Orbit.zip
- SHA256 0519c2e32e5525669129bbe38a202584a8c4823711c2d6155038ca83d8e11f2d
Overview
overview
8Static
static
3Dependenci...64.exe
windows10-2004-x64
4Dependenci...64.exe
windows11-ltsc_2024-x64
4Orbit.exe
windows10-2004-x64
5Orbit.exe
windows11-ltsc_2024-x64
5OrbitLauncher.exe
windows10-2004-x64
8OrbitLauncher.exe
windows11-ltsc_2024-x64
8Resources\...er.exe
windows10-2004-x64
1Resources\...er.exe
windows11-ltsc_2024-x64
1Resources\ffmpeg.exe
windows10-2004-x64
1Resources\ffmpeg.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dependencies\VC_redist.x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dependencies\VC_redist.x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Orbit.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Orbit.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
OrbitLauncher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
OrbitLauncher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral7
Sample
Resources\cs2-dumper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Resources\cs2-dumper.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
Resources\ffmpeg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Resources\ffmpeg.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Orbit.zip
- Size 69.1MB
- Sample260903-2hb8dsgm3t
- SHA256 0519c2e32e5525669129bbe38a202584a8c4823711c2d6155038ca83d8e11f2d
- MD5 3d3000129c25370a4bb4eb85fdaa2ba9
- SHA1 152dbe7b57fbf145d0a9f263deebd451e82770ca
- SHA512 e609f215ea5f9e013d4cd476c823ba8678f0100e26a3a6fa19ffeda86f5b9c16a1043bd8461923c706880f0df3e323c1b8a6e034428464ebb0dd7e713afb83c7
- SSDEEP 1572864:GpDZgx+M7YYr37nYeLfDUQk6IwTh5qP9PbfnH45iz8L8/IdXI5fOV2:SgMM7zTYeHJh5qPxbfH45iI3d45fO0
- TLSH T182F73382D48CCB4CCB1B65182232DF159BA97822D1A8F767DC4C8F5342A31D719BBDAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Orbit.exe unpack001/OrbitLauncher.exe unpack001/Resources\cs2-dumper.exe unpack001/Resources\ffmpeg.exe
File Explorer
-
Orbit.zip.zip 69.1MB
-
Dependencies\VC_redist.x64.exe.exe 24.4MB
-
Lua\3D Box ESP.lua5KB
-
Lua\Bone Health ESP.lua7KB
-
Lua\Economy.lua1KB
-
Lua\FireSpread.lua1KB
-
Lua\Hs & Kd Indicator.lua4KB
-
Lua\Recoil Overdrive.lua1KB
-
Lua\Scope Delay.lua856B
-
Lua\Selective Targeting.lua1KB
-
Lua\Tube ESP.lua3KB
-
Lua\Visuals Toggle On Key.lua940B
-
Orbit.exe.exe 7.5MB
-
OrbitLauncher.exe.exe 5.0MB
-
README.txt4KB
-
Resources\Airhorn.wav776KB
-
Resources\Death.txt308B
-
Resources\Default.cfg8KB
-
Resources\GlobalDLC.txt30B
-
Resources\GrenadeHelper.txt60KB
-
Resources\Headshot.txt187B
-
Resources\Kaya.wav60KB
-
Resources\Kill.txt130B
-
Resources\OrbitAPI.lua11KB
-
Resources\bubble.wav40KB
-
Resources\cs2-dumper.exe.exe 2.1MB
-
Resources\ffmpeg.exe.exe 88.0MB
-
Resources\lua.load17B
-
Resources\primodial.wav288KB
Dependencies\VC_redist.x64.exe
- IMPHASH e277f1464e7729ad9df5ec047611738a
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:62:10:49:14:17:51:9e:9c:73:fb:fd:ea:34:29:32:27:5d:b9:88:20:0e:c9:2b:38:f9:0e:0a:f5:28:65:40
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 11, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0c:b9:64:e3:35:9c:ec:f4:ae:00:01:00:00:02:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
197349
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
CloseEventLog
OpenEventLogW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateWellKnownSid
InitializeAcl
DecryptFileW
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
PeekMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
gdi32
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
CreateCompatibleDC
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetFileType
GetStdHandle
EncodePointer
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
CreateFileW
CloseHandle
ExitProcess
CreateFileA
SetFilePointer
WriteFile
GetLastError
GetCurrentProcessId
GetSystemDirectoryW
LoadLibraryW
lstrlenA
HeapSetInformation
GetModuleHandleW
GetProcAddress
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetTempFileNameW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
MoveFileExW
FormatMessageW
lstrlenW
MultiByteToWideChar
IsValidCodePage
LCMapStringW
ExpandEnvironmentStringsW
GetFileSizeEx
GetFullPathNameW
ReadFile
SetFilePointerEx
SetFileTime
Sleep
GlobalAlloc
GlobalFree
CopyFileW
GetLocalTime
GetModuleFileNameW
CompareStringW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetCurrentProcess
FindFirstFileExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
GetVolumePathNameW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetWindowsDirectoryW
GetNativeSystemInfo
GetSystemWow64DirectoryW
GetModuleHandleExW
GetComputerNameW
VerifyVersionInfoW
GetDateFormatW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetSystemDefaultLangID
GetStringTypeW
DuplicateHandle
LoadLibraryExW
CreateEventW
ProcessIdToSessionId
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitForSingleObject
GetProcessId
OpenProcess
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
LocalFileTimeToFileTime
SetEndOfFile
ResetEvent
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
CreateMutexW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetThreadLocale
GetStartupInfoW
IsDebuggerPresent
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
WriteConsoleW
GetModuleHandleA
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetCurrentThreadId
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
GetTimeZoneInformation
rpcrt4
UuidCreate
Name
.text
Size
307KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=28900,
count=145, id=261, version=28900,
count=19, id=260, version=26706,
count=19, id=259, version=26706,
count=44, id=261, version=26706,
count=23, id=260, version=28900,
count=2, id=262, version=28900,
count=17, id=257, version=28900,
count=334, id=1, productName=Unmarked objects,
count=75, id=261, version=27051,
count=1, id=255, version=27051,
count=2, id=151,
count=1, id=258, version=27051,
Lua\3D Box ESP.lua
- SHA256 9b7c3826daffe86c45e255f756cbf2ee0a10194cba77dfd12427a2aa8dc1a55d
- MD5 1e4e4e804fb0c5bf9a021c2d933b0b01
- SHA1 4d65449895baa2bb36e2ada6402bb643839cc0f6
- SHA512 9db7540868d9f3b743484bac18ff13c25cbb3d7a6f7e02eb1c25136bbc557d5a4ad2a72015cbba4a3f88a265f54d54244abb102ae624a4dbacd36114b35a4548
- SSDEEP 96:SioIrxzagafm3AHY5YMhZRlFfZRcVAjT86jNSxId9UbQsjQb42ABe/4:Sd2xm/f7ydfXSxIjsP2h4
- TLSH T1BFC15BA72343417524BA4B894F0A6C8EEB2734231B66951E7BFC54E13F7839C59B13AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Lua\Bone Health ESP.lua
- SHA256 e3a6aed42ca6e5a2a56494b1529d54e1c27d483bb50456a8f187e7056643420e
- MD5 560b48bdbd8fef39075c769a01326267
- SHA1 840ada571f5c3f63d924f0bfad622278f2cc56cb
- SHA512 a66d30a1c5a34bc116730eac1d4a6c670dde5c9d684d1f6b671ad3b967659ea8128be620ea38039fe7cecb2eaa6d4cad44758ce0c8189d3fae3194d63dfa0d89
- SSDEEP 192:SdjUGxczCoLDO0jS9f8AQlFn1i4BPKIjS9f8AtlF9Rb0Djt:egGxvo3O0lF1pPKtlF9dMt
- TLSH T1A5F11227239309A660B686C19C43A84AF20620674D7A431F77FD81D06FFD3ACEBE525D
- MD5 SHA1 SHA512 SSDEEP TLSH
Lua\Economy.lua
- SHA256 348333010580f0012adc40408b82472bd9d6e0f15fb83c561ef146436d812489
- MD5 f9fdf67f7d3a5586af12359664e31813
- SHA1 0b50475d1c57a67b64ca472bc0f356c8db609d0c
- SHA512 b0b326e6d60dea67125c104d97611159ad576c41dcaacf938dc8499ae1f6f671241c9045298ef2883b88d07036482aec5a0d1e16d0067590399735035f1567cd
- TLSH T1B431C2E1A78B087218C6A6C4FC724C8D7171212A8D2D633FB5D1507A5A6E6BC175A4BC
- MD5 SHA1 SHA512 TLSH
Lua\FireSpread.lua
- SHA256 0cc0309a01ca54f8e649597aba9ce349b51e8d303b513257721cfcc9338f4afd
- MD5 e798cd13bdfe27e260325c2fe206ef9d
- SHA1 1de0caf95dad4232e782a4aff72639f915b33661
- SHA512 6defb155ac3aad332e6efe25b213183006a791a578d30e4cfdad8ec12c6af25fd3cf43c2c77671269c5a83d922d2b235104f62b157613bda4ee22f78da18240d
- TLSH T1C821DD72268365E758E6B38CFC20484DD739121702265234BF7C06946F3E2DE9667AFC
- MD5 SHA1 SHA512 TLSH
Lua\Hs & Kd Indicator.lua
- SHA256 e763babf35ffd043cdbc3fdb42c54da8fb3434229d5d0c1ee3784b9667f0a1c0
- MD5 f120b70ea093b9e8fe737efa4ca4a233
- SHA1 da343c2ab3c56b8c4f4438a1505d0892cc8c447b
- SHA512 53fb438d860c963630aee1e4e5c9c7b085a9027afb7b55f5600116156ffa3bf44da28547813767f0fc151d5b831284a19d349e4a607a5dede9933ab1205b38cc
- SSDEEP 96:PTq3fXbIsTZ6dLddu1kZ4o/beL7skXBicRWr7bp5WZv3:LqfbdMme/beL7syicRMpO3
- TLSH T167A121721343097A28BB1788DC83D48CFB35A1234952552FB5FC85A57FBE59C7342AAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Lua\Recoil Overdrive.lua
- SHA256 4bf28091c1f98c8b9d8ed6b810f20ea913c3cb6475282ab585bbe8efbe979e95
- MD5 5c5dd785d293d74bc16073cd280b5f0f
- SHA1 03f27523e8f704a09498363baf2eeb2e7a4c0384
- SHA512 14141215d5dd12c3ebcfabfd5c95d2cfd854ed8ef8108d4a82c271999470a3f03a6a4a1f209128993d625d95bdb2cc290704914b704ac20655d203d51a22cfbf
- TLSH T14431B5A666421CE13976918A469DCC08F8B2C11F9497D40FFE7EFEC1A35F44887399B8
- MD5 SHA1 SHA512 TLSH
Lua\Scope Delay.lua
- SHA256 24c85faaff70d00082cd3ec23207a839eee18d1244cf0b5d91b0dc4ff8f5c1c7
- MD5 10a0d0e0c8063df315a36c9a372cce67
- SHA1 6740268ad738e8c50675e286d5b3948c002eefcf
- SHA512 6c79832e589c8997ea5306e7236ee32755e6fb38874daff4cf6685a207e607c4c13b3e65d050a57af99e2160589c920850c87322ff2f68fd58cc371098a68f22
- TLSH T18611661B63430276057B4AA5EA1D9C0DFF25032B541E124DBF6D875A5F7C1DC81F85AC
- MD5 SHA1 SHA512 TLSH
Lua\Selective Targeting.lua
- SHA256 078bcef9686a88d746776370b06c95b322142507ea01334d506207ee90747c53
- MD5 abc88da83f367332d3926c643761af5e
- SHA1 d61b836ad47fd45e23b41266affc94a3414b1e54
- SHA512 c1e9f7c6af3ffab4b7f5ccdc6f042be48ae7642c94b62d28a4773e0492d3171ce8197c390ca8a5919722a6aae533a21c4bd36ea578228afed38697cbd1dcef8f
- TLSH T1E2419B32B64314F079FAC29DDC528C5BF14505DB83280179F99C91A81FB83AC91F93A4
- MD5 SHA1 SHA512 TLSH
Lua\Tube ESP.lua
- SHA256 628a2b720caad7ed7156b8dfbd34e3191fb80d14dc0544af88d2ee5467602742
- MD5 d65df7d5405feda8a05c1e0528c38f96
- SHA1 22e2c9890f748f8b230cad9f546bbaeadb4267cf
- SHA512 2383c8ce33d70d8ffbfb0bba27096b34a804f5fe53f77f04f26ae8759e3f8ef606971965a9c31f8311d33af711ce5e07468959a5f7e488b7c4e97cf1c5af954d
- TLSH T11781CE175397023E107647C48C06A88DF3122067297B821EBBFD96A52FBD27CABF419D
- MD5 SHA1 SHA512 TLSH
Lua\Visuals Toggle On Key.lua
- SHA256 090800916d0906aa09c19310ee7304aa30498481afb538271ff8f6ad28290e28
- MD5 38d3f51da4146f9dec0d360216f6e3a9
- SHA1 e4907db19d5216b6fafc47a15129dcabb315510b
- SHA512 026cc4b16610c5d69bd5cf59cb62b3c2b7007bec4f60ae22dc32b7ad235c5ca0d3cad93cf5eb24a48ddf18888ec6c2f209f1c65a8a88614dec4778d19ce2feab
- TLSH T10911826FB10D0167C87590B6C84641F2E110CB9E233A0AECF4CC54441BEDA7CC17E93A
- MD5 SHA1 SHA512 TLSH
Orbit.exe
- IMPHASH b39d7314cd1f4e741ea22e313c607dda
- SHA256 d0971b0fd9c27770ce9e4d7da1bf1ae5d9b170d92d9f68ccad8cdb3a87a02646
- MD5 fe4d44a77039e01e5ab026abd35527e2
- SHA1 5a65effaabbe4ca0a925327a657110caea9c78f2
- SHA512 c8bf7a0305c1b10454fb79734e9f16457adc11ae1bfcca25bbb0501aa9d039cc123f23293b3be3131423a2baeab4e94150a13043f7c81942e0e9842b95efbefd
- SSDEEP 196608:rd2SkdMoijzsUG8ypKKYW5bj93WBd2v9wk2WxT:RqmLQUG8ypKlW5bjxsd2v9wkT
- TLSH T1408622AA2A6D33D8C02FCD3840B2A92633F9753F0DD595ED70CA7EC07756412AD86B46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
14843619
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gdiplus
GdipDisposeImage
winmm
timeGetDevCaps
iphlpapi
if_nametoindex
secur32
InitSecurityInterfaceW
kernel32
QueryPerformanceCounter
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteDC
advapi32
CryptGetHashParam
shell32
ShellExecuteW
ole32
CoCreateInstance
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dxgi
CreateDXGIFactory1
msvcp140
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
msvcp140_atomic_wait
__std_atomic_wait_direct
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtUnloadDriver
ws2_32
WSACloseEvent
crypt32
CryptDecodeObjectEx
imm32
ImmReleaseContext
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
longjmp
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
__sys_errlist
api-ms-win-crt-string-l1-1-0
isblank
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
log10
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
� j�>v�u}S��f��K>tf�mrȗ�ek;Zr-I k|
�̓�1r���we���$o%�J�����z�*���z����u�����D�B�X��S�����R}~?���H=@��7]\��KH���������4�`觊�� $�+�O���+�;�T$��K��@7_����tb��Lk�,l��X�>
d� j�*�����G���
y�6=
U`F% Z:D�`ee��_��j�����v�b�ꀑ���Ǟ �� ��%��K��, ��Wp�2ݧ��UV�pޅ'�xy�� znW��� �3� ��)Y�@�m��w��hؙI�����DtC�Lg�0D(�+�N��^�h ��l1T&$��g���E5J��576L;��.`r���f�Ȋ ��C�}���A���?5��ȁ ��ڳ1���4K_�9G��&z�g>a���������O�� F!^b^\"� 5쥷x ���X����v��ŀ@���i��5J2�� ٲ��rF�xd��Z����5���������%jư�J=?��af�
�%� 6�5�� Z1���f��ёۅ��j+E
��P� �둔y�.F$q����O������8]�ə��d��R�,T0Nbnlz*M��%��� ��ܹ��p����4����^c�z�zg�������I!��L� ���rr��Yy�s�k�8 J��P*��Z4�,��5�fX��� ��r����ϧ|H]~bc A���>�] �&�eԌ+1;�_]�\���_O�F+_Dոw�J ��[O��� Xs#�Z��I�#��,f���y��K',S��ј���f�3�ӹ�9�Q*C��:~�a ^��8���T�X�=2<l� Qv���ח�`F�>�eBX֣���T��Q �Dz�ܷ�7c� ��F&����Kp&%�}Qd�9RL���) oB���Ђx<p�Et��RC�ҭ�����`���J���,�Z,1��� 5�������gȢ���!+���F"�{�Ch�u]#�ߍ�*�)�^l��U wך��Rj=p *S���t}=Y���u~և>����������μ:�
�%��
�B�Ò��Ѩj�g��WC7zG�-��2��)�6�:�B��[�l�6p���Q�
�cMo>n��}>w �>�jC��*e�bhK�.�Ov��L���Φ����TX,����[H=ߋB�ﳵ���� #�C���n���|�S�����h)S%J*��s�o ,{�]&��=?���5H�RY�>���);�����ð���+���@
�3�96wg�k����ܷ7X숪"��w;��Gɝ���L����K��_���n< 8��'Jt>�c� ���C/�"��{�^R#�h&`�Mρ�ې�0;T��)x4�&��.�|�T��V���;jp K��8 ��ڻ@���N��U�pY!`I�Qu�HK+�k�z�O��V�s�����J��Z?�i��V$`��?����':���l Ø-+T����I\�<�V�sࡠ
�a��K\v�{��LR�;�4h�m�ɦ^0��I^ ����լ*�����(,!��
��2�h�`/~���V�2����5(�f�雼�8u�a��J����+Sq�p�h�$$�e���dg c|�|�7�L$�oj2?�H+qF��X�i�~ �^���EbE
�7�I�1�{���\2�p2�]�N����Q9Zd\Xa0�90��iy��}�v�'�dt� �SZm^�G���@R��y��l����*z��۹�쒅[�����DyM���Qxᚖ�$A� ��0l�.]b���ɮ��n��ס?��{�@��.{�G
���#)�)
U�l�*Xz˳�����!Ҹ�b���c̲Z^����
�/�w�O ��;�^1d&�r�V��8����t�1��b)�ބӗ 9���:�JD����p I�� �؉l�DqcrVbK�^\��� ��_��,����xI1�hZO �a���#�#��GCq^�5]/*~/U,.�*�H��E~k�+�Z�i6�C�b�Oj2 � � 䍛(�Dv�XJ(�~�t2��Z��X�( �j�W��7�(W��zn�M;�O�&R6�C��5Ze д��Q�� p�[ G� F�~K����v�K^�,�=�x ��tl��5�~���6���8��Ժ
t��1�j/�8t���`�{����D��!�t<�9��b[higM �Lq#;zMrf�� ��%�Ay[�Ul�^�3��k
*?a|��Q ��С� �qdD�&��Y�=Pn��N'81v3@Ѩ�٤ ��FP����n��c�\����YQlH�ke+���߽N���(D���-Op+��ƣ��� +�W��|v (DK3�i����m�w4�v�S:�W"��-u�<����X��adr #��`ն 5&\�`@�ۗ� j�:o Z7%)Z���P2J4ل��gn-\�� L*�Θ�f��ʀ~�����<��tY�&j ��[Bx1Ֆ/����_ �o+�E�*S��UÞ�Z��0%��!�U烲�4���m�_��nL�-"��%`M����o��������V��z�-n���沱[B"I�⬰��o40�.n&B�d���o%D#p��dG�
n�XNEr�kI�1�$J|� L�03�Ȅ��'�j�����W��W�6�3[>Bo܆~����`N;U��%=�����������pE/��g,G2Y�j�������q���Z��I�Z��[=4��3ݗbvj�)J�e�d�tM0-����� u�����mh���`BD�_u�J���ċ��`�0y�亦Q�!,5LVfɄ�"�^ �8;/]�����ŭ�d x��Q��Z��'��[Q����]��^���Șox�;�W�g+�l�n��m߮��H�P&��>��nL�E?M��=�9ɼ�Ն�"|�*�c�g��@yd��^-]=���9V����0Ѓ�Єst��4E�|�_��^$���(��s��gW��aT,�]/����^�{��
o��G������`P����|� �6� �F��d*��J�<�:�!/�La�)�0�z
t:'�ci�-�c�2�`�i@rո�4�V���D��f��u��].����e��_�<x���>�^�C�c˗����낈]%�A����%�hk�VHG྄1��s-�L��
Name
.text
Size
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.'ad0
Size
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.'ad1
Size
7.4MB
Virtual Size
7.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
OrbitLauncher.exe
- IMPHASH 656afc354276cff6e4d2abca39f3e04b
- SHA256 f1c3ce4c1254abb03235e23710a771e3f515597848df51c81847b3ef0f44092b
- MD5 bb17577a2695907e5772c161d0159364
- SHA1 9e210fa039c551cd301667fc5fa9067eaa38c14d
- SHA512 5dc9b1d9712446858637775b658e443c3c79dde024916233f7c31cea25a26e7504bb1d8fd0f3e2949dd79d3ace8d31f4085e53bc34399d66035e402f70675011
- SSDEEP 98304:fwN16Fu9uKVk4dDEwYnUc7v/4kX+oTpFnXXNMGhfCXp7NzZOUkBd/JsaxrZkF:fwsOu+9E1lj4kX+KpFnH+AfCXp8H/Js9
- TLSH T1F636126DA28C3398C41E88389433FC49B5F6853F1AF595A971DFBFC0775A910DA82B42
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6827066
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
Sleep
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
AdjustTokenPrivileges
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
v��@�����r"tu:���T������|7W�t�v�:i[ ��p�I������L���xl���/ �Y�k @���S�y�L� S-v�I�3��� �v�i�+��-��0=�PV3�0���T
�7��V_���8-ٷ�l�H��Mx-� K�
oN��;�9��H������w��� _�z�aks �K9A;1�W`ȗ��l�T( 19oR�c�q�����>U���<R�x��HL��+� &m�4D�p�P�#�X �^����[ ��
�R�3R��'@ �frգ}�̀�M���"\ڜ��� @3?JTY������C�f�("�=�R!�嵐���̖�.<^�a��
�� Y�� Q �Ld1"�m]��:����ݮ��u�4ꚀUf��7��L����ZeQD�%����Qh/�+�2����0��QBv�b�m���
��1�*y�ʓ�#�(��*��/�e}�?Qm�w1_&���l�iJ���x��}KM�1�N��*�PO��c��3o��DY�5�
�r���� & aQh�w ��aOU��^�2�(�ab�+^*Υ��ͣ$�"w���*<�Sg���P&Q��5���q��GۆV e ��f,!f�d͗5y�fA[Z�e�$ ��T5fe�>�:�@�X~i��~&�V���G�Z:���c��e|��PjxC�Q;�ߨ��-*���� 9�u�X.kG�ܦ�O~@H�nR���B��Ƴ������G�/�6 � �i*:d#�d��0�xnr^��X?�Q�wCL%�˕1F`��H뮟�)����E���X0� 2&^ܨ��_R��{���_��j�W�x+����}7~�>y�����?��{� Փ�L��%w�!!�-������e�$��2y���r�}� ������8 w>S����ǥ��cւJ���ҽ/(�&���[�%����Э�3�4��6G,j�R���9'��0��i���f ��
���F�X;�;T�1��4��a_cMb��X��Q�F�@Un��*�����Y�DZP� y�m�Z ���f8�pY�e�E;�^v�U%��u6tv�J�P^���E ��W.�EW�/�X��b_t4�� _{� ��&��Q��
�v[厡BO�2L�E����Y�\�����[�!n��ML������,� � �[u%�u�r� ��Ȯ� t4�Iڿ`
4���U�&��<�vD��¤_n˫�P�y_7e�Պ�7��|�a�%� a�uwzm�����<�E�����8���� B���nh������7q�,���a4����d��2%jL��gY x�J�����ѕ0�0
]ߔ����� �Qє\4����q��n6� ޱ��] �yPVf\"
+ ��KNjP��^��m͙,_jaV;E�����
�Ń� >�h�ѿu�)��X@��r��u��O �����9��a!f+����B+���m�^'��:
O�>� �Zǟ^�P ��X1�k�q��I��75��� J#�W��pC�ob�4��^�,s���nG�4� ) O����c��{7���i�)F���Xk̏H;���&� ���)��j1�D����&q���������D/��k|�֎W� °u�B��/�A�"-ޗ�s Z!ywn��3[p�8�S_ePhۯD\��u� ��[�����<]�M��w�#���n�9|��z�O�� Z%��o�'=�/�ӪI�#ˬR/��
j���,{����9##��J�v����ièl{!w|�����y���q�� n��f.x�i�{;�HS��(����V��O�����h�[��� U��\Պ�������*GH��ъP�0���c��e������Ҹ'���{�e���}��3<��^��$:ѭј�ۧ �'���gm��Ȱ<:]Dj3|�iA]���p�"�F=���������G�� BO�O � ��,M���w�Ċ��>(��|�"/����U������� �FB$l.�3c�ݸUֆx ����!��`�2(����
a\�K��� �#��n��`��9�@��o��7c[7i���ph��;���C�
���A�=�/e�Q+ard)���.��̙'YJÏ����-���� �.p�OV@��9�� �m����!a�Al@�Tg���ǿ����k�ku� � �'� ��W�#�H �Y d���f,>
P��vy���yǁw*
�ۖ;�������ݸ��{�?��f���"���������o��|�/�ƃ����� � ߥxrT�d`��{��Q��U]�㜹{ݜ�g���I���&�C7J~����.�n��P��W۟-h�ص�}��ۭ ?�ɸg�� `��!�Xte
�Fs���
.]�*��$�������oo� z07���#W�x�<f�->�� ����c �Z�u*�G� � ��?p��uu�>,]��
3�V7��ǝ �gDU�<�ʊnV=��{�wZ�<G[��$��S�q�r��G�
�S�ޠb��p_��@F�ջ>2�o�������~k.���K��U���48i �L7I�@���w=�W������$��Q�����@���`JM�� ���n�s��zD�
��!�=�|�����|�z��'D�xXV��+��`��p�䖙� ��>�D_��Ō�L��<+����. ���H)@�@����:��d����<- ���8[���P�*�[�QzYh��m��(�&�f� �@�-�磡���J�Іơ�0��$zѲ��m5m,�����N|�h#�dž!��Z��� >��Ԥ�tt��� �j6�?F��~�*�Hl�oZ
J?��ѤY�� =6q =�iB;�k';��v��W�g��� �]��5f�>�u~�V�¼�<�*��k��o���! E^nb���s�Q*`j.;��Q;ot��)��n�}�� vU����3�]�i"�p1ѻ��E=¥:�<�~�L��H� ~��y �0>AS�]`���e�q����C �{ *�� +� �+�yy�W�����*�KC�1 �Q��
���-��pL��x���
�9{��L22��w�`5�c
�����Y|L�+k��r�8.��J� - S�8�b��C�����hj��JjN���� ���Y�rȶ4�
Name
.text
Size
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.car0
Size
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.car1
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
README.txt
- SHA256 9e5c5a7ec7fedf923c8f287a30be8ed55306f93b7288b079a91de6509f45b654
- MD5 7241951f771f2a8d901bbbab034a3a2b
- SHA1 83ed14494db83e7bba6e4a761640b6856aa9f285
- SHA512 cf82de51c54f0cef22c89a2990bce57aff93d545514ca0e7929f2d28038544f19b7391fa414fd4a643c79d0839e404bfec63a24697d7881c885c1cfb8f298027
- SSDEEP 96:LWKkDLHCKugGeYqJ6kK05YKNcnv4S6UY9KuRVMnL9jHKwx4jU:zPt0wkK05YKN2v4J93Y9jH3xAU
- TLSH T190A1963B7D0B823658B1D172B19E56C3FB09038C63E9A234345D105E1A6636A467FBED
- MD5 SHA1 SHA512 SSDEEP TLSH
Resources\Airhorn.wav
- SHA256 eeb4ff25976f46e026139c47062f139e13fadfa804c1d5bea297c42d718345c9
- MD5 c842a4c8ecdbeffa14f924e331b28aa0
- SHA1 006c3911b317d40cc6443fef4a78fad1d8b0f788
- SHA512 e837476c9f800ef0301acd1bfe273e6d546e91f9f3830c330721dea6e5e2df886adca10472b5889f5068d5afd3284f791705180441ec63fe6e6d65f0f9b05964
- SSDEEP 12288:eNTuUDwqCCf4u1897oqAVHhgDcd2Ac8Hs2Mi:SkqCY5hxPnvMi
- TLSH T191F41296B341C390C9EDAB358DA2DBE55276BF196E0716133139BB573E320832E129CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Resources\Death.txt
- SHA256 3bee736aaebe54097a86850d4f0d593d42e64505e7dc6e06a5dcf8c8b2a045d5
- MD5 f4cd5b8792a36bdc5bb1a8aabf3c4885
- SHA1 6639de6fdcca7594f7163ae6836d7e5b39065c15
- SHA512 712ffb2df1d7daacb190382155dfe027d79b96f1977827024900d6fff730a7d9f3045f5fea86cff7e099a6bd3502cfa2f403ce28e162b7c5dedd25982f1ccb6d
- TLSH T195E072A882B683CBD0F1C1CC8006B23CC249887F6024808A2C3FBEE650A1628E073092
- MD5 SHA1 SHA512 TLSH
Resources\Default.cfg
- SHA256 15723d9bb0e05bffd35b20a78362e3de2cc5384e11ad6152f24ff05571ec0516
- MD5 f247e941c45a04d63a63fee9321e0631
- SHA1 f2f5c577d8b54927fb7ac4ee7373ceab859105d2
- SHA512 71df397dd05fa84941d0413e190d7394a9c0982bba69a62eace93fb57d41f48273d749b6649beb6c588238ead584b173c1fbf5620f5a0d480896175bc9581227
- SSDEEP 96:2a2ZunpnySBfZf0UvyqHN7I9+um7+0KT/JtLquOnDwawbqZaPr:j2ZupnpZf0UKqGQGflyw5bFj
- TLSH T1EA024255CB1C90BF30BDD37FD87522849EEA655BCB732366F3A9ED8983C109416AC818
- MD5 SHA1 SHA512 SSDEEP TLSH
Resources\GlobalDLC.txt
- SHA256 07cce9d5aae15fb328ac372a25e16273b3d881d2b24f1e3f958fa0f534a1ecd1
- MD5 220a8cb00fb6c0a03e07a7c19be5899e
- SHA1 95cd7bf065fb9bf14ed7aaed3a75758c6d9a967d
- SHA512 a38ddee4d8fb5cf7f3ab819e3438949d076acb83436eb32da39593fcc0b59d56163cd9b9f9beb835e131e5291acdffce9034ba880efbda8ffb56ee80f3f10e97
- MD5 SHA1 SHA512
Resources\GrenadeHelper.txt
- SHA256 583fe1a75f1762c05b27cc33395469cb8ca18f1fc1bb3b36321af9f1c08e4c50
- MD5 8a4a7e0afb4964ca3e05b079542e7419
- SHA1 79571f734a3a01a41d69f336226b59b29be014ae
- SHA512 9715ab125b807f110ef167f86096bb614d71f4dc42d853452b6640fc982f19cdaeca5f8aca56daabac226ed480880f4a6eef39d2e714cc7939d899a42d01fcb1
- SSDEEP 768:4OPe4aGkikBnsFNlCF11xZF+L+zQAfP4oQq4dZmMXj3YreWz/M7Olp0kSfp/oMuD:EfX8PUCbHhu1Ba4uNb6iMQlrY
- TLSH T13C5372D886508B4CD7642DC9DED9D93A33781889D47E60EEEF2982B5C000F65E46CBF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Resources\Headshot.txt
- SHA256 e2be3917d4ffe95663a85febee8d9af7e3acd2f43123224b811b211aa26b2f32
- MD5 09f2480fdb9a5efabfb18da9b36e81b5
- SHA1 656e43ccd980b36cd1f863efae727f0d13be1350
- SHA512 594cde169e270db44210c0fb2fddc3e916bf0271824e555c7de4f95958c6394fbca393cc7b593234759b16376e5818ceee5ef64403e3780736a7165f3ff0869a
- TLSH T128C0229E4AA6082B81110141080A58E2F1263DDBD2939950A220200BB0C98AE62A0C8D
- MD5 SHA1 SHA512 TLSH
Resources\Kaya.wav
- SHA256 f20ba6abbddb80aa7678d14a46a03c48a062339faeff8d2990d6fbfb08db7774
- MD5 177df1798fa83c884ec97e09149f609c
- SHA1 6893ce82186683a2282adcf3d163d7dc9646e519
- SHA512 bad5a337f2332ad5119d8b90d2a1a574bd3e5ac0174d1919e7468b50b347d8100a1f364dc8d7e4bbf3c3cfb853bf1c920c273866cb6c8ee95b597719e97adfbc
- SSDEEP 768:h+zyse7MSu2HODlYe7AF4REusKwkPITlzF+FxAqwCqy9hLQMSEwMwILn15XG9t76:ozyFZh/QqMsRASkAqLqiQKfTTX3Jyc
- TLSH T1AA53E1A7C213EB023EC5CA169FD218885CD1748EBBB0A51F755C8C80E673B06B5AC775
- MD5 SHA1 SHA512 SSDEEP TLSH
Resources\Kill.txt
- SHA256 f3efb39f0ae8f804f32bbd12126bd18c93024985f3ee94e27dfc240c1c444b0d
- MD5 f7eb3cfaa46bad87e183cf53f124d173
- SHA1 f2f2fc7a9deaf6f8c5f9556c8066413c42dc32c4
- SHA512 d49fad1e453d5ce5201723a50853c38344b230f490598e5d4b5551a028aa7fcc4dffc5e3a175f851cd9750185d7b461d5029915893f14d89503a82a5c608c80a
- TLSH T1BCC0222EF200C30AC823023C8008F02AE00082B000B0AB2082CAA8C2328C0082A23ACE
- MD5 SHA1 SHA512 TLSH
Resources\OrbitAPI.lua
- SHA256 ae0689d8e9e4b3a45e2ff60219b52da8423fac263d8b2b5b1ff9abd3b61c37c1
- MD5 9c17ca607ddf64a9e133247c288d3987
- SHA1 59bf02f1dd4d3c2ce05c171050e28099bd722999
- SHA512 cfe4718b21ce2ac46735183c110b32bbf0aa2e509219d8949c773c0611179792646acaec5c3be996619939aa635e19b782e87d029d97faf0375ca5d4afd1eb53
- SSDEEP 192:l1WcOTnKzL40R6MtAJh5feNKQXOTlzq/hBnUXBCWiuE:ecOTnKzLHR6MtAJh5feNKQXOTQ/h4BoZ
- TLSH T15E32108F7D87E11108C22635540F7448E62C523833A4A2A5D4A8ECEB1E7BC7E52FFA5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Resources\bubble.wav
- SHA256 d6837a0ab82b7754cc9b911c1cd4a3c5bee9cb52939e22b86e421ac3ac4248ae
- MD5 067f8f540c43929a507f10035dc644d2
- SHA1 5df059190bcf854bc3368b42ef23b4773f4d1e6f
- SHA512 7a32d67ea3791903b125ac3770a29b94233392c22aeccab570e43049df415276efe3e2a5291e2dab20060ea5f19dd6c9563585e65a3f03c08aa86a42aaae5728
- SSDEEP 768:r9xJEyUVK9Bp0hPqeIqhJAb88C9CjgmaLwvIaa6BBeBojVuU7UY+69S5LzZaXlyx:CSBp0hPnhaoKNIaxBBeujVu
- TLSH T1E513E592F342D540C4066D7A8D09EBE94332FE95EF4A67273080BF2F7CB25825D666C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Resources\cs2-dumper.exe
- IMPHASH 88745667c166e192da6d7c8f513514e6
- SHA256 95d0390cd4962a9eea050d6ed6d2717d681e1d76b7972ea0991348936e172c9d
- MD5 9639ff642d5d20fa920b6fca0c54978c
- SHA1 a35dbb629b1cc3e65cfdad7da15142eb0aefe18e
- SHA512 51860cf9f87210b7de15a480343dca5fd04e7da2493e1cace7a8bb0c4a25f3363ba27b567647bee577e3f0e784d5de529b045dd33b4dce6a79e109c04327749e
- SSDEEP 49152:JStFqrYT8HrLiMk2r+LW9HnoDE1zYEYH+XyFdoQR:OtRoYoQR
- TLSH T180A52816769E98ECC1A9C474C34A4A736A2174CB0B367AFF44D446353FAAAE42F3C714
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1606672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
cs2_dumper.pdb
kernel32
WaitForSingleObject
FreeLibrary
SetThreadErrorMode
VirtualQueryEx
K32EnumProcessModulesEx
RtlCaptureContext
K32GetModuleFileNameExA
K32GetModuleInformation
HeapFree
HeapReAlloc
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
GetLastError
ReadProcessMemory
GetCurrentThread
WriteProcessMemory
Sleep
OpenProcess
CloseHandle
AddVectoredExceptionHandler
GetProcAddress
GetCurrentThreadId
InitializeSListHead
SetUnhandledExceptionFilter
SetThreadStackGuarantee
HeapAlloc
ExitProcess
FormatMessageW
ReleaseMutex
CreateMutexA
GetCurrentProcessId
WaitForSingleObjectEx
Process32NextW
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetProcessHeap
GetModuleHandleA
GetFileType
CreateDirectoryW
SetFileInformationByHandle
CreateFileW
GetFullPathNameW
GetFileInformationByHandleEx
GetFileInformationByHandle
GetModuleHandleW
QueryPerformanceFrequency
GetEnvironmentVariableW
WriteConsoleW
MultiByteToWideChar
GetConsoleOutputCP
WideCharToMultiByte
LoadLibraryA
GetCurrentDirectoryW
GetSystemTimeAsFileTime
GetFinalPathNameByHandleW
LoadLibraryExW
FindFirstFileExW
FindClose
FindNextFileW
GetSystemTimePreciseAsFileTime
QueryPerformanceCounter
lstrlenW
GetModuleFileNameW
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleMode
GetConsoleMode
GetStdHandle
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
ntdll
NtReadFile
NtWriteFile
RtlNtStatusToDosError
NtQueryInformationProcess
user32
GetKeyboardState
GetKeyState
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ole32
CoTaskMemFree
oleaut32
GetErrorInfo
bcryptprimitives
ProcessPrng
shell32
SHGetKnownFolderPath
vcruntime140
__CxxFrameHandler3
memcpy
memcmp
memmove
