Emulator.zip
- SHA256 15cc2777babd2dca542af7d2e5b813f07b7efd413c66bced8e192a10746f8eac
Static task
static1
1 signatures
General
- Target Emulator.zip
- Size 76.4MB
- Sample261102-rexd2swy7m
- SHA256 15cc2777babd2dca542af7d2e5b813f07b7efd413c66bced8e192a10746f8eac
- MD5 cf827f92d5b5e05a09f0b6dd73b91bbe
- SHA1 e6042d8aeca887c85852712c26ac9dbd37f38903
- SHA512 f4b58020821abd1d8baf1d1b41b409df2e91080013f1441bc557410986137952a766cca5b493ea76f32f2b7d54099abefd94b9deba044458a7df0a26916e3881
- SSDEEP 1572864:E7SDFjt9VoSrEWCYQlvuAwF3E7SDFjt9VoSrEWCYQlvuAeXMIDGXjIDhOayrnIDA:rDFjtUl7wtrDFjtUl7GMMOjMnsnMs9V
- TLSH T1150833C8B5D51A93FD6A8A32BB074454FF61DA04CABB24D93A97F5045A422333EE70DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14.dat.enc unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14.dll unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14_hookloader.dll unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_driver.sys unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_helper.dll unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_pid16_emulator.dll unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_embedded_34404_at0x395060.bin unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_embedded_34404_at0x801cd0.bin unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_pid16.dll unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13_cheat.dll unpack001/Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/unknown_pid16.dat.enc unpack001/Emulator/wtf (2)/x64/Release/VMProtectSDK64.dll unpack001/Emulator/wtf (2)/x64/Release/wtf.exe unpack001/Emulator/x64/Release/VMProtectSDK64.dll
File Explorer
-
Emulator.zip.zip 76.4MB
-
Emulator/VMProtectSDK.h3KB
-
Emulator/VMProtectSDK64.lib7KB
-
Emulator/anti_debug.h18KB
-
Emulator/gen.py1KB
-
Emulator/main.cpp112KB
-
Emulator/output.txt81.4MB
-
Emulator/vanguard_gateway.h.js 36KB
-
Emulator/wtf (2)/VMProtectSDK.h3KB
-
Emulator/wtf (2)/VMProtectSDK64.lib7KB
-
Emulator/wtf (2)/anti_debug.h18KB
-
Emulator/wtf (2)/gen.py1KB
-
Emulator/wtf (2)/keysystem/admin.php13KB
-
Emulator/wtf (2)/keysystem/api.php5KB
-
Emulator/wtf (2)/keysystem/gateway_proxy.php1KB
-
Emulator/wtf (2)/keysystem/setup.sh.sh .vbs 13KB
-
Emulator/wtf (2)/main.cpp107KB
-
Emulator/wtf (2)/main.obj4.2MB
-
Emulator/wtf (2)/output.txt81.4MB
-
Emulator/wtf (2)/smd vps by xt aizi/TODO_MANQUANT_POUR_REPRODUCTION.txt11KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/CREDENTIALS.txt11KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/README_FICHIERS_RECUPERES.md13KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_config.php.js 34KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_dashboard.php10KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_discord.php879B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_discord_callback.php5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_discord_link.php4KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_download.php4KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_footer.php227B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_header.php1KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_hwid_reset.php.js 3KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_login.php4KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_logout.php460B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_redeem.php1KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_register.php.js 4KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_signout_clients.php1KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_skeleton.js.js 9KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_style.css10KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_index.php.js 47KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_lib.php.js 49KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_online_source.php.js 3KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_payload_lib.php5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_changelog.php.html .js 5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_hwid.php.html .js 5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_license.php.html .js 5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_link.php.html .js 5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_link_finish.php.html .js 5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_redeem.php.html .js 5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_version.php.html .js 5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14.dat.enc.dll 403KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14.dll.dll 403KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14_hookloader.dll.dll 403KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_driver.sys.sys 4.4MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_helper.dll.dll 32KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_pid16_emulator.dll.dll 8.1MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_embedded_34404_at0x395060.bin.sys 4.4MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_embedded_34404_at0x801cd0.bin.dll 32KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_pid16.dll.dll 8.1MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_key_0.pem53B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_key_1.pem3KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_key_2.pem451B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.dll 1.9MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.id018.3MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.id17.2MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.id26KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.nam64KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.til31KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13_cheat.dll.dll 1.9MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/unknown_pid16.dat.enc.dll 8.1MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dodicom_loader.bin.html .js 2KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dodicom_loader.exe.html .js 2KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/eonauth_openapi.json55KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/index.html.html 4KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_app.js.js 5KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_balance.php.js 7KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_balance_checkout.php3KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_changelogs.php12KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_config.php.js 12KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_credits.php.js 6KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_generate.php.js 19KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_index.php.js 22KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_launcher_version.php.js 13KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_license_detail.php14KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_licenses.php.js 38KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_login.html.html 1KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_login.php4KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_logout.php78B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_navbar.php1KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_products.php.js 11KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_resellers.php.js 20KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_style11.css23KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_deps.py143B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_index.html.html .js 43KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_main.py143B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_router.py143B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_schemas.py133B
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_account_link.php.js 4KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_config_source.php.js 2KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_discord_callback.php1KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_discord_config.php9KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_index.html.html .js 9KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_index_executed.html.html .js 9KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_index_source.php.js 24KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/relic_auth_full_disasm.txt879KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/relic_auth_pseudocode.c.js 46KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/relic_gateway_workflow.md24KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/relic_pid13_authflow.md12KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/script.js.js 20KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_config.php9KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_deliver.php.js 21KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_deliver_current.php.js 21KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_delivery.log38KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_delivery_new.log38KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/style.css24KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/getskins.obj537KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/hypermallknife.obj988KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/hypermalltxt.obj354KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/knife.obj1.0MB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/novaudtxt.obj.html 2KB
-
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/offsets.json3KB
-
Emulator/wtf (2)/vanguard_gateway.h.js 36KB
-
Emulator/wtf (2)/wtf.sln1KB
-
Emulator/wtf (2)/wtf.vcxproj.xml 6KB
-
Emulator/wtf (2)/wtf.vcxproj.filters1KB
-
Emulator/wtf (2)/wtf.vcxproj.user225B
-
Emulator/wtf (2)/wtf/x64/Release/main.obj4.9MB
-
Emulator/wtf (2)/wtf/x64/Release/vc143.pdb1.4MB
-
Emulator/wtf (2)/wtf/x64/Release/vc145.pdb1.3MB
-
Emulator/wtf (2)/wtf/x64/Release/wtf.Build.CppClean.log999B
-
Emulator/wtf (2)/wtf/x64/Release/wtf.exe.recipe295B
-
Emulator/wtf (2)/wtf/x64/Release/wtf.iobj4.6MB
-
Emulator/wtf (2)/wtf/x64/Release/wtf.ipdb2.5MB
-
Emulator/wtf (2)/wtf/x64/Release/wtf.log874B
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/CL.command.1.tlog2KB
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/CL.read.1.tlog48KB
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/CL.write.1.tlog328B
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/Cl.items.tlog101B
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/link.command.1.tlog4KB
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/link.read.1.tlog10KB
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/link.secondary.1.tlog230B
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/link.write.1.tlog736B
-
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/wtf.lastbuildstate313B
-
Emulator/wtf (2)/x64/Release/VMProtectSDK64.dll.dll 115KB
-
Emulator/wtf (2)/x64/Release/wtf.exe.exe 254KB
-
Emulator/wtf (2)/x64/Release/wtf.pdb4.0MB
-
Emulator/wtf (2)/xorstr.h2KB
-
Emulator/wtf.sln1KB
-
Emulator/wtf.vcxproj.xml 6KB
-
Emulator/wtf.vcxproj.filters1KB
-
Emulator/wtf.vcxproj.user225B
-
Emulator/wtf/x64/Release/main.obj4.6MB
-
Emulator/wtf/x64/Release/vc143.pdb1.4MB
-
Emulator/wtf/x64/Release/wtf.Build.CppClean.log999B
-
Emulator/wtf/x64/Release/wtf.exe.recipe290B
-
Emulator/wtf/x64/Release/wtf.iobj4.4MB
-
Emulator/wtf/x64/Release/wtf.ipdb2.4MB
-
Emulator/wtf/x64/Release/wtf.log874B
-
Emulator/wtf/x64/Release/wtf.tlog/CL.command.1.tlog1KB
-
Emulator/wtf/x64/Release/wtf.tlog/CL.read.1.tlog47KB
-
Emulator/wtf/x64/Release/wtf.tlog/CL.write.1.tlog298B
-
Emulator/wtf/x64/Release/wtf.tlog/Cl.items.tlog91B
-
Emulator/wtf/x64/Release/wtf.tlog/link.command.1.tlog2KB
-
Emulator/wtf/x64/Release/wtf.tlog/link.read.1.tlog4KB
-
Emulator/wtf/x64/Release/wtf.tlog/link.secondary.1.tlog210B
-
Emulator/wtf/x64/Release/wtf.tlog/link.write.1.tlog402B
-
Emulator/wtf/x64/Release/wtf.tlog/wtf.lastbuildstate159B
-
Emulator/x64/Release/VMProtectSDK64.dll.dll 115KB
-
Emulator/x64/Release/wtf.pdb3.2MB
-
Emulator/xorstr.h2KB
Emulator/VMProtectSDK.h
- SHA256 2300b7b4bb6bbf9cfa08013ec2d9b2fdceb3dfd2e603cd1e24a493de4d165b15
- MD5 e8c78f60aaad4671110eba8991fe94ef
- SHA1 dce765aa7929102ad95dfac47325c67bc668c409
- SHA512 0b4d8366a75222834d6bf0ef1f403a15a6092312005683676f77c57fed370f109516354969c458a5c6d5dd32c3d0ad7d46ea7c70650e5f0b1eb3903231eed4be
- TLSH T1C571AB010D0120AEE292D7A52B77DD52359CF12335F6E8EF220A64151AC354E6BEEA9F
- MD5 SHA1 SHA512 TLSH
Emulator/VMProtectSDK64.lib
- SHA256 9997a9c6e179010450385832a66ea36938e180fc9067d91fd6aae7c9f6bf4d18
- MD5 6e597e4be8eb765dcfd4b058c463bb7b
- SHA1 4eda19892928cf64c4e3e9a9e9e4c533ec70230f
- SHA512 3895946dedbf25f5ab279370d3315ed93b5d09ec35789a2721f6b7b0717faf06d0d02659e682d592113f77dd8fe70f4739952588b50c4124535968550aebcb99
- SSDEEP 48:lZ5/k5RLRzRCRXB6cI15gXy/F/CRcRj15T1tRLRyIBrzX43KXyAOUMKnFS5vKas5:ljkqB61xr83KIKFGKaWdlmkArg
- TLSH T128E1763959E17D2FC6EAC1FA7B21DCA97E6D404101F7E46B308D4BA2432A65FA347207
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/anti_debug.h
- SHA256 76cfafba81fdd3571cc1e0d0c93e3720b5f66e71a741d75f13c72fb16904124e
- MD5 808f4b627b5a25a40948d92d8830b20f
- SHA1 7f782642ffb20d37c6c82803e4f06bc29358e390
- SHA512 619bb3f7fea530d516d78c845c0fc70ae5b81dcfc2d8b537408e35da9b478b4ee70e3960267974f581a9464dda734c37948568f7907eccf1801450c718ab7028
- SSDEEP 384:08m+dQmrd7AbVDdUgw8M9k2i75bXzZsYMSipIlg2CbZ73Te8+xN:1m+GVH
- TLSH T1DB82A6C681DB6026127B117DABE7890B7AED4007027BCA71BC8E8350BF897748671B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/gen.py
- SHA256 d481d6cbabb9ae7e09c763f80b142bcc0c47a9b9ed61e2a15bdac0bf0110a93c
- MD5 79a110113f7ff040f2f584789ae33355
- SHA1 83971912519ec16199f0fd9b25d6ed887e62e13a
- SHA512 4380782fa629b23f397fac38098bca8ea0f1703bbdd41c5b1d45c45599c85556320445ca29719c3d1718a1c97532cb4a653c07adf7cc293c32609817e32b504b
- TLSH T1B2316529709B56A4CEF55DBA7C6498D2631C730D5BD13A416F1B1AF14A01C75C23A83E
- MD5 SHA1 SHA512 TLSH
Emulator/main.cpp
- SHA256 2d2f3a7645521a852fc738f795629d209149d6d70dfb236e5c1cdb381b46b24f
- MD5 8dbfe410db69db37dbad5d42c942c5f2
- SHA1 fbd906bee4d971142f0f08ca2c3c1cd860df2772
- SHA512 a02a0ec1bad567ed8d1caf6183b4aad7294cbfc6e956e16324e670994004ec23586d85fc58eb6cb02e9102f5ff4dbdd9c21dc05f6574ff4c2fe7d3e3d56683d7
- SSDEEP 3072:EtPqgpRPNRHWsPsgrLltcyHcs0ZMj6MNy9ZZfNHZgl7d0VW/T0gdCw4JN:s7jVRHWsPsgrLltcyHcs0ZMj6MNy9nf7
- TLSH T1A2B3F94424A1BD211A73AB6ECFB35006F7261133F3A543E0FEDE45842FB5564A2B4E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/output.txt
- SHA256 49b6eb955c57603fe5b3f0431e2e62471babe230716e2b8e8134cccf9301286b
- MD5 a63eb929e2cb1dfa2700b6efb1ab19f5
- SHA1 6c43b6b5f1452fff4adc72c8eb14acaf1c1a9976
- SHA512 6cd8daacd1c259fa4676a84c01679ee92338e2549f69e5f97342178334a4d30e989d06ffb25f41b1d16ea2c39dd1771424cc142a09da63bdd470a7c83d64bdec
- SSDEEP 98304:LEt8d1XE2/3NBMD1RMPrEnGJ7pKyeP/XXBs+78wwibQXciYeLrkmmAbM67AKfADS:z
- TLSH T1C31882708BBCE5BEDB088453BB07DE783F2A9A07E15F6D7A552837402A6E34B1915703
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/vanguard_gateway.h
- SHA256 8dc0ecbefa4c87153b1fcd083387d14e3282d49ce592d4250f6e25a15d7f4b4c
- MD5 9e0f0204027940fa46d450102bccbc91
- SHA1 22fed33c300a3b15542d3a62f860e81ac1fbe06c
- SHA512 bc7314a5bed42b245c27b68cc20a6627a9da2f7e04ed97feb0ec97fa37b6f1ce3ae220378ccea23ae6ce3047a4537c2eca81dfbc2b14550c745ae3b8c8175e0f
- SSDEEP 768:WfIlCegz+Eff9lFsw9c7YZsEirIR+DkrigP35coSUFzTvZxT+sGKeedKvaCGubY0:WA5gz+Eff9lFsw9c7YZsEirIRukrig/E
- TLSH T1CEF2C640A9A1EDA20AB2E70EDB964601F71421A7F395C792FDAF01581FB3870C7B4D5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/VMProtectSDK.h
- SHA256 2300b7b4bb6bbf9cfa08013ec2d9b2fdceb3dfd2e603cd1e24a493de4d165b15
- MD5 e8c78f60aaad4671110eba8991fe94ef
- SHA1 dce765aa7929102ad95dfac47325c67bc668c409
- SHA512 0b4d8366a75222834d6bf0ef1f403a15a6092312005683676f77c57fed370f109516354969c458a5c6d5dd32c3d0ad7d46ea7c70650e5f0b1eb3903231eed4be
- TLSH T1C571AB010D0120AEE292D7A52B77DD52359CF12335F6E8EF220A64151AC354E6BEEA9F
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/VMProtectSDK64.lib
- SHA256 9997a9c6e179010450385832a66ea36938e180fc9067d91fd6aae7c9f6bf4d18
- MD5 6e597e4be8eb765dcfd4b058c463bb7b
- SHA1 4eda19892928cf64c4e3e9a9e9e4c533ec70230f
- SHA512 3895946dedbf25f5ab279370d3315ed93b5d09ec35789a2721f6b7b0717faf06d0d02659e682d592113f77dd8fe70f4739952588b50c4124535968550aebcb99
- SSDEEP 48:lZ5/k5RLRzRCRXB6cI15gXy/F/CRcRj15T1tRLRyIBrzX43KXyAOUMKnFS5vKas5:ljkqB61xr83KIKFGKaWdlmkArg
- TLSH T128E1763959E17D2FC6EAC1FA7B21DCA97E6D404101F7E46B308D4BA2432A65FA347207
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/anti_debug.h
- SHA256 76cfafba81fdd3571cc1e0d0c93e3720b5f66e71a741d75f13c72fb16904124e
- MD5 808f4b627b5a25a40948d92d8830b20f
- SHA1 7f782642ffb20d37c6c82803e4f06bc29358e390
- SHA512 619bb3f7fea530d516d78c845c0fc70ae5b81dcfc2d8b537408e35da9b478b4ee70e3960267974f581a9464dda734c37948568f7907eccf1801450c718ab7028
- SSDEEP 384:08m+dQmrd7AbVDdUgw8M9k2i75bXzZsYMSipIlg2CbZ73Te8+xN:1m+GVH
- TLSH T1DB82A6C681DB6026127B117DABE7890B7AED4007027BCA71BC8E8350BF897748671B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/gen.py
- SHA256 d481d6cbabb9ae7e09c763f80b142bcc0c47a9b9ed61e2a15bdac0bf0110a93c
- MD5 79a110113f7ff040f2f584789ae33355
- SHA1 83971912519ec16199f0fd9b25d6ed887e62e13a
- SHA512 4380782fa629b23f397fac38098bca8ea0f1703bbdd41c5b1d45c45599c85556320445ca29719c3d1718a1c97532cb4a653c07adf7cc293c32609817e32b504b
