Furever-Dock_1[.]5[.]0_windows-x64-prod-main-74d5d382-setup[.]exe

resource
Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/Furever Dock.exe
unpack001/ffmpeg.exe

Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 b184962fadb05e94aa985d6bc6c0626553643dbdba2959913a93a3b1735118bc
MD5 b8e85ee58d8c7cf4c72deb830dc545f4
SHA1 829e0584e1e21b061669fc7874d39bab9fd295f1
SHA512 a8cb68dd16509eae4323409567e40adeb5830b95d7f5264fe66229052846f1dbd82f5164f754a465e3118a15c27cf78790ef08ddf159c294f5f29fc14d223d0c
SSDEEP 3145728:dhFd1qBWQyK1WGt0eeI5yCBR0lqG1UJnnPEwW+rfsOHWTG:hrqWMWJLIFBRDJnPbrfj2TG
TLSH
T175583338E9C93069D8B4763AE1DD98594755FB7107C2C543673AC2BF36F0388AA6FA04
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

Furever Dock.exe

IMPHASH 7b2fae7ef5d8890ca62434456f41b52e
SHA256 fae3d81155b549bf32e5566c30c716bc9b0e89ffc67cff249a8497128918d52b
MD5 b7cdf273bdbc78d385f18b217d286f23
SHA1 31540ba6136c6975bf843c6dc570ac58bb98f701
SHA512 85fde49ba8ea7d1d1d73501b79d4a99eb29ec0b0b26d26c5aaba9e53fc47bc60a14b77e87e480377cafb90bbdaf7da3e8226347a42a6a72f604f12aa3d31ddc5
SSDEEP 3145728:CAv6LYD4+xMger4Dm8BUGwDSjtBBO2zcsAQo7:CAy0D4FgerpwwDSI2zcZQo7
TLSH
T1FF4801616B5A996CD09AC474838B8A724A7130DB0B35B9FF449496383F6DBF42F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12505580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kitty_screen.pdb

kernel32

IsDebuggerPresent GetTickCount64 IsProcessorFeaturePresent RtlPcToFileHeader GetModuleHandleA Sleep GetProcAddress RaiseException EncodePointer TlsGetValue TlsAlloc FormatMessageW LoadLibraryExA TlsFree UnhandledExceptionFilter GetLastError SetUnhandledExceptionFilter InitializeSListHead FindNextFileW GetTempPathW SetWaitableTimer CreateWaitableTimerExW RtlUnwindEx GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW GetModuleHandleW GetSystemTimeAsFileTime WakeAllConditionVariable DeleteFileW DeviceIoControl CreateSymbolicLinkW SleepConditionVariableSRW CreateMutexA WaitForSingleObjectEx SwitchToThread GetSystemInfo ExitProcess InitOnceExecuteOnce FindClose FindFirstFileExW CopyFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread GetCurrentThreadId AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW TerminateProcess GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW TlsSetValue GetUserDefaultUILanguage GetEnvironmentStringsW GetFileInformationByHandleEx SetHandleInformation GetSystemTimePreciseAsFileTime OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW FreeLibrary RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle LoadLibraryA GetCurrentProcess GetFinalPathNameByHandleW ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetFullPathNameW SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW HeapFree ReleaseMutex DeleteCriticalSection RtlVirtualUnwind HeapAlloc GetProcessHeap CreateMutexW AcquireSRWLockShared lstrlenW MoveFileExW CreateFileW SetNamedPipeHandleState AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock SetLastError LCIDToLocaleName WideCharToMultiByte SetThreadStackGuarantee LoadLibraryW GetStdHandle GetConsoleMode CloseHandle GetFileInformationByHandle GetFileAttributesW SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult InitializeCriticalSectionAndSpinCount

advapi32

RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegGetValueW EventUnregister SystemFunction036 RegDeleteValueW EventRegister RegCloseKey EventSetInformation EventWriteTransfer

oleaut32

GetErrorInfo SetErrorInfo SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

ntdll

NtCreateFile NtDeviceIoControlFile NtWriteFile NtCancelIoFileEx RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile RtlGetVersion NtReadFile

shell32

Shell_NotifyIconGetRect Shell_NotifyIconW ShellExecuteW SHCreateItemFromParsingName ILFree ILCreateFromPathW ShellExecuteExW SHOpenFolderAndSelectItems SHGetKnownFolderPath DragQueryFileW DragFinish SHAppBarMessage

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

user32

OffsetRect GetMenuBarInfo DestroyMenu CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenuItemInfoW AppendMenuW InsertMenuW PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable GetMenuItemInfoW PeekMessageW PostMessageW SetWindowPos SetMenu DrawIconEx TrackPopupMenu ChangeWindowMessageFilterEx GetWindowDC CreateIcon GetKeyboardState MapVirtualKeyExW EnumChildWindows GetKeyState SetWindowTextW DrawTextW GetLastInputInfo GetWindowTextLengthW SendInput SetForegroundWindow DestroyIcon SetWindowDisplayAffinity SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem PostThreadMessageW DefWindowProcW GetSystemMenu VkKeyScanW GetRawInputData GetKeyboardLayout EnumDisplayMonitors ScreenToClient DispatchMessageA MonitorFromPoint GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible GetAsyncKeyState RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterWindowMessageA SetParent MapWindowPoints GetWindow DestroyWindow FindWindowW SetFocus ShowWindow ReleaseDC GetWindowRect GetParent FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled IsProcessDPIAware GetDC AdjustWindowRect RegisterClassExW TranslateMessage DispatchMessageW TranslateAcceleratorW SetWindowLongPtrW GetWindowLongPtrW GetMessageW CreateWindowExW GetMessageA IsIconic SendMessageW SetTimer KillTimer RegisterClassW GetWindowTextW GetForegroundWindow ToUnicodeEx RedrawWindow RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos DrawMenuBar InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor LoadCursorW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW

comctl32

SetWindowSubclass DefSubclassProc TaskDialogIndirect RemoveWindowSubclass

ole32

CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree RevokeDragDrop CoTaskMemAlloc OleInitialize RegisterDragDrop CoCreateFreeThreadedMarshaler CoInitializeEx

gdi32

SetTextColor SetBkMode GetDeviceCaps CreateRectRgn DeleteObject CreateSolidBrush BitBlt CombineRgn CreateCompatibleDC DeleteDC SelectObject CreateDIBSection

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

WSAStartup WSACleanup freeaddrinfo getaddrinfo closesocket WSASocketW bind listen getpeername accept getsockopt getsockname WSAGetLastError recv WSASend send setsockopt ioctlsocket connect shutdown WSAIoctl

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

crypt32

CertFreeCertificateContext CertCloseStore CertFreeCertificateChain CertFreeCertificateChainEngine CertOpenStore CertAddEncodedCertificateToStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy CertGetCertificateChain CertCreateCertificateChainEngine

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

round roundf pow trunc floor __setusermatherr ceil

api-ms-win-crt-string-l1-1-0

strcpy_s strlen wcscmp _wcsicmp strcmp wcsncmp wcslen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _initterm _set_app_type _seh_filter_exe terminate _configure_narrow_argv _crt_atexit _register_onexit_function _initialize_onexit_table _initterm_e _wassert abort _register_thread_local_exe_atexit_callback _errno _c_exit exit _cexit _exit __p___argv __p___argc

api-ms-win-crt-convert-l1-1-0

_wtoi strtol wcstol _ultow_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fopen fgets __p__commode fseek ferror feof _set_fmode fclose _setmode fwrite fread __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fflush __acrt_iob_func ftell _fileno

api-ms-win-crt-heap-l1-1-0

free _callnewh calloc _set_new_mode realloc malloc

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

companions/0440456d-7e77-4441-8afb-9d45a9bcc141/standing.png

SHA256 c8497f4fa0d2a98dd9bd5203ce28fa6df797ddff1bd55f24a348ed0a728c32cb
MD5 5e3ed494b8a30f2be233dc48d3ac1e29
SHA1 b335813b46cefc6f82a847902d247cda3e59444f
SHA512 4955dda3daf81879863f7fea6eb05890c54cff21fc0d7ff6ed38303620bdb670fd4c00385e2bde8e5b26b28c973e0606a14486b1340d764401d7b9ca7218903f
SSDEEP 12288:kZs5UFdIjycWGVuSvbu21C71hn4Zz9NIrmEdH9+XUwf7JWdblFoqq:kKUFe4qFbu2GHn4ZZEdH9+kFoh
TLSH
T10BC42381A95BAFF1E50783B54A60FBDD343A5C91E219130BBF76D33B08BD31A2527912
MD5 SHA1 SHA512 SSDEEP TLSH

companions/15e46b03-65d6-4f00-8ccc-32f9d07a8738/standing.png

SHA256 8fdceb9ddbe2d5dddeeb6a6633f1680feeb07f1232f54d9a5d5b3fc7ab3b8bdb
MD5 92fb7ae7d1a892bb69d77020b3d66ab5
SHA1 577df3cb12267ad7887071dfa6bb96c01855471e
SHA512 d32df0e718d5cd4c25f5c8469380076f044baeb2d8a99487d014be57e8c4171023bce5d68dc8111dfc76e2ba34d52a8e153aac752c0b122cd0eec0619db7d3fe
SSDEEP 12288:3BLrhPXTHQjhhiYgyqwbLOJHLNwYJUYwxOe+L77jl:xfh/ghiWO5LGYw4l
TLSH
T13BB423C6EC42D161DDAF267A30435BA1C5874341EB21767D53B3ECAA8B4138B4788F6B
MD5 SHA1 SHA512 SSDEEP TLSH

companions/20bce790-39ba-440f-9c87-1f6d9c2cf537/standing.png

SHA256 4ac2e68caf7232edc5235b7a8aa2e66a4a3a679200120f86f3a1059eb51d4004
MD5 33c87d901c618bde05d2bd3c2aebf459
SHA1 cc440480e2cbff2b83990a3946bcb2f7f967220f
SHA512 f28ddbd6f1ea488bd90c40e3218643143f916496ca4a67b045c337b61b02a594bea7276c5dd2f001703fc9b369eaa6f1637e7c407b7a0bde93a2275a051f3f1c
SSDEEP 12288:QFJhJWoXytrNS//3+mb0oXVhQrc+Iqt2JRjn+FCnCsx8Se3mW7:gJioXytxYf+c0oXOIqwJRjvCm8Skl
TLSH
T19DC42360CBC7E3A6DC0B7475E1014B601F616145A7AAABA4737B827CDFA018E97CFD06
MD5 SHA1 SHA512 SSDEEP TLSH