memset
_CxxThrowException
__current_exception_context
__C_specific_handler
__current_exception
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
exit
_get_initial_narrow_environment
_exit
__p___argc
_initterm_e
_initterm
_cexit
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_crt_atexit
__p___argv
terminate
_set_app_type
_register_onexit_function
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
466KB
Virtual Size
466KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=3, id=259, version=35721,
count=9, id=260, version=35721,
count=23, id=261, version=35721,
count=2, id=257, version=30151,
count=3, id=257, version=33145,
count=126, id=1, productName=Unmarked objects,
count=28, productName=Unmarked objects (old),
count=1, id=258, version=36248,
Resources\ffmpeg.exe
- IMPHASH 83a2a9c7d919e32f9c59e5dd8c311ab5
- SHA256 d31fe0802eadda669786f88c856f590beb1277ab0bed61a1f4d959757165ca3a
- MD5 fd851bd4e35859c08079466c1f2797d7
- SHA1 b80bd8e445016527d0da5f38bd134cc13eb8a6a2
- SHA512 2894edd0399b998d9090441f950dbf45982f9ab5916afc6f5a54d60fb6a5370955fce80c8993e9e1ca80f8a1703294f6cc0ad566b0844ed2f8ecce4d60ec5a73
- SSDEEP 1572864:zTJXTtFGyhQHPwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFh09G:zrLQE
- TLSH T148188D9EE1E3509CC12BD4F0436EFB73BA24786C10246E7A66D9DA306E62FC0571AF54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptReleaseContext
CryptSetHashParam
CryptSetProvParam
CryptSignHashA
DeregisterEventSource
GetUserNameA
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegisterEventSourceW
ReportEventW
SetSecurityDescriptorDacl
SystemFunction036
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
bcrypt
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
crypt32
CertCloseStore
CertDeleteCertificateFromStore
CertEnumCRLsInStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertOpenSystemStoreW
PFXImportCertStore
gdi32
BitBlt
CombineRgn
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
CreateRectRgn
DeleteDC
DeleteObject
EnumFontFamiliesW
GetDIBColorTable
GetDeviceCaps
GetObjectA
GetStockObject
GetTextFaceW
SelectObject
iphlpapi
GetAdaptersAddresses
if_indextoname
if_nametoindex
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AreFileApisANSI
CancelIoEx
CloseHandle
ConvertFiberToThread
ConvertThreadToFiberEx
CreateEventA
CreateEventW
CreateFiberEx
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateMutexA
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DebugBreak
DeleteCriticalSection
DeleteFiber
DeleteFileW
DuplicateHandle
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetCommandLineW
GetComputerNameA
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleA
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetLocaleInfoA
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadLocale
GetThreadPriority
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersion
GetVolumeInformationW
GetWindowsDirectoryA
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
IsDBCSLeadByteEx
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExA
MoveFileExW
MultiByteToWideChar
OpenFileMappingA
OpenProcess
OutputDebugStringA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTextAttribute
SetDllDirectoryA
SetEndOfFile
SetEvent
SetFilePointer
SetHandleInformation
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadErrorMode
SetThreadGroupAffinity
SetThreadPriority
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SleepConditionVariableCS
SuspendThread
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
UnregisterWait
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
lstrcmpiW
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_access
_access
_aligned_free
_aligned_malloc
_aligned_realloc
_amsg_exit
_assert
_beginthreadex
_cexit
_chmod
_close
_close
_commode
_dup
_dup2
_endthreadex
_environ
_errno
_exit
_fdopen
_filelengthi64
_fileno
_fileno
_findclose
_findfirst64
_findnext64
_fmode
_fstat
_fstat64
_ftime64
_fullpath
_get_osfhandle
_getch
_getmaxstdio
_getpid
_gmtime64
_hypot
_initterm
_isatty
_isctype
_isatty
_kbhit
_localtime64
_lock
_locking
_lseeki64
_lseeki64
_mbsrchr
_mkdir
_mkdir
_mktime64
_nextafter
_open
_open
_open_osfhandle
_read
_rmdir
_rmdir
_setjmp
_setmaxstdio
_setmode
_setmode
_sopen
_stat
_stat64
_strdup
_stricmp
_strdup
_strnicmp
_strtoi64
_strtoui64
_strtoui64
_telli64
_time64
_unlink
_unlock
_vscprintf
_vsnprintf
_vsnwprintf