- TLSH T1B2316529709B56A4CEF55DBA7C6498D2631C730D5BD13A416F1B1AF14A01C75C23A83E
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/keysystem/admin.php
- SHA256 2580fb9d658855006ebad0abd38549bc2fe63813ea77611c0fb92c5daa28a33a
- MD5 d64b14eec245a2e21ba457ffbe23a6af
- SHA1 91b3960ff22e3924e7d8011f287da176f50a597c
- SHA512 4e96a4904a6647a3c7a4ba19bffaef0b60404827a27f9fc7f1fdf55ac764be8fe6753e73d699cc7ef4d38c9c52eb10461ed34eee8cbfb986c007cac29f9c9a7a
- SSDEEP 192:p9MUmCQteRt5ZGaRR7ShrB2YIN6Q7hRksbW3yXs+vbP1q1uB74RMNr58:7DhnGW7O23JmsbWCXs+vbP1q1uB74or+
- TLSH T1255218B2FCE52D107033C8F156919E5AF9558523A14347947EAC62E9DFC1CA28B3FB48
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/keysystem/api.php
- SHA256 dc3f412832df6a197d4322d1b649abbc3b93953a940fe8fe70c22f883ed2165f
- MD5 1b340b2f5e1da9b2c019d6a07793a698
- SHA1 8edc36a40f39e78e2237320fa9ea67b79c3b1862
- SHA512 bebbad61386d7aaf1c682d4382fbf207621cabc7f28a91a89c0de11cd41a18207114365ae540ea7244da23e885bcb360e42136602ba85447850699ee9cf42462
- SSDEEP 96:0GvbFrGQGXdLDckXmEpBAlK2TSUE74TLPRVCV1SvN0Bb9:rIQSd8kWEpBMK2TSv76LJksOBb9
- TLSH T1C5B143563CE3AE104063D1BB077FC01AF63C4A272785A982FA9E51C01F64A69D67CBF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/keysystem/gateway_proxy.php
- SHA256 5ab466a9b546a6bd14491278eb5557d3cbc390f2efe08b4da6c421f17e2ba90c
- MD5 c65d32922311ed9d81e57b5877d99fb3
- SHA1 897600f6e96b8d5758c5b338f17a7cd2c39a04a6
- SHA512 ef880fbaca6dd1e689d66f11db1e6f73388b98808f8f98faec82c9b784621a1ba688bd30a3479363cb6bfd459732ad9125f327a9a706182187e3a3f0601e1af9
- TLSH T1D241219220D3680B0275A4E7B3AE195E67EDC48F4216C981FD2902728FD461DB7F05DE
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/keysystem/setup.sh
- SHA256 352a98675a27d159451e24d350831081de51874c21a11a6724cf66e52dabca4b
- MD5 45efd14afdab4d41d5b85bf5101cbf47
- SHA1 b09fd599e4c4ddfceb879bfca4d99346d8113c9a
- SHA512 6d6aefa614eb48eee317c240f68c8bb3113ce2dc33c32373881bde9c2538819bad26744a9c54aa63bbed654c86c72761cf9e3228643a871fad4373b7041f7f17
- SSDEEP 192:1hCL7QcvmiowQCvlxJ1LS9JRu62Jeo66cYCgRibe7092N:1hIoamu6qn66cYCgRj7RN
- TLSH T13D523AF6B0C57D3162A3C9F545A1815D345E862B92030AC4FD6A30F9DF50FA5AA38BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/main.cpp
- SHA256 ab3220cbec4acff1f05700e74ba3c50dffdb0b559300d829bb1b544d59747ac5
- MD5 2006df3594a30933b579224d0297ec46
- SHA1 1913267fde82844ae1563f8592bf82adb1521890
- SHA512 3b811839b1a80f81f720080f217dbf3117250fbfbbf31d062deae3022bd02f5acc12b6981aa0b9c223d50ccf22a31c6f52dc455a910d7177452f03df22b38a8b
- SSDEEP 3072:E3PqgpRP0HWsPsgrLltcyHcs0Zbj6MNy9dffNHZguld0VW/T0gdCw4r:C7jMHWsPsgrLltcyHcs0Zbj6MNy9hffK
- TLSH T124B3E74450A1BC251BB79B6ACFB36045F7650123F3D543E0FA9E4A482FB14B4A2B4E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/main.obj
- SHA256 c1d8c3ad28fac714f9e02193a095079dce5ffb4ef538c6ea9f1a1cd3be439029
- MD5 9f259eae5ba055ee00b9f99f5907925d
- SHA1 34b290bdd2ddd5b1b3524855684f229e35134b7e
- SHA512 695b9e30aa0a6cda75f08ec94fb19f0e362050ca24f63f1229676bb388d67a72532eda0fd215487c216ddbc0d2e20fecfe9f5c1b7d51dfc81c86ce3dd83e69fa
- SSDEEP 98304:7Vy9e+YjFhYZD83R2yY+Ob9E48qhvsr4gSpQKa:7VSgKa
- TLSH T167163B164A94C543D96D6F75E05B133A3B30D999FA44E783C2BFC42E1C993CD0BA7A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/output.txt
- SHA256 49b6eb955c57603fe5b3f0431e2e62471babe230716e2b8e8134cccf9301286b
- MD5 a63eb929e2cb1dfa2700b6efb1ab19f5
- SHA1 6c43b6b5f1452fff4adc72c8eb14acaf1c1a9976
- SHA512 6cd8daacd1c259fa4676a84c01679ee92338e2549f69e5f97342178334a4d30e989d06ffb25f41b1d16ea2c39dd1771424cc142a09da63bdd470a7c83d64bdec
- SSDEEP 98304:LEt8d1XE2/3NBMD1RMPrEnGJ7pKyeP/XXBs+78wwibQXciYeLrkmmAbM67AKfADS:z
- TLSH T1C31882708BBCE5BEDB088453BB07DE783F2A9A07E15F6D7A552837402A6E34B1915703
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/TODO_MANQUANT_POUR_REPRODUCTION.txt
- SHA256 6f9dc7cf9759134d56ab49c62e100dcd4f84fd6a7c2e22cfa804b2988300e334
- MD5 14502cee6819ebebbd20f961cbf35cb5
- SHA1 9973abfdf43f652cee6c5ecc2ec3bf6a1639f85f
- SHA512 d41b5bfca9a204376ac2e320b32c27e19800291d9a6003441ec51058e24a893288a4775182e1715e7085dc388a765076a2c68dd337ac7270c25eba974eebc813
- SSDEEP 96:Vn1K/0f6fkLnuJyN1OOpwW6REiqpo3YVRowxgLoJbLyjUPTcF+X/RIiHE+yOgEXc:Z1f6JKptg1qpTLoyyGcF8/RrPyOgm9K
- TLSH T13C42E93C48807826B392CE4EA8321E4195277806F9586057B9EC70D48FFEBBDCE64E75
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/CREDENTIALS.txt
- SHA256 55fecb1cbfda6754668fe39ccdb3e66d1e8c6370928c8185d127023b98b85d33
- MD5 05a2089cc6cd8258ffbe281bcae49438
- SHA1 493b392aeaf79512d04931e7061d48ad788dc7be
- SHA512 b964dfe8333ab4f59eab4f42c4deaec3baf50ebadcac0096af23174f79bd799c1f811faaf6763572a6bacf5e22f124fa4bfd63294cb8ed9b530eec1dc34c3cda
- SSDEEP 192:x/1vAC0mato8Gy8tSANDsFJ3kzUxRRsTj8JQXCBTLqPFJVg5D1wUYUyhiCLfn:x/1vAn6zyovw3kzUbRsTYJzTLsjVgtSD
- TLSH T1E54284C7A524E09B8BD55F5376B62E8967318883D40E603AB1EC52C80F7D34CEE92CD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/README_FICHIERS_RECUPERES.md
- SHA256 f3d52de31787e44169d50933570bdfa1c3ea002e0345a082d5e2076f0bad2845
- MD5 20293e900e5881925993e1f2ca11b1cb
- SHA1 49a039eb3f34c4a9b767b90c2190a56b9d73d9ca
- SHA512 428803d82fd7a8ac23d264fb168a66fb193d85348c6ce0e476d28a4cc957f47ebcc5a4810513c3051e82dc3fff5de6429036ee22d4f0321b892088706c9508ea
- SSDEEP 192:17vXKHR5PSR3tOvJ75DdTg5n77/QJ4c4d9gEMr59D5rJtmrBgToixrd5ZhPLVsZ1:17cCRduJ71dTgpX//9g75M6dhpsZJj
- TLSH T19952D8DB55D4E48727B98F93B2867F96AF65510A014F5435A0CC800CE21C76FBBEDC86
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_config.php
- SHA256 7fde0f9cfbbddaa246bee8a54af016be7b64e1fe8707bfb2b44009aec2f1eb28
- MD5 b14c4b58d1c72b029f384c8b27d2e739
- SHA1 aeb8cd63d0858c9e6cca743c62366b18fb132005
- SHA512 35177a98ac0763ba37a024e65c4570619fdb65a4ac34715f9a08c77714244500c732e4de25b2819a88d0abe014a4058a025e1f853de0dec78963cfaead866492
- SSDEEP 768:FlNXjAZpZnJQ1mMuI13taXPx6SRQM9XSItRHvA2xl:FlWZpcQI19aXXiM9XSItRHvA2xl
- TLSH T11CF2837D70E7542136A2C42D5F8DA099B605BC07F9497564B86CB1A02FCCABCE170EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_dashboard.php
- SHA256 bc87d12135d38fbf0eea31c8de75da29a8b5ecc674211dfd21cbfbe0457c84ed
- MD5 edf520fdc16b883a996897897a9f02a3
- SHA1 ad2d44821b80d54fead41397c2ba78fced6092ad
- SHA512 42bb2018f3ad1a8407dab6027a4fc491bc7aa0dd7a5d532dc5855552ed983b39ab81249b8decc30eeb63993eacbc5f76cf21c43030e9f571b0cdb071a5345114
- SSDEEP 192:vxtZMPppHc85DbCfjpbdVrUzH1vUPqGapOmpmpOWBY:ZtKpdopxVINUcpOmpmpOWBY
- TLSH T11322B36AA0F1443318D39DD6AB459B5A3F82C807510B214D7AFC86CCAFC6D17ED2B886
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_discord.php
- SHA256 3c30e9c76bef939b63bb6e8d4ef03d41cc23c58d95cf0b863cbf1406cd7cb646
- MD5 fefd70d6229c7c39481118fa50d9232f
- SHA1 e3c3110869df2ff6e44df53a5e40ae5a84523133
- SHA512 f75cf5ca9cb0ed158468c8284868304b6ed74a8305dec7fa8f01350e2a3e7b5601d91a1a53fd3817a45b8de97aa293ca6b317cc95455cc1ff945f096fc3825fe
- TLSH T1C411E33208DB507D4D626E03D75D2596A14995533FE4A94EB45D32041FD933D603CEF6
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_discord_callback.php
- SHA256 6d2939afb9414425f04d2b24a976133db9dbaa76235e1acf2d78046ed354de7c
- MD5 23d807f463df6cf5eb49037616988a36
- SHA1 8edd988fd8b95af862b49659b612293bab158af2
- SHA512 937075eedf86e7060e1e1b17970e8d288b3a9a216c2d073f5db8a093b9d7233f56abb32c47486d2554547f0698561005033e32065dcced990f9fc9cbdfd7d556
- SSDEEP 96:XSVx9gtExnBcSHZGtNOfdg0T3Ta17Mse69+iIXCvJDqeH1Sw4pwo3v5:4IonS81bcMbvi6c5LVA/3v5
- TLSH T109C1953D2174883169A2D25D8B1D1599B20AEC8BF61B6A34796EF2243FCC61DE094CF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_discord_link.php
- SHA256 948828f5c22cf82744e8b37a5a6f0f57e1e66a8d2ca669222a535928c0806e13
- MD5 f4363eb82168fcdc69d283b59884a77b
- SHA1 29505e589fd9795620172bd19b34ceed21f19c29
- SHA512 df51b948b6aa20f3c7317f1e691f964e7c6ee50f52cfe987d7443fd35ee5f6681da7b8356f6c48d0fde8b21c7cd37e69e79ae38784788aadf47213cec5564560
- SSDEEP 96:ZT8S4RTJXzU6Meesj2+mTxe6/Bq8Lu6qGtirCTS9oG3spV3Rf+BixvPQ:ZH4tJDvz/jUx/BzLu6qleTS9oLpRKCY
- TLSH T167A1833B51D504323462DA0FEB8D0A8AB345F417BA273624B56C715C2FCDA1EE1AACF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_download.php
- SHA256 961d51266c7572bdd505f18e9a1bcc373488530dc123c2fd84447e2b9079e3b1
- MD5 f01ee939932881b9bf169029818be170
- SHA1 e3ac2355f42c7aee890b53d0a17845a764d14bcd
- SHA512 2845f39c3508ea7fb46a337eb2e2b3599d2f9eb336cc8829360d13eb8bd94e7e6483b4285d8ca7bad3059755fc4f1c61920ff4fd7c67ba275cfc59d51ffb1d60
- SSDEEP 96:03HWHo0rU+BfjRxExbz1LKn7expS8nXaK5g/s2F:0Y/AXnXaKy
- TLSH T1EA9151BDE1F69A313AA1D15D0E48548A6A06B992B01D2226357DB08C2FCC26DD5B48FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_footer.php
- SHA256 794257cf3eba5fd5a77e068d5d9c3e46350eb0699168e970259ae7f79a1da00b
- MD5 315c6b482e3bbcb28b01ed813dbf1f9b
- SHA1 5bdd383aecdf1fc0dd56252a2bc235d6db18238f
- SHA512 7f2474330a56a6f181d52db66ce2fce2360ea79f5b056e10d6e216402370a9d8b3b1f5068dc0e82a9111fb9be0cebc3afa4507a3dc367fcd31b054e08e0c395d
- TLSH T1ACD0A7BFBD41C25648551F83F05452DDC4AA482FF04291F4249DA0E4916275CE517D9B
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_header.php
- SHA256 8774f43b3758b064e58e7d879e91e6e068860a3064af6d77aef81af612b14dad
- MD5 56a48700da7a8b5cda5eed0f50e18031
- SHA1 2ebac4dffd30ecaa8b16447318b0960d351cf71d
- SHA512 f1966e04917e477a371f41b70034101890b0dc73e7cd03dc337008b5a06c8f23832045ed3f71799a71bdda852fefa03536c4aef675218b59ddca3b4d793f8a99
- TLSH T18421351710F8502A15F1E6C276697B25BCDF7C67FA004808BA9DA48BDFF9B498107D49
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_hwid_reset.php
- SHA256 5246b121580a0c830f1fcaad93d3ed19671e771b2ff95996359d742486dd8c9a
- MD5 27bd6e5e0f6b2cd73f08c90f407040a7
- SHA1 f0435be51cc071c943b57c28742ccf1e596a4877
- SHA512 f26110c6beb3dd39cb34a91a9cb2e4531d8e5a87e0961dd3385a7c4415f1d481c29289f40b3a59fbfb998041eda4a6e4357cc54077101f2ba51cde7f94060393
- TLSH T1A461A70DB2EA57375AA3A11E9F4F00EE321BDD4FE154CA6A7CAD41809F9022CD1718E7
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_login.php
- SHA256 d84f425b5affbef405b62608344dfd1256ad3369af2033c92235329aeca05073
- MD5 f1ae2889196448c44adf2dcceccd6ef4
- SHA1 e579740eb9219908640af772cef17d51c9ed8445
- SHA512 37868bd1bf8c661ba0218b9b74440e2f37dce3165b1dc4f7c196ea7546734e705ee23982e6b9c408d830cbe8b991d39e722f3a470f25061f65982220ccfadc19
- SSDEEP 96:C46HiRjelBiS8HdTtjfGH2ciJNgWxZ18teQpOOZPQ:AVP1UdTtjOH2cfWxjLQpOOZY
- TLSH T1E0A1933A50F21C3302937D686A8C44657A83C407851B2B14B6BED39C2FE6E6FDD35693
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_logout.php
- SHA256 4e3d0244daf5845a8eb8e928b323b9610f29fe98bc56d74bd224c35c53f0ae20
- MD5 154b54db69de978957946dbbdefad674
- SHA1 9962f6cd3585ec81c4d8e766137bdfce78f22cee
- SHA512 e42ae70bc7f71d5be473b4bf03b0c973b1dd7d0c09041c3bd49a5b54539aa2c78b82356a0189866a9330c53cc70b97188c98760ed052a4d6506ea385d3d086ce
- TLSH T16CF0D4996E9794360536E4C300742485F57ACD0ED2014164E7FC1275D7C4568DB3D1EB
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_redeem.php
- SHA256 086f22e2c06ff8b54519a8c5b128c8c6dd77384d53ceaed39030978867b9f995
- MD5 d3dc7d0adcf395427517b88f6169c645
- SHA1 69519828a00b20f8ac23a07e598dcc6cad94eb91
- SHA512 75122cbacd890a90e4750a26c0550d69225f14903d73f928fe7fd81d60e08bd9cf20cfa6284842210be261b38793532e8f8e7fdf93d6d89c56e1c74e5e2d1bee
- TLSH T18721624993BE64710BD618AA9E8D1109F107D849953E27B4BCED88982EE418DD2315FA
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_register.php
- SHA256 0698dc82d1b41e0a99046d3fe045b082d5817b076410db99a4be9a34da00baec
- MD5 bbbdc0f9a7bf1a63e940ed03dd4a112a
- SHA1 eff3879a48c59b11ff90833a0155a976bb75067b
- SHA512 8680c1728a43d1ada50987859dadddd17a1e6f50e6be7ac9f3b4c1793d610a620acbaac080add68bf0f0469074e476771f1127beb05855de508e9b1e5e4af7a8
- SSDEEP 96:YZ41Bi+8rhV2Yxo7inexONcZWxZ1E8t+qEpKVPQ:f+hV2Yxo7c2DZWxjEwmpKVY
- TLSH T1E291943564F20D230143A4486A8A59257F96C003021B5A44BFFDD3CC7FE7E9BCEA5287
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_signout_clients.php
- SHA256 b4ea314a6a210dbaf3bf7aa75370649adea43493c4e04a8247f7b63a7e23b44f
- MD5 b30a31aa36a5354cbefd880d47a67c02
- SHA1 7b13d4fd03e37e5c931e64faed280cea8062aacc
- SHA512 75acfd04cfa8e0c0a425f2d918e176f6af2f8b4a68541a306b470e0b0d6bd8886606a8f50fb1dfeb58b4ef684fff02cac2c7ed795f0f0e2fbf8b50b08f365c36
- TLSH T19D111FCD51F951306AF799C4981C4C65A427DE0FF5421934BA3ED0892FC828CEB95EB2
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_skeleton.js
- SHA256 bb3865bd6688598cfcd4f78f1c092138b9a5343306277a2ba8bb376d09a2d42a
- MD5 fefd0062e63ce39e4e3a8bf933f6169e
- SHA1 e2da5950097cadc84a8d3bb35f518eaa23539adf
- SHA512 b9d3bfa9587ecd394bdba274b775347ac8b5e5f0de216acc12747993a94333d445e8cf03a99ba762ee828643120807d88b0f56c4f477763c40b07df096d4eff8
- SSDEEP 192:nXZg/6nrsh+8HB2KGp7abRNACq4hIdZP7yVttuELsLBC1rO/JkG9SR:nXCushr1jYZcfKyO/M
- TLSH T199124F7C65D220327C16E13D9BDF6194B16A3807B409DA22389CF2119FECA9CD674EF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/account_style.css
- SHA256 66bb20f5a65811e1814037ab51f99f5260c579a3ae205277e0a849e75c106d7b
- MD5 82e5a7cfc6a0ca63bec0af0bbb326018
- SHA1 0470d97df2c36617b9f2012dff54f7662c60b72a
- SHA512 0266c7c203ffd4893ea54a4fc6da9cccee182f8a4145546b892e6d107c30c4896bd69022481f347349b4725b4681db608e5514cb5c2db7e80c0a3c4d16892aff
- SSDEEP 192:oEGaYK4B9ZUXPwP5gEAr80bd5dcvbUJxtZLeUrAX28ehc4:hGaYK4qIqh
- TLSH T11F2265BA6262556A7523C40C6BCA91DE32087847B816F7BCBC8C7019CFCE6E9D215674
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_index.php
- SHA256 23a98ef00e5633ec422898df2e4735455af55fc9b7c1774d040a3b01b2893580
- MD5 2b1bee0f31f86b44e0d8ff768787b859
- SHA1 0f4232b4a910e8620acb0ae0578419884a89cbc0
- SHA512 10f2100ebbca5053f0c99790a9e771475c0828213de48fa2eee439537485e61a9e0fee8ff3e65728102f6896db82661688a0b27926e365cc1ef10324edd4eae3
- SSDEEP 768:WuGCBeXzJ9x4wHeQ9W2p1vDTT4bx9qNeV6RgGPKlHJ4jP+N4v:WsBkzPx4wJc2p1Dv4F3oMZJ4T+w
- TLSH T19F23D93DA0B694350423911A5F5F906477269C07ED07AB60B6ADE2887FDC6ACF230EF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_lib.php
- SHA256 5c8cc2b17eaffa5b266a9f3e46bfbc4c133bc6f3a82278922d0f0f0b4df77263
- MD5 b95f61ed5321ff8ed59d8ac0ef983bb5
- SHA1 f2f6507bde529682087f9c765db09bf1b6e12dc3
- SHA512 2799cd6fc4286bfc0717e0868cd8f8ffda41345454953abeb66ca115a3cec0355a8892347fae54037d41e2af584329e24cf4f55c75b6c82f859df8dee68864eb
- SSDEEP 768:Yx0mdtkVwqKbRY+Vm71BwjuYXujyKu/Kkh5lNqwht3/ymV:qztkVwqKbRY+Vm71CKYXu+K+KkhH/7V
- TLSH T18933D63CA0E354353863D01E4EAB9565B329BC07F946A561F9AD71942FCC2ACF630EB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_online_source.php
- SHA256 4373745d04e5de83141a724006c0c825aaac1470e7539dc4314e0b3f78dfbbf7
- MD5 c7e13ab2377730c39cc15bed06051919
- SHA1 0419e13baa8bcbffddb2b4cb38cb12ba7dbe54f4
- SHA512 445621f7d377bfef49e5a50c1a9674f91616c508b1252ea7d75ec602897f83074010a029362ebb8e24baea3182a77777e845300a92713251a6d1d06e05bca7a1
- TLSH T19D81443830F2A9713865E23E2519D419BE2A7C0BB54E6616728D77042FDC6EDE314DF1
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_payload_lib.php
- SHA256 54f1d799c8b0dedb25a0e746d3cf93a25b06694afb4145c9d14b6cd8ef712447
- MD5 7480bc834132778eacab656844c19f51
- SHA1 afe38240c69398047d62a0772ff12f61797c6285
- SHA512 85ef535236317a523a02be2a9bb3142c0d43f4ea9ade11794d5b21c435a1114ebe2859d53d2ab5b2deb2c89b877539c858a40ae8a5aae2775d0ec21158719fad
- SSDEEP 96:ArFu+smHClTSx1qyAAbe+UjWdD3F8Mk6jbvbHAkG3D0wV+QavPYhi2gXBdMmjHxB:ActTSx1azWpvtjHAkg+QaCi2gXBNx5Qe
- TLSH T1F0C1A888BDE3D416021362261EAB55A6B2349C1BE546B9707DBC40F87F989DCD1B0FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_changelog.php
- SHA256 be09ba5ead53f1b95b2def7ccbf97169cb0a68dfd949948ce7287e74cca6764e
- MD5 e95d81155f382f642b03dd273841ee13
- SHA1 8e698b0b9712c68a9cf87eca3089c94089fb9e48
- SHA512 9788f890cac2837bbd173173d33eb4263a9953c90b14b119e1735d6a65d7ba71ff826ea4a8401110fecb528d04065324995275425c7ec94769902a9a4136562c
- SSDEEP 96:PNyK+toXZzIEb0EaW87xxGYcyWV5OUoOEKcr1lYAqosiP3iBy2ojmUceYzueh8CM:PN8tkCBVgeNvsiv0jojQjyOw
- TLSH T1B1C15CA3F47AB02A43B8B723B0B2734CD7117586BB074254E150D71C97EEECB8314A89
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_hwid.php
- SHA256 26877dee6e1e2b1c0d7853ca6422869eff7ea8096bc7aab7613f242b08df0e16
- MD5 91c97216bfc8d755f9aebc747c2bdaa1
- SHA1 66374a0dd0d03552a686a60152f2bcfa8408d01e
- SHA512 c96739103b49f4845bc6de0f8e61efde07cb305e8db32ccfec25127df3bee5bf8cdb36160b579c9cd544c4eaff3818b88fa50a7ec6427b6affbaab6546d5506e
- SSDEEP 96:PNyRvtoXZzIEb0EaW87wylxxmt+otrHD3+Ae8V9z6/8VRtZJAYktrhYzueh8Dtgd:PNIvtkCBfxm8oFuh8V9e/8VwYur2yphw
- TLSH T1DFC14AF336B14027E3E56F8E60FA73A89221B28DF7025084F580933C1ACEE9FC254594
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_license.php
- SHA256 ccb527fcdd71111d3c3e2f0816271e4249cf97ca53eec01de80b4ad624e019ec
- MD5 bb08c2f4e0d9ba31059485f9c56a5f1c
- SHA1 dfa9472ec52f612d282eb98d82360ca785b26850
- SHA512 26b4e82f4e8c99c6a7fc1b4b9b32d31d4edece942af5fd9f06acd5a5a5117b9a43359aa541e39c1f09eabfa122db646b931a0c6127097f432339d51a0cf47a27
- SSDEEP 96:PNyStoXZzIEb0EaW87OHczUAx4INVhO2vIKG5hFGbYajlkIYLNksHxYzueh8bimw:PNntkCBD4Uw2v5lbYaiIY5HmyPw
- TLSH T143C13BD3B672402BA3F96BE600F7321CAA115114FB0666C9A151C77DF7DEE3B8226484
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_link.php
- SHA256 6123d1bc5df092a619fcc08e0af806e9610a5a3e250f112d3c4fba62dbb05abc
- MD5 3f13a2d5ccc5368c48145b1247facb2c
- SHA1 74095b128915ad569d1b5c5d5b3eb50a44d2e781
- SHA512 ac534e83754e692af16fc07d1686d7d1d80e62344756bd6b3d4e43f24cdc8573af757688502c45a473cc963439af87680d57f472c5526053684f4a53de9182ed
- SSDEEP 96:PNyxvtoXZzIEb0EaW87XUyJ6CizaIgCCDZ5YtdMCHYRMY6U3blfN10VYzueh811d:PNUvtkCB1JyzaIoDkwCkMzUrlF10yyEw
- TLSH T16EC14CD76E17504F57BC5FAB60A33328A722B6927B005189D2A2CF2C59ECF8EC248595
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_link_finish.php
- SHA256 6b697587ff036291925e637b3e7814cb86e592f55499499ff99a2d3483868248
- MD5 2a5d951064cf2a613273f6c107a2e7c5
- SHA1 7665c5fe4e6ab613255f1651d78d1dd1ed43d2a3
- SHA512 55ca20219e64cd5c7b47e22392eb3deccc1e03fae868558dead60c58b7b81804bd0cbd0b8a7ab8ccac4591827a677f66d198348ed01e5a17b5298d2b2c84c83d
- SSDEEP 96:PNyItoXZzIEb0EaW870+Na9yTzC4+kgL2Fei23zwOsSetAbeYzueh8ntmw:PNttkCB3pTzC4+z2FwUBSKAbjy1Qw
- TLSH T19DC15CF3E932402B9B762FD660B7F36C9050764DF2028596C0E1D75C98EDE8E81B4D94
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_redeem.php
- SHA256 9ceddfb4ebb2e2507e683a47f7880057625cbb73c7bce62f48341d11fdf3b8ba
- MD5 b7edebb7686a6bccc8bedfa7eba2deb4
- SHA1 7db3791129918632e5177d88cd6ced4e5a53bc95
- SHA512 69f7d8969e39d48ecec43001c7b8c2a6e64b0b8c8b67ac35eaf4f399bf6c01908333aa72d217b0e5001ec3f1df9631924eab01d059cab06a925e385c02fcbca4
- SSDEEP 96:PNy8toXZzIEb0EaW87cnINgyuFagLagq8YhEaKDyqHXX38JCVW6ETZYzueh8sagJ:PNltkCBcCRuFNhYhEaC3XjVW6ETuyasw
- TLSH T155C15BF7E572B02BA3226FA665F6334CA312B155FB419185D066C61C81DDFCA82A2DC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/api_v1_version.php
- SHA256 abc67fe961f8d4bd90f5aeb70b0694dbe7977913bf1242d31a716e4fb23db79a
- MD5 beb9d71c7558724161c7323393aba16b
- SHA1 050f275cc3d04fc92663f45af12c17e335a50af9
- SHA512 6d7a0613caedb1fb28f417ec32062919db3c1bfe5c006d6cd0528026afc4bafa23fc260a23f61e3340774da9318d5b9b1f3da42c2403d4c803016b678d4392e8
- SSDEEP 96:PNy2itoXZzIEb0EaW87scuDxeR7AQj0jWiijGsudVu4HQAyu4kqSYzueh8Gxmw:PNOtkCBMdeiQj0wx8VZQAyPkq/yxw
- TLSH T102C13CB7B424908687F66FB720F6335C9310F2A6F30344FDA991971C86D9F5F8265690
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14.dat.enc
- IMPHASH 5c30e52724d56940da470cc763883ac0
- SHA256 e40e91f1f6d66021a07b55cb1a95f165b17d6f2183f36e7d05abd434e18a696e
- MD5 92b6dd35b56d84ca480f69bcd7efefb0
- SHA1 a10fd7687578734fa3251769b3a889a05073a129
- SHA512 6f4ffb0ad202ed9f0a32d4b5b74c9b55e55688eff582b076828f5dbdc240717039e98588ad568fd0d8c4ea532fc834d8c0ab110c9d8e4736e855bdac33ceed87
- SSDEEP 6144:bft0gBOxBUQ7FWC4+IfmFek8BrOPtJjf1YLovWltXZyceg4cbWi9RZJ4bqiNyxNK:rSxxKfmFeZxSNvgJ4+1mN
- TLSH T1A5946B2AF9194165E6D782BCA9534502EBF3B4880366D0F703C0DAD97E47BEC573AE12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
182896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\!!!!projectinternal\!hookloader\build\hookloader.pdb
kernel32
CreateDirectoryW
ReadFile
GetCurrentProcess
GetModuleHandleA
SetFileAttributesW
GetTickCount64
DeleteFileW
GetFileSize
SetThreadAffinityMask
GetSystemFirmwareTable
IsWow64Process2
SetLastError
GetPhysicallyInstalledSystemMemory
DeviceIoControl
CreateMutexA
LocalAlloc
GetFileAttributesW
IsNativeVhdBoot
GetLastError
GetLogicalProcessorInformationEx
GetDiskFreeSpaceExW
QueryPerformanceFrequency
GetNativeSystemInfo
LocalFree
GetProcessHeap
GetThreadContext
SleepEx
BuildCommDCBAndTimeoutsA
EnumSystemFirmwareTables
SetThreadContext
QueryPerformanceCounter
IsWow64Process
GetComputerNameA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AllocConsole
Beep
CreateThread
CloseHandle
DisableThreadLibraryCalls
GetCurrentThread
VirtualAlloc
VirtualFree
GetModuleHandleW
CreateFileW
WriteFile
GetProcAddress
LoadLibraryExW
FreeLibrary
user32
QueryDisplayConfig
SetWinEventHook
GetDesktopWindow
ReleaseDC
FindWindowW
GetWindowThreadProcessId
GetDC
GetWindowRect
GetSystemMetrics
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
GetDeviceCaps
advapi32
RegQueryValueExW
RegEnumKeyExA
RegGetValueW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExW
RegQueryValueExA
RegQueryInfoKeyW
RegCloseKey
shell32
SHGetKnownFolderPath
ole32
CoCreateInstance
CoTaskMemFree
CoInitializeEx
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xbad_function_call@std@@YAXXZ
?_Random_device@std@@YAIXZ
_Thrd_hardware_concurrency
dbghelp
ImageDirectoryEntryToData
winhttp
WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpOpen
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpConnect
shlwapi
PathMatchSpecA
setupapi
SetupDiEnumDeviceInterfaces
SetupDiGetDevicePropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
tbs
Tbsi_Context_Create
Tbsip_Submit_Command
Tbsip_Context_Close
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
memcpy
memmove
memset
__current_exception
__std_type_info_destroy_list
strstr
strrchr
__C_specific_handler_noexcept
__current_exception_context
_CxxThrowException
wcsstr
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
wcschr
strchr
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
freopen_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vsprintf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_errno
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
system
api-ms-win-crt-string-l1-1-0
isdigit
strcmp
strnlen
tolower
towlower
wcslen
strlen
api-ms-win-crt-convert-l1-1-0
strtod
strtoull
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
ceilf
Name
.text
Size
186KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
98KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=26, id=261, version=35721,
count=6, id=257, version=35721,
count=1, id=260, version=33145,
count=1, id=262, version=33145,
count=25, id=257, version=33145,
count=348, id=1, productName=Unmarked objects,
count=21, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14.dll
- IMPHASH 5c30e52724d56940da470cc763883ac0
- SHA256 e40e91f1f6d66021a07b55cb1a95f165b17d6f2183f36e7d05abd434e18a696e
- MD5 92b6dd35b56d84ca480f69bcd7efefb0
- SHA1 a10fd7687578734fa3251769b3a889a05073a129
- SHA512 6f4ffb0ad202ed9f0a32d4b5b74c9b55e55688eff582b076828f5dbdc240717039e98588ad568fd0d8c4ea532fc834d8c0ab110c9d8e4736e855bdac33ceed87
- SSDEEP 6144:bft0gBOxBUQ7FWC4+IfmFek8BrOPtJjf1YLovWltXZyceg4cbWi9RZJ4bqiNyxNK:rSxxKfmFeZxSNvgJ4+1mN
- TLSH T1A5946B2AF9194165E6D782BCA9534502EBF3B4880366D0F703C0DAD97E47BEC573AE12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
182896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\!!!!projectinternal\!hookloader\build\hookloader.pdb
kernel32
CreateDirectoryW
ReadFile
GetCurrentProcess
GetModuleHandleA
SetFileAttributesW
GetTickCount64
DeleteFileW
GetFileSize
SetThreadAffinityMask
GetSystemFirmwareTable
IsWow64Process2
SetLastError
GetPhysicallyInstalledSystemMemory
DeviceIoControl
CreateMutexA
LocalAlloc
GetFileAttributesW
IsNativeVhdBoot
GetLastError
GetLogicalProcessorInformationEx
GetDiskFreeSpaceExW
QueryPerformanceFrequency
GetNativeSystemInfo
LocalFree
GetProcessHeap
GetThreadContext
SleepEx
BuildCommDCBAndTimeoutsA
EnumSystemFirmwareTables
SetThreadContext
QueryPerformanceCounter
IsWow64Process
GetComputerNameA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AllocConsole
Beep
CreateThread
CloseHandle
DisableThreadLibraryCalls
GetCurrentThread
VirtualAlloc
VirtualFree
GetModuleHandleW
CreateFileW
WriteFile
GetProcAddress
LoadLibraryExW
FreeLibrary
user32
QueryDisplayConfig
SetWinEventHook
GetDesktopWindow
ReleaseDC
FindWindowW
GetWindowThreadProcessId
GetDC
GetWindowRect
GetSystemMetrics
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
GetDeviceCaps
advapi32
RegQueryValueExW
RegEnumKeyExA
RegGetValueW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExW
RegQueryValueExA
RegQueryInfoKeyW
RegCloseKey
shell32
SHGetKnownFolderPath
ole32
CoCreateInstance
CoTaskMemFree
CoInitializeEx
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xbad_function_call@std@@YAXXZ
?_Random_device@std@@YAIXZ
_Thrd_hardware_concurrency
dbghelp
ImageDirectoryEntryToData
winhttp
WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpOpen
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpConnect
shlwapi
PathMatchSpecA
setupapi
SetupDiEnumDeviceInterfaces
SetupDiGetDevicePropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
tbs
Tbsi_Context_Create
Tbsip_Submit_Command
Tbsip_Context_Close
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
memcpy
memmove
memset
__current_exception
__std_type_info_destroy_list
strstr
strrchr
__C_specific_handler_noexcept
__current_exception_context
_CxxThrowException
wcsstr
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
wcschr
strchr
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
freopen_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vsprintf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_errno
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
system
api-ms-win-crt-string-l1-1-0
isdigit
strcmp
strnlen
tolower
towlower
wcslen
strlen
api-ms-win-crt-convert-l1-1-0
strtod
strtoull
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
ceilf
Name
.text
Size
186KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
98KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=26, id=261, version=35721,
count=6, id=257, version=35721,
count=1, id=260, version=33145,
count=1, id=262, version=33145,
count=25, id=257, version=33145,
count=348, id=1, productName=Unmarked objects,
count=21, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/afterlife_pid14_hookloader.dll
- IMPHASH 5c30e52724d56940da470cc763883ac0
- SHA256 e40e91f1f6d66021a07b55cb1a95f165b17d6f2183f36e7d05abd434e18a696e
- MD5 92b6dd35b56d84ca480f69bcd7efefb0
- SHA1 a10fd7687578734fa3251769b3a889a05073a129
- SHA512 6f4ffb0ad202ed9f0a32d4b5b74c9b55e55688eff582b076828f5dbdc240717039e98588ad568fd0d8c4ea532fc834d8c0ab110c9d8e4736e855bdac33ceed87
- SSDEEP 6144:bft0gBOxBUQ7FWC4+IfmFek8BrOPtJjf1YLovWltXZyceg4cbWi9RZJ4bqiNyxNK:rSxxKfmFeZxSNvgJ4+1mN
- TLSH T1A5946B2AF9194165E6D782BCA9534502EBF3B4880366D0F703C0DAD97E47BEC573AE12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
182896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\!!!!projectinternal\!hookloader\build\hookloader.pdb
kernel32
CreateDirectoryW
ReadFile
GetCurrentProcess
GetModuleHandleA
SetFileAttributesW
GetTickCount64
DeleteFileW
GetFileSize
SetThreadAffinityMask
GetSystemFirmwareTable
IsWow64Process2
SetLastError
GetPhysicallyInstalledSystemMemory
DeviceIoControl
CreateMutexA
LocalAlloc
GetFileAttributesW
IsNativeVhdBoot
GetLastError
GetLogicalProcessorInformationEx
GetDiskFreeSpaceExW
QueryPerformanceFrequency
GetNativeSystemInfo
LocalFree
GetProcessHeap
GetThreadContext
SleepEx
BuildCommDCBAndTimeoutsA
EnumSystemFirmwareTables
SetThreadContext
QueryPerformanceCounter
IsWow64Process
GetComputerNameA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AllocConsole
Beep
CreateThread
CloseHandle
DisableThreadLibraryCalls
GetCurrentThread
VirtualAlloc
VirtualFree
GetModuleHandleW
CreateFileW
WriteFile
GetProcAddress
LoadLibraryExW
FreeLibrary
user32
QueryDisplayConfig
SetWinEventHook
GetDesktopWindow
ReleaseDC
FindWindowW
GetWindowThreadProcessId
GetDC
GetWindowRect
GetSystemMetrics
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
GetDeviceCaps
advapi32
RegQueryValueExW
RegEnumKeyExA
RegGetValueW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExW
RegQueryValueExA
RegQueryInfoKeyW
RegCloseKey
shell32
SHGetKnownFolderPath
ole32
CoCreateInstance
CoTaskMemFree
CoInitializeEx
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xbad_function_call@std@@YAXXZ
?_Random_device@std@@YAIXZ
_Thrd_hardware_concurrency
dbghelp
ImageDirectoryEntryToData
winhttp
WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpOpen
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpConnect
shlwapi
PathMatchSpecA
setupapi
SetupDiEnumDeviceInterfaces
SetupDiGetDevicePropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
tbs
Tbsi_Context_Create
Tbsip_Submit_Command
Tbsip_Context_Close
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
memcpy
memmove
memset
__current_exception
__std_type_info_destroy_list
strstr
strrchr
__C_specific_handler_noexcept
__current_exception_context
_CxxThrowException
wcsstr
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
wcschr
strchr
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
freopen_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vsprintf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_errno
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
system
api-ms-win-crt-string-l1-1-0
isdigit
strcmp
strnlen
tolower
towlower
wcslen
strlen
api-ms-win-crt-convert-l1-1-0
strtod
strtoull
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
ceilf
Name
.text
Size
186KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
98KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=26, id=261, version=35721,
count=6, id=257, version=35721,
count=1, id=260, version=33145,
count=1, id=262, version=33145,
count=25, id=257, version=33145,
count=348, id=1, productName=Unmarked objects,
count=21, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_driver.sys
- IMPHASH 5ab36d16c201a8fa58e1f7d620d9704b
- SHA256 c088e3dbb80c9f5608550757c1f2841598c8e43ebac073a91897b41831f40710
- MD5 7665a8504ff96bf66e4be4e2a00e8c5a
- SHA1 882ac724d804f6f366ed3a0b277c1dfd23672d38
- SHA512 a2696de217a793d475c4d0e4b3dc56e92817a5a385894c4ab311db460d221fa6d71351f189360baa9162903c2776265c396fbb48c7481aa9b1db7d0b0f9b6c53
- SSDEEP 98304:hOpEDDsnhUY+kP7l51v0sDw0r39eec8Yz0:JnsnhUAJ5ysDwsNet0
- TLSH T1D82602031CD01274C2F7C70A97DB465FA2C35156A6AB6F0E28D458425BC3F9A3A8B76F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
cng.sys
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptOpenAlgorithmProvider
ntoskrnl.exe
ExFreePoolWithTag
ZwClose
ZwOpenKey
ZwQueryValueKey
swprintf_s
PsLookupProcessByProcessId
strncmp
ObfDereferenceObject
PsGetProcessSectionBaseAddress
__C_specific_handler
strstr
DbgPrintEx
ZwQuerySystemInformation
MmGetSystemRoutineAddress
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwProtectVirtualMemory
PsProcessType
MmIsAddressValid
MmUserProbeAddress
MmGetPhysicalMemoryRanges
MmGetVirtualForPhysical
MmUnmapIoSpace
MmMapIoSpaceEx
MmCopyMemory
IoGetCurrentProcess
KeQueryUnbiasedInterruptTime
ExAllocatePool
ObfReferenceObject
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
IoEnumerateDeviceObjectList
ExInitializeResourceLite
ExEnterCriticalRegionAndAcquireResourceShared
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
ExDeleteResourceLite
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
KeLowerIrql
KfRaiseIrql
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
ObReferenceObjectByName
RtlPcToFileHeader
IoDriverObjectType
KeDelayExecutionThread
RtlImageNtHeader
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlFindExportedRoutineByName
ExAllocatePoolWithTag
RtlCopyUnicodeString
RtlGetVersion
RtlInitUnicodeString
_wcsicmp
IofCompleteRequest
MmCopyVirtualMemory
wdfldr.sys
WdfLdrQueryInterface
WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.borat20
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_helper.dll
- IMPHASH c766d92ad0cfe977c8a8632e20757130
- SHA256 248943cd4b35c079d5ae5f84b6dfc68818f58ea4bb5b4549df59a877ac64bd44
- MD5 ad1cbddcdb77303ad32a67eb1a4ea931
- SHA1 9faf98f46744a1447d91a424fb1fd5102677c398
- SHA512 e6328b4acc94d21791a8627a34553c27f0fc4ef59552bd09f432f9a071f799c12a1336e8f83e2e9f664edbe976c7f898ca338f92ae833d61c1f19dd69ddfb324
- SSDEEP 768:dr9qupoBUng4WaszhThYLix/Jq7lUiEk+3:d9quG6DCThfAW/3
- TLSH T1B1E24B64974901FAE476C1FCE1336716D275B834573193EF036086A90E277E8E63ABC5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16476
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Jenkins\jobs\SaperaLTBuild\workspace\Pdb\x64\CorLog.pdb
kernel32
CreateFileA
CloseHandle
DeviceIoControl
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
GetLocalTime
GetLastError
LocalFree
FormatMessageA
ResetEvent
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
ReadFile
WriteFile
SetLastError
SetNamedPipeHandleState
CancelIo
WaitNamedPipeA
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
oleaut32
SysReAllocStringLen
vcruntime140
memset
__C_specific_handler
__std_type_info_destroy_list
__current_exception_context
__current_exception
api-ms-win-crt-string-l1-1-0
strcat_s
strcpy_s
api-ms-win-crt-heap-l1-1-0
malloc
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-runtime-l1-1-0
_crt_at_quick_exit
_initterm_e
_initterm
_register_onexit_function
terminate
_execute_onexit_table
_crt_atexit
_initialize_onexit_table
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
CorLogClearFilters
CorLogClearMessages
CorLogGetConfig
CorLogGetDefaultFile
CorLogGetFileName
CorLogGetLog
CorLogGetLogEx
CorLogGetLogNew
CorLogOnline
CorLogPopFileFilter
CorLogPushFileFilter
CorLogPutLog
CorLogPutMsg
CorLogReadFileFilters
CorLogReadReset
CorLogSaveFileFilters
CorLogSetConfig
CorLogSetFileName
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=5, id=257, version=30795,
count=61, id=1, productName=Unmarked objects,
count=5, id=260, version=30158,
count=1, id=256, version=30158,
count=1, id=255, version=30158,
count=1, id=151,
count=1, id=258, version=30158,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/azure_pid16_emulator.dll
- IMPHASH ca387eed53051a9fb0ecfde4136cb8b0
- SHA256 3e64562e108f0563c5dab83dd9a0c3792e19029ecf8f2d3341800775e3b22a68
- MD5 45a1cbc35de9a64ec187203c9da90598
- SHA1 28842c907ab779c9b16fb237045ee073612d3923
- SHA512 3400e4fd106ea8ba86fbb32b97961d6cba6e462ad210d7c4f2135966dae3702be5344723bf4cf583fa42349c5a06fec4fa6a82188d805ffc1badd8008e3f6a50
- SSDEEP 98304:jCoM6Gl+bbSA1OpEDDsnhUY+kP7l51v0sDw0r39eec8Yz0:jCX6Gl+bjFnsnhUAJ5ysDwsNet0
- TLSH T1D486F106669D82B8D2A3D53D85D38307F3F2BD5AA755EFCB25D04C400F83AE1696738A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2182464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\!azuresrc\azure_both\x64\Release\awdawd.pdb
