pingzhu-0.10.2-win-x64.zip
- SHA256 1229e9423090238d18491ee4e68d85dc11e6b8d3b9da7dad349c0931d3aeb0bf
Overview
overview
7Static
static
3pingzhu-0....ar.cmd
windows10-2004-x64
7pingzhu-0....ar.cmd
windows11-ltsc_2024-x64
7pingzhu-0....ll.cmd
windows10-2004-x64
3pingzhu-0....ll.cmd
windows11-ltsc_2024-x64
3pingzhu-0....ll.ps1
windows10-2004-x64
3pingzhu-0....ll.ps1
windows11-ltsc_2024-x64
3pingzhu-0....st.exe
windows10-2004-x64
3pingzhu-0....st.exe
windows11-ltsc_2024-x64
3pingzhu-0....me.exe
windows10-2004-x64
3pingzhu-0....me.exe
windows11-ltsc_2024-x64
3pingzhu-0....ol.exe
windows10-2004-x64
3pingzhu-0....ol.exe
windows11-ltsc_2024-x64
3pingzhu-0....st.exe
windows10-2004-x64
3pingzhu-0....st.exe
windows11-ltsc_2024-x64
3pingzhu-0.....2.dll
windows10-2004-x64
7pingzhu-0.....2.dll
windows11-ltsc_2024-x64
7pingzhu-0....st.exe
windows10-2004-x64
3pingzhu-0....st.exe
windows11-ltsc_2024-x64
3pingzhu-0....re.dll
windows10-2004-x64
3pingzhu-0....re.dll
windows11-ltsc_2024-x64
3pingzhu-0....ar.cmd
windows10-2004-x64
5pingzhu-0....ar.cmd
windows11-ltsc_2024-x64
5pingzhu-0....ll.cmd
windows10-2004-x64
3pingzhu-0....ll.cmd
windows11-ltsc_2024-x64
3pingzhu-0....ll.ps1
windows10-2004-x64
3pingzhu-0....ll.ps1
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pingzhu-0.10.2-win-x64/install-languagebar.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
pingzhu-0.10.2-win-x64/install-languagebar.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
pingzhu-0.10.2-win-x64/install.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
pingzhu-0.10.2-win-x64/install.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
pingzhu-0.10.2-win-x64/install.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
pingzhu-0.10.2-win-x64/install.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
pingzhu-0.10.2-win-x64/pingzhu-engine-test.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
pingzhu-0.10.2-win-x64/pingzhu-engine-test.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
pingzhu-0.10.2-win-x64/pingzhu-ime.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
pingzhu-0.10.2-win-x64/pingzhu-ime.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
pingzhu-0.10.2-win-x64/pingzhu-regtool.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
pingzhu-0.10.2-win-x64/pingzhu-regtool.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
pingzhu-0.10.2-win-x64/pingzhu-router-test.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
pingzhu-0.10.2-win-x64/pingzhu-router-test.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
pingzhu-0.10.2-win-x64/pingzhu-tsf-0.10.2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
pingzhu-0.10.2-win-x64/pingzhu-tsf-0.10.2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
pingzhu-0.10.2-win-x64/pingzhu-tsf-test.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
pingzhu-0.10.2-win-x64/pingzhu-tsf-test.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
pingzhu-0.10.2-win-x64/pingzhu_core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
pingzhu-0.10.2-win-x64/pingzhu_core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
pingzhu-0.10.2-win-x64/uninstall-languagebar.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral22
Sample
pingzhu-0.10.2-win-x64/uninstall-languagebar.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
pingzhu-0.10.2-win-x64/uninstall.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
pingzhu-0.10.2-win-x64/uninstall.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
pingzhu-0.10.2-win-x64/uninstall.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target pingzhu-0.10.2-win-x64.zip
- Size 1.9MB
- Sample261030-vbksmazxev
- SHA256 1229e9423090238d18491ee4e68d85dc11e6b8d3b9da7dad349c0931d3aeb0bf
- MD5 2c9ba264281182e5c294754c3b913568
- SHA1 bd2f13095327df8cad067ade7660b6aa2cafebe8
- SHA512 bc3350337c2cd441fd63809348c2782bae2cce21ed0e86a255a71dc16fdc1413d34419fa5121e0a4719fc0f69a35bb4298523f3e18525b65a44fbbb583d3f278
- SSDEEP 49152:aYrIrgutf6mnbypyHT3+6ACdabcR49AzgiDtOk31tJN:arrjtftCqjycR49Asg5JN
- TLSH T19895332F4FB496B015652A6C8A64ECD776240C2B9D0B7E36F690116C22F7DE71F22A07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/pingzhu-0.10.2-win-x64/pingzhu-engine-test.exe unpack001/pingzhu-0.10.2-win-x64/pingzhu-ime.exe unpack001/pingzhu-0.10.2-win-x64/pingzhu-regtool.exe unpack001/pingzhu-0.10.2-win-x64/pingzhu-router-test.exe unpack001/pingzhu-0.10.2-win-x64/pingzhu-tsf-0.10.2.dll unpack001/pingzhu-0.10.2-win-x64/pingzhu-tsf-test.exe unpack001/pingzhu-0.10.2-win-x64/pingzhu_core.dll
File Explorer
-
pingzhu-0.10.2-win-x64.zip.zip 1.9MB
-
pingzhu-0.10.2-win-x64/LICENSE.txt1KB
-
pingzhu-0.10.2-win-x64/NOTICE.txt4KB
-
pingzhu-0.10.2-win-x64/README.txt3KB
-
pingzhu-0.10.2-win-x64/bopomofo-lm.tsv6.1MB
-
pingzhu-0.10.2-win-x64/install-languagebar.cmd.cmd .bat 1KB
-
pingzhu-0.10.2-win-x64/install.cmd.cmd .bat 494B
-
pingzhu-0.10.2-win-x64/install.ps1.ps1 5KB
-
pingzhu-0.10.2-win-x64/pingzhu-engine-test.exe.exe 32KB
-
pingzhu-0.10.2-win-x64/pingzhu-ime.exe.exe 88KB
-
pingzhu-0.10.2-win-x64/pingzhu-regtool.exe.exe 40KB
-
pingzhu-0.10.2-win-x64/pingzhu-router-test.exe.exe 54KB
-
pingzhu-0.10.2-win-x64/pingzhu-tsf-0.10.2.dll.dll 110KB
-
pingzhu-0.10.2-win-x64/pingzhu-tsf-test.exe.exe 55KB
-
pingzhu-0.10.2-win-x64/pingzhu.ini421B
-
pingzhu-0.10.2-win-x64/pingzhu_core.dll.dll 355KB
-
pingzhu-0.10.2-win-x64/ts-conversion.tsv33KB
-
pingzhu-0.10.2-win-x64/uninstall-languagebar.cmd.cmd .bat 509B
-
pingzhu-0.10.2-win-x64/uninstall.cmd.cmd .bat 222B
-
pingzhu-0.10.2-win-x64/uninstall.ps1.ps1 1KB
pingzhu-0.10.2-win-x64/LICENSE.txt
- SHA256 e2629011989dcb363fea7abc267799561f40f4232b95244d10a9f183b0381615
- MD5 dfe101b69780dcb1c3a418644ab4aa82
- SHA1 008813a1774f4064a5902fdf2f421875c1a500ee
- SHA512 367ba19616d8e9fb7e540e872f74cbbc4a4851d48abf5f8f9f39097e4856cf451d9526736db2616e5cfcb7d5b1bb65fa6cde8c5f4e7587be5ce91d87e27b22b1
- TLSH T1E211B61E725007621C9A13A045B86CC4F23BB14FBE5F2A84142EF245233A06CC5FF840
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.2-win-x64/NOTICE.txt
- SHA256 56114ca5ede3496b482951957e29045553dd98c2c95c6c8557b31bcaec2dbc68
- MD5 6acb299f23fda57ebad2cc505e91489c
- SHA1 c1962ef0b7b912b8d9ce66d09d44f74b6e396a4d
- SHA512 0c06259aedeef19ef7ccd1e05746a343faea7e9d8bf3698678eb1ef8078946a0727b5562a5e29ab4d46377b5b79a3203a221baadaa26c3196dd28a1ebaa328fa
- SSDEEP 96:Rj9/neU757sIPp7AlkVFgrMVUl2U9lC49m:VBneUhsIPp7iksMVUIKlC
- TLSH T14081F6172F08D2531BB4D3E167263846ED0746CE63A60976B31E43CB23777A9A2FC225
- MD5 SHA1 SHA512 SSDEEP TLSH
pingzhu-0.10.2-win-x64/README.txt
- SHA256 9f7ab537e80f9936b10b463c112423e2e3def18de63e719433ef6f21d79b6d28
- MD5 72b4600b8d5db63feaff2687e47694e8
- SHA1 f64089f620873c04fa37001826987a05584bd723
- SHA512 11164e94c7b21a6bda424151cd1bc943b94c1e906edbf11e8ca35a46d1c255a317d3a92b52a2a896d971ee4c8ccf59b6b1a015d13ff72af0688a18e098cdba1d
- TLSH T1A881F8920E12AEA47EE2C3D47365C405CB7C0A5B71A14D913F2E8607FFA1B14D9AE61E
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.2-win-x64/bopomofo-lm.tsv
- SHA256 866841abfe4394ae84b2ad30b1c5725acab1f53dee59260b807608731b45259d
- MD5 4a9fea6b22cf14fd00bedb8f9fca70b4
- SHA1 34a7ab66bc36ba1bb67696df548fe48877aa184e
- SHA512 3a6fe2d6a3be4eb7b9f319e6d3be8f1f88e61ec05d06df5ff55d5797ba24e17aa9c69127eda93cf79496c8149aabfb9f0bb659f6fb706454f885482b2baff78d
- SSDEEP 24576:mzHvIHpiQcvjZbNKBdSxdbdAJYxQYPVvEKjb9cMgZWf2aiqxFd8KXQaJ6tL3:mNS4xBnZ/jJclWd8
- TLSH T1B856AAE8F3202A65E83D8D95FDC58ADC44DA70B6183723CA39B94707499ACEF712325D
- MD5 SHA1 SHA512 SSDEEP TLSH
pingzhu-0.10.2-win-x64/install-languagebar.cmd
- SHA256 678819cf54827105a7598a3c26c53b4aa5efa568745b4e3fc3276f8e2fa66ebe
- MD5 0afdf153f87fef7378fa894c57f4ebb8
- SHA1 803c928132e219ed56ca9ea6af5b014c94a573f1
- SHA512 cbdeb8551fd04b3a35451696997c2417bf77f35b0d207903c4a156429dc508e816153d74c215e790fc8507eb2ad4a7e8b114290ef85ee15b0bfdfc3c0eb3553d
- TLSH T1E8310E17F235E231DEE10A562E3552707B1694FB271A4D1126FB8078B3821CD333A1C6
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.2-win-x64/install.cmd
- SHA256 ecb310950600f660178b1cf065d4e5d66a237392bcdd5489c822d05a28372cd3
- MD5 3b363b4eac49888026fbfccc309cf4f1
- SHA1 d935c5e9f6c1c46d75afd334f885fbe86c47453b
- SHA512 6cf47a9f402c7c03d8a714af6bfce252db6442ca7092e0fcc3a98041c276890de3ad870649c0ca01d2e9694bfe4cba75c942479db6de124c1cd55eab8c559da2
- TLSH T1EFF005063C2663B474D58D061C6E41A4E01951725103D88139B74338BD051D2D5B81D2
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.2-win-x64/install.ps1
- SHA256 c7f20663236693c15c25a35e2e07febf546f8689dba03f7e10d0e202f9232a15
- MD5 c2aa085fb654bf35141058e96a9d34b7
- SHA1 a77c525e22eb667754c2c38d65eff7ca12e5de01
- SHA512 8516e4f367c818444c683fc61d6fa59ca0d74de28bad9226554cd814b2d9d14e1c278ff41ba936c21638252cbfdbb274ac7c2126e8265c7c1f57c512958cf06a
- SSDEEP 96:DIB9wit22lVlt00rmNRio+pvpGWRZ9pspUowiHPVA:DIB9/vrmNRUpZRZ9pspUoXA
- TLSH T171C1B8256C11166CFAF2C31AA612F646DDD7003FA0411E94B6AC10D9BF7263C8B7F65B
- MD5 SHA1 SHA512 SSDEEP TLSH
pingzhu-0.10.2-win-x64/pingzhu-engine-test.exe
- IMPHASH 08c390a6bad168bccd6df4e2b4476639
- SHA256 dca79c9eac5a92bc3f53d1049fb5d30f5a497bc10cf7d0bc9b0dfd2b4d847310
- MD5 10c68696095b490c2a4bccb8589b120a
- SHA1 8caadb6df56c7b70b235fe288d22ac520ae8985c
- SHA512 7112effe810de14f56c0090bc8df7dfdd0c73f7263f5179666c59166711a9ed2cd7ebbe19c49c4dffeffbbc035ac11c4c3805638253dc2b171f20aa0afad659b
- SSDEEP 384:fkLjEiAv3Zlp4tHmMhhV8rgelF+NetqAsaZwx+8fQ7h88iYprnX30njfqXS8Iylp:M8Py/48348qMEkdzr3h5ERwHje3q
- TLSH T1B8E2093A6B5800BCF166D33FE9735A91E6B1344547A1DBCF0BE111922E672D07C3BA92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20892
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
kernel32
GetCurrentThreadId
IsDebuggerPresent
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleHandleW
vcruntime140
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
__current_exception
__current_exception_context
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_seh_filter_exe
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_crt_atexit
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_register_onexit_function
_initterm
_initialize_onexit_table
_invoke_watson
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__p__commode
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_callnewh
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33145,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=26, id=261, version=35207,
count=7, id=257, version=35207,
count=71, id=1, productName=Unmarked objects,
count=3, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.2-win-x64/pingzhu-ime.exe
- IMPHASH dc1d5838f97b1b304b0a3815a77f23cc
- SHA256 4e7cf81b1242628b39c964f5433975a11a0b2b1efc59b14063d92f1b165c7ffb
- MD5 90126e51a2e75359341b7f21f67111e5
- SHA1 dfa4c973d18c9aa710122ac02b4f30ff48b7dc0d
- SHA512 e587d792c540c971a461f22d5d2e9dcb8a09e0420794b329771dedf8cff82e75d62f12dfb491367918ef913d5ae2dcf2cc3a3afc68ef423e2020b15c50d8898e
- SSDEEP 1536:JZH579M64IA/hkO6vxKzGOeC8LJsLKWe89UuEpDzYi+YoMS:v5RM6s/hkOSx4GOn8tsLX9Uzwcoj
- TLSH T13D932C26CA15517EF26ACA7DCA524C42EB327C4647D1ABCF0B904CE21E6AAD45F3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
FillRect
ClientToScreen
GetWindowRect
GetClientRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
GetForegroundWindow
UpdateWindow
GetSystemMetrics
SetWindowPos
DestroyWindow
LoadCursorW
DrawTextW
ReleaseCapture
SetCapture
SendInput
wsprintfW
LoadIconW
CheckMenuRadioItem
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
FindWindowW
GetCursorPos
MessageBoxW
GetMessageW
SetForegroundWindow
TrackPopupMenu
AppendMenuW
DestroyMenu
CreatePopupMenu
GetAsyncKeyState
ShowWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
PostMessageW
RegisterHotKey
DispatchMessageW
TranslateMessage
GetGUIThreadInfo
shell32
Shell_NotifyIconW
gdi32
BitBlt
CreateCompatibleDC
CreateFontW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
GetTextExtentPoint32W
Rectangle
SelectObject
SetBkMode
SetTextColor
TextOutW
RoundRect
CreateCompatibleBitmap
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
kernel32
MultiByteToWideChar
LoadLibraryW
GetProcAddress
RtlCaptureContext
GetModuleFileNameW
CreateMutexW
GetLastError
CloseHandle
GetFileAttributesW
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
FreeLibrary
WideCharToMultiByte
InitializeSListHead
vcruntime140
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
__C_specific_handler
__current_exception
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_errno
_invoke_watson
__p___argc
__p___wargv
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
_seh_filter_exe
_set_app_type
_initialize_wide_environment
_configure_wide_argv
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
api-ms-win-crt-string-l1-1-0
wcscpy_s
strlen
wcscmp
wcslen
api-ms-win-crt-stdio-l1-1-0
fwrite
fclose
_set_fmode
__p__commode
_wfopen
fread
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=28, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=150, id=1, productName=Unmarked objects,
count=8, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.2-win-x64/pingzhu-regtool.exe
- IMPHASH 3a3230b61428d284283da2a4492a8208
- SHA256 569254f86875e8f959b31fcf2c66aff6272189b52dafa8b53aca473de9bf2a33
- MD5 a0d24ffcd1f7b0baad6d8587b74eba08
- SHA1 0886635f4f5fab3c5981e888b4b520f6f7c9ecde
- SHA512 4b7d13370810abeee558a140c096226274edbd100eced7c51a450f40b58a77de98f89f8aa1abf991443ed078f3ebe4d9b360cf28f549c6fc54c0197a6403c888
- SSDEEP 384:GSk4GRPKP5W7js3KxfdD8ICYXxpFmBqP1vpvci7AdjLWyKnS3fV7UrrgcedO2kGd:GNBRPKMko9+VEpV2vXRnAgTSLhXM
- TLSH T1FD03A616DD6AA17FD35E8D78CA528C05DE63BCD6CBD1A58F57400CE209B1AE4AB3D302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
19532
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
StringFromGUID2
oleaut32
SysFreeString
advapi32
GetTokenInformation
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
OpenProcessToken
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
kernel32
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlVirtualUnwind
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
CompareFileTime
FindClose
FindFirstFileW
FindNextFileW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
RtlCaptureContext
RtlLookupFunctionEntry
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
vcruntime140
__current_exception
__current_exception_context
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
memset
memcmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_crt_atexit
_seh_filter_exe
_set_app_type
_register_onexit_function
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___wargv
_cexit
_c_exit
_invoke_watson
terminate
api-ms-win-crt-locale-l1-1-0
setlocale
_configthreadlocale
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
wcslen
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=27, id=261, version=35207,
count=6, id=257, version=35207,
count=2, id=260, version=33145,
count=9, id=257, version=33145,
count=93, id=1, productName=Unmarked objects,
count=2, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.2-win-x64/pingzhu-router-test.exe
- IMPHASH 98c9505c4430575ec5b73e3a0495692f
- SHA256 2cb458cb797be18655dfbe038272c120e7120fe3bc2f5d22409ddadcca6d6703
- MD5 c574fa8d79ed5ce0fc0bd5cd9041108a
- SHA1 aca24b444bff23b6190de51675b2e6f38f0b7473
- SHA512 3e6c394c212005e58f2cdae877fe334c2e28358978984e7c5b75d09d65a19c4223d891a3aed174cbe2824479fbe2baea31d3a311235330e151f6f35e236457e5
- SSDEEP 768:41DnlGPSFuDJqYpYzYN2CB2mfpyZYkLH8sS3dkS:MWAYNdcZ8J
- TLSH T16F430A7ADF1691BAD21E8D74D5130A02DB72BCC64B90B2CF5B916CE60D31AE49B3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
25644
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
vcruntime140
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception_context
memcmp
memcpy
memmove
memset
__C_specific_handler
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_onexit_function
_invoke_watson
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argv
__p___argc
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
fclose
fflush
fread
__acrt_iob_func
__p__commode
__stdio_common_vsprintf
__stdio_common_vfprintf
fgetc
fgetpos
ungetc
setvbuf
fwrite
_set_fmode
fsetpos
_fseeki64
fputc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33145,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=28, id=261, version=35207,
count=7, id=257, version=35207,
count=136, id=1, productName=Unmarked objects,
count=2, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.2-win-x64/pingzhu-tsf-0.10.2.dll
- IMPHASH 3e78724a3a5903d77f0360f9956d0989
- SHA256 d31194c8174969a9988fd79687d5b1afe9be32ab9a4c345db588b587fa1177e0
- MD5 3e2e73884f4ab1d0861e310fdf6b679f
- SHA1 12e37c4286b4c7b803e1926f9789f2d7bd2b1e42
- SHA512 6f1b6e9ce2eb58113b7e0e1fc128e8661b88415d8a34f326b651f10278df374146035b58b44642a7feebc7ac166b0040248c83767e347a59dd8515dfe43af29d
- SSDEEP 3072:/xvLwbZEtkLMbbQ8nr/i9sULOdGWWdkkwYbKjjgD+:ZvLwdEzbbQ8nrK/LOdGWWPbKjjQ+
- TLSH T116B33B17FA15413EF1A5C77CCA938C42DB72788A0791ABCF07904DE65EA67E45F3A202
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
71780
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ole32
CoCreateInstance
oleaut32
VariantClear
VariantInit
SysAllocString
user32
GetClientRect
GetWindowRect
GetCursorPos
ClientToScreen
GetWindowLongPtrW
EndPaint
BeginPaint
GetForegroundWindow
SetWindowLongPtrW
UpdateWindow
GetSystemMetrics
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
wsprintfW
CopyIcon
GetGUIThreadInfo
DestroyIcon
FillRect
ReleaseDC
GetDC
GetKeyState
InvalidateRect
GetWindowThreadProcessId
LoadCursorW
CreateIconIndirect
gdi32
DeleteObject
DeleteDC
CreateSolidBrush
SelectObject
CreateCompatibleBitmap
CreateBitmap
SetTextColor
TextOutW
BitBlt
CreateFontW
CreatePen
GetStockObject
GetTextExtentPoint32W
Rectangle
CreateCompatibleDC
SetBkMode
advapi32
RegDeleteTreeW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
kernel32
GetModuleFileNameW
MultiByteToWideChar
GetLastError
FreeLibrary
GetProcAddress
GetFileAttributesExW
LoadLibraryW
GetModuleHandleW
WideCharToMultiByte
GetCurrentProcessId
GetFileAttributesW
GetLocalTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
DisableThreadLibraryCalls
vcruntime140
memmove
__C_specific_handler
__current_exception_context
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memset
__std_terminate
__current_exception
memcmp
__std_type_info_destroy_list
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_errno
_initterm_e
_initterm
_invoke_watson
terminate
_cexit
api-ms-win-crt-string-l1-1-0
strlen
wcsncpy_s
wcslen
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
fclose
_wfopen
__stdio_common_vsprintf
fread
fwrite
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=22, id=261, version=35207,
count=6, id=257, version=35207,
count=4, id=260, version=33145,
count=13, id=257, version=33145,
count=134, id=1, productName=Unmarked objects,
count=11, id=261, version=35228,
count=1, id=256, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.2-win-x64/pingzhu-tsf-test.exe
- IMPHASH b69222d4261648d580e20415c7618a00
- SHA256 9f2c8a089e9c2079cb3c98ccf6cc7e094b9adae0f1f7cac6e44daa7cbe32f045
- MD5 a200f16dd9d094e10725bb12aad0d7d6
- SHA1 c58e3fe953a1c114fa3be88947669a15fa7de688
- SHA512 d09ad126348b23f82614571c6ea0da4f75ea8819e3ceca346cc4a62d9c274711592ab7d0d206020802b4a6287e9f289a0ef494b71f382636ce17b0c5b7bb6567
- SSDEEP 768:12V5fYAOtkDlREea0Arx2ezetHZXc15RbZF/mucFV/NgLp0YDgP3dx9:12DR/aDrxwH1c15R9ZmuwV/X2Sx
- TLSH T164430B29DD56907FE31ACD79CA134C41EE627C8A8BE1A5CF4B900DE20D756E4AF39702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
30916
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
kernel32
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetFileAttributesW
GetLastError
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
WideCharToMultiByte
LoadLibraryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
vcruntime140
__current_exception_context
__current_exception
__C_specific_handler
strrchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_initialize_onexit_table
_register_onexit_function
_invoke_watson
_register_thread_local_exe_atexit_callback
terminate
_seh_filter_exe
_set_app_type
__p___argc
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_c_exit
_cexit
__p___argv
api-ms-win-crt-stdio-l1-1-0
_wfopen
__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
fread
fclose
api-ms-win-crt-string-l1-1-0
wcslen
strlen
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=28, id=261, version=35207,
count=6, id=257, version=35207,
count=3, id=260, version=33145,
count=7, id=257, version=33145,
count=86, id=1, productName=Unmarked objects,
count=4, id=261, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.2-win-x64/pingzhu.ini
- SHA256 1b09c8445a24addc7ae04df000dbb91122d33816b8ebe2a449a9bd335343d506
- MD5 cad21d8267be6ef4f020ffc45a3f9660
- SHA1 0dafec040a4b7de1257798288eadf06d10874459
- SHA512 4f9283ca42711f86d633ebb1044ea295d33a58c0f82fe6c7a5b1ec7dae09530dfa1413ccf325abbbccd75614c86f3dc14f2b481670e777855211664e35e8d8fd
- TLSH T113E0A366452344A62176F1C10761F17802543CFB3EB5C436EBA94421F9034267645926
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.2-win-x64/pingzhu_core.dll
- IMPHASH 4b32a1d17750743d74e5d1aa6e3744d2
- SHA256 12a3d79272063d71749f446156923d44bb4b5ca6cf33eb6e9e8e074239bae857
- MD5 6f238f46c24459b26b15614e0bafaf5e
- SHA1 ae6cb782183c0bdc2f9ed29aae24650dc6fca2d9
- SHA512 844adb60183a6b4a8f1dad22f9851db246840e8e0bdfca5086526f284d4fee8a63dac5ac9c19c678e12864393b50b680995b8718a6027ab1a51bbe77eb283631
- SSDEEP 6144:s5JQNmcV/QmLSEVdi9zQyXSxXxPvgGce6qijFXEZFlFkY5T:A2yme7rDZxf3
- TLSH T12A747C02F55658ADD09BC474432A84636A7170CE1B35ADFF12D982783FADFE25B38368
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
272532
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
pingzhu_core.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
bcryptprimitives
ProcessPrng
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
CloseHandle
GetLastError
WaitForSingleObject
SetLastError
GetFullPathNameW
GetCurrentThreadId
SetFileInformationByHandle
CreateFileW
GetStdHandle
GetCurrentProcess
GetProcessHeap
HeapFree
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetSystemTimePreciseAsFileTime
SetFileTime
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
GetCurrentDirectoryW
lstrlenW
FindFirstFileExW
FindClose
GetProcAddress
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
HeapAlloc
MultiByteToWideChar
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
IsProcessorFeaturePresent
FlsFree
FlsAlloc
GetModuleHandleExW
GetModuleHandleW
FlsSetValue
IsThreadAFiber
FormatMessageW
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
ntdll
NtReadFile
RtlNtStatusToDosError
NtWriteFile
vcruntime140
_CxxThrowException
__C_specific_handler
__std_type_info_destroy_list
__CxxFrameHandler3
memmove
memcmp
memcpy
memset
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
api-ms-win-crt-heap-l1-1-0
free
engine_abi_version
engine_backspace
engine_best_score
engine_best_sentence
engine_candidate_at
engine_candidate_count
engine_candidate_page_info
engine_candidate_window_open
engine_close_candidate_window
engine_commit
engine_composing
engine_create
engine_destroy
engine_feed_key
engine_feed_keys
engine_keyboard_rows
engine_keyboard_rows_free
engine_load_user_dictionary
engine_move_candidate_cursor
engine_next_candidate_page
engine_open_candidate_window
engine_output_is_faithful
engine_output_script
engine_prev_candidate_page
engine_reset
engine_save_user_dictionary
engine_select_candidate
engine_set_output_script
engine_syllable_count
Name
.text
Size
274KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
664B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=7, id=260, version=35207,
count=16, id=261, version=35207,
count=9, id=257, version=33145,
count=173, id=1, productName=Unmarked objects,
count=18, productName=Unmarked objects (old),
count=1, id=256, version=35228,
count=1, id=258, version=35228,
pingzhu-0.10.2-win-x64/ts-conversion.tsv
- SHA256 2d2440f4c3f3f346b332030c501732583013e731b01e9ddf16966dec02cf79c1
- MD5 9632aa63628a7e73f7692ff78fd9752c
- SHA1 e89d7babf735bfa73230808a2408ddeadebcb6f2
- SHA512 b71f36015ea7a9dc7bcb0871da74ab18b9dd5f54618b52e36c8199f66de5993e719a34d0a0d0e38ab21e1f6c67da5cfc4f99af28252bb658ebe8faf9f030c3ff
- SSDEEP 768:0H8DziPYmyXnxuXCNg/p1ZOyhXVaUxx+XUS8zQ3+ZQrNWKnV:xDziJyXno2gf9vz3lrzQ3uQV
- TLSH T195F25A0D8EB100AE20A391497107B776374F5F9C8DA944EAB5DE3A1AB08D0DC597D2BF
- MD5 SHA1 SHA512 SSDEEP TLSH
pingzhu-0.10.2-win-x64/uninstall-languagebar.cmd
- SHA256 4c84162fb4ecc7f1a8dc772201b15c8088b2747f6e4d3a53c1c03ac1802c3eaa
- MD5 3d5bc81fde1b920f4151e0c4a108f5f8
- SHA1 f354f34fa25edf7b11ec8f8532a11263f17df04a
- SHA512 762a9d68fa80e9910c07728c803a85e76dc0aea1dae5527e7dd54c5d625518bcc6ebe71f778b916657f07e1672a7b8bb2062bdc8539ee7e7a2d66c51954b479d
- TLSH T10FF05006B45667B5ACE24E9518B955519959D1D933279E0172BB5030B343246B3381D1
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.2-win-x64/uninstall.cmd
- SHA256 c3cf321e7f7c2e83077c4b5d0c441abfb3503f5c7247353e242eb32d1c28ab96
- MD5 74d377fb7ac34bc44d662ccacbc9847e
- SHA1 dc082be1ba0f531086bb8cd621c9f2752cf9b4b0
- SHA512 849b1f45f44e9ffd9633025dd9be81a537da34dd635479d82063192f6effee7332985e223e2aecd846f4b37205640bf995636be20b4f3b320e3d1c550d50998f
- TLSH T161D0A787741752AD7CE28D121CB69574F44A534303035D45A9B78234780625AE73A192
- MD5 SHA1 SHA512 TLSH
pingzhu-0.10.2-win-x64/uninstall.ps1
- SHA256 be2fb2d5eee828ee6bd368a94a5d6b8f2f6ecb6eba4f99f850acbf044325fd9c
- MD5 a7330350c805233132e731279a5b9559
- SHA1 ebf1d78475f19be8fcafed0535a739133eb2adb5
- SHA512 844b7cfa8b3cce7c91da380313aca39217880146ae5720cc4e5c1e92d363b2ab310afe62010adc267c7dc21e28b79e5789b4fb2790bf4bc7986d3ade737986c6
- TLSH T1A64194341012182EE7FA0B164A063F04EE8F413FA1622E60BD7D80C93F63A3C5725E6A
- MD5 SHA1 SHA512 TLSH