DarkTrack+Alien+4.1 Legit Copy (1).rar
- SHA256 f7fbc70d8ade17021be6dab695467b4e4b970012f2f0705e7a3cf564df563a1c
Overview
overview
10Static
static
10DarkTrack+...px.exe
windows10-2004-x64
5DarkTrack+...px.exe
windows11-ltsc_2024-x64
5DarkTrack+...ta.exe
windows10-2004-x64
3DarkTrack+...ta.exe
windows11-ltsc_2024-x64
3DarkTrack+...er.exe
windows10-2004-x64
3DarkTrack+...er.exe
windows11-ltsc_2024-x64
3DarkTrack+...eg.exe
windows10-2004-x64
3DarkTrack+...eg.exe
windows11-ltsc_2024-x64
3DarkTrack+...e3.dll
windows10-2004-x64
5DarkTrack+...e3.dll
windows11-ltsc_2024-x64
5DarkTrack+...e3.dll
windows10-2004-x64
3DarkTrack+...e3.dll
windows11-ltsc_2024-x64
3DarkTrack+...er.dll
windows10-2004-x64
5DarkTrack+...er.dll
windows11-ltsc_2024-x64
5DarkTrack+...ub.exe
windows10-2004-x64
10DarkTrack+...ub.exe
windows11-ltsc_2024-x64
10Resubmissions
08/08/2026, 00:20
260808-amxlcaag551008/08/2026, 00:11
260808-agzhraej5x1029/03/2023, 22:40
230329-2llw1aab6629/03/2023, 22:31
230329-2fqb8sbg6t10Analysis
- custom tags
evasion anti-termination
Behavioral task
behavioral1
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Compressors/upx.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Compressors/upx.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Darktrack 4.1 Beta.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Darktrack 4.1 Beta.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Mescaline File Binder/Mescaline Multi File Binder.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Mescaline File Binder/Mescaline Multi File Binder.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Modules/ffmpeg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Modules/ffmpeg.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Plugins/sqlite3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Plugins/sqlite3.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/stub/stub.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target DarkTrack+Alien+4.1 Legit Copy (1).rar
- Size 15.0MB
- Sample260808-amxlcaag55
- SHA256 f7fbc70d8ade17021be6dab695467b4e4b970012f2f0705e7a3cf564df563a1c
- MD5 26b8cceb9c0bc52a9265053289ed3141
- SHA1 c3af5912c4104697e0a53672854f3f1e6dcb25e0
- SHA512 2db0dedf0c0457ed43a0ec0e218ea634d57903b72416bea7b70e3428565b0a8fc662cf7ffd97987a8490c21b154c86c7b869412f7c2e3214e3ad56dcd6c71693
- SSDEEP 393216:Sp+xS/coviYgeUNDA1H0Kw1VvUk/CQWYnjAVo8:+ZFTXTw1VvmQbnjC
- TLSH T184F633647442DB01B0B4E47A2ABC88B43B358A6BD4D057DA61647F3DF1DCCAD7C622B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- DarkTrack payload 1 IoCs
resource yara_rule static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/stub/stub.exe family_darktrack - Custom signatureDetects potential process-critical anti-termination behavior 1 IoCs
Detects RtlSetProcessIsCritical or NtSetInformationProcess references associated with process criticality, likely causing a BSOD upon terminating the program.