companions/25e6fc48-f3b8-4d4e-85c1-334ce3b013fd/standing.png

SHA256 59607ad41401400924620be08e0a3b7c0b69889c92489852b55bd57dd8429917
MD5 8c52f1dd8bac4114db80ca6688f09b0e
SHA1 7e90bcd26053d5c33b2192fec7cac98533131750
SHA512 2589620fc99c266f14723c8ac0e244ed483bc4c02fdbb39f5d6896a842d82f32dc67eec039b68692833fb21428720c5d657bb598c9ccf57e934d67f915c02255
SSDEEP 12288:cjI6Ui1xVikGdvLSe7w8oDKLfOHTsFide1PT2:J6Z1jiRdGec3HQiElT2
TLSH
T126942360895D1AB5F5C3DF39E6E0223F09737DC9DF7972218064D88C76602A81ADDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

companions/2cadbb63-e7a2-4f33-b527-4f05f3334982/standing.png

SHA256 1e01e5d7d102e53b379b12f3c8b823e1eb7168e5d3a46cdb867158eb1549d6e1
MD5 7eecb2711dff3f35491e06e9a8dc0beb
SHA1 cb69db709d402b4048d27eef6310e04c00cb04c8
SHA512 08510904f4763a4ed6e6eade67354a730271bee5fa8941fcc8967f787a2a0d88df2e9d461822b6cfd292700937a27db9cd46fa9c925d93f78b1565c8fcde78ea
SSDEEP 12288:iAYq6iG4JGyf2jA54me61XvHWXL2ymlRStpoyp:iAYq6ibJGqr1PWXL3Z5p
TLSH
T12294125AE09F8FF2E4AE19F97CC9CAB08B955A52DBD9230E0395C9552F012701DC3E27
MD5 SHA1 SHA512 SSDEEP TLSH

companions/42594fea-14c1-43c5-815c-45918d70fcdd/standing.png

SHA256 4040013ead7f6564eda922e769842032b74a4166905b1d9fe99cde03bce42fb4
MD5 18f35ad5ef91aa9a7ea8a996a9ecdd68
SHA1 7c66d315bd76ee469076cf18ff11701f457fa65c
SHA512 1f7f5419150b033cc6ebe24b78e7f0676a0aae317d572560804379997488204f17c751cbb6937b5ddf026fcae48e9437c70d6377cb9dfc859db0b28d9aced040
SSDEEP 6144:phvZspUnOqKQ4aB7RM8seqWxNJ2CWVmnGNZzT0OdlasYl/hhn0obRwFnx0YD2A32:phvxngQ4adRM8srWxTVnGNZEOdlapl/F
TLSH
T1188423C49F6F4466EAE690358AC0467FA963147314927503FF24BC87CEDA3C65272ACB
MD5 SHA1 SHA512 SSDEEP TLSH

companions/4ace9341-f97f-49fd-a205-9d8b9bde1b58/standing.png

SHA256 13bbd4ec484ec9b436ee2b0d3a6b32d6a5926221d8d6ef9967b0a6ca1184123f
MD5 2acfb8568aa98c9c84d6ec1bcc2b7859
SHA1 d836134737b6427c38699b25db36fa7d48b96bc6
SHA512 48aac6b5178ad0ce88acdb38fd41bdace11d7f873626f0140670c876dbb1f4c53cb8cabe64f26bde6a4454379d5e06df0f6dfa61e05566d43dfca17820d0b6e9
SSDEEP 6144:6fppUaQFYlkVvllqEBqueSSHQfAbPzkwXA03E8F46/gbNdVDc3AuWaBTVwLClc:c0FYlIvtO3w44wX/FSN7DDuzc
TLSH
T1CB942280CD252BA2C46E3370446DAF0B479A56F957BD272F807AF4195C8974502F7BCB
MD5 SHA1 SHA512 SSDEEP TLSH

companions/4d498efd-4127-4ac2-ab36-f2818f0f0831/standing.png

SHA256 e97eeb57e815c2d1207d9b2ecb41e7e1d39e8a5be8925d9c0380583aad3fbdef
MD5 98d2272a1883ec87bb0a685852f1a776
SHA1 d83914f28b2d016f6e34d608f689dc1418a6d893
SHA512 55414676e4269288968c4d53837d14ad4aff55d06ebceb53c96279791b2118fc35904d23b2c5e7aca1ae1019d1ddcd4cb51762ab0827bd932203feccd1c6d892
SSDEEP 12288:k1u1vPRi+GRBqEQklpMlBs9MMIgHFBYhbv:k1u++GRkEQk7MA9M5n5
TLSH
T110A42397F80B51A4F413CA35C3A1512C9BDE9A41236EB290C371692BEE3E3B69376D14
MD5 SHA1 SHA512 SSDEEP TLSH