bcrypt
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
advapi32
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
GetTokenInformation
OpenServiceW
RegOpenKeyExA
StartServiceW
OpenProcessToken
OpenSCManagerW
RegQueryValueExA
CloseServiceHandle
ConvertSidToStringSidA
RegCloseKey
CreateServiceW
CryptHashData
CryptCreateHash
CryptEncrypt
user32
MessageBoxA
ToUnicode
GetDesktopWindow
UpdateWindow
GetKeyState
SetWindowDisplayAffinity
ScreenToClient
FindWindowW
TranslateMessage
SetLayeredWindowAttributes
ClientToScreen
EnumWindows
GetForegroundWindow
LoadCursorW
SetCursor
GetClientRect
SetCursorPos
GetWindowLongW
GetWindowThreadProcessId
MapVirtualKeyW
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
GetSystemMetrics
ShowWindow
GetAsyncKeyState
DispatchMessageW
GetClipboardData
SetClipboardData
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
PeekMessageW
MoveWindow
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateContext
CryptBinaryToStringA
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CryptStringToBinaryA
CertFindCertificateInStore
ws2_32
recvfrom
getsockname
getsockopt
ntohs
sendto
connect
getpeername
WSASetLastError
WSAGetLastError
select
setsockopt
freeaddrinfo
htons
recv
gethostname
socket
__WSAFDIsSet
send
WSAStartup
getaddrinfo
inet_pton
listen
ioctlsocket
WSAIoctl
closesocket
bind
accept
WSACleanup
htonl
ntohl
d3d9
Direct3DCreate9Ex
kernel32
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
ExitProcess
DeleteCriticalSection
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
SetLastError
GetCurrentProcess
LoadLibraryExA
GetUserDefaultUILanguage
InitializeCriticalSectionEx
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetTickCount64
GetLastError
GetFileAttributesA
Process32NextW
Process32FirstW
CloseHandle
LoadLibraryW
CreateThread
GetLocalTime
Beep
LocalFree
shell32
ShellExecuteA
ole32
CoInitializeEx
CoCreateInstance
imm32
ImmSetCompositionWindow
ImmAssociateContextEx
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
_Mtx_unlock
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
shlwapi
PathFileExistsW
winmm
timeBeginPeriod
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memset
strchr
strrchr
memmove
memcmp
memchr
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
__std_type_info_destroy_list
__std_exception_copy
strstr
__std_terminate
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fgetpos
setvbuf
ungetc
fgetc
__stdio_common_vsprintf_s
fsetpos
_fseeki64
_get_stream_buffer_pointers
_lseeki64
fputc
_open
fopen
_close
__stdio_common_vsscanf
fread
_write
__stdio_common_vsprintf
_wfopen
fwrite
_read
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
fputs
ftell
feof
fgets
api-ms-win-crt-string-l1-1-0
wcslen
_strdup
strncpy_s
strcspn
strncpy
strncmp
strcmp
tolower
strpbrk
isupper
strlen
_stricmp
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
realloc
malloc
free
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
strtod
strtol
atoi
strtoll
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_cexit
exit
_initialize_onexit_table
__sys_nerr
_register_onexit_function
strerror
_crt_atexit
_beginthreadex
_initterm_e
terminate
_execute_onexit_table
_errno
_getpid
api-ms-win-crt-math-l1-1-0
atan2
sin
fmod
floorf
fmodf
expf
_dsign
sinf
sqrt
cosf
ceilf
tanf
cos
powf
sqrtf
acosf
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_unlink
_lock_file
_unlock_file
_access
_stat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
normaliz
IdnToAscii
wldap32
ord30
ord79
ord301
ord33
ord32
ord27
ord35
ord200
ord26
ord22
ord41
ord50
ord45
ord143
ord60
ord211
ord217
ord46
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4.7MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33145,
count=6, id=257, version=35721,
count=8, id=253, version=35721,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=28, id=261, version=35721,
count=1, id=260, version=33145,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=33, id=257, version=33145,
count=460, id=1, productName=Unmarked objects,
count=9, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_embedded_34404_at0x395060.bin
- IMPHASH 5ab36d16c201a8fa58e1f7d620d9704b
- SHA256 c088e3dbb80c9f5608550757c1f2841598c8e43ebac073a91897b41831f40710
- MD5 7665a8504ff96bf66e4be4e2a00e8c5a
- SHA1 882ac724d804f6f366ed3a0b277c1dfd23672d38
- SHA512 a2696de217a793d475c4d0e4b3dc56e92817a5a385894c4ab311db460d221fa6d71351f189360baa9162903c2776265c396fbb48c7481aa9b1db7d0b0f9b6c53
- SSDEEP 98304:hOpEDDsnhUY+kP7l51v0sDw0r39eec8Yz0:JnsnhUAJ5ysDwsNet0
- TLSH T1D82602031CD01274C2F7C70A97DB465FA2C35156A6AB6F0E28D458425BC3F9A3A8B76F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
cng.sys
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptOpenAlgorithmProvider
ntoskrnl.exe
ExFreePoolWithTag
ZwClose
ZwOpenKey
ZwQueryValueKey
swprintf_s
PsLookupProcessByProcessId
strncmp
ObfDereferenceObject
PsGetProcessSectionBaseAddress
__C_specific_handler
strstr
DbgPrintEx
ZwQuerySystemInformation
MmGetSystemRoutineAddress
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwProtectVirtualMemory
PsProcessType
MmIsAddressValid
MmUserProbeAddress
MmGetPhysicalMemoryRanges
MmGetVirtualForPhysical
MmUnmapIoSpace
MmMapIoSpaceEx
MmCopyMemory
IoGetCurrentProcess
KeQueryUnbiasedInterruptTime
ExAllocatePool
ObfReferenceObject
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
IoEnumerateDeviceObjectList
ExInitializeResourceLite
ExEnterCriticalRegionAndAcquireResourceShared
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
ExDeleteResourceLite
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotificationEx
KeLowerIrql
KfRaiseIrql
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
ObReferenceObjectByName
RtlPcToFileHeader
IoDriverObjectType
KeDelayExecutionThread
RtlImageNtHeader
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlFindExportedRoutineByName
ExAllocatePoolWithTag
RtlCopyUnicodeString
RtlGetVersion
RtlInitUnicodeString
_wcsicmp
IofCompleteRequest
MmCopyVirtualMemory
wdfldr.sys
WdfLdrQueryInterface
WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.borat20
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_embedded_34404_at0x801cd0.bin
- IMPHASH c766d92ad0cfe977c8a8632e20757130
- SHA256 248943cd4b35c079d5ae5f84b6dfc68818f58ea4bb5b4549df59a877ac64bd44
- MD5 ad1cbddcdb77303ad32a67eb1a4ea931
- SHA1 9faf98f46744a1447d91a424fb1fd5102677c398
- SHA512 e6328b4acc94d21791a8627a34553c27f0fc4ef59552bd09f432f9a071f799c12a1336e8f83e2e9f664edbe976c7f898ca338f92ae833d61c1f19dd69ddfb324
- SSDEEP 768:dr9qupoBUng4WaszhThYLix/Jq7lUiEk+3:d9quG6DCThfAW/3
- TLSH T1B1E24B64974901FAE476C1FCE1336716D275B834573193EF036086A90E277E8E63ABC5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16476
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Jenkins\jobs\SaperaLTBuild\workspace\Pdb\x64\CorLog.pdb
kernel32
CreateFileA
CloseHandle
DeviceIoControl
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
GetLocalTime
GetLastError
LocalFree
FormatMessageA
ResetEvent
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
ReadFile
WriteFile
SetLastError
SetNamedPipeHandleState
CancelIo
WaitNamedPipeA
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
oleaut32
SysReAllocStringLen
vcruntime140
memset
__C_specific_handler
__std_type_info_destroy_list
__current_exception_context
__current_exception
api-ms-win-crt-string-l1-1-0
strcat_s
strcpy_s
api-ms-win-crt-heap-l1-1-0
malloc
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-runtime-l1-1-0
_crt_at_quick_exit
_initterm_e
_initterm
_register_onexit_function
terminate
_execute_onexit_table
_crt_atexit
_initialize_onexit_table
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
CorLogClearFilters
CorLogClearMessages
CorLogGetConfig
CorLogGetDefaultFile
CorLogGetFileName
CorLogGetLog
CorLogGetLogEx
CorLogGetLogNew
CorLogOnline
CorLogPopFileFilter
CorLogPushFileFilter
CorLogPutLog
CorLogPutMsg
CorLogReadFileFilters
CorLogReadReset
CorLogSaveFileFilters
CorLogSetConfig
CorLogSetFileName
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=5, id=257, version=30795,
count=61, id=1, productName=Unmarked objects,
count=5, id=260, version=30158,
count=1, id=256, version=30158,
count=1, id=255, version=30158,
count=1, id=151,
count=1, id=258, version=30158,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/emulator_pid16.dll
- IMPHASH ca387eed53051a9fb0ecfde4136cb8b0
- SHA256 3e64562e108f0563c5dab83dd9a0c3792e19029ecf8f2d3341800775e3b22a68
- MD5 45a1cbc35de9a64ec187203c9da90598
- SHA1 28842c907ab779c9b16fb237045ee073612d3923
- SHA512 3400e4fd106ea8ba86fbb32b97961d6cba6e462ad210d7c4f2135966dae3702be5344723bf4cf583fa42349c5a06fec4fa6a82188d805ffc1badd8008e3f6a50
- SSDEEP 98304:jCoM6Gl+bbSA1OpEDDsnhUY+kP7l51v0sDw0r39eec8Yz0:jCX6Gl+bjFnsnhUAJ5ysDwsNet0
- TLSH T1D486F106669D82B8D2A3D53D85D38307F3F2BD5AA755EFCB25D04C400F83AE1696738A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2182464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\!azuresrc\azure_both\x64\Release\awdawd.pdb
bcrypt
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
advapi32
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
GetTokenInformation
OpenServiceW
RegOpenKeyExA
StartServiceW
OpenProcessToken
OpenSCManagerW
RegQueryValueExA
CloseServiceHandle
ConvertSidToStringSidA
RegCloseKey
CreateServiceW
CryptHashData
CryptCreateHash
CryptEncrypt
user32
MessageBoxA
ToUnicode
GetDesktopWindow
UpdateWindow
GetKeyState
SetWindowDisplayAffinity
ScreenToClient
FindWindowW
TranslateMessage
SetLayeredWindowAttributes
ClientToScreen
EnumWindows
GetForegroundWindow
LoadCursorW
SetCursor
GetClientRect
SetCursorPos
GetWindowLongW
GetWindowThreadProcessId
MapVirtualKeyW
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
GetSystemMetrics
ShowWindow
GetAsyncKeyState
DispatchMessageW
GetClipboardData
SetClipboardData
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
PeekMessageW
MoveWindow
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateContext
CryptBinaryToStringA
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CryptStringToBinaryA
CertFindCertificateInStore
ws2_32
recvfrom
getsockname
getsockopt
ntohs
sendto
connect
getpeername
WSASetLastError
WSAGetLastError
select
setsockopt
freeaddrinfo
htons
recv
gethostname
socket
__WSAFDIsSet
send
WSAStartup
getaddrinfo
inet_pton
listen
ioctlsocket
WSAIoctl
closesocket
bind
accept
WSACleanup
htonl
ntohl
d3d9
Direct3DCreate9Ex
kernel32
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
ExitProcess
DeleteCriticalSection
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
SetLastError
GetCurrentProcess
LoadLibraryExA
GetUserDefaultUILanguage
InitializeCriticalSectionEx
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetTickCount64
GetLastError
GetFileAttributesA
Process32NextW
Process32FirstW
CloseHandle
LoadLibraryW
CreateThread
GetLocalTime
Beep
LocalFree
shell32
ShellExecuteA
ole32
CoInitializeEx
CoCreateInstance
imm32
ImmSetCompositionWindow
ImmAssociateContextEx
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
_Mtx_unlock
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
shlwapi
PathFileExistsW
winmm
timeBeginPeriod
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memset
strchr
strrchr
memmove
memcmp
memchr
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
__std_type_info_destroy_list
__std_exception_copy
strstr
__std_terminate
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fgetpos
setvbuf
ungetc
fgetc
__stdio_common_vsprintf_s
fsetpos
_fseeki64
_get_stream_buffer_pointers
_lseeki64
fputc
_open
fopen
_close
__stdio_common_vsscanf
fread
_write
__stdio_common_vsprintf
_wfopen
fwrite
_read
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
fputs
ftell
feof
fgets
api-ms-win-crt-string-l1-1-0
wcslen
_strdup
strncpy_s
strcspn
strncpy
strncmp
strcmp
tolower
strpbrk
isupper
strlen
_stricmp
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
realloc
malloc
free
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
strtod
strtol
atoi
strtoll
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_cexit
exit
_initialize_onexit_table
__sys_nerr
_register_onexit_function
strerror
_crt_atexit
_beginthreadex
_initterm_e
terminate
_execute_onexit_table
_errno
_getpid
api-ms-win-crt-math-l1-1-0
atan2
sin
fmod
floorf
fmodf
expf
_dsign
sinf
sqrt
cosf
ceilf
tanf
cos
powf
sqrtf
acosf
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_unlink
_lock_file
_unlock_file
_access
_stat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
normaliz
IdnToAscii
wldap32
ord30
ord79
ord301
ord33
ord32
ord27
ord35
ord200
ord26
ord22
ord41
ord50
ord45
ord143
ord60
ord211
ord217
ord46
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4.7MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33145,
count=6, id=257, version=35721,
count=8, id=253, version=35721,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=28, id=261, version=35721,
count=1, id=260, version=33145,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=33, id=257, version=33145,
count=460, id=1, productName=Unmarked objects,
count=9, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_key_0.pem
- SHA256 6151c0e3bb90aeedbb8a0f39d061a4965f1b6088e943a8ecfdb8e6d435a87997
- MD5 92a9eda8049726781f887e5844b5730b
- SHA1 ec86511ecef80b8afd789a2dc8acd153300b0ed2
- SHA512 29b4fad0fe91963e00df32829429c143525f7968208e5de2817c5d21ee5fca29306e070e1c821f8f36aa013d861e49ceaf140539c3c3d7e44ae7ff86f927ae2e
- MD5 SHA1 SHA512
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_key_1.pem
- SHA256 c3837320503ce41c63814abdab124c70ddb69e77fd56355d567199a9122bc706
- MD5 2a520ab6c75fe1474f2dea17dd733927
- SHA1 66a07de7f40a326bdcc9df86ff9d92e6aeda6e48
- SHA512 fda66f783dd394a0439fac76fc70009dbe7cb3339cf1c949234d67aef830059637a2acdf3cd90d316bc6fd5e6e01ba5c11733c782cb1c5b0d9e9f25279001426
- TLSH T12E614B04C15DCED3F2EA8464EEC7570F5E52DAB11995D2C5FDD4A25D2E0230106BED68
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_key_2.pem
- SHA256 7f909ba291ead776b0de0e209e3f642d4e22d10d550b496014744a3c700a56fd
- MD5 540938350d1e1d3d140f638d9123166d
- SHA1 5b174fb265a8435578a47b16a26641058dc9e824
- SHA512 261c9332a21d6d3f6335c5eed5608952e936a9d7d6c50ce19bfcab76200a3afc764d5da4c5db54a3699d339cf48b570561ec802f3ba7f96070057daf517b5699
- TLSH T11FF0DC63CE4C88CF002AFE6129A31588E4E830E76FF4C0B70728D14B4745C81A94FCAE
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll
- IMPHASH f2582f93e6ded6621e97630f3a5e629b
- SHA256 17cfdd676902bc2622d2b9943c5d2baf2144f75b55226558ed6746a120fe2938
- MD5 0a7cb9b5657ad9ad08a3eb100ed4240e
- SHA1 31f70bb3245411b8c8bf1896179520389dd061a6
- SHA512 ac82f840d1d2258027e46e19c51b9f6e5b124afe316ea34a20ae592256d72477be70d1059eb93c1181a521c4a64cc8a7d58c5c8d851e26d5e8c9cb7d0c1f0ebb
- SSDEEP 24576:EH2jcItbkdC3Z96Y3Gq17oh1GCiRY40/nh0lhSMXlKmN1eCJWi61:EH2jcts1um6KJBg
- TLSH T1CB95174AEA7641E1C1FAC13C9153612FFCB134AA8334A7D79B859F471B627E4A63E700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
963344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThread
GetThreadContext
VirtualAlloc
VirtualFree
CreateDirectoryW
GetFileSize
GetLocalTime
GetModuleHandleA
VirtualProtect
GetDiskFreeSpaceExW
GetFileAttributesW
IsDebuggerPresent
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessHeap
SleepEx
CreateMutexA
SetThreadContext
GetLogicalProcessorInformationEx
GetNativeSystemInfo
EnumSystemFirmwareTables
GetSystemFirmwareTable
GetPhysicallyInstalledSystemMemory
IsWow64Process
IsWow64Process2
LoadLibraryW
LocalAlloc
SetThreadAffinityMask
IsNativeVhdBoot
BuildCommDCBAndTimeoutsA
GetComputerNameA
K32EnumProcesses
K32GetModuleBaseNameA
RaiseException
SetUnhandledExceptionFilter
SetEndOfFile
WriteConsoleW
HeapSize
SetConsoleTitleA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
HeapReAlloc
HeapFree
HeapAlloc
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary
ExitThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RtlUnwindEx
RtlLookupFunctionEntry
GetProcAddress
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
K32EnumProcessModules
GetConsoleWindow
SetConsoleTitleW
SetConsoleOutputCP
SetConsoleCtrlHandler
SetConsoleMode
GetConsoleMode
MultiByteToWideChar
LocalFree
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
DisableThreadLibraryCalls
GetTickCount64
GetSystemTime
GetSystemInfo
OpenProcess
CreateProcessW
GetCurrentThreadId
CreateThread
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
Sleep
WaitForSingleObject
DeviceIoControl
CreateNamedPipeW
ConnectNamedPipe
GetLastError
CloseHandle
Beep
OutputDebugStringA
WriteFile
SetFileAttributesW
InterlockedFlushSList
RtlPcToFileHeader
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
SetFileAttributesA
ReadFile
GetFileAttributesA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
CreateFileA
SetStdHandle
GetStdHandle
WakeAllConditionVariable
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetFileInformationByHandleEx
AreFileApisANSI
CreateFile2
GetFileAttributesExW
FindFirstFileExW
GetStringTypeW
WideCharToMultiByte
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetSystemTimePreciseAsFileTime
InitOnceComplete
InitOnceBeginInitialize
GetLocaleInfoEx
FormatMessageA
RtlUnwind
user32
SetWindowPos
UpdateLayeredWindow
ShowWindow
DestroyWindow
IsWindow
GetAsyncKeyState
GetSystemMetrics
GetForegroundWindow
GetDC
ReleaseDC
CreateWindowExW
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
SystemParametersInfoW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetDesktopWindow
FindWindowA
QueryDisplayConfig
RegisterClassExW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
gdi32
GetDeviceCaps
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
advapi32
CryptCreateHash
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ChangeServiceConfigW
CloseServiceHandle
RegGetValueW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExA
RegEnumKeyExW
RegEnumKeyExA
CryptDestroyHash
CryptHashData
OpenProcessToken
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
ControlService
shell32
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteExW
ole32
CoInitializeEx
CoTaskMemFree
CoCreateInstance
crypt32
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptImportPublicKeyInfoEx2
CertStrToNameA
CertCreateSelfSignCertificate
CryptStringToBinaryA
CryptBinaryToStringA
PFXImportCertStore
PFXExportCertStore
bcrypt
BCryptExportKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinalizeKeyPair
BCryptDestroyKey
BCryptImportKeyPair
BCryptHashData
BCryptGenRandom
BCryptDestroyHash
BCryptCreateHash
BCryptFinishHash
winhttp
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpReadData
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetOption
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpConnect
shlwapi
PathMatchSpecA
wininet
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
ws2_32
recv
send
setsockopt
socket
WSAStartup
listen
inet_pton
htonl
closesocket
bind
accept
htons
WSAGetLastError
connect
secur32
FreeCredentialsHandle
DecryptMessage
EncryptMessage
FreeContextBuffer
QueryContextAttributesW
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleW
gdiplus
GdipFillEllipseI
GdipFillRectangleI
GdipGraphicsClear
GdipFillPath
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipSetClipRegion
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipDeletePen
GdipCreatePen1
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipCreateLineBrushI
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDeleteRegion
GdipCreateRegionPath
GdipAddPathEllipseI
GdipAddPathArcI
GdipClosePathFigure
GdipResetPath
GdipDeletePath
GdipCreatePath
GdiplusStartup
GdipFree
GdipAlloc
GdipResetClip
GdipCreateBitmapFromScan0
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDrawPath
setupapi
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
tbs
Tbsip_Submit_Command
Tbsi_Context_Create
Tbsip_Context_Close
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
404KB
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
167KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=195, id=261, version=33145,
count=8, id=259, version=33145,
count=17, id=260, version=35721,
count=12, id=259, version=35721,
count=96, id=261, version=35721,
count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=20, id=260, version=33145,
count=1, id=262, version=33145,
count=37, id=257, version=33145,
count=445, id=1, productName=Unmarked objects,
count=17, id=261, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.id0
- SHA256 262fc6d0958ce746fd06a522bddb178b352df79ec8edd48735531243b8ac8e8b
- MD5 76f26de53d839950543e91057ee0d412
- SHA1 80a091b4f2b3b3d710f3bb16bda2aa0a01d9f417
- SHA512 1a2f1c3e7a20769dd3d1c4f5a18ee2508579184f08fe9bf75ad02bf90629032b9d3eaad15b309f7dba9b4e9effe9ced46bbc1e0a3ebdbcb37bc4c1468bed32dc
- SSDEEP 49152:SF6kv8xe6Y/ohTV72yXCl99bulyOSxFX4lYFAxfH6Q57YqQBIN1AWN8TtJI7Wqpv:S0kExe6Cvh7ImOvNIryGU0dSKlQ
- TLSH T1CB178355B7C79D35C0A44A328DBAA3383B18DDA7860F2B23B3317B5565FB3009B60B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.id1
- SHA256 5c299eafd12a396f256241eabb3753d8fbb4d6e7f44660ca3c59634ced8cb43f
- MD5 73af29c490ba1836ad08b1b599752a5d
- SHA1 4c4bed64219d3674b353def89d4fe835bd91280e
- SHA512 91feb29b88be02966116984275cfa7cccca0730ebe38199b1916a067c09229d6606998cb3c407a41d111e9e4545f1b55ef99585ee86b45010336b327eab50819
- SSDEEP 12288:jgzge5SQ7pWtlUHzIK01mtJtH9NBVdgq5ET/FnJPDqH:XnSsqH
- TLSH T1DA76157673CD1D89C1C066306A5F8B37D1EAC5EACA7DE897819B2900FD7E9E0839019D
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.id2
- SHA256 b04c5170d33b19da0780446c4703842010495ef736c0cf7c66ca29547312742b
- MD5 95453c60671dc8ae5e4fa7bb4257cf29
- SHA1 0d93277e74d3a29a3650f078738faa778501c94e
- SHA512 94e8670c881b9d9381719d4b5d7a71a66f2d110188e948ab181afb01206d7f16b72f383b7de14c46f30ce274e285567789335335578d1a41ddc5d70132f953ef
- SSDEEP 48:z0BDuJuuajlu/huhsDBuhsae2guhs7ueuuueuuuVsu+umvJw7uuXPMuuyuuoeuuD:TRcN
- TLSH T14FE1BB722F830B52D1C511F490A35731EFADFDC686ADA34027317AA1AE727695B22DF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.nam
- SHA256 e3aa8a51973204e3b91b3664cb85cb5bb3f3ac156620eb9e85af2ace7697b9f3
- MD5 016005496b9355b4e0885491f4b400e9
- SHA1 2cb5ea68af15681a3ab798e564de324d97897af1
- SHA512 1f9ac7da45f6585d3ff6a26b999a57890163fae27f1cdfa07e0ae28435c3004fa53d559c38694b84dc97cb64261b9a9ccd423eaf4ad351bc4afde0f7a5579668
- SSDEEP 768:yU1goH52Gq3kMShcqAbwO7ca5w1IAP5hZT+FTNwDFqHQI:yU1zH52GbfkQa5oIuDT+5q8wI
- TLSH T19D53B95A6C904CA2C7CCBB7886274E1FA3EA1A450141B3BCB76758C6EC563C6D17287E
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13.dll.til
- SHA256 92b5e2086f9d3681c580c6343e6ff94268ba67790f3b55c56300305cc814e265
- MD5 599ba12f515b209dcd37c3d7a273e518
- SHA1 450c87958186b4dbdda3a4e12fba2dcfd4b14d50
- SHA512 2dac91068c8928d5d67debc426166e706ceaf4702701be3386695b8a9425ad14e56c74d018b6575437a1ee3906cc8f68738c4e5fda5ac40b9cf05b7e196fec25
- SSDEEP 768:eJQ3JayUDZuDYkHR18rDEtwYFTN9mWv6gehdWj4S:eJQ3JayUDZuDjHR6EtwYFTZv7jt
- TLSH T1B0E2D7223B63FB56FD9A117D0D2C04C681A9C2512F3197716EE2ED8C0782D7C99F6B92
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/relic_pid13_cheat.dll
- IMPHASH f2582f93e6ded6621e97630f3a5e629b
- SHA256 17cfdd676902bc2622d2b9943c5d2baf2144f75b55226558ed6746a120fe2938
- MD5 0a7cb9b5657ad9ad08a3eb100ed4240e
- SHA1 31f70bb3245411b8c8bf1896179520389dd061a6
- SHA512 ac82f840d1d2258027e46e19c51b9f6e5b124afe316ea34a20ae592256d72477be70d1059eb93c1181a521c4a64cc8a7d58c5c8d851e26d5e8c9cb7d0c1f0ebb
- SSDEEP 24576:EH2jcItbkdC3Z96Y3Gq17oh1GCiRY40/nh0lhSMXlKmN1eCJWi61:EH2jcts1um6KJBg
- TLSH T1CB95174AEA7641E1C1FAC13C9153612FFCB134AA8334A7D79B859F471B627E4A63E700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
963344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThread
GetThreadContext
VirtualAlloc
VirtualFree
CreateDirectoryW
GetFileSize
GetLocalTime
GetModuleHandleA
VirtualProtect
GetDiskFreeSpaceExW
GetFileAttributesW
IsDebuggerPresent
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessHeap
SleepEx
CreateMutexA
SetThreadContext
GetLogicalProcessorInformationEx
GetNativeSystemInfo
EnumSystemFirmwareTables
GetSystemFirmwareTable
GetPhysicallyInstalledSystemMemory
IsWow64Process
IsWow64Process2
LoadLibraryW
LocalAlloc
SetThreadAffinityMask
IsNativeVhdBoot
BuildCommDCBAndTimeoutsA
GetComputerNameA
K32EnumProcesses
K32GetModuleBaseNameA
RaiseException
SetUnhandledExceptionFilter
SetEndOfFile
WriteConsoleW
HeapSize
SetConsoleTitleA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
HeapReAlloc
HeapFree
HeapAlloc
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary
ExitThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RtlUnwindEx
RtlLookupFunctionEntry
GetProcAddress
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
K32EnumProcessModules
GetConsoleWindow
SetConsoleTitleW
SetConsoleOutputCP
SetConsoleCtrlHandler
SetConsoleMode
GetConsoleMode
MultiByteToWideChar
LocalFree
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
DisableThreadLibraryCalls
GetTickCount64
GetSystemTime
GetSystemInfo
OpenProcess
CreateProcessW
GetCurrentThreadId
CreateThread
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
Sleep
WaitForSingleObject
DeviceIoControl
CreateNamedPipeW
ConnectNamedPipe
GetLastError
CloseHandle
Beep
OutputDebugStringA
WriteFile
SetFileAttributesW
InterlockedFlushSList
RtlPcToFileHeader
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
SetFileAttributesA
ReadFile
GetFileAttributesA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
CreateFileA
SetStdHandle
GetStdHandle
WakeAllConditionVariable
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetFileInformationByHandleEx
AreFileApisANSI
CreateFile2
GetFileAttributesExW
FindFirstFileExW
GetStringTypeW
WideCharToMultiByte
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetSystemTimePreciseAsFileTime
InitOnceComplete
InitOnceBeginInitialize
GetLocaleInfoEx
FormatMessageA
RtlUnwind
user32
SetWindowPos
UpdateLayeredWindow
ShowWindow
DestroyWindow
IsWindow
GetAsyncKeyState
GetSystemMetrics
GetForegroundWindow
GetDC
ReleaseDC
CreateWindowExW
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
SystemParametersInfoW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetDesktopWindow
FindWindowA
QueryDisplayConfig
RegisterClassExW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
gdi32
GetDeviceCaps
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
advapi32
CryptCreateHash
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ChangeServiceConfigW
CloseServiceHandle
RegGetValueW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExA
RegEnumKeyExW
RegEnumKeyExA
CryptDestroyHash
CryptHashData
OpenProcessToken
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
ControlService
shell32
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteExW
ole32
CoInitializeEx
CoTaskMemFree
CoCreateInstance
crypt32
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptImportPublicKeyInfoEx2
CertStrToNameA
CertCreateSelfSignCertificate
CryptStringToBinaryA
CryptBinaryToStringA
PFXImportCertStore
PFXExportCertStore
bcrypt
BCryptExportKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinalizeKeyPair
BCryptDestroyKey
BCryptImportKeyPair
BCryptHashData
BCryptGenRandom
BCryptDestroyHash
BCryptCreateHash
BCryptFinishHash
winhttp
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpReadData
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetOption
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpConnect
shlwapi
PathMatchSpecA
wininet
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
ws2_32
recv
send
setsockopt
socket
WSAStartup
listen
inet_pton
htonl
closesocket
bind
accept
htons
WSAGetLastError
connect
secur32
FreeCredentialsHandle
DecryptMessage
EncryptMessage
FreeContextBuffer
QueryContextAttributesW
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleW
gdiplus
GdipFillEllipseI
GdipFillRectangleI
GdipGraphicsClear
GdipFillPath
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipSetClipRegion
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipDeletePen
GdipCreatePen1
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipCreateLineBrushI
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDeleteRegion
GdipCreateRegionPath
GdipAddPathEllipseI
GdipAddPathArcI
GdipClosePathFigure
GdipResetPath
GdipDeletePath
GdipCreatePath
GdiplusStartup
GdipFree
GdipAlloc
GdipResetClip
GdipCreateBitmapFromScan0
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDrawPath
setupapi
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
tbs
Tbsip_Submit_Command
Tbsi_Context_Create
Tbsip_Context_Close
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
404KB
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
167KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=195, id=261, version=33145,
count=8, id=259, version=33145,
count=17, id=260, version=35721,
count=12, id=259, version=35721,
count=96, id=261, version=35721,
count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=20, id=260, version=33145,
count=1, id=262, version=33145,
count=37, id=257, version=33145,
count=445, id=1, productName=Unmarked objects,
count=17, id=261, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dlls/unknown_pid16.dat.enc
- IMPHASH ca387eed53051a9fb0ecfde4136cb8b0
- SHA256 3e64562e108f0563c5dab83dd9a0c3792e19029ecf8f2d3341800775e3b22a68
- MD5 45a1cbc35de9a64ec187203c9da90598
- SHA1 28842c907ab779c9b16fb237045ee073612d3923
- SHA512 3400e4fd106ea8ba86fbb32b97961d6cba6e462ad210d7c4f2135966dae3702be5344723bf4cf583fa42349c5a06fec4fa6a82188d805ffc1badd8008e3f6a50
- SSDEEP 98304:jCoM6Gl+bbSA1OpEDDsnhUY+kP7l51v0sDw0r39eec8Yz0:jCX6Gl+bjFnsnhUAJ5ysDwsNet0
- TLSH T1D486F106669D82B8D2A3D53D85D38307F3F2BD5AA755EFCB25D04C400F83AE1696738A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2182464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\!azuresrc\azure_both\x64\Release\awdawd.pdb
bcrypt
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
advapi32
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
GetTokenInformation
OpenServiceW
RegOpenKeyExA
StartServiceW
OpenProcessToken
OpenSCManagerW
RegQueryValueExA
CloseServiceHandle
ConvertSidToStringSidA
RegCloseKey
CreateServiceW
CryptHashData
CryptCreateHash
CryptEncrypt
user32
MessageBoxA
ToUnicode
GetDesktopWindow
UpdateWindow
GetKeyState
SetWindowDisplayAffinity
ScreenToClient
FindWindowW
TranslateMessage
SetLayeredWindowAttributes
ClientToScreen
EnumWindows
GetForegroundWindow
LoadCursorW
SetCursor
GetClientRect
SetCursorPos
GetWindowLongW
GetWindowThreadProcessId
MapVirtualKeyW
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
GetSystemMetrics
ShowWindow
GetAsyncKeyState
DispatchMessageW
GetClipboardData
SetClipboardData
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
PeekMessageW
MoveWindow
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateContext
CryptBinaryToStringA
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CryptStringToBinaryA
CertFindCertificateInStore
ws2_32
recvfrom
getsockname
getsockopt
ntohs
sendto
connect
getpeername
WSASetLastError
WSAGetLastError
select
setsockopt
freeaddrinfo
htons
recv
gethostname
socket
__WSAFDIsSet
send
WSAStartup
getaddrinfo
inet_pton
listen
ioctlsocket
WSAIoctl
closesocket
bind
accept
WSACleanup
htonl
ntohl
d3d9
Direct3DCreate9Ex
kernel32
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
ExitProcess
DeleteCriticalSection
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
SetLastError
GetCurrentProcess
LoadLibraryExA
GetUserDefaultUILanguage
InitializeCriticalSectionEx
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetTickCount64
GetLastError
GetFileAttributesA
Process32NextW
Process32FirstW
CloseHandle
LoadLibraryW
CreateThread
GetLocalTime
Beep
LocalFree
shell32
ShellExecuteA
ole32
CoInitializeEx
CoCreateInstance
imm32
ImmSetCompositionWindow
ImmAssociateContextEx
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
_Mtx_unlock
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
shlwapi
PathFileExistsW
winmm
timeBeginPeriod
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memset
strchr
strrchr
memmove
memcmp
memchr
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
__std_type_info_destroy_list
__std_exception_copy
strstr
__std_terminate
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fgetpos
setvbuf
ungetc
fgetc
__stdio_common_vsprintf_s
fsetpos
_fseeki64
_get_stream_buffer_pointers
_lseeki64
fputc
_open
fopen
_close
__stdio_common_vsscanf
fread
_write
__stdio_common_vsprintf
_wfopen
fwrite
_read
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
fputs
ftell
feof
fgets
api-ms-win-crt-string-l1-1-0
wcslen
_strdup
strncpy_s
strcspn
strncpy
strncmp
strcmp
tolower
strpbrk
isupper
strlen
_stricmp
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
realloc
malloc
free
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
strtod
strtol
atoi
strtoll
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_cexit
exit
_initialize_onexit_table
__sys_nerr
_register_onexit_function
strerror
_crt_atexit
_beginthreadex
_initterm_e
terminate
_execute_onexit_table
_errno
_getpid
api-ms-win-crt-math-l1-1-0
atan2
sin
fmod
floorf
fmodf
expf
_dsign
sinf
sqrt
cosf
ceilf
tanf
cos
powf
sqrtf
acosf
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_unlink
_lock_file
_unlock_file
_access
_stat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
normaliz
IdnToAscii
wldap32
ord30
ord79
ord301
ord33
ord32
ord27
ord35
ord200
ord26
ord22
ord41
ord50
ord45
ord143
ord60
ord211
ord217
ord46
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4.7MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=33145,
count=6, id=257, version=35721,
count=8, id=253, version=35721,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=28, id=261, version=35721,
count=1, id=260, version=33145,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=33, id=257, version=33145,
count=460, id=1, productName=Unmarked objects,
count=9, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dodicom_loader.bin
- SHA256 5e88b5704fc86a859a61ee77cb0264e06f3fba8384027c381ea089fa5070cf10
- MD5 33921bf24e97df32de9a566492894617
- SHA1 6249de1fcd31e85b6a2fcbf54908d64b1f3726da
- SHA512 4fb61600238c45ab54a1d0d23b18220ca2181789d1bb40d610ddb6665cca75aca30d73aae30cf809acc01c1dc7ab25b0155ed62b2250050ce72b74729626daf2
- TLSH T18F51B43AA2510234C1538145B2B9F3BC3A364212A6034B40A36DF879FA9CDE710EBEDC
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/dodicom_loader.exe
- SHA256 c914a3cc2c3cf7ad18b66e33d5fe8122eb1af02758c596f35c9bebfc094d81fa
- MD5 51b836cf306d2a5674ef317c42fab276
- SHA1 bf6dee1cbb022bfdede50c0314c26a3fc428a7ad
- SHA512 538fcd6c230f193ffa1d206b011f4fff62bd93ae68aa2c9e08e0d9d1aa5b678ce7a7a1d6c61af93e452e5ba36afd765c2be412c1e406c00ea24f928df8f8a761
- TLSH T14B51B63AD2511634C193014576BAF7BC3A354221AB034A40A79DF83AEACCDE710EBDDC
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/eonauth_openapi.json
- SHA256 40b5abff9bcfca78b18d99cc59f102bbbbb84c7e5fffa62dc2471b18b96e0dbe
- MD5 7d5edd92482ec707cd23da4b7bff79d9
- SHA1 f4f053690ae473cfba26016527a577225b6ed7ef
- SHA512 c819798d85c64a508ffb1f52641966f247894f82ce8a9c4d5a1a72d4a6f0f377e7c52b5871a112b84e37e62898ccea411e0c33c6481265b524adc89dd8e8ab9f
- SSDEEP 384:HU6cxCLpu66ESEG6E/mG6Ew3G6EChG6EJIG6E24rrp6EGTR6EV66EWoc6EDp0w6/:HmDWyA0dnE4vaoreW
- TLSH T1C643DDE62C22ACF75F9E85D79CB9EC4F70B40155CBE4D916D4D0A48E418C6FEBEA2006
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/index.html
- SHA256 3beda7d7c05ff74c440521dea43d3faa711d40093b8551d5b596a0fec2f01754
- MD5 0cb7d3bfd7e2250a791d1b27b4c7518d
- SHA1 d8f1b3b844ad2831442568360b8f86abac0078f7
- SHA512 703c9af935abe92c543a8a20451fac74a67db5f3a3df00cb82c835b91b05f5e4a6526b3d25d608406ba18dfcb0b861fa3a5a35473cc2d0c06a16b0507a5c103d
- SSDEEP 96:9pbKK8Na5jvzcx0OoJLzuW4cLs9vifdSxRIhF41UY7XmQ9p0GmEPRY:Dug5vzcyOoJ/uW4cLACd8R8uUYrmQ9pe
- TLSH T128A18427D3A50818A06681384FEB720C9171904B9D03AE0CFB9D63CDCFDAAA98572F64
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_app.js
- SHA256 e44a174be55b1f001eccbd07029290c2c1bc4432711f90469df056b202283aa9
- MD5 18277982b2fa4d02346435cfd5d827eb
- SHA1 028b52a124e02ad00db694138b967abe1461a101
- SHA512 9524aafa152aae89516b556530adc281176fa63c7ea6110e19cec4afb3869a39ff426bc6b0c9fb9343a7f36a8d1b0b0bf057f477a3276163978f5c1635a06dd9
- SSDEEP 96:grsiVjgpqwzWvlBoKPlIiGl/KtZGYjY2oRawGmVpmrcj3iwQ:wuS8NiqyDTG0lwQ
- TLSH T1E9C11EB85AC3247A3453D4DE67B743CB3C6AA023A407D8113A6CF3916FC9F1092A65F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_balance.php
- SHA256 a940fe129c1b3c9b006fdaa2f5e43910e045117625e46984f3c464f293b12608
- MD5 17acfc4575a740dc8fa92746ca5ad0d2
- SHA1 9fdb91e267b6fbaf4766d50a6ced09a117181495
- SHA512 b0ff817fe065f30d9a7b4831932847c77dc666941a6db9ca3f190e231078ec2a14b23905de3de8f1d669efe4b0fb3a740235913241b2c35f808b554abda9e4e2
- SSDEEP 192:XdUXPhKdCQRE1qRE59FanAi69C+Ge7AYHg:XdUXPMFRgGE59Fg/GqX
- TLSH T1A3F1942971F71F222F934CEA668F76663E42C50B924BC9047DDC93E81F85C64CD67282
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_balance_checkout.php
- SHA256 faa15c3899bd91081aef10f29b7e9b0eb0978628e4bbfdb454bb368c28582381
- MD5 20567b30d5431620308b8e4d691417a3
- SHA1 9880da99ed74759a298a1af698b4aea117acdbd2
- SHA512 26e0521535daee4943b9c9801d734b091cef332a831dd2a80bf44e30190eec29743fe069b8c1d60d02cbddeff42441b3b22070cc8e1bf28453c2e4f9843ed61f
- TLSH T13481F85980B69E723E7AA0AA448F515AA40F1DD7DB802531FCAC733C0F5C2A9D575CD1
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_changelogs.php
- SHA256 31441379d0792e21edf64ed41dac7939a1fb91eedae8030cab283cf506d1c583
- MD5 e12caea32e69b81b9d29e6825a10e3da
- SHA1 093d253fbc03e9ff052593fc79882671b2306ab1
- SHA512 151f33c8d4137fb770935cdabb34bc2a8d7276646adf133f11b2921851e3696aa6bc2bf6feb47bbe01c7d4c8c20651104db8fa0a686b33df5b1b3a562ec16d81
- SSDEEP 192:+BjrwxhsRE8fRWNYxT0V4D2Nhe0ophlw7yHKk5E6cMyJpDHnVArWM2POxy:+lfE8JS6TE4oheFha7IUHV+WYxy
- TLSH T11C42C531F4F54E21028348692F9985063FDBC653D60BAA0575DCA7C48F9AC86CE6BBF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_config.php
- SHA256 ffdccdb01ce092fa503c99ba425903c331e14523457772d04dc8db59258666b3
- MD5 da68359a0056b44b619cbc0dccb3481a
- SHA1 b96302a288c723b3ad775f5359b7f4e268192241
- SHA512 76f6af0dcc17ae4a1080b2e304f705c50b51cb77840665c3d2ba31165853c5fe04402c97ccc1a39260936fee0b774db628e4af845c631438c4108772c498c843
- SSDEEP 192:Y0ZaSsEHvlzSobNxiQGWXAvQBWGgNPKuhgJqOC9X+EbAF+jA9yQj8BWHonECPbxl:Y0ZdJHvlzSobNRhy1Wh8BrP17cyIH7E
- TLSH T1264274B930E759213EA7D65E5B89949E3124FC03B544EA64B42CB0847FDCB9CC270DB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_credits.php
- SHA256 e4611527aab3789b0aab33f865dcc8ba89b605275fdb305bcba2705df408b1ac
- MD5 a0734d5c5d7805bd0907fa039572bd9b
- SHA1 425107b345f5d7aaf2d0b38cb947d919469e2d0b
- SHA512 fa67e36f3d9213c9d99cb682938c21338959a1d792c95f46759a06c438091a7078c8930693eab5a626a9cec8b7c77a8b2d87ca1effd9e0c746b0415f6a9dbd80
- SSDEEP 96:G7isMFxVMS5btHHFycb6V295P83bkvOOfZUQm:iMF7MS5btHlycGIPbg
- TLSH T154D14E3670F15F3228438CE72A86FA272ED6C013A30E48143DDD97ED8F91D878A5BA55
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_generate.php
- SHA256 2856508b9dd7143c19d41a7e1e80a9fbc0313e84546ca60f702de17da7b85075
- MD5 d08aca4c7ef9ab41679d209f7a9a94b8
- SHA1 b3d290044d5cfd39169f6cdd6d9cc7098db76c70
- SHA512 6ab4edb64715f81340a297487202d8b777bc38bf5456042a810eb37900f600d06480f7e6ee10a7c9aca42038711a873ded264fdce8062d196aea66da1b085d11
- SSDEEP 192:U+cVOLYjsv59hmdytkffRmbnDXaCyIyDY+6wLb/xlPbVpqXcnRGCc96/BmZAYTGi:Zvu5ffRmb48wLbXTVwmGC7/BB1xi
- TLSH T12792A4B2B1F319312D4790B79BCAA5AA7E305803E144C511BC9CA2C56FC9D44DB72BEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_index.php
- SHA256 24a8828965fb915195bc116ebfdc4783e3e1f1ebcca14ff7e75a9280022bad57
- MD5 0f537eedc9e328b9ae03a3c43e7db589
- SHA1 31234691a13a1b81f26ec0f429bf1ca3d014b362
- SHA512 f469d1f8ebe1f2f85abfd145a2fe69e8329db01a54c1515ffb414d1cd2128431f6cbddc14a06eb3cef338a5cc8f2d32ed72a6a41fad1f6b2c8ea226eda1228c4
- SSDEEP 192:fPRuHeQ3ipCO/ySGkFq3J/9RpTwJ2N5oSUnmWaOz:f5u+CO/bElTpMG5AAs
- TLSH T157A2B622F0F22A2625D248E65F555FBFBE83C503A04E440432BDA2D44FE6DDADC2759E
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_launcher_version.php
- SHA256 84804e460c56c9d0424489f4a9fd730b45339fc33e1d4664beaa32e03332be5d
- MD5 d5831fb679fe7761f6eb6181938813b6
- SHA1 8ac3158a0b5fae4f180701fac5537fc2ce4d4032
- SHA512 a115340f018776b49e041547e3696075b7b73262689549953341c9c85598e82e5cc97bd7d471adb1cbef84fff4b4034e6eb23a60127c622bc0baeb958f5591b8
- SSDEEP 192:1SaeCEXHZHyZwaGiS8T9GTpl3B2973QIG5x+pZAWjXRdpnJeylz59Ts:xEX5HyZwaGilpGtl3g97gfyA
- TLSH T19352B76970E3CB335153469A3A8A65697F73C603A104A52C78DE52C08FCEDCDD6636F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_license_detail.php
- SHA256 8a984cfd6f6b5e400c43eaba89ba5ecd4a31e85ae577763173226ee22269027e
- MD5 a4dbee2d600fcb2d5295e29e8744c01f
- SHA1 0110412c9dc4b6bfe7f5faf8a33bcab5fc7b3a92
- SHA512 0b736c2e0d18dbdad4b4567394f9a2f469e8122f81dfcaae23ec189729c912c1be99321f2dce509be9156c0afe7eefb7da00e9ac4ace57bad20333ca107ff0ad
- SSDEEP 192:Qd4WQNSB4QjVES84VS1SvwYyrG6NxgmoJ0zuWdPegD:YhQNSB4pS8401SvwYyNbxegD
- TLSH T19962A801B0F35F2312C349975E4A2AAF2E178617A30E4801348D63F99FB5D55C9FB2A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_licenses.php
- SHA256 0f01bd22b3c0b58271e366ae3324bd752605dfaeb50a0bf67d1fd49d47b10a8e
- MD5 acda46e6c5b0191e6773a851652428a7
- SHA1 753cd8700bec61a7e26a1cabcb2f46442d065e09
- SHA512 413571efa4480a2a1c9429c2a033aa32eb0d1c44997cc209dc847dfab06af503f44ce607bb242a0b0001dd9abff7b4e60c7c8951f3c7e43514bd457c1bb0301d
- SSDEEP 768:xkwBj8QIL/kdqGVv6lec4INYh/17T0gjfWiL:m6YQLjp1X0kfh
- TLSH T14B03A444B4F36F23068359BA6F8A4AEF3D328503A34D4808388C92E55FE5D51CB7769E
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_login.html
- SHA256 2be9b0f5ddb96791ac0922bd60f3258af00a15122438954ab94e69cfb269744c
- MD5 2b91bfb81c545da6675def84a2d69611
- SHA1 3e88fb989837d9b34c48693302254ccfa8bf242c
- SHA512 ae6d8305ffb8c79b80e3df2018a964095f13cd2751113b675ab86482caf62d300ac2e02a5e52c5362b2ac4b256861f4e56eee59ee486dba1d2a5ddd9468ebe8a
- TLSH T17031956224F5086A2182D0C469B4AE1F3DCADA17CE8F5600B6FC9BD81FD7EC2DD43048
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_login.php
- SHA256 4ab87b882d378260addd7b233c43842bf5497cbb9f2821e77ce8947e31432872
- MD5 b367e41c4b92e9ebb0dab9c5c63384f4
- SHA1 963a0cef50a0a7f8c590a42902720dd2bf68332c
- SHA512 040e524615c000486b0bb594af551daded6eb3241f50bec52a8fbe7552e538398de10a91f84a7c67dfefa8e4835780e497ed3e119e89a7da38ea22f55789b2ef
- SSDEEP 48:eZxvs7PQHoEocargZKhGf0tXlt6hSSJA/MhDMSy+MmjmMVQhAls8WN2xrSGkmgYl:eLvs7PBdrZhYJ4K3RaIAN2rS8gYWxcd
- TLSH T1F2A1637554F309263343C8AD36945A093C89F107B98A4A00BDBDB2C92FDED56CE725F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_logout.php
- SHA256 b73ec3d62a0ff95524ee462c6d7e64171a3c04aa095c559d3d6a0c3eb3a21eed
- MD5 452bb7239776af14bcdfb9289990a3b9
- SHA1 a4887c1f1f9c22d8ed2ba97883eb806a1daa3029
- SHA512 b5c3fb927795e86bbc84dc9b59eda3f752f33b93fab702c7b761afdce2d91c2d45b39da38a214211613ee911945cc1b163b464f153bda35793e1a8ba6211de01
- TLSH T1C8A012B4EC8524305C7F840944D009041631008C31108290437301054D4098C40720B0
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_navbar.php
- SHA256 b7492bd9449d3f934ef5262711528c10ecbf995c9db008001f6626d639ce6534
- MD5 379fcbde853544e713cca5105c7ccec2
- SHA1 1d962f0701ce5ee35e4d5e9a1f7fb34199f917f4
- SHA512 363df160f368b51f4824187058aca7d9056c8726e73ae7b70ba150a23176b739ae32a1463fcc4a345753982cec06ed4576c26fefb6adb8e8d681a1ffb6544edf
- TLSH T18A2136116CF5356313869DDB8278AB7EADE20543F209360BB4BC41868FDED1C9C47D61
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_products.php
- SHA256 2876a14cb2e8451de6332908e9e83f32d5e1c1adfdce7fb205dc86079c2d8f98
- MD5 5486139fbe750e173eb71ba779f20ab5
- SHA1 f20928246f1352245cb11ede8cb9b33ef27818d8
- SHA512 712c3aaeee089875ec0d23dad79d12ac932508af755d545551bf1bdc62b439c316bf66d4b40689036cc0501032bb0923d9e2ea072f4696a565a60a61e7ac903a
- SSDEEP 192:Uo31CVAT+DTkBYm4C7EDNGoMhlvj0wpGaU/:UogAafkBYm5EDAhZAwpU
- TLSH T1E6323ED1F0F24F61208754B7199AAAC63D72C21397CA8C047A8DB2D68F95D82CF6739D
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_resellers.php
- SHA256 87ae68e14c2e711191344bd158745a2cdf3d76249cfbd8e4cd4cac35c857ba53
- MD5 2282cc6224865da2f6e60963f16ad367
- SHA1 ac77d4c03c4c053081c00bf8220e20a10baff426
- SHA512 0bbb0b467ab3fe5200e3d9ca38c1a3340177d033705a7d84903cef79df0e5bd2e7352774c85ca5fb57ae4d037dc6a659c0a8e509cf38779e075b82d85f35b229
- SSDEEP 192:TrA8kn2u11bCscQ+bz8FqZCp3C1iiscOzflWOh1xxL15NcuIzaR:vA8bu/AH/CMxsOQ1HL1dIuR
- TLSH T1E59283A0E0F26E731B8348B727949A8A3D61C0135386994C78DC63D76F9DC46D72B2DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/keypanel_style11.css
- SHA256 cecef4f91fe463b432d76671ac6029aeaef8cd5b2e3e948e70769ce7a21abca9
- MD5 5403465151eaac30ee0933d322d99be8
- SHA1 c5d47553007372f2fb2d33451184d541f6d16eeb
- SHA512 47dc97bf61082dbe1409b6434ca2c13dde797b9e893ba01e5c1f29497a2aa7d8fecf897a316ec3ecd9267f85ee1ec6347240977d8dd71a98bfe33cbd1218decf
- SSDEEP 192:c02sR9LGp/0W5eqd7pOngbWZdYWu72NuAjIFFTH2ZkjCnQmSVi5rsl6w4F/EmzpQ:d2sR9QXH2PZvJ66hbAgyIqZ
- TLSH T1A6B221B19A6348A57816D26D67EB979A33187043B406C97DBA887158CFCC3FC4192FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_deps.py
- SHA256 88dbb05de18fd2f5fe05bb19128dd222443cc2bdd5b213c27f40d0c9a9c2fe71
- MD5 7164d3445d991eb5f46f2d4dd663bbcd
- SHA1 de38a9f795ac2aead185df2258df97d0047ea215
- SHA512 9c2c5ede6198a61b526b3a110cc6a1ba1342ec159391d0de57c7330ddf8e494b74cfa78a1964f869a47c0012d717caa3940db3e0ca3125e06de2f2414ab108c0
- TLSH T173C08C2902AD2BAA3E934309640E276282C186C0446A3C11424942040A8A08EBA819A7
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_index.html
- SHA256 707bee1c7b81182c9ba88093468221f5460191eddc645b1baf8767cab74bbe28
- MD5 8de5e52774bb8f0450abef1e6a440b90
- SHA1 13d1e9fdc06770e153eea52006ada7574b3f3497
- SHA512 a2aef71e4422cec5bb971ce1cb2751464b0bd2998f838b68e00ae5d7a62d12f87c166efc6420cdf16700fc211a432a80d47dbb1770925cbddd9a120b61fe3126
- SSDEEP 768:Ell7IUtPdMAFuqB3I5pSakUiNfJR2ua/IuHGaq9/K051ZAIx/a:ElxIU/M0B3I5pSakjFD8/IRagTZAIx/a
- TLSH T1F113E936327501366857A6E63AE3A75E7794F003E80795383AAC0484CFCAEE5DA777C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_main.py
- SHA256 88dbb05de18fd2f5fe05bb19128dd222443cc2bdd5b213c27f40d0c9a9c2fe71
- MD5 7164d3445d991eb5f46f2d4dd663bbcd
- SHA1 de38a9f795ac2aead185df2258df97d0047ea215
- SHA512 9c2c5ede6198a61b526b3a110cc6a1ba1342ec159391d0de57c7330ddf8e494b74cfa78a1964f869a47c0012d717caa3940db3e0ca3125e06de2f2414ab108c0
- TLSH T173C08C2902AD2BAA3E934309640E276282C186C0446A3C11424942040A8A08EBA819A7
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_router.py
- SHA256 88dbb05de18fd2f5fe05bb19128dd222443cc2bdd5b213c27f40d0c9a9c2fe71
- MD5 7164d3445d991eb5f46f2d4dd663bbcd
- SHA1 de38a9f795ac2aead185df2258df97d0047ea215
- SHA512 9c2c5ede6198a61b526b3a110cc6a1ba1342ec159391d0de57c7330ddf8e494b74cfa78a1964f869a47c0012d717caa3940db3e0ca3125e06de2f2414ab108c0
- TLSH T173C08C2902AD2BAA3E934309640E276282C186C0446A3C11424942040A8A08EBA819A7
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/launcher_schemas.py
- SHA256 2b1b83f9df4d024ff790e9dd49bc0f4a44af6abe74df701800971245ed0e7061
- MD5 f155aed486247b44603c0c58e815e54f
- SHA1 1c207d9dfb4ae45bdfa33082c4957037fa836cd0
- SHA512 5aac23750edf31f80c66b3878a8016a3a4891f0cf07fd9c2173677892f295bc6f73fd0f0d1120d31aed164979b82e5f75d3eae3ab49a8deb146119a7be4a1618
- TLSH T1EAC02B2D026C2F6A2FC34305500E2763C3C1C6C0405A3C11414D02040F4F08EB9814A3
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_account_link.php
- SHA256 75a884d4d80dc2038443f8ce12fef5c8ab82fe9715f1e8c78df7bf2aa78f8479
- MD5 d97cf5a7e0e3c90ee00e1b917be47b3b
- SHA1 f7588002a7b12520cd88da189c0e155c57b1a0c9
- SHA512 0cc8ac0ef1b542aafb35a2e4d0b55419ab86789251d1e3f625905c50b1c4cea1ffec97947a3bf17f1497eecb07c1d9882ea4bc6eacc190faa7de793ef77355cd
- SSDEEP 96:4xbCk3wEs/qvzVI3az+Q5RgfjRxExxnNeOyeJ8291+7oHQQPHgNHS3QN3e:U3wqBIZQsOy08Q87oHQQPHgNHS3QNO
- TLSH T177A1735C70F7E0310AA2543A6B9D5199F61A8C13E21C7821B8FCD4A4AFE46ECD170DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_config_source.php
- SHA256 b517e66accde945d8d31411e708acb04650a5d59d08b5437d2ba4d16a061ac3d
- MD5 f3d55441a6c3f0bb624df9c7c154de66
- SHA1 49b05d413d66dcfefa2c3ee4dade82bf2ff7e01e
- SHA512 645e71f4423ab56891d025c5f045c86c082715e1455a6c85da1bf659f12c583653f2770db852ddb2b63400a32503b69609d60eca027c33176ed7cb2786eebc42
- TLSH T17551448824E3694616E764F80ADBD60C3614C8035418EB16746F83C8BFE1AA8CBF5ED5
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_discord_callback.php
- SHA256 d52c4f689007999cefd1fc49e77d48e77cb6e4fd30f6af484f004d9ea634f2d7
- MD5 4360c9666f43c23917cc1e9c4afd5db0
- SHA1 1b0bad22fdb0216a66f518e2a0fe0e61803fdac0
- SHA512 6d069fb36f5dacb6750a4aac9f055b5f0ef100a9dbfdf32e58ce649c206361682e5a5cb32e50901af6c77843aff6463875aad8123181879ee270ac474f2d4acb
- TLSH T1F421744EB2B09B2A08AA70D000894230760F0D99D41A2734311F65581FC855EE77CDF3
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_discord_config.php
- SHA256 6282dabcf41dad958e63840f1a27111ba0434c9bc679f6f1436cecbaad28fabf
- MD5 874640cf70010bcf460764fc8a20389c
- SHA1 2d8d41c4dde8eabd831a787b2b109bfcef182dba
- SHA512 e3a5c8e9350651d28e7d929209e49e39e830238c386c0540aecc10dd9ec75c3267b4c86ca5b78a0bc97072bcc70f2ea59003549063dd62165f95b1cbd2aed6c5
- SSDEEP 192:WCcvze3NsXotQZBR8nt1r40LXQp+I28DHGz/y28JT3IzssFOfQfbvBpc8v:WCcSbuX0L++InHGz/p8JJfQfbBpJ
- TLSH T1FA1250B8289750203952C17E4A0B958572887C13BC6AB55AFD5DB2682FCC37DE235EF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_index.html
- SHA256 da382eda40aa22d4217c62508be84e9d588fabbbe1cca9a744236ead1411f8bc
- MD5 92154cda4ef93661a61aee8b5af7e235
- SHA1 d339837fd2610684effd5aa789debdce65700768
- SHA512 7fedfabd87fb50778cf92740709a506570e7c164a14a633c61dac230da290f5228280c68e4eac0e1605fe54b449ee1c2455041e97e9f86fdc490ce88fa9e817c
- SSDEEP 192:zli4kTn9nhA2lJNep+hQVojWS66VDPOYAhA4Oj:ujxebOj
- TLSH T1FA22423AE6B3044A7413E13C5FE3A6485360B0137A4ACD647E5CB344CFEE16965B2BB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_index_executed.html
- SHA256 da382eda40aa22d4217c62508be84e9d588fabbbe1cca9a744236ead1411f8bc
- MD5 92154cda4ef93661a61aee8b5af7e235
- SHA1 d339837fd2610684effd5aa789debdce65700768
- SHA512 7fedfabd87fb50778cf92740709a506570e7c164a14a633c61dac230da290f5228280c68e4eac0e1605fe54b449ee1c2455041e97e9f86fdc490ce88fa9e817c
- SSDEEP 192:zli4kTn9nhA2lJNep+hQVojWS66VDPOYAhA4Oj:ujxebOj
- TLSH T1FA22423AE6B3044A7413E13C5FE3A6485360B0137A4ACD647E5CB344CFEE16965B2BB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/loaders_index_source.php
- SHA256 7f19e6dec536d1c55e0c810a6aec4b1c213ca8fe7ffad925f2b2082e67225788
- MD5 c9a16c6d4696d46cf143ff1e73ab6440
- SHA1 e15a9c4af57e570c2a1bc803bcfdd04a286f31e7
- SHA512 164086655b548219236cbb33069a8f45fcbbfbff391d408529b1ca7a2ec2ea002353d0b36dfd3d2798ea440790d15a9e38c28e4b0c0607423d9ee81875897f16
- SSDEEP 192:7967vCI+RnjDF+siZS3xHmli4kTn9nhA2jf8fQ6Fl7vlg9ZKicS6l9iN5kuAZJ7x:796mRnjDF+o846kOf3M2DpjxebOj
- TLSH T18BB2B53AD6B301163843D53C5F83664D3352B113B40ACE187D9CB2889FDE769E5B2AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/relic_auth_full_disasm.txt
- SHA256 ae3e9f1638bbc33f1c331d58e7a86ba1b3c7666f5a24c0561801a25df12621e7
- MD5 caa1c0f55b705cc44f9c454ca0bf4d14
- SHA1 fc0fb954316f1231245bfb3512467d4c1d194f3e
- SHA512 bd5b9fd24792cbe6a9cfeefe421e509fe56189061e1b2566d1324690dd3a5815f0c00453c27e958b6d1cf489135a1736d6f353dabb90432297778b51b39b4893
- SSDEEP 1536:lUcWLw2a+bJ1em+G13CxTxQx/mbe6lV2d1/hIvOT6dEAAa0hklXYrIVY4QHoqwk6:lo7owm4EDEAAtTq5l
- TLSH T16215037010DD1C58F1F3A725E8903DAE121D709BD0E31CA1731DA7A9A7BEAA879C7B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/relic_auth_pseudocode.c
- SHA256 772ca21939d8bc3ef3bde9ca60d218df37352641fcfbbdad6c22b76c13c2ed84
- MD5 8b6b3a4a6011eea9d34db7b214f8eb30
- SHA1 6acec54b32f8a49265bacb95120755923f40d1d5
- SHA512 1e9d82f173ad9e14aa887ea65170f96cc2fa9b338d2815cf22c3816963b7bc3a390cdf4d2df39a5eb035968fe560aa61ea9c8c27d0234bb794c7982dcd766603
- SSDEEP 768:4WGK7MXuKhHa2GP+tw31JCTm27OJ+NCeXbZ:tGK7vkGuw3q7rQeXbZ
- TLSH T13A235D3424A229617A52ED2D87B63C425628B003F748DA51B69F73C05FFC5A8CE75AF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/relic_gateway_workflow.md
- SHA256 cec298619b870a22b89d6604ea84b8db813d36f04bb42ab527eab56de37bf000
- MD5 6e249fcbf041f1ae132715ad6b47590e
- SHA1 54a457bf469242351130d61b9079e952c3819cb0
- SHA512 6ef517242b81c49bb401234ecc6f6e32af561667ece74964eb23fb8182759db82d44bb3e2f7909147930a4b9c0e06cbe0d6f983f6dd408e30917025b2055c883
- SSDEEP 384:rWRiJQA4y0qekPv3Akua2kUBoBl2vwQ0qkX:rW4sqf2khBl+c7X
- TLSH T145B22C382C00AC5C77E6F05EA9135450A2697CA3FA091072F1AD3165DFEED7E82E9DB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/relic_pid13_authflow.md
- SHA256 cc7cffd8134677972edd334247181320510c6b81aabf3744a5c0196fc72df752
- MD5 b823eab6981c22ae7c95119b3868ce6a
- SHA1 1abe57699f7f14e81dc673af4dd6b8aec64af38a
- SHA512 bad6c9e260defea89d3c99a897dafea2fd2cd61c87f6f75d4eb0ec79f4fd88b6ecab9c093219f89c3bf6afdc1d68cc7d542f28e4ef9c5c65ad120517ca82eb0e
- SSDEEP 192:loMHiRiBqyudTPlwCH+TSogVjucJmQjfjPaxFnpYkjI9oX7uXcSsUfXItLYSNsgJ:lohRSqyudTPlw0bI02XnK2odXEgFShJ
- TLSH T13D423A28359110AA0BA7D00DE73A7552DBB4C05A97663866FA6D5724BF1AC2EC37C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/script.js
- SHA256 153e18f7df756ca8e87c204f5ebab05acd9dc70ae285643c164e4db94d1ab73f
- MD5 f65710921e35e3eac39ea6f1a563ce86
- SHA1 5b6aa786d453de5bfeaad9456d9a91e217ab5692
- SHA512 e78e753612aed4d13ed87b93cf42a22326cd8a9b2d2f9149bb011ee85c7e70954363685868b4acdc503f9605a38e07fbc264e1be5aa4fd3899f6a3ffc1cf60c0
- SSDEEP 384:4DVwqDcIKJ+eceJ8G77f8zKdTtkV8T6n6q46m2PIZ:AcIqceuG77k3n6qO2AZ
- TLSH T13992611930B7243285BB60BB538BA2897A2250033D4ADD497E5DC7844FD1FA2E9B3FD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_config.php
- SHA256 92e21f7e9aea5d560282483cb47ac153ecc07f134abab8fc603624843c7b4cfd
- MD5 212ad7e48d7006abda4e2d62c055e892
- SHA1 1be26668a5adaa7f7b87f2f576a8844f9eef80f9
- SHA512 7c3c35349e38020306ea7e168a8ea8b38332d589eb1e024b97fa002734938fe00d4c1cbf32dc4401f7a4f69145cd1db8f5ca4ecea92fa11498fc70187e2a357d
- SSDEEP 96:c7G9K1YxfaYgeF0ENzp5ilUhAPoKNAbUf6ecqorHzCKNKYxEN1qDO0uyzqVeqVqC:V9kQLBNzpc+hIoufxfVDMey3eLr2HG
- TLSH T12C123EB9A1B804607856D63E1A602D53A6143843F4E0B577BB6DB0211FCCA3CCB99CFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_deliver.php
- SHA256 4c0ae431f1423904245a25ad2a5616aacbe488bc20c3992e6d94cccda64126f8
- MD5 191eef552aa3b8c0c29b6a0e693307f8
- SHA1 2453e372fe5bf14d37f23bf5dafe86e8ed8d2acd
- SHA512 5371fd012883e2c858b94ce73d9753fa8933ab48e6455e43c90317f194b81888d08bc227ea281556b3398c756d731326c05bba1b145782c71e6012911e10c263
- SSDEEP 384:mEjTwqSFmpj09RQHAePn1/bf902LX0/kTxK4gc:mCwnRQN1/b9csTx8c
- TLSH T193A2B538F0E2087039A2E52E1B5BA4A562593813F5C99572FD8D73980FDC67CD170EBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_deliver_current.php
- SHA256 4c0ae431f1423904245a25ad2a5616aacbe488bc20c3992e6d94cccda64126f8
- MD5 191eef552aa3b8c0c29b6a0e693307f8
- SHA1 2453e372fe5bf14d37f23bf5dafe86e8ed8d2acd
- SHA512 5371fd012883e2c858b94ce73d9753fa8933ab48e6455e43c90317f194b81888d08bc227ea281556b3398c756d731326c05bba1b145782c71e6012911e10c263
- SSDEEP 384:mEjTwqSFmpj09RQHAePn1/bf902LX0/kTxK4gc:mCwnRQN1/b9csTx8c
- TLSH T193A2B538F0E2087039A2E52E1B5BA4A562593813F5C99572FD8D73980FDC67CD170EBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_delivery.log
- SHA256 e8e6e2e8a80c149583282bbc92157ed995ec89714bd11c59416dcafe18b5b449
- MD5 8e6ac34d359e16242b9fadc2cf1a40f7
- SHA1 e7f6a0d79d1602a3e730113a97d122771bfe77a2
- SHA512 b9147c1cb472d17a515af233e662b0199b6b5ddb7aae19f3eb725689c1aa66a326e1eccd511399553b43a7f9abad601a58f46b5e2d91ac2297d6a410b5100aa0
- SSDEEP 768:dSfq2zdVLMVV/euF//XRT/Qn5QuvXp8SRRYy4:dSfq2zdV+V/pFXXRT/Qnvp8SL4
- TLSH T13F03F54FDAB56C9664C21131B1BBA7C8045C3216EE8AF364774B610A1D8CC376DBCFA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/sellauth_delivery_new.log
- SHA256 42bc9cc821ef5cfc62748b192afb8b89128ac72fe7101ded830283b4a3005db4
- MD5 4bb309b4c5c906bd4aac79844dd0b32c
- SHA1 d8b87bf926514bc634d43bdbdc9346e56a7bbc32
- SHA512 da7f5b759e9d20142b0f299f8f5b5ea6f5f99605967d6083dec4098228ce71a3a0b78addd66ebd2c82a0dfe20720d5565e883888ca7cdf87eeb439dd9cff1654
- SSDEEP 768:dSfq2zdVLMVV/euF//XRT/Qn5QuvXp8SRRYyV:dSfq2zdV+V/pFXXRT/Qnvp8SLV
- TLSH T17903F44FDAB56CA624C21131B1BBA6C8045C3216DE8AF264774B610A1D8CC376DBCFA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/style.css
- SHA256 8e2f260ce013bfa4428f314e0e95224122b062a0a66df3eacb34311f62f12618
- MD5 62fb1f9e133c363ec41efefc1f5bbf08
- SHA1 911b72c91243a0a82abc19a7f7e4157eca3cbd1d
- SHA512 fc49c0e90348e9d2f5e3c2a0cec7b7da8c4428cf0e954ac8ac884bdd445a761ce6d945997458634e1bd4b015b3c6a6f55bab1bfc6489e86f23849f24950238e1
- SSDEEP 192:DpwgsLmAOtz5q6eonGMB2rJSSb6x5EO081JDGhFi5zqZm4z4Pqi2QdKn/41L34xu:1Jtz51eonGMoXmsO74pCpr
- TLSH T102B27668D612215A6633E7B4ABF64718F7686057DF03062E7BEC22450FF52B88162FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/getskins.obj
- SHA256 6f5651367067c7c4a308d239154bf1ec26acfeddaddf9401041738869eebf84f
- MD5 e9662992d82ade3a7c7aa945565fa7ad
- SHA1 82211016e348526602340d1b6640e6fc6a2dc9d7
- SHA512 0fb536f40ef3a46b24b3fc3bdcdb71a209341e294e2a6d72fd6aa13b069b6460730ac54db39d6c444b4afca03220009cff513e95db1e9cc677e22d8fc611c580
- SSDEEP 1536:agTFhuNzLAKh/d1JBWOWKKhdAI83RerIT5jp24Uy7N3HztExFB/ob2b/WYQrUTnW:0t2TK7T5phy/Br3dAhI0WzrcMCIaX
- TLSH T196C495F4A3D8A6A1F74FD4B99C383EAC1747397B2ED2A5840EE59D50E533BD11E08842
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/hypermallknife.obj
- SHA256 7a2f8f4a264ae9947b078c21c18034afe6c50dc90c84f933f8d82cf073e9d233
- MD5 7a335aa559e1875e1a335ca17774dc21
- SHA1 f06c34b86a3692464b265ecc41277d1dc3576301
- SHA512 89637e7626219587fd42b67b180f3d14bd0c3ce65138d9ce3ecb915f8cb9b432d9c0ab817257fbf86de5bdc7cc06033c1d426ecb0e266277f4b6201c59e74f59
- SSDEEP 3072:GvTjRxxsXXRgoXZNGNnCkepeXG72Pd69OSoJD6dLmFGVVpqs:BWSoJD6tmF8
- TLSH T1922551E0D7E8B1A1F2CED4B95C393BAD0A13397B76C5ACC40F61BD21A9B26D50E58443
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/hypermalltxt.obj
- SHA256 29a714e3096969b7e8bfc30d2390835ad870ec78de4e871febe4207d3b2832f9
- MD5 4611254a5bd54020089cb695c49bac5d
- SHA1 e15f25fdd225408f69ee297e0c4460f9ea12f8ca
- SHA512 5a5b6e0045d61e1ce733e7db794e5df031eb14fcb361d413c760cae914cf9492eda3baae1ae9b146b6e0d1c88009620bbc4868da6d974be434f2b148bdcb369d
- SSDEEP 1536:AW+Uskim/fxoBr88Q+QPyp997g6T4CDm4uY6VPBGUe8iDwTRc8SnNqUKmvTiG6Zc:ACoBr88Q+H7ZT5z6V4DosFlMRvCNUa
- TLSH T17F7473F493D4B291F74FD8B99C347EAD2797397B2ED2A4880ED4DC50E1326E51E18882
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/knife.obj
- SHA256 5a46b28a379f804ad61a9c87c49e94f16952a5adb923c660399b574346a6e55f
- MD5 8687fa36b68e9e7c1b08419a14d0f0d3
- SHA1 5059b3a7f8ce991c6b8212680c7de9fd2d9d741d
- SHA512 4b9d7500ecdcb385b31c17d4b626e465b9bd1e8b5f1d1f85e2ba144b700b759ac5f0945866d7690d091177a7b73ad636c37e7e66d51789efb7bcbb1b30f16c31
- SSDEEP 3072:CvTjRxxsXXRgoXZNGNnCkepeXG72Pd69OSoJD6dLmFGVrfFs71Hq1muRwrRN1y:NWSoJD6tmFWUU
- TLSH T15B3552E0E7E8B1A2F2CED5B95C393BAD4653397B3AC5ACC40F51BD21A9726D40E48443
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/novaudtxt.obj
- SHA256 f03733f0d1c890b75d05a02c4acb955f733d94ab44fbe6053cc966d24117a0d9
- MD5 bd39a1d0cf5951bcdd2b0ba69b76f082
- SHA1 bb6ad96f4b2764f440f33f0f76338ec5eb0201bc
- SHA512 b5ef9c20b645328702f9be5523acdbe17dbb55f51671f27373d5b63d1b6444dfe0f232a6cf5db89e3342a93b9fc26e7c66e26594067afe49bbf6f4e6d1cab339
- TLSH T1E84197214250243595B396583BD15A8CF420B643C212CB5CFE9D62AA8FFA6A2C757F44
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/smd vps by xt aizi/vps data smd/valorantapi/offsets.json
- SHA256 0c637418aaf7b8c28d0735f55a97473c2dea867c0f4d03fd0c7ba6e0b40f25b6
- MD5 da83a697d81a25913381e738cddea1a6
- SHA1 81ed59be099a75ea158d3dc123df2671cd74ec94
- SHA512 8d4f11088a571ef755b45d8759af372b3dd5e31cbe393971617491b96817ad1fa6c025b0376bfaa5495a2d45319883a917ddf48e60ff8394653b36df4ae6a788
- TLSH T16E81EC203661886B19D6D312393E2A836BD19F7345C43C7C9B6B4208624DD27EBB6F4E
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/vanguard_gateway.h
- SHA256 8dc0ecbefa4c87153b1fcd083387d14e3282d49ce592d4250f6e25a15d7f4b4c
- MD5 9e0f0204027940fa46d450102bccbc91
- SHA1 22fed33c300a3b15542d3a62f860e81ac1fbe06c
- SHA512 bc7314a5bed42b245c27b68cc20a6627a9da2f7e04ed97feb0ec97fa37b6f1ce3ae220378ccea23ae6ce3047a4537c2eca81dfbc2b14550c745ae3b8c8175e0f
- SSDEEP 768:WfIlCegz+Eff9lFsw9c7YZsEirIR+DkrigP35coSUFzTvZxT+sGKeedKvaCGubY0:WA5gz+Eff9lFsw9c7YZsEirIRukrig/E
- TLSH T1CEF2C640A9A1EDA20AB2E70EDB964601F71421A7F395C792FDAF01581FB3870C7B4D5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf.sln
- SHA256 07e5481e29a811eebb779acd4ef28d4de2b5086facc5ee21cf38192cfa32bbcc
- MD5 7c91b23b4d0e1d682ee87ba808e468c9
- SHA1 cee423aa3baf19321526bce06bf833327c34f3c9
- SHA512 ccc21bb65fb13ee922c074b3609c34fde23efcac5bac327811c611c85be8165ca496043bb005c2e13500172b68168d00593668ef9282f939ac959d0af0ac7270
- TLSH T1F2218B7C712F7192A987A22FF1BC4CA63F365398C5EC293C009B248D3797702526B947
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf.vcxproj
- SHA256 1aa06eb6656dbbdc779703ee375f45a3171075943ce55ac41534536c7523b6f1
- MD5 c44d3834820ff0d0dbe21fadf4fa6d69
- SHA1 d83e9a6ceefbcfe6e1f447d121c868261df38ba0
- SHA512 e2775d4d2f620278885f0f7c58d1aa71200789f0aea5dab09e44ae824c4580cc7a430cf77c9a7a4cb12d110053fba6420fd6c129f3d26b0eaca0c7838bd4cc11
- SSDEEP 96:Z0/zcpx1fNO+7FE7b+7aET2YyaLbyaLMyaL6yaLDSA7/ePPc5Af/eWPcUA7/eHPV:e/zcXTWmfp/YPc0/JPcH/gPct/xPcKA
- TLSH T1B5E1A864E0E02A5AD1B2822BF5D79940EE71D3830D5B4C5CB69FE74B8F771582223B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf.vcxproj.filters
- SHA256 63ae0f6f17f171451a6f18df4ce66a2f30d9bd9677b1b1930c5668c8160f95f6
- MD5 59554dfe0155f7db0567d3b93e8159ba
- SHA1 3d639d7ffb4349f9a1522b40c6f7996332e67255
- SHA512 7716c9758a5493382fb6606d43e697a72aa53860d905023f53219a728e52a3c5b3bff0819b4b89c5fecf8be22d4d5e70edd78e2e2f5377435f919ec393c0fae4
- TLSH T1C231F720C5EC3B4C2176981BFB84CD04EF29B2E36196154977D8E4476BF221CD627768
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf.vcxproj.user
- SHA256 a0c24e8908c9bcc5eb33cdd38762da3a86013fe87f0c681238ec4bcee56d15e1
- MD5 5e35e02fcaa092f2943bf7b04b02b687
- SHA1 8f7f5c5e803d06ef30739734391f8d4d0c7a1fc6
- SHA512 7a1edc418f72acde0d7d087c04604d7dddb672835c0529e38b15ed5977bba1bde67d3d4d0f41c99cbd37f83e3b50a1fd1a06f981cd6b7b42e5201e2ac7bf83ac
- TLSH T156D0A7104140B42071B417349358D834E2E1E6E314B04898F3D0E50D111605950167B3
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/main.obj
- SHA256 82d1b7b1a30f33101afc436eb4e84c8139a5c9982e37f568a9e7fed25219b09e
- MD5 20e24cd89c58c3b2f531f592f090650c
- SHA1 42afebc668580a0af6c0f5eeb6cb2ae96ff3f922
- SHA512 0d1c0c70e2b3a8f22ee4b2d36b5724f3af82c3f37356503e3e02623363522cc98d253a3caa2845841b8c4685af26f584c72e3348d09fa43d09e9ca868491117b
- SSDEEP 98304:V8gpu9UZwIXCnLSuCDudnHV9qDTpe3SapZueZt+6ds3unnlnDkAPkdRm:V86u9LI0V
- TLSH T15536192246A08647EA766E30904B1B3F7B61C89AE864DB83C37FC46E5D793CD06E3571
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf/x64/Release/vc143.pdb
- SHA256 6be3e9bc296e87381c21ca7d1de7fb3afe88c37e1fd21da33b12664aa2371a9b
- MD5 1abdb8e8e28002c02bccd7abcd59a996
- SHA1 44bb199fb3908e42e65bb7d4d9a3cb6fd6608e53
- SHA512 71bdf9f95ab5dae8542fd3d6882f2be4b5d13911aace8625ad2ae53ac11fa69a1c5a303d11dc55677528c5e17a27be8672a5dcef1b47cba395ea4333164e0d81
- SSDEEP 24576:DK030qqDub+KS4lugwUw4NgIDszHDHLOrfNwWHRHsHXHPHbHYeUBWl6UJveqyGva:D5+KS4lugwUw4NgIDszHDHLOrfNwWHRH
- TLSH T12E650A62E5928D23D4AE2739D056136423209F4AD3CD7BCF509BB0315EEF3589F6EA90
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf/x64/Release/vc145.pdb
- SHA256 3dc481e2bd86623db829ca9db051293bb40836199631dd639be55aa5b5d4b104
- MD5 67a5cd8f4a6d193553a623d03451830b
- SHA1 4ff780ea85a1fb7d9474459a4ff25459148d0e88
- SHA512 dcfaefd697cfcb28d5caa6f913881d3d0f3df1212d588d4c746b44d7794d0276946afd1d4b2db9d99cee0b295e22aba61e9fb993b596210db25191440034726d
- SSDEEP 24576:JbIl05OHVvu1+KjrFmWIXjzOTRbHQHLtG85BMHvHEHnHFHrHRcF4M0K/Tygbl0wn:F1+KjrFmWIXjzOTRbHQHLtG85BMHvHEe
- TLSH T15055FBA2E5928D23D4BE2739D05617A423249F0AD3CD7BCF5097B0345EEA3589F2F981
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.Build.CppClean.log
- SHA256 9191f2956818b77b7422e4d02f3ff76a65e6068588c537311117cbd25c3d3f0c
- MD5 3f4fe6e6b5bf96399f85835b95ea30c6
- SHA1 4fe76249f133b715f987f29964f61d0104a9046b
- SHA512 43f0b868a1fbba00ec0860264bbeefab3e5a0981a522ad2594bb1a479b71315ee493fa1781cfd413a4ca4a9897f9a43550604e7e7b7c6addb8b1b3002b70b863
- TLSH T11011BC5D758CAA5C008DB907FF8C6EA870F8D504C60CCB6ED672B8978717C6C20A1AE4
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.exe.recipe
- SHA256 0e098f09b31a43b1eb9db1121fc662bbd79653923655516288bd43cccdc9d9ce
- MD5 70235464bb3bf754558edc677522e30e
- SHA1 e9794728cf71c65e7d64c63ab318373a51ef73b0
- SHA512 8c6dda317a72854a5d4d5afd51fe7b803071894cb261df4a0a25804295d9b8d9287d26cb2b045d170058f7bd7dd526f46771ee4627d45b4f7591e29182435d1a
- TLSH T15FE0C26649D4F04167B06115E23E4F6DFB4BB9D306300C603494CDBB0F9300804434A7
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.iobj
- SHA256 5386f2ef1bca94878fd29c46caf745887a1204acd754a27b2ab2d728a0c595da
- MD5 3e9ba538dc5a89ab97020f5a909c781a
- SHA1 41641a68550467cf47253ce57dfebc7088eeec0e
- SHA512 e4400ca047efefee535e4eef6190ff0d0c069c3c15b1e3e89beec08afd5a4c2707a2a1fede5b2b1e22eb9411d288c738021ea8eef431d5d4d7e78e44c3ca50f4
- SSDEEP 98304:ej9K+iXnqR7TOFzzwx8hELLkM/kqJjHYxyUq+6mmhoCcTDGNkpB:etw
- TLSH T1CE260A11B1A8C663E97E53B9D0DB452EB731F947BF9B6747BA8FE1201E83348618B410
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.ipdb
- SHA256 57cdf0bd97fe0e8c497e02f9a8760aae114725c7eed68ced077a15bed53341b9
- MD5 8b2d51766b8d25d2e59f0c05b9cd7815
- SHA1 e2c765b2260d5cc0330281e39ea788348f2f8077
- SHA512 184f3b5bed414f370d1dfe12dbf35606515faeb5bd33e51ec5c69d6cf81397e7f98fb9ad8cb2e13486c3a6a1eec6c3c5473edfab4ae653b1db84425b937b4017
- SSDEEP 6144:xB+uNjzUJwRRGqq/u2Vpce6wlUgGzYNYwvVeFe31A+9j1rfYw3T6xPuDLjDDJoWT:61SRIWObSxVeBp36PuvjUl
- TLSH T13CC565292396CFB2C449137054DB6F12B370EE450B0BAF4735EAE92E1FB2394BA57494
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.log
- SHA256 ec2a8a5b258a4e010aa96e2b887709291c25067d10575d56784d40cd881b8809
- MD5 9bdebc0e9be0e1ab315e81b64e9b48f8
- SHA1 54f94005e3f574a1c7e14dc5b6e76d0285556a26
- SHA512 f7fe45a1f529b1bc0de46df5aaaf855b49851122bf2e044d96e74d7eb2eb87ba2ee16fe3b860f677d516f05d2480ce719b6343e318003570af22c0e578376fdb
- TLSH T138115932102E81CA507372CED12F543517EF690503B1E732F2AC6266730E9697B3C6AC
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/CL.command.1.tlog
- SHA256 e3abd53a89c3ab6aa7e47a9111fde7178fb3bd1f5f74405f9ed59d45e3d20e6b
- MD5 ff387b3e9095f504f18a8211c5f5510e
- SHA1 6cfbecdb3e14d95413f165fb441eea43fa61fda5
- SHA512 850f669714c5935d86e70d81acfb9d7511dc99375bc0492fcfd60c64d15a0d3856424e2cb1f14a96e7aa78015f849845061328b71b8d72694d6003fe68ea7d03
- TLSH T15241E92421FCA20BA371BACE8FEFC08B4E78BB658973452E517545474264E04FE12B72
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/CL.read.1.tlog
- SHA256 4b588eec8f7a923a7212e266772c546beb1389118954844799d7a143ee1cf6a6
- MD5 5deeb70dc1fc2968297908823531acc8
- SHA1 824352074d5d6235db27e68ab8381d2987cb1f7b
- SHA512 f15fff124d9604044a1a447be2a92c559b39eced2fd27ee75ea563712aaa26251a82b77519f4fb2434defe6b645eda45412e5ca26c0b49b96e7a778c1f066dfb
- SSDEEP 192:ivO4g2mOIMQM5oTjSglGqC0C/Y+YS/izyEu:ivUjhlGqC0CQ+Uu
- TLSH T13623441970EA22492313B2C6DBCFA95BC727F2F8C62B1B2F5595130343916571E82FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/CL.write.1.tlog
- SHA256 c9e13e7922e0be81814478e3ca251bc947d46f643712e4128d00c92724916601
- MD5 851582382dcd9ff239fa92ea87bd4c75
- SHA1 1145ef701d77ca1b254de742a3a7dfd800461d24
- SHA512 e44220da6713463025c4f1216029e384fe89c6caa7f8572ea979748d25833f73c02e3bdd86cd823cfc0845e61224a9c5c60e1c7d9a5c590df903cd7e1566fbd3
- TLSH T181E0E23A24E8A18B430AF0C21FC3D0AE8B2163A4EC5223BF2086D00312808080A0B2B1
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/Cl.items.tlog
- SHA256 e9478bf95da6a960a066225b64dc90e336a2d1b44a780f022dc2a260e5cd3292
- MD5 69ee35d942113e6f39274884ab955e54
- SHA1 88fb447af3cdbd0fba44935091a9441e7370b0b4
- SHA512 d9bf855a77fc72464ae0954611cde654528a8dc6d60d3503ef8517bc58d054ee7e9c3ce5da665e23fa5ce65810250f79c0775764d8754185e4b57c7be07389e5
- TLSH T17AB0127506BDE8120024345EDF9E074C1CC054D206713321CBF90CF3653141D1C42017
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/link.command.1.tlog
- SHA256 93b08380ccedd8d412a7839a85777af25c63f179b498c527b957788bc91c2e1b
- MD5 6e6049cdff5c5fe59f54bd2d551d2ae1
- SHA1 67e0666dfa5c8adc9d6eb7aac8942a8cf080dea3
- SHA512 c4da829e00cf6ebc7018fe461072ea42c6e1e43a95b2abb427b5af4136a1eaf56a0ad58aa910382d3243ce185a66f9bba306c27dbff12f172b8f918b9d32aeca
- SSDEEP 96:t6B8ghZt7IppZzJ7OxghZt7a0pZ7aghZt7IpZ6:t6B8MZBI5zJ7OxMZBam7aMZBC6
- TLSH T1E391A53A70E9721E4716F5CA0FEAC07A8B29BB65E57B073F18E1848F4355986AD03770
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/link.read.1.tlog
- SHA256 3af783c8a99c42ce2175990160f97627c7bdef447d717f351a003e20503f245b
- MD5 7350ebc8a592ef2084e626814084a476
- SHA1 faa64cbddf10a3252b3bd5d3a89b99d06b32f6da
- SHA512 8c6f90f528cc2c0b44286f92a30d93e69b11169a555242a41c1a33ec6177329939102e0ba13828f2e20312f66a9403854d1eb7a8b7d2d178f73e3a3e0def0d9c
- SSDEEP 96:F2wtAZl9tY1dtPpSY7RrmqU6CO/wWPPxQrStui1tdsIwSYAIwOk67RrmJf77/2Fx:FtgYvuUotJ
- TLSH T19C227F3970EA234A1706B2C187CFA16BD713B664EA3F133F59C143470392517AA47FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/link.secondary.1.tlog
- SHA256 76da15b8b406fd728ebb3a01d2acfa97b0014bfa191949bb07509fea3702ea81
- MD5 bc56c97411420374fbcb83c1f2d6bcda
- SHA1 0dd5f78ca390226f0ba588bf8173d3b0f91f039a
- SHA512 22ebdb78f76a01a84f07741b31f58e4990c80d43ca04a044997c1c7bc2f66b3122aab71d8090681f811e07b502724230f2c21932807a361c679f270b4ca53f43
- TLSH T14DD0A71847ECE48D260AB901DB6D128C1DC0B1B513371B05CAB09CD1589B1AF8687083
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/link.write.1.tlog
- SHA256 c9391f995a6360b7ddf17e0f936370182cd48ee9d77a4e883ce5aadeef515dd0
- MD5 7e9614f47b78c0f9badea9f811538ae1
- SHA1 6f6abec0d20fd391c8243f3d589f36c52ab04692
- SHA512 da0a916a2dac552237f7e73836a406983d0570792a0a85774ad15b880f46885ccbfdd187793ec948e6a1e00afa8a30f697d7fa12c876690c69c4d164417e63fe
- TLSH T1E701C93A30F9B24B5706F4D20FD7D069DB216A65D956227F64C3C40353848594A0B771
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/wtf/x64/Release/wtf.tlog/wtf.lastbuildstate
- SHA256 564129844e25c4c74b4be3aeb742f1b7b7c64f3e4775290f443959ec4be07ae9
- MD5 f855af4f0028334861d31fccdb08c5b1
- SHA1 149ad63ced3c326e13fd3b235fce654706ba7b1d
- SHA512 ed00762f1cc3232fc7cc7766df9f04547149e26bca52c3a47c89eaaf58c6fcfee81420ed3be254e514b97a03a642b9737a3a440a549f3224315c337040b1c34c
- TLSH T17AE08C0CB6E46DF250F6A231C095010C23FCE2550875714CBBB1518C9BEA80C10AA236
- MD5 SHA1 SHA512 TLSH
Emulator/wtf (2)/x64/Release/VMProtectSDK64.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 ec3235136a4daee2a6f72c0f2994a8365ca8427c8068d068130b74c9fa64cd02
- MD5 c0ce8c981bda19d2be17aca0774d9df1
- SHA1 895052a42efa50043f473f072578bee69be8d2f8
- SHA512 1578948dba2492263c0b174816451218c70df89e6b4440981db9513c664d97f6253fc1c0dab4164c620b9cb7794f4789677a0c38e0a5ac9636aee1dbc3d16062
- SSDEEP 3072:0RcqYHq7Aiytzg2ScpvgJcLYsqYX6UDdyBo:K0Hq7AiyegZgJoZXBa
- TLSH T171C35B47B3E540BBD1B6C679CD234A56D3B678150B249BAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Emulator/wtf (2)/x64/Release/wtf.exe
- IMPHASH b539c45a841195124f0eecfee106f7f3
- SHA256 432e378f7cd332807a50c2f75e40a8ad0979b8ffdde0437f4e2d7301965b52bf
- MD5 001cdf615fc4ec8cfa33f45d02ed70c7
- SHA1 07affde0318c74e907e182d8c39914aa1b11f871
- SHA512 7d6fe983b9f1a1589ef3a04a0bdfaaff0deecde1f989e05465021f809b2c2150d26110a256f5d6fb89ab66e424c9e7e30bbf659e02f4ec52760fdc48ab5b3867
- SSDEEP 6144:/8CB6UcSUTQnznjfBW9c2uZV7J4fwnfd58STELtrWwcw3v8toilqC9K+B:/B6U2Qz+cvfd+FZqw/k9qCMe
- TLSH T154446C29A6551D79EA37C178C9A78803E7737C450331E6EB17D0AA670F379E4BA3E900
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
172784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\levin\Downloads\wtf (2)\x64\Release\wtf.pdb
kernel32
WriteFile
OutputDebugStringA
GetModuleFileNameW
CreateNamedPipeW
FindNextFileA
GetEnvironmentVariableA
FindClose
CreateMutexA
WaitForSingleObject
CreateFileW
ReleaseMutex
GetModuleHandleA
DisconnectNamedPipe
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetTempPathA
GetTickCount64
GetLastError
Process32NextW
QueryFullProcessImageNameA
CreateFileA
GetCurrentThread
DeleteFileA
Process32FirstW
GetStdHandle
CancelIoEx
GetProcAddress
CreateFileMappingA
LocalFree
RemoveDirectoryA
ExitProcess
GetConsoleWindow
SetConsoleOutputCP
CreateDirectoryA
GetTickCount
IsDebuggerPresent
ConnectNamedPipe
GetComputerNameA
CheckRemoteDebuggerPresent
FlushFileBuffers
GetCurrentProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
FindNextFileW
SetConsoleTitleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
VirtualProtect
FindFirstFileA
FindFirstFileW
SetUnhandledExceptionFilter
WakeAllConditionVariable
GetCurrentThreadId
SleepConditionVariableSRW
SetConsoleCtrlHandler
GetModuleFileNameA
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReadFile
user32
GetAsyncKeyState
FindWindowA
GetForegroundWindow
MessageBoxA
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueW
RegOpenKeyExA
vmprotectsdk64
VMProtectIsProtected
VMProtectEnd
VMProtectIsDebuggerPresent
VMProtectBeginUltra
msvcp140
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Mtx_lock
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Xtime_get_ticks
_Mtx_unlock
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
__crtLCMapStringA
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
_Strxfrm
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
_Thrd_detach
bcrypt
BCryptEncrypt
BCryptDestroyKey
BCryptGetProperty
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptImportKeyPair
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptHashData
crypt32
CryptImportPublicKeyInfoEx2
CryptDecodeObjectEx
CryptBinaryToStringA
CryptStringToBinaryA
winhttp
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpSendRequest
WinHttpConnect
WinHttpQueryDataAvailable
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
__std_type_info_compare
__std_terminate
__std_exception_copy
__std_exception_destroy
__C_specific_handler
wcsrchr
__current_exception_context
__current_exception
_CxxThrowException
memset
memmove
memcpy
memcmp
__RTtypeid
api-ms-win-crt-stdio-l1-1-0
fgetc
_get_stream_buffer_pointers
_fseeki64
fputc
fread
fsetpos
ungetc
__stdio_common_vswprintf_s
__stdio_common_vsscanf
setvbuf
_set_fmode
__p__commode
__stdio_common_vsprintf
fwrite
fflush
fclose
__stdio_common_vsprintf_s
fgetpos
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
realloc
api-ms-win-crt-string-l1-1-0
wcscat_s
wcscpy_s
tolower
_wcsicmp
towlower
strlen
wcscmp
wcslen
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_errno
__p___argv
_beginthreadex
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
__p___argc
_set_app_type
_seh_filter_exe
_cexit
system
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
terminate
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
___lc_collate_cp_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=32, id=261, version=35721,
count=6, id=257, version=35721,
count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=13, id=257, version=35222,
count=311, id=1, productName=Unmarked objects,
count=1, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,
Emulator/wtf (2)/x64/Release/wtf.pdb
- SHA256 8b1ce261e9d313277b6247f07c3cc8d9a6a53fa5669bb71fc9b66943a80ee69e
- MD5 8b977e77d72f0b806d195d0c329001e6
- SHA1 2cb4f7300a71b5f4336326f9a4b95ae1447d7121
- SHA512 7ac96c2fb64e21ac10348f27b1cccf12cfdf6a948b170c08f1570c38719c331e30c93e47d15100bdf0eeb2db7468e707426bfc1d16bf2aff895240d5cd80b923
- SSDEEP 98304:GeHBfIngkBkkBkgQCgkB0rH0Rtqpv+WWq1RoioKKsSBpefni0TBsBaBvBDBWBHBR:sT
- TLSH T13A163AB2E6669D13C47F0335905F1B2C2325DD469BEE3FCB854EA2108CEA39C9E5E251
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf (2)/xorstr.h
- SHA256 63f85755c40f2fd1bec883de50db3b300510905302e1f0d560de09f380d2d3ec
- MD5 311a5594932043b619f7f613393795c7
- SHA1 d36b4ea808faa3617706e018c7241865eeb4f88e
- SHA512 34406234f6e2e5d653b94f08ac0443c8c0dbb9ae83ba3424ac71bc4139ea644ce82ffcd972d99a455f275d244ff3ee5ede8f34c871d4013f6aabc31a35c6acd8
- TLSH T13D51044819BF624485936376F367D0131108A0573264DBE4FE5FD9608F42B31BBBEE59
- MD5 SHA1 SHA512 TLSH
Emulator/wtf.sln
- SHA256 07e5481e29a811eebb779acd4ef28d4de2b5086facc5ee21cf38192cfa32bbcc
- MD5 7c91b23b4d0e1d682ee87ba808e468c9
- SHA1 cee423aa3baf19321526bce06bf833327c34f3c9
- SHA512 ccc21bb65fb13ee922c074b3609c34fde23efcac5bac327811c611c85be8165ca496043bb005c2e13500172b68168d00593668ef9282f939ac959d0af0ac7270
- TLSH T1F2218B7C712F7192A987A22FF1BC4CA63F365398C5EC293C009B248D3797702526B947
- MD5 SHA1 SHA512 TLSH
Emulator/wtf.vcxproj
- SHA256 f2c43e87c3ddce9974b427ecc711d7e89d0867caefd348501772b41f0441f3fe
- MD5 56fb2caac64ca994b5f32c87b1e0169c
- SHA1 b64605b8f799bc9cbb824a8820e0e89c486d7e79
- SHA512 a3f94f527f10e8a83fc43fcea22354f18385a1f3d675975ca34f15230f4e36b5cb8958fdc0add1f3958ad3d24da32ae934662dd2562c5aed6a8e440ae71c0760
- SSDEEP 96:Z0/zcpx1fNOw7FO7bw7aOT2YyaLbyaLMyaL6yaLDSA7/ePPc5Af/eWPcUA7/eHPV:e/zcXls4hp/YPc0/JPcH/gPct/xPcKA
- TLSH T127E1A864E1E02A5A91B2822BF5D79940EE71D3830D5B4C5CB69FE74B8F771582223B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf.vcxproj.filters
- SHA256 63ae0f6f17f171451a6f18df4ce66a2f30d9bd9677b1b1930c5668c8160f95f6
- MD5 59554dfe0155f7db0567d3b93e8159ba
- SHA1 3d639d7ffb4349f9a1522b40c6f7996332e67255
- SHA512 7716c9758a5493382fb6606d43e697a72aa53860d905023f53219a728e52a3c5b3bff0819b4b89c5fecf8be22d4d5e70edd78e2e2f5377435f919ec393c0fae4
- TLSH T1C231F720C5EC3B4C2176981BFB84CD04EF29B2E36196154977D8E4476BF221CD627768
- MD5 SHA1 SHA512 TLSH
Emulator/wtf.vcxproj.user
- SHA256 a0c24e8908c9bcc5eb33cdd38762da3a86013fe87f0c681238ec4bcee56d15e1
- MD5 5e35e02fcaa092f2943bf7b04b02b687
- SHA1 8f7f5c5e803d06ef30739734391f8d4d0c7a1fc6
- SHA512 7a1edc418f72acde0d7d087c04604d7dddb672835c0529e38b15ed5977bba1bde67d3d4d0f41c99cbd37f83e3b50a1fd1a06f981cd6b7b42e5201e2ac7bf83ac
- TLSH T156D0A7104140B42071B417349358D834E2E1E6E314B04898F3D0E50D111605950167B3
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/main.obj
- SHA256 09e305834399b060ba85d320828e93fe48eb218714c7b219ea1207ad7aaa5f89
- MD5 a1512b7afe8491c023e727ae732d73f9
- SHA1 9cca4702532fcccc7c0594da2a827e997b1fff4b
- SHA512 86847187ff67aa5e7545a880d5ca88029a58ba5f1a7ae217f0090c6c5e7039349353b135926a96ab570ec7376fb0829b697f982089c1a16eac18936e18c41221
- SSDEEP 98304:pMcyB44tVeCoF6tHGzexv0hC0bcZY9HbfHjv7zzj7xvfiTSB721oVcDAZp+YLAWi:poB4m
- TLSH T196262913C6B0C643DB667D21C14B032E6AB188A96964E9C3C17FC45F5DBD38E42E7A72
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf/x64/Release/vc143.pdb
- SHA256 6be3e9bc296e87381c21ca7d1de7fb3afe88c37e1fd21da33b12664aa2371a9b
- MD5 1abdb8e8e28002c02bccd7abcd59a996
- SHA1 44bb199fb3908e42e65bb7d4d9a3cb6fd6608e53
- SHA512 71bdf9f95ab5dae8542fd3d6882f2be4b5d13911aace8625ad2ae53ac11fa69a1c5a303d11dc55677528c5e17a27be8672a5dcef1b47cba395ea4333164e0d81
- SSDEEP 24576:DK030qqDub+KS4lugwUw4NgIDszHDHLOrfNwWHRHsHXHPHbHYeUBWl6UJveqyGva:D5+KS4lugwUw4NgIDszHDHLOrfNwWHRH
- TLSH T12E650A62E5928D23D4AE2739D056136423209F4AD3CD7BCF509BB0315EEF3589F6EA90
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf/x64/Release/wtf.Build.CppClean.log
- SHA256 9191f2956818b77b7422e4d02f3ff76a65e6068588c537311117cbd25c3d3f0c
- MD5 3f4fe6e6b5bf96399f85835b95ea30c6
- SHA1 4fe76249f133b715f987f29964f61d0104a9046b
- SHA512 43f0b868a1fbba00ec0860264bbeefab3e5a0981a522ad2594bb1a479b71315ee493fa1781cfd413a4ca4a9897f9a43550604e7e7b7c6addb8b1b3002b70b863
- TLSH T11011BC5D758CAA5C008DB907FF8C6EA870F8D504C60CCB6ED672B8978717C6C20A1AE4
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.exe.recipe
- SHA256 7693b9bfd7c6d9416c7e3cd875ce4c33f3aa715b6b5c119255d53a967aa1f255
- MD5 533f1461f558e162fd9c07a7d09e43f6
- SHA1 9de0fbb594483bef6f48f7666dc1e626f97ffcd5
- SHA512 00a7aefb4d9813190165887d44c8d26b1e3d5e4e90ccdb77849667b6bff489a9de3b184ef633c8e23d5192a7b0bfc82522fbbe62534b20ae3c40f0b7f982bf3d
- TLSH T152D0127659D4F14167B55119E63E5E69F71BBAD305250C703484DD7F1F5314405034AB
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.iobj
- SHA256 aaa0163c6f2f14d9aa8a69c63ba631041e90b9a3f474ffe567f06282f408477a
- MD5 e5405d0993c7ba06c5fb02817ef65c37
- SHA1 14762ab7c4fc079bb3e067f9c54fa5e395657baf
- SHA512 dd2524b2f0ec88dc7f6e81ddbd1f65a9a44151c20bed58021040d5812b93e77f30c59c6b522d3c1e9ef83e2f18bd2fdb6ae413d040cd0041e48786ceb8271916
- SSDEEP 98304:ielQ8JgEb90yYvkuimVZ9K7HtGx/+Ly83FiWjadhsHu1:jl8f
- TLSH T169261A15B6A8CA63D93E53B5D0DB452EB330F947BF9B674BB58FA1246E83348714B020
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf/x64/Release/wtf.ipdb
- SHA256 90487b98cbac5cc386009af463063f52c18ac4fc50e1e7d41538dc03553af4e3
- MD5 21163c5cbd7648389c99c1b17066ca51
- SHA1 a21e00e748e780d9ee4489e71968d5432e048747
- SHA512 fe9168cf2f4e2e640d176eeca95aa7a527dd29f7ed2880b2da84c49bdf6d1ed448bd972dc6a51ea01df15036d26064ac1f741970609dbb909140dcab3640c860
- SSDEEP 6144:qtQ2bRw9oWNLgqbTgC+KQtHWP+mVWo5gTy/Y8x9SAOm2GQASuoWZAJjstDJjSZ4u:qJuBLgPLOt5dSAxUWZAJj
- TLSH T16BB54F0523468BB2C499237154DBAF177330FE064F1B674779EEE92D2FA33987A96090
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf/x64/Release/wtf.log
- SHA256 ec2a8a5b258a4e010aa96e2b887709291c25067d10575d56784d40cd881b8809
- MD5 9bdebc0e9be0e1ab315e81b64e9b48f8
- SHA1 54f94005e3f574a1c7e14dc5b6e76d0285556a26
- SHA512 f7fe45a1f529b1bc0de46df5aaaf855b49851122bf2e044d96e74d7eb2eb87ba2ee16fe3b860f677d516f05d2480ce719b6343e318003570af22c0e578376fdb
- TLSH T138115932102E81CA507372CED12F543517EF690503B1E732F2AC6266730E9697B3C6AC
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.tlog/CL.command.1.tlog
- SHA256 046afefeeedd5b8445c0a1e79ae8f1fd7754afda14c62d4f2aa652b126423dce
- MD5 99c63443902567fb7823b7ffda3020ab
- SHA1 74c7a3c5191525d7d7c1b059c2cda69511ae9163
- SHA512 ef128903207a944ad0105962ca89bc291e1b2bb65d9111e50cf6c855dd4ad01775618c6d5f774906646fc3ea6bbdc71f29f9da0f89201f0d493e854ae21aa44b
- TLSH T19D312D2461FCA20AA3717ACD4FEFC08B4E78BB668973452E517501474264E04FE12B73
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.tlog/CL.read.1.tlog
- SHA256 6a84a455c00f4c1604defa54be1dc97f7bdc1d7673aff64f6b21bbd47c1771bd
- MD5 e3bfc544fc57c39ac280656b9438c6e7
- SHA1 1df4f576c1e3a45ed4f984cd7af1ed31c0b3b594
- SHA512 b302a9d0875a3a3744ca99c04326d34eda0d169f609c47502be8a9262d71a7a9098e8e3ad7c11deb8e9403c64399f408e80d0cdc97d494ae23d6d8cdb8a61ddd
- SSDEEP 192:FJLL5SZH/jqQFZ7ZjSPtvrDRD/ovgKXFarKx9NwK:FJLijytvrDRDgvNx9NwK
- TLSH T19C231A1D70EA224A6716F1C69BCE965BC327F2F8863B172F51D5130313906176B82FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf/x64/Release/wtf.tlog/CL.write.1.tlog
- SHA256 85ba353ffd48717befed61e6f6c8ce7c900ba8bdd647896437ffa2404190bdef
- MD5 a5f9a6ee8d1221982f601b7fbc874bdf
- SHA1 c8797cf63f0a6afcf8285d0903d04ae3e285a0db
- SHA512 3fdaf12296495cd181f084884c9e27f02faa8dee666e2917ef02c0319c02cf53f4fc4aa3aad0eb8ceafaf661ac6f328337ba674e0929d16ae19ad2de9e4ea5bb
- TLSH T188E0C73B70FC760A171174D60FCBC0949B26DD569666353E709B004793DCC444F02772
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.tlog/Cl.items.tlog
- SHA256 e61fe5c53937305354f2b97d5e43e1c3066d13f65068d8fec0055e215afae2c3
- MD5 355e46f82d4010fd01199c1c56a17976
- SHA1 2a92c9ed72bb345f7a884eb959fa867cbcabe6ba
- SHA512 2c397375428a88d075e483d68c1791ccb1118544eed69137e1909f25219ce36753f4eaaeacfc1b6f08ff6e7eb72097ce21bf38338b7f2c448e1b0ce0f1d06e88
- TLSH T16CB01231003982980037B54EDF3F2820164755C20251F231B3D8297735119541F1401F
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.tlog/link.command.1.tlog
- SHA256 600437e6ba441bbb72593403bf8e928ab58423efdd167c73a20078085ede0b92
- MD5 ba0879ebc1435804b716bf791396d0d4
- SHA1 11ce9a694d0f4db569ff27ae24f5f876b0e7e609
- SHA512 90d97c91c3f32eb43a33e7be20f10e5b7b0cc6afbf063204f6d232c896d9a70507fa1fa1c585b0f7259595697c95dacdfb9c1c4c6888fa40d0d1838e4a196fd8
- TLSH T17A51A53A70F9720D4716B58A0FEEC0BA8B29BB26957B073F18F1848F4355982AD03771
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.tlog/link.read.1.tlog
- SHA256 dc2098b6a62a9aadf66ac3fb75f78496f0c66fde402c995d7235676379d159cd
- MD5 ba4b2fc8d8d9c3a2205b77fa648a5c9e
- SHA1 c8779d2ac898d9619184b218f7dcdfdf07fa194f
- SHA512 51605a77b3271775147f80e1915bac22e775cc735454628e3880afd68a5f529d94ff00f60d04d1a77d738e4ae9f5af0ae1b2489d4bf4ede48f62b5f742578268
- SSDEEP 96:F7nwtAZl9tY1dtPpSHY7RrmqU6CO/wWPPxQrStuf:F7wgHYvuf
- TLSH T157A15E3970EA234A4705F2C28BCBA16BD313B664EA3F137F95D543470392517A643FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/wtf/x64/Release/wtf.tlog/link.secondary.1.tlog
- SHA256 fdceb970a2e2e8fd4e157abf31175b0e4571ba47458326177e7a37b65518b662
- MD5 045029fcffa07950abc1aa2becb2bb50
- SHA1 3e376c415e4709e84ab863981c1416e5c17ee2db
- SHA512 3ef36ad93424451e61432bc09c3f88dcff3998b13e890a616659483c605854938808e9cd2b90daa9e50d3cc668bb975ccd415bb4290233f71a915d9ee6f23a99
- TLSH T1A5D02365416C568C015DF50EDB2A1CA02E4B96641251C3BBFFE12DD131431404F57404
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.tlog/link.write.1.tlog
- SHA256 08a8f9b92a0bd69177112fc1c0f911074b971cdc03c9e8e69d2a94e3802b8728
- MD5 821387a9362cb3e0f4efb99859d08c77
- SHA1 c801fc1e6620559b5f7d3b2508325f4d99e554d6
- SHA512 4363467dffad648d70dbb3f08f92f4b3a3ce81532f13704c181b89b10bda2d2230a7deac5041d6d4f1af356c4fdfc4b9ef51ef744372e28ee505f34fe26f8ec1
- TLSH T1AFE0EC3A70FCB60A1712B8D60FDBD054DB269E6A96A6352EB497440393CCC458F02732
- MD5 SHA1 SHA512 TLSH
Emulator/wtf/x64/Release/wtf.tlog/wtf.lastbuildstate
- SHA256 988944937aae71bdb8b57dce2b59c6fe4d0c14acca9a4a752bd5bfa049aafea5
- MD5 30dcfd204e64cbf20a404ef51a6725bb
- SHA1 9a452bbeb3a74ad3f4217796e9bedc55de63e229
- SHA512 07ec8977de829bb41995944ce976e94850978cb5ade18e4c88032b5f63088c1e3a24a1e8b8e657d5ce45de287aaf45ec27e9f9edecebe7a19bc98bd109502c9a
- TLSH T19EC08004535493E16413A54ED4D1004553AE52515521F15C6D85271D2F955580177337
- MD5 SHA1 SHA512 TLSH
Emulator/x64/Release/VMProtectSDK64.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 ec3235136a4daee2a6f72c0f2994a8365ca8427c8068d068130b74c9fa64cd02
- MD5 c0ce8c981bda19d2be17aca0774d9df1
- SHA1 895052a42efa50043f473f072578bee69be8d2f8
- SHA512 1578948dba2492263c0b174816451218c70df89e6b4440981db9513c664d97f6253fc1c0dab4164c620b9cb7794f4789677a0c38e0a5ac9636aee1dbc3d16062
- SSDEEP 3072:0RcqYHq7Aiytzg2ScpvgJcLYsqYX6UDdyBo:K0Hq7AiyegZgJoZXBa
- TLSH T171C35B47B3E540BBD1B6C679CD234A56D3B678150B249BAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Emulator/x64/Release/wtf.pdb
- SHA256 04a9da0a42ac079f709ad64c8db3ebe1fd1732c0348e067d86f65c10ec869ef2
- MD5 4c086c4585649d509f7648f2391ee856
- SHA1 843471dbe738a2f6e0bf74841ee20787a6d67cd2
- SHA512 a94a4295e27020562243639ecfffeabf84542e06625b402d4e903d49fc8a2cee40f4dfe5f01622cff06487fed9ef8553021efddb46f972c3e7c6e4c756fe3ab0
- SSDEEP 49152:L/CY45S4SInFQalTt9QJ3lK41KcQ1ufgWso+wrdbJ2FdoMI95hIGu86QyRxOBtbY:L/It9QJ9WRxctb/E6qL/qcn
- TLSH T144F52BA2E6664E23C46F1735A09F132C2364DD47DFEE3BCB851EA2158CEA3589E1F501
- MD5 SHA1 SHA512 SSDEEP TLSH
Emulator/xorstr.h
- SHA256 63f85755c40f2fd1bec883de50db3b300510905302e1f0d560de09f380d2d3ec
- MD5 311a5594932043b619f7f613393795c7
- SHA1 d36b4ea808faa3617706e018c7241865eeb4f88e
- SHA512 34406234f6e2e5d653b94f08ac0443c8c0dbb9ae83ba3424ac71bc4139ea644ce82ffcd972d99a455f275d244ff3ee5ede8f34c871d4013f6aabc31a35c6acd8
- TLSH T13D51044819BF624485936376F367D0131108A0573264DBE4FE5FD9608F42B31BBBEE59
- MD5 SHA1 SHA512 TLSH