ZapretTray-0[.]8[.]zip

resource
unpack001/Setup.exe
unpack001/files\ZapretTray.exe
unpack001/files\core\bin\WinDivert.dll
unpack001/files\core\bin\cygwin1.dll
unpack001/files\core\bin\winws.exe

ZapretTray-0.8.zip

SHA256 d534d718a13d4b435ba2e1532f6fe379418be438677ad36196cac5e25e8e4450
MD5 1c2f745ec2527dd330d5bf8bdc2c2ddf
SHA1 18e0cb7781a0d4391fe570b38edddbd452e497bf
SHA512 82de8d695e3c25d47b5b1899d6aac493921aebaea1e3126090f87bec37cd079e43c9ca806b78ed836f9baca98588d13115d2a89b88c9e5b5c08e37ac1dec584d
SSDEEP 24576:KkTdlejXO95NorTSqGx0cAj/Ko3ibh15bvLoHcDjY294tcRqKKxxnB6kx3jm:puTQ5NorTHGxnUta5bvLokMbHKCB18
TLSH
T12F7533AAA04AD58BD346B3365C0A0B1404E1B5D03490EF8E7FD935889B15CD76FE8E7E
MD5 SHA1 SHA512 SSDEEP TLSH

README.txt

SHA256 6fd99f3aac8df7c27f88a597f79aae71451b634c2fe683bb7b8aecc95bde485f
MD5 8172161d2cddec74eaca173d46cb2247
SHA1 69e1006d5537085cbfb584adc18c9ec1b2129af2
SHA512 a30dc2902781e78289276366678d95484bf5e9cec2dd11ce48345f1e5946c252a9c0b7bf14a41729726284440d8573ae629aca9c395c78bd4203c081263360de
TLSH
T1AF614B2054D8649E66087017DC18B90E79EB84FE7F7FA31919752C6F38F2139823FA66
MD5 SHA1 SHA512 TLSH

Setup.exe

SHA256 033c4463a8fdb52ca6b379c0cec480294932e3c7642902675755e3c167e564f1
MD5 5f1883021def3c18c2875d4c02ee7c96
SHA1 4ec75706b7f9403dab411cfe7119b26f08507a8c
SHA512 d85512cf44bfacda4d445bb4aec00a17252f93194c8890c88be01dd1985bdf9313abefe298dc364c5ae6b10fe487548f4bd4b9a16dbf4354372bb9c7478c3bfd
SSDEEP 1536:JjOpnMTdZYXWZli0s8TTPkt1HONbh/1YYEERgD8:dsXWy0s8TTPcsph/1YYEEo
TLSH
T18F834A06B7F9C628E3BE4F38947205D00735FA53AB63D75C1C8B58BC05267E18926BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

files\ZapretTray.exe

SHA256 dced936739574375ff5fc0b6b21910759d6fff456d11095f289ec0aa645bd752
MD5 651cb640c0e86ce90cd7757e55e46be3
SHA1 beaac06d7d6ed6b21db8822db71fc896eef13f42
SHA512 8f5cbfbe49bd007f3c232f3096c8f031b629929f973b82e127b2064c186994f43c3b70cfef103324f06e9615e37d21f2422c5f00481e00265f9fd7030beca6d0
SSDEEP 6144:3Rlv1fAD3+6gtzkBDtc7GPgZstWgtrD5wge:3Jf8gm+VurD+
TLSH
T1C4544B0FB7B98F65FAAE8738807105C18672B307E75EEB485CCB68FC1459371A61126B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

files\core\bin\ACTIVE_DISCORD_UDP.bin

SHA256 2fe18b3bd20807d36704d0b072092ee49ae84edca907a4420ab9a0f0f28fddcf
MD5 7429222625dfb23a41af04a4aa704acb
SHA1 5e17589b3ab3d86dd269e6382dfdd15931f386e8
SHA512 28563bd1fa798dcd3d95f13421c3b5041363cf0943baa3479138375f6daabbbfcaa6e2658b8e8e126850a40bdd658ce9a9e43abf5a5a073e6377a28211eb5243
TLSH
T1DD210DEF44273587CE95476523AC42FCA7C3956FC648047A6FF372051C7C14EE591415
MD5 SHA1 SHA512 TLSH

files\core\bin\ACTIVE_GAME_UDP.bin

SHA256 e065870cb0d13152e6132807bbf42218a9e7cd8d96f5602b61674cc540f3a56e
MD5 6422bac6b3e976bab5d21451b834221f
SHA1 5c3cbd90820054aec414e1c6e89f0ed03eb1f1d1
SHA512 0c2b212260fe6a4ef7af91f2e5cb1d9ba117c0654a80b4153301c23f08e63c8921835ae5e66f287b60722e1aee5b122fd18ce856f1aaba52604c0f51d9859205
TLSH
T1F721EA9951EF257024F6430A18E9A4B6594366C74AF68BF351D90CA06CE974B8F09863
MD5 SHA1 SHA512 TLSH

files\core\bin\WinDivert.dll

IMPHASH 0b649f8e17494bb31b47f6e959a1769c
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

files\core\bin\WinDivert64.sys

IMPHASH db584dd0570594898805dd67d7ff391c
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 20, 2022

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 20, 2022

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

01

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

61:50:19:91:b1:8f:32:38:04:52:51:37:dc:25:00:5a

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2022 - May 25, 2023

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

4484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\WinDivert-2.2.2\install\MSVC\amd64\WinDivert64.pdb

ntoskrnl.exe

RtlCopyUnicodeString KeBugCheckEx IoGetRequestorProcess PsGetProcessId ExUuidCreate ObfDereferenceObject ObfReferenceObject IoWriteErrorLogEntry IoGetCurrentProcess IoFreeMdl IoAllocateMdl IoAllocateErrorLogEntry MmMapLockedPagesSpecifyCache MmBuildMdlForNonPagedPool ExFreePoolWithTag ExAllocatePoolWithTag KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock RtlGetVersion RtlIntegerToUnicodeString

hal

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool NdisFreeNetBufferPool NdisAllocateNetBufferListPool NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

fwpkclnt.sys

FwpmTransactionAbort0 FwpmTransactionBegin0 FwpmEngineClose0 FwpmEngineOpen0 FwpsQueryPacketInjectionState0 FwpmProviderAdd0 FwpmProviderDeleteByKey0 FwpsInjectNetworkReceiveAsync0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 FwpmFilterAdd0 FwpmFilterDeleteByKey0 FwpmTransactionCommit0 FwpsCalloutRegister0 FwpsCalloutUnregisterByKey0 FwpsFlowAssociateContext0 FwpsFlowRemoveContext0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsInjectForwardAsync0

wdfldr.sys

WdfVersionBindClass WdfVersionUnbindClass WdfVersionBind WdfVersionUnbind

Name

.text

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

files\core\bin\cygwin1.dll

IMPHASH 8f21c12c4e790805822951d4e4dcad1c
SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 a1c82ed072dc079dd7851f82d9aa7678
SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
TLSH
T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

202560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredContinueHandler AllocConsole AttachConsole CallNamedPipeA CancelIo CancelSynchronousIo ClearCommBreak ClearCommError CloseHandle CompareStringW ConnectNamedPipe CreateFileA CreateFileW CreateNamedPipeA CreatePipe CreateProcessW CreateRemoteThread CreateSymbolicLinkW CreateTapePartition CreateThread DebugBreak DeleteCriticalSection DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DuplicateHandle EnterCriticalSection EraseTape EscapeCommFunction ExitProcess ExitThread ExpandEnvironmentStringsW FillConsoleOutputAttribute FillConsoleOutputCharacterW FindFirstVolumeW FindNextVolumeW FindVolumeClose FlushConsoleInputBuffer FlushFileBuffers FlushViewOfFile FreeConsole FreeEnvironmentStringsW FreeLibrary GenerateConsoleCtrlEvent GetBinaryTypeW GetCommModemStatus GetCommState GetCommandLineW GetConsoleCP GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleProcessList GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentConsoleFontEx GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetHandleInformation GetLastError GetLocaleInfoA GetLocaleInfoW GetLogicalDriveStringsA GetLogicalDrives GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetNamedPipeClientProcessId GetNumberOfConsoleInputEvents GetOverlappedResult GetPriorityClass GetProcAddress GetProcessAffinityMask GetProcessGroupAffinity GetProcessHeap GetProcessId GetProcessWorkingSetSize GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTapeParameters GetTapePosition GetTapeStatus GetTempPathW GetThreadContext GetThreadGroupAffinity GetThreadId GetThreadPriority GetTickCount GetTickCount64 GetTimeZoneInformation GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree IdnToAscii IdnToUnicode InitializeCriticalSection InitializeProcThreadAttributeList IsBadStringPtrA IsDebuggerPresent IsProcessInJob LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LocaleNameToLCID MapViewOfFile MapViewOfFileEx MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA PeekConsoleInputA PeekConsoleInputW PeekNamedPipe PrepareTape PurgeComm QueryDosDeviceW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime QueueUserAPC RaiseException ReadConsoleInputA ReadConsoleInputW ReadConsoleOutputW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind ScrollConsoleScreenBufferA ScrollConsoleScreenBufferW SetCommBreak SetCommMask SetCommState SetCommTimeouts SetComputerNameExW SetConsoleCP SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleW SetConsoleWindowInfo SetEnvironmentVariableW SetErrorMode SetEvent SetFilePointerEx SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetProcessWorkingSetSize SetStdHandle SetSystemTime SetTapeParameters SetTapePosition SetThreadContext SetThreadGroupAffinity SetThreadPriority SetThreadStackGuarantee Sleep SuspendThread SwitchToThread TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TransmitCommChar UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitCommEvent WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteConsoleInputW WriteConsoleOutputW WriteConsoleW WriteFile WriteProcessMemory WriteTapemark