companions/53dfd2fd-c222-4b5b-a1dc-898e981a326b/standing.png

SHA256 0ecd5b9063dfd3f1adfe7d0132a66ce1d8207951d1024226a2c056f507812df4
MD5 74903e5f397ff29f14f671bef390d382
SHA1 657b85f3ec5ee88d67db841b93e086f5be404b75
SHA512 3d9e1f7702ed7cc59ae4dc6a5b67e6743bc8e9a5101c374e6252c3afa4cc334695d14728f26fd3008331785ded48de311e4081189ec298e45e5fdc069940f9d3
SSDEEP 6144:yx96HJcX0zn/4g1UZFQqUG+kSqRcAsq2eI68JRG+k+AHMZ4Skk5qAZdOfaXjYf+m:6UH2qIOUsxu3sKsZdOfaX0f+m
TLSH
T111A423D2C1A6A331DC5F3570B92A0774052110A4C7EEAE357B77E4DEEB0A34D904AF9A
MD5 SHA1 SHA512 SSDEEP TLSH

companions/65222ad2-73c1-4f4d-985c-b78a049fec0c/standing.png

SHA256 a510a58875ff9c59afd1da535e726e7f0fd0563dcaf15f7c616e6572701df341
MD5 9c3025351db5101e3f7baf61a1e65bf2
SHA1 37643a5331aaedde595fd6d2d2fb93576cb7530f
SHA512 6eaaad5ec4d9e6afe47e5d4154130fcbce4f0767dbc8f503f1e275be6edcfd8724543df259860e6d9de7a00bc064b97c4ad1f56270e98bc739334f6474961cba
SSDEEP 6144:BcTJJiynepKSdyhmhOslr7BNGiLJ6roPQaggkch63bcXR:8HepKEyhmFl3jfJ6ZYdhBB
TLSH
T1BD74220D971689F5C1A65DFCC8997B48E3B07007975E0970BA2CE2967C5FB34C6BAB02
MD5 SHA1 SHA512 SSDEEP TLSH

companions/72410967-ea19-42c4-bf7c-40741b4969cb/standing.png

SHA256 a11b30b7a2db11eca56b22e3f47d3af328565dc742223d6a821d0622ab5027f3
MD5 aea8766d020181429ae443b3a7ee6451
SHA1 ea5127fbd7924eb28d3a57aefb2ec283154aca6b
SHA512 56dcd0fc2d6990d59e8944405fa49213762e5f86c8e8694ca1ca681efca8291e9d58a5c3a26fb286def43b8c1c1f2f4650ceb373aa2d39c8967e45a718dd86e2
SSDEEP 12288:YW2RvTh/6401VP9YRO80nycf1Ercl725M1kt1/o8b1u:jw64ybYRo9f1V25M+/o2k
TLSH
T19EA42274AD471AACDB1FD631F0D68E2AA192C5060D12533D5BBA41FA9FACA724E0D703
MD5 SHA1 SHA512 SSDEEP TLSH

companions/8156b180-6c9e-4190-8890-81ce0fad38c3/standing.png

SHA256 71abf18dbc3542b2eba7e72ccdb552ffb6b052fd452635ea35451891c2fc65b4
MD5 0b1cfaf197294318cd02cbd148709ba1
SHA1 280a613fc1942520014685130fc40cf030ddd549
SHA512 44b7b1c17503c34beca097ea927712f75e8b06e1d59a73c7dfeb2d8ba787c83205c900587cfa4fd2cb51197601b4c3d2a5e34cec636b0e16d50da3f6cbbb5804
SSDEEP 12288:okxpkvZAOnrq2VNU9lLO/1lyiDql55jT6mAjUz:svZAgrqQNKla/XyiDJmz
TLSH
T13CC423616DE0D1B1C8DE5A724875800C1D6A193283C9EFDA8375F6952F9F3710AE7EC2
MD5 SHA1 SHA512 SSDEEP TLSH

companions/85fd516a-3d29-41a5-9300-ed06bbfdce15/standing.png

SHA256 e8f1b576a6e679fd9b52129b7407a5a6d5459d6862f9019daa17118a8f1fd73c
MD5 1101d476815a18ed63801b8cab788073
SHA1 3d4eb05f5a120f6be22f4fc1e624825d91d97475
SHA512 dd0610c3fc46814521dde5ed2673b48ded613202fb72da3b3ff9b55051da93672f4d159b8099fac83412178b42e42faa2e5627210990afb6c9db009c2f513ed3
SSDEEP 12288:WvvQtkg13iAEJUE1lXH1bALpyxzx9uJ3PUi403:FioEJUE/XH1b2czDW4S
TLSH
T1D5A423C499AF56F2C733A4385D7E1E42F2A281AD450E7B061B7F7A83160F9B105C6F22
MD5 SHA1 SHA512 SSDEEP TLSH

companions/8dd76180-4537-4afb-9e42-b2b8c6620630/standing.png

SHA256 f9f5bf5c6d207722c47bfabe57f502ecbdedf9c950b50303e8896accaa7bbdcb
MD5 653b8bdb2c8d217dc8776b1207915e09
SHA1 4538feb3b37cb046d5ce7ea5fde0250abc9b7435
SHA512 dc55feffc0201dc34dbd90b750ac6fa2fc02fbfee42348b91bf5278e37288d26a66448a6c759bf89a50c10d596355a60c9701485476272aa191460f0aaa96d57
SSDEEP 6144:Vv2zbjF3ceAnl1eRtiLEH9FLj+Z1bLbbMJvS/62KzrLvIC34R+bZm:Vv+bJ3qnDUtHjQbLboJvS/8zNoRyZm
TLSH
T17F6412D4F1C9971ED210CB34389793F9AB84C67B4B260EB9A13BFC4D8BCBB15651484A
MD5 SHA1 SHA512 SSDEEP TLSH

