zapret-telegram.zip
- SHA256 d95c397599ab00e5a6926146aced68136b00d6cb80e8e0160ee668ae55ed77ff
Overview
overview
3Static
static
3bin/WinDivert.dll
windows10-2004-x64
1bin/WinDivert.dll
windows11-ltsc_2024-x64
1bin/WinDivert64.sys
windows10-2004-x64
3bin/cygwin1.dll
windows10-2004-x64
1bin/cygwin1.dll
windows11-ltsc_2024-x64
1bin/winws.exe
windows10-2004-x64
1bin/winws.exe
windows11-ltsc_2024-x64
1general (ALT).bat
windows10-2004-x64
3general (ALT).bat
windows11-ltsc_2024-x64
3general (ALT10).bat
windows10-2004-x64
3general (ALT10).bat
windows11-ltsc_2024-x64
3general (ALT11).bat
windows10-2004-x64
3general (ALT11).bat
windows11-ltsc_2024-x64
3general (ALT12).bat
windows10-2004-x64
3general (ALT12).bat
windows11-ltsc_2024-x64
3general (ALT13).bat
windows10-2004-x64
3general (ALT13).bat
windows11-ltsc_2024-x64
3general (ALT2).bat
windows10-2004-x64
3general (ALT2).bat
windows11-ltsc_2024-x64
3general (ALT3).bat
windows10-2004-x64
3general (ALT3).bat
windows11-ltsc_2024-x64
3general (ALT4).bat
windows10-2004-x64
3general (ALT4).bat
windows11-ltsc_2024-x64
3general (ALT5).bat
windows10-2004-x64
3general (ALT5).bat
windows11-ltsc_2024-x64
3general (ALT6).bat
windows10-2004-x64
3general (ALT6).bat
windows11-ltsc_2024-x64
3general (ALT7).bat
windows10-2004-x64
3general (ALT7).bat
windows11-ltsc_2024-x64
3general (ALT8).bat
windows10-2004-x64
3general (ALT8).bat
windows11-ltsc_2024-x64
3general (ALT9).bat
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bin/WinDivert.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
bin/WinDivert.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
bin/WinDivert64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
bin/cygwin1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
bin/cygwin1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
bin/winws.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
bin/winws.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
general (ALT).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
general (ALT).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
general (ALT10).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
general (ALT10).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
general (ALT11).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
general (ALT11).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
general (ALT12).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
general (ALT12).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
general (ALT13).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
general (ALT13).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
general (ALT2).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
general (ALT2).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
general (ALT3).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
general (ALT3).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
general (ALT4).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
general (ALT4).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
general (ALT5).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
general (ALT5).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
general (ALT6).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
general (ALT6).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
general (ALT7).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
general (ALT7).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
general (ALT8).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
general (ALT8).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
general (ALT9).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target zapret-telegram.zip
- Size 14.5MB
- Sample261102-afgljsfz8k
- SHA256 d95c397599ab00e5a6926146aced68136b00d6cb80e8e0160ee668ae55ed77ff
- MD5 830c66ad8c54af9eae12d237b40f7e70
- SHA1 44f7538e2a26bbdc7588ab466b6a8455c9eebd15
- SHA512 730bf7b88ff2565ad17a31ab2502a7b8be4de52e9f0ef6d928d405ef382142aed8c0bb3d5d4d6a7979f39b328f56017ed2e5681cb35a3f55b396cc046dba7361
- SSDEEP 393216:T3VgK+4cdyefpoSmoqKSr60WzjIQZ2TilCA5TuLJ+t8GL:LVKdyC1fnZEPsSN+Wm
- TLSH T13BE633B903027C0FF7694331E9491346A378E6343A818FAE9B535389BB1BD638796D17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/bin/WinDivert.dll unpack001/bin/cygwin1.dll unpack001/bin/winws.exe unpack001/zapret-telegram.exe
File Explorer
-
zapret-telegram.zip.zip 14.5MB
-
.gitattributes59B
-
.github/ISSUE_TEMPLATE/bug_report.yml2KB
-
.github/github-bot.yml199B
-
.github/workflows/comment.yml6KB
-
.github/workflows/release.yml1KB
-
.github/workflows/stale.yml961B
-
.gitignore152B
-
.salt32B
-
.service/hosts3KB
-
.service/ipset-service.txt559KB
-
.service/version.txt6B
-
LICENSE.txt2KB
-
README.md21KB
-
bin/ACTIVE_DISCORD_UDP.bin1KB
-
bin/ACTIVE_GAME_UDP.bin1KB
-
bin/WinDivert.dll.dll 46KB
-
bin/WinDivert64.sys.sys 91KB
-
bin/cygwin1.dll.dll 2.8MB
-
bin/quic_initial_4pda_to.bin1KB
-
bin/quic_initial_5ka_ru.bin1KB
-
bin/quic_initial_lemana_pro.bin1KB
-
bin/quic_initial_rutube_ru.bin1KB
-
bin/quic_initial_steam_chat_com.bin1KB
-
bin/quic_initial_steamcommunity_com.bin1KB
-
bin/quic_initial_steamstatic_com.bin1KB
-
bin/quic_initial_tencent_com.bin1KB
-
bin/quic_initial_www_google_com.bin1KB
-
bin/stun.bin100B
-
bin/stun2.bin120B
-
bin/tls_clienthello_4pda_to.bin284B
-
bin/tls_clienthello_5ka_ru.bin654B
-
bin/tls_clienthello_awswaf_com.bin1KB
-
bin/tls_clienthello_max_ru.bin664B
-
bin/tls_clienthello_sochi_park.bin244B
-
bin/tls_clienthello_steam_chat_com.bin1KB
-
bin/tls_clienthello_steamstatic_com.bin1KB
-
bin/tls_clienthello_teamspeak_com.bin1KB
-
bin/tls_clienthello_www_google_com.bin681B
-
bin/tls_clienthello_www_sferum_ru.bin661B
-
bin/winws.exe.exe 199KB
-
general (ALT).bat3KB
-
general (ALT10).bat3KB
-
general (ALT11).bat4KB
-
general (ALT12).bat4KB
-
general (ALT13).bat3KB
-
general (ALT2).bat3KB
-
general (ALT3).bat3KB
-
general (ALT4).bat3KB
-
general (ALT5).bat2KB
-
general (ALT6).bat3KB
-
general (ALT7).bat3KB
-
general (ALT8).bat3KB
-
general (ALT9).bat3KB
-
general (EXP).bat4KB
-
general (FAKE TLS AUTO ALT).bat3KB
-
general (FAKE TLS AUTO ALT2).bat4KB
-
general (FAKE TLS AUTO ALT3).bat4KB
-
general (FAKE TLS AUTO).bat3KB
-
general (SIMPLE FAKE ALT).bat3KB
-
general (SIMPLE FAKE ALT2).bat3KB
-
general (SIMPLE FAKE).bat3KB
-
general.bat3KB
-
lists/ipset-all.txt18B
-
lists/ipset-all.txt.backup559KB
-
lists/ipset-exclude.txt135B
-
lists/list-exclude.txt1KB
-
lists/list-general.txt1KB
-
lists/list-google.txt453B
-
utils/check_updates.enabled9B
-
utils/targets.txt1KB
-
utils/test zapret.ps1.ps1 40KB
-
zapret-telegram.bat.bat 14.2MB
-
zapret-telegram.exe.exe 7.1MB
.gitattributes
- SHA256 636e36f6dc3645153ecee71e8cb98ee73ed8dd1db6580b47e4241e46f818b039
- MD5 40db365330b693eff45477c99d48628e
- SHA1 42995ff46cbcf3219ac61366382e434b745ce23f
- SHA512 f2415f9f7fb62e96606642747ac5be919becd3eeab936cd9cfd58529a0160bb1ba74759899ff5b182352f96a5aec899c5f30080f1b1558312fa9bd67d872cb47
- TLSH T1C8A00112F05102A9E0C040C2500177A7285603EBB1B0C18008C994C8A220998B036000
- MD5 SHA1 SHA512 TLSH
.github/ISSUE_TEMPLATE/bug_report.yml
- SHA256 02c310e7d1a2f2daeb2ad08424f2beca28ab6d3ac1c06ace5820fa120cc2b96d
- MD5 ede048e588ea48b63de4eda6a8cc560b
- SHA1 0876cb6318de456ef7da512d065478771b706aaa
- SHA512 37e42579d1d23304f0fbe16bc37b14861d812800b3cb66c641e911c86ce73822b1706c4bcd762640aced34628a19a2554d5d01eff75415f12bdcad27f515d4b7
- TLSH T10D41DF12C55A24984E017085DC0CEF0971B685FF7E5793B4B9BE4CAD3FA2278D2B154A
- MD5 SHA1 SHA512 TLSH
.github/github-bot.yml
- SHA256 0c43131490c1bfe45cb05c32c215106eabdeb62f283c5305d822d2bdf542a597
- MD5 15ca5888571be5b38b93a14c17b46af0
- SHA1 53280c88c5e83c61d04d74a6a5e01e124ee5a9e0
- SHA512 0cba940e1ef114a438fde746a0318e286297657d5fba63a704cb1431c7600a23d3e94ff85764ae84ea187ad1e68b83b463c263f90e7e5f50474d7db06703bf39
- TLSH T1E2D0805194542D3D7110154D4653AD37A1B9F414E610335FEFE9B8592B59DDC2031535
- MD5 SHA1 SHA512 TLSH
.github/workflows/comment.yml
- SHA256 00959e7e87ff3c556d249548f49ec414e88bb9514946ccf7cce6d73871042d3b
- MD5 d365b301a3333ed7e520c145de82f178
- SHA1 5b8b88b1b536ef226d97ba0e1905f2b31ccc4956
- SHA512 1249c10cdbfcd111865adc15e7117dc5c8c76eaf56a0445695046d8668d099263a09c77914fe67d98cfe790f64b5566f1b1374f963795bda136edad8c5417148
- SSDEEP 96:A6p++1rKzdAbbrD6jm/i56+H7nvsuBx+dUkb:ApiKW6jL5H7nvQl
- TLSH T11BD1DD2015AA28DE0200B42BD8047D0D79FB44FF7EAA639A31FD6D7E3BF5134821D15A
- MD5 SHA1 SHA512 SSDEEP TLSH
.github/workflows/release.yml
- SHA256 d9c102ef5c9b73173c9b4790e66693ff529d326d0c151aad625dab086d561332
- MD5 f148100d09fa7fae945d33beb1506fa4
- SHA1 311425600496328db5cd45a9e2e6eadce86dfbaa
- SHA512 6941fb3779cbf432ea126ade0e4a12f8adec7ad6c37d1d3298117aa8083a9e4ad3298cd091a1dc3bcbf72775c935ea0882125cd663e0f18509efa0e979d73153
- TLSH T1D741DD45E50181F4876E943AC6C7644AB232B4CBB1911838F4BFC8E86FFA77153AAD04
- MD5 SHA1 SHA512 TLSH
.github/workflows/stale.yml
- SHA256 43e60645dc64283e446757ececec01f1f1f2e185c577edd3d5f4246bc371e144
- MD5 9b351d016800f6d43ea8a561fa590bd5
- SHA1 9608d280cd381864e8f755a37d107ed09dc8b03b
- SHA512 2307abdf26563a811ae687396025a4ff052699ab7fc113f91f1a5673202a4014ca98665499b90887b67db9cf3178f2c33858ca65279a01a04dacfba4ad3952c3
- TLSH T16011E3E5C605763D4151C16FE11C6540A06A4DFB3B171168B1DE1AAD2FFB118C5F270E
- MD5 SHA1 SHA512 TLSH
.gitignore
- SHA256 104b3747e47c6f8ced7055127377ffeb2029e42a22b8712804384b897cd5ad9f
- MD5 c288b1b79b3323b99af65b39b36632f7
- SHA1 0d09e1a995c381ba69132bece3aec6a0953d150b
- SHA512 9d2abd9569c7e78b37743217a19eebfc72f3144f8e137df8bee5ff1e99f64f7d5d3cb83dfa3669468e162b091de585a2e53d0b66947564713d1e1c501f50101f
- TLSH T166C04C55946DB80119DD9457ED5193EAADD0CDA3A8C2517471D742CD8082DCDD43AD11
- MD5 SHA1 SHA512 TLSH
.salt
- SHA256 2305a45d7239a41d0dc9931f28d95015042e8b3d811fdc70db178c329c0283eb
- MD5 954ba5d4d9910c1963bfb146be92c02c
- SHA1 7daaf9128638080e908fd72334e17bdcf9b59304
- SHA512 fb5a63e8fc8024db87892b7745715014869accb2075c65b38de25f4f2007b7dbb3a98c6c797c173ab5371844c6614cf01377f1214d5ce92f6891f6ac0f8a5db4
- MD5 SHA1 SHA512
.service/hosts
- SHA256 e7dcca4f85f425ddb641586823d15a66618eaec4df010027ad95f9cc1af489a9
- MD5 a508eb00ce6e420cb6489c0c749b16e7
- SHA1 e6eda53eb91b51333b709ed3e802975938426d2e
- SHA512 c58ea3b71b3ffb073f6502d9855a9547306cff1c72a3386613e02462caf425f1ebbc9c7d919e63eeb96ea5872fd66d514c1ae87de505fcd30278f062e286850d
- TLSH T13E61F6D1177ECF114B92C032E612B1E85134E010D64EBDA6DF6B5C6DE8A8B8639B633D
- MD5 SHA1 SHA512 TLSH
.service/ipset-service.txt
- SHA256 c39bf4e1b151c7d0d42fe7dae4c09e01ac26806a1ff4060ae456c7fb22087651
- MD5 875bcea7044f38c1938151dac9c96778
- SHA1 3399cc0394629c0c671b33705ea07cb982e0367e
- SHA512 8df41b5da47c9701a6d5b02edbada303f9a1fd31170f94c52f4af284595767b3bc21b2990a1a2251608e754f444999c1aea533d71547f362e9d64ce52c6eed76
- SSDEEP 3072:JdbJnv36N2ClwjoPrK1LHYky4deCp0I1m4BjIKxCteumYEYsppucy7Z5YgARGTJb:YbYvWsWmuDgK
- TLSH T15BC4593213B41BE78ACEA1EA3323957425E7968615F6F273CB9F62623C11040FD2795E
- MD5 SHA1 SHA512 SSDEEP TLSH
.service/version.txt
- SHA256 8fa9af879aa72ed97e61926854269da858a80f0a5c72f117cb1ea537c9cec268
- MD5 ba0847f9ae8dc874bdcec97d14f5ce98
- SHA1 934664f45e2943a57b65f7cdad7e4986fa49c54d
- SHA512 c1eef2d486047ca44e869c6d13dff720d33213e99b51bcbb52abd8d100ef1a334361284f35ecc8b97c1673ab8f6374d7f77881612bf17f12a5ffdb988a9fc213
- MD5 SHA1 SHA512
LICENSE.txt
- SHA256 8ea76af265366af6ef96595705ad21cafab82f2786203ae70d29a970260434dc
- MD5 c503677f0456d501cad4eb9d8c84b6c7
- SHA1 3bf636db8861015870aa70a8225588b5750455ac
- SHA512 591112164951bdab5f569d538f34e841fae4d16cb6907d16145656bc93c24857d4640c13012dafc705d767fc96d66267d2cdfaba6b402eaddd5fe4206e0402bd
- TLSH T10141861E624583A21FC103915A8AACCFF32F509ABF5F6454306AD00CA276455CBFBA68
- MD5 SHA1 SHA512 TLSH
README.md
- SHA256 97db646b7e1897810b8e634d4fdc03fbbd1386786ca3c3186119cddcf7126e98
- MD5 4cbc3ec471a2933ceea39301ec3e8b0b
- SHA1 0c7b95ecf73dfc6e107ba1131da2d75534dd95f9
- SHA512 6e820a5a714232491736025b00177f64db27350e0969efaa10eaa24784b9be096811126a5bb961ed5b432835567dc2f40ebf2d87dda3324c55c75d9670955046
- SSDEEP 384:gbCQAs5nAJL7ai7rrOAAS2bHMMmZ8vGIDv31gEOa6gUQU10/JykPaD8/LCzpo:gbFAs5nAJCFAAS2bsD7Mf6EOa6T12Jz9
- TLSH T13DA2CB61129E24DE1605B45BDC047E4E79EB44FE7FAA93A715B42CBE35F2034C22E21A
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/ACTIVE_DISCORD_UDP.bin
- SHA256 2fe18b3bd20807d36704d0b072092ee49ae84edca907a4420ab9a0f0f28fddcf
- MD5 7429222625dfb23a41af04a4aa704acb
- SHA1 5e17589b3ab3d86dd269e6382dfdd15931f386e8
- SHA512 28563bd1fa798dcd3d95f13421c3b5041363cf0943baa3479138375f6daabbbfcaa6e2658b8e8e126850a40bdd658ce9a9e43abf5a5a073e6377a28211eb5243
- TLSH T1DD210DEF44273587CE95476523AC42FCA7C3956FC648047A6FF372051C7C14EE591415
- MD5 SHA1 SHA512 TLSH
bin/ACTIVE_GAME_UDP.bin
- SHA256 e065870cb0d13152e6132807bbf42218a9e7cd8d96f5602b61674cc540f3a56e
- MD5 6422bac6b3e976bab5d21451b834221f
- SHA1 5c3cbd90820054aec414e1c6e89f0ed03eb1f1d1
- SHA512 0c2b212260fe6a4ef7af91f2e5cb1d9ba117c0654a80b4153301c23f08e63c8921835ae5e66f287b60722e1aee5b122fd18ce856f1aaba52604c0f51d9859205
- TLSH T1F721EA9951EF257024F6430A18E9A4B6594366C74AF68BF351D90CA06CE974B8F09863
- MD5 SHA1 SHA512 TLSH
bin/WinDivert.dll
- IMPHASH 0b649f8e17494bb31b47f6e959a1769c
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegSetValueExW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
CreateMutexW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
HeapAlloc
HeapCreate
HeapDestroy
ReleaseMutex
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WinDivertClose
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCompileFilter
WinDivertHelperDecrementTTL
WinDivertHelperEvalFilter
WinDivertHelperFormatFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperHtonIPv6Address
WinDivertHelperHtonIpv6Address
WinDivertHelperHtonl
WinDivertHelperHtonll
WinDivertHelperHtons
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohIpv6Address
WinDivertHelperNtohl
WinDivertHelperNtohll
WinDivertHelperNtohs
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
WinDivertShutdown
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/WinDivert64.sys
- IMPHASH db584dd0570594898805dd67d7ff391c
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 20, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Sep 20, 2022
SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
61:50:19:91:b1:8f:32:38:04:52:51:37:dc:25:00:5a
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2022 - May 25, 2023
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
4484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\WinDivert-2.2.2\install\MSVC\amd64\WinDivert64.pdb
ntoskrnl.exe
RtlCopyUnicodeString
KeBugCheckEx
IoGetRequestorProcess
PsGetProcessId
ExUuidCreate
ObfDereferenceObject
ObfReferenceObject
IoWriteErrorLogEntry
IoGetCurrentProcess
IoFreeMdl
IoAllocateMdl
IoAllocateErrorLogEntry
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
RtlGetVersion
RtlIntegerToUnicodeString
hal
KeQueryPerformanceCounter
ndis.sys
NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBufferListPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool
fwpkclnt.sys
FwpmTransactionAbort0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpsQueryPacketInjectionState0
FwpmProviderAdd0
FwpmProviderDeleteByKey0
FwpsInjectNetworkReceiveAsync0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmCalloutAdd0
FwpmCalloutDeleteByKey0
FwpmFilterAdd0
FwpmFilterDeleteByKey0
FwpmTransactionCommit0
FwpsCalloutRegister0
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsInjectNetworkSendAsync0
FwpsInjectForwardAsync0
wdfldr.sys
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=262, version=24610,
count=3, id=136, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=1, productName=Unmarked objects,
count=9, id=257, version=24610,
count=5, id=259, version=24610,
count=5, id=260, version=24610,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
bin/cygwin1.dll
- IMPHASH 8f21c12c4e790805822951d4e4dcad1c
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
202560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredContinueHandler
AllocConsole
AttachConsole
CallNamedPipeA
CancelIo
CancelSynchronousIo
ClearCommBreak
ClearCommError
CloseHandle
CompareStringW
ConnectNamedPipe
CreateFileA
CreateFileW
CreateNamedPipeA
CreatePipe
CreateProcessW
CreateRemoteThread
CreateSymbolicLinkW
CreateTapePartition
CreateThread
DebugBreak
DeleteCriticalSection
DeleteProcThreadAttributeList
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
EnterCriticalSection
EraseTape
EscapeCommFunction
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
FlushConsoleInputBuffer
FlushFileBuffers
FlushViewOfFile
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
GenerateConsoleCtrlEvent
GetBinaryTypeW
GetCommModemStatus
GetCommState
GetCommandLineW
GetConsoleCP
GetConsoleCursorInfo
GetConsoleMode
GetConsoleOutputCP
GetConsoleProcessList
GetConsoleScreenBufferInfo
GetConsoleWindow
GetCurrentConsoleFontEx
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetHandleInformation
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDriveStringsA
GetLogicalDrives
GetLogicalProcessorInformationEx
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetNamedPipeClientProcessId
GetNumberOfConsoleInputEvents
GetOverlappedResult
GetPriorityClass
GetProcAddress
GetProcessAffinityMask
GetProcessGroupAffinity
GetProcessHeap
GetProcessId
GetProcessWorkingSetSize
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTapeParameters
GetTapePosition
GetTapeStatus
GetTempPathW
GetThreadContext
GetThreadGroupAffinity
GetThreadId
GetThreadPriority
GetTickCount
GetTickCount64
GetTimeZoneInformation
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
GlobalAlloc
GlobalLock
GlobalMemoryStatusEx
GlobalSize
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
IdnToAscii
IdnToUnicode
InitializeCriticalSection
InitializeProcThreadAttributeList
IsBadStringPtrA
IsDebuggerPresent
IsProcessInJob
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
LocaleNameToLCID
MapViewOfFile
MapViewOfFileEx
MultiByteToWideChar
OpenProcess
OpenThread
OutputDebugStringA
PeekConsoleInputA
PeekConsoleInputW
PeekNamedPipe
PrepareTape
PurgeComm
QueryDosDeviceW
QueryInformationJobObject
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
QueueUserAPC
RaiseException
ReadConsoleInputA
ReadConsoleInputW
ReadConsoleOutputW
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
ScrollConsoleScreenBufferA
ScrollConsoleScreenBufferW
SetCommBreak
SetCommMask
SetCommState
SetCommTimeouts
SetComputerNameExW
SetConsoleCP
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleOutputCP
SetConsoleTextAttribute
SetConsoleTitleW
SetConsoleWindowInfo
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointerEx
SetHandleInformation
SetLastError
SetNamedPipeHandleState
SetPriorityClass
SetProcessAffinityMask
SetProcessWorkingSetSize
SetStdHandle
SetSystemTime
SetTapeParameters
SetTapePosition
SetThreadContext
SetThreadGroupAffinity
SetThreadPriority
SetThreadStackGuarantee
Sleep
SuspendThread
SwitchToThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransmitCommChar
UnmapViewOfFile
UpdateProcThreadAttribute
VirtualAlloc
VirtualFree
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitCommEvent
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteConsoleInputW
WriteConsoleOutputW
WriteConsoleW
WriteFile
WriteProcessMemory
WriteTapemark
ntdll
NtAccessCheck
NtAdjustPrivilegesToken
NtAllocateLocallyUniqueId
NtAssignProcessToJobObject
NtCancelTimer
NtClose
NtCommitTransaction
NtCreateDirectoryObject
NtCreateEvent
NtCreateFile
NtCreateJobObject
NtCreateKey
NtCreateMutant
NtCreateNamedPipeFile
NtCreateSection
NtCreateSemaphore
NtCreateSymbolicLinkObject
NtCreateTimer
NtCreateTransaction
NtDuplicateToken
NtFlushBuffersFile
NtFsControlFile
NtLockFile
NtLockVirtualMemory
NtMapViewOfSection
NtOpenDirectoryObject
NtOpenEvent
NtOpenFile
NtOpenJobObject
NtOpenKey
NtOpenMutant
NtOpenProcessToken
NtOpenSection
NtOpenSemaphore
NtOpenSymbolicLinkObject
NtOpenThreadToken
NtPrivilegeCheck
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryDirectoryObject
NtQueryEaFile
NtQueryEvent
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationToken
NtQueryObject
NtQueryQuotaInformationFile
NtQuerySecurityObject
NtQuerySemaphore
NtQuerySymbolicLinkObject
NtQuerySystemInformation
NtQuerySystemTime
NtQueryTimer
NtQueryTimerResolution
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtReadFile
NtRollbackTransaction
NtSetEaFile
NtSetEvent
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationThread
NtSetInformationToken
NtSetQuotaInformationFile
NtSetSecurityObject
NtSetTimer
NtSetValueKey
NtSetVolumeInformationFile
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtWaitForSingleObject
NtWriteFile
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAccessDeniedAceEx
RtlAllocateHeap
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlCheckRegistryKey
RtlCompareUnicodeString
RtlConvertSidToUnicodeString
RtlCopySid
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateQueryDebugBuffer
RtlCreateSecurityDescriptor
RtlDestroyQueryDebugBuffer
RtlDowncaseUnicodeString
RtlEnterCriticalSection
RtlEqualPrefixSid
RtlEqualSid
RtlEqualUnicodeString
RtlFirstFreeAce
RtlFreeHeap
RtlFreeUnicodeString
RtlGetAce
RtlGetControlSecurityDescriptor
RtlGetCurrentTransaction
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetNtVersionNumbers
RtlGetOwnerSecurityDescriptor
RtlGetVersion
RtlIdentifierAuthoritySid
RtlInitAnsiString
RtlInitUnicodeString
RtlInitializeSid
RtlLeaveCriticalSection
RtlLengthSid
RtlNtStatusToDosError
RtlPrefixUnicodeString
RtlQueryProcessDebugInformation
RtlQueryRegistryValues
RtlSetControlSecurityDescriptor
RtlSetCurrentDirectory_U
RtlSetCurrentTransaction
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlUnicodeStringToAnsiString
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeString
GetCommandLineA@0
GetCommandLineW@0
_Exit
__argc
__argv
__assert
__assert_func
__assertfail
__b64_ntop
__b64_pton
__bsd_qsort_r
__check_rhosts_file
__chk_fail
__cpuset_alloc
__cpuset_free
__ctype_ptr__
__cxa_atexit
__cxa_finalize
__cygwin_user_data
__dn_comp
__dn_expand
__dn_skipname
__eprintf
__errno
__fbufsize
__flbf
__fpclassifyd
__fpclassifyf
__fpending
__fpurge
__freadable
__freading
__fsetlocking
__fwritable
__fwriting
__getpagesize
__getreent
__gets_chk
__gnu_basename
__infinity
__isinfd
__isinff
__isnand
__isnanf
__locale_ctype_ptr
__locale_ctype_ptr_l
__locale_mb_cur_max
__main
__mb_cur_max
__memcpy_chk
__memmove_chk
__mempcpy
__mempcpy_chk
__memset_chk
__opendir_with_d_ino
__progname
__rcmd_errstr
__res_close
__res_init
__res_mkquery
__res_nclose
__res_ninit
__res_nmkquery
__res_nquery
__res_nquerydomain
__res_nsearch
__res_nsend
__res_query
__res_querydomain
__res_search
__res_send
__res_state
__sched_getaffinity_sys
__signbitd
__signbitf
__signgam
__snprintf_chk
__sprintf_chk
__srget
__srget_r
__stack_chk_fail
__stack_chk_fail_local
__stack_chk_guard
__stpcpy_chk
__stpncpy_chk
__strcat_chk
__strcpy_chk
__strncat_chk
__strncpy_chk
__swbuf
__swbuf_r
__vsnprintf_chk
__vsprintf_chk
__wrap__ZdaPv
__wrap__ZdaPvRKSt9nothrow_t
__wrap__ZdlPv
__wrap__ZdlPvRKSt9nothrow_t
__wrap__Znam
__wrap__ZnamRKSt9nothrow_t
__wrap__Znwm
__wrap__ZnwmRKSt9nothrow_t
__xdrrec_getrec
__xdrrec_setnonblock
__xpg_sigpause
__xpg_strerror_r
_alloca
_check_for_executable
_ctype_
_daylight
_dll_crt0
_exit
_fe_dfl_env
_fe_nomask_env
_feinitialise
_fscanf_r
_get_osfhandle
_impure_ptr
_longjmp
_pipe
_pthread_cleanup_pop
_pthread_cleanup_push
_setjmp
_setmode
_sys_errlist
_sys_nerr
_timezone
_tzname
a64l
abort
abs
accept
accept4
access
acl
acl_add_perm
acl_calc_mask
acl_check
acl_clear_perms
acl_cmp
acl_copy_entry
acl_copy_ext
acl_copy_int
acl_create_entry
acl_delete_def_file
acl_delete_entry
acl_delete_perm
acl_dup
acl_entries
acl_equiv_mode
acl_error
acl_extended_fd
acl_extended_file
acl_extended_file_nofollow
acl_free
acl_from_mode
acl_from_text
acl_get_entry
acl_get_fd
acl_get_file
acl_get_perm
acl_get_permset
acl_get_qualifier
acl_get_tag_type
acl_init
acl_set_fd
acl_set_file
acl_set_permset
acl_set_qualifier
acl_set_tag_type
acl_size
acl_to_any_text
acl_to_text
acl_valid
aclcheck
aclfrommode
aclfrompbits
aclfromtext
aclsort
acltomode
acltopbits
acltotext
acos
acosf
acosh
acoshf
acoshl
acosl
aio_cancel
aio_error
aio_fsync
aio_read
aio_return
aio_suspend
aio_write
alarm
aligned_alloc
alphasort
arc4random
arc4random_addrandom
arc4random_buf
arc4random_stir
arc4random_uniform
argz_add
argz_add_sep
argz_append
argz_count
argz_create
argz_create_sep