ntdll

NtAccessCheck NtAdjustPrivilegesToken NtAllocateLocallyUniqueId NtAssignProcessToJobObject NtCancelTimer NtClose NtCommitTransaction NtCreateDirectoryObject NtCreateEvent NtCreateFile NtCreateJobObject NtCreateKey NtCreateMutant NtCreateNamedPipeFile NtCreateSection NtCreateSemaphore NtCreateSymbolicLinkObject NtCreateTimer NtCreateTransaction NtDuplicateToken NtFlushBuffersFile NtFsControlFile NtLockFile NtLockVirtualMemory NtMapViewOfSection NtOpenDirectoryObject NtOpenEvent NtOpenFile NtOpenJobObject NtOpenKey NtOpenMutant NtOpenProcessToken NtOpenSection NtOpenSemaphore NtOpenSymbolicLinkObject NtOpenThreadToken NtPrivilegeCheck NtQueryAttributesFile NtQueryDirectoryFile NtQueryDirectoryObject NtQueryEaFile NtQueryEvent NtQueryInformationFile NtQueryInformationJobObject NtQueryInformationProcess NtQueryInformationThread NtQueryInformationToken NtQueryObject NtQueryQuotaInformationFile NtQuerySecurityObject NtQuerySemaphore NtQuerySymbolicLinkObject NtQuerySystemInformation NtQuerySystemTime NtQueryTimer NtQueryTimerResolution NtQueryValueKey NtQueryVirtualMemory NtQueryVolumeInformationFile NtReadFile NtRollbackTransaction NtSetEaFile NtSetEvent NtSetInformationFile NtSetInformationJobObject NtSetInformationThread NtSetInformationToken NtSetQuotaInformationFile NtSetSecurityObject NtSetTimer NtSetValueKey NtSetVolumeInformationFile NtUnlockFile NtUnlockVirtualMemory NtUnmapViewOfSection NtWaitForSingleObject NtWriteFile RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlAddAccessAllowedAceEx RtlAddAccessDeniedAceEx RtlAllocateHeap RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlCheckRegistryKey RtlCompareUnicodeString RtlConvertSidToUnicodeString RtlCopySid RtlCopyUnicodeString RtlCreateAcl RtlCreateQueryDebugBuffer RtlCreateSecurityDescriptor RtlDestroyQueryDebugBuffer RtlDowncaseUnicodeString RtlEnterCriticalSection RtlEqualPrefixSid RtlEqualSid RtlEqualUnicodeString RtlFirstFreeAce RtlFreeHeap RtlFreeUnicodeString RtlGetAce RtlGetControlSecurityDescriptor RtlGetCurrentTransaction RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetNtVersionNumbers RtlGetOwnerSecurityDescriptor RtlGetVersion RtlIdentifierAuthoritySid RtlInitAnsiString RtlInitUnicodeString RtlInitializeSid RtlLeaveCriticalSection RtlLengthSid RtlNtStatusToDosError RtlPrefixUnicodeString RtlQueryProcessDebugInformation RtlQueryRegistryValues RtlSetControlSecurityDescriptor RtlSetCurrentDirectory_U RtlSetCurrentTransaction RtlSetDaclSecurityDescriptor RtlSetGroupSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSubAuthorityCountSid RtlSubAuthoritySid RtlUnicodeStringToAnsiString RtlUpcaseUnicodeChar RtlUpcaseUnicodeString

GetCommandLineA@0 GetCommandLineW@0 _Exit __argc __argv __assert __assert_func __assertfail __b64_ntop __b64_pton __bsd_qsort_r __check_rhosts_file __chk_fail __cpuset_alloc __cpuset_free __ctype_ptr__ __cxa_atexit __cxa_finalize __cygwin_user_data __dn_comp __dn_expand __dn_skipname __eprintf __errno __fbufsize __flbf __fpclassifyd __fpclassifyf __fpending __fpurge __freadable __freading __fsetlocking __fwritable __fwriting __getpagesize __getreent __gets_chk __gnu_basename __infinity __isinfd __isinff __isnand __isnanf __locale_ctype_ptr __locale_ctype_ptr_l __locale_mb_cur_max __main __mb_cur_max __memcpy_chk __memmove_chk __mempcpy __mempcpy_chk __memset_chk __opendir_with_d_ino __progname __rcmd_errstr __res_close __res_init __res_mkquery __res_nclose __res_ninit __res_nmkquery __res_nquery __res_nquerydomain __res_nsearch __res_nsend __res_query __res_querydomain __res_search __res_send __res_state __sched_getaffinity_sys __signbitd __signbitf __signgam __snprintf_chk __sprintf_chk __srget __srget_r __stack_chk_fail __stack_chk_fail_local __stack_chk_guard __stpcpy_chk __stpncpy_chk __strcat_chk __strcpy_chk __strncat_chk __strncpy_chk __swbuf __swbuf_r __vsnprintf_chk __vsprintf_chk __wrap__ZdaPv __wrap__ZdaPvRKSt9nothrow_t __wrap__ZdlPv __wrap__ZdlPvRKSt9nothrow_t __wrap__Znam __wrap__ZnamRKSt9nothrow_t __wrap__Znwm __wrap__ZnwmRKSt9nothrow_t __xdrrec_getrec __xdrrec_setnonblock __xpg_sigpause __xpg_strerror_r _alloca _check_for_executable _ctype_ _daylight _dll_crt0 _exit _fe_dfl_env _fe_nomask_env _feinitialise _fscanf_r _get_osfhandle _impure_ptr _longjmp _pipe _pthread_cleanup_pop _pthread_cleanup_push _setjmp _setmode _sys_errlist _sys_nerr _timezone _tzname a64l abort abs accept accept4 access acl acl_add_perm acl_calc_mask acl_check acl_clear_perms acl_cmp acl_copy_entry acl_copy_ext acl_copy_int acl_create_entry acl_delete_def_file acl_delete_entry acl_delete_perm acl_dup acl_entries acl_equiv_mode acl_error acl_extended_fd acl_extended_file acl_extended_file_nofollow acl_free acl_from_mode acl_from_text acl_get_entry acl_get_fd acl_get_file acl_get_perm acl_get_permset acl_get_qualifier acl_get_tag_type acl_init acl_set_fd acl_set_file acl_set_permset acl_set_qualifier acl_set_tag_type acl_size acl_to_any_text acl_to_text acl_valid aclcheck aclfrommode aclfrompbits aclfromtext aclsort acltomode acltopbits acltotext acos acosf acosh acoshf acoshl acosl aio_cancel aio_error aio_fsync aio_read aio_return aio_suspend aio_write alarm aligned_alloc alphasort arc4random arc4random_addrandom arc4random_buf arc4random_stir arc4random_uniform argz_add argz_add_sep argz_append argz_count argz_create argz_create_sep argz_delete argz_extract argz_insert argz_next argz_replace argz_stringify asctime asctime_r asin asinf asinh asinhf asinhl asinl asnprintf asprintf at_quick_exit atan atan2 atan2f atan2l atanf atanh atanhf atanhl atanl atexit atof atoff atoi atol atoll basename bcmp bcopy bind bindresvport bindresvport_sa bsearch btowc bzero cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl call_once calloc canonicalize_file_name carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl catclose catgets catopen cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil ceilf ceill cexp cexpf cexpl cfgetispeed cfgetospeed cfmakeraw cfsetispeed cfsetospeed cfsetspeed chdir chmod chown chroot cimag cimagf cimagl clearenv clearerr clearerr_unlocked clock clock_getcpuclockid clock_getres clock_gettime clock_nanosleep clock_setres clock_settime clog clog10 clog10f clog10l clogf clogl close closedir closelog cnd_broadcast cnd_destroy cnd_init cnd_signal cnd_timedwait cnd_wait confstr conj conjf conjl connect copysign copysignf copysignl cos cosf cosh coshf coshl cosl cpow cpowf cpowl cproj cprojf cprojl creal crealf creall creat csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl ctermid ctime ctime_r cuserid cwait cygwin_attach_handle_to_fd cygwin_conv_path cygwin_conv_path_list cygwin_create_path cygwin_detach_dll cygwin_dll_init cygwin_internal cygwin_logon_user cygwin_posix_path_list_p cygwin_set_impersonation_token cygwin_split_path cygwin_stackdump cygwin_umount cygwin_winpid_to_pid daemon dbm_clearerr dbm_close dbm_delete dbm_dirfno dbm_error dbm_fetch dbm_firstkey dbm_nextkey dbm_open dbm_store difftime dirfd dirname div dladdr dlclose dlerror dlfork dll_crt0__FP11per_process dll_dllcrt0 dll_entry dlopen dlsym dn_comp dn_expand dn_skipname dprintf drand48 drem dremf dreml dup dup2 dup3 duplocale eaccess ecvt ecvtbuf ecvtf endgrent endhostent endmntent endprotoent endpwent endservent endusershell endutent endutxent environ envz_add envz_entry envz_get envz_merge envz_remove envz_strip erand48 erf erfc erfcf erfcl erff erfl err error error_at_line error_message_count error_one_per_line error_print_progname errx euidaccess execl execle execlp execv execve execvp execvpe exit exp exp10 exp10f exp10l exp2 exp2f exp2l expf expl explicit_bzero expm1 expm1f expm1l fabs fabsf fabsl faccessat facl fchdir fchmod fchmodat fchown fchownat fclose fcloseall fcntl fcvt fcvtbuf fcvtf fdatasync fdim fdimf fdiml fdopen fdopendir feclearexcept fedisableexcept feenableexcept fegetenv fegetexcept fegetexceptflag fegetprec fegetround feholdexcept feof feof_unlocked feraiseexcept ferror ferror_unlocked fesetenv fesetexceptflag fesetprec fesetround fetestexcept feupdateenv fexecve fflush fflush_unlocked ffs ffsl ffsll fgetc fgetc_unlocked fgetpos fgets fgets_unlocked fgetwc fgetwc_unlocked fgetws fgetws_unlocked fgetxattr fileno fileno_unlocked finite finitef finitel fiprintf flistxattr flock flockfile floor floorf floorl fls flsl flsll fma fmaf fmal fmax fmaxf fmaxl fmemopen fmin fminf fminl fmod fmodf fmodl fnmatch fopen fopencookie fork forkpty fpathconf fprintf fpurge fputc fputc_unlocked fputs fputs_unlocked fputwc fputwc_unlocked fputws fputws_unlocked fread fread_unlocked free freeaddrinfo freeifaddrs freelocale fremovexattr freopen frexp frexpf frexpl fscanf fseek fseeko fsetpos fsetxattr fstat fstatat fstatfs fstatvfs fsync ftell ftello ftime ftok ftruncate ftrylockfile fts_children fts_close fts_get_clientptr fts_get_stream fts_open fts_read fts_set fts_set_clientptr ftw funlockfile funopen futimens futimes futimesat fwide fwprintf fwrite fwrite_unlocked fwscanf gai_strerror gamma gamma_r gammaf gammaf_r gcvt gcvtf get_avphys_pages get_current_dir_name get_nprocs get_nprocs_conf get_phys_pages getaddrinfo getc getc_unlocked getchar getchar_unlocked getcontext getcwd getdelim getdomainname getdtablesize getegid getentropy getenv geteuid getgid getgrent getgrgid getgrgid_r getgrnam getgrnam_r getgrouplist getgroups gethostbyaddr gethostbyname gethostbyname2 gethostid gethostname getifaddrs getitimer getline getloadavg getlogin getlogin_r getmntent getmntent_r getmode getnameinfo getopt getopt_long getopt_long_only getpagesize getpass getpeereid getpeername getpgid getpgrp getpid getppid getpriority getprogname getprotobyname getprotobynumber getprotoent getpt getpwent getpwnam getpwnam_r getpwuid getpwuid_r getrandom getrlimit getrusage gets getservbyname getservbyport getservent getsid getsockname getsockopt getsubopt gettimeofday getuid getusershell getutent getutid getutline getutxent getutxid getutxline getw getwc getwc_unlocked getwchar getwchar_unlocked getwd getxattr glob glob_pattern_p globfree gmtime gmtime_r grantpt h_errno hcreate hcreate_r hdestroy hdestroy_r herror hsearch hsearch_r hstrerror htonl htons hypot hypotf hypotl if_freenameindex if_indextoname if_nameindex if_nametoindex ilogb ilogbf ilogbl imaxabs imaxdiv in6addr_any in6addr_loopback index inet_addr inet_aton inet_makeaddr inet_netof inet_network inet_ntoa inet_ntop inet_pton infinity infinityf initgroups initstate insque ioctl iprintf iruserok iruserok_sa isalnum isalnum_l isalpha isalpha_l isascii isascii_l isatty isblank isblank_l iscntrl iscntrl_l isdigit isdigit_l isgraph isgraph_l isinf isinff isinfl islower islower_l isnan isnanf isnanl isprint isprint_l ispunct ispunct_l issetugid isspace isspace_l isupper isupper_l iswalnum iswalnum_l iswalpha iswalpha_l iswblank iswblank_l iswcntrl iswcntrl_l iswctype iswctype_l iswdigit iswdigit_l iswgraph iswgraph_l iswlower iswlower_l iswprint iswprint_l iswpunct iswpunct_l iswspace iswspace_l iswupper iswupper_l iswxdigit iswxdigit_l isxdigit isxdigit_l j0 j0f j1 j1f jn jnf jrand48 kill killpg l64a labs lchown lcong48 ldexp ldexpf ldexpl ldiv lfind lgamma lgamma_r lgammaf lgammaf_r lgammal lgammal_r lgetxattr link linkat lio_listio listen listxattr llabs lldiv llistxattr llrint llrintf llrintl llround llroundf llroundl localeconv localtime localtime_r lockf log log10 log10f log10l log1p log1pf log1pl log2 log2f log2l logb logbf logbl logf login login_tty logl logout logwtmp longjmp lrand48 lremovexattr lrint lrintf lrintl lround lroundf lroundl lsearch lseek lsetxattr lstat lutimes madvise makecontext mallinfo malloc malloc_stats malloc_trim malloc_usable_size mallopt mblen mbrlen mbrtowc mbsinit mbsnrtowcs mbsrtowcs mbstowcs mbtowc memalign memccpy memchr memcmp memcpy memmem memmove mempcpy memrchr memset mkdir mkdirat mkdtemp mkfifo mkfifoat mknod mknodat mkostemp mkostemps mkstemp mkstemps mktemp mktime mlock mmap modf modff modfl mount mprotect mq_close mq_getattr mq_notify mq_open mq_receive mq_send mq_setattr mq_timedreceive mq_timedsend mq_unlink mrand48 msgctl msgget msgrcv msgsnd msync mtx_destroy mtx_init mtx_lock mtx_timedlock mtx_trylock mtx_unlock munlock munmap nan nanf nanl nanosleep nearbyint nearbyintf nearbyintl newlocale nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl nftw nice nl_langinfo nl_langinfo_l nrand48 ntohl ntohs on_exit open open_memstream open_wmemstream openat opendir openlog openpty optarg opterr optind optopt optreset pathconf pause pclose perror pipe pipe2 poll popen posix_fadvise posix_fallocate posix_madvise posix_memalign posix_openpt posix_spawn posix_spawn_file_actions_addclose posix_spawn_file_actions_adddup2 posix_spawn_file_actions_addopen posix_spawn_file_actions_destroy posix_spawn_file_actions_init posix_spawnattr_destroy posix_spawnattr_getflags posix_spawnattr_getpgroup posix_spawnattr_getschedparam posix_spawnattr_getschedpolicy posix_spawnattr_getsigdefault posix_spawnattr_getsigmask posix_spawnattr_init posix_spawnattr_setflags posix_spawnattr_setpgroup posix_spawnattr_setschedparam posix_spawnattr_setschedpolicy posix_spawnattr_setsigdefault posix_spawnattr_setsigmask posix_spawnp pow pow10 pow10f pow10l powf powl ppoll pread printf program_invocation_name program_invocation_short_name pselect psiginfo psignal pthread_atfork pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getguardsize pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_getstack pthread_attr_getstackaddr pthread_attr_getstacksize pthread_attr_init pthread_attr_setdetachstate pthread_attr_setguardsize pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_attr_setstack pthread_attr_setstackaddr pthread_attr_setstacksize pthread_barrier_destroy pthread_barrier_init pthread_barrier_wait pthread_barrierattr_destroy pthread_barrierattr_getpshared pthread_barrierattr_init pthread_barrierattr_setpshared pthread_cancel pthread_cond_broadcast pthread_cond_clockwait pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_condattr_destroy pthread_condattr_getclock pthread_condattr_getpshared pthread_condattr_init pthread_condattr_setclock pthread_condattr_setpshared pthread_continue pthread_create pthread_detach pthread_equal pthread_exit pthread_getaffinity_np pthread_getattr_np pthread_getconcurrency pthread_getcpuclockid pthread_getname_np pthread_getschedparam pthread_getsequence_np pthread_getspecific pthread_join pthread_key_create pthread_key_delete pthread_kill pthread_mutex_clocklock pthread_mutex_destroy pthread_mutex_getprioceiling pthread_mutex_init pthread_mutex_lock pthread_mutex_setprioceiling pthread_mutex_timedlock pthread_mutex_trylock pthread_mutex_unlock pthread_mutexattr_destroy pthread_mutexattr_getprioceiling pthread_mutexattr_getprotocol pthread_mutexattr_getpshared pthread_mutexattr_gettype pthread_mutexattr_init pthread_mutexattr_setprioceiling pthread_mutexattr_setprotocol pthread_mutexattr_setpshared pthread_mutexattr_settype pthread_once pthread_rwlock_clockrdlock pthread_rwlock_clockwrlock pthread_rwlock_destroy pthread_rwlock_init pthread_rwlock_rdlock pthread_rwlock_timedrdlock pthread_rwlock_timedwrlock pthread_rwlock_tryrdlock pthread_rwlock_trywrlock pthread_rwlock_unlock pthread_rwlock_wrlock pthread_rwlockattr_destroy pthread_rwlockattr_getpshared pthread_rwlockattr_init pthread_rwlockattr_setpshared pthread_self pthread_setaffinity_np pthread_setcancelstate pthread_setcanceltype pthread_setconcurrency pthread_setname_np pthread_setschedparam pthread_setschedprio pthread_setspecific pthread_sigmask pthread_sigqueue pthread_spin_destroy pthread_spin_init pthread_spin_lock pthread_spin_trylock pthread_spin_unlock pthread_suspend pthread_testcancel pthread_timedjoin_np pthread_tryjoin_np pthread_yield ptsname ptsname_r putc putc_unlocked putchar putchar_unlocked putenv puts pututline pututxline putw putwc putwc_unlocked putwchar putwchar_unlocked pwrite qsort qsort_r quick_exit quotactl raise rand rand_r random rawmemchr rcmd rcmd_af read readdir readdir_r readlink readlinkat readv realloc reallocarray reallocf realpath recv recvfrom recvmsg reent_data regcomp regerror regexec regfree remainder remainderf remainderl remove removexattr remque remquo remquof remquol rename renameat renameat2 res_close res_init res_mkquery res_nclose res_ninit res_nmkquery res_nquery res_nquerydomain res_nsearch res_nsend res_query res_querydomain res_search res_send revoke rewind rewinddir rexec rindex rint rintf rintl rmdir round roundf roundl rpmatch rresvport rresvport_af ruserok sbrk scalb scalbf scalbl scalbln scalblnf scalblnl scalbn scalbnf scalbnl scandir scandirat scanf sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getcpu sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setparam sched_setscheduler sched_yield secure_getenv seed48 seekdir select sem_clockwait sem_close sem_destroy sem_getvalue sem_init sem_open sem_post sem_timedwait sem_trywait sem_unlink sem_wait semctl semget semop send sendmsg sendto setbuf setbuffer setcontext setdtablesize setegid setenv seteuid setgid setgrent setgroups sethostent sethostname setitimer setjmp setlinebuf setlocale setlogmask setmntent setpassent setpgid setpgrp setpriority setprogname setprotoent setpwent setregid setreuid setrlimit setservent setsid setsockopt setstate settimeofday setuid setusershell setutent setutxent setvbuf setxattr shm_open shm_unlink shmat shmctl shmdt shmget shutdown sig2str sigaction sigaddset sigaltstack sigdelset sigemptyset sigfillset sighold sigignore siginterrupt sigismember siglongjmp signal signalfd significand significandf sigpause sigpending sigprocmask sigqueue sigrelse sigset sigsetjmp sigsuspend sigtimedwait sigwait sigwaitinfo sin sincos sincosf sincosl sinf sinh sinhf sinhl sinl siprintf sleep snprintf sockatmark socket socketpair spawnl spawnle spawnlp spawnlpe spawnv spawnve spawnvp spawnvpe sprintf sqrt sqrtf sqrtl srand srand48 srandom sscanf stat statfs statvfs stime stpcpy stpncpy str2sig strcasecmp strcasecmp_l strcasestr strcat strchr strchrnul strcmp strcoll strcoll_l strcpy strcspn strdup strerror strerror_l strerror_r strfmon strfmon_l strftime strftime_l strlcat strlcpy strlen strlwr strncasecmp strncasecmp_l strncat strncmp strncpy strndup strnlen strnstr strpbrk strptime strptime_l strrchr strsep strsignal strspn strstr strtod strtod_l strtof strtof_l strtoimax strtok strtok_r strtol strtol_l strtold strtold_l strtoll strtoll_l strtosigno strtoul strtoul_l strtoull strtoull_l strtoumax strupr strverscmp strxfrm strxfrm_l swab swapcontext swprintf swscanf symlink symlinkat sync sys_errlist sys_nerr sys_sigabbrev sys_siglist sysconf sysinfo syslog system tan tanf tanh tanhf tanhl tanl tcdrain tcflow tcflush tcgetattr tcgetpgrp tcgetsid tcsendbreak tcsetattr tcsetpgrp tdelete tdestroy telldir tempnam tfind tgamma tgammaf tgammal thrd_create thrd_current thrd_detach thrd_equal thrd_exit thrd_join thrd_sleep thrd_yield time timegm timelocal timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd_create timerfd_gettime timerfd_settime times timezone timingsafe_bcmp timingsafe_memcmp tmpfile tmpnam toascii toascii_l tolower tolower_l toupper toupper_l towctrans towctrans_l towlower towlower_l towupper towupper_l trunc truncate truncf truncl tsearch tss_create tss_delete tss_get tss_set ttyname ttyname_r ttyslot twalk tzset ualarm umask umount uname uname_x ungetc ungetwc unlink unlinkat unlockpt unsetenv updwtmp updwtmpx uselocale usleep utime utimensat utimes utmpname utmpxname valloc vasnprintf vasprintf vdprintf verr verrx versionsort vfiprintf vfork vfprintf vfscanf vfwprintf vfwscanf vhangup vprintf vscanf vsnprintf vsprintf vsscanf vswprintf vswscanf vsyslog vwarn vwarnx vwprintf vwscanf wait wait3 wait4 waitpid warn warnx wcpcpy wcpncpy wcrtomb wcscasecmp wcscasecmp_l wcscat wcschr wcscmp wcscoll wcscoll_l wcscpy wcscspn wcsdup wcsftime wcsftime_l wcslcat wcslcpy wcslen wcsncasecmp wcsncasecmp_l wcsncat wcsncmp wcsncpy wcsnlen wcsnrtombs wcspbrk wcsrchr wcsrtombs wcsspn wcsstr wcstod wcstod_l wcstof wcstof_l wcstoimax wcstok wcstol wcstol_l wcstold wcstold_l wcstoll wcstoll_l wcstombs wcstoul wcstoul_l wcstoull wcstoull_l wcstoumax wcswidth wcsxfrm wcsxfrm_l wctob wctomb wctrans wctrans_l wctype wctype_l wcwidth wmemchr wmemcmp wmemcpy wmemmove wmempcpy wmemset wordexp wordfree wprintf write writev wscanf xdr_array xdr_bool xdr_bytes xdr_char xdr_double xdr_enum xdr_float xdr_free xdr_hyper xdr_int xdr_int16_t xdr_int32_t xdr_int64_t xdr_int8_t xdr_long xdr_longlong_t xdr_netobj xdr_opaque xdr_pointer xdr_reference xdr_short xdr_sizeof xdr_string xdr_u_char xdr_u_hyper xdr_u_int xdr_u_int16_t xdr_u_int32_t xdr_u_int64_t xdr_u_int8_t xdr_u_long xdr_u_longlong_t xdr_u_short xdr_uint16_t xdr_uint32_t xdr_uint64_t xdr_uint8_t xdr_union xdr_vector xdr_void xdr_wrapstring xdrmem_create xdrrec_create xdrrec_endofrecord xdrrec_eof xdrrec_skiprecord xdrstdio_create y0 y0f y1 y1f yn ynf

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

/4

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

274KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

400KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/38

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

files\core\bin\quic_initial_4pda_to.bin

SHA256 e065870cb0d13152e6132807bbf42218a9e7cd8d96f5602b61674cc540f3a56e
MD5 6422bac6b3e976bab5d21451b834221f
SHA1 5c3cbd90820054aec414e1c6e89f0ed03eb1f1d1
SHA512 0c2b212260fe6a4ef7af91f2e5cb1d9ba117c0654a80b4153301c23f08e63c8921835ae5e66f287b60722e1aee5b122fd18ce856f1aaba52604c0f51d9859205
TLSH
T1F721EA9951EF257024F6430A18E9A4B6594366C74AF68BF351D90CA06CE974B8F09863
MD5 SHA1 SHA512 TLSH

files\core\bin\quic_initial_5ka_ru.bin

SHA256 247dcd97f53bfae5482e4b2b66acdb01e48ee6c29c5ca526c9b241fa38c233b5
MD5 a2ab0c128e6834d716823c376188edc8
SHA1 68791babdcd1887cf2c393054d465888e126ed4a
SHA512 48cb53de5bfeb687c1df038d99ee3abdf7ccc45eb33654212bd4d1dedd6e4a4ca36ec19fd95cdb344f61e1bf701bd34541353931801ba56f88f2255479f8a758
TLSH
T1E321C5AA790192DC2666C1D238886A85E9C4DEF2BBDCBC42D31934F16E1F409D098E47
MD5 SHA1 SHA512 TLSH

files\core\bin\quic_initial_lemana_pro.bin

SHA256 c2ff932a40d69a61321c1fa091a6182e16a2fb85f36881b6864f864f07508848
MD5 563619ff38a65d63cd01b11fa2b2e099
SHA1 5474f02b594000bb8cf447c132b191d58ff29fda
SHA512 4c02f7034f6bf7d97ab0f3229d6f794c22b538a7b3d4a403a94befc76e2b121e1f3297b6d0bff918d47f50438068a57ed05901ce26c3d85c976cfb9637d82d43
TLSH
T10621F1AD2412CE8FDD502433A71140052A3552E2565F145762049C9A4762C2DA42B779
MD5 SHA1 SHA512 TLSH

files\core\bin\quic_initial_rutube_ru.bin

SHA256 74b1dfbdec125263c9407436658b0a848b8f0a934b8063d11571a6a2146a4a7b
MD5 fc935731a55d3e715d5e216c50d937e7
SHA1 90d3e8ab70e62556bdba81869bb2127fe39f254f
SHA512 a43d195c1bb8d06e1a670760ef1aa308e1820488d88b64acf848a81004eca058e64bed60f069eb2e94fcba32610d346da1c2eaaf7d6f3b3a7efb5af0432c865d
TLSH
T12621418325867A72CA8A807A9C354C38833C0F5AB18E741162CCEB6B30CA626E30385D
MD5 SHA1 SHA512 TLSH

files\core\bin\quic_initial_steam_chat_com.bin

SHA256 1da1407166f5d2ade80f1d3c86d828178e13f08050c40fda2b0a4d276318642a
MD5 f299ae597213e82160dff35f90c6c365
SHA1 ff9145f04a472f2cf2955d4fcf1cf01e990207fe
SHA512 8dbe05156a8e198f9d3acdd5c29a7662683f03c2fab5079782cbabb0b3d949605b137612f7ed0cfbb39ae441e11004241ade134dad37c606868348cbf82bb77e
TLSH
T12B21C04D3A113576C29649350695B36892C0A2010AB850337AA309EB14F2BE04FB2436
MD5 SHA1 SHA512 TLSH

files\core\bin\quic_initial_steamcommunity_com.bin

SHA256 2fe18b3bd20807d36704d0b072092ee49ae84edca907a4420ab9a0f0f28fddcf
MD5 7429222625dfb23a41af04a4aa704acb
SHA1 5e17589b3ab3d86dd269e6382dfdd15931f386e8
SHA512 28563bd1fa798dcd3d95f13421c3b5041363cf0943baa3479138375f6daabbbfcaa6e2658b8e8e126850a40bdd658ce9a9e43abf5a5a073e6377a28211eb5243
TLSH
T1DD210DEF44273587CE95476523AC42FCA7C3956FC648047A6FF372051C7C14EE591415
MD5 SHA1 SHA512 TLSH

files\core\bin\quic_initial_steamstatic_com.bin

SHA256 4f1468adcc30ac7ffd9e04627c7289968f8c4ae476626d05f282da8064fe64b4
MD5 6db6220f66db20028022466cb1376e29
SHA1 487e676a5392f6b31e5c5dfb6c5ceb25044fe906
SHA512 1a22e2ff17eb7601c707ec69f14c896eb7402496e24b0de0567a9351815c26d33ae9f7ba23a33b5a8c8f5fba106ebb95a01cecfe000cdd5bdbca8dde6635c40f
TLSH
T150216A2085173F5CCA50F479C8B0BCC05310C933654F30540784070760C38D3C1EC087
MD5 SHA1 SHA512 TLSH

files\core\bin\quic_initial_tencent_com.bin

SHA256 d250051d6200946a7ba0629c59c5641432957fa3513081a6c3c5aaa91a62ac03
MD5 0b98262b43c075dd041329bab61a68c3
SHA1 87d9162c43854b7084e08c15988661491e149589
SHA512 96899e973a30e850567ac0912ad5cf04c147e26891d8655e838ba756213c728ff85e1c63ad8c6f29fa8cf403dddf9217a0cf658af846e34fa9fdc69a76d5ba44
TLSH
T15921177410ED13603E80128030AA4A2BBA705A58ADD0D90F21A3A0F5DD51832FBFBFE8
MD5 SHA1 SHA512 TLSH

files\core\bin\quic_initial_www_google_com.bin

SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
MD5 312526d39958d89b1f8ab67789ab985f
SHA1 49a06ceebb13807faaf2a935a716127faff9864d
SHA512 472e88fdd60f9c67f784514a6b699bbefac257657f53a9682a864c0ced474b33f89cf14eb112226ebc9b2c6b07a8f2ec9b25010ccdf98c13370c5c9c6dc2b893
TLSH
T16C21E766D88023896108F64536222E5009B3A4471621258F07292781C83EFEEC1EC0C6
MD5 SHA1 SHA512 TLSH

files\core\bin\stun.bin

SHA256 9cd5469309780ca56c0bd97266524a48c7ee529d02c3179cfecb20b260a59641
MD5 0357596c0e38a10a4b99dca2032419cc
SHA1 05fb322426bd56771a1e1873e88626bc98d34563
SHA512 319880f7624ff32720d11b79e5cdc24e24ee482a92cd2224e2175936b54a32916d059f431bf2f0e8ff74cf1be41395a462665e75fd1cf17a2c126d01cc2ee165
TLSH
T181B01200C24B4DA4C014103CC4436A9F84A415D58F00DFC389091E9050CA05E6CC1ACD
MD5 SHA1 SHA512 TLSH

files\core\bin\stun2.bin

SHA256 b7c2497496039c541f7337ac8536813f0a1cf52363ab2faa5213b7816d458813
MD5 f01f84f99471de0c7c580da6a14fcdc6
SHA1 4ba9e863501403b8bda56a1c482a5f351880a3d8
SHA512 70a0a416d2b2ab8875b9e68690a4d10f735a9b2173aa3c4dd9d6fb1fe0ad228d8d767deea97f5eece1380f5ed2ef0266fa4d26ec18e3aa0763c14ae5cb3da3ff
TLSH
T1E1B02B0080B000900499853B41050B585B020AE4A373C9110A0B58D612C60308C08224
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_4pda_to.bin

SHA256 eefeaf09dde8d69b1f176212541f63c68b314a33a335eced99a8a29f17254da8
MD5 e6d649de132c3c10cb62531ef74f5b73
SHA1 689c7e8d021a99d0a64fee9099fa9012a3528265
SHA512 f7be809482e3098a5a8f79a759d1f8bcdc2e5201ac35f06eb8662afbb8194f2dfacc2c3e64114557de78e935086cad43880be83b0af1611a1aa0bced0facffba
TLSH
T14ED02B87C982745FDF090B7AA5D5C9B9DED3F1EA03CB8F4768058344FAD85B1422208D
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_5ka_ru.bin

SHA256 1e8871e272591c5a277d38a6166af597c1fecb1cf58e85162e8f1968ec08d018
MD5 710437a88c95578373f1fd2cf971100a
SHA1 14f0032c13f75bbc4d06d8a177e92499a57dfd95
SHA512 ef0229f348d359e30364d837ef180d2e57c365dcfb0f7f34011d6fe3e100ee953b26e5a6e9d8d3813d699c6f32cedba3b2040999ac809235271717f184a4a83e
TLSH
T118F023A7255B1C13F95712213CD5C14947526D247B033A576245FF30C8DDBC24BD070A
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_awswaf_com.bin

SHA256 6405e264eff9f33632e727f6d696ff39503d3652f0f0be00921f06f97720a5b0
MD5 7b6d8d620bfc15319eb179592cab473c
SHA1 7e6341f395d25b5b4619280765b37a392aaccd9a
SHA512 f907efa92ee7da74b25a6dbbb979e1cd8ac00d5dfbc869e459172770b9a501a135d1015b0fe8a67cdd9ef2f9556b87c02371aa46d333ba8d5a862a68dc9ca87f
TLSH
T19B1144A3135259CAD2414E340D8F54EAC206A104C7A35BCFFAA2DA50CDBBD86441219D
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_max_ru.bin

SHA256 4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
MD5 b2b3e684ce449b60f0bc5a9028221a08
SHA1 32538a43ec8502f0146cd59456646bce7aedd29c
SHA512 19963986a6c0f7265456aeaa4622fd4f8061dc81d1b722fb62f61574f6d96e4b55cfcd256dcfc555bec11ae458ddebb943de25dc1df102dafe99a2b4174b5b38
TLSH
T1CF0128771655D117A54D1F1650E150418585EF447302C7EF3B74D974CAD68C34E75345
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_sochi_park.bin

SHA256 ad552922acfe029521da884ea29f4bb28bb6bdcee9b1a70b46adbfd266c11d4d
MD5 cae56426ee185c46b19cd4f7dc8a6222
SHA1 13fc2ceef9f883203f0cceef5978c3bb3b7f8972
SHA512 68a928058cda86b67d0e30014d135eae1fc632e3daf4b504f618fa6809878c937000737ae5fbc8acd6eaa1ab6223138ea0006a54abf32f341cc8073fda966fa0
TLSH
T199D097C39901BC3E70204720AA2E86AEA1A370139B03670E30F6F0201AE8C643F33E81
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_steam_chat_com.bin

SHA256 388e9a09bb2758ebbce34a0e27d8efa41bbd59954c9c32d8fb74b4bce2d99c67
MD5 eae090dc82216136fd881102c217e35b
SHA1 0b0bf6ce3e40b35eb75f3b3334912ac56c149165
SHA512 15223df4fb15ddf25ea0500bdb863698f540c076d0cc0f2b049934411e7fe7fced9b876def0371f6484d6ce7308e2260005dbacda14d529ce2f18043cef6a1b9
TLSH
T1281183B2184A8882EB014276084E581253C1F08132E3CFFAB5AEC7984ACB8D348B9318
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_steamstatic_com.bin

SHA256 3f8ba0b0de17a3feda593ef2cd82a1b44ca566f96acaa42f6fccd69f2484ecea
MD5 2f24d2ddfb3fa5e796fe16cae9898c30
SHA1 0e6b5e2d9436493d3203364a1c45a287df72910b
SHA512 3118123a1ac1505b7a1d790c17d59e9e9b8506b15177f6c453aef7293099aaa43f13ae910e3257a20d3d12e273d65975ccfe31e48f5337ed21d2e031703f343d
TLSH
T1131144192111D687DC1D453608DF409A93E7D80263930FEB32DEBA66CFC01C78986255
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_teamspeak_com.bin

SHA256 1336b7529c050a9c5a4728368430686311c448d4b3ba61bfc8d1e10a15de438a
MD5 a0fb7b30a27e79d42006e85df6dfd2a7
SHA1 49069c889e7802f8a8d38053e60cded1f3bdd78c
SHA512 1e822eb8fdb1023e41a6b6e2c1074a5d1291b4f508c061c42e841a4ceb6716e10c895571e31040e8e5889ff82ef8c1f1d4bb4944a307d9b6b4c16e7a75b950fd
TLSH
T1AD1183921240E65FC16A263209C9CCF5DF85D0140AE253C71DC7DE008A9219699631AB
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_www_google_com.bin

SHA256 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
MD5 41e47557f16690df1781f67c8712714e
SHA1 2f3ca8e75528e0e7797e8f5edfdc582535531913
SHA512 e8b644d7996168e51d8b991b1d263b9d98f7178bdd9a060078cf4f5ef368fa6e864492b3365227aa68d4d079d734f17d8a5755bbab7424f1bb66e82c0b72f1dc
TLSH
T1D601F4AB1D42D11AD9020E1629D7854A51CADA0561138F772705AF11E8C3D97CD10BC9
MD5 SHA1 SHA512 TLSH

files\core\bin\tls_clienthello_www_sferum_ru.bin

SHA256 e6dd8d724eecc6a7340bf64e2ebec81c60bc4e078c6f702b4b6ba9bf184180ad
MD5 2e7d5581af22c22b0828e1048acb6dd4
SHA1 49179dc0c4e65937af15de143b3baf7e8802bf2a
SHA512 35cea376e854b246f80b9348cc93c525641ae203cc4cf73911d92e31e9617a922051551bfffca1d5f057bd54afc4037357a471a81969a48e1c6f04643ebab7a2
TLSH
T1780123860047745BD9875F2B0CD5D5844689F04AB6078327B0E3F5A8EF51AD55990B2E
MD5 SHA1 SHA512 TLSH

files\core\bin\winws.exe

IMPHASH a4b140fe839e54b299bb799d5e755765
SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
MD5 d498e19bc7a79dd1efcb6b928cbe9909
SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
TLSH
T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

cygwin1

__cxa_atexit __errno __getreent __locale_ctype_ptr __main __stack_chk_fail __stack_chk_guard _dll_crt0 _impure_ptr atoi calloc chdir close cygwin_detach_dll cygwin_internal dirname dll_dllcrt0 dup exit fclose fgets fopen fork fprintf fputc fputs fread free fseek fwrite get_current_dir_name getopt_long_only getpid getsockopt inet_ntop inet_pton localtime_r malloc memcmp memcpy memmem memmove open openlog optarg posix_memalign printf putchar puts qsort random realloc setenv setsid setsockopt setvbuf signal snprintf srandom sscanf stat strcasecmp strchr strcmp strdup strerror strlen strncasecmp strncat strncmp strncpy syslog time tolower toupper usleep vfprintf vsnprintf wordexp wordfree

advapi32

RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA

kernel32

CancelIoEx CloseHandle CreateEventW CreateMutexA FormatMessageA GetLastError GetModuleHandleA GetOverlappedResult GetTickCount LocalFree ReleaseMutex SetLastError WaitForSingleObject WideCharToMultiByte

ole32

CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysFreeString

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanOpenHandle WlanQueryInterface

windivert

WinDivertClose WinDivertOpen WinDivertRecvEx WinDivertSend

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

files\core\general (ALT).bat

SHA256 03daa1e91c59264139110c4fd0216ac57e7387efa1c7abdb0f9c3e65492b5edb
MD5 5a8b4cd8849bd1c9b22a9182dfaa629f
SHA1 d54226dc27e92e2116884f9114d4bbee796fa788
SHA512 09fca6e42dcfde29f53540b8d3c5f9e07ac3198f00d6d4befdf6e77035f999f5370f54316e28670b7cfb60ebe20abb782150af4552450e2b29a276ec7de11d26
TLSH
T1E4816BA7E00CDE47F5CD653EF89BA5A420279C8329D6D452839B89F8CC0EDBD684E480
MD5 SHA1 SHA512 TLSH

files\core\general (ALT10).bat

SHA256 00a37955e2a8e2c2df1859c7e542c24a26f613373a0930e68b20bdeed08d4863
MD5 91e4da2117ed62a323d8ccaf4a0e9693
SHA1 271b25f95c008fb79752f3086c538f3ecb94ea2e
SHA512 3b7583db9256bd8582afa2860ed4a79b724c174405a8c4fd73a4ab4bda375b3dfbfc9686bbcc066c462e3cc2e74b3b92208f41b36ebbf4f5d74a79dd2240a56b
TLSH
T142713CA7E00CDE47F58C697DF89EA5B42127DCC328D6D456439B85E8CC0ECBE584E484
MD5 SHA1 SHA512 TLSH

files\core\general (ALT11).bat

SHA256 f11cf901444b7b1de316dae78852449f8d390e2ccd9d5eeb7a03ef732cbd1bae
MD5 38664ef4dc5812b7e11210f2d565efdd
SHA1 92fa06a726cf6829dc405224a6b1849c9c462f59
SHA512 a12c3dbc81e8a9f35f65308aa587044f58ed5e980d6c9bdf77be9beb8fd2062c78395564ab7e2575bcf2a6c70f40e66690954b8bd8e58ba1e87e90313f9912fe
SSDEEP 96:nL674QGB/GRRQ1zbIKdUGB/GRAVv/GRRQuv/GRA5P+R0ri5+RRLx/:A4QGB/GRRGEVGB/GRkv/GRRDv/GRUP+6
TLSH
T16F9137A3E00CEE4AF68E747EF49EA6A5211788C328D6D452439B45E8CD0EDB9194E485
MD5 SHA1 SHA512 SSDEEP TLSH

files\core\general (ALT12).bat

SHA256 9b21fa52d50668b162e5e1caf39b56478184a22565588ec4dce92f4a25fb2dd1
MD5 93d8406c772c53dbf7d93d684d712524
SHA1 d58db5e1917e0c1708afcc9b605b4641f99792b4
SHA512 5e567d89bcca3a83e4b689821262f31b76f407590e2e3b2a2f58877e2e3646c91f1d9be2f0a8b84ee3e79dfea9830214c4fcef95f1fd950fd2d1497bc96f900e
SSDEEP 96:nL674QGB/GRRQ1zoLIiUGB/GRKVv/GRRQuv/GRK5P+REji5+RRLx/:A4QGB/GRRGl1GB/GRav/GRRDv/GReP+g
TLSH
T1109149A3E00CEE4AF68D747EF89EE6A4301788C328D6D453439B85E8CC0EDBD594E485
MD5 SHA1 SHA512 SSDEEP TLSH

files\core\general (ALT13).bat

SHA256 8eadbd0eac63aa87adaaf07359b815c316614c27cf6b478e4ef9b35c2fd8e7b7
MD5 82a31bff3556ba00d49834b278e0c642
SHA1 a3995ec5fd3f91f4186af30218a6596c5a1fc61b
SHA512 8686b8190250b90de8a5e4abcff08d3320b48f380cecf5f1c66232b03d3ab147992754e5ba6ab3e3882e102a399a92112964ff857a239dc43ff1234a2cf489d6
TLSH
T1FE818E63E00CDE47F5CD697EF85FEAA16027888728D6D452539B49E8CC0EDBE684F481
MD5 SHA1 SHA512 TLSH

files\core\general (ALT2).bat

SHA256 c9a43d689bae4303b061294aa8ce8dcd5c5a38f19c962391cafeef82bf7b5023
MD5 f7466f42744a09aed245dc31e05d4620
SHA1 f008f4c982f90c56d503cb8919547a1cc6e5933a
SHA512 e4a53daddb8308c1d6025226428c471ebb8a0e209e308453e1da39ea6ef23009524113987b4fec3801d5605698644efd11644f84c6003a93f96c38e4aea34192
TLSH
T166610757E00DDE4AB68E783FF89EE5E42017C8C31CD6D452529789E8C84EDFA494E485
MD5 SHA1 SHA512 TLSH

files\core\general (ALT3).bat

SHA256 eff9c48a0b379cd1c8f770bd7e64c52dad99e1f7ae082de5bc2fb8a88d9ee43c
MD5 53bc1c1c7f49ef19f8bc1a336b19c166
SHA1 6d81e9989c80002378088009f097e60085db70be
SHA512 6782502ee1e2ed97e06f5215d3775c162e8f4d35a401697a80b9d7a0734572242092a3b4320c1054383c3e4724e6006de7bfe1f779586ed20503f0cac2ed8454
TLSH
T129715B93E00CDE46F5CD687EF88EA5B56427888728D6C85152DA49E8CC4EDFA6C4F085
MD5 SHA1 SHA512 TLSH

files\core\general (ALT4).bat

SHA256 1565de56c2782c79ce20277081ea39643957d74db2b0df17e4ec493aad43afaf
MD5 ba4e3711e01e80e8d70eec4c44098d61
SHA1 13571571e0d6d295172961a5c9021128e726746a
SHA512 c9c0be5d7dc6f77278da65e4b2d6c83c4d166838400c40b4736155fdeab2a850031ecfc4f8c4813db78a38e909c0c65d9c21a1c7344284878beae8c955543029
TLSH
T18E813993E00CDE46F6CDA53EF8ABA6A421179CC318D6D452439B89F8CC0EDBD584E594
MD5 SHA1 SHA512 TLSH

files\core\general (ALT5).bat

SHA256 e745729c4785de344b36105407b5b6bdbda17d655be7c314b3aa73826db79272
MD5 1f035e25fe65433fa229f90f18468ef6
SHA1 0f4b03120ed08ea11b291940726d119a77d872c3
SHA512 e6e33b1e907c554cd683ad10c9cd02472516de6b9738bb4ed16bd41dacbc1873bf421cd92a9992cafc084e758753e7b8e386d2da266bac994f4572b202c34f9e
TLSH
T13341F397E00DDE46B48DA83EFC5AA5F5601B98C32CE5D466539788E8C84EDAE8C4E484
MD5 SHA1 SHA512 TLSH

files\core\general (ALT6).bat

SHA256 c32d3a253a3dcd827b5a6d3a1d903beaeda0e5ee65c1d2d1b0abbfc1f04f3005
MD5 37ec25f0901fbea19ac76881e634402e
SHA1 04bf0761db34aae33c00e5e3b00f48ca2a72ce2c
SHA512 e2052e74adc43a8f5721ec4228b51efdf24054c05e5381b85353ec3a32a0e6b051248d60774ad171cfe5cc65e5aa9da6cd6ce35708a11e3bd796b90f63362428
TLSH
T15B611657E00DDE4AB6CEB83FF85EA5E52007C8C31CD6D452529B89E8C84FDBA494E485
MD5 SHA1 SHA512 TLSH

files\core\general (ALT7).bat

SHA256 147911332e2734a3a7ff760fbabb1bd44d29e75ed0be12bced734270ec592ac9
MD5 7f98211bb42a98978221987bc39c6c3e
SHA1 a2c0c10c2074f090f819d7817bb38b7c6ccaa950
SHA512 dffd8afa407318abc55777e0b95b398a1298fb3ab6deaf57909e9cf737e6d8f3c17b4e76da5597a09d77e49a6fd51fe97a1e07d7f31a335aef691d2e3944beb5
TLSH
T19251F797E00DDE46B68EA83EFC9AA5F52017C8C31CD6D462539789E8C84EDEE4C4E485
MD5 SHA1 SHA512 TLSH

files\core\general (ALT8).bat

SHA256 bad7e2fac768330ad003b91d09a66035b43511155bd54682ba4833d3af0b1506
MD5 b550281136fb54ab10fc573dc48f2c10
SHA1 16e90df716e43e647a1ce92b8be05830c5ca2e60
SHA512 453a9197c3605305579f5ac30ca98c35c18f445da081c1818bbbfeb8d5ee1daae9c2d152a4827f28686f590f19dc56427a6fe0fef6988ae9c5e5b04538aa7bf1
TLSH
T154713A93E00CDE46F58C683EF89BA5B42127DC8728D5D452539B88F8D84EDBE584E584
MD5 SHA1 SHA512 TLSH

files\core\general (ALT9).bat

SHA256 10381483a04b690545a052f64a1c84df6857a74ac43a7985c88e2891e443f399
MD5 8789c3e38c7e74560ed25eb88d94316b
SHA1 2deebe6ec3d663cac7a22ce4caa0cd5625273ed7
SHA512 3f6bd5a602b9d933bf51704d743402a00d31ee350be9575b54bf2218dd78aa49f7093eaebecd04df8993e4c8fe89b28e2302327d69a2c1ea527ff4e82b04db82
TLSH
T109616993E00CDF4AB58D6C3EF89BA5B52417C8872CE6C851638689F8C84EDAE5C4F485
MD5 SHA1 SHA512 TLSH

files\core\general (EXP).bat

SHA256 3c83544634f4ab41dab0ff206158d024e4500a549a7d41f8a12810b5b09ef6df
MD5 fcbdad5f4f904ca166f6eacab727ac1a
SHA1 005e3053e72db6cc17b7e01986d60d459e0ecca3
SHA512 3af1e97bd2b5aadcf55be2e1046c96aed9c9efd785a8c8ee92a02d99d2edb092f24464c29b1938943a33fc04b74b0d207dfd0c4047060b5957e77d921d952945
SSDEEP 96:nL6743GB/GRRQ1pT/8EIiUGB/GRrVv/GRRQuv/tRr5P+R75+RR17i/:A43GB/GRRIa1GB/GRRv/GRRDv/tRlP+X
TLSH
T135914CA3E00CDE4AF6CE747EF49EB6A57017C8C328D6D453429B45E8CC4EDB9584E485
MD5 SHA1 SHA512 SSDEEP TLSH

files\core\general (FAKE TLS AUTO ALT).bat

SHA256 2d2311f6d05ba2dbb84840eedc5caf5da84d9bd40c95d83580c82009575e9478
MD5 3ab56032ca476282715f04b1e6ef8de3
SHA1 17f80f91fcadcb623efdc9b0e1cdeaf171313387
SHA512 4909316a1cddc0665d0c3e2d53801cd271ae3043f8405f0d8646e2eb0107cca72777773275a2bc1a21145b96d271857af216689bd9f7f61669ba323da829dac7
TLSH
T191714A97E00DDE47F68D643EF89FA2A46127C88329D6C851829A84F8DC4EDBE5C4E584
MD5 SHA1 SHA512 TLSH

files\core\general (FAKE TLS AUTO ALT2).bat

SHA256 46ab1f463e3a594750e96cbab5e1d8629b5561abe1eb155d24a34f93dcdf4e66
MD5 06c98777352036de3d658a7647a7ddec
SHA1 2fc127e3465ab701eaadfbfc875b09f79f3b9726
SHA512 4f09db603fca28b600bb74f98655eba06cf5090f619679f05c24caf383a0978c12ae10be347d1f77b8ff1088a81315574f083fe15ea8013b015d1666ab373d47
SSDEEP 96:nL674QGB/GRRQ1zxDUGB/GRbVv/GRRQuv/GRb5P+Rii5+RRLx1:A4QGB/GRRGxYGB/GRBv/GRRDv/GR1P+w
TLSH
T143915893E00DDE4BF7CEB43EF89EB2A5211798C328D6D452839A45E8C84EDB9584E590
MD5 SHA1 SHA512 SSDEEP TLSH

files\core\general (FAKE TLS AUTO ALT3).bat

SHA256 0b701b6df8f0e019a1256d1e86fb4bb073587c6bb2a53dc12f505bdd487074c1
MD5 037619dbf51e60248dca6adc0c2f77eb
SHA1 3103488496373053fbe683f1e08afe6bd897fd80
SHA512 a3b40335c14aae0a29f40fa9c7c2a63fff52f8982d0677bf512df74c7bdbb7ecb19685752dd0b5b56dc20d3e5e34ea7f3606d61f6d70f622b24cea8bca339447
SSDEEP 96:nL674QGB/GRRQ1zd1UGB/GRVVv/GRRQuv/GRV5P+R3i5+RRLxI:A4QGB/GRRGdmGB/GRvv/GRRDv/GRfP++
TLSH
T188815997E00DDE4BB6CE743EF89EB6A5711788C32CD6D452839B85E8CC4EDB95C4A080
MD5 SHA1 SHA512 SSDEEP TLSH

files\core\general (FAKE TLS AUTO).bat

SHA256 88e52040767fcbd4cfe2cc37873158ac890760d3f6e7ff7026c3fb993417e895
MD5 d3cb009397b6266589d1beb74d3be076
SHA1 3d4078e68c2413bc1e61567df3a829838d33130b
SHA512 124e60d8b60d062b0fac162f357a922e4268659347af670ca686f56f033296f905e17b74420d0df4c3d5e5b6b3144bfb91dc59e76eb5324692c22d56a1b3c2e0
TLSH
T197816C83E00DDD47F6CDB43EF89FB6A861279C8328D5C85282DA45E8DC4D9BE584F484
MD5 SHA1 SHA512 TLSH

files\core\general (SIMPLE FAKE ALT).bat

SHA256 9862af0175a4c3fd3082d3360d5e8bd5820f611dba12b9897628fa1355b9cfb7
MD5 0d6e9c069ee97e73b95b929ecd499c53
SHA1 e3867032d489ce00b4bea2e4c01b54b35ab5be94
SHA512 19e778e23a0c3c16b2f3475b8dd428f49a4d7c36bf20946e857ea38dd7765e08d6fc6c0c81c9ab6a0d5f4b9c3c89a0695b248b862c5d2c440cd43f9c28ef6076
TLSH
T13B812AA3F00CDE46F6CCA87EF89BA6A4212798C319D6D452439B85F8CC0EDBD584E594
MD5 SHA1 SHA512 TLSH

files\core\general (SIMPLE FAKE ALT2).bat

SHA256 87dd6441ec797c2cb769fe047846e5869e998ada4fc21f8182597a928cf5e040
MD5 9cddfe2d52dec3f5050a185c0ca8614a
SHA1 f0fea367fbea3e0688cfe6db9fd95d148d7ed55c
SHA512 617660dc85f93bfbb41835209f9cdf540a18e896b1666cb99572ee16f2597729e67dd241f6d460638f0bf2da7bf61597da7358b54e09005edb4b2e7fae384b49
TLSH
T1EE710B63F00CDE46F5CC697EF89AA5B461279CC329D6D452439B89F8CC0EDBE584E484
MD5 SHA1 SHA512 TLSH

files\core\general (SIMPLE FAKE).bat

SHA256 70f248bac2bb442cdd2dfb9215158d091c225003af2a285512dc74eb7ad93f25
MD5 27ae868d1049fa78da2ba1a93bbce507
SHA1 07b58f8cf69e186ce62a749845d291868a0d42c2
SHA512 730bb608ce1c96b4690d469ceb5e95f5c16dfba28fe8fc52289afb89f531fab667690f17a25f84eea8a9492583b257b14a072217233c8cf28682d021aeb1d809
TLSH
T1E6714C93F00CDE46F5CDA87EF89EA5B4212798C328D6D452439B89F8CC0EDBE584E484
MD5 SHA1 SHA512 TLSH

files\core\general.bat

SHA256 6ac4a347fa90062b195e4267896eca24da60473965ba5206bf24c7fbb274470b
MD5 6b2d7fea664d9f1667663ba5f033c6f2
SHA1 0c253ff99efaeba4fd61f77efecbe697dc24ebca
SHA512 abdf33f0c1e8999aa9de58e69e929c965a512d5da29289b67a4dae491b481301da34f8062d5523ff446d351f6f4591a447a1cf3ac55c05be0c52e05745d58078
TLSH
T1C96149A7E00DDE4AB68E787FF84EA5F13007C8C31CD6D462529789E8C94EDBA4D4E485
MD5 SHA1 SHA512 TLSH

files\core\lists\ipset-all.txt

SHA256 6f9bee038620b527c49fab24b21069de9b2acff1b7693476667c34669204f5b6
MD5 3206bc58ed45d39df984220d638740b6
SHA1 8003eb2a3ff01ac1cfe18f059f0af1590780ad7e
SHA512 21768980d6ac797c9294b2689f277dde48bd011f5b368b206cd06caa9760b9be510e779b37c1a0d94e4c473f603497bec4cc586d14b02b2cbeeb57c4aad0451c
SSDEEP 3072:vdFAYPvI6N2ClwfoPrK1LHYky4deCp6SIcm4BmIKx4w5xteumYEYsppucy7Zn36I:vbYvWLWmreqO3g
TLSH
T160D4593213B41BE78ACEA1EA3323957415D7D68611FAF273CB8F62623D21040F96795E
MD5 SHA1 SHA512 SSDEEP TLSH

files\core\lists\ipset-exclude-user.txt

SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 42ad35639873f78e1b2dc5c1039499df
SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
MD5 SHA1 SHA512

files\core\lists\ipset-exclude.txt

SHA256 96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
MD5 240532f20e114cd6de2906ebc86d683e
SHA1 f7d4b6e1ec084e64c367ac11f5fe21fff454fb68
SHA512 809e9961b2952acff12fb27b31895f9e7c0d70433363cdd8fd61bd522ffa835e7d403de3419092145673e10644aa0803d0e244d9cfff8d8bf784e783713f799a
TLSH
T147C09271516912FB0F876B21A13E0326F9475BCB26F37D64A36C5286EC504096029920
MD5 SHA1 SHA512 TLSH

files\core\lists\list-exclude-user.txt

SHA256 2b348fd583daf7ba7feb85fb71f32e23dec3990e802ab451a4a281c0aa264f4a
MD5 600bbdf13f7fb9bb077f2d5ffe6ac48a
SHA1 3d58b897568942c3d7516ab68e8af54ca2396077
SHA512 7d3bc89dd8d21bb43c17fbff4f19604e27abf66c35a590cbdc0cd023a022d1e97d4936c147123fca55012aed15596b781d4bf013ded284fb7a30040909c64c9e
TLSH
T161B09B218050106D3D4270136D08454575ED55FB2C779201555014EE395A531C074F6E
MD5 SHA1 SHA512 TLSH

files\core\lists\list-exclude.txt

SHA256 c9708474e79249845d722b6344370c73b8a4949341f2d8ec6c5b443caf6d44d4
MD5 eb4c6783ee199068c1fdf48a9448fb20
SHA1 2e9ec04614391fe3d723a73e83cde73f51abe125
SHA512 b1cb376508ce8a787aba72e7f52903d88ce60ce1220d63e7f8081544c7c27de53c2db6b3e00f761db3e0866f4cc01c5e3e74e2e3adaf57a67ad953c443ab68e2
TLSH
T16E31F1A0E44424917798F497D0A67E45B839723A85C1FCC552F8ED8C27C2291EFCAA74
MD5 SHA1 SHA512 TLSH

files\core\lists\list-general-user.txt

SHA256 c1191e6c61d0a3b1904aad5862d99c1ca8db70c29167c457f09d0983c1b8a075
MD5 18a281d1d691f3535af5c41879460a49
SHA1 f9a595c3c253a3a6471dd9b2b2ddffcc5b0af9a9
SHA512 989e542c39446fd2b5415505083800e17c76915d15b9394b805246fa3d4d22652269539a95be966334fd349eb50b03eddd17817e654583162de68032ce517d85
TLSH
T13AD097084A90063E3C63C6A8393C3CADDB0278337CD2E1E02168A256A301C6848F39C9
MD5 SHA1 SHA512 TLSH

files\core\lists\list-general.txt

SHA256 9ff3ae9e4bf0edbcf8fecb1bba7aac951aace2036cdb732ec3ef65dfc6db443b
MD5 316adb4bdd3c1e3418dc1627c1129794
SHA1 0b765481aa45b883dcb5181787b9756f9b812819
SHA512 d63361b654aebe85bf59f3c8c2d22b77e952e846a0d6b185a5dc7361567ae2dc8bee18a04d02a680b430f58e8521d6fe1919fd99d91c76c3f14d4b93a22cee1d
TLSH
T13E113356A1A997102B1DD0E4245422A02380B4B418CFE6E39B6FC19F490D3FEB3C0AA7
MD5 SHA1 SHA512 TLSH

files\core\lists\list-google.txt

SHA256 4104b8f5119f76a3642e3176987bbcf817d98daa4899a7ecf9ee2c254958e33b
MD5 2d099c8547925f13d6ab23dc2ccd8f19
SHA1 ba822130389f13343a6f0a711962fafccb809173
SHA512 e8b82795d202e52e93c63894404ac3b8afdca677e0ff1836314655e22cb81f16b991ffc3aff80cacbe81c81dfa2bfac8f837a3cd5ec658b3dd9e1674b96468a4
TLSH
T116F0ED87780EC09F5202E9C818F06549B62CF23586D9E6F4DD61D07E60ADB4635C18E2
MD5 SHA1 SHA512 TLSH

files\core\service.bat

SHA256 697573a2f6f3a32cc06a6ea8ba22718bd8997f14d12973076dd61c632df738d0
MD5 37a341215ec8e7621c3090d23ca38b7d
SHA1 57025f2bd96e33fb618b5e11ddc75c718595ae56
SHA512 d3885ca2ea7d9a50190dc6645b32ed34be114f0c5432ce4b46e069ffc6ef22aa7238248ddcd6869c237d65d337421edc82fb20bc42e08f7eb61eecbcf52f049a
SSDEEP 96:6D0kf6R4YqB4EDwJm+l+PfPub+lmNS+Nv0+s2VqHswaJWxrJWEyKnDvTsocNx:hR4YqB4EsJmaP6rc0h2VqMwaJWFJWEyZ
TLSH
T1F691BAF4C8042502CEF121BFF2478995E67AA5D38A56969D3E1440473B3F693CCEE2A8
MD5 SHA1 SHA512 SSDEEP TLSH

files\core\utils\game_filter.enabled

SHA256 9e3dbe0a16e58797ba9b8d0ff475dc0dbb5fbcab8b5c9e9f39daec57fad121b9
MD5 71b1b880448ff68b9fe6d850e29e74b1
SHA1 109175b8db620da1a06be64f4ddf9c1a8bc70e3b
SHA512 251f56f4dbe8b31e3eb8ef93c36a7edcdef86ff045c8b3f55e081cce90b42a367f2be291fc73f961f7495302417f25988ad7efb9e6c4420984ce43491b7d2d08
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

ZapretTray-0.8.zip

README.txt

Setup.exe

generic

files\ZapretTray.exe

generic

files\core\bin\ACTIVE_DISCORD_UDP.bin

files\core\bin\ACTIVE_GAME_UDP.bin

files\core\bin\WinDivert.dll

advapi32

kernel32

generic

files\core\bin\WinDivert64.sys

ntoskrnl.exe

hal

ndis.sys

fwpkclnt.sys

wdfldr.sys

generic

files\core\bin\cygwin1.dll

kernel32

ntdll

generic

files\core\bin\quic_initial_4pda_to.bin

files\core\bin\quic_initial_5ka_ru.bin

files\core\bin\quic_initial_lemana_pro.bin

files\core\bin\quic_initial_rutube_ru.bin

files\core\bin\quic_initial_steam_chat_com.bin

files\core\bin\quic_initial_steamcommunity_com.bin

files\core\bin\quic_initial_steamstatic_com.bin

files\core\bin\quic_initial_tencent_com.bin

files\core\bin\quic_initial_www_google_com.bin

files\core\bin\stun.bin

files\core\bin\stun2.bin

files\core\bin\tls_clienthello_4pda_to.bin

files\core\bin\tls_clienthello_5ka_ru.bin

files\core\bin\tls_clienthello_awswaf_com.bin

files\core\bin\tls_clienthello_max_ru.bin

files\core\bin\tls_clienthello_sochi_park.bin

files\core\bin\tls_clienthello_steam_chat_com.bin

files\core\bin\tls_clienthello_steamstatic_com.bin

files\core\bin\tls_clienthello_teamspeak_com.bin

files\core\bin\tls_clienthello_www_google_com.bin

files\core\bin\tls_clienthello_www_sferum_ru.bin

files\core\bin\winws.exe

cygwin1

advapi32

kernel32

ole32

oleaut32

wlanapi

windivert

generic

files\core\general (ALT).bat

files\core\general (ALT10).bat

files\core\general (ALT11).bat

files\core\general (ALT12).bat

files\core\general (ALT13).bat

files\core\general (ALT2).bat

files\core\general (ALT3).bat

files\core\general (ALT4).bat

files\core\general (ALT5).bat

files\core\general (ALT6).bat

files\core\general (ALT7).bat

files\core\general (ALT8).bat

files\core\general (ALT9).bat

files\core\general (EXP).bat

files\core\general (FAKE TLS AUTO ALT).bat

files\core\general (FAKE TLS AUTO ALT2).bat

files\core\general (FAKE TLS AUTO ALT3).bat

files\core\general (FAKE TLS AUTO).bat

files\core\general (SIMPLE FAKE ALT).bat

files\core\general (SIMPLE FAKE ALT2).bat

files\core\general (SIMPLE FAKE).bat

files\core\general.bat