companions/970d89b4-b318-4da3-97b5-9cb2e3ae6ea7/standing.png

SHA256 96aada8e3d094b6a814b3f5654d69abaf2898f4fad14c0343415ae2998f78dfb
MD5 a3e892c3abbf97fcbbb34a828c42aa11
SHA1 d1f61e41ae0be3d9a587b87377568631979689ea
SHA512 8d7fa15c7525a88ca3991b51199575ef0e864f6b32b3cd5d3724c4f28b6de8e9473df1e85da366ed0b9d6dfb94faa32362c9c50f25250940de5e1820546e73f2
SSDEEP 12288:T/kAPGmZemaNczItwlO+2XmKEUQJycAvT:LXV5NnlN2XL4AvT
TLSH
T1369423A9FCD04AB8CF46E97E882FAF7E17D74023F78842BA52F5D419981A3900456F02
MD5 SHA1 SHA512 SSDEEP TLSH

companions/9c06dcbb-b4de-435d-9df0-1f9712d7452e/standing.png

SHA256 0eba818b3b5b1b2cbdd538dabbda1de2739d6f1a4396f7aae82ddb4a2b6946da
MD5 6aec20367f409a54920075b7718e1787
SHA1 199d39c9c6bce0a61c68f53fb76a8c53a0f058b9
SHA512 58e4c2ac7f48274d1159e740290fb0cf7d1a1830d64ca39b0c96cf6632ccf00eca36b35735482bea7cb0a6b26c8ee9282b7ae3027db337f096d41aa7cba11f56
SSDEEP 12288:4caLan47Qrbm6Kw4lR8V18p2s8FyeBZG9x+E7aTxvXFNnpY+FDuFA:Bn40nmOSKVWgkq8N7CtFcouFA
TLSH
T14CC42309954B52F1CEAB38F6A19209684F1B2D3217036B3B5FF1F44D6E1366A58C7BC2
MD5 SHA1 SHA512 SSDEEP TLSH

companions/abe495c2-2a5f-4528-a2ef-6a1d7e242650/standing.png

SHA256 b0db22d7181518933aaef584ae992293e82b79b32d05c7f998d8d147bf34d216
MD5 ec06db1034da607a181a1349d2bf3b8a
SHA1 357a8f05ec05d1ff0c3572306f5eb681fc6de2b6
SHA512 5d70a7bbd24085ba52ef942048102651bdee4468e4958a19532152dd6d6f22202d27800f4eb8f77f9c5c362e97b56dd31f01e2f5f7123487803e0690ca3acb04
SSDEEP 12288:BxpHw5NyycPB3JPtvHKtsStoUx+1LnOpF7FLxy88+b3:ByNyyKBrKsJUx8LoF7pk88o
TLSH
T12CA41387707F65B1DCAE5A76DC4B8B120381458077D62722FBA3884E2D027597CA7BD2
MD5 SHA1 SHA512 SSDEEP TLSH

companions/ac5a0273-76cd-402a-b5e3-b9011a9ee96a/standing.png

SHA256 d9acb21a8dc3266aa67ed53daab18341c7f82806958a70b06de420e2ef3369e5
MD5 0089d971eec70764b9e5eb1b9658b3c5
SHA1 83aaae3c42d32d9b62b39eb0149a7159a27e1953
SHA512 606a6a3fcf1f648d4540b2d5327d4495e0c3d11c7b3d100aafd0743d914c643ff928195260791032c7bddd397c6ca7d2e580067d2940f3e12c79526ade9dfcfc
SSDEEP 12288:E2SL7BRcA67dKZ/sf3l/uwIKtouRasrxVIQ3UlR:EhETx8q1cuwsrZUv
TLSH
T16AB423ECCD0E65F0D97928B57B28055B40B2054A9A257523BF7EE187ADD73860C32CD7
MD5 SHA1 SHA512 SSDEEP TLSH

companions/b0cbbb34-7470-4a83-aca0-2f4cb9f99ba9/standing.png

SHA256 e4d81c27468693a371f7a0674556245039f991b2b37f480cc0319e80bad01502
MD5 57e136f1f83f7f046ce3d41785dfc39b
SHA1 a7cc6a7a8627ca5baca9a5d505be1b016d96569c
SHA512 2ae22e8175088c0abad896cd65e2b1e43f3b880b736e50463d0530ff8910f1f55c4e5f8309bcfecece4871ec4a74bf6e10ccb1a3b8760a7a464a626b2a6de333
SSDEEP 12288:y8+wNGQxEsl+Vi4uEGQQlymcXx1VeegqQs1/emvBs6as1T:L+Lsl+Vi4uEYzcXMegrsFemHaS
TLSH
T103A423F6E4B353F0E687D7389A290A991DCD4440691BA7BC5531DA6A8BAC331D2B4C0F
MD5 SHA1 SHA512 SSDEEP TLSH