resource yara_rule static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/stub/stub.exe Detect_ProcessCritical_AntiTermination - ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Plugins/sqlite3.dll acprotect static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll acprotect -
resource yara_rule static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Darktrack 4.1 Beta.exe aspack_v212_v242 static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Mescaline File Binder/Mescaline Multi File Binder.exe aspack_v212_v242 -
resource yara_rule static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Compressors/upx.exe upx static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Plugins/sqlite3.dll upx static1/unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll upx - Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Compressors/upx.exe unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Darktrack 4.1 Beta.exe unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Mescaline File Binder/Mescaline Multi File Binder.exe unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Modules/ffmpeg.exe unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Plugins/sqlite3.dll unpack003/out.upx unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3.dll unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll unpack004/out.upx unpack001/DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/stub/stub.exe
File Explorer
-
DarkTrack+Alien+4.1 Legit Copy (1).rar.rar 15.0MB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Compressors/upx.exe.exe 283KB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Darktrack 4.1 Beta.exe.exe 2.9MB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Data/DataBase.db9KB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Mescaline File Binder/Mescaline Multi File Binder.exe.exe 878KB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Modules/ffmpeg.exe.exe 29.4MB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Plugins/sqlite3.dll.dll 171KB
-
out.upx.dll 336KB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/settings.ini94B
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3.dll.dll 245KB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll.dll 171KB
-
out.upx.dll 336KB
-
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/stub/stub.exe.exe 627KB
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Compressors/upx.exe
- SHA256 c0f9faffdf14ab2c853880457be19a237b10f8986755f184ecfe21670076cb35
- MD5 308f709a8f01371a6dd088a793e65a5f
- SHA1 a07c073d807ab0119b090821ee29edaae481e530
- SHA512 c107f1af768d533d02fb82ae2ed5c126c63b53b11a2e5a5bbf45e396cb7796ca4e7984ce969b487ad38d817f4d4366e7953fb555b279aa019ffb5d1bbba57e28
- SSDEEP 6144:EBgzKMDrn1MUQ8Kr4eNyJf2EycBqABfpV6xSyQy9CZ07Yf+1+ujToS:v5rn6JfXCjUafpVeDQyUXfW+u/oS
- TLSH T1EB5423980AF63084F47B437A88856729D149A36F9EF04ACE6CCC179D3DB74252F2913B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1555024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
281KB
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Darktrack 4.1 Beta.exe
- SHA256 90e4c9da7a502d71c88b0d8e58a5f4f884de9d6d5c73b753923568784f0302fd
- MD5 92c0d76303d0d2ea83a35c03d6b28a15
- SHA1 60d3d9e16b202cf8d3a9c2dca9a843f5da65bcb8
- SHA512 1d8b67f16d93f839806aaa979297f31ede91df314211f8fe51e1c562164ebdacd14d73e2ece13ea4adf1f69d6a58cf0e266eae0c4ce710f040c9fdc137c372c4
- SSDEEP 49152:6HOK7MnMFtPSudmESq3Qiv+5cTTTTvYlVTYp/tWLRs0uNc9vCrdzVMGQ:6HOAaMnq6+q3SATTzGypMLoAv+VMGQ
- TLSH T1CBD5330AA4D3187ADCED54B90998C3B8F25BDD524A69B702B0D09F5FB3EE184D7C1263
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13848577
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
