pingzhu-0.10.3-win-x64.zip
- SHA256 9722de39c342d8ca26a195d2d4f25fc5b4b1aaa6f3f0177585f8b8243a0dac4b
Overview
overview
7Static
static
3pingzhu-0....ar.cmd
windows10-2004-x64
7pingzhu-0....ar.cmd
windows11-ltsc_2024-x64
7pingzhu-0....ll.cmd
windows10-2004-x64
3pingzhu-0....ll.cmd
windows11-ltsc_2024-x64
3pingzhu-0....ll.ps1
windows10-2004-x64
3pingzhu-0....ll.ps1
windows11-ltsc_2024-x64
3pingzhu-0....st.exe
windows10-2004-x64
3pingzhu-0....st.exe
windows11-ltsc_2024-x64
3pingzhu-0....me.exe
windows10-2004-x64
3pingzhu-0....me.exe
windows11-ltsc_2024-x64
3pingzhu-0....ol.exe
windows10-2004-x64
3pingzhu-0....ol.exe
windows11-ltsc_2024-x64
3pingzhu-0....st.exe
windows10-2004-x64
3pingzhu-0....st.exe
windows11-ltsc_2024-x64
3pingzhu-0.....2.dll
windows10-2004-x64
7pingzhu-0.....2.dll
windows11-ltsc_2024-x64
7pingzhu-0....st.exe
windows10-2004-x64
3pingzhu-0....st.exe
windows11-ltsc_2024-x64
3pingzhu-0....re.dll
windows10-2004-x64
3pingzhu-0....re.dll
windows11-ltsc_2024-x64
3pingzhu-0....ar.cmd
windows10-2004-x64
5pingzhu-0....ar.cmd
windows11-ltsc_2024-x64
5pingzhu-0....ll.cmd
windows10-2004-x64
3pingzhu-0....ll.cmd
windows11-ltsc_2024-x64
3pingzhu-0....ll.ps1
windows10-2004-x64
3pingzhu-0....ll.ps1
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pingzhu-0.10.3-win-x64/install-languagebar.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
pingzhu-0.10.3-win-x64/install-languagebar.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
pingzhu-0.10.3-win-x64/install.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
pingzhu-0.10.3-win-x64/install.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
pingzhu-0.10.3-win-x64/install.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
pingzhu-0.10.3-win-x64/install.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
pingzhu-0.10.3-win-x64/pingzhu-engine-test.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
pingzhu-0.10.3-win-x64/pingzhu-engine-test.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
pingzhu-0.10.3-win-x64/pingzhu-ime.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
pingzhu-0.10.3-win-x64/pingzhu-ime.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
pingzhu-0.10.3-win-x64/pingzhu-regtool.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
pingzhu-0.10.3-win-x64/pingzhu-regtool.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
pingzhu-0.10.3-win-x64/pingzhu-router-test.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
pingzhu-0.10.3-win-x64/pingzhu-router-test.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
pingzhu-0.10.3-win-x64/pingzhu-tsf-0.10.2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
pingzhu-0.10.3-win-x64/pingzhu-tsf-0.10.2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
pingzhu-0.10.3-win-x64/pingzhu-tsf-test.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
pingzhu-0.10.3-win-x64/pingzhu-tsf-test.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
pingzhu-0.10.3-win-x64/pingzhu_core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
pingzhu-0.10.3-win-x64/pingzhu_core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
pingzhu-0.10.3-win-x64/uninstall-languagebar.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral22
Sample
