NovaTools_8C18+.rar
- SHA256 2695438fe00f2012d0af10ec8ee850b6d59091e061d0d096f14e6bced31aa9f7
Overview
overview
7Static
static
3NovaTools_8C18+.rar
windows10-2004-x64
7NovaTools_8C18+.rar
windows11-ltsc_2024-x64
1Common.dll
windows10-2004-x64
1Common.dll
windows11-ltsc_2024-x64
1Installer.exe
windows10-2004-x64
3Installer.exe
windows11-ltsc_2024-x64
3Uninstaller.exe
windows10-2004-x64
3Uninstaller.exe
windows11-ltsc_2024-x64
3dinput8.dll
windows10-2004-x64
3dinput8.dll
windows11-ltsc_2024-x64
3input.vbs
windows10-2004-x64
5input.vbs
windows11-ltsc_2024-x64
5Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NovaTools_8C18+.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
NovaTools_8C18+.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Common.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Common.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installer.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
Uninstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
Uninstaller.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
dinput8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
dinput8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
input.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
input.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target NovaTools_8C18+.rar
- Size 724KB
- Sample260820-rysj7sdr2v
- SHA256 2695438fe00f2012d0af10ec8ee850b6d59091e061d0d096f14e6bced31aa9f7
- MD5 089e4ca02f0e4ea53554bbc41bf41e28
- SHA1 2d77d5b06363310b632b96962492ca9e096cdc3e
- SHA512 2e3f22880905cdf6d85664c1d6b5d4d356bc2bb769303ff517d2146443536576d60a1aab78019a181fbf87b70b73180276a801e8a0481f61bc9402b2ef6aff6b
- SSDEEP 12288:vblcd1IcgYWB9pXuW/QDwnV8sjoqkHLL7QSyPAZl1/5pjKa/j9:RcdjgYWbpoKl+tUKvKE
- TLSH T1F9F423397AD6220AA4082CF8E88FDBB2E0B05E4499DD33DCF1CA7E4B40859559CDD7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Common.dll unpack001/Installer.exe unpack001/Uninstaller.exe unpack001/dinput8.dll
File Explorer
-
NovaTools_8C18+.rar.rar 724KB
-
Common.dll.dll 9KB
-
Installer.exe.exe 5KB
-
Uninstaller.exe.exe 5KB
-
dinput8.dll.dll 1.7MB
-
input.vbs.vbs 973B
Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d598fbbe3c1811c59a30f81fa384fd15af877d45961fe199ab9a888963ef2c3
- MD5 d718a3351fe00336d78517396e2b46e0
- SHA1 e38692da530c7802be2644810abd5bbf11ce617a
- SHA512 a87a81973d8eedc564148e6eeb0c11035ca4deef4233ab3f3b76e2ed3e882242efdb812019e96a36a38d7d24b3fd76c4ac234c98743e3e2cb91418cc437303af
- SSDEEP 192:THGXkMAidu5N0R+pgt9FEC3LvfA6llNasRFGU:aXkMu58+pK9iCLg6LoYX
- TLSH T17D12FA8A9778CA2FD815033AA8A30B0617B0EB0CE6126B975F709427BC6B71552613F5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Emre\source\repos\RevLimiterSetup\RevLimiterCommon\obj\Release\Common.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
672B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Installer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b4745511b89b603c6682255cb0cecaa387bebc992917ff625b35ee4831a9386f
- MD5 9c1ad1f690939c62454256eded975e2a
- SHA1 adf3a8a3934ac4c51ef71401bcca2095aa932ae6
- SHA512 f91a1e1c526aabe1e1992c382ee88be369e20ee7e4f2044b288d4e6e93743acb3bfe92a02dbdf74b3a91947d819a1b238b2085fa50176072dfb2c656762c0c79
- SSDEEP 48:6CUfhRvucyo0lOFZPwTPyJgQ4khvj09fcO6g+Wi+JaeqCBhXOuljXiqspfbNtm:yio0ggQ4U0mOhi+1/xXuzNt
- TLSH T139C1540193F4526AF2778B30BEF343510570BA91AD76D75D2A84150FAD22B548DA3FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Emre\source\repos\RevLimiterSetup\RevLimiterInstaller\obj\Release\Installer.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Uninstaller.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 317da34218e8864e5a545ee93b7149252ae75923f98a01b9b139a05d507c4204
- MD5 7f0560820303d26b320acc2810ef55a2
- SHA1 b868cfcfe3163a5727f66f1eceeffc0825cb9181
- SHA512 5073c5aa3e18e1db39b1f47d1ff81aef2fe3d332535a421245e768e87139bbf748703ed9211d72824090be47d2efa4b4e34b41dd2a7d23e4c88d158c4846a766
- SSDEEP 96:vI+ss50WUueO450YcOCDQy67zpahE97xzNt:vI+ssvxZSlHz/X
- TLSH T1A4C19406A3F4436EE17B4B34BDF302510A70BE11AE36DB6D2980151B6D62B558DA3FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Emre\source\repos\RevLimiterSetup\RevLimiterUninstaller\obj\Release\Uninstaller.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dinput8.dll
- IMPHASH 7a595821b9681ca8d32f77e992c805a3
- SHA256 0427b72415bb1bab17437bca89e1af0edb52c5115edd6a198b40c12a0fc0d007
- MD5 f01febcb541c2a678406818d9840094b
- SHA1 c7165eb02890f31d3925e1ab2db6ca7fad90e4c1
- SHA512 fbdb4ad5e16541246b6cb43a0e08837e191cbb6cdd760adb9214324e902b068abf015b2d9aa1bf3168cb238ec6fe59466ec33619680741c58ddc62f8eedf8127
- SSDEEP 24576:HA/RDzfBiXznNt/UbBuC6DqiVPX58bSKnQUvB8fqePNGLcFh0lhSMXlliVRVV7bn:HMdwXznP2uZDqSCKomYL7UfVVq3Zw
- TLSH T12785CF50F98781B2D2D801B0717F7F6F4A39585C572050D3B3E86DAC99A02E23BBBB56
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1070736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetConsoleTextAttribute
GetStdHandle
LoadLibraryW
GetModuleFileNameA
GetVolumeInformationA
FreeLibraryAndExitThread
ExitThread
CreateFileA
DisableThreadLibraryCalls
CreateThread
SetUnhandledExceptionFilter
WritePrivateProfileStringW
GetPrivateProfileStringW
K32GetModuleInformation
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
GetCurrentThreadId
Thread32First
Thread32Next
GetCurrentProcess
HeapFree
VirtualProtect
HeapCreate
VirtualQuery
VirtualAlloc
VirtualFree
QueryPerformanceCounter
FreeLibrary
OpenThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetFullPathNameW
SleepEx
VerSetConditionMask
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetTickCount
GetEnvironmentVariableA
SetLastError
MoveFileExW
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
WaitForSingleObjectEx
VerifyVersionInfoW
CreateFileW
GetFileSizeEx
FormatMessageW
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
SetThreadContext
FlushInstructionCache
GetCurrentProcessId
GetProcAddress
QueryPerformanceFrequency
InitializeSListHead
LoadLibraryA
GetLocaleInfoA
GetThreadContext
HeapDestroy
HeapAlloc
CloseHandle
HeapReAlloc
GetLastError
Sleep
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetFileInformationByHandleEx
GlobalFree
GlobalAlloc
EnterCriticalSection
MultiByteToWideChar
user32
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
CloseClipboard
EmptyClipboard
GetClipboardData
TrackMouseEvent
GetKeyboardState
GetWindowThreadProcessId
SetClipboardData
GetClassNameA
SetWindowLongA
CallWindowProcA
GetWindowTextA
EnumWindows
DefWindowProcA
CreateWindowExA
UnregisterClassA
RegisterClassExA
MessageBeep
GetAsyncKeyState
MessageBoxA
GetKeyState
GetMessageExtraInfo
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
OpenClipboard
DestroyWindow
advapi32
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
GetUserNameA
shell32
ShellExecuteW
SHGetKnownFolderPath
ole32
CoTaskMemFree
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?good@ios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??Bios_base@std@@QBE_NXZ
