uwus.zip
- SHA256 dffc978ad0f2cdbe2c2be6060cfc4d2adafd007bbe9395bd526189b9b8b5b753
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
uwus.zip
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target uwus.zip
- Size 65.7MB
- Sample261023-vx8ftacy6z
- SHA256 dffc978ad0f2cdbe2c2be6060cfc4d2adafd007bbe9395bd526189b9b8b5b753
- MD5 a90e964e67c3e367dd79f85f5e72e1a2
- SHA1 f04e7027df946a4c42ada18fa2bb3b62b0bf413c
- SHA512 b435715fdc53024e38d62d5daab22a44fed91c2e8f7ee6ee6661621024327301b86d6a180309f549b9f2357bd50f90ce4e927a3d101b4d0be274f1c099becd1e
- SSDEEP 1572864:1T15aUGPiFe9UF0KfYZGiMZm1g545inKGw2JYQ:8fD9UFncgq4EaF
- TLSH T103E733AA84907C99F445EBB387508D98F8E5707D9D098FE281C72A711BA777E0B00F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/v1.5.5/Release/neverlose-server.exe unpack001/v1.5.5/injector.exe unpack001/v1.5.5/neverlose.dll unpack001/v1.7.27-migration/Release/neverlose-server.exe unpack001/v1.7.27-migration/injector.exe unpack001/v1.7.27-migration/neverlose.dll
File Explorer
-
uwus.zip.zip 65.7MB
-
v1.5.5/Release/certs/cert.pem556B
-
v1.5.5/Release/certs/key.pem246B
-
v1.5.5/Release/neverlose-server.exe.exe 8.8MB
-
v1.5.5/Release/nl_cloud/avatar.png.png 197KB
-
v1.5.5/Release/nl_cloud/configs/3_Config.cfg83KB
-
v1.5.5/Release/nl_cloud/state.json1KB
-
v1.5.5/injector.exe.exe 10KB
-
v1.5.5/neverlose.dll.dll 60.5MB
-
v1.7.27-migration/Release/certs/cert.pem556B
-
v1.7.27-migration/Release/certs/key.pem246B
-
v1.7.27-migration/Release/neverlose-server.exe.exe 8.8MB
-
v1.7.27-migration/Release/nl_cloud/avatar.png.png 197KB
-
v1.7.27-migration/Release/nl_cloud/configs/3_Config.cfg83KB
-
v1.7.27-migration/Release/nl_cloud/state.json1KB
-
v1.7.27-migration/injector.exe.exe 8.8MB
-
v1.7.27-migration/neverlose.dll.dll 53.2MB
v1.5.5/Release/certs/cert.pem
- SHA256 417b8a6de8064f4f238c3adb9b72e64e20944d0c1a8ce6f37764e978ae2a2396
- MD5 8d85b4ed3d5245a0e9f3f6345bcc118f
- SHA1 7ff27915defcaf564667914e12829266b7e82f2b
- SHA512 f731a43816522aa1cc78f09af4f76deed75f174a121ba8ecfc8fd241b77cb672bfcd0a9ecfa9ff167e6bb8da2f5cebdb59bb49c4105adb5fbf77cb51cf57a3d1
- TLSH T1C6F026B94F728A1024D6C092874F0559C8527BD39A85DD8528DA0536A3187DD306FF0C
- MD5 SHA1 SHA512 TLSH
v1.5.5/Release/certs/key.pem
- SHA256 4f6bf3d52429cce79f5fc3014ddcf6dd21751db30c05f9dd03d4c97016d1334e
- MD5 1888732223ae166952d96f9bfd42b925
- SHA1 1150a39633c7616b8abbaef226cd4f43566b1292
- SHA512 84200d02a705ed52526944044ece887a9e7437359539e26e7fee3c354b7c44ce6dc86ccd537033a5fbefe9b895d04e17a67f6dedcca083e6c8b9da23c3d989b6
- TLSH T167D095FE2E8D0D8250D3D0B11C27623FCD3BC4531122EEA62AE311131C2CC62416C4BC
- MD5 SHA1 SHA512 TLSH
v1.5.5/Release/neverlose-server.exe
- IMPHASH 7fd180e62c218beb66b23bc61866aae9
- SHA256 1d74a2601192e03a023706467922e0c496078ab407d9a693e948921c159c36c9
- MD5 fe17e8e004655192cd8155795b7112cf
- SHA1 2a68b9722089bfb9c3b4527537c8ebc38f9f80d0
- SHA512 01f5be27b26c3138533aaec90ae9736db9834ec837bd6c2442f4a250edeb3b8f1398a5abb6c53515b2174870998cb5685d5ad939ebff96687b8bf1606b5a35cb
- SSDEEP 98304:rLkoEItSrv/zRuwDa2EbUdm5CxyNcHCnDgwBJ74MAg3kEPq6ClC9++Fe:PNEnVuwOPgWyMA4kEPq6ClC8E
- TLSH T1D7964B217B6B94ADC556C874C30B4A225E6570CB0B35B9FB70CC41383FA9AF81B39769
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5094444
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
neverlose_server.pdb
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
kernel32
CreateDirectoryW
GetFullPathNameW
SetFileTime
GetFileInformationByHandle
GetFileInformationByHandleEx
WaitForSingleObject
GetConsoleOutputCP
GetConsoleMode
GetStdHandle
ReleaseMutex
SetConsoleCtrlHandler
CreateMutexA
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
Sleep
ReadDirectoryChangesW
GetSystemInfo
FindNextFileW
CancelIo
WaitForSingleObjectEx
CreateFileW
GetCurrentThread
GetModuleHandleA
GetProcAddress
GetProcessHeap
HeapReAlloc
HeapFree
QueryPerformanceCounter
SetThreadStackGuarantee
PostQueuedCompletionStatus
AddVectoredExceptionHandler
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCurrentDirectoryW
LoadLibraryA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
HeapAlloc
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
QueryPerformanceFrequency
MoveFileExW
CreateThread
CreateSemaphoreW
GetFinalPathNameByHandleW
SetLastError
GetSystemTimeAsFileTime
SetFileCompletionNotificationModes
CreateIoCompletionPort
IsProcessorFeaturePresent
GetQueuedCompletionStatusEx
TerminateProcess
InitializeSListHead
IsDebuggerPresent
SwitchToThread
GetSystemTimePreciseAsFileTime
SetFileInformationByHandle
DeleteFileW
CloseHandle
GetLastError
FindFirstFileExW
UnhandledExceptionFilter
ReleaseSemaphore
FindClose
WriteConsoleW
SetHandleInformation
SetUnhandledExceptionFilter
ws2_32
WSASocketW
WSACleanup
WSAStartup
recv
send
shutdown
ioctlsocket
accept
freeaddrinfo
getaddrinfo
bind
WSAGetLastError
WSAIoctl
WSASend
socket
listen
closesocket
getsockname
ntdll
NtDeviceIoControlFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtCreateFile
NtWriteFile
NtReadFile
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
vcruntime140
memmove
__current_exception
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
__current_exception_context
memcmp
api-ms-win-crt-math-l1-1-0
pow
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
__p___argc
terminate
_initterm_e
_initialize_narrow_environment
_crt_atexit
_exit
_initterm
_configure_narrow_argv
__p___argv
_cexit
_c_exit
_set_app_type
_register_thread_local_exe_atexit_callback
_seh_filter_exe
exit
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
197KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=24, id=261, version=35207,
count=12, id=260, version=35226,
count=142, id=1, productName=Unmarked objects,
count=35, productName=Unmarked objects (old),
count=1, id=258, version=35226,
v1.5.5/Release/nl_cloud/avatar.png
- SHA256 1361229a2db9536c9e916cf5e22dc3716c15df3a0834872af4373c2359399991
- MD5 0326a7a91b16bd0a22caf3f4e8f6d8c7
- SHA1 b187c76fed919d6f7c4bd762e3eecad4efb7a854
- SHA512 c285c3fde466cae5403665dfd4f84d5e603e0ef4f8801ad817b06c5461259c9582ee8014986a0f3ce3697df96eda306fddf0439defea357dcf0e5f82047d1d9c
- SSDEEP 6144:cyP8GxNJnbgO91yIxUHYAHRSJm7/UEbjhw8v:cyk4z9wIxU4fJ2MgNv
- TLSH T139141234B5BC487FE52C7CFDE6EA9BE3A8318231A41E66B074183422E1E2B1C15793D5
- MD5 SHA1 SHA512 SSDEEP TLSH
v1.5.5/Release/nl_cloud/configs/3_Config.cfg
- SHA256 e84321ba14f097bfa07ba3870d34f62a42ae7cdb29e4f047c83642b36e33e6e3
- MD5 fe3354476b70ffe513f60a2ed50dc187
- SHA1 4b0cf7c63504526d8cb61e648422dbec29a4d06d
- SHA512 c2c520a44df8df9353354f6738c1fc2d0849bfef71c734cf863abed85daea35e805ef7577138bd0906ebafd58b54da695c1fa27817c9f8daf83598087bc96931
- SSDEEP 768:6UNhqAIvKTLRdnVwuzhCzRMT+RZJkgUs9xRzJmOsnJJ7NfDclGGlGGlGGlGGlGG2:jLjMZJSjddddR
- TLSH T1FF83E17B308DFC8C365A73A64856152488214258ECB5AFCF94FE90D878DBBD31DB924E
- MD5 SHA1 SHA512 SSDEEP TLSH
v1.5.5/Release/nl_cloud/state.json
- SHA256 e76c7f9f3892eefe569472d5556984182c7ca9c57913868d3a0347319550b129
- MD5 2243f55a30f1aa192e48f5c47a672f11
- SHA1 45909798a2ede8d571afd0ca9b55c227e76cc690
- SHA512 cd42ccd9686fcf3704e7e3a1f9d7c36deddc6448c0b3234b4177554b7ccfe4beefd0b343914717ed44949bdfb33c71468cded731874228194af474cd6ea95aef
- TLSH T12E411193649EFD0B379A7B12502B4C520110965A9DB1FA0B72CE41EC3EAF27725F821E
- MD5 SHA1 SHA512 TLSH
v1.5.5/injector.exe
- IMPHASH def7d54d9bcb77406595e0d172015441
- SHA256 f275c9fc108554794f176428983ad21fdd4bebcae6d294dbe80a4c053680dcfc
- MD5 31ae4c94456dfd036500dc465e46158b
- SHA1 69509a4c4a9b7a82518ce52ea1e5bbac7badbac4
- SHA512 7ebf7ef804e14a051e3da8598743f630490758613c618c68fc5692176ae85e9052b16d3fe88da193cad10ce30c69466fca8b4317a4e3cb20d2641063e7ef47a2
- SSDEEP 192:Sdak828jk4I6WMgJd9tw47Zq2bSibQm7E5pz6cS2a:SdF8jk4I6YJd9eSZJWibQm7N2
- TLSH T1E0222C83FFD05CF0EF6942380137D55EC7AE6A204A63BE176F94B8510976680F91A26F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4682
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntdll
NtWaitForSingleObject
NtWriteVirtualMemory
NtSuspendProcess
NtClose
NtQueryInformationThread
NtFreeVirtualMemory
NtAllocateVirtualMemory
RtlGetCurrentDirectory_U
NtResumeProcess
NtOpenProcess
NtCreateThreadEx
NtQuerySystemInformation
kernel32
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetProcAddress
shell32
ShellExecuteW
vcruntime140
_except_handler4_common
__current_exception_context
__current_exception
api-ms-win-crt-string-l1-1-0
_wcsicmp
wcscat_s
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_set_app_type
_crt_atexit
_configure_narrow_argv
terminate
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_controlfp_s
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35403,
count=1, id=259, version=35403,
count=12, id=260, version=35403,
count=19, id=261, version=35403,
count=7, id=257, version=33145,
count=59, id=1, productName=Unmarked objects,
count=1, id=265, version=35730,
count=1, id=255, version=35730,
count=1, id=258, version=35730,
v1.5.5/neverlose.dll
- IMPHASH e9363b73b719d11901bb54c5928f6031
- SHA256 d090ec359d047a5a5b5a5abd6b53ed92dc7c38d0083e32b7dc5e5e18e502b935
- MD5 54b0cc482b46b04662e3679f9b8769b6
- SHA1 ed51935789255ca4a37e5ccac95ab2cece4e1165
- SHA512 b533a5c2c526a94ab106354dc27538372c81962cbb7ff886565214bc7d4f7081d06be10a9cf32886f7e26bb74d87f9f948ae0415a903ab19dacb98af2d209e0d
- SSDEEP 786432:FGBVk4lCCS270hmKLMHvX2jT2O7je28p3TIrgcvY:FWVkSqMHvm+Ee28
- TLSH T17FD7E102F642D0FBC58213F1E11E9F7E5D29865697204CD7F7889EAD8AF52D4203AB2D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
63524864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
NtClose
NtProtectVirtualMemory
NtFlushInstructionCache
NtTerminateProcess
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtQueryVirtualMemory
RtlPcToFileHeader
NtResumeThread
NtWaitForSingleObject
NtQueryInformationThread
NtCreateThreadEx
kernel32
SleepConditionVariableSRW
SetWaitableTimer
SetLastError
EnterCriticalSection
CreateWaitableTimerW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
CreateMutexW
WaitForSingleObject
ReleaseMutex
PostQueuedCompletionStatus
CreateEventW
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
SetEvent
TerminateThread
CloseHandle
CancelIoEx
QueueUserAPC
LocalFree
DeleteCriticalSection
GetCurrentProcessId
WideCharToMultiByte
SleepEx
FormatMessageA
CreateIoCompletionPort
VirtualFree
VirtualAlloc
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
HeapAlloc
GetThreadContext
GetProcAddress
UnhandledExceptionFilter
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleHandleA
LoadLibraryW
K32GetModuleInformation
QueryPerformanceFrequency
GetStdHandle
AllocConsole
SizeofResource
LockResource
LoadResource
FindResourceW
AddVectoredExceptionHandler
TlsAlloc
TlsGetValue
TlsSetValue
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
GetSystemTime
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
InitializeCriticalSection
ReleaseSemaphore
GetExitCodeThread
CreateSemaphoreA
GetEnvironmentVariableW
GetACP
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTimeAsFileTime
TerminateProcess
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WakeAllConditionVariable
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetLocaleInfoEx
GetModuleHandleW
InitializeSListHead
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
MoveFileExW
AreFileApisANSI
QueryPerformanceCounter
SetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
CreateFileW
CreateDirectoryW
user32
MessageBoxA
GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
advapi32
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
msvcp140
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??Bios_base@std@@QBE_NXZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Syserror_map@std@@YAPBDH@Z
_Xtime_get_ticks
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?_Random_device@std@@YAIXZ
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
_Query_perf_counter
_Thrd_detach
_Mtx_unlock
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
_Cnd_do_broadcast_at_thread_exit
?xalloc@ios_base@std@@SAHXZ
ws2_32
getservbyport
gethostbyaddr
socket
inet_ntoa
getservbyname
gethostbyname
inet_addr
WSAGetLastError
setsockopt
ioctlsocket
sendto
recvfrom
getsockopt
htons
getpeername
WSASocketA
send
recv
WSAIoctl
WSACleanup
__WSAFDIsSet
htonl
accept
bind
WSARecv
closesocket
WSASend
select
ntohl
shutdown
listen
WSASetLastError
WSAStringToAddressW
WSASocketW
WSAStartup
getsockname
WSAAddressToStringW
ntohs
connect
mswsock
GetAcceptExSockaddrs
AcceptEx
vcruntime140
__std_terminate
_purecall
__std_type_info_compare
memchr
memcpy
__std_exception_destroy
strchr
memmove
strrchr
strstr
wcsstr
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
__std_type_info_destroy_list
__CxxFrameHandler3
__std_exception_copy
memset
api-ms-win-crt-heap-l1-1-0
realloc
calloc
_aligned_malloc
_aligned_free
_callnewh
free
malloc
api-ms-win-crt-runtime-l1-1-0
signal
terminate
_beginthreadex
strerror_s
_invoke_watson
strerror
abort
raise
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_exit
_errno
api-ms-win-crt-stdio-l1-1-0
ungetc
fsetpos
__stdio_common_vswprintf
setvbuf
fgetpos
fputc
fflush
fread
_fseeki64
_get_stream_buffer_pointers
fopen
_setmode
_get_osfhandle
ftell
fseek
_fileno
fgets
ferror
feof
__stdio_common_vswprintf_s
fputs
__stdio_common_vsprintf
fclose
__stdio_common_vsscanf
fwrite
fgetc
_wfopen
freopen
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf_s
api-ms-win-crt-math-l1-1-0
ceil
_dclass
_dsign
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
wcstol
strtol
strtod
strtoll
strtoull
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_stat32
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
isspace
strncpy
strspn
strcmp
strcpy_s
strcat_s
strncpy_s
tolower
isdigit
strpbrk
strcspn
api-ms-win-crt-time-l1-1-0
_time32
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
crypt32
CertOpenSystemStoreW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
905KB
Virtual Size
904KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
53.0MB
Virtual Size
53.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.nla
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.nlam
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.nlad
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
v1.7.27-migration/Release/certs/cert.pem
- SHA256 417b8a6de8064f4f238c3adb9b72e64e20944d0c1a8ce6f37764e978ae2a2396
- MD5 8d85b4ed3d5245a0e9f3f6345bcc118f
- SHA1 7ff27915defcaf564667914e12829266b7e82f2b
- SHA512 f731a43816522aa1cc78f09af4f76deed75f174a121ba8ecfc8fd241b77cb672bfcd0a9ecfa9ff167e6bb8da2f5cebdb59bb49c4105adb5fbf77cb51cf57a3d1
- TLSH T1C6F026B94F728A1024D6C092874F0559C8527BD39A85DD8528DA0536A3187DD306FF0C
- MD5 SHA1 SHA512 TLSH
v1.7.27-migration/Release/certs/key.pem
- SHA256 4f6bf3d52429cce79f5fc3014ddcf6dd21751db30c05f9dd03d4c97016d1334e
- MD5 1888732223ae166952d96f9bfd42b925
- SHA1 1150a39633c7616b8abbaef226cd4f43566b1292
- SHA512 84200d02a705ed52526944044ece887a9e7437359539e26e7fee3c354b7c44ce6dc86ccd537033a5fbefe9b895d04e17a67f6dedcca083e6c8b9da23c3d989b6
- TLSH T167D095FE2E8D0D8250D3D0B11C27623FCD3BC4531122EEA62AE311131C2CC62416C4BC
- MD5 SHA1 SHA512 TLSH
v1.7.27-migration/Release/neverlose-server.exe
- IMPHASH 7fd180e62c218beb66b23bc61866aae9
- SHA256 1d74a2601192e03a023706467922e0c496078ab407d9a693e948921c159c36c9
- MD5 fe17e8e004655192cd8155795b7112cf
- SHA1 2a68b9722089bfb9c3b4527537c8ebc38f9f80d0
- SHA512 01f5be27b26c3138533aaec90ae9736db9834ec837bd6c2442f4a250edeb3b8f1398a5abb6c53515b2174870998cb5685d5ad939ebff96687b8bf1606b5a35cb
- SSDEEP 98304:rLkoEItSrv/zRuwDa2EbUdm5CxyNcHCnDgwBJ74MAg3kEPq6ClC9++Fe:PNEnVuwOPgWyMA4kEPq6ClC8E
- TLSH T1D7964B217B6B94ADC556C874C30B4A225E6570CB0B35B9FB70CC41383FA9AF81B39769
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5094444
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
neverlose_server.pdb
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
kernel32
CreateDirectoryW
GetFullPathNameW
SetFileTime
GetFileInformationByHandle
GetFileInformationByHandleEx
WaitForSingleObject
GetConsoleOutputCP
GetConsoleMode
GetStdHandle
ReleaseMutex
SetConsoleCtrlHandler
CreateMutexA
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
Sleep
ReadDirectoryChangesW
GetSystemInfo
FindNextFileW
CancelIo
WaitForSingleObjectEx
CreateFileW
GetCurrentThread
GetModuleHandleA
GetProcAddress
GetProcessHeap
HeapReAlloc
HeapFree
QueryPerformanceCounter
SetThreadStackGuarantee
PostQueuedCompletionStatus
AddVectoredExceptionHandler
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCurrentDirectoryW
LoadLibraryA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
HeapAlloc
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
QueryPerformanceFrequency
MoveFileExW
CreateThread
CreateSemaphoreW
GetFinalPathNameByHandleW
SetLastError
GetSystemTimeAsFileTime
SetFileCompletionNotificationModes
CreateIoCompletionPort
IsProcessorFeaturePresent
GetQueuedCompletionStatusEx
TerminateProcess
InitializeSListHead
IsDebuggerPresent
SwitchToThread
GetSystemTimePreciseAsFileTime
SetFileInformationByHandle
DeleteFileW
CloseHandle
GetLastError
FindFirstFileExW
UnhandledExceptionFilter
ReleaseSemaphore
FindClose
WriteConsoleW
SetHandleInformation
SetUnhandledExceptionFilter
ws2_32
WSASocketW
WSACleanup
WSAStartup
recv
send
shutdown
ioctlsocket
accept
freeaddrinfo
getaddrinfo
bind
WSAGetLastError
WSAIoctl
WSASend
socket
listen
closesocket
getsockname
ntdll
NtDeviceIoControlFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtCreateFile
NtWriteFile
NtReadFile
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
vcruntime140
memmove
__current_exception
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
__current_exception_context
memcmp
api-ms-win-crt-math-l1-1-0
pow
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
__p___argc
terminate
_initterm_e
_initialize_narrow_environment
_crt_atexit
_exit
_initterm
_configure_narrow_argv
__p___argv
_cexit
_c_exit
_set_app_type
_register_thread_local_exe_atexit_callback
_seh_filter_exe
exit
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
197KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=24, id=261, version=35207,
count=12, id=260, version=35226,
count=142, id=1, productName=Unmarked objects,
count=35, productName=Unmarked objects (old),
count=1, id=258, version=35226,
v1.7.27-migration/Release/nl_cloud/avatar.png
- SHA256 1361229a2db9536c9e916cf5e22dc3716c15df3a0834872af4373c2359399991
- MD5 0326a7a91b16bd0a22caf3f4e8f6d8c7
- SHA1 b187c76fed919d6f7c4bd762e3eecad4efb7a854
- SHA512 c285c3fde466cae5403665dfd4f84d5e603e0ef4f8801ad817b06c5461259c9582ee8014986a0f3ce3697df96eda306fddf0439defea357dcf0e5f82047d1d9c
- SSDEEP 6144:cyP8GxNJnbgO91yIxUHYAHRSJm7/UEbjhw8v:cyk4z9wIxU4fJ2MgNv
- TLSH T139141234B5BC487FE52C7CFDE6EA9BE3A8318231A41E66B074183422E1E2B1C15793D5
- MD5 SHA1 SHA512 SSDEEP TLSH
v1.7.27-migration/Release/nl_cloud/configs/3_Config.cfg
- SHA256 e84321ba14f097bfa07ba3870d34f62a42ae7cdb29e4f047c83642b36e33e6e3
- MD5 fe3354476b70ffe513f60a2ed50dc187
- SHA1 4b0cf7c63504526d8cb61e648422dbec29a4d06d
- SHA512 c2c520a44df8df9353354f6738c1fc2d0849bfef71c734cf863abed85daea35e805ef7577138bd0906ebafd58b54da695c1fa27817c9f8daf83598087bc96931
- SSDEEP 768:6UNhqAIvKTLRdnVwuzhCzRMT+RZJkgUs9xRzJmOsnJJ7NfDclGGlGGlGGlGGlGG2:jLjMZJSjddddR
- TLSH T1FF83E17B308DFC8C365A73A64856152488214258ECB5AFCF94FE90D878DBBD31DB924E
- MD5 SHA1 SHA512 SSDEEP TLSH
v1.7.27-migration/Release/nl_cloud/state.json
- SHA256 e76c7f9f3892eefe569472d5556984182c7ca9c57913868d3a0347319550b129
- MD5 2243f55a30f1aa192e48f5c47a672f11
- SHA1 45909798a2ede8d571afd0ca9b55c227e76cc690
- SHA512 cd42ccd9686fcf3704e7e3a1f9d7c36deddc6448c0b3234b4177554b7ccfe4beefd0b343914717ed44949bdfb33c71468cded731874228194af474cd6ea95aef
- TLSH T12E411193649EFD0B379A7B12502B4C520110965A9DB1FA0B72CE41EC3EAF27725F821E
- MD5 SHA1 SHA512 TLSH
v1.7.27-migration/injector.exe
- IMPHASH b85bb6c4894ad3aaedc81d9359f513e0
- SHA256 1a8b3d72d895d03b171c138ce4f22000e5c2efefd1c73073dac932c687739ce3
- MD5 546f97c0ada80edf878b735b739892f0
- SHA1 abdcdd3de2bd979dd8dae03304565800d29a9c5b
- SHA512 75d2097f83cf5249d4597bd8f6fd124f27b364096717f10dbc3e74167b8ff689f3f98649a7cad2718b37026b7d04117960bf2557e50fae671acca4ebc9302aaa
- SSDEEP 98304:ggOzuoNdBkhzrCpwvzHbbWVOJ3/O20xS7pgTPS3kEPq6ClCZnDgwBJ74MAl+x5lg:tM9KDqObkEPq6ClCZgWyMAl
- TLSH T100965C217B5B94BCC156C874C30B4A225E6570CB0B35B9FB74CC41393FAAAF81B39669
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetConsoleTitleA
GetCurrentProcess
WriteFile
GetModuleHandleExW
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
SetEnvironmentVariableW
GetProcessId
GetEnvironmentVariableW
GetTempPathW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Sleep
GetTickCount64
CopyFileA
GetLastError
GetFileAttributesA
LockResource
SetLastError
CloseHandle
LoadResource
FindResourceW
Module32FirstW
VirtualProtectEx
GetProcAddress
SetFilePointerEx
VirtualAllocEx
LocalFree
MoveFileExW
CreateProcessW
GetModuleHandleW
FreeLibrary
FlushInstructionCache
CreateRemoteThread
Module32NextW
QueryFullProcessImageNameW
VirtualFreeEx
LoadLibraryExW
FlushFileBuffers
GetExitCodeProcess
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
WriteProcessMemory
GetFileSizeEx
GetFileInformationByHandleEx
SizeofResource
GetModuleFileNameA
ReadFile
DeleteFileW
CreateDirectoryW
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentThreadId
user32
FindWindowA
GetWindowThreadProcessId
advapi32
GetSidSubAuthority
IsValidSid
OpenProcessToken
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
GetSidSubAuthorityCount
shell32
ShellExecuteW
msvcp140
_Query_perf_counter
?_Xlength_error@std@@YAXPBD@Z
_Query_perf_frequency
bcrypt
BCryptGenRandom
ws2_32
ioctlsocket
WSAGetLastError
WSACleanup
closesocket
select
socket
connect
htons
htonl
WSAStartup
getsockopt
vcruntime140
__std_exception_copy
wcsrchr
__std_exception_destroy
__CxxFrameHandler3
memcpy
memmove
memset
_CxxThrowException
__current_exception
__current_exception_context
_except_handler4_common
strrchr
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfwprintf
__p__commode
_set_fmode
puts
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
wcscat_s
_wcsicmp
strcpy_s
api-ms-win-crt-runtime-l1-1-0
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initterm
__p___argc
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_exit
_seh_filter_exe
_set_app_type
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8.7MB
Virtual Size
8.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=12, id=260, version=35721,
count=27, id=261, version=35721,
count=4, id=257, version=35721,
count=13, id=257, version=33145,
count=152, id=1, productName=Unmarked objects,
count=1, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,
v1.7.27-migration/neverlose.dll
- IMPHASH 42ee6aabb23bf23ae5a6ade385d85fee
- SHA256 ecd09f223d1496ea72c6b48cb48046f9beb6dcf6c9f24338af1e9e38ed5844b0
- MD5 4729da8f9b26c4601d85eb51ff127790
- SHA1 cad5e23c89e0b98fe6a30fbe7a0d14773b0a42a7
- SHA512 9ce5d73c275429fbbaaf6552f1f3c1495ab0b125a045e81b1f1ab3de86a6458d36cc37cbd49d8d3b2d43a27b71c5bb0502a48644bce79db2298eb3c291a1babb
- SSDEEP 393216:yj0N2BiNmHQTs12tkP1rDXDMw+2s60NDUwNcrnPEFDE1IlO7je28jrZ3TImMgK7:yj0NmiAMHvX2jT2O7je28p3TIrgcvY
- TLSH T114C7E002BA82D0FBC58213F1E11E8F7E5E29971A6B114CD7D7849EA98CF61C46472B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
61840
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
NtCreateThreadEx
NtResumeThread
NtWaitForSingleObject
NtQueryInformationThread
NtProtectVirtualMemory
NtFlushInstructionCache
RtlPcToFileHeader
NtTerminateProcess
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtClose
RtlExitUserProcess
kernel32
ReadProcessMemory
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetLastError
VirtualProtect
GetCurrentProcess
FlushInstructionCache
VirtualQuery
GetTickCount64
Sleep
GetTempPathA
CloseHandle
CreateThread
GetModuleHandleExW
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
WriteFile
CreateFileA
GetLocalTime
SetThreadContext
DisableThreadLibraryCalls
VirtualAlloc
GetModuleHandleA
SizeofResource
LockResource
LoadResource
FindResourceW
GetStdHandle
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryW
K32GetModuleInformation
GetCurrentThread
MultiByteToWideChar
AddVectoredExceptionHandler
GetLastError
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
VirtualFree
user32
GetClassNameW
MessageBoxA
GetWindowThreadProcessId
CallNextHookEx
UnhookWindowsHookEx
EnumWindows
SetWindowsHookExW
msvcp140
?widen@?$ctype@_W@std@@QBE_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
?_Xlength_error@std@@YAXPBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@PB_W4@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
winhttp
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpOpen
WinHttpReadData
WinHttpOpenRequest
vcruntime140
memcpy
__std_type_info_destroy_list
_CxxThrowException
__CxxFrameHandler3
_except_handler3
memmove
_except_handler4_common
__std_exception_copy
__std_exception_destroy
memset
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
fflush
__acrt_iob_func
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
__stdio_common_vsprintf
api-ms-win-crt-string-l1-1-0
strcat_s
strnlen
_wcsicmp
strcpy_s
strncpy_s
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_crt_atexit
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
_cexit
_seh_filter_dll
_execute_onexit_table
abort
_register_onexit_function
api-ms-win-crt-math-l1-1-0
_dclass
_dsign
api-ms-win-crt-locale-l1-1-0
localeconv
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
53.0MB
Virtual Size
53.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=17, id=261, version=35721,
count=4, id=257, version=35721,
count=3, id=261, version=35222,
count=9, id=257, version=33145,
count=188, id=1, productName=Unmarked objects,
count=31, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,