1.1MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.itext
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
20KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.6MB
Virtual Size
9.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
73KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Data/DataBase.db
- SHA256 b974aa3bbf8569ead530978778db835f34fe9e107a39b77ba4e63fd500f88ed4
- MD5 ca5749d6bc67e67f2369c2a47f26e9fd
- SHA1 5c36552942c939d6b3ccfd69c918361d0db02736
- SHA512 37e6823e7545ef7a677fee9cac30895726726b621c4300472ad899d4947dae75bb1a37d64a03b3c2e4c23aabf59d4e2e5f9251d057fb90b17597191d4d48789f
- SSDEEP 96:pMNx5RZryenRsC54C59C5g8OmoGHSm2IJWRaTWRaWC54C59C5fWWRaXWRah:gIenRsCaC7Cm8Omo9mWCaC7C6
- TLSH T1FB123611A3E8120CF2BB6FB66FF7A4559D7AB9359E35D25D2054424E0871E10EE20B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Mescaline File Binder/Mescaline Multi File Binder.exe
- SHA256 80eb6c0204241543f26412c21af9b8d9bc89c20dc24f2d2efff4d674c9e6f350
- MD5 4580bc445dfad7d046e7440b1c179c33
- SHA1 3c48788e35c4113ddc289747a699ec4691a37ba0
- SHA512 6c57117728986d89f59d404e169824dfe16047ddf8727da0c47e21062b60771b96401d23b667df0120b710b7679f6dd6e2b1215a96c02d93497769b18f88afad
- SSDEEP 12288:+sDZtFKbuUoy5LCiE0XNIWP2xo7/nZ9kkeeENH2:1FKKDICiPXNBP1nEeK2
- TLSH T19515004E7AE7A64FCF805B30B9A5D06868EA5D37A91255B232437F8ECD3E511C983313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2002945
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
457KB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.itext
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
6KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
500KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
367KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Modules/ffmpeg.exe
- IMPHASH a05575a4ef06bc557b834a488509da27
- SHA256 1abee4a7dbe8f624290054c14ef7b58db19e93df976c2adb8ff4bd20974c3a78
- MD5 f25eef8a89531e8a78340b2a682d6047
- SHA1 a3d495987c8fad02b828475020904aedfd2c92ca
- SHA512 28f0f857299655be4e5badd4f044156935f0f60256127e6e8bf1341728d895ec619e8ebb543e1b971e1046f1308242aa9105365bd0a5a1eba432c3c4cf21a115
- SSDEEP 393216:eUubj/bPa0l4tk5vDJS81QhKloaXu1xsBsmpe+k:ej/O0l4y1r+Xo
- TLSH T183677C82EAC781F2E8470970815BF77F6B346F09C420CE76EE84BB46FA73B51151A259
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
DeregisterEventSource
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceA
ReportEventA
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreA
gdi32
BitBlt
ChoosePixelFormat
CombineRgn
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDIBSection
CreatePalette
CreateRectRgn
DeleteDC
DeleteObject
DescribePixelFormat
GetBitmapBits
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetDeviceGammaRamp
GetObjectA
GetStockObject
GetSystemPaletteEntries
GetSystemPaletteUse
RealizePalette
SelectObject
SelectPalette
SetDIBColorTable
SetDeviceGammaRamp
SetPaletteEntries
SetPixelFormat
SetSystemPaletteUse
SwapBuffers
UnrealizeObject
kernel32
AllocConsole
CloseHandle
CreateConsoleScreenBuffer
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetCommandLineW
GetConsoleCursorInfo
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentVariableA
GetFileAttributesA
GetFileAttributesExA
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleW
GetNumberOfConsoleInputEvents
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathA
GetThreadContext
GetThreadPriority
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalUnlock
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExA
MoveFileExW
MultiByteToWideChar
OpenProcess
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputA
ReadFile
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleActiveScreenBuffer
SetConsoleCursorInfo
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleTitleA
SetConsoleWindowInfo
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetLastError
SetProcessAffinityMask
SetThreadAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteConsoleOutputW
WriteConsoleW
WriteFile
lstrcpyA
lstrcpynA
msvcrt
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_aligned_free
_aligned_malloc
_aligned_realloc
_amsg_exit
_beginthreadex
_cexit
_close
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_findclose
_findnext
_fmode
_fstati64
_ftime
_ftime64
_fullpath
_get_osfhandle
_getch
_initterm
_iob
_lock
_lseeki64
_mbsrchr
_mkdir
_mktemp
_onexit
_open
_rmdir
_setjmp3
_setmode
_snprintf
_snwprintf
_sopen
_stat
_stati64
_vsnprintf
time
mktime
localtime
gmtime
calloc
clock
cosh
div
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
frexp
fscanf
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getchar
getenv
gmtime
isalnum
isalpha
islower
isprint
isspace
isupper
isxdigit
localeconv
localtime
log10
malloc
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
putchar
puts
qsort
raise
rand
realloc
rename
rewind
setlocale
setvbuf
signal
sinh
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
_strdup
_stricmp
_strnicmp
_unlink
_unlock
_wfopen
_wmkdir
_wrename
_write
_wrmdir
_wsopen
_wstati64
_wunlink
abort
acos
asin
atan
atan2
atof
atoi
atol
tan
tanh
time
tolower
toupper
ungetc
vfprintf
vsprintf
wcscmp
wcscpy
wcslen
wcsstr
bsearch
_wfindnext
_wfindfirst
_findfirst
longjmp
_hypot
_write
_wcsdup
_unlink
_tempnam
_strdup
_setmode
_rmdir
_read
_putenv
_open
_kbhit
_isatty
_getpid
_getch
_fileno
_fdopen
_close
_chmod
_access
ole32
CoCreateInstance
CoGetMalloc
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateBindCtx
oleaut32
OleCreatePropertyFrame
SysFreeString
psapi
GetProcessMemoryInfo
shell32
CommandLineToArgvW
user32
AdjustWindowRect
AdjustWindowRectEx
BeginPaint
CallWindowProcA
ChangeDisplaySettingsA
ClientToScreen
ClipCursor
CopyIcon
CreateCursor
CreateIconFromResourceEx
CreateWindowExA
DefWindowProcA
DestroyCursor
DestroyIcon
DestroyWindow
DispatchMessageA
DrawIcon
EndPaint
EnumDisplaySettingsA
FindWindowA
FrameRect
GetClassInfoA
GetClientRect
GetCursor
GetCursorInfo
GetCursorPos
GetDC
GetDesktopWindow
GetForegroundWindow
GetIconInfo
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardState
GetMenu
GetMessageA
GetParent
GetProcessWindowStation
GetShellWindow
GetSystemMetrics
GetUserObjectInformationW
GetWindowLongA
GetWindowRect
InvalidateRect
IsZoomed
KillTimer
LoadCursorA
LoadImageA
LoadKeyboardLayoutA
MapVirtualKeyA
MapVirtualKeyExA
MapWindowPoints
MessageBoxA
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RegisterClassA
ReleaseCapture
ReleaseDC
ScreenToClient
SendMessageA
SetCapture
SetClassLongA
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowRgn
SetWindowTextA
ShowWindow
ToAsciiEx
ToUnicode
TranslateMessage
UnregisterClassA
WindowFromPoint
wsprintfA
winmm
joyGetDevCapsA
joyGetNumDevs
joyGetPosEx
mciGetErrorStringA
mciSendCommandA
timeBeginPeriod
timeEndPeriod
timeGetTime
timeKillEvent
timeSetEvent
waveOutClose
waveOutGetErrorTextA
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
ws2_32
WSACleanup
WSAEnumNetworkEvents
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
22.0MB
Virtual Size
22.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rotext
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
302KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
6.9MB
Virtual Size
6.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rodata
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
8.2MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Plugins/sqlite3.dll
- SHA256 33eb31a2a576e663474a895ff0190316c64a93d9ce05a55df0d53f9beeb61163
- MD5 744dcc4cbbfbb18fe3878c4e769ec48f
- SHA1 c1f2c56ee2d91203a01d3465f185295477a1217d
- SHA512 706630be2ca09e574a7794e32e515a0a3f993643d034647b8cb976c1e7045e87e30362757cc65fcdb95f4a4327f0dcda3edc82ba84e5ed9115870a037e13af21
- SSDEEP 3072:4yOtgCNPbAHuzueAlwsKmiiEHpmBt7tjBwHH1ELXvSsmB8teUOhKJz4ZKJNCT1xe:FOtRsOz2xKmGH8JBwn+2smB1Uf8Kurb
- TLSH T1270412C5E86F9F6EF4C6C47ED6EB80D3D00818B0CBF5E282D66DF3262D6910825A1658
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
356864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_complete
sqlite3_complete16
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_handle
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_held
sqlite3_mutex_leave
sqlite3_mutex_notheld
sqlite3_mutex_try
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_sql
sqlite3_step
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
Name
UPX0
Size
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
165KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=26, id=14, version=7299,
count=3, id=19, version=8034,
count=94, id=1, productName=Unmarked objects,
count=76, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
out.upx
- SHA256 717118ffe9060081710cd6333549504004c9515df743f696b3c63eb7b2065407
- MD5 43ed6f508ba523e0a3b9224392755ea7
- SHA1 8b1e0ec29ab3759d1cec9a01ab4a323e4238684e
- SHA512 cc6b6f112217b466c9c746f7647b833cc62ebe3e0aa2f03439e361fac9964b065c216ada2e4ac19ff5404eb6e663239dbad90b9dee94cd4c173c2667ff522fda
- SSDEEP 6144:rICvMnOTvcfgA0qBlJ89Ojo33C1oVDtY4sG2/WctyzuYf0oRCL23/:zvMnAA9BleOjoH4Ktm+jbFL3/
- TLSH T1FD747D43DAD3C0F1DA8521B522B75B3BDE3657072117DA83E7D8ED914922322F62E389
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253593
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
268KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=26, id=14, version=7299,
count=3, id=19, version=8034,
count=94, id=1, productName=Unmarked objects,
count=76, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/settings.ini
- SHA256 26d370b520a6e9c5718af7c4988af7d060212f65b060b2bdd8dc5578980f5bea
- MD5 acd1690740a1e60ea2894f7d509e78e2
- SHA1 9d29020fa7cb52dd5afcdebb4f790f53fcb31965
- SHA512 7410c94434c435ad9ef88b06e7fee9cea47824f84806901447790fea98e17b922c641952b0b030003246fc5e245e22002bbcfb673617d6923ec446103a486b39
- TLSH T14FB012277205659C7B3A006211A30CE4F7630D814151098B47670C0DEC7DEBD443A1C6
- MD5 SHA1 SHA512 TLSH
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3.dll
- IMPHASH 40512658f087f2990d621c454c392124
- SHA256 629fd65a87d6d08503e45348ecc7c337f4921f35e47356e8fab6f3007039c280
- MD5 a2eba4b5199074dbe91fae77e1050d8a
- SHA1 f144c5e64068eaa923d9244c134681e418148077
- SHA512 917032c8ee533c46876ae43b6dd7a85f03293eda67c1710685bb07fbe12d2300742f53c024d81905b199061453950a5238856cf498b97cc83314debb35ac1a40
- SSDEEP 6144:t6n+TCgWV8ZC0YeCiR6HKJzgv1/DiF4nqinO:w+T7oMYeCiR6HKJ8No
- TLSH T190345C13E912CD32C45316B44224073AE668D2B46985F456FBC6F97FABB21C1BA3C31E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
EnterCriticalSection
FlushFileBuffers
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetVersionExA
InitializeCriticalSection
InterlockedIncrement
LeaveCriticalSection
LockFile
LockFileEx
MultiByteToWideChar
ReadFile
SetEndOfFile
SetFilePointer
Sleep
UnlockFile
WideCharToMultiByte
WriteFile
msvcrt
_iob
atoi
free
isalnum
isdigit
isspace
isxdigit
localtime
malloc
memcpy
memset
realloc
sprintf
strcat
strcmp
strcpy
strncmp
strncpy
tolower
toupper
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_commit_hook
sqlite3_complete
sqlite3_complete16
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_function
sqlite3_create_function16
sqlite3_data_count
sqlite3_db_handle
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_mprintf
sqlite3_open
sqlite3_open16
sqlite3_prepare
sqlite3_prepare16
sqlite3_progress_handler
sqlite3_reset
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_snprintf
sqlite3_step
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vmprintf
Name
.text
Size
233KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll
- SHA256 33eb31a2a576e663474a895ff0190316c64a93d9ce05a55df0d53f9beeb61163
- MD5 744dcc4cbbfbb18fe3878c4e769ec48f
- SHA1 c1f2c56ee2d91203a01d3465f185295477a1217d
- SHA512 706630be2ca09e574a7794e32e515a0a3f993643d034647b8cb976c1e7045e87e30362757cc65fcdb95f4a4327f0dcda3edc82ba84e5ed9115870a037e13af21
- SSDEEP 3072:4yOtgCNPbAHuzueAlwsKmiiEHpmBt7tjBwHH1ELXvSsmB8teUOhKJz4ZKJNCT1xe:FOtRsOz2xKmGH8JBwn+2smB1Uf8Kurb
- TLSH T1270412C5E86F9F6EF4C6C47ED6EB80D3D00818B0CBF5E282D66DF3262D6910825A1658
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
356864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_complete
sqlite3_complete16
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_handle
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_held
sqlite3_mutex_leave
sqlite3_mutex_notheld
sqlite3_mutex_try
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_sql
sqlite3_step
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
Name
UPX0
Size
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
165KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=26, id=14, version=7299,
count=3, id=19, version=8034,
count=94, id=1, productName=Unmarked objects,
count=76, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
out.upx
- SHA256 717118ffe9060081710cd6333549504004c9515df743f696b3c63eb7b2065407
- MD5 43ed6f508ba523e0a3b9224392755ea7
- SHA1 8b1e0ec29ab3759d1cec9a01ab4a323e4238684e
- SHA512 cc6b6f112217b466c9c746f7647b833cc62ebe3e0aa2f03439e361fac9964b065c216ada2e4ac19ff5404eb6e663239dbad90b9dee94cd4c173c2667ff522fda
- SSDEEP 6144:rICvMnOTvcfgA0qBlJ89Ojo33C1oVDtY4sG2/WctyzuYf0oRCL23/:zvMnAA9BleOjoH4Ktm+jbFL3/
- TLSH T1FD747D43DAD3C0F1DA8521B522B75B3BDE3657072117DA83E7D8ED914922322F62E389
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253593
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
268KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=26, id=14, version=7299,
count=3, id=19, version=8034,
count=94, id=1, productName=Unmarked objects,
count=76, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
DarkTrack+Alien+4.1 Legit Copy (1)/DarkTrack+Alien+4.1/DarkTrack Alien 4.1/stub/stub.exe
- IMPHASH ee46edf42cfbc2785a30bfb17f6da9c2
- SHA256 98fb43736370f72edda152a0c6e5edeab4ffcd9e1c5b4da932b63e0b786c4161
- MD5 edc9c0a3eaaf592dba89ec3735ef022b
- SHA1 4c1196733e6bafa0b7d3e078896d0937111a9440
- SHA512 4f1bbaff8d4a046cbde6dc82ff4c0b2adcb7604417b0498cc234f7aa1d28fe73545d69605ae64ab51404687ea5b4bbe88f037a867f1171cfcfd18f5e511752ef
- SSDEEP 12288:BOqvQomCg4G6q90tmPvj+GU/ttJuqwh3EQiXRUVZs4ixsiNhkApRaw:9oovgbAKvBgtJuqwh3EQihUb1ifNh
- TLSH T158D4B031F2828537E1630EB48C1BA2A65529BF501E39F54B77F41E4C9EBD291382A3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DarkTrack payload
-
Detects potential process-critical anti-termination behavior
Detects RtlSetProcessIsCritical or NtSetInformationProcess references associated with process criticality, likely causing a BSOD upon terminating the program.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
407024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
RegOpenKeyA
RegFlushKey
RegEnumValueA
RegEnumKeyExW
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueA
LookupPrivilegeNameA
LookupPrivilegeDisplayNameA
GetUserNameA
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
AdjustTokenPrivileges
StartServiceA
QueryServiceStatus
QueryServiceConfigA
OpenServiceA
OpenSCManagerA
GetServiceDisplayNameA
EnumServicesStatusA
ControlService
CloseServiceHandle
user32
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
mouse_event
keybd_event
VkKeyScanA
UnregisterClassA
TranslateMessage
ToUnicodeEx
SystemParametersInfoA
ShowWindow
SetWindowTextA
SetWindowLongA
SetKeyboardState
SetForegroundWindow
SetFocus
SetCursorPos
SetClipboardData
SendMessageA
ReleaseDC
RegisterClassA
PostQuitMessage
PostMessageA
PeekMessageA
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxA
MapVirtualKeyExA
MapVirtualKeyA
LoadStringA
LoadIconA
LoadCursorA
IsWindowVisible
IsWindow
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetSystemMetrics
GetSysColor
GetMessageA
GetKeyboardState
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetDesktopWindow
GetDC
GetClipboardData
GetClientRect
GetClassInfoA
GetAsyncKeyState
FindWindowExA
FindWindowA
FillRect
ExitWindowsEx
EnumWindows
EnableWindow
EmptyClipboard
DrawIconEx
DispatchMessageA
DestroyWindow
DestroyIcon
DefWindowProcA
CreateIcon
CloseClipboard
CharNextA
CharLowerBuffA
CharUpperBuffA
CharUpperA
CharToOemA
PrintWindow
BlockInput
LockWorkStation
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrlenA
lstrcpyA
lstrcmpA
lstrcatA
WriteProcessMemory
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAllocEx
VirtualAlloc
TerminateThread
TerminateProcess
SystemTimeToFileTime
SuspendThread
Sleep
SetThreadPriority
SetThreadLocale
SetPriorityClass
SetNamedPipeHandleState
SetFilePointer
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
ReadProcessMemory
ReadFile
OpenProcess
MultiByteToWideChar
MulDiv
MoveFileA
LockResource
LocalFree
LoadResource
LoadLibraryA
LeaveCriticalSection
IsBadReadPtr
InitializeCriticalSection
HeapFree
HeapAlloc
GlobalUnlock
GlobalReAlloc
GlobalMemoryStatus
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetVersionExA
GetUserDefaultLangID
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemDirectoryA
GetStdHandle
GetStartupInfoA
GetShortPathNameA
GetProcessTimes
GetProcessHeap
GetProcAddress
GetPrivateProfileStringA
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetComputerNameA
GetCPInfo
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceExA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitProcess
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessA
CreatePipe
CreateMutexA
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CompareStringA
CloseHandle
Sleep
OpenThread
GetVersionExW
gdi32
UnrealizeObject
StretchBlt
SetWinMetaFileBits
SetTextColor
SetStretchBltMode
SetROP2
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetBrushOrgEx
GetBitmapBits
GdiFlush
ExtTextOutA
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
mpr
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
ole32
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
shell32
ShellExecuteA
SHGetFileInfoA
SHFileOperationA
DragQueryFileW
SHGetSpecialFolderPathA
ShellExecuteA
wsock32
WSACleanup
WSAStartup
WSAGetLastError
gethostbyname
gethostbyaddr
socket
shutdown
sendto
send
recv
ioctlsocket
inet_ntoa
inet_addr
htons
connect
closesocket
bind
netapi32
NetApiBufferFree
NetShareEnum
crypt32
CryptUnprotectData
CryptUnprotectData
winmm
waveInUnprepareHeader
waveInStart
waveInReset
waveInPrepareHeader
waveInOpen
waveInClose
waveInAddBuffer
mciSendStringA
ntdll
RtlSetProcessIsCritical
powrprof
IsPwrShutdownAllowed
msvcrt
_gcvt
msacm32
acmStreamUnprepareHeader
acmStreamPrepareHeader
acmStreamConvert
acmStreamReset
acmStreamSize
acmStreamClose
acmStreamOpen
iphlpapi
GetAdaptersInfo
shfolder
SHGetFolderPathA
Name
.text
Size
391KB
Virtual Size
390KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
23KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