c940c98002441677156c680643b80f71004572531a580503b8ecd491f1541132
- SHA256 c940c98002441677156c680643b80f71004572531a580503b8ecd491f1541132
Overview
overview
6Static
static
3WFE Applic...er.exe
windows10-2004-x64
3WFE Applic...er.exe
windows11-ltsc_2024-x64
3WFE Applic...pp.exe
windows10-2004-x64
3WFE Applic...pp.exe
windows11-ltsc_2024-x64
3WFE Applic...ll.dll
windows10-2004-x64
3WFE Applic...ll.dll
windows11-ltsc_2024-x64
3WFE Applic...er.exe
windows10-2004-x64
6WFE Applic...er.exe
windows11-ltsc_2024-x64
6WFE Launcher.exe
windows10-2004-x64
3WFE Launcher.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WFE Application/WFE Launcher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
WFE Application/WFE Launcher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
WFE Application/WFEApp.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
WFE Application/WFEApp.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
WFE Application/WFEDll.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
WFE Application/WFEDll.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
WFE Application/WFEUpdater.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
WFE Application/WFEUpdater.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
WFE Launcher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
WFE Launcher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target c940c98002441677156c680643b80f71004572531a580503b8ecd491f1541132
- Size 1.9MB
- Sample261002-mmcmdsxbjg
- SHA256 c940c98002441677156c680643b80f71004572531a580503b8ecd491f1541132
- MD5 71ee9f9abd1d8205ce9836fa67a83fe9
- SHA1 4b33e514f809858a2fed671646ee204b0f320e0f
- SHA512 c2c4eb180eb49b81e87afcfc2f7089bc1f51ff03ea9a1990c490c7793455e45fa97ef827b08c6571541cbe3307322cbe727a13a2063f88cbb2236e148566f7ac
- SSDEEP 49152:ouKOmQHhq53T9wJpxuiA1Uak24h3muXOxdijloiCyqtidqvM:JOunloiCjG
- TLSH T16095AD5273578133E96D23F284271B21A32EBC172B5197DF6A87352D2AF03C16932E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/WFE Application/WFE Launcher.exe unpack001/WFE Application/WFEApp.exe unpack001/WFE Application/WFEDll.dll unpack001/WFE Application/WFEUpdater.exe unpack001/WFE Launcher.exe
File Explorer
-
c940c98002441677156c680643b80f71004572531a580503b8ecd491f1541132.zip 1.9MB
-
WFE Application/ChangeLog.txt77KB
-
WFE Application/Language.xml50KB
-
WFE Application/Localisation.ini527B
-
WFE Application/ReadMe.txt15KB
-
WFE Application/Sounds/wfe_closed.wav56KB
-
WFE Application/Sounds/wfe_started.wav58KB
-
WFE Application/TestCommands.ini6KB
-
WFE Application/WFE Launcher.exe.exe 56KB
-
WFE Application/WFE.mpq193KB
-
WFE Application/WFEApp.exe.exe 625KB
-
WFE Application/WFEAppStyleDefault.ini818B
-
WFE Application/WFEConfig.ini6KB
-
WFE Application/WFEConfigBase.ini5KB
-
WFE Application/WFEDll.dll.dll 643KB
-
WFE Application/WFEGameColours.ini385B
-
WFE Application/WFEUpdater.exe.exe 106KB
-
WFE Application/icon.ico9KB
-
WFE Launcher.exe.exe 56KB
-
[必看1]WFE本体使用说明.txt3KB
-
[必看2]WFE Launcher使用说明.txt1KB
WFE Application/ChangeLog.txt
- SHA256 f1189e19ec83e8939740b254b22033fd78711b70a51e088d3d0d2e040fb22f55
- MD5 d79b23c732e86e1edf3b7eb26d89d429
- SHA1 bf3ac635d5710232cd2a683842a24df9a80eaedc
- SHA512 d1da26da30b218ababe23847d783c7b5a65dc82cb0ed132300ce62e7fbf37782f3cf56b098ea2a2c60575e7c5236488b1c358377798e1ac9e9022409994e09ad
- SSDEEP 768:8KyaqoRlztkilovEfWhqb6hSXz8x1jsF6j6CrtQo/nrDZPRJrOObTrL3pbQFZmKD:Eaqoh1e1jP9pKObTrL3Y+4vSU2+n
- TLSH T1DA73E813320733370CA19172673D7172EF2980AD57A6679134ADC25C3FA686DA23F9DA
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/Language.xml
- SHA256 819ee408300f28e85d73d86d564072c7e11b47ccd50874176ce55048435bfb10
- MD5 5199392ec21cceb60270b73e01d821cd
- SHA1 151065aa45181e1f8c3c057b287c5fe3ae857966
- SHA512 e7cb5bfc89dafaa82579844f34763bbecd881ac7f221334718581408d96a38b5bc01b928373f80b2e7cc134d8f7142268ab5cbf9f0a994e2393aeb68eed7efb8
- SSDEEP 768:+WdD5V68XvKIU/602Dday1x0le314S/r+SEvT3CLq5+3pH:VbXvKZ2ha5le31v563CLq8H
- TLSH T1F4331F7672EE128DA30D16CBC0B50F06B46FFDBC62421B3A945709BF73B68944B93529
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/Localisation.ini
- SHA256 518f39d91ccd769635dbe902f633c1548a91f93d14b0c84375fe6fff16b7f96a
- MD5 054bbc6cd6279f8a76802c7aabf817f0
- SHA1 8976f70329aca1aaacfe65fd1b9f2ee734d72841
- SHA512 7382141b5cc9199ceb3f28cc101b260ad4216acf4a6f3ffc32179bf4fdfc9c4377b8631eb96cae417658b856ab723809adf6ed09e7d3b5a445d3cbbd6e3a1596
- TLSH T1C9F0507755984384A0807B0FF35E9DAAF42BC552E7C517B94D1117564B3225C135DDC1
- MD5 SHA1 SHA512 TLSH
WFE Application/ReadMe.txt
- SHA256 974a3f02ab612b08695dbfc340e794701fc4094290c2ef9f5572380de54bb1da
- MD5 c2689936051a047074f91187d9a23a18
- SHA1 7f80ac872c99397954159405c37dfe531152536f
- SHA512 c1bc64afd2578e77a933104355ddeaf54f0722df2f610ea9df26f55c94c2d906539d3a862f4d5dd58d51725a88e336f576583a1fc49d1347540cb1622ce36fad
- SSDEEP 384:2hbMHQZdB2pwpjzB8S5AI2zxWKwMPM2JQel8J4BKCyAwsFrPUlNi:gIw5zB8S5AIiWKwQDQel8SBKCym58fi
- TLSH T1AE720053625BA3334532107125DE72AED33689DF836A66B034CEA18C2F32359563EDDE
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/Sounds/wfe_closed.wav
- SHA256 a1b1323b6127c6db9fca7d81f95ddbb08bb259d3ee5a0b9ceb5f1e3817ab7a10
- MD5 bb684f9425a402d3c532130c02967c79
- SHA1 debc8c0a32faef2608e59caaae25f0cbf3ee4b2b
- SHA512 2f3e96e3f7d1e1203c70ac8c350cfd8bbbfc3a35d53156a1b4daf24dfd78534efc8568c46834a6ce52115e3c3460f6c463a62b384a1fd9db2b6f7fa989768f42
- SSDEEP 1536:rQTAH28KEcPxrVKWz/x6S7VdNQ/FwG4GUltL9JsIs:sTi28PQZDx6qVdMwG4bZC
- TLSH T1E643D042F0A3C214D0734B7F9D801C952E19BC8DEE56987B2147FF69B273B21B9A169C
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/Sounds/wfe_started.wav
- SHA256 f9b0f67535bb1677d3da062707184c47e98f82adb8ca3c66e9997ef8b451d64b
- MD5 49e9ef4b2e1e87adec3a5956e81d3916
- SHA1 e21ab7edeb8a191b58e0aa09fba3182f63c7906e
- SHA512 4f326b2874af9bd7e0b9502c4f7e74b0fc703426d845451e9868f22abf113aedc232c4870b46419602b0f4cf328eb64f52650215c02ef7f593e2e12f1500c38b
- SSDEEP 768:LhW138MLm/6NBp9/hOig2C1Uufj+IIyM2v6sdpamcYRY2KMVTSABLAlN+ihyp83G:LQTP/vhO6CtL+3kd9lY2DkT+J8AX
- TLSH T1CB43CF93F1438E10E4358E3ADE8584400AA7BD8CFF99A11F7103FF5939B7651A8AB754
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/TestCommands.ini
- SHA256 ad87fea3491c0a48bcd9bb4a91f40608eea338863db8118356e1bbc316176347
- MD5 131ff5a4dd7cf95d135f152a251e4447
- SHA1 337e3c507335bca6ccf43ec705c0b783c9af9fcc
- SHA512 8f8fa39dd913bbe167a70c1ea110fa15e2f8f16245546fd3de356740b192dbf9c1af1bb7899b9e96258b85e2f70fc849f98a87a254a32aae2a41ad300efe770a
- SSDEEP 96:MojR7dPp2hkZZIFfnfnfssQPcEmkOl1pZSDiNeJcB216vWli8XC/wJck3/H3:MQR6qZ+Vfn0dlO7pZSDJJcxLwJck3/H3
- TLSH T13BE163705312753754B669B3D54EB0E0E9B6E04C4BF4E6D0F65FA06C6A2182DC63FC92
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/WFE Launcher.exe
- IMPHASH bcb18e639ee0ffeafd91babfb92aa489
- SHA256 8f3d72dcd0adb14074af48bf3072ea9de7b6d0579a7a756a6bb2cc2cf50aea07
- MD5 a658fd18cd6a36be5bd053ea4f1d51ab
- SHA1 70d21f07d10261a3533ae066b235787a5d0a8c37
- SHA512 ce4094c1eec6555ffbe58a73ad7a1ba2b45a753deb39fcc34835e15f9cabfad531b988ac36db2b1e2c7ae2dd26d095200844cd221877ea395b24ea05f65be119
- SSDEEP 768:lCF2OlT8ZTGQcjTmtJzh/a+FFc5dW3Fr68y12/6A5V9VRVPJGYN1xvsAzCF2OlTw:lU4f4mtJzrFrn5PJGYWAzU4f4mtJz
- TLSH T14F437C339AA4402AF59246F11D72963D7836BD3A1050DE4BB689BE181F34983BDF533B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord626
__vbaStrCat
__vbaForEachCollAd
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaLateMemSt
__vbaExitProc
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaBoolVar
_CIsin
__vbaChkstk
ord526
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaStrCompVar
__vbaVarCat
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaVarLateMemCallLd
__vbaFpI4
ord616
__vbaVarSetObjAddref
__vbaLateMemCallLd
_CIatan
__vbaStrMove
_allmul
_CItan
__vbaNextEachCollAd
_CIexp
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=1, id=9, version=8783,
count=1, id=13, version=8964,
WFE Application/WFE.mpq
- SHA256 449c9548ea9306186282fe4c07b5fecbe30dd62668f7e271ac27773293b747e5
- MD5 9b0479a81cb67f07b00b6377f7fdfde1
- SHA1 c5c0d8ea7bfc601474308c8e5e9d4faa75eb99d3
- SHA512 1fd77d8ba1343323fba9324bc34e6812dc29295a4cab48a2d92c3b200ceafdfccd8668e6417ddf1b086dd6c2c613ef81bd1f07174a26825050794f873bab1f52
- SSDEEP 6144:AApdv8gNUUeA2rroTcv9ZQkW9kQdGkK3V:BpdUgin5rroIvQ2l
- TLSH T19D1412539043EF1696C714B1504B6670EADCC1BE02A6EA3D7A416D8BF08B17FB17CE62
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/WFEApp.exe
- IMPHASH 8a2b135375a113f10ac99245eeae3a4a
- SHA256 9b5e46ed71e9978ed974996da82deb92015051f066edd03190aabdf77e51f20a
- MD5 e917fd0c95c85b1aafcca1708c4d70fc
- SHA1 f1f5b2515176179a563b250eaca60d515135547c
- SHA512 46ae8ff36e83b7f56c4678546686dcbe16d654601f0a8632bf8868b5e3cb2bcc77e5229149505c6d1612cd9745dc7f2f2f292e3c8f797e3e6222926b25f86ad0
- SSDEEP 12288:njqthzCwyJ8nStGiMu9Mu9FJFwJpxuiA1AHak24h3muXOxqEPcUxPMuw:nj8yJ8nStbMu9Mu7wJpxuiA1Uak24h31
- TLSH T111D43B8273664627E6AE7BF2D47306216363BC177B11A7DE5E07702826F07C4A422F97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
242369
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Files\Work Files\Programming\C++\WFEUpdate\Release\WFEApp.pdb
api-ms-win-crt-stdio-l1-1-0
fgets
__stdio_common_vfprintf_s
fclose
fopen
fopen_s
api-ms-win-crt-string-l1-1-0
isspace
tolower
strncpy
_stricmp
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
api-ms-win-crt-runtime-l1-1-0
terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_initialize_narrow_environment
abort
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_execute_onexit_table
_initialize_onexit_table
_register_onexit_function
vcruntime140
memmove
__current_exception_context
__FrameUnwindFilter
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_except_handler4_common
memset
__current_exception
strchr
kernel32
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
VirtualFreeEx
GetCurrentProcessId
Sleep
WideCharToMultiByte
GetFileAttributesA
GetModuleFileNameA
K32GetModuleFileNameExA
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
OpenProcess
Module32Next
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
Module32First
GetLastError
CloseHandle
CreateToolhelp32Snapshot
Process32First
Process32Next
user32
FindWindowA
EnumWindows
GetWindowThreadProcessId
GetAsyncKeyState
GetKeyState
PostMessageA
advapi32
RegQueryValueExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
msvcp140
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
api-ms-win-crt-convert-l1-1-0
strtod
strtol
strtoul
strtof
mscoree
_CorExeMain
??0INIReader@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Get@INIReader@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@00@Z
?GetBoolean@INIReader@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?GetFloat@INIReader@@QBEMABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0M@Z
?GetInteger@INIReader@@QBEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0J@Z
?GetLong@INIReader@@QBEJABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0J@Z
?GetReal@INIReader@@QBENABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0N@Z
?GetUInteger@INIReader@@QBEIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0J@Z
?GetULong@INIReader@@QBEKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0J@Z
?MakeKey@INIReader@@CA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@0@Z
?ParseError@INIReader@@QBEHXZ
?ValueHandler@INIReader@@CAHPAXPBD11@Z
EnableDebugPrivEx
GetExePath
GetExePathByName
GetProcessIdByName
InjectToProcess
InjectToProcessByName
InjectToWindowByNameEx
InjectToWindowEx
Name
.text
Size
233KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
347KB
Virtual Size
346KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30625,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=20, id=261, version=30625,
count=9, id=260, version=30625,
count=1, id=259, version=30625,
count=6, id=257, version=28900,
count=88, id=1, productName=Unmarked objects,
count=12, id=261, version=30706,
count=1, id=256, version=30706,
count=1, id=255, version=30706,
count=1, id=151,
count=1, id=258, version=30706,
WFE Application/WFEAppStyleDefault.ini
- SHA256 72ff3a5eb7d5d069f08df0ae9aea5bba170d25ec477bc06fc55f32b3c2bd92d0
- MD5 30f29a77086d186f998a3a782840baf3
- SHA1 594fbf658cce7ea2781a1476851dd8ce13d2508b
- SHA512 6818248b4c04911d7ec926d7e5475e12282470ac8fec711b0fd645fc40b6f858afb534782ddd179aadf9635e393c95930a9ecd5a990eb7ba4cf6a4924659757c
- TLSH T1EF0146FF10FBDA8791720CAB3895C9B5A1216A157C4993C2FBC8C3093D34390392861E
- MD5 SHA1 SHA512 TLSH
WFE Application/WFEConfig.ini
- SHA256 d7441c2b23eb382f3bef42f7761c792877ffd1834cbe1a097e3f01b6ad890ead
- MD5 ca815af27627929a669af26d01ce709b
- SHA1 1f595fc865ba3bd13b0f7f16af60b94f80cea8ea
- SHA512 c01fea2fd92f1c1d6c4b08b1a4db24bd1f84e4e35316abd4c034fb0eb01cb8e34c8d77f99849f1dad7da6afe0b25e68e8b644ef0250ddc96b2eb5a6af5b087e2
- SSDEEP 192:7oT9qjMkqZHAquxzin0H2LUreP5ZF8/8FW+InB:7oP9Ain0VSP5ZFiDB
- TLSH T118D1B9B110540B8498495B0BD806820094EDBACDA99BCB53F5AC4E79FEF8FA5330BD77
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/WFEConfigBase.ini
- SHA256 24f67726133b608c822df15a0745b624b3b3ae350f955b5d8ca2f649ade02bed
- MD5 c4b5e415f610a399385b9a2bc0ec1028
- SHA1 4f3fb81a1af228f5f1ed45123a0ba024874396db
- SHA512 b5ee502e57c21f710a200094b8ad7a64638e8a45abb2214526146396786e57f31806f56ff21b26bd82c68e0fce325a610955c7ab4f926bc7f427d346ed31b284
- SSDEEP 96:Ujijof7Bje5pIZJ1/AquxzinCHhAiKbDUrek585tAlO7FtFg3Iw6/Ac2tNXRIMD:Bof7BjApIZ7AquxzinCH2LUreP5ZFBwv
- TLSH T168B132A615590644905D9E07E8069300E0DEB9CDAD8BDB43F8AD0D79FEF4F922346E37
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Application/WFEDll.dll
- IMPHASH 5d7b529f09bcd24ddf915eb18d840e5c
- SHA256 96f546b8d48b921abd65f37b2591bb1bc2bf591eb4f63f761a59ff441531a1a4
- MD5 7cdda1d65d80a0a72f5454eef54dcda5
- SHA1 fc16cea8cbbd90e3987c9cdb9da5081d58ddd54f
- SHA512 8cd5565b378a9111cf6b8d82d3b8d50455aee41494b36085dc71e180831b3421f9c15d3cfa819802e31efb69a1c3c178de8abeda192c3cf92f02c445a8c70ac3
- SSDEEP 12288:xSH72b8PYEu7iQMoC+M1lgziQPTX19MS0qpiNsid:u7Y1Eu/urlgzimlmFqYNsid
- TLSH T193E46D11B347C0B2EC7D11B5502C6B76567CAC241BAC99EF97E16E3A9C701C3693AE0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
336770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Files\Work Files\Programming\C++\WFEUpdate\Release\WFEDll.pdb
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
HeapReAlloc
GetProcessHeap
GetStdHandle
GetConsoleWindow
FreeConsole
AllocConsole
SetConsoleTitleA
K32GetProcessMemoryInfo
GetCurrentProcess
GetCurrentThread
GetModuleHandleA
WriteFile
CloseHandle
ReadFile
VirtualProtect
FlushInstructionCache
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
TlsGetValue
GetTickCount64
GetFileAttributesA
GetModuleFileNameA
DisableThreadLibraryCalls
K32GetModuleInformation
GetLastError
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
VirtualAlloc
VirtualFree
SetStdHandle
SetLastError
FreeLibrary
LoadLibraryExW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileSizeEx
HeapAlloc
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
VirtualQuery
SetEndOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
HeapSize
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
LocalFree
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
GetExitCodeThread
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue
TlsFree
GetFileType
user32
ClipCursor
MapWindowPoints
BlockInput
MapVirtualKeyA
DefWindowProcA
SendInput
ScreenToClient
GetCursorPos
GetWindowPlacement
SetWindowPlacement
GetWindowLongA
MonitorFromWindow
GetMonitorInfoA
GetActiveWindow
FindWindowA
ShowWindow
GetKeyState
GetForegroundWindow
GetClientRect
SetWindowLongA
SetWindowPos
SetTimer
KillTimer
SendMessageA
GetWindowRect
??0INIReader@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Get@INIReader@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@00@Z
?GetBoolean@INIReader@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?GetFloat@INIReader@@QBEMABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0M@Z
?GetInteger@INIReader@@QBEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0J@Z
?GetLong@INIReader@@QBEJABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0J@Z
?GetReal@INIReader@@QBENABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0N@Z
?GetUInteger@INIReader@@QBEIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0J@Z
?GetULong@INIReader@@QBEKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0J@Z
?MakeKey@INIReader@@CA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@0@Z
?ParseError@INIReader@@QBEHXZ
?ValueHandler@INIReader@@CAHPAXPBD11@Z
Name
.text
Size
474KB
Virtual Size
474KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=259, version=28900,
count=185, id=261, version=28900,
count=26, id=260, version=28900,
count=1, id=253, version=30625,
count=78, id=261, version=30625,
count=15, id=260, version=30625,
count=23, id=259, version=30625,
count=9, id=257, version=28900,
count=210, id=1, productName=Unmarked objects,
count=3, id=261, productName=VS2019 v16.0.0 build 27508, version=27508,
count=143, id=265, version=30706,
count=1, id=256, version=30706,
count=1, id=255, version=30706,
count=1, id=151,
count=1, id=258, version=30706,
WFE Application/WFEGameColours.ini
- SHA256 7e06b3714fbc715c68b9dc8836de20d0f898d31c02c34219791770a0ce881e17
- MD5 06a3619c4631388def7f9e55f4699096
- SHA1 c4a8ef64a43525a5e01cb9c2811ff53bb319d4d8
- SHA512 4aea42df8c8068590abdbf8cd66a46943475692d93d530b8bf6e66b786b13326d15c9d244a2a54cb58cb4667a10af4b54e53fdb0491a867889184c74cbf41a45
- TLSH T14FE07619415F1340A2100089370F4223248FEACE259FBE2233BED8B3BF85B02138B0CB
- MD5 SHA1 SHA512 TLSH
WFE Application/WFEUpdater.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 40f9fa689bff61b174eafbd74253d556066255e6aa8963a6871b8f71a4c377ff
- MD5 60a27f14a71f6b02f110f2b9ce370417
- SHA1 5d30f26dde8cd5b244ac4c2ff6cb5e070a3f9e93
- SHA512 0f17035d9afd68e2eeedcfb9c906c8cb18070656c151c8e67acc1866ec4db67dc0d67b7a2d1f1fde6e741b21e366920a7c39f22955fc4db8875721b80a84899b
- SSDEEP 1536:U0U6yxB3MEehOFymAPpxWMBDGuPIjkz0QR1kABpPWMBDGuPIjkm:wpZehUyVhzYuPdvFYuP2
- TLSH T163B3BF94179A8932C6FD0BF4A937848A47F0ED476926DF8B1E9078B54ABF3500B07B43
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
76030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
WFEUpdater.pdb
mscoree
_CorExeMain
Name
.text
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
WFE Application/icon.ico
- SHA256 c91537b63d424c2d1018f94aca25c73a51f1ac92a648f2da150a521af7d00558
- MD5 67d87cf187f5c6f9ba46993f443540a2
- SHA1 329e03e9332f59fb4420ac3e93df64b411e9c823
- SHA512 935bf3257cc7d3fc552aff6ca8259328880a3b450fa4857b7d224b80fd4af0c0d8b996f3318736efc87ad943f6d8227d875e7fc248d46b069f51982b0a9b9e5c
- SSDEEP 192:aCAirR0X31UAwzejv2yf1d9klTJm6MVTG3L0c0cT5a4OHPtJz0I:aCv9rvu1dOlTJm7VTG3L0c0cTxOHPtJl
- TLSH T19F128D3513919469E1C22EFDFAE5B53EF9B86F4A68C0FBA4431A3D641F346808ECB051
- MD5 SHA1 SHA512 SSDEEP TLSH
WFE Launcher.exe
- IMPHASH bcb18e639ee0ffeafd91babfb92aa489
- SHA256 8f3d72dcd0adb14074af48bf3072ea9de7b6d0579a7a756a6bb2cc2cf50aea07
- MD5 a658fd18cd6a36be5bd053ea4f1d51ab
- SHA1 70d21f07d10261a3533ae066b235787a5d0a8c37
- SHA512 ce4094c1eec6555ffbe58a73ad7a1ba2b45a753deb39fcc34835e15f9cabfad531b988ac36db2b1e2c7ae2dd26d095200844cd221877ea395b24ea05f65be119
- SSDEEP 768:lCF2OlT8ZTGQcjTmtJzh/a+FFc5dW3Fr68y12/6A5V9VRVPJGYN1xvsAzCF2OlTw:lU4f4mtJzrFrn5PJGYWAzU4f4mtJz
- TLSH T14F437C339AA4402AF59246F11D72963D7836BD3A1050DE4BB689BE181F34983BDF533B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord626
__vbaStrCat
__vbaForEachCollAd
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaLateMemSt
__vbaExitProc
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaBoolVar
_CIsin
__vbaChkstk
ord526
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaStrCompVar
__vbaVarCat
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaVarLateMemCallLd
__vbaFpI4
ord616
__vbaVarSetObjAddref
__vbaLateMemCallLd
_CIatan
__vbaStrMove
_allmul
_CItan
__vbaNextEachCollAd
_CIexp
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=1, id=9, version=8783,
count=1, id=13, version=8964,
[必看1]WFE本体使用说明.txt
- SHA256 d1c73ad27ddffe1290322dcab9a77eb8b80a6bc9e7d0f9f973c08f96fc41023e
- MD5 29e4076f15e12d0c198c56ed1d875de8
- SHA1 d1d3b5b79c96a77ab8d91f0b955fb5102a7765b6
- SHA512 12c4ff03c35014a60f7caf5b78af8f6af7cea3f80fe7cd6a97080c4f68d77ee9ffccfc793b0b66d8437367194812632a3c625ec17f17f4ff9f231396fcab181f
- TLSH T1B871C8D210AC5FBC016235EE17959062F40D7E9FF977F6256A1280DB3980A2ADA1AD0F
- MD5 SHA1 SHA512 TLSH
[必看2]WFE Launcher使用说明.txt
- SHA256 e0f8c7a732a22551224e0ad23eeff778553957d2c864bfbe28c91937718fbeb8
- MD5 ddb0b2e1edf4fc34c381e7a3548cf6e1
- SHA1 c28a372b23b760ba1ef027a77a605e2fd22b3009
- SHA512 efd9b983a0c19842a569f649aca02caad667da540ffefd6965a1818b500bf7362a924ecea4c700bf689da69339cab9975056735e3a1073b8cd3b99e0421f211c
- TLSH T1A64130D6028BC030A4F39BBD039848BAA253796B3D468E20ABF5051A39CCF898CA5549
- MD5 SHA1 SHA512 TLSH