companions/companions.json

SHA256 e78dda1dfe2bdfdaccb573674558e89d8ef769705eacd400761be9be42330999
MD5 7b17bd57d48c37148f14129305f13082
SHA1 9df139a3604fa1c1b2897061bc8b778893dfd5f9
SHA512 91e9d1b2672094df292ff3306c3d85d1ec03bc8b1fbbd8818766cdb34ec57d02226c162bb22879c1140fdce2f63ee327479dd115efe89f8493483572088c9be1
SSDEEP 192:ni6HX3WDGAG5EqeF4Mfj9/qpBRYXNZSs80j8c:8Gif6B7sh
TLSH
T173225233C8762C3707F440532C6A0A23F655EB9F131D589B38BEAA9E6F76A0121554B8
MD5 SHA1 SHA512 SSDEEP TLSH

companions/de9f8c8e-c79e-4c20-9fb3-4dda3ff9fd9d/standing.png

SHA256 b93558a1f07321c1854399b78244945f831e248f8409b69e61a74686fe4747ff
MD5 1498fd7c786e0da4e65f9b43ae10ca00
SHA1 40c9c3644f3e539833bc11a8e7a4fd3bdad8048e
SHA512 101746bfec9dcf35b503c705358258c8d77673b702bfde3c1a3c629691f9c3063991e39d1027b56b768c3f1d4989a9536d2279abe0acf6cb115285973740e699
SSDEEP 6144:ThInTWkxFK2KYDUauhs6HgeCZpRsCX58a+EFyumgN2T/uUHdCT6AGKdzA8u5smr1:T6n6kxF1KYDUaCsg4RJr7Y75kT6qeTsC
TLSH
T1F2841282FC9A14A1EC87853A66EF2F03C928F85FD99097B623B1E5454F08B14174FED9
MD5 SHA1 SHA512 SSDEEP TLSH

ffmpeg.exe

IMPHASH 62b0daa49f511fd8cdee198c3a6f9e54
SHA256 e9fd5e711debab9d680955fc1e38a2c1160fd280b144476cc3f62bc43ef49db1
MD5 5b19d3cffebcf8746b52c39f90208a88
SHA1 bb008c51dd6b223eac88373241ccb54587a4243b
SHA512 136c242ba9f3ef8d21972c26b08c253f5d49f75bb8fc28bab477cb781283e0ff48f89fd11c9df848dcbb6203fdfae8055bc3f1514272cdf994a3f6f8dfeac80b
SSDEEP 1572864:Jgfb1P0bQyTwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhk:GW
TLSH
T1E1088E9EE2D350DCD12BD4F043AAF773BA24B83D11206A7A26D9DA306D22FC0575AF54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptGenRandom CryptGetHashParam CryptGetProvParam CryptReleaseContext CryptSetHashParam CryptSetProvParam CryptSignHashA DeregisterEventSource GetUserNameA InitializeSecurityDescriptor RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl SystemFunction036

crypt32

CertCloseStore CertDeleteCertificateFromStore CertEnumCRLsInStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore PFXImportCertStore

gdi32

BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateFontW CreatePen CreateRectRgn CreateSolidBrush DeleteDC DeleteObject DescribePixelFormat EnumFontFamiliesW ExtTextOutW GetDIBColorTable GetDIBits GetDeviceCaps GetDeviceGammaRamp GetICMProfileW GetObjectA GetPixelFormat GetStockObject GetTextExtentPoint32A GetTextExtentPoint32W GetTextFaceW GetTextMetricsW Rectangle SelectObject SetBkMode SetDeviceGammaRamp SetPixelFormat SetTextColor SwapBuffers

imm32

ImmAssociateContext ImmGetCandidateListW ImmGetCompositionStringW ImmGetContext ImmGetIMEFileNameA ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionStringW ImmSetCompositionWindow

iphlpapi

GetAdaptersAddresses if_indextoname if_nametoindex

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI CancelIo CancelIoEx CloseHandle CompareStringA ConvertFiberToThread ConvertThreadToFiberEx CreateDirectoryW CreateEventA CreateEventW CreateFiberEx CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateSemaphoreA CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFiber DeviceIoControl DuplicateHandle EnterCriticalSection EnumResourceLanguagesA EnumSystemLocalesA ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageA FormatMessageW FreeLibrary GetACP GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleA GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocaleInfoA GetLongPathNameA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNumaHighestNodeNumber GetNumaNodeProcessorMaskEx GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadLocale GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetTimeZoneInformation GetVersion GetWindowsDirectoryA GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSRWLock IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExA MoveFileExW MulDiv MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetCurrentDirectoryW SetDllDirectoryA SetEnvironmentVariableA SetErrorMode SetEvent SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadErrorMode SetThreadExecutionState SetThreadGroupAffinity SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableCS SuspendThread SwitchToFiber SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrcmpiW

msvcrt

___lc_codepage_func ___mb_cur_max_func __argv __getmainargs __initenv __iob_func __set_app_type __setusermatherr _access _access _aligned_free _aligned_malloc _aligned_realloc _amsg_exit _assert _beginthreadex _cexit _chmod _close _commode _close _dup _dup2 _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _findclose _fileno _findfirst64 _findnext64 _fmode _fstat64 _ftime64 _fullpath _get_osfhandle _getch _getcwd _getmaxstdio _getpid _gmtime64 _hypot _i64toa _initterm _isatty _isctype _itoa _kbhit _localtime64 _lock _locking _lseeki64 _ltoa _mbsrchr _mkdir _mkdir _mktime64 _onexit _open _open _open_osfhandle _read _rmdir _rmdir _read _nextafter _setjmp _setmaxstdio _setmode _setmode _sopen _stat64 _strdup _strdup _stricmp _strlwr _strnicmp _strrev _strtoi64 _strtoui64 _strtoui64 _strupr _time64 _ui64toa _ultoa _unlink _unlink _unlock _vscprintf _vsnprintf _vsnwprintf _waccess _wassert _wcsdup _wcsicmp _wcsnicmp _wfindfirst64 _wfindnext64 _wfopen _wfullpath _wgetcwd _wgetenv _wmkdir _wopen _wrename _write _wrmdir _wsopen _wstat64 _wunlink abort acos asin atan atof atoi bsearch calloc clock cosh div exit fclose feof ferror fflush fgetc fgetpos fgets fopen fopen_s fprintf fputc fputs fputwc fread free fsetpos fwprintf fseek ftell fwrite getc getchar getenv getwc isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper iswctype isxdigit localeconv log10 longjmp malloc mbstowcs memchr memcmp memcpy memmove memset perror printf putc puts putwc qsort raise rand realloc rename rewind setlocale setvbuf signal sinh sprintf srand strcat strchr strcmp strcoll strcpy strcpy_s strcspn strerror strftime strlen strncat strncmp strncpy strncpy_s strpbrk strrchr strspn strstr strtok strtok_s strtol strtoul strxfrm tan tanh tolower toupper towlower towupper ungetwc ungetc vfprintf wcscat wcschr wcscmp wcscoll wcscpy wcscpy_s wcsftime wcslen wcsncmp wcsrchr wcsstr wcstombs wcstombs_s wcstoul wcsxfrm

ncrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider NCryptDecrypt NCryptDeleteKey NCryptFreeObject NCryptGetProperty NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash

ole32

CLSIDFromString CoCreateInstance CoGetMalloc CoInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateBindCtx OleLoadFromStream OleSaveToStream PropVariantClear StringFromGUID2

oleaut32

OleCreatePropertyFrame SysFreeString

setupapi

CM_Get_Device_IDA CM_Get_Parent CM_Locate_DevNodeA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW ExtractIconExW SHGetFolderPathW SHGetSpecialFolderPathA ShellExecuteW

shlwapi

SHCreateStreamOnFileA

user32

AdjustWindowRectEx AttachThreadInput BeginPaint CallNextHookEx CallWindowProcW ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CopyIcon CopyImage CreateIconFromResource CreateIconIndirect CreateWindowExA CreateWindowExW DefWindowProcA DefWindowProcW DestroyCursor DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageA DispatchMessageW DrawIcon DrawTextW EmptyClipboard EndDialog EndPaint EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsW FillRect FindWindowW FlashWindowEx FrameRect GetAsyncKeyState GetClassInfoExW GetClientRect GetClipCursor GetClipboardData GetClipboardSequenceNumber GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDlgItem GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMessageExtraInfo GetMessageW GetMonitorInfoW GetParent GetProcessWindowStation GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetUpdateRect GetUserObjectInformationW GetWindowLongPtrA GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IntersectRect InvalidateRect IsClipboardFormatAvailable IsIconic IsRectEmpty KillTimer LoadCursorA LoadCursorW LoadIconW MapVirtualKeyW MessageBoxA MessageBoxW MonitorFromPoint MonitorFromRect MonitorFromWindow OpenClipboard PeekMessageA PeekMessageW PostMessageW PostThreadMessageW PtInRect RegisterClassExA RegisterClassExW RegisterClassW RegisterDeviceNotificationW RegisterRawInputDevices RegisterWindowMessageA ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageA SendMessageW SetActiveWindow SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropW SetTimer SetWindowLongPtrA SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage UnhookWindowsHookEx UnregisterClassA UnregisterClassW UnregisterDeviceNotification ValidateRect

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

winmm

timeBeginPeriod timeEndPeriod waveInAddBuffer waveInClose waveInGetDevCapsW waveInGetNumDevs waveInOpen waveInPrepareHeader waveInReset waveInStart waveInUnprepareHeader waveOutClose waveOutGetDevCapsW waveOutGetErrorTextW waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveOutReset waveOutUnprepareHeader waveOutWrite

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEventSelect WSAGetLastError WSAIoctl WSARecvFrom WSASendTo WSASetLastError WSASocketA WSAStartup WSAStringToAddressA WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