pingzhu-0.10.3-win-x64/uninstall-languagebar.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
pingzhu-0.10.3-win-x64/uninstall.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
pingzhu-0.10.3-win-x64/uninstall.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
pingzhu-0.10.3-win-x64/uninstall.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target pingzhu-0.10.3-win-x64.zip
- Size 1.9MB
- Sample261030-tecqradt7z
- SHA256 9722de39c342d8ca26a195d2d4f25fc5b4b1aaa6f3f0177585f8b8243a0dac4b
- MD5 53fe64f0ea7cba3eb55ce1d17235420d
- SHA1 37062d4d80b5d1fecff43c576e55c5c3e921d53c
- SHA512 6178b78550c459a8fd9edcdc7f9dc7feba3d04ddb7e9a8c5fcb5633b8110b4584165da7d1629efb7ae16b26d81726b3fcdf246495ac369f59d73ba522a940dc2
- SSDEEP 49152:CYrIrgutf6mnbypyHT3+6ACdabcR49AzgiDaVPa0v:CrrjtftCqjycR49Asd1v
- TLSH T1E495333E9E7492B05B51216C86AAB49135201D779B1E3F36FAD0107912BBFE63F25B03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/pingzhu-0.10.3-win-x64/pingzhu-engine-test.exe unpack001/pingzhu-0.10.3-win-x64/pingzhu-ime.exe unpack001/pingzhu-0.10.3-win-x64/pingzhu-regtool.exe unpack001/pingzhu-0.10.3-win-x64/pingzhu-router-test.exe unpack001/pingzhu-0.10.3-win-x64/pingzhu-tsf-0.10.2.dll unpack001/pingzhu-0.10.3-win-x64/pingzhu-tsf-test.exe unpack001/pingzhu-0.10.3-win-x64/pingzhu_core.dll
File Explorer
-
pingzhu-0.10.3-win-x64.zip.zip 1.9MB
-
pingzhu-0.10.3-win-x64/LICENSE.txt1KB
-
pingzhu-0.10.3-win-x64/NOTICE.txt4KB
-
pingzhu-0.10.3-win-x64/README.txt3KB
-
pingzhu-0.10.3-win-x64/bopomofo-lm.tsv6.1MB
-
pingzhu-0.10.3-win-x64/install-languagebar.cmd.cmd .bat 1KB
-
pingzhu-0.10.3-win-x64/install.cmd.cmd .bat 494B
-
pingzhu-0.10.3-win-x64/install.ps1.ps1 5KB
-
pingzhu-0.10.3-win-x64/pingzhu-engine-test.exe.exe 32KB
-
pingzhu-0.10.3-win-x64/pingzhu-ime.exe.exe 88KB
-
pingzhu-0.10.3-win-x64/pingzhu-regtool.exe.exe 40KB
-
pingzhu-0.10.3-win-x64/pingzhu-router-test.exe.exe 54KB
-
pingzhu-0.10.3-win-x64/pingzhu-tsf-0.10.2.dll.dll 110KB
-
pingzhu-0.10.3-win-x64/pingzhu-tsf-test.exe.exe 55KB
-
pingzhu-0.10.3-win-x64/pingzhu.ini421B
-
pingzhu-0.10.3-win-x64/pingzhu_core.dll.dll 356KB
-
pingzhu-0.10.3-win-x64/ts-conversion.tsv33KB
-
pingzhu-0.10.3-win-x64/uninstall-languagebar.cmd.cmd .bat 509B
-
pingzhu-0.10.3-win-x64/uninstall.cmd.cmd .bat 222B
-
pingzhu-0.10.3-win-x64/uninstall.ps1.ps1 1KB
pingzhu-0.10.3-win-x64/LICENSE.txt
- SHA256 e2629011989dcb363fea7abc267799561f40f4232b95244d10a9f183b0381615
- MD5 dfe101b69780dcb1c3a418644ab4aa82
- SHA1 008813a1774f4064a5902fdf2f421875c1a500ee
- SHA512 367ba19616d8e9fb7e540e872f74cbbc4a4851d48abf5f8f9f39097e4856cf451d9526736db2616e5cfcb7d5b1bb65fa6cde8c5f4e7587be5ce91d87e27b22b1
- TLSH T1E211B61E725007621C9A13A045B86CC4F23BB14FBE5F2A84142EF245233A06CC5FF840
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.3-win-x64/NOTICE.txt
- SHA256 56114ca5ede3496b482951957e29045553dd98c2c95c6c8557b31bcaec2dbc68
- MD5 6acb299f23fda57ebad2cc505e91489c
- SHA1 c1962ef0b7b912b8d9ce66d09d44f74b6e396a4d
- SHA512 0c06259aedeef19ef7ccd1e05746a343faea7e9d8bf3698678eb1ef8078946a0727b5562a5e29ab4d46377b5b79a3203a221baadaa26c3196dd28a1ebaa328fa
- SSDEEP 96:Rj9/neU757sIPp7AlkVFgrMVUl2U9lC49m:VBneUhsIPp7iksMVUIKlC
- TLSH T14081F6172F08D2531BB4D3E167263846ED0746CE63A60976B31E43CB23777A9A2FC225