_Query_perf_frequency
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?id@?$numpunct@D@std@@2V0locale@2@A
_Query_perf_counter
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
_Mbrtowc
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xlength_error@std@@YAXPBD@Z
_Mtx_lock
_Xtime_get_ticks
_Mtx_unlock
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
dbghelp
MiniDumpWriteDump
bcrypt
BCryptGenRandom
vcruntime140
__CxxFrameHandler3
__std_terminate
strstr
strchr
__std_exception_destroy
__std_exception_copy
_CxxThrowException
memchr
memcpy
memmove
memset
strrchr
wcschr
__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
api-ms-win-crt-stdio-l1-1-0
feof
ftell
__acrt_iob_func
_wopen
fflush
fclose
fputs
fseek
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
__stdio_common_vfprintf
_read
fgetc
_write
_lseeki64
fgets
fputc
_fileno
fwrite
__stdio_common_vsscanf
fread
_close
__stdio_common_vsprintf
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
free
_callnewh
malloc
realloc
_aligned_malloc
_aligned_free
api-ms-win-crt-string-l1-1-0
strspn
strpbrk
strcspn
strncmp
wcsncpy
wcsncmp
_strdup
tolower
strncpy
api-ms-win-crt-convert-l1-1-0
strtoll
atoi
mbstowcs
_wcstoi64
strtod
_itow
wcstombs
_wtoi
wcstof
strtoull
atof
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_time64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_fullpath
_wstat64
_unlock_file
_lock_file
_unlink
_fstat64
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initialize_narrow_environment
_configure_narrow_argv
_errno
abort
_beginthreadex
terminate
_initterm
__sys_errlist
__sys_nerr
_initialize_onexit_table
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
exit
api-ms-win-crt-math-l1-1-0
_fdclass
_libm_sse2_log_precise
ceil
_libm_sse2_cos_precise
_libm_sse2_pow_precise
_ldclass
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_CIfmod
_fdopen
_libm_sse2_acos_precise
_dsign
_fdsign
_ldsign
_dclass
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
ws2_32
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAIoctl
WSASetLastError
setsockopt
send
recv
ntohs
getaddrinfo
getsockopt
gethostname
htonl
sendto
recvfrom
listen
select
__WSAFDIsSet
ioctlsocket
freeaddrinfo
getsockname
WSACleanup
WSAStartup
WSAWaitForMultipleEvents
WSAGetLastError
closesocket
htons
socket
accept
bind
connect
getpeername
crypt32
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
iphlpapi
if_nametoindex
secur32
InitSecurityInterfaceW
DirectInput8Create
GetdfDIJoystick
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
581KB
Virtual Size
581KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=35721,
count=6, id=253, version=35721,
count=12, id=259, version=35721,
count=10, id=260, version=35721,
count=33, id=261, version=35721,
count=140, id=260, version=30159,
count=1, id=262, version=33145,
count=502, id=1, productName=Unmarked objects,
count=31, id=257, version=33145,
count=20, id=261, version=30159,
count=40, id=265, version=36252,
count=1, id=256, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,
input.vbs
- SHA256 ad490366496cd4a24b1068c75a21d77e25771d573f577bab27e5de1ed9634e61
- MD5 dfd0db5ef77293170f030c6e9c8e1876
- SHA1 9c02298e861aec18f5c35904f076c6a1d6513c8f
- SHA512 294810f08566dc0def9828d16b4fa32f5ce1b0c6ccc4e74ec0fa96b20e88f95635ec02c344b0759716ac413c56109b33b4e4b1a275ed90249733b88aa3d7dd7a
- TLSH T1FC11E1662E4EF1A392B0865A53F3C298E34BC1783225D1C47C24C0403B18A9F4DF3D7A
- MD5 SHA1 SHA512 TLSH