FT_Activate_Size FT_Add_Default_Modules FT_Add_Module FT_Angle_Diff FT_Atan2 FT_Attach_File FT_Attach_Stream FT_Bitmap_Blend FT_Bitmap_Convert FT_Bitmap_Copy FT_Bitmap_Done FT_Bitmap_Embolden FT_Bitmap_Init FT_Bitmap_New FT_CeilFix FT_Cos FT_DivFix FT_Done_Face FT_Done_FreeType FT_Done_Glyph FT_Done_Library FT_Done_MM_Var FT_Done_Size FT_Error_String FT_Face_GetCharVariantIndex FT_Face_GetCharVariantIsDefault FT_Face_GetCharsOfVariant FT_Face_GetVariantSelectors FT_Face_GetVariantsOfChar FT_Face_Properties FT_FloorFix FT_Get_Advance FT_Get_Advances FT_Get_BDF_Charset_ID FT_Get_BDF_Property FT_Get_CMap_Format FT_Get_CMap_Language_ID FT_Get_Char_Index FT_Get_Charmap_Index FT_Get_Color_Glyph_ClipBox FT_Get_Color_Glyph_Layer FT_Get_Color_Glyph_Paint FT_Get_Colorline_Stops FT_Get_First_Char FT_Get_Font_Format FT_Get_Glyph FT_Get_Glyph_Name FT_Get_Kerning FT_Get_MM_Blend_Coordinates FT_Get_MM_Var FT_Get_MM_WeightVector FT_Get_Module FT_Get_Multi_Master FT_Get_Name_Index FT_Get_Next_Char FT_Get_PS_Font_Info FT_Get_PS_Font_Private FT_Get_PS_Font_Value FT_Get_Paint FT_Get_Paint_Layers FT_Get_Postscript_Name FT_Get_Renderer FT_Get_Sfnt_LangTag FT_Get_Sfnt_Name FT_Get_Sfnt_Name_Count FT_Get_Sfnt_Table FT_Get_SubGlyph_Info FT_Get_Track_Kerning FT_Get_Transform FT_Get_TrueType_Engine_Type FT_Get_Var_Axis_Flags FT_Get_Var_Blend_Coordinates FT_Get_Var_Design_Coordinates FT_Get_X11_Font_Format FT_GlyphSlot_Own_Bitmap FT_Glyph_Copy FT_Glyph_Get_CBox FT_Glyph_Stroke FT_Glyph_StrokeBorder FT_Glyph_To_Bitmap FT_Glyph_Transform FT_Has_PS_Glyph_Names FT_Init_FreeType FT_Library_SetLcdFilter FT_Library_SetLcdFilterWeights FT_Library_SetLcdGeometry FT_Library_Version FT_List_Add FT_List_Finalize FT_List_Find FT_List_Insert FT_List_Iterate FT_List_Remove FT_List_Up FT_Load_Char FT_Load_Glyph FT_Load_Sfnt_Table FT_Matrix_Invert FT_Matrix_Multiply FT_MulDiv FT_MulFix FT_New_Face FT_New_Glyph FT_New_Library FT_New_Memory_Face FT_New_Size FT_Open_Face FT_Outline_Check FT_Outline_Copy FT_Outline_Decompose FT_Outline_Done FT_Outline_Embolden FT_Outline_EmboldenXY FT_Outline_GetInsideBorder FT_Outline_GetOutsideBorder FT_Outline_Get_Bitmap FT_Outline_Get_CBox FT_Outline_Get_Orientation FT_Outline_New FT_Outline_Render FT_Outline_Reverse FT_Outline_Transform FT_Outline_Translate FT_Palette_Data_Get FT_Palette_Select FT_Palette_Set_Foreground_Color FT_Property_Get FT_Property_Set FT_Reference_Face FT_Reference_Library FT_Remove_Module FT_Render_Glyph FT_Request_Size FT_RoundFix FT_Select_Charmap FT_Select_Size FT_Set_Char_Size FT_Set_Charmap FT_Set_Debug_Hook FT_Set_Default_Log_Handler FT_Set_Default_Properties FT_Set_Log_Handler FT_Set_MM_Blend_Coordinates FT_Set_MM_Design_Coordinates FT_Set_MM_WeightVector FT_Set_Named_Instance FT_Set_Pixel_Sizes FT_Set_Renderer FT_Set_Transform FT_Set_Var_Blend_Coordinates FT_Set_Var_Design_Coordinates FT_Sfnt_Table_Info FT_Sin FT_Stream_OpenLZW FT_Stroker_BeginSubPath FT_Stroker_ConicTo FT_Stroker_CubicTo FT_Stroker_Done FT_Stroker_EndSubPath FT_Stroker_Export FT_Stroker_ExportBorder FT_Stroker_GetBorderCounts FT_Stroker_GetCounts FT_Stroker_LineTo FT_Stroker_New FT_Stroker_ParseOutline FT_Stroker_Rewind FT_Stroker_Set FT_Tan FT_Trace_Set_Default_Level FT_Trace_Set_Level FT_Vector_From_Polar FT_Vector_Length FT_Vector_Polarize FT_Vector_Rotate FT_Vector_Transform FT_Vector_Unit TT_New_Context TT_RunIns gme_ay_type gme_clear_playlist gme_delete gme_enable_accuracy gme_equalizer gme_free_info gme_gbs_type gme_gym_type gme_hes_type gme_identify_extension gme_identify_file gme_identify_header gme_ignore_silence gme_kss_type gme_load_custom gme_load_data gme_load_file gme_multi_channel gme_mute_voice gme_mute_voices gme_new_emu gme_new_emu_multi_channel gme_nsf_type gme_nsfe_type gme_open_data gme_open_file gme_play gme_sap_type gme_seek gme_seek_samples gme_set_autoload_playback_limit gme_set_equalizer gme_set_fade gme_set_stereo_depth gme_set_tempo gme_set_user_cleanup gme_set_user_data gme_spc_type gme_start_track gme_tell gme_tell_samples gme_track_count gme_track_ended gme_track_info gme_type gme_type_extension gme_type_list gme_type_multitrack gme_type_system gme_user_data gme_vgm_type gme_vgz_type gme_voice_count gme_voice_name gme_warning gme_wrong_file_type

Name

.text

Size

62.6MB

Virtual Size

62.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

905KB

Virtual Size

905KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

252KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer