UFOlee.zip
- SHA256 a07d336992ad2dc7d085b124672389f589794b1e6a571051427255b5fa6a257a
Behavioral task
behavioral1
Sample
UFOlee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
UFOlee.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
WebView2Loader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
app_hook.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
app_hook.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target UFOlee.zip
- Size 457KB
- Sample260922-j3ha2abe55
- SHA256 a07d336992ad2dc7d085b124672389f589794b1e6a571051427255b5fa6a257a
- MD5 370d2cb498f31a48e646b1d98cd709e7
- SHA1 022b670ac9a0da42160c2cb792b5d7e860150a62
- SHA512 95cc554040d700bf93de175f6481285a15020dfc1682c82599fec20d1bc6af784033455945509a52fe8f078304009297d32d92b87627696d4d3387debf85b5d6
- SSDEEP 12288:mhcIVogKZmmrJJvo5bysHTyTUoyp+/QkeP0:mhWjgml1oxBSyw/Re8
- TLSH T17AA423F65C3CED81A2696E560F8EDEE396C84A5B8316F4800CF42508589CBDEFC76539
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/UFOlee.exe upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/UFOlee.exe unpack001/app_hook.dll
File Explorer
-
UFOlee.zip.zip 457KB
-
UFOlee.exe.exe 333KB
-
out.upx.exe 728KB
-
WebView2Loader.dll.dll 159KB
-
app_hook.dll.dll 96KB
-
settings.json1KB
UFOlee.exe
- SHA256 429be014260f55eb54c1422c7fcd16f5f5ab34fcb581486e30028ebce44da836
- MD5 cdf8756136c2cb33d20c50c36f1745c1
- SHA1 1d841d90985fcecb5660a9aa11a4d950571619a6
- SHA512 486603dc3283f43b89421c8d9c7f1d9b2012d3b16717ed47a21304b034e6e6b9b40d342f2abbce51a0e49294aa8c976bd2129b3b79fe1cb76b15350596d9a891
- SSDEEP 6144:cEpcXuZ54YsgB/THx/2M45UKqGIieqkIfH8ZBxynoULD3Yf0T:xmCLsgRTRIZqGjQIfHIBcoo7T
- TLSH T1B37423C50A067A9DC4D72875956839E1CE24F71FA3AEC3E13D9909C8683CBEBC449DD8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
eb:1c:fe:f4:e8:cb:46:47:9e:6d:b2:41:88:8d:89:fc:78:2e:45:df:a3:e3:5f:c2:66:f7:fa:02:de:14:3e:9e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Desktop Enhancement Services,O=Microsoft Windows Component Publisher
Chains
Sep 15, 2026
CN=Desktop Enhancement Services,O=Microsoft Windows Component Publisher
Subject
CN=Desktop Enhancement Services,O=Microsoft Windows Component Publisher
Serial Number
3d:4a:46:a5:75:f5:ab:ac:40:31:7d:52:d5:79:fe:1b
Issuer
CN=Desktop Enhancement Services,O=Microsoft Windows Component Publisher
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2026 - Aug 30, 2036
Minor OS version
0
Major OS version
4
Entry point
801408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
275KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
55KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 aa18f073e5932384352cead522976a1692ab6237336acb56ec75bcef5ec3586f
- MD5 d7d31d28949cf4a9e4152fe95819b189
- SHA1 be83d8a81e1ac16b43037132baf07f78097d19b7
- SHA512 096972ca0970150ed0651682b449c96a990ed7d61599be3784738e1840b6f45fdf0473112872060d77c152b6c5a0cc0500adf80275d1c186cf76621ff0a4fbcb
- SSDEEP 12288:sqvs9M8cfIFWH1wfzCyAZJEUf1+7XOtV+5JGb8b/sXO7oo:fvs9fjFWQzCyin5O8o
- TLSH T193F4391BE7E350BCD17BC13885A75332B933BC190534AE6F1298CA362F72E51593AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
399KB
Virtual Size
399KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
214KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
WebView2Loader.dll
- IMPHASH 1d9cc3b38dfd9bed2be6d6bf0e209d61
- SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
- MD5 0243cb84351c92ddea3fc0334f3a52ae
- SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
- SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
- SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
- TLSH T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
77:28:d0:57:a2:4b:5e:a5:f7:75:de:a8:49:f9:33:4a:fe:99:43:b0:c9:af:7c:06:c7:59:14:08:7e:7a:73:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 23, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
22288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
app_hook.dll
- IMPHASH a20ed6fac5a46b84aaf1297618053080
- SHA256 af36936f9d4fc86a45cbc209e7ef33f96aae446b02c0b82a9be502f5afd3e4ed
- MD5 166f172668adf4e55c453f5aba5164b9
- SHA1 75dcb80f980a30415c2ba37394acf007b4751c2b
- SHA512 9c64ed945908cfd5d377da62f2c0b08b02d4dacad5d9fdc7ef7f00ef6d36e0bd4dd6c9c59b6a8e0d90f5c335b56086ef71fe248629ad06b84648d4002b0a5ee8
- SSDEEP 3072:kcv7flCzRilaRoG31I6pps2rCkwx6S78+mPO1t:9v7flARilaRoG3U9QO1t
- TLSH T1D3A36B12F1C324FDC656D17091975A72EAB3B8240520FE7F12A8EB343D62E51BE2DD29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
70:e9:cc:92:2d:00:4f:1d:a8:d2:66:5c:20:31:58:8b:d0:0c:55:7e:39:fb:39:61:81:a5:54:bf:bd:6a:03:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Desktop Enhancement Services,O=Microsoft Windows Component Publisher
Chains
Sep 15, 2026
CN=Desktop Enhancement Services,O=Microsoft Windows Component Publisher
Subject
CN=Desktop Enhancement Services,O=Microsoft Windows Component Publisher
Serial Number
3d:4a:46:a5:75:f5:ab:ac:40:31:7d:52:d5:79:fe:1b
Issuer
CN=Desktop Enhancement Services,O=Microsoft Windows Component Publisher
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2026 - Aug 30, 2036
Minor OS version
0
Major OS version
4
Entry point
4592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
crypt32
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptMsgClose
CryptMsgGetParam
CryptQueryObject
gdi32
GetObjectType
GetStockObject
kernel32
CloseHandle
CreateEventW
CreateFileW
CreateMutexW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FlushInstructionCache
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemInfo
GetThreadContext
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MultiByteToWideChar
OpenEventW
OpenFileMappingW
OpenProcess
OpenThread
ProcessIdToSessionId
QueryFullProcessImageNameW
ReadFile
ReleaseMutex
ResumeThread
SetEvent
SetLastError
SetThreadContext
Sleep
SuspendThread
Thread32First
Thread32Next
TlsGetValue
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_stricmp
_unlock
_wcsicmp
abort
calloc
fprintf
fputc
free
localeconv
malloc
memcpy
memset
realloc
strcmp
strerror
strlen
strncmp
vfprintf
wcslen
wcsncpy
wcsrchr
user32
CallNextHookEx
FillRect
GetAncestor
GetAsyncKeyState
GetClassNameA
GetGuiResources
GetWindow
GetWindowLongPtrW
GetWindowRect
GetWindowThreadProcessId
IsWindow
IsWindowVisible
PtInRect
WindowFromDC
wsprintfW
AllocateBuffer
CreateTrampolineFunction
FreeBuffer
InitializeBuffer
IsExecutableAddress
MH_ApplyQueued
MH_CreateHook
MH_CreateHookApi
MH_CreateHookApiEx
MH_DisableHook
MH_EnableHook
MH_Initialize
MH_QueueDisableHook
MH_QueueEnableHook
MH_RemoveHook
MH_StatusToString
MH_Uninitialize
UninitializeBuffer
hde64_disasm
hde64_table
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
580B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
settings.json
- SHA256 4dda8d49e42cbe9658dd5ca37204ab6be3e7dfec1108b2b75f04e53f7948aed0
- MD5 c5f88706caf28883753e339c348ad72c
- SHA1 4f60441846df30840e3ff31cb7ff899c318bac33
- SHA512 f90b957d7f28ae08369b6ce251e157524a9ff1d110685ac1362a913b3873ce81c9176e6d7b099d0d2e3a18dea48773c60a6dc7890b4e4cbb4cc74a9bc6d242a4
- TLSH T1C921C1449E7A14FD60E6F1143F7FDB4B5ED9971611602912BF78AA0C6F318BCA102E1E
- MD5 SHA1 SHA512 TLSH