- MD5 SHA1 SHA512 SSDEEP TLSH
pingzhu-0.10.3-win-x64/README.txt
- SHA256 9f7ab537e80f9936b10b463c112423e2e3def18de63e719433ef6f21d79b6d28
- MD5 72b4600b8d5db63feaff2687e47694e8
- SHA1 f64089f620873c04fa37001826987a05584bd723
- SHA512 11164e94c7b21a6bda424151cd1bc943b94c1e906edbf11e8ca35a46d1c255a317d3a92b52a2a896d971ee4c8ccf59b6b1a015d13ff72af0688a18e098cdba1d
- TLSH T1A881F8920E12AEA47EE2C3D47365C405CB7C0A5B71A14D913F2E8607FFA1B14D9AE61E
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.3-win-x64/bopomofo-lm.tsv
- SHA256 866841abfe4394ae84b2ad30b1c5725acab1f53dee59260b807608731b45259d
- MD5 4a9fea6b22cf14fd00bedb8f9fca70b4
- SHA1 34a7ab66bc36ba1bb67696df548fe48877aa184e
- SHA512 3a6fe2d6a3be4eb7b9f319e6d3be8f1f88e61ec05d06df5ff55d5797ba24e17aa9c69127eda93cf79496c8149aabfb9f0bb659f6fb706454f885482b2baff78d
- SSDEEP 24576:mzHvIHpiQcvjZbNKBdSxdbdAJYxQYPVvEKjb9cMgZWf2aiqxFd8KXQaJ6tL3:mNS4xBnZ/jJclWd8
- TLSH T1B856AAE8F3202A65E83D8D95FDC58ADC44DA70B6183723CA39B94707499ACEF712325D
- MD5 SHA1 SHA512 SSDEEP TLSH
pingzhu-0.10.3-win-x64/install-languagebar.cmd
- SHA256 678819cf54827105a7598a3c26c53b4aa5efa568745b4e3fc3276f8e2fa66ebe
- MD5 0afdf153f87fef7378fa894c57f4ebb8
- SHA1 803c928132e219ed56ca9ea6af5b014c94a573f1
- SHA512 cbdeb8551fd04b3a35451696997c2417bf77f35b0d207903c4a156429dc508e816153d74c215e790fc8507eb2ad4a7e8b114290ef85ee15b0bfdfc3c0eb3553d
- TLSH T1E8310E17F235E231DEE10A562E3552707B1694FB271A4D1126FB8078B3821CD333A1C6
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.3-win-x64/install.cmd
- SHA256 ecb310950600f660178b1cf065d4e5d66a237392bcdd5489c822d05a28372cd3
- MD5 3b363b4eac49888026fbfccc309cf4f1
- SHA1 d935c5e9f6c1c46d75afd334f885fbe86c47453b
- SHA512 6cf47a9f402c7c03d8a714af6bfce252db6442ca7092e0fcc3a98041c276890de3ad870649c0ca01d2e9694bfe4cba75c942479db6de124c1cd55eab8c559da2
- TLSH T1EFF005063C2663B474D58D061C6E41A4E01951725103D88139B74338BD051D2D5B81D2
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.3-win-x64/install.ps1
- SHA256 c7f20663236693c15c25a35e2e07febf546f8689dba03f7e10d0e202f9232a15
- MD5 c2aa085fb654bf35141058e96a9d34b7
- SHA1 a77c525e22eb667754c2c38d65eff7ca12e5de01
- SHA512 8516e4f367c818444c683fc61d6fa59ca0d74de28bad9226554cd814b2d9d14e1c278ff41ba936c21638252cbfdbb274ac7c2126e8265c7c1f57c512958cf06a
- SSDEEP 96:DIB9wit22lVlt00rmNRio+pvpGWRZ9pspUowiHPVA:DIB9/vrmNRUpZRZ9pspUoXA
- TLSH T171C1B8256C11166CFAF2C31AA612F646DDD7003FA0411E94B6AC10D9BF7263C8B7F65B
- MD5 SHA1 SHA512 SSDEEP TLSH
pingzhu-0.10.3-win-x64/pingzhu-engine-test.exe
- IMPHASH 08c390a6bad168bccd6df4e2b4476639
- SHA256 4b1566b154eeb22a030a2b689cbaabaa227a23f64987f0b6ed546f8dd0967d24
- MD5 1688e2d40015aea66dec81231005105f
- SHA1 fb8616e609dddc18d4c0439d6407a97d2059fcd7
- SHA512 4618b14765998af66262a0aef5ecda7ac8bb3cc77f363d73c383d6daa04f483b3be9c7ef26dc84a82e4807b196fa3bff00303bcb88c21d0053767677eae799bb
- SSDEEP 384:1kLjEiAv3Zlp4tHmMhhV8rgelF+NetqAsaZwx+8fQ7h88iYprnX30njfqXS8IylH:28Py/48348qMEkdzr3h5ERwhje3q
- TLSH T111E2082A6B5800BCF166D33FE9735A91E6B1344547A1DBCF0BE111922E672D07C3BA92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20892
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
kernel32
GetCurrentThreadId
IsDebuggerPresent
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleHandleW
vcruntime140
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
__current_exception
__current_exception_context
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_seh_filter_exe
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_crt_atexit
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_register_onexit_function
_initterm
_initialize_onexit_table
_invoke_watson
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__p__commode
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_callnewh
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33145,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=26, id=261, version=35207,
count=7, id=257, version=35207,
count=71, id=1, productName=Unmarked objects,
count=3, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.3-win-x64/pingzhu-ime.exe
- IMPHASH dc1d5838f97b1b304b0a3815a77f23cc
- SHA256 6fa7170dd14856b7f7385fb9ff2c58e35d25939e1044bc80850e1d49746efb8d
- MD5 122ed04ac342e58bc81f9475ad0e1874
- SHA1 9fe8dc3ff4a21f343cb06916bfc56b730eff600b
- SHA512 837d1ce8ba81f27b55ec1a14517f72f4eb6f6131bc949de0f2c3d0c2e360e56514171f5ba40ee167a73a4e2ebae2708cac91b3c9bc42c09bc01e8266394e490b
- SSDEEP 1536:cZH579M64IA/hkO6vxKzGOeC8LJsLKWe89UuEpDMYi+YoMS:K5RM6s/hkOSx4GOn8tsLX9UzHcoj
- TLSH T1BF932C26CA15517EF26ACA7DCA524C42EB327C4647D1ABCF0B905CE21E6AAD45F3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
FillRect
ClientToScreen
GetWindowRect
GetClientRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
GetForegroundWindow
UpdateWindow
GetSystemMetrics
SetWindowPos
DestroyWindow
LoadCursorW
DrawTextW
ReleaseCapture
SetCapture
SendInput
wsprintfW
LoadIconW
CheckMenuRadioItem
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
FindWindowW
GetCursorPos
MessageBoxW
GetMessageW
SetForegroundWindow
TrackPopupMenu
AppendMenuW
DestroyMenu
CreatePopupMenu
GetAsyncKeyState
ShowWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
PostMessageW
RegisterHotKey
DispatchMessageW
TranslateMessage
GetGUIThreadInfo
shell32
Shell_NotifyIconW
gdi32
BitBlt
CreateCompatibleDC
CreateFontW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
GetTextExtentPoint32W
Rectangle
SelectObject
SetBkMode
SetTextColor
TextOutW
RoundRect
CreateCompatibleBitmap
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
kernel32
MultiByteToWideChar
LoadLibraryW
GetProcAddress
RtlCaptureContext
GetModuleFileNameW
CreateMutexW
GetLastError
CloseHandle
GetFileAttributesW
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
FreeLibrary
WideCharToMultiByte
InitializeSListHead
vcruntime140
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
__C_specific_handler
__current_exception
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_errno
_invoke_watson
__p___argc
__p___wargv
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
_seh_filter_exe
_set_app_type
_initialize_wide_environment
_configure_wide_argv
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
api-ms-win-crt-string-l1-1-0
wcscpy_s
strlen
wcscmp
wcslen
api-ms-win-crt-stdio-l1-1-0
fwrite
fclose
_set_fmode
__p__commode
_wfopen
fread
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=28, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=150, id=1, productName=Unmarked objects,
count=8, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.3-win-x64/pingzhu-regtool.exe
- IMPHASH 3a3230b61428d284283da2a4492a8208
- SHA256 5ab85531cdde1baa141f3a598eacae1f7e744e72955ca5b5687af571b086fd6e
- MD5 c3b55abdd3a17b6ef64c5ca59ad6de09
- SHA1 f2b626ba61317a5a5d0fec6a1d36807128536ae5
- SHA512 02ba0e64a76f6c8d81203f61b3669cc0fe4530f1c2dd4361836fa4eb8ba91aecdcbd068ea3516aac3568da7f0cafab8a07ac29c2f94e4f702c62f6a4a88953d6
- SSDEEP 384:PSk4GRPKP5W7js3KxfdD8ICYXxpFmBqP1vpvci7AdjLWyKnS3fV7UrrgcedO2kGU:PNBRPKMko9+VEpV2vuRnAgTSLhXM
- TLSH T16403A616DD6AA17FD35E8D78CA528C05DE63BCD6CBD1A58F57400CE209B1AE4AB3D302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
19532
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
StringFromGUID2
oleaut32
SysFreeString
advapi32
GetTokenInformation
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
OpenProcessToken
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
kernel32
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlVirtualUnwind
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
CompareFileTime
FindClose
FindFirstFileW
FindNextFileW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
RtlCaptureContext
RtlLookupFunctionEntry
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
vcruntime140
__current_exception
__current_exception_context
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
memset
memcmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_crt_atexit
_seh_filter_exe
_set_app_type
_register_onexit_function
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___wargv
_cexit
_c_exit
_invoke_watson
terminate
api-ms-win-crt-locale-l1-1-0
setlocale
_configthreadlocale
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
wcslen
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=27, id=261, version=35207,
count=6, id=257, version=35207,
count=2, id=260, version=33145,
count=9, id=257, version=33145,
count=93, id=1, productName=Unmarked objects,
count=2, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.3-win-x64/pingzhu-router-test.exe
- IMPHASH 98c9505c4430575ec5b73e3a0495692f
- SHA256 258dd2842b0cc9324cae8885a8e3b500c67078dcc4f22a65d2f9a46de829d7b3
- MD5 5ecba1263bc8cd35cc535e52e4de07b6
- SHA1 838694361e72bfd50c0821f12861719521b4faa3
- SHA512 f7ffb5a8fdeee18b22297f5de4dd723167c2c282b3d49b1a913c39c6629f89389ec31a6ab85127936f1034a70a7b50bd0cf74607307438cc0031d32505668ece
- SSDEEP 768:45DnlGPSFuDJqYpYzYN2CB2mfpyZYkLn8sS3dkS:MWAYNdcJ8J
- TLSH T1EC430A7ADF1691BAD21E8D74D5130A02DB72BCC64B90B2CF5B916CE60D31AE49B3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
25644
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
vcruntime140
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception_context
memcmp
memcpy
memmove
memset
__C_specific_handler
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_onexit_function
_invoke_watson
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argv
__p___argc
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
fclose
fflush
fread
__acrt_iob_func
__p__commode
__stdio_common_vsprintf
__stdio_common_vfprintf
fgetc
fgetpos
ungetc
setvbuf
fwrite
_set_fmode
fsetpos
_fseeki64
fputc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33145,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=28, id=261, version=35207,
count=7, id=257, version=35207,
count=136, id=1, productName=Unmarked objects,
count=2, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.3-win-x64/pingzhu-tsf-0.10.2.dll
- IMPHASH 3e78724a3a5903d77f0360f9956d0989
- SHA256 b57ff5b95edb05c2c6748aaad2bd43a93ceb02d74621d3b8ad201b0a5b9c0f5c
- MD5 55a5f1a704bea10308214e3c12683b4a
- SHA1 131c8242dddb1149a6f83b6239041c5258a33743
- SHA512 413dcd87fdb2e9673de13128638000684df4cb60ca7f7a10da005a0a65ffb7e07f166e2e4de4d70a21030cf192651fa95afdb1b931a5249beaceac5393b3def5
- SSDEEP 3072:+xvLwbZEtkLMbbQ8nr/i9sULOdGWWgkkwYbKjjgD+:CvLwdEzbbQ8nrK/LOdGWWmbKjjQ+
- TLSH T116B32B17FA15413EF1A5C77CCA938C42DB72788A0791ABCF07904DE65EA67E45F3A202
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
71780
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ole32
CoCreateInstance
oleaut32
VariantClear
VariantInit
SysAllocString
user32
GetClientRect
GetWindowRect
GetCursorPos
ClientToScreen
GetWindowLongPtrW
EndPaint
BeginPaint
GetForegroundWindow
SetWindowLongPtrW
UpdateWindow
GetSystemMetrics
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
wsprintfW
CopyIcon
GetGUIThreadInfo
DestroyIcon
FillRect
ReleaseDC
GetDC
GetKeyState
InvalidateRect
GetWindowThreadProcessId
LoadCursorW
CreateIconIndirect
gdi32
DeleteObject
DeleteDC
CreateSolidBrush
SelectObject
CreateCompatibleBitmap
CreateBitmap
SetTextColor
TextOutW
BitBlt
CreateFontW
CreatePen
GetStockObject
GetTextExtentPoint32W
Rectangle
CreateCompatibleDC
SetBkMode
advapi32
RegDeleteTreeW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
kernel32
GetModuleFileNameW
MultiByteToWideChar
GetLastError
FreeLibrary
GetProcAddress
GetFileAttributesExW
LoadLibraryW
GetModuleHandleW
WideCharToMultiByte
GetCurrentProcessId
GetFileAttributesW
GetLocalTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
DisableThreadLibraryCalls
vcruntime140
memmove
__C_specific_handler
__current_exception_context
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memset
__std_terminate
__current_exception
memcmp
__std_type_info_destroy_list
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_errno
_initterm_e
_initterm
_invoke_watson
terminate
_cexit
api-ms-win-crt-string-l1-1-0
strlen
wcsncpy_s
wcslen
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
fclose
_wfopen
__stdio_common_vsprintf
fread
fwrite
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=22, id=261, version=35207,
count=6, id=257, version=35207,
count=4, id=260, version=33145,
count=13, id=257, version=33145,
count=134, id=1, productName=Unmarked objects,
count=11, id=261, version=35228,
count=1, id=256, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.3-win-x64/pingzhu-tsf-test.exe
- IMPHASH b69222d4261648d580e20415c7618a00
- SHA256 e00fd93b9eeaf955207733bcac19dc69d281672be1663f2128f2923c55f9dd9e
- MD5 28b51d5ccd49fb26f473bac2089c5ab3
- SHA1 ff5c1cc4864e571e8f2afc55fd01bdff8d9d1f11
- SHA512 7ee95fee46c0f491e5d38eaad5d24e38e9bf5e21781e53f8d98587366914ae84ba850b66339fac07b87c67f95ff4c42bb5017f84492f1134edfafcdc055b8d72
- SSDEEP 768:92V5fYAOtkDlREea0Arx2ezetHZXc15RbZF/mucFV/N0Lp0YDgP3dx9:92DR/aDrxwH1c15R9ZmuwV/L2Sx
- TLSH T1BF430B29DD56907FE31ACD79CA134C41EE627C8A8BE1A5CF4B900DE20D756E4AF39702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
30916
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
kernel32
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetFileAttributesW
GetLastError
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
WideCharToMultiByte
LoadLibraryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
vcruntime140
__current_exception_context
__current_exception
__C_specific_handler
strrchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_initialize_onexit_table
_register_onexit_function
_invoke_watson
_register_thread_local_exe_atexit_callback
terminate
_seh_filter_exe
_set_app_type
__p___argc
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_c_exit
_cexit
__p___argv
api-ms-win-crt-stdio-l1-1-0
_wfopen
__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
fread
fclose
api-ms-win-crt-string-l1-1-0
wcslen
strlen
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=28, id=261, version=35207,
count=6, id=257, version=35207,
count=3, id=260, version=33145,
count=7, id=257, version=33145,
count=86, id=1, productName=Unmarked objects,
count=4, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.3-win-x64/pingzhu.ini
- SHA256 1b09c8445a24addc7ae04df000dbb91122d33816b8ebe2a449a9bd335343d506
- MD5 cad21d8267be6ef4f020ffc45a3f9660
- SHA1 0dafec040a4b7de1257798288eadf06d10874459
- SHA512 4f9283ca42711f86d633ebb1044ea295d33a58c0f82fe6c7a5b1ec7dae09530dfa1413ccf325abbbccd75614c86f3dc14f2b481670e777855211664e35e8d8fd
- TLSH T113E0A366452344A62176F1C10761F17802543CFB3EB5C436EBA94421F9034267645926
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.3-win-x64/pingzhu_core.dll
- IMPHASH a4ecb0b1525aee27c8b302da60f24d18
- SHA256 546515da39ea3427a3626febc0cff69a28a7da28f018ce32a8a30d088a94b557
- MD5 16791d62bbe122bbd95a5d3d69f20d1e
- SHA1 472a309edfa3c60de6cab72ac550d4db24445aa6
- SHA512 86308ddcb35d1b384d19c814ff45959d6fc774452d291261e04234c1bdfb6856800d18cc1f0e99d5e7031df1a750bd41355a0a14f249fce78ba5d8b0b9c8d37a
- SSDEEP 6144:WJFyi5ZEXFrNCTNO3pYu8EjlYshiHYPUQ8RdyDOfQdOJvd:CF/0C5cDz32
- TLSH T10D746B13F556586CD00AC478432A85A26A7270CE1B29BDFF12D581783FADFE16F38369
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
273252
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
pingzhu_core.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
bcryptprimitives
ProcessPrng
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
CloseHandle
GetLastError
WaitForSingleObject
SetLastError
GetFullPathNameW
GetCurrentThreadId
SetFileInformationByHandle
CreateFileW
GetStdHandle
GetCurrentProcess
GetProcessHeap
HeapFree
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetSystemTimePreciseAsFileTime
SetFileTime
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
GetCurrentDirectoryW
lstrlenW
FindFirstFileExW
FindClose
GetProcAddress
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
HeapAlloc
MultiByteToWideChar
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
IsProcessorFeaturePresent
FlsFree
FlsAlloc
GetModuleHandleExW
GetModuleHandleW
IsThreadAFiber
FlsSetValue
FormatMessageW
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
ntdll
NtReadFile
RtlNtStatusToDosError
NtWriteFile
vcruntime140
memmove
_CxxThrowException
__C_specific_handler
memset
memcmp
memcpy
__CxxFrameHandler3
__std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
strlen
wcslen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
api-ms-win-crt-heap-l1-1-0
free
engine_abi_version
engine_backspace
engine_best_score
engine_best_sentence
engine_candidate_at
engine_candidate_count
engine_candidate_page_info
engine_candidate_window_open
engine_close_candidate_window
engine_commit
engine_composing
engine_create
engine_destroy
engine_feed_key
engine_feed_keys
engine_keyboard_rows
engine_keyboard_rows_free
engine_load_user_dictionary
engine_move_candidate_cursor
engine_next_candidate_page
engine_open_candidate_window
engine_output_is_faithful
engine_output_script
engine_prev_candidate_page
engine_reset
engine_save_user_dictionary
engine_select_candidate
engine_set_output_script
engine_syllable_count
Name
.text
Size
274KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
664B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=7, id=260, version=35207,
count=16, id=261, version=35207,
count=9, id=257, version=33145,
count=175, id=1, productName=Unmarked objects,
count=18, productName=Unmarked objects (old),
count=1, id=256, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.3-win-x64/ts-conversion.tsv
- SHA256 2d2440f4c3f3f346b332030c501732583013e731b01e9ddf16966dec02cf79c1
- MD5 9632aa63628a7e73f7692ff78fd9752c
- SHA1 e89d7babf735bfa73230808a2408ddeadebcb6f2
- SHA512 b71f36015ea7a9dc7bcb0871da74ab18b9dd5f54618b52e36c8199f66de5993e719a34d0a0d0e38ab21e1f6c67da5cfc4f99af28252bb658ebe8faf9f030c3ff
- SSDEEP 768:0H8DziPYmyXnxuXCNg/p1ZOyhXVaUxx+XUS8zQ3+ZQrNWKnV:xDziJyXno2gf9vz3lrzQ3uQV
- TLSH T195F25A0D8EB100AE20A391497107B776374F5F9C8DA944EAB5DE3A1AB08D0DC597D2BF
- MD5 SHA1 SHA512 SSDEEP TLSH
pingzhu-0.10.3-win-x64/uninstall-languagebar.cmd
- SHA256 4c84162fb4ecc7f1a8dc772201b15c8088b2747f6e4d3a53c1c03ac1802c3eaa
- MD5 3d5bc81fde1b920f4151e0c4a108f5f8
- SHA1 f354f34fa25edf7b11ec8f8532a11263f17df04a
- SHA512 762a9d68fa80e9910c07728c803a85e76dc0aea1dae5527e7dd54c5d625518bcc6ebe71f778b916657f07e1672a7b8bb2062bdc8539ee7e7a2d66c51954b479d
- TLSH T10FF05006B45667B5ACE24E9518B955519959D1D933279E0172BB5030B343246B3381D1
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.3-win-x64/uninstall.cmd
- SHA256 c3cf321e7f7c2e83077c4b5d0c441abfb3503f5c7247353e242eb32d1c28ab96
- MD5 74d377fb7ac34bc44d662ccacbc9847e
- SHA1 dc082be1ba0f531086bb8cd621c9f2752cf9b4b0
- SHA512 849b1f45f44e9ffd9633025dd9be81a537da34dd635479d82063192f6effee7332985e223e2aecd846f4b37205640bf995636be20b4f3b320e3d1c550d50998f
- TLSH T161D0A787741752AD7CE28D121CB69574F44A534303035D45A9B78234780625AE73A192
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.3-win-x64/uninstall.ps1
- SHA256 be2fb2d5eee828ee6bd368a94a5d6b8f2f6ecb6eba4f99f850acbf044325fd9c
- MD5 a7330350c805233132e731279a5b9559
- SHA1 ebf1d78475f19be8fcafed0535a739133eb2adb5
- SHA512 844b7cfa8b3cce7c91da380313aca39217880146ae5720cc4e5c1e92d363b2ab310afe62010adc267c7dc21e28b79e5789b4fb2790bf4bc7986d3ade737986c6
- TLSH T1A64194341012182EE7FA0B164A063F04EE8F413FA1622E60BD7D80C93F63A3C5725E6A
- MD5 SHA1 SHA512 TLSH