_waccess
_wchdir
_wchmod
_wcsdup
_wcsdup
_wcsnicmp
_wfindfirst64
_wfindnext64
_wfopen
_wfullpath
_unlink
atexit
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wrename
_write
_write
_wrmdir
_wsopen
_wstat
_wstat64
_wunlink
_wutime64
abort
acos
asin
atan
atof
atoi
bsearch
calloc
clearerr
clock
cosh
div
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fopen_s
fprintf
fputc
fputs
fputwc
fread
free
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getchar
getenv
getwc
isalnum
isalpha
isdigit
isprint
isspace
isupper
iswctype
isxdigit
localeconv
log10
longjmp
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
perror
putc
putchar
puts
putwc
qsort
raise
rand
realloc
rename
rewind
setlocale
setvbuf
signal
sinh
sprintf
srand
strcat
strchr
strcmp
strcoll
strcpy
strcpy_s
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strncpy_s
strpbrk
strrchr
strspn
strstr
strtok
strtok_s
strtol
strtoul
strxfrm
tan
tanh
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcscat
wcscmp
wcscoll
wcscpy
wcscpy_s
wcsftime
wcslen
wcsrchr
wcsncpy
wcsstr
wcstombs
wcstombs_s
wcstoul
wcsxfrm
ncrypt
NCryptDecrypt
NCryptDeleteKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSignHash
ole32
CLSIDFromString
CoCreateInstance
CoGetMalloc
CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateBindCtx
OleLoadFromStream
OleSaveToStream
PropVariantClear
StringFromCLSID
StringFromGUID2
oleaut32
OleCreatePropertyFrame
shell32
CommandLineToArgvW
SHGetKnownFolderPath
SHGetSpecialFolderPathA
shlwapi
SHCreateStreamOnFileA
user32
AdjustWindowRectEx
BeginPaint
CopyIcon
CreateWindowExA
DefWindowProcA
DestroyCursor
DestroyWindow
DispatchMessageA
DrawIcon
EndPaint
FindWindowW
FrameRect
GetClientRect
GetCursorInfo
GetDC
GetDesktopWindow
GetForegroundWindow
GetIconInfo
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowLongPtrA
GetWindowRect
LoadCursorA
MessageBoxW
PeekMessageA
ReleaseDC
SendMessageA
SetWindowLongPtrA
SetWindowRgn
ShowWindow
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
winmm
waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
ws2_32
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSARecvFrom
WSAResetEvent
WSASendTo
WSASetLastError
WSASocketA
WSAStartup
WSAStringToAddressA
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
FcPatternAdd
FcPatternAddBool
FcPatternAddCharSet
FcPatternAddDouble
FcPatternAddFTFace
FcPatternAddInteger
FcPatternAddLangSet
FcPatternAddMatrix
FcPatternAddRange
FcPatternAddString
FcPatternAddWeak
FcPatternBuild
FcPatternCreate
FcPatternDel
FcPatternDestroy
FcPatternDuplicate
FcPatternEqual
FcPatternEqualSubset
FcPatternFilter
FcPatternFindIter
FcPatternGet
FcPatternGetBool
FcPatternGetCharSet
FcPatternGetDouble
FcPatternGetFTFace
FcPatternGetInteger
FcPatternGetLangSet
FcPatternGetMatrix
FcPatternGetRange
FcPatternGetString
FcPatternGetWithBinding
FcPatternHash
FcPatternIterEqual
FcPatternIterGetObject
FcPatternIterGetValue
FcPatternIterIsValid
FcPatternIterNext
FcPatternIterStart
FcPatternIterValueCount
FcPatternReference
FcPatternRemove
FcPatternVaBuild
FcValueDestroy
FcValueEqual
FcValueSave
Name
.text
Size
72.0MB
Virtual Size
72.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rodata
Size
193KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
12.1MB
Virtual Size
12.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
938KB
Virtual Size
938KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
26.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
279KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Resources\lua.load
- SHA256 2171f1b7db6944142faa423b240f695db7c1191e689d21160bcf74147a389d38
- MD5 56e1d51ad2d68ac14f71e95af28283da
- SHA1 8d309b9983a4de3d98d07e1a638297801d593fdf
- SHA512 e10d4ce67b55ab82d5d85ed4e51e1d1884c7bdf891504e617452d0531fe5ea675eb0c33a1ac9f5908ed690e3c5efc8ab42eb4a7e5393dfe423e7ee5ae502318f
- MD5 SHA1 SHA512
Resources\primodial.wav
- SHA256 ae42e5154195058cdc7a8a7e9bab451598fb5c4422cbd73d206d03d0e8d95a89
- MD5 b9c2399a34c2227c8f338a5554b27ff3
- SHA1 8119f422e098d37ee58a78f90fcb504735295321
- SHA512 6f1bd86c686c272f3f174cefc023a495cdd184d8496e97d85e5a821df7c1416c2431243971b413cc86a13078b4c6859d11c9e95e321241250723b9cd837eea43
- SSDEEP 3072:wkl7MZ8hpV62f8u1nAny8eaySKI+1jxYWSNbptbQyVycSc7:wkQ8nV6K8uBAy8Cpx6NtHQcS
- TLSH T1CF540782B641D550C8056D3ACD5ADAFD07337E85EF0AA32330E0BF6F7AB34825E59685
- MD5 SHA1 SHA512 SSDEEP TLSH