argz_delete
argz_extract
argz_insert
argz_next
argz_replace
argz_stringify
asctime
asctime_r
asin
asinf
asinh
asinhf
asinhl
asinl
asnprintf
asprintf
at_quick_exit
atan
atan2
atan2f
atan2l
atanf
atanh
atanhf
atanhl
atanl
atexit
atof
atoff
atoi
atol
atoll
basename
bcmp
bcopy
bind
bindresvport
bindresvport_sa
bsearch
btowc
bzero
cabs
cabsf
cabsl
cacos
cacosf
cacosh
cacoshf
cacoshl
cacosl
call_once
calloc
canonicalize_file_name
carg
cargf
cargl
casin
casinf
casinh
casinhf
casinhl
casinl
catan
catanf
catanh
catanhf
catanhl
catanl
catclose
catgets
catopen
cbrt
cbrtf
cbrtl
ccos
ccosf
ccosh
ccoshf
ccoshl
ccosl
ceil
ceilf
ceill
cexp
cexpf
cexpl
cfgetispeed
cfgetospeed
cfmakeraw
cfsetispeed
cfsetospeed
cfsetspeed
chdir
chmod
chown
chroot
cimag
cimagf
cimagl
clearenv
clearerr
clearerr_unlocked
clock
clock_getcpuclockid
clock_getres
clock_gettime
clock_nanosleep
clock_setres
clock_settime
clog
clog10
clog10f
clog10l
clogf
clogl
close
closedir
closelog
cnd_broadcast
cnd_destroy
cnd_init
cnd_signal
cnd_timedwait
cnd_wait
confstr
conj
conjf
conjl
connect
copysign
copysignf
copysignl
cos
cosf
cosh
coshf
coshl
cosl
cpow
cpowf
cpowl
cproj
cprojf
cprojl
creal
crealf
creall
creat
csin
csinf
csinh
csinhf
csinhl
csinl
csqrt
csqrtf
csqrtl
ctan
ctanf
ctanh
ctanhf
ctanhl
ctanl
ctermid
ctime
ctime_r
cuserid
cwait
cygwin_attach_handle_to_fd
cygwin_conv_path
cygwin_conv_path_list
cygwin_create_path
cygwin_detach_dll
cygwin_dll_init
cygwin_internal
cygwin_logon_user
cygwin_posix_path_list_p
cygwin_set_impersonation_token
cygwin_split_path
cygwin_stackdump
cygwin_umount
cygwin_winpid_to_pid
daemon
dbm_clearerr
dbm_close
dbm_delete
dbm_dirfno
dbm_error
dbm_fetch
dbm_firstkey
dbm_nextkey
dbm_open
dbm_store
difftime
dirfd
dirname
div
dladdr
dlclose
dlerror
dlfork
dll_crt0__FP11per_process
dll_dllcrt0
dll_entry
dlopen
dlsym
dn_comp
dn_expand
dn_skipname
dprintf
drand48
drem
dremf
dreml
dup
dup2
dup3
duplocale
eaccess
ecvt
ecvtbuf
ecvtf
endgrent
endhostent
endmntent
endprotoent
endpwent
endservent
endusershell
endutent
endutxent
environ
envz_add
envz_entry
envz_get
envz_merge
envz_remove
envz_strip
erand48
erf
erfc
erfcf
erfcl
erff
erfl
err
error
error_at_line
error_message_count
error_one_per_line
error_print_progname
errx
euidaccess
execl
execle
execlp
execv
execve
execvp
execvpe
exit
exp
exp10
exp10f
exp10l
exp2
exp2f
exp2l
expf
expl
explicit_bzero
expm1
expm1f
expm1l
fabs
fabsf
fabsl
faccessat
facl
fchdir
fchmod
fchmodat
fchown
fchownat
fclose
fcloseall
fcntl
fcvt
fcvtbuf
fcvtf
fdatasync
fdim
fdimf
fdiml
fdopen
fdopendir
feclearexcept
fedisableexcept
feenableexcept
fegetenv
fegetexcept
fegetexceptflag
fegetprec
fegetround
feholdexcept
feof
feof_unlocked
feraiseexcept
ferror
ferror_unlocked
fesetenv
fesetexceptflag
fesetprec
fesetround
fetestexcept
feupdateenv
fexecve
fflush
fflush_unlocked
ffs
ffsl
ffsll
fgetc
fgetc_unlocked
fgetpos
fgets
fgets_unlocked
fgetwc
fgetwc_unlocked
fgetws
fgetws_unlocked
fgetxattr
fileno
fileno_unlocked
finite
finitef
finitel
fiprintf
flistxattr
flock
flockfile
floor
floorf
floorl
fls
flsl
flsll
fma
fmaf
fmal
fmax
fmaxf
fmaxl
fmemopen
fmin
fminf
fminl
fmod
fmodf
fmodl
fnmatch
fopen
fopencookie
fork
forkpty
fpathconf
fprintf
fpurge
fputc
fputc_unlocked
fputs
fputs_unlocked
fputwc
fputwc_unlocked
fputws
fputws_unlocked
fread
fread_unlocked
free
freeaddrinfo
freeifaddrs
freelocale
fremovexattr
freopen
frexp
frexpf
frexpl
fscanf
fseek
fseeko
fsetpos
fsetxattr
fstat
fstatat
fstatfs
fstatvfs
fsync
ftell
ftello
ftime
ftok
ftruncate
ftrylockfile
fts_children
fts_close
fts_get_clientptr
fts_get_stream
fts_open
fts_read
fts_set
fts_set_clientptr
ftw
funlockfile
funopen
futimens
futimes
futimesat
fwide
fwprintf
fwrite
fwrite_unlocked
fwscanf
gai_strerror
gamma
gamma_r
gammaf
gammaf_r
gcvt
gcvtf
get_avphys_pages
get_current_dir_name
get_nprocs
get_nprocs_conf
get_phys_pages
getaddrinfo
getc
getc_unlocked
getchar
getchar_unlocked
getcontext
getcwd
getdelim
getdomainname
getdtablesize
getegid
getentropy
getenv
geteuid
getgid
getgrent
getgrgid
getgrgid_r
getgrnam
getgrnam_r
getgrouplist
getgroups
gethostbyaddr
gethostbyname
gethostbyname2
gethostid
gethostname
getifaddrs
getitimer
getline
getloadavg
getlogin
getlogin_r
getmntent
getmntent_r
getmode
getnameinfo
getopt
getopt_long
getopt_long_only
getpagesize
getpass
getpeereid
getpeername
getpgid
getpgrp
getpid
getppid
getpriority
getprogname
getprotobyname
getprotobynumber
getprotoent
getpt
getpwent
getpwnam
getpwnam_r
getpwuid
getpwuid_r
getrandom
getrlimit
getrusage
gets
getservbyname
getservbyport
getservent
getsid
getsockname
getsockopt
getsubopt
gettimeofday
getuid
getusershell
getutent
getutid
getutline
getutxent
getutxid
getutxline
getw
getwc
getwc_unlocked
getwchar
getwchar_unlocked
getwd
getxattr
glob
glob_pattern_p
globfree
gmtime
gmtime_r
grantpt
h_errno
hcreate
hcreate_r
hdestroy
hdestroy_r
herror
hsearch
hsearch_r
hstrerror
htonl
htons
hypot
hypotf
hypotl
if_freenameindex
if_indextoname
if_nameindex
if_nametoindex
ilogb
ilogbf
ilogbl
imaxabs
imaxdiv
in6addr_any
in6addr_loopback
index
inet_addr
inet_aton
inet_makeaddr
inet_netof
inet_network
inet_ntoa
inet_ntop
inet_pton
infinity
infinityf
initgroups
initstate
insque
ioctl
iprintf
iruserok
iruserok_sa
isalnum
isalnum_l
isalpha
isalpha_l
isascii
isascii_l
isatty
isblank
isblank_l
iscntrl
iscntrl_l
isdigit
isdigit_l
isgraph
isgraph_l
isinf
isinff
isinfl
islower
islower_l
isnan
isnanf
isnanl
isprint
isprint_l
ispunct
ispunct_l
issetugid
isspace
isspace_l
isupper
isupper_l
iswalnum
iswalnum_l
iswalpha
iswalpha_l
iswblank
iswblank_l
iswcntrl
iswcntrl_l
iswctype
iswctype_l
iswdigit
iswdigit_l
iswgraph
iswgraph_l
iswlower
iswlower_l
iswprint
iswprint_l
iswpunct
iswpunct_l
iswspace
iswspace_l
iswupper
iswupper_l
iswxdigit
iswxdigit_l
isxdigit
isxdigit_l
j0
j0f
j1
j1f
jn
jnf
jrand48
kill
killpg
l64a
labs
lchown
lcong48
ldexp
ldexpf
ldexpl
ldiv
lfind
lgamma
lgamma_r
lgammaf
lgammaf_r
lgammal
lgammal_r
lgetxattr
link
linkat
lio_listio
listen
listxattr
llabs
lldiv
llistxattr
llrint
llrintf
llrintl
llround
llroundf
llroundl
localeconv
localtime
localtime_r
lockf
log
log10
log10f
log10l
log1p
log1pf
log1pl
log2
log2f
log2l
logb
logbf
logbl
logf
login
login_tty
logl
logout
logwtmp
longjmp
lrand48
lremovexattr
lrint
lrintf
lrintl
lround
lroundf
lroundl
lsearch
lseek
lsetxattr
lstat
lutimes
madvise
makecontext
mallinfo
malloc
malloc_stats
malloc_trim
malloc_usable_size
mallopt
mblen
mbrlen
mbrtowc
mbsinit
mbsnrtowcs
mbsrtowcs
mbstowcs
mbtowc
memalign
memccpy
memchr
memcmp
memcpy
memmem
memmove
mempcpy
memrchr
memset
mkdir
mkdirat
mkdtemp
mkfifo
mkfifoat
mknod
mknodat
mkostemp
mkostemps
mkstemp
mkstemps
mktemp
mktime
mlock
mmap
modf
modff
modfl
mount
mprotect
mq_close
mq_getattr
mq_notify
mq_open
mq_receive
mq_send
mq_setattr
mq_timedreceive
mq_timedsend
mq_unlink
mrand48
msgctl
msgget
msgrcv
msgsnd
msync
mtx_destroy
mtx_init
mtx_lock
mtx_timedlock
mtx_trylock
mtx_unlock
munlock
munmap
nan
nanf
nanl
nanosleep
nearbyint
nearbyintf
nearbyintl
newlocale
nextafter
nextafterf
nextafterl
nexttoward
nexttowardf
nexttowardl
nftw
nice
nl_langinfo
nl_langinfo_l
nrand48
ntohl
ntohs
on_exit
open
open_memstream
open_wmemstream
openat
opendir
openlog
openpty
optarg
opterr
optind
optopt
optreset
pathconf
pause
pclose
perror
pipe
pipe2
poll
popen
posix_fadvise
posix_fallocate
posix_madvise
posix_memalign
posix_openpt
posix_spawn
posix_spawn_file_actions_addclose
posix_spawn_file_actions_adddup2
posix_spawn_file_actions_addopen
posix_spawn_file_actions_destroy
posix_spawn_file_actions_init
posix_spawnattr_destroy
posix_spawnattr_getflags
posix_spawnattr_getpgroup
posix_spawnattr_getschedparam
posix_spawnattr_getschedpolicy
posix_spawnattr_getsigdefault
posix_spawnattr_getsigmask
posix_spawnattr_init
posix_spawnattr_setflags
posix_spawnattr_setpgroup
posix_spawnattr_setschedparam
posix_spawnattr_setschedpolicy
posix_spawnattr_setsigdefault
posix_spawnattr_setsigmask
posix_spawnp
pow
pow10
pow10f
pow10l
powf
powl
ppoll
pread
printf
program_invocation_name
program_invocation_short_name
pselect
psiginfo
psignal
pthread_atfork
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getguardsize
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstack
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setguardsize
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstack
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_clockwait
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getclock
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setclock
pthread_condattr_setpshared
pthread_continue
pthread_create
pthread_detach
pthread_equal
pthread_exit
pthread_getaffinity_np
pthread_getattr_np
pthread_getconcurrency
pthread_getcpuclockid
pthread_getname_np
pthread_getschedparam
pthread_getsequence_np
pthread_getspecific
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_clocklock
pthread_mutex_destroy
pthread_mutex_getprioceiling
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_setprioceiling
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getprioceiling
pthread_mutexattr_getprotocol
pthread_mutexattr_getpshared
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setprioceiling
pthread_mutexattr_setprotocol
pthread_mutexattr_setpshared
pthread_mutexattr_settype
pthread_once
pthread_rwlock_clockrdlock
pthread_rwlock_clockwrlock
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_setaffinity_np
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setname_np
pthread_setschedparam
pthread_setschedprio
pthread_setspecific
pthread_sigmask
pthread_sigqueue
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_suspend
pthread_testcancel
pthread_timedjoin_np
pthread_tryjoin_np
pthread_yield
ptsname
ptsname_r
putc
putc_unlocked
putchar
putchar_unlocked
putenv
puts
pututline
pututxline
putw
putwc
putwc_unlocked
putwchar
putwchar_unlocked
pwrite
qsort
qsort_r
quick_exit
quotactl
raise
rand
rand_r
random
rawmemchr
rcmd
rcmd_af
read
readdir
readdir_r
readlink
readlinkat
readv
realloc
reallocarray
reallocf
realpath
recv
recvfrom
recvmsg
reent_data
regcomp
regerror
regexec
regfree
remainder
remainderf
remainderl
remove
removexattr
remque
remquo
remquof
remquol
rename
renameat
renameat2
res_close
res_init
res_mkquery
res_nclose
res_ninit
res_nmkquery
res_nquery
res_nquerydomain
res_nsearch
res_nsend
res_query
res_querydomain
res_search
res_send
revoke
rewind
rewinddir
rexec
rindex
rint
rintf
rintl
rmdir
round
roundf
roundl
rpmatch
rresvport
rresvport_af
ruserok
sbrk
scalb
scalbf
scalbl
scalbln
scalblnf
scalblnl
scalbn
scalbnf
scalbnl
scandir
scandirat
scanf
sched_get_priority_max
sched_get_priority_min
sched_getaffinity
sched_getcpu
sched_getparam
sched_getscheduler
sched_rr_get_interval
sched_setaffinity
sched_setparam
sched_setscheduler
sched_yield
secure_getenv
seed48
seekdir
select
sem_clockwait
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_timedwait
sem_trywait
sem_unlink
sem_wait
semctl
semget
semop
send
sendmsg
sendto
setbuf
setbuffer
setcontext
setdtablesize
setegid
setenv
seteuid
setgid
setgrent
setgroups
sethostent
sethostname
setitimer
setjmp
setlinebuf
setlocale
setlogmask
setmntent
setpassent
setpgid
setpgrp
setpriority
setprogname
setprotoent
setpwent
setregid
setreuid
setrlimit
setservent
setsid
setsockopt
setstate
settimeofday
setuid
setusershell
setutent
setutxent
setvbuf
setxattr
shm_open
shm_unlink
shmat
shmctl
shmdt
shmget
shutdown
sig2str
sigaction
sigaddset
sigaltstack
sigdelset
sigemptyset
sigfillset
sighold
sigignore
siginterrupt
sigismember
siglongjmp
signal
signalfd
significand
significandf
sigpause
sigpending
sigprocmask
sigqueue
sigrelse
sigset
sigsetjmp
sigsuspend
sigtimedwait
sigwait
sigwaitinfo
sin
sincos
sincosf
sincosl
sinf
sinh
sinhf
sinhl
sinl
siprintf
sleep
snprintf
sockatmark
socket
socketpair
spawnl
spawnle
spawnlp
spawnlpe
spawnv
spawnve
spawnvp
spawnvpe
sprintf
sqrt
sqrtf
sqrtl
srand
srand48
srandom
sscanf
stat
statfs
statvfs
stime
stpcpy
stpncpy
str2sig
strcasecmp
strcasecmp_l
strcasestr
strcat
strchr
strchrnul
strcmp
strcoll
strcoll_l
strcpy
strcspn
strdup
strerror
strerror_l
strerror_r
strfmon
strfmon_l
strftime
strftime_l
strlcat
strlcpy
strlen
strlwr
strncasecmp
strncasecmp_l
strncat
strncmp
strncpy
strndup
strnlen
strnstr
strpbrk
strptime
strptime_l
strrchr
strsep
strsignal
strspn
strstr
strtod
strtod_l
strtof
strtof_l
strtoimax
strtok
strtok_r
strtol
strtol_l
strtold
strtold_l
strtoll
strtoll_l
strtosigno
strtoul
strtoul_l
strtoull
strtoull_l
strtoumax
strupr
strverscmp
strxfrm
strxfrm_l
swab
swapcontext
swprintf
swscanf
symlink
symlinkat
sync
sys_errlist
sys_nerr
sys_sigabbrev
sys_siglist
sysconf
sysinfo
syslog
system
tan
tanf
tanh
tanhf
tanhl
tanl
tcdrain
tcflow
tcflush
tcgetattr
tcgetpgrp
tcgetsid
tcsendbreak
tcsetattr
tcsetpgrp
tdelete
tdestroy
telldir
tempnam
tfind
tgamma
tgammaf
tgammal
thrd_create
thrd_current
thrd_detach
thrd_equal
thrd_exit
thrd_join
thrd_sleep
thrd_yield
time
timegm
timelocal
timer_create
timer_delete
timer_getoverrun
timer_gettime
timer_settime
timerfd_create
timerfd_gettime
timerfd_settime
times
timezone
timingsafe_bcmp
timingsafe_memcmp
tmpfile
tmpnam
toascii
toascii_l
tolower
tolower_l
toupper
toupper_l
towctrans
towctrans_l
towlower
towlower_l
towupper
towupper_l
trunc
truncate
truncf
truncl
tsearch
tss_create
tss_delete
tss_get
tss_set
ttyname
ttyname_r
ttyslot
twalk
tzset
ualarm
umask
umount
uname
uname_x
ungetc
ungetwc
unlink
unlinkat
unlockpt
unsetenv
updwtmp
updwtmpx
uselocale
usleep
utime
utimensat
utimes
utmpname
utmpxname
valloc
vasnprintf
vasprintf
vdprintf
verr
verrx
versionsort
vfiprintf
vfork
vfprintf
vfscanf
vfwprintf
vfwscanf
vhangup
vprintf
vscanf
vsnprintf
vsprintf
vsscanf
vswprintf
vswscanf
vsyslog
vwarn
vwarnx
vwprintf
vwscanf
wait
wait3
wait4
waitpid
warn
warnx
wcpcpy
wcpncpy
wcrtomb
wcscasecmp
wcscasecmp_l
wcscat
wcschr
wcscmp
wcscoll
wcscoll_l
wcscpy
wcscspn
wcsdup
wcsftime
wcsftime_l
wcslcat
wcslcpy
wcslen
wcsncasecmp
wcsncasecmp_l
wcsncat
wcsncmp
wcsncpy
wcsnlen
wcsnrtombs
wcspbrk
wcsrchr
wcsrtombs
wcsspn
wcsstr
wcstod
wcstod_l
wcstof
wcstof_l
wcstoimax
wcstok
wcstol
wcstol_l
wcstold
wcstold_l
wcstoll
wcstoll_l
wcstombs
wcstoul
wcstoul_l
wcstoull
wcstoull_l
wcstoumax
wcswidth
wcsxfrm
wcsxfrm_l
wctob
wctomb
wctrans
wctrans_l
wctype
wctype_l
wcwidth
wmemchr
wmemcmp
wmemcpy
wmemmove
wmempcpy
wmemset
wordexp
wordfree
wprintf
write
writev
wscanf
xdr_array
xdr_bool
xdr_bytes
xdr_char
xdr_double
xdr_enum
xdr_float
xdr_free
xdr_hyper
xdr_int
xdr_int16_t
xdr_int32_t
xdr_int64_t
xdr_int8_t
xdr_long
xdr_longlong_t
xdr_netobj
xdr_opaque
xdr_pointer
xdr_reference
xdr_short
xdr_sizeof
xdr_string
xdr_u_char
xdr_u_hyper
xdr_u_int
xdr_u_int16_t
xdr_u_int32_t
xdr_u_int64_t
xdr_u_int8_t
xdr_u_long
xdr_u_longlong_t
xdr_u_short
xdr_uint16_t
xdr_uint32_t
xdr_uint64_t
xdr_uint8_t
xdr_union
xdr_vector
xdr_void
xdr_wrapstring
xdrmem_create
xdrrec_create
xdrrec_endofrecord
xdrrec_eof
xdrrec_skiprecord
xdrstdio_create
y0
y0f
y1
y1f
yn
ynf
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
/4
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
274KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
400KB
Virtual Size
399KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
53B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/38
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/quic_initial_4pda_to.bin
- SHA256 e065870cb0d13152e6132807bbf42218a9e7cd8d96f5602b61674cc540f3a56e
- MD5 6422bac6b3e976bab5d21451b834221f
- SHA1 5c3cbd90820054aec414e1c6e89f0ed03eb1f1d1
- SHA512 0c2b212260fe6a4ef7af91f2e5cb1d9ba117c0654a80b4153301c23f08e63c8921835ae5e66f287b60722e1aee5b122fd18ce856f1aaba52604c0f51d9859205
- TLSH T1F721EA9951EF257024F6430A18E9A4B6594366C74AF68BF351D90CA06CE974B8F09863
- MD5 SHA1 SHA512 TLSH
bin/quic_initial_5ka_ru.bin
- SHA256 247dcd97f53bfae5482e4b2b66acdb01e48ee6c29c5ca526c9b241fa38c233b5
- MD5 a2ab0c128e6834d716823c376188edc8
- SHA1 68791babdcd1887cf2c393054d465888e126ed4a
- SHA512 48cb53de5bfeb687c1df038d99ee3abdf7ccc45eb33654212bd4d1dedd6e4a4ca36ec19fd95cdb344f61e1bf701bd34541353931801ba56f88f2255479f8a758
- TLSH T1E321C5AA790192DC2666C1D238886A85E9C4DEF2BBDCBC42D31934F16E1F409D098E47
- MD5 SHA1 SHA512 TLSH
bin/quic_initial_lemana_pro.bin
- SHA256 c2ff932a40d69a61321c1fa091a6182e16a2fb85f36881b6864f864f07508848
- MD5 563619ff38a65d63cd01b11fa2b2e099
- SHA1 5474f02b594000bb8cf447c132b191d58ff29fda
- SHA512 4c02f7034f6bf7d97ab0f3229d6f794c22b538a7b3d4a403a94befc76e2b121e1f3297b6d0bff918d47f50438068a57ed05901ce26c3d85c976cfb9637d82d43
- TLSH T10621F1AD2412CE8FDD502433A71140052A3552E2565F145762049C9A4762C2DA42B779
- MD5 SHA1 SHA512 TLSH
bin/quic_initial_rutube_ru.bin
- SHA256 74b1dfbdec125263c9407436658b0a848b8f0a934b8063d11571a6a2146a4a7b
- MD5 fc935731a55d3e715d5e216c50d937e7
- SHA1 90d3e8ab70e62556bdba81869bb2127fe39f254f
- SHA512 a43d195c1bb8d06e1a670760ef1aa308e1820488d88b64acf848a81004eca058e64bed60f069eb2e94fcba32610d346da1c2eaaf7d6f3b3a7efb5af0432c865d
- TLSH T12621418325867A72CA8A807A9C354C38833C0F5AB18E741162CCEB6B30CA626E30385D
- MD5 SHA1 SHA512 TLSH
bin/quic_initial_steam_chat_com.bin
- SHA256 1da1407166f5d2ade80f1d3c86d828178e13f08050c40fda2b0a4d276318642a
- MD5 f299ae597213e82160dff35f90c6c365
- SHA1 ff9145f04a472f2cf2955d4fcf1cf01e990207fe
- SHA512 8dbe05156a8e198f9d3acdd5c29a7662683f03c2fab5079782cbabb0b3d949605b137612f7ed0cfbb39ae441e11004241ade134dad37c606868348cbf82bb77e
- TLSH T12B21C04D3A113576C29649350695B36892C0A2010AB850337AA309EB14F2BE04FB2436
- MD5 SHA1 SHA512 TLSH
bin/quic_initial_steamcommunity_com.bin
- SHA256 2fe18b3bd20807d36704d0b072092ee49ae84edca907a4420ab9a0f0f28fddcf
- MD5 7429222625dfb23a41af04a4aa704acb
- SHA1 5e17589b3ab3d86dd269e6382dfdd15931f386e8
- SHA512 28563bd1fa798dcd3d95f13421c3b5041363cf0943baa3479138375f6daabbbfcaa6e2658b8e8e126850a40bdd658ce9a9e43abf5a5a073e6377a28211eb5243
- TLSH T1DD210DEF44273587CE95476523AC42FCA7C3956FC648047A6FF372051C7C14EE591415
- MD5 SHA1 SHA512 TLSH
bin/quic_initial_steamstatic_com.bin
- SHA256 4f1468adcc30ac7ffd9e04627c7289968f8c4ae476626d05f282da8064fe64b4
- MD5 6db6220f66db20028022466cb1376e29
- SHA1 487e676a5392f6b31e5c5dfb6c5ceb25044fe906
- SHA512 1a22e2ff17eb7601c707ec69f14c896eb7402496e24b0de0567a9351815c26d33ae9f7ba23a33b5a8c8f5fba106ebb95a01cecfe000cdd5bdbca8dde6635c40f
- TLSH T150216A2085173F5CCA50F479C8B0BCC05310C933654F30540784070760C38D3C1EC087
- MD5 SHA1 SHA512 TLSH
bin/quic_initial_tencent_com.bin
- SHA256 d250051d6200946a7ba0629c59c5641432957fa3513081a6c3c5aaa91a62ac03
- MD5 0b98262b43c075dd041329bab61a68c3
- SHA1 87d9162c43854b7084e08c15988661491e149589
- SHA512 96899e973a30e850567ac0912ad5cf04c147e26891d8655e838ba756213c728ff85e1c63ad8c6f29fa8cf403dddf9217a0cf658af846e34fa9fdc69a76d5ba44
- TLSH T15921177410ED13603E80128030AA4A2BBA705A58ADD0D90F21A3A0F5DD51832FBFBFE8
- MD5 SHA1 SHA512 TLSH
bin/quic_initial_www_google_com.bin
- SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
- MD5 312526d39958d89b1f8ab67789ab985f
- SHA1 49a06ceebb13807faaf2a935a716127faff9864d
- SHA512 472e88fdd60f9c67f784514a6b699bbefac257657f53a9682a864c0ced474b33f89cf14eb112226ebc9b2c6b07a8f2ec9b25010ccdf98c13370c5c9c6dc2b893
- TLSH T16C21E766D88023896108F64536222E5009B3A4471621258F07292781C83EFEEC1EC0C6
- MD5 SHA1 SHA512 TLSH
bin/stun.bin
- SHA256 9cd5469309780ca56c0bd97266524a48c7ee529d02c3179cfecb20b260a59641
- MD5 0357596c0e38a10a4b99dca2032419cc
- SHA1 05fb322426bd56771a1e1873e88626bc98d34563
- SHA512 319880f7624ff32720d11b79e5cdc24e24ee482a92cd2224e2175936b54a32916d059f431bf2f0e8ff74cf1be41395a462665e75fd1cf17a2c126d01cc2ee165
- TLSH T181B01200C24B4DA4C014103CC4436A9F84A415D58F00DFC389091E9050CA05E6CC1ACD
- MD5 SHA1 SHA512 TLSH
bin/stun2.bin
- SHA256 b7c2497496039c541f7337ac8536813f0a1cf52363ab2faa5213b7816d458813
- MD5 f01f84f99471de0c7c580da6a14fcdc6
- SHA1 4ba9e863501403b8bda56a1c482a5f351880a3d8
- SHA512 70a0a416d2b2ab8875b9e68690a4d10f735a9b2173aa3c4dd9d6fb1fe0ad228d8d767deea97f5eece1380f5ed2ef0266fa4d26ec18e3aa0763c14ae5cb3da3ff
- TLSH T1E1B02B0080B000900499853B41050B585B020AE4A373C9110A0B58D612C60308C08224
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_4pda_to.bin
- SHA256 eefeaf09dde8d69b1f176212541f63c68b314a33a335eced99a8a29f17254da8
- MD5 e6d649de132c3c10cb62531ef74f5b73
- SHA1 689c7e8d021a99d0a64fee9099fa9012a3528265
- SHA512 f7be809482e3098a5a8f79a759d1f8bcdc2e5201ac35f06eb8662afbb8194f2dfacc2c3e64114557de78e935086cad43880be83b0af1611a1aa0bced0facffba
- TLSH T14ED02B87C982745FDF090B7AA5D5C9B9DED3F1EA03CB8F4768058344FAD85B1422208D
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_5ka_ru.bin
- SHA256 1e8871e272591c5a277d38a6166af597c1fecb1cf58e85162e8f1968ec08d018
- MD5 710437a88c95578373f1fd2cf971100a
- SHA1 14f0032c13f75bbc4d06d8a177e92499a57dfd95
- SHA512 ef0229f348d359e30364d837ef180d2e57c365dcfb0f7f34011d6fe3e100ee953b26e5a6e9d8d3813d699c6f32cedba3b2040999ac809235271717f184a4a83e
- TLSH T118F023A7255B1C13F95712213CD5C14947526D247B033A576245FF30C8DDBC24BD070A
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_awswaf_com.bin
- SHA256 6405e264eff9f33632e727f6d696ff39503d3652f0f0be00921f06f97720a5b0
- MD5 7b6d8d620bfc15319eb179592cab473c
- SHA1 7e6341f395d25b5b4619280765b37a392aaccd9a
- SHA512 f907efa92ee7da74b25a6dbbb979e1cd8ac00d5dfbc869e459172770b9a501a135d1015b0fe8a67cdd9ef2f9556b87c02371aa46d333ba8d5a862a68dc9ca87f
- TLSH T19B1144A3135259CAD2414E340D8F54EAC206A104C7A35BCFFAA2DA50CDBBD86441219D
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_max_ru.bin
- SHA256 4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
- MD5 b2b3e684ce449b60f0bc5a9028221a08
- SHA1 32538a43ec8502f0146cd59456646bce7aedd29c
- SHA512 19963986a6c0f7265456aeaa4622fd4f8061dc81d1b722fb62f61574f6d96e4b55cfcd256dcfc555bec11ae458ddebb943de25dc1df102dafe99a2b4174b5b38
- TLSH T1CF0128771655D117A54D1F1650E150418585EF447302C7EF3B74D974CAD68C34E75345
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_sochi_park.bin
- SHA256 ad552922acfe029521da884ea29f4bb28bb6bdcee9b1a70b46adbfd266c11d4d
- MD5 cae56426ee185c46b19cd4f7dc8a6222
- SHA1 13fc2ceef9f883203f0cceef5978c3bb3b7f8972
- SHA512 68a928058cda86b67d0e30014d135eae1fc632e3daf4b504f618fa6809878c937000737ae5fbc8acd6eaa1ab6223138ea0006a54abf32f341cc8073fda966fa0
- TLSH T199D097C39901BC3E70204720AA2E86AEA1A370139B03670E30F6F0201AE8C643F33E81
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_steam_chat_com.bin
- SHA256 388e9a09bb2758ebbce34a0e27d8efa41bbd59954c9c32d8fb74b4bce2d99c67
- MD5 eae090dc82216136fd881102c217e35b
- SHA1 0b0bf6ce3e40b35eb75f3b3334912ac56c149165
- SHA512 15223df4fb15ddf25ea0500bdb863698f540c076d0cc0f2b049934411e7fe7fced9b876def0371f6484d6ce7308e2260005dbacda14d529ce2f18043cef6a1b9
- TLSH T1281183B2184A8882EB014276084E581253C1F08132E3CFFAB5AEC7984ACB8D348B9318
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_steamstatic_com.bin
- SHA256 3f8ba0b0de17a3feda593ef2cd82a1b44ca566f96acaa42f6fccd69f2484ecea
- MD5 2f24d2ddfb3fa5e796fe16cae9898c30
- SHA1 0e6b5e2d9436493d3203364a1c45a287df72910b
- SHA512 3118123a1ac1505b7a1d790c17d59e9e9b8506b15177f6c453aef7293099aaa43f13ae910e3257a20d3d12e273d65975ccfe31e48f5337ed21d2e031703f343d
- TLSH T1131144192111D687DC1D453608DF409A93E7D80263930FEB32DEBA66CFC01C78986255
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_teamspeak_com.bin
- SHA256 1336b7529c050a9c5a4728368430686311c448d4b3ba61bfc8d1e10a15de438a
- MD5 a0fb7b30a27e79d42006e85df6dfd2a7
- SHA1 49069c889e7802f8a8d38053e60cded1f3bdd78c
- SHA512 1e822eb8fdb1023e41a6b6e2c1074a5d1291b4f508c061c42e841a4ceb6716e10c895571e31040e8e5889ff82ef8c1f1d4bb4944a307d9b6b4c16e7a75b950fd
- TLSH T1AD1183921240E65FC16A263209C9CCF5DF85D0140AE253C71DC7DE008A9219699631AB
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_www_google_com.bin
- SHA256 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
- MD5 41e47557f16690df1781f67c8712714e
- SHA1 2f3ca8e75528e0e7797e8f5edfdc582535531913
- SHA512 e8b644d7996168e51d8b991b1d263b9d98f7178bdd9a060078cf4f5ef368fa6e864492b3365227aa68d4d079d734f17d8a5755bbab7424f1bb66e82c0b72f1dc
- TLSH T1D601F4AB1D42D11AD9020E1629D7854A51CADA0561138F772705AF11E8C3D97CD10BC9
- MD5 SHA1 SHA512 TLSH
bin/tls_clienthello_www_sferum_ru.bin
- SHA256 e6dd8d724eecc6a7340bf64e2ebec81c60bc4e078c6f702b4b6ba9bf184180ad
- MD5 2e7d5581af22c22b0828e1048acb6dd4
- SHA1 49179dc0c4e65937af15de143b3baf7e8802bf2a
- SHA512 35cea376e854b246f80b9348cc93c525641ae203cc4cf73911d92e31e9617a922051551bfffca1d5f057bd54afc4037357a471a81969a48e1c6f04643ebab7a2
- TLSH T1780123860047745BD9875F2B0CD5D5844689F04AB6078327B0E3F5A8EF51AD55990B2E
- MD5 SHA1 SHA512 TLSH
bin/winws.exe
- IMPHASH a4b140fe839e54b299bb799d5e755765
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
cygwin1
__cxa_atexit
__errno
__getreent
__locale_ctype_ptr
__main
__stack_chk_fail
__stack_chk_guard
_dll_crt0
_impure_ptr
atoi
calloc
chdir
close
cygwin_detach_dll
cygwin_internal
dirname
dll_dllcrt0
dup
exit
fclose
fgets
fopen
fork
fprintf
fputc
fputs
fread
free
fseek
fwrite
get_current_dir_name
getopt_long_only
getpid
getsockopt
inet_ntop
inet_pton
localtime_r
malloc
memcmp
memcpy
memmem
memmove
open
openlog
optarg
posix_memalign
printf
putchar
puts
qsort
random
realloc
setenv
setsid
setsockopt
setvbuf
signal
snprintf
srandom
sscanf
stat
strcasecmp
strchr
strcmp
strdup
strerror
strlen
strncasecmp
strncat
strncmp
strncpy
syslog
time
tolower
toupper
usleep
vfprintf
vsnprintf
wordexp
wordfree
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
kernel32
CancelIoEx
CloseHandle
CreateEventW
CreateMutexA
FormatMessageA
GetLastError
GetModuleHandleA
GetOverlappedResult
GetTickCount
LocalFree
ReleaseMutex
SetLastError
WaitForSingleObject
WideCharToMultiByte
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysFreeString
wlanapi
WlanCloseHandle
WlanEnumInterfaces
WlanFreeMemory
WlanOpenHandle
WlanQueryInterface
windivert
WinDivertClose
WinDivertOpen
WinDivertRecvEx
WinDivertSend
Name
.text
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
53B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
general (ALT).bat
- SHA256 233512a3275cd934f27b20dc33cb058794f4fcc2c5ef58694651c84b07d3b538
- MD5 b79f1b1cd3b1a808cd13625a0981f9a1
- SHA1 3568abeb405cdaf19fbd249fcb7ad84c0eee2949
- SHA512 d64bbc8356dbf86da46f8395c8efad537f6ac369c88023ae031bb50b88ac202d04627d520b189289e3e1f0dab83f43813f1ca53df75a2e9da6f33d0e723800ad
- TLSH T1F6816BA7E00CDE47F5CD653EF89BA5A420279C8329D6D452839B89F8CC0EDBD684E480
- MD5 SHA1 SHA512 TLSH
general (ALT10).bat
- SHA256 00c31ee7bc3f41a79209cbd0e9e60a04033b8b6844e1e6b8157faf2a1da0cb5f
- MD5 d8a7deb841af4e3426f6605f7f2233fc
- SHA1 4bc36911823b59ceea0e26e5160cdeceef305ae4
- SHA512 d4e186f6c117941413075cc5213d2134cc3decaf78a8713120e4f7c53b913c950170b76dbe934e872b070714328bc4b9fb30e470d5b689493b581c31d08017af
- TLSH T187713CA7E00CDE47F58C697DF89EA5B42127DCC328D6D456439B85E8CC0ECBE584E484
- MD5 SHA1 SHA512 TLSH
general (ALT11).bat
- SHA256 6003f63ed86e6b5d4b6a3f3a6d38d710af6a7d515325dfc7ad0ce77e85961b0d
- MD5 978113622a56c4d95dfe50bdfa379752
- SHA1 9498f346425a0c949d13f911bc9aa745f8169b9b
- SHA512 caea9f590670a3a91c11207831ffbb19b4283945be57ac6d31abc357d4a18e706aaf6162a9b7ac995fe8cfb126d38db33d8fad6aa661bc1fb2a74862721c4e76
- SSDEEP 96:nL67mQGB/GRRQ1zbIKdUGB/GRAVv/GRRQuv/GRA5P+R0ri5+RRLx/:AmQGB/GRRGEVGB/GRkv/GRRDv/GRUP+6
- TLSH T1489137A3E00CEE4AF68E747EF49EA6A5211788C328D6D452439B85E8CD0EDB9194E085
- MD5 SHA1 SHA512 SSDEEP TLSH
general (ALT12).bat
- SHA256 e6f24c3048bca3ad4dbf408afe23c2e1a2ef3dc6ff20ecc4c37df64022101ead
- MD5 26f70aac1eacf9b7b296f4266f0056cf
- SHA1 69ff0e166f1dc5a7a11333732e52ac8e4663dbcf
- SHA512 d597c76e6c6b7a48fd83ef1081445b2430a6d2b382230bc4a5eb2e2e468f0c8da181a3916727ea4c18fc1be13baa59fbb67d19a983902238424bdaa45a98b604
- SSDEEP 96:nL67mQGB/GRRQ1zoLIiUGB/GRKVv/GRRQuv/GRK5P+REji5+RRLx/:AmQGB/GRRGl1GB/GRav/GRRDv/GReP+g
- TLSH T1689149A3E00CEE4AF68D747EF89EE6A4301788C328D6D453439B85E8CC0EDBD594E485
- MD5 SHA1 SHA512 SSDEEP TLSH
general (ALT13).bat
- SHA256 0ef7279f222ced580f002c4073cc431307a368d6a70016489fc09e7a1741b0f8
- MD5 f32605507f97f3762b7c13c3a5804858
- SHA1 2e1b313d8d6ad50d385c7be5fbd30ed3fb297e8e
- SHA512 d906ac907d089868b4b9e97a6f3c4ba09bfaa55a6a213d5a09e9866d763bd25c5fef6c403c71cb1103abad17d60a136705b098f7ced1f6f688aec68cd959d8fb
- TLSH T1B7818E63E00CDE47F5CD697EF85FEAA16027888728D6D452539B49E8CC0EDBE684F481
- MD5 SHA1 SHA512 TLSH
general (ALT2).bat
- SHA256 f928a447fd312866c02e3a06519537c892424c9133a6ec91ee741664ff17595e
- MD5 19740924254d81f4811a6704e7fa3246
- SHA1 33515547dea40f040a95ed90d161dda34a02f695
- SHA512 12222b2c13d15b57a88701beab9e56b56702b4c9942927280ccd1d0e0070802ce8fb772f398a29c920570e0b5bacd4d316875788fbfee1a9382ba6954ec51479
- TLSH T19A610757E00DDE4AB68E783FF89EE5E42017C8C31CD6D452539789E8C84EDFA494E485
- MD5 SHA1 SHA512 TLSH
general (ALT3).bat
- SHA256 0229d59773af1717d54906873245e3598c00457514178b0e96500780277cea53
- MD5 fe823b5d391c8224109cce9de3d67c68
- SHA1 6d4be9d0743db7c68c8904c6bbe50bb0ccd1b20e
- SHA512 68883c68fead4f691ee88dcbf0be0a68536115488e76e1c023eb05e56c4239b79611f179143e1a2d2a1792bc5dc5d8cdbaccc1d7fac83c0a39a7c8c9ea7f08b9
- TLSH T1D1716B93E00CDE46F5CD687EF88EA5B56427888728D6C85152DA89E8CC4EDFA6C4F085
- MD5 SHA1 SHA512 TLSH
general (ALT4).bat
- SHA256 497c19483a59f3d55a740ce5d45abb1d7429e2f6dc52e39d5e18b6941b8290cf
- MD5 2aa483930425e94fc077b65c24b9da65
- SHA1 54d9994859a370a0f5c210fefb09012b5295d65a
- SHA512 6eb124b654c9756b2b9b3bb4ed7c9c0a7e40d88300fecb66db1b22e199f6f68e19d832e7f024eaad9a20a99ca8e9893f34a4f1db7f7263843937242408a818e1
- TLSH T1CA813993E00CDE46F6CDA53EF8ABA6A421179CC318D6D452439B89F8CC0EDBD584E594
- MD5 SHA1 SHA512 TLSH
general (ALT5).bat
- SHA256 a81c276ecae34c3c39c5d862bbf1ef841ff04864bd854485178adf5a8121f9f8
- MD5 2ca56a417d5ef64ae7e8c0b58fedeeba
- SHA1 6413271c89dc8674e29602977a1acd0d9237871d
- SHA512 5addc0f3d27a840db184f01b3152c663e52af6ae73082b30481bd087a26b63a31c492eaa9682b0d0de5e4bf9a7827c8055db290b20c2bcbbed12604f8fdaed1b
- TLSH T1E0411387E00DDE46B48DA83EFC5AA5F5701B98C32CE5D466539788E8C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
general (ALT6).bat
- SHA256 ed7a09a6686191fa8a2bf733b5b4d26fefa45c92b62266e1f94bb56aeffcd079
- MD5 c3ff7ea1add327011ee6730b4053966d
- SHA1 4e2eae34810683c4484cfadde15e5a1453e23fe6
- SHA512 76ded952ffe8406af1588c2163cc66851a8605fdb9e165f94d81a3e8e8d48287d434bb7c6a145561820ec4dbf83b3cf13a06d05cb17bca6474a8936d026e2b7a
- TLSH T135611657E00DDE4AB6CEB83FF85EA5E52007C8C31CD6D452539B89E8C84FDBA494E485
- MD5 SHA1 SHA512 TLSH
general (ALT7).bat
- SHA256 57cb714ea0e385ab3cea37543fd9ac7d591142571192217b39a6ce7c04f85f15
- MD5 96e72a33cf63c887ef194cedd6ee22db
- SHA1 0e5a8595f435fc4d01be203da895f5117fe585ba
- SHA512 83c853db87e8e37ba5dbb02ce35d88833d5a11dcb6c8bc3e4ab21506878385d38de720fd5ac022ab85eb1e2f473daf14aef4fee5fcd11f83f66fd79c923b0f86
- TLSH T13751F797E00DDE46B68EA83EFC9AA5F52017C8C31CD6D462539789E8C84EDEE4C4E485
- MD5 SHA1 SHA512 TLSH
general (ALT8).bat
- SHA256 4fa90488f6df6f6311fa75a811e1753567c454ebde0ee1484550fb2beed44204
- MD5 4247f8f723bb7a35cd06b121266cab40
- SHA1 3789574ed50ed541e7079fd8a6468f5e234b2226
- SHA512 4b53fe82742de1a2f0a26344a0824617da1757371704fc4ea7d607f763fdf2a810d695b89cd77c9225d73f85017972c27c929d0a59d08bdb87c51f3f5bd5f54d
- TLSH T18E714A93E00CDE46F58C683EF89BA5B43127DC832CD5D452539B88F8D84EDBE584E484
- MD5 SHA1 SHA512 TLSH
general (ALT9).bat
- SHA256 56430f0594058f6a1585509a0b52a532348d9e9913c723a4952fa8009c079d43
- MD5 887f170da8b6c662cabb459d142cc7a4
- SHA1 c32a4eea7583550812d67cbdd3926c087abb6153
- SHA512 0595cb2cfac83211e26d32e2cde40741df4ec7d744843c8f5dad6abd06409d60ad33227b914205a5d336415d39027c31dc1f57837b76e026b14bf87fe1168d7f
- TLSH T177616993E00DDF4AB58D6C3EF89BA5B52417C8872CE6C851638689F8C84EDAE5C4F485
- MD5 SHA1 SHA512 TLSH
general (EXP).bat
- SHA256 e5b8eb98c6a3258969bda9274894f85551d37eec0352df806b0a1fb41b74f17b
- MD5 cd14bd6c333fa01fbb0212804418659a
- SHA1 8719d5aa4d07fdfc352b2acecef353e1f68e32e7
- SHA512 d49b990b06ef20eab5e2312bf694074bd4fe0c7e2c4d195d4c276f003b5fc4f3e0b59662fab868d0c87a0087d3408ff3e03fb286c9b70bb2952dd70367fda1f4
- SSDEEP 96:nL67m3GB/GRRQ1pT/8EIiUGB/GRrVv/GRRQuv/tRr5P+R75+RR17i/:Am3GB/GRRIa1GB/GRRv/GRRDv/tRlP+X
- TLSH T10A915CA3E00CDE4AF6CE747EF49EB6A57017C8C328D6D453429B85E8CC4EDB9584E485
- MD5 SHA1 SHA512 SSDEEP TLSH
general (FAKE TLS AUTO ALT).bat
- SHA256 aa026f4030c17f1bf515389c903dc922992dfe29f6affff8494fa1548d1480a7
- MD5 b388460a8812f7b05030566dd01bc7a9
- SHA1 42693c591ab1238f81957de9834f72359adf4e78
- SHA512 61caa6c0cca7987bd475b44fd99c6bfc1b31fb08da93944d65b2599b27cc30c12dc2aa66f6d04e85c1f8ca212d8ba02eb897bdb3c3b436652baef3fc4233d2ef
- TLSH T1B1715A97E00DDE47F68D643EF89FA2A46127C88329D6C851829A84F8DC4EDBE5C4E584
- MD5 SHA1 SHA512 TLSH
general (FAKE TLS AUTO ALT2).bat
- SHA256 0efa20276b94eb675730dc5920c42d8606e93adcaba186fc0306f978c49e8dd7
- MD5 f665ba2ce31ae3ffe8d86ad0b9fa1887
- SHA1 625533dfbb62537dd6d8b01cddbee0369dc68e0c
- SHA512 347c69a18c4431f18164881afbb941c9977289c91e10203046db992df04f5a4dee5e94c49846f015f8f404d36d89824539a5b549e015fb964d20841eba443310
- SSDEEP 96:nL67mQGB/GRRQ1zxDUGB/GRbVv/GRRQuv/GRb5P+Rii5+RRLx1:AmQGB/GRRGxYGB/GRBv/GRRDv/GR1P+w
- TLSH T111915893E00DDE4BF7CEB43EF89EB2A5311798C32CD6D452839A45E8C84EDB9584E590
- MD5 SHA1 SHA512 SSDEEP TLSH
general (FAKE TLS AUTO ALT3).bat
- SHA256 604015c6716f8e52f2b95aa3b1d8690661e4dc7963b3efbbf4ab19fe5f45b4ff
- MD5 44d636e6af8576e613619df91307cb96
- SHA1 7763cd60ea3f7d75e298b48e8ed13de56f972504
- SHA512 32bd8cfa8c4223679590ced74364b856a8fff3f6db2bd1f816153b2a187e0a902df4d463d225389724ecea73587d50c9c060752d9b67314028d1d5b227fb7e29
- SSDEEP 96:nL67mQGB/GRRQ1zd1UGB/GRVVv/GRRQuv/GRV5P+R3i5+RRLxI:AmQGB/GRRGdmGB/GRvv/GRRDv/GRfP++
- TLSH T135815997E00DDE4BB6CE743EF89EB6A5711788C32CD6D452839B85E8CC4EDB95C4A080
- MD5 SHA1 SHA512 SSDEEP TLSH
general (FAKE TLS AUTO).bat
- SHA256 b181d1db261ba06d5b54baff123d491c6900174bbc22a2a237f9135160b7a948
- MD5 8df9e1cf403f4da858ac96d4a4082e51
- SHA1 4254565984a4e82a4e43c73e91efeee819dd8d97
- SHA512 d1800d23e42a5fc2cb8f924268fbbc17087920e6396b44c50dc2a55692bb47e04293d9a2dacf7a7d4b1b9c83963b162d9e435acfc4ea5a5c775732f657a323f1
- TLSH T1BD815B83E00DDE47F6CDB43EF89FB6A861279C8328D5C852829A45E8DC4D9BE584F484
- MD5 SHA1 SHA512 TLSH
general (SIMPLE FAKE ALT).bat
- SHA256 8bffa109e32aabb0360b2dc6be055687a884945fd62fcbe8fa73bdb4f3910df5
- MD5 038c46b162f4de670e9d9e36598250a2
- SHA1 d8336c9cf8ad2c66c8d58b8031d7b8b21e62219d
- SHA512 c47ccd6396ebb8f10c1092903bfb29eeba814363a18387dcc7afcdeda73d9eab9f3e72239c6a90dd501e1eed866d93a9e9d92c6ac1c6eb188fe2fb983c6181de
- TLSH T101812AA3F00CDE46F6CCA87EF89BA6A4212798C319D6D452439B85F8CC0EDBD584E594
- MD5 SHA1 SHA512 TLSH
general (SIMPLE FAKE ALT2).bat
- SHA256 16d3f5350f24ce87cd3ec43e0639b76cbd71a53766672939df09cb9d50449fb1
- MD5 6d75f83937039e1f2f74976955a8b4f5
- SHA1 f6cffcdffc848538d1237d82dac517b35e1f64f7
- SHA512 f02342901dcb90038232266091e8f389ba48ea68f5df66c1e8e12c13295d22320642d55515146eb4b543cf9e797ff08b82e40c3e7de2a7f334768e6a02f53052
- TLSH T1D2711B63F00CDE46F5CC697EF89AA5B461279CC328D6D452439B89F8CC0EDBE584E484
- MD5 SHA1 SHA512 TLSH
general (SIMPLE FAKE).bat
- SHA256 f6371c618951df2989db86e717beb4a8440ad9a405a592a85d2c7bffaeac0bb3
- MD5 4d8b4ba1e91b306d4850ddc6f95d8c24
- SHA1 dd7b4b57272ccc7e464666113d4d94ffcd7d5936
- SHA512 75056901baefc83ea8e03d35971f4ac5074973634aeba72f93b7bc6a03bf0f736d705664cb2db3c27de76f7981e2c93021c9e451ecd7b264e806fcd7beb70611
- TLSH T1C4713B93F00CDE46F5CDA87EF89AA5B4212798C328D6D452439B89F8CC0EDBE584E484
- MD5 SHA1 SHA512 TLSH
general.bat
- SHA256 2c0723be1d3539a70392607b9cf2ef590efcceec8e6139b1a0d2984ea1da1947
- MD5 2f2bf37b93201a61bea5f9e1c9bdc42e
- SHA1 b6c54ea83673fdb9e5100437d76ba9e5f408b5b8
- SHA512 9eac5f0de5c5ff6ea7d418140d816d2084f1777264183bde470b167febe707c4f083ed4c941272a33b60414bbaef78182495275b7f4ab7f5dabb9c46b60cb984
- TLSH T15A6149A7E00DDE4AB68E787FF84EA5F13007C8C31CD6D462529789E8C94EDBA4D4E485
- MD5 SHA1 SHA512 TLSH
lists/ipset-all.txt
- SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
- MD5 42ad35639873f78e1b2dc5c1039499df
- SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
- SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
- MD5 SHA1 SHA512
lists/ipset-all.txt.backup
- SHA256 c39bf4e1b151c7d0d42fe7dae4c09e01ac26806a1ff4060ae456c7fb22087651
- MD5 875bcea7044f38c1938151dac9c96778
- SHA1 3399cc0394629c0c671b33705ea07cb982e0367e
- SHA512 8df41b5da47c9701a6d5b02edbada303f9a1fd31170f94c52f4af284595767b3bc21b2990a1a2251608e754f444999c1aea533d71547f362e9d64ce52c6eed76
- SSDEEP 3072:JdbJnv36N2ClwjoPrK1LHYky4deCp0I1m4BjIKxCteumYEYsppucy7Z5YgARGTJb:YbYvWsWmuDgK
- TLSH T15BC4593213B41BE78ACEA1EA3323957425E7968615F6F273CB9F62623C11040FD2795E
- MD5 SHA1 SHA512 SSDEEP TLSH
lists/ipset-exclude.txt
- SHA256 96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
- MD5 240532f20e114cd6de2906ebc86d683e
- SHA1 f7d4b6e1ec084e64c367ac11f5fe21fff454fb68
- SHA512 809e9961b2952acff12fb27b31895f9e7c0d70433363cdd8fd61bd522ffa835e7d403de3419092145673e10644aa0803d0e244d9cfff8d8bf784e783713f799a
- TLSH T147C09271516912FB0F876B21A13E0326F9475BCB26F37D64A36C5286EC504096029920
- MD5 SHA1 SHA512 TLSH
lists/list-exclude.txt
- SHA256 e2de8403e1d2bd8ebd9de6b2cbfaab488d710681cbdcde2b219e71bc4490a56d
- MD5 27a91db4f8304ccff19fb6bd090770ba
- SHA1 2010a14a9b2098b900a51786a8f94745622a9621
- SHA512 4edb5e58968851fdd462b09cad721affbb5c90d8cf4b79a74610a812caae942f710089e6999c795d039e76c126561e502c2a6257af971a88926b13ee0c8d734e
- TLSH T19031A0A0D4142491A799F59BD0A67E44B839323A85C0FCC663E8DD8C27C2291AFCFB75
- MD5 SHA1 SHA512 TLSH
lists/list-general.txt
- SHA256 9ff3ae9e4bf0edbcf8fecb1bba7aac951aace2036cdb732ec3ef65dfc6db443b
- MD5 316adb4bdd3c1e3418dc1627c1129794
- SHA1 0b765481aa45b883dcb5181787b9756f9b812819
- SHA512 d63361b654aebe85bf59f3c8c2d22b77e952e846a0d6b185a5dc7361567ae2dc8bee18a04d02a680b430f58e8521d6fe1919fd99d91c76c3f14d4b93a22cee1d
- TLSH T13E113356A1A997102B1DD0E4245422A02380B4B418CFE6E39B6FC19F490D3FEB3C0AA7
- MD5 SHA1 SHA512 TLSH
lists/list-google.txt
- SHA256 4104b8f5119f76a3642e3176987bbcf817d98daa4899a7ecf9ee2c254958e33b
- MD5 2d099c8547925f13d6ab23dc2ccd8f19
- SHA1 ba822130389f13343a6f0a711962fafccb809173
- SHA512 e8b82795d202e52e93c63894404ac3b8afdca677e0ff1836314655e22cb81f16b991ffc3aff80cacbe81c81dfa2bfac8f837a3cd5ec658b3dd9e1674b96468a4
- TLSH T116F0ED87780EC09F5202E9C818F06549B62CF23586D9E6F4DD61D07E60ADB4635C18E2
- MD5 SHA1 SHA512 TLSH
utils/check_updates.enabled
- SHA256 c823a2779ca11474ada5ece9c37cc825f71c54fbc1525d9b0cf3dbc7879abb09
- MD5 c45d8fbde4e335ed2d438d81bf5e6b5d
- SHA1 c78adef3e4f3601b3bfcab9d16467709e4242f13
- SHA512 6a3f31efd1d6c20ca61c515cda8e13d684a87cafb2b8ed940b24fe5d195c14c9b159af906d6dbad7e2befdfa75c311a96f792e342aadb2e0be15c7fe148d83f0
- MD5 SHA1 SHA512
utils/targets.txt
- SHA256 c27af6e8ba0a91e772b5b4a8da5f4cde6903b6eb6ab3a5a02b13afe7695d0f31
- MD5 ff5a30059e04a28ae4ae8bb17727e8fc
- SHA1 ea08d02ae8ab3f3433c7d541dc4ac1da18a8a814
- SHA512 505ae68c8d6b8759b22b90d645a0abcad2620a9ba42622f5836b0734f3a8d10ec43c341a9a68cd8fcb3ee170bb45f144959ab0bf5fed353e9d25037a29eebaa0
- TLSH T132216893F152C4B0029A94DCE400A2ACFB0A511F679A60EBF14F509F3B147F482FB695
- MD5 SHA1 SHA512 TLSH
utils/test zapret.ps1
- SHA256 13ce2b57b35b9a0223b0ea2782752bd2e20f550e2b7f0e9de8ae8d3999bfd402
- MD5 9ccdd2334a390cdb5b153a872740f901
- SHA1 748038a97478b9a689af0f4c2b573bb988bac75a
- SHA512 6a0ea6c8785a3018fc564777d4afd6ff67d43bbe5df203d3d85b1cbb3dab311cf250a4bf3fe7edb73928c0449d24a266743bebd1be7563011d1bb6c4fdbd66cb
- SSDEEP 384:ZmnJMakddb1YJz1jbdZTP/9lnXVqkNC5tJuyci8EULNWByBwdH2I1H1UVnVkGySm:Zkk3O91g5tJtciOsByBwdZ1H1KCxt
- TLSH T12013B62AB90A106B467357BFDC81A104FF57017B800D16D4BD9CA0D87FF492DC679EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
zapret-telegram.bat
- SHA256 6df5b30195dfe0b845218b25746aeff428c706adedcc303a0a8af2558156d5c8
- MD5 0536f346126466c4812637cc037b2c7f
- SHA1 48f223ab2ff8e0cf94329172ef4e9081951a148e
- SHA512 310a536b5c577196b95da05bc08a0bf39d4ad0f29d15ed8b2e707191681be6f6f2fe054076056aa315403df4b3738a02b0fcdeb87fa5ecfe8d6c0d477e23d38d
- SSDEEP 24576:zig1NpWF4vfcK6xbN0ye5W718vUtUJEglPloTr2chFRt5I7lxDUgXGOjDKzdyGFr:8
- TLSH T147E64BF86627EE41E23B871996DCBE894B3933578AC21E90A33CF5911DD7301BE5C489
- MD5 SHA1 SHA512 SSDEEP TLSH
zapret-telegram.exe
- SHA256 8ae4130ad94c43368f5c12017fa606abe98d2231b7ef6ec37563b061895f6703
- MD5 608ac71eb6c145880a91731acbb0279d
- SHA1 e427484696d340c2d9a3a5802d51a155e0748aea
- SHA512 16a757d8798297448fb98c20745c292b54736e4048541193622e79078c6d981d83a7868b2aff3a3f6dcce60a26079644bb6f7f509a69647d4e32551a5387b5e7
- SSDEEP 98304:kr6UauwOJKSCJ9+7/JKYq8VIKPxkRwYFoPZEJVt:Sa1qKS60VEo4wiCaV
- TLSH T15676E121BE43B771D40395355A26903BE762E9482F35C6A3F9CC7269F3732B84A356C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
398752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
648KB
Virtual Size
647KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
640KB
Virtual Size
639KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5.8MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE