RegionLauncher-0[.]3[.]0-alpha[.]27-win-x64[.]zip

resource
unpack001/app/DnsProbe.exe
unpack001/app/DnsProbe32.exe
unpack001/app/RegionHook.dll
unpack001/app/RegionHook32.dll
unpack001/app/RegionInject32.exe
unpack001/app/RegionInject64.exe
unpack001/app/RegionLauncher.dll
unpack001/app/RegionLauncher.exe
unpack001/app/RegionProbe.exe
unpack001/app/RegionProbe32.exe
unpack001/app/RegionSession.exe
unpack001/app/YamlDotNet.dll
unpack001/app/proxy/mihomo.exe
unpack001/install/package/ProxyBridgeCore.dll
unpack001/install/package/RegionNetworkService.exe
unpack001/install/package/WinDivert.dll

RegionLauncher-0.3.0-alpha.27-win-x64.zip

SHA256 17bd4980523fc1add4fa2e9ce77bb50023bb886886d920fa53471cf3238afbca
MD5 8414cedc2349204a0a481442fdd679e9
SHA1 bbdebf92f1cc62104cd1952d9598f5dfbc67203b
SHA512 e176d49fa37eae696fdd6e2dd3dfbfabcf4b0ef7282e7351332641053024a050004e1813775523393cfd0bca20a56cf58195ff5714e2ff031c6c510b3903afb6
SSDEEP 393216:qo81LFNZ8Amu+3JAxvU7JFA/aXb4L4xpUoNmnrQJbMWwxsv93em5WgxBqXu91nMU:qo81LF23JUYUar4L4rUoNWkJbfksJeWZ
TLSH
T14C473398CA950E54C7371C32B522E4B65CB35DCD9EBBE22ED8B811604BE53307607ADB
MD5 SHA1 SHA512 SSDEEP TLSH

CHANGELOG.md

SHA256 0055cef9260eceefe941a94e3437f2ea5cee584432880217648cc68bfcfbd47a
MD5 fed19a6af2f76cd7320f61be23e8401a
SHA1 7cf34ce015f67d1aabed7bfeeecb3a4dd88b6b8b
SHA512 6a9fb9349706c3c0d1b057f34b42cc9cfedeb64f3161575562e6f291f77932f7f4e4ddc4f6282214faa1b0d9cb3a3c59c3a5a6d8fa963cfc41c68eb793790d4d
TLSH
T14A21A76F40F42EC556226FB202DCB09FFE54E82786B032F45AA7C78D7C0D0590044D41
MD5 SHA1 SHA512 TLSH

LICENSE

SHA256 981b8424f241c259cd50d2ebec9fdbdf60493d9c26bf3cbe9ad9c2d9a3939d49
MD5 537b058decc5d4f4ce956638cf568ea3
SHA1 e0b4bdc83b6eb021c6656e7d8c5f1b82a5c4844f
SHA512 d7d4933118a3cca86f2266fbb4f8333968a5863f2f81fc531815041fa7ccc1e261d36aa34e042ba35ba2b73d31f4b8b0ee833f7c80ab7d37466f0dbe14d38b07
TLSH
T16021961F725407A21C9A13604674ECD9B22BB25A7E5F2A85146EF385233B06CCAFB840
MD5 SHA1 SHA512 TLSH

SHA256SUMS.txt

SHA256 a1fd901ddae5ca091cfab77f1fefb3fd40600d786b2e30bd7a54611523793b13
MD5 1c338cb0148bb660fe594047fcc2f074
SHA1 96e004af25578c6bc2759d80ede463679101e71f
SHA512 aa07ff4025a0b815aaeb76a30911b6475096bcd75c429dd14568c3a00759bf31731da93adc06aedcdc57664c992fcc3b7dbb25b1b1dbbc41a5e155042d734075
TLSH
T1C841EB9CE104E3F0B135518E7C7AC5E42B5D29B443B753D525DD3052268F750A603C33
MD5 SHA1 SHA512 TLSH

app/DnsProbe.exe

IMPHASH 1d95d8d34f6501d8484c5aa04da078a4
SHA256 a5f9729164b5ed0c36125ab8f59281f9afb0164cdea9d05ec5504613ed0e735d
MD5 ad3fe9e876c5695e1a814b76aa07d318
SHA1 72850a2476f266b5f1cd2cafd523ed217a7b0d88
SHA512 d9ed419750530fe2bb0c280f1739d844738299ebe3d951a767da6fa26e22a8d58781cf2221b82cc12438bb627c969d60fbc8302ef425621c42b8a574520df1f1
SSDEEP 3072:XlP6bBwB2Ko89Jj9NcuAh4T0oWuvYLdCj+1Kou+cMM:XlPto89JJNcug4jvYhwWPM
TLSH
T10E047D15B7A611FAE1378A38C8520A02FB737C5547A0AADF17904AF69E237D09F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

closesocket inet_ntop InetPtonW FreeAddrInfoW freeaddrinfo GetAddrInfoW getaddrinfo WSASocketW WSASocketA WSAGetLastError WSASetLastError WSACleanup WSAStartup gethostbyname socket setsockopt send select recv ntohs htons htonl getsockopt ioctlsocket connect __WSAFDIsSet

dnsapi

DnsCancelQuery DnsFree DnsQuery_A DnsCancelQueryRaw DnsQueryRaw DnsQueryRawResultFree DnsRecordSetCopyEx DnsQueryEx DnsQuery_W DnsQuery_UTF8

iphlpapi

IcmpCloseHandle Icmp6CreateFile

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP SetEnvironmentVariableW FindNextFileW FindFirstFileExW FindClose GetConsoleMode SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx GetFileSizeEx HeapSize HeapReAlloc CreateFileW WriteConsoleW IsValidCodePage SetLastError GetEnvironmentVariableW CloseHandle SetEvent WaitForSingleObject CreateEventW Sleep CreateProcessW GetModuleFileNameW GetModuleHandleW GetProcAddress WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetConsoleOutputCP RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FlushFileBuffers

Name

.text

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

app/DnsProbe32.exe

IMPHASH 14f8199f3396f3a8f0d0738f2efb82cd
SHA256 c5f6fe9b1738bb3e969334db9980d6caafe3036f1045fffbccd90a7f66ec1f2b
MD5 4de7e3d6d4010926b37f74fd4a47e050
SHA1 bfff53a702484ab0354a3dd687e568ccf503d2e8
SHA512 f754e8deea8e7179bde48661892765ebcecceb3e97203fdd30f09e7cd0d45b135dce57382ec9f4ca52339969e457b9f6735beacf2dfa94b1d33e18bf708782ab
SSDEEP 3072:GDkepcfkDWFxk/JaB5VxMopiB7iRxB/0+FPB0gh7:GekDR/+LMopiV0v/73F
TLSH
T1E7D36C11B8D1D033D6AA4C304965CEB58E2EFCB04FA06DDB77841EF64E246D09B39A5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

closesocket inet_ntop InetPtonW FreeAddrInfoW freeaddrinfo GetAddrInfoW getaddrinfo WSASocketW WSASocketA WSAGetLastError WSASetLastError WSACleanup WSAStartup gethostbyname socket setsockopt send select recv ntohs htons htonl getsockopt ioctlsocket connect __WSAFDIsSet

dnsapi

DnsCancelQuery DnsFree DnsQuery_A DnsCancelQueryRaw DnsQueryRaw DnsQueryRawResultFree DnsRecordSetCopyEx DnsQueryEx DnsQuery_W DnsQuery_UTF8

iphlpapi

IcmpCloseHandle Icmp6CreateFile

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP SetEnvironmentVariableW FindNextFileW FindFirstFileExW FindClose GetConsoleMode SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx GetFileSizeEx HeapSize HeapReAlloc CreateFileW WriteConsoleW IsValidCodePage GetLastError GetEnvironmentVariableW CloseHandle SetEvent WaitForSingleObject CreateEventW Sleep CreateProcessW GetModuleFileNameW GetModuleHandleW GetProcAddress WideCharToMultiByte IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetConsoleOutputCP RaiseException RtlUnwind DecodePointer SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FlushFileBuffers

app/RegionHook.dll

IMPHASH 2dc5818ed06565d71b2d80c0ed206190
SHA256 1d679877b1759a358b70c0e5d6e8d3bdf64027a97d7accf5227617b8d5683ba9
MD5 8dde133766a139ed574c621a01a15b43
SHA1 010d1211a4a2872c14c56e36855c606830561413
SHA512 67adcfde10125adfc302909f89af7fa69b9807cb9b5b5bdc6e59e307cde1aaf7a46639508cce4000c84e889e4abf1d252cf11b33d373ee632894567b5d4e18a3
SSDEEP 6144:RRo733aCQTPgYmeOjXIp/D7pvWGqrjCu9iky1ky/bwH1:vkts3vWGqrjBMzk1
TLSH
T197546C5AE6A508BBE527C17DCD538A09E7B2BC1A0360D6DB43904E9A5F23BD04F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

87248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExW EnumDynamicTimeZoneInformation

dnsapi

DnsQuery_A DnsQuery_UTF8 DnsQuery_W DnsQueryEx DnsQueryRaw DnsRecordSetCopyEx DnsFree

ws2_32

WSASendTo htonl WSAGetOverlappedResult sendto recvfrom WSAIoctl WSAConnect WSAGetLastError WSASetLastError htons getsockopt getsockname getpeername connect closesocket bind InetPtonW ntohl WSARecvFrom

iphlpapi

Icmp6CreateFile GetIpAddrTable

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen

wininet

InternetOpenW InternetOpenA

shell32

ShellExecuteW ShellExecuteExA ShellExecuteExW ShellExecuteA

user32

FindWindowExW GetWindowThreadProcessId

kernel32

HeapSize HeapReAlloc GetFileSizeEx SetStdHandle GetStringTypeW GetProcessHeap WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW WriteConsoleW SetFilePointerEx FindFirstFileExW FindClose GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType GetStdHandle LCMapStringW GetTimeZoneInformationForYear GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW CloseHandle DuplicateHandle GetLastError SetLastError ReleaseMutex WaitForSingleObject CreateMutexW GetCurrentProcess ExitProcess TerminateProcess GetExitCodeProcess CreateRemoteThread GetCurrentThread ResumeThread CreateProcessA CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute FlushInstructionCache OpenProcess GetSystemTime GetLocalTime VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx IsProcessInJob OpenJobObjectW IsWow64Process2 GetModuleFileNameW GetModuleHandleW GetProcAddress SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDynamicTimeZoneInformation SystemTimeToTzSpecificLocalTimeEx TzSpecificLocalTimeToSystemTimeEx CompareStringOrdinal MultiByteToWideChar GetLocaleInfoW GetLocaleInfoA LocaleNameToLCID GetUserGeoID GetUserDefaultGeoName GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetSystemDefaultLCID GetUserDefaultLCID GetThreadUILanguage GetUserPreferredUILanguages GetSystemPreferredUILanguages GetThreadPreferredUILanguages GetLocaleInfoEx GetUserDefaultLocaleName GetSystemDefaultLocaleName K32GetMappedFileNameW CreateFileW ReadFile WriteFile WaitNamedPipeW GetOverlappedResult CancelIoEx ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared CreateEventW WaitForMultipleObjects GetTickCount64 GetQueuedCompletionStatus GetQueuedCompletionStatusEx WaitForSingleObjectEx WaitForMultipleObjectsEx GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext VirtualAlloc VirtualProtect VirtualFree VirtualQuery FreeLibrary LoadLibraryExW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead HeapFree RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc

Name

.text

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

app/RegionHook32.dll

IMPHASH 0d2835d027d431a6f79e699f95a753cb
SHA256 f34dc45738aea2165c9f9f75b3722e0354ec2336780f7e5cd24edd42aacbe1a5
MD5 219edc584b58d0c5d711afbf73aa75a5
SHA1 e58f885070e31ea3dcbac311264a736481697c0c
SHA512 ba4fcd6c5c9945e8376eeeded6337ec2dea613b3234631f5c659ba088a424344baa2ff5455618fa996ad9602d8747997650462db6d219fd2503cc83cc3acf0d3
SSDEEP 3072:T4lpQVtcsocKDQc3E/IOmKhRmrzk2EZ0zvdf2CooeqDSMLrnmv5LBECTS29PtPLB:T4ltEZ0rdudJz2rn2ECTS8PtgtxX+cC
TLSH
T179246C01B941D473D6AE0974492DDF798ABCF9A08F6298CB73842EEA4D606C07F3571B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

73744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExW EnumDynamicTimeZoneInformation

dnsapi

DnsQuery_A DnsQuery_UTF8 DnsQuery_W DnsQueryEx DnsQueryRaw DnsRecordSetCopyEx DnsFree

ws2_32

WSASendTo htonl WSAGetOverlappedResult sendto recvfrom WSAIoctl WSAConnect WSAGetLastError WSASetLastError htons getsockopt getsockname getpeername connect closesocket bind InetPtonW ntohl WSARecvFrom

iphlpapi

Icmp6CreateFile GetIpAddrTable

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen

wininet

InternetOpenW InternetOpenA

shell32

ShellExecuteW ShellExecuteExA ShellExecuteExW ShellExecuteA

user32

FindWindowExW GetWindowThreadProcessId

kernel32

SetFilePointerEx HeapSize SetStdHandle GetStringTypeW GetProcessHeap WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc WriteConsoleW GetFileSizeEx FindClose DecodePointer GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType GetStdHandle LCMapStringW GetTimeZoneInformationForYear GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW CloseHandle DuplicateHandle GetLastError SetLastError ReleaseMutex WaitForSingleObject CreateMutexW GetCurrentProcess ExitProcess TerminateProcess GetExitCodeProcess CreateRemoteThread GetCurrentThread ResumeThread CreateProcessA CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute FlushInstructionCache OpenProcess GetSystemTime GetLocalTime VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx IsProcessInJob OpenJobObjectW IsWow64Process2 GetModuleFileNameW GetModuleHandleW GetProcAddress SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDynamicTimeZoneInformation SystemTimeToTzSpecificLocalTimeEx TzSpecificLocalTimeToSystemTimeEx CompareStringOrdinal MultiByteToWideChar GetLocaleInfoW GetLocaleInfoA LocaleNameToLCID GetUserGeoID GetUserDefaultGeoName GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetSystemDefaultLCID GetUserDefaultLCID GetThreadUILanguage GetUserPreferredUILanguages GetSystemPreferredUILanguages GetThreadPreferredUILanguages GetLocaleInfoEx GetUserDefaultLocaleName GetSystemDefaultLocaleName K32GetMappedFileNameW CreateFileW ReadFile WriteFile WaitNamedPipeW GetOverlappedResult CancelIoEx ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared CreateEventW WaitForMultipleObjects GetTickCount64 GetQueuedCompletionStatus GetQueuedCompletionStatusEx WaitForSingleObjectEx WaitForMultipleObjectsEx GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext VirtualAlloc VirtualProtect VirtualFree VirtualQuery FreeLibrary LoadLibraryExW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead HeapFree RaiseException RtlUnwind InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleExW IsDebuggerPresent UnhandledExceptionFilter HeapAlloc

Name

.text

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

app/RegionInject32.exe

IMPHASH d219667b00d86960a40a0986494fb59f
SHA256 d636f6a5a41f2828bc48e91d0aab8cdba30b45d86550771b62044c8345260ace
MD5 4a8a304f71027f3452298966507c2c1a
SHA1 038d9ce7f9400bfbf624dffa20750524a3e9f7ec
SHA512 5d96eeb0e04302df562f03662adca158ee506a1dc164bcbf17cb99ddc7ffb6991d71de00076262abf7dcae6d6d9e0619b7afc06d59bec6597033e1f50e2514a5
SSDEEP 1536:7otpvxS9v9hxP3Agzw/HhpFzYpm5HoNmc+RnvRPA6RV8RQbzMsW/oUcdxQqYfllw:70vxS9VhBAiKzYpmemc+RvRPAs8RQHvC
TLSH
T181938E40B5D2C471EA7209354CB8DE75463EF9601F649FEB339812BE4F342C05A36AAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetLastError SetLastError WaitForSingleObject TerminateProcess CreateRemoteThread GetProcessId FlushInstructionCache VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx IsWow64Process2 GetModuleHandleW GetProcAddress K32GetMappedFileNameW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent WriteConsoleW RaiseException RtlUnwind FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW DecodePointer

app/RegionInject64.exe

IMPHASH b1acac0b7ad5598dee75ef5184dc4678
SHA256 603a3a7336d3cde9b5e136eb9d68b72e70b221d156c12941fdef13b871a0b0be
MD5 15d2fa04c7b6a235d7842841390b90d3
SHA1 199729169e235a2d34f32d08c2a44cb1b6c9fff5
SHA512 166f5c849987b555b3db62f2751869e143048626b9a7200bc4d1e15cdd99abd56e98f36562fc7182d6968ae28965e9e1176904823d7c5e7855ce215623dfaa5a
SSDEEP 3072:5R3HBh06SOFGFRkN6K1p41lgthW+K9THYEbiy:vX36Rk9v4PgjMiy
TLSH
T1D8C35A47B3E931F8E177867984920A0AEB76B8314761ABDF07A4475A1F237D08D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetLastError SetLastError WaitForSingleObject TerminateProcess CreateRemoteThread GetProcessId FlushInstructionCache VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx IsWow64Process2 GetModuleHandleW GetProcAddress K32GetMappedFileNameW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW WriteConsoleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW

Name

.text

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

app/RegionLauncher.deps.json

SHA256 6a153c358b5c158da6a6031ed687216533f63d7d6a9cabcd37ba85c5d3a93b54
MD5 2dae7c44cdb4ae7efbb67b230000c7e1
SHA1 3894641f9933a8089683eaf9e67d11ed5a364e77
SHA512 c78696374942934ffe8f3a382a8a353047762414e024204df12d99e8b6413e6b29e178322a64d3316539eb89a5bf989452397057a6bedbd3e5a229361cdcb0ad
TLSH
T149110E1DE4800DE749B227F268394243FAAA072F20001C6E78FDA46CAF7BD0BA445F35
MD5 SHA1 SHA512 TLSH

app/RegionLauncher.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 21906a57089c0f6782049cc303d527da3f2ad6470bd1e1aa35769ec4611565c2
MD5 b422e696bec17f4e8743a85284aac35e
SHA1 a0f4a54785a4d839e8139eab0a13a322b7af6ac5
SHA512 156916572aa3cd8a8f6fdefad3bf24745176f1e841e9275dca9ec0eb665db00371991a99e2947d4c88dee062637c3dd46be81dd130294477abd40c171e771c4f
SSDEEP 6144:hGvZ1A8NSaRhzW5h3XBIHVeJNC8Z/g52b8ZYg52:hGvA8NdRhzWT9N
TLSH
T12044BF6433BC4F47C5EF4FBDA074319243B9C66FA556FB8D8D8578DE08A63806801A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

220586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

G:\Codex Projects\2026-11-04\wo-xia\work\region-launcher\src\obj\Release\net10.0-windows\RegionLauncher.pdb

app/RegionLauncher.exe

IMPHASH 53e4e12437621212a425d294842d0a96
SHA256 66c279fbc827feb11ec580d8006b326e5e175b801dffb31c4696381d3bb3e57b
MD5 8528daf5ecaa1c5b9433e7f257b53adf
SHA1 c60c67a75471c5c981752046ac2c126d00c5c5ef
SHA512 c6d30ab78e2f19116c62caeaae7599fef3005488be5133db5918cea20d35d43cbcb5ef911060c8720f05b59072062e108a85b87698e37e050961496837a4c84c
SSDEEP 3072:UVDxk88wN1nLVu7dL1Z9QnlX9rE38wm1VzaAT5T5a0y7Di8U4zgRjJITuH:wHRu7F1nQnZ88Uo18Zzg52
TLSH
T143246D13A7A811BEE1B3D67CC9A24941FB7278594B71A7CF07504EB60F66BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

80800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

shell32

ShellExecuteW

advapi32

RegCloseKey ReportEventW RegisterEventSourceW RegOpenKeyExW RegGetValueW DeregisterEventSource

kernel32

TlsFree CreateActCtxW ActivateActCtx GetLastError FindResourceW GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetStdHandle GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose GetFileAttributesW MultiByteToWideChar GetConsoleMode GetFileAttributesExW LoadLibraryA WriteConsoleW DeleteCriticalSection WideCharToMultiByte IsWow64Process OutputDebugStringW GetCurrentProcessId TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode fputwc __acrt_iob_func __stdio_common_vswprintf _set_fmode _wfsopen fflush setvbuf __stdio_common_vsnwprintf_s

api-ms-win-crt-locale-l1-1-0

_create_locale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func __pctype_func _configthreadlocale setlocale _lock_locales _free_locale _unlock_locales

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp toupper strcpy_s _wcsdup wcsnlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

app/RegionLauncher.runtimeconfig.json

SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
MD5 7e4444b5a3e3cea574693f055f944011
SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
TLSH
T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
MD5 SHA1 SHA512 TLSH

app/RegionProbe.exe

IMPHASH 8c1cb7a3ca410d3cd89865fe8e4da5a8
SHA256 bdd34af0b978b80a814283b164706af7a89ec9f9de60cdb332ae3cce224f3d63
MD5 180bb11fa0da05ccb6ca7240373ad835
SHA1 9fe138474e725f2e9448188ee80160950357486c
SHA512 dfa1148eaee4b9ffdf1f68671f0a8bfa33c186de2c2b2c80f03e21f86f58c8d9e330e7fb40bec4e2df9a90227a53f54443ff0cd981ba41aff396a04aa83e5d37
SSDEEP 3072:2CAIi7rViRd6bHqGCxCqMXR3403S3zU7EEfRr2LV4uZKxC:2CAIjseGCxCqMB1szU7tfXC
TLSH
T16A046C05B3E911F9E1778278C9924602E7B3781507309BEF07A4577AAF276D09E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

closesocket InetPtonW WSAIoctl WSAGetOverlappedResult WSAConnect WSAGetLastError WSACleanup WSAStartup socket setsockopt sendto send select recv htons getpeername ioctlsocket connect bind

advapi32

RegGetValueW

kernel32

HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetProcessHeap WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW FlsFree GetEnvironmentVariableW CreateFileW WriteFile CloseHandle GetLastError WaitForSingleObject CreateEventW Sleep GetCurrentProcessId GetExitCodeProcess ResumeThread CreateProcessA CreateProcessW GetSystemTime GetLocalTime GetTickCount64 GetModuleFileNameW GetModuleHandleW GetDynamicTimeZoneInformation SystemTimeToTzSpecificLocalTimeEx WideCharToMultiByte GetUserGeoID GetUserDefaultGeoName GetUserDefaultLocaleName QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW FindNextFileW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW

Name

.text

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

app/RegionProbe32.exe

IMPHASH 1066aa88b999bdfd22f8ba53e17f22ce
SHA256 805f93d77ca664a10b04795eed8fd9bf607a125a2885ce6022e7899c5496aeb7
MD5 fb6d0aafc0a41792e0d8eafe8c64835f
SHA1 b53e38f7d18b5feb6283ebfe7e855875ea709344
SHA512 0c12786a5cbdf6b7f5423d96d79f9e3d5d78ebfd375b32f5f7c40494248673347d3e5dae4dfeb00fe3e401254ed924984a864af27d69eaf5bbf1d444665d3e97
SSDEEP 3072:+/oPTYhVwtTbiwpGvsePqRHJhrUSzmE3B1Iy23zfuv:QgtWs9JhrUSSAzIZm
TLSH
T112D38D1179D1C072D9B755350978CFB2867DF8300F609EDB6398267A9F242C06F35AAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

closesocket InetPtonW WSAIoctl WSAGetOverlappedResult WSAConnect WSAGetLastError WSACleanup WSAStartup socket setsockopt sendto send select recv htons getpeername ioctlsocket connect bind

advapi32

RegGetValueW

kernel32

HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetProcessHeap WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW FlsSetValue GetEnvironmentVariableW CreateFileW WriteFile CloseHandle GetLastError WaitForSingleObject CreateEventW Sleep GetCurrentProcessId GetExitCodeProcess ResumeThread CreateProcessA CreateProcessW GetSystemTime GetLocalTime GetTickCount64 GetModuleFileNameW GetModuleHandleW GetDynamicTimeZoneInformation SystemTimeToTzSpecificLocalTimeEx WideCharToMultiByte GetUserGeoID GetUserDefaultGeoName GetUserDefaultLocaleName QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent FindNextFileW RaiseException RtlUnwind SetLastError FlsAlloc FlsGetValue DecodePointer FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW

app/RegionSession.exe

IMPHASH cfb2402f018f4296a4214100ada5b97a
SHA256 243e0ade7d3248f662793753b23271c224a89aca4fc60863a791c2189091de04
MD5 792151fab9decb727fbb8d7185d644a8
SHA1 f2aced3965ce328b427bb4cfff231116f7540f82
SHA512 2144e8aedc276ea13b407a2155a9566f29c92d01c338c521fa4244500da9edc66c1689add2b54323f179e09ff89de065058b4b37653123a910164ff76fa0c53f
SSDEEP 6144:ree5/x3cC2+fliuWo+MAr21yb1gnbTJDX:iwuuP+Zr21SKb
TLSH
T1D6447D15F7A418FAED67857DC9538902EB72BC5247A0EACF03905AA71F236D04E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

64464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

__WSAFDIsSet inet_ntop WSASocketW WSAGetLastError WSACleanup WSAStartup shutdown setsockopt sendto send select recvfrom recv ntohs ntohl listen htons htonl getsockopt getsockname getpeername ioctlsocket connect closesocket bind accept InetPtonW

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable

advapi32

OpenServiceW OpenSCManagerW CloseServiceHandle EnumDynamicTimeZoneInformation QueryServiceStatusEx

kernel32

GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetFileSizeEx GetStringTypeW SetFilePointerEx ReadConsoleW FreeEnvironmentStringsW GetConsoleOutputCP FlushFileBuffers GetFileType LCMapStringW CompareStringW GetProcessHeap SetStdHandle HeapSize HeapReAlloc SetEndOfFile WriteConsoleW GetConsoleMode GetStdHandle SetEnvironmentVariableW CreateFileW DeleteFileW GetFileAttributesW GetFullPathNameW ReadFile RemoveDirectoryW WriteFile CloseHandle DuplicateHandle GetLastError SetLastError WaitNamedPipeW GetOverlappedResult CancelIoEx SetEvent WaitForSingleObject CreateEventW OpenEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateRemoteThread ResumeThread CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute FlushInstructionCache OpenProcess VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx IsProcessInJob CreateJobObjectW OpenJobObjectW TerminateJobObject SetInformationJobObject QueryInformationJobObject IsWow64Process2 FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW SetDefaultDllDirectories GetPrivateProfileStringW GetNamedPipeServerProcessId WideCharToMultiByte GetGeoInfoW IsValidLocaleName K32GetMappedFileNameW GetEnvironmentVariableW ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetTickCount64 QueueUserWorkItem GetNamedPipeClientProcessId FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 GetFileInformationByHandleEx MultiByteToWideChar WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCPInfo IsProcessorFeaturePresent ExitProcess GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect

Name

.text

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

app/YamlDotNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d618138109a40e4a7250e49e2abad8c450e3636bee18d7499ab231e37fa9150a
MD5 9593434009bbc4a1f81209c477a0a52b
SHA1 5ad5f8b22d2c04a9c859a1d063860553dac258ff
SHA512 d982bd851119197e9602f7f4f5f545bcfd03d23b2bdf7253eb1e1f0334ab937b823d95e254549900f879b02d31c5c8ddc88d126571551203015b918b8ae42ebb
SSDEEP 6144:wA/HZpgZdsEsAFHsIU2UVcYaPWk2N3w1:V/HZpgZdsR0ZUdchPWk2N30
TLSH
T174543C0373AD4326EB9F67F9B8B0119947F9FC2AA0B9E78D198694E51C527D04A007B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

305378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/YamlDotNet/obj/Release/net10.0/YamlDotNet.pdb

app/licenses/Detours-MIT.txt

SHA256 f854ae8aabc0404652b48a2b3bf7f21ec174c69d73f5596934c20884eb0639ef
MD5 c26b34f5996c7ed7f7bce6aaf6c8a98b
SHA1 553e3a3efec9a07d9b08fcaadbcd88f2099aada8
SHA512 e3c82bfe3bacb07e3a8327a01b2c9772e44bfa1a8012c0f0b363d6e3b2ee2371bc66f9c207611cd6f73d6f1ff1ceb9b2bf2c7d0864ade256d41d533b598a804f
TLSH
T1FA21961E721507671856176155A9F885F22BF18B7D6F1684346EF308232705CC6FB868
MD5 SHA1 SHA512 TLSH

app/licenses/ProxyBridge-MIT.txt

SHA256 ab139341a79adba98055f1bd93dcc765c8374940b473632484478d4ecc9e6062
MD5 d8a8b33b5a8b732b23217deec6509533
SHA1 eb9d81c144904a66acbc04e763a11081fb03616a
SHA512 19c9a084e941d5e14baf631f14d18f4f414514027ec1c3b444130d67977ecc1db6d6849581022d7cc8677ca9bdc9c5130c16b1589b162afa042d2f319d0d773d
TLSH
T16111E91F729A0377189217A005B8ECD5F12BB04B7F6F2584306DF2091326018C9FFC64
MD5 SHA1 SHA512 TLSH

app/licenses/RegionLauncher-MIT.txt

SHA256 981b8424f241c259cd50d2ebec9fdbdf60493d9c26bf3cbe9ad9c2d9a3939d49
MD5 537b058decc5d4f4ce956638cf568ea3
SHA1 e0b4bdc83b6eb021c6656e7d8c5f1b82a5c4844f
SHA512 d7d4933118a3cca86f2266fbb4f8333968a5863f2f81fc531815041fa7ccc1e261d36aa34e042ba35ba2b73d31f4b8b0ee833f7c80ab7d37466f0dbe14d38b07
TLSH
T16021961F725407A21C9A13604674ECD9B22BB25A7E5F2A85146EF385233B06CCAFB840
MD5 SHA1 SHA512 TLSH

app/licenses/WinDivert-LICENSE.txt

SHA256 14a0cb5214d536e4fdae6aa3f5696f981eeda106cd026e9794bba489ee79d628
MD5 bbd7a5894dfb29429e01764c2b3e6265
SHA1 9c587dc1b47c857528368ca72d24ca57f7087e26
SHA512 300bdb513fecc9f3d212e99ed4daa34c24973a3703afb9f1c6b884e18d79f38d2611c07b9752a1823f673dffe87d294f86602c3a120df28de370c420a0277dd5
SSDEEP 768:uBv5Oe47gvUo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7MmFWixMFzMdm7jUS:uBhOL7gvUhcycsrfrnouRFBzMU
TLSH
T18B53852F774413B201C206A16A8F68DEE32AD079726A4464785DC15D27A7F3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

app/licenses/YamlDotNet-MIT.txt

SHA256 daea8b7f1b2bab48ea12ad50b0ce91634669d99d7dd0cb64aed8dffeeef69ed3
MD5 0f0de4e2388d798e8ce75a4cb01d28ca
SHA1 c6b815e575c04676a6dcf38c021bbfb8f55adcf2
SHA512 d822fb154d8b5c039641747d9d4c58060b18dff064dc8eeb047f865d25766793ccba38f8443cc00a49ca8cf434132dcd3ff026b22a65c7defbc4d376255df84a
TLSH
T10311661EB25403612DAB13E055E8B8C5F12B715F7A5B3645146EF345132705CD5FB840
MD5 SHA1 SHA512 TLSH

app/proxy/LICENSE

SHA256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
MD5 1ebbd3e34237af26da5dc08a4e440464
SHA1 31a3d460bb3c7d98845187c716a30db81c44b615
SHA512 d361e5e8201481c6346ee6a886592c51265112be550d5224f1a7a6e116255c2f1ab8788df579d9b8372ed7bfd19bac4b6e70e00b472642966ab5b319b99a2686
SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7J:Fhcycsrfrnoum
TLSH
T15FF2835FB74413B2018206A26A9F68DEE319D03A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

app/proxy/mihomo.exe

IMPHASH f9446c531a0baf10ff7aa8398cbc025b
SHA256 926bfea2ce48a247d6a7ce4cf641980e416202d5e40fe4ee5c949089ace0e197
MD5 e8bb17c6fd6f26a46ce86edf08373395
SHA1 7276dbee666c1d50b856ab4e4117aeb3706f849c
SHA512 85c3689a6c4995c5de3ab4e6301dc505be32ccb2d974694796b916cb5a36b0a165add9b7a4bfc6d27ede1db7fa82afdbda3881463216d1d9fcec2ab35f06c1bc
SSDEEP 393216:0kLMJeBN3c1yMcljd5dP9psjptXxlmx1gpJblkQV5VjV4tpOaLN/hH+KO:0kLXG1yMU3DpQON/hH
TLSH
T18DD7494BF82A4CD9F4A9C43885A696277B317CA9572433E71B10FA146F3EFD059BA310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

592192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

23.2MB

Virtual Size

23.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26.0MB

Virtual Size

26.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.2MB

Virtual Size

40.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

558KB

Virtual Size

557KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

535KB

Virtual Size

535KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

docs/SOURCES.md

SHA256 c85200c94cad9cdea32806d73ba3d371e264c911f5af1909fa8a1a43917a11f8
MD5 e0bccb614f549b20deea9aeda82757d1
SHA1 853247a438b4087cfe64d838c05081e880faee0c
SHA512 c68a97bc582e42a4f6233874c5b9e6d90218e0d2f9b0df18a0e8724fcecc171d71e542b4491956123bb03a486ba5110fd4cce85726ac02f0347ffe6f8b4b871d
TLSH
T1AF7173F78B0011E78F3029C05BCEB34FA61A631BBC4184DE60D0C4059A893FBE2561DE
MD5 SHA1 SHA512 TLSH

docs/applications.md

SHA256 82b4dd22a49e8f6155da29bfadc56166d9db93cf76d854a395c96195c7e60fa9
MD5 f6eeac07239b02b3ddca9b35219e17e8
SHA1 4bad9e7eec518365e42cc4a4bb38e3212d8379a4
SHA512 d7351a71026ef7f9979fd38e786e597ee85b8db384eb5ad5dc192c0afdbc578223f6fb67358d0054ab73eed5bdf2c10a038c8712420bf46db8c0d4ea3b49c66b
SSDEEP 96:EjISlr3TbNu0jLyAo7d45tEpukGmJZSG1JNFS3Fava3hCb1yf:E1Ttu0jLcODSu7QZFrNFS3FaKf
TLSH
T14EA196DD50590FFE068114770228D4EBB4CA971B6B73A561BE8E84685FCCD2B0291787
MD5 SHA1 SHA512 SSDEEP TLSH

docs/bitness.md

SHA256 8b691752c412341c19230a6333a060eaf844265144f90bc779f6826778e43c6a
MD5 517ae8e6cc0917e4d1688a045618c40f
SHA1 bdcb6dd0b666a0adadd09852ca20abcf5ffb0922
SHA512 3fed30d04df221ad866154bbb33650f6721834b46f390054649f7a0834f7db294391391476aa25cbe323d4b68751398c301bdc92761c27cbac202099ea4dfb78
TLSH
T14841DB6418A7FDD40535D09D133DE03E705FEE77D679E2E4E8F99499234852C88522C7
MD5 SHA1 SHA512 TLSH

docs/build-commit.txt

SHA256 5c16adf65e5a8097381c218464fbdaa2e6254859e17a7cf97b67d99aa4d56e56
MD5 37684d479babe3c34acdbd3c6ac0ed10
SHA1 945ae0f76d331c20037de5a7d770e390b624d97e
SHA512 781ee9c77b5cbb44c6388d19bc24974e99cb42a42ef4e8b7daae4620cc426a361c810fb433ea2f367f1e47d5e66ed9a78b7cd06f57bf4887e3b31c509e124ff5
MD5 SHA1 SHA512

docs/child-environment-websocket.md

SHA256 60b5b9c3242eb61bd5fcee11e0edc76544161bf5dacb9f0320a4913ff2fbc48c
MD5 fba8cfd96e444b020cc2dee604c958c9
SHA1 de57569d9f61d43ffa07483da12ff1274d3b8b44
SHA512 c491ce145b8f8c92f3d27fcef88aecc7405522177ffe96a90bcfad2494559ff51e0d5361241472c0512d3290dfb7a34d579f6dfe69e2265d61f856fe3397997b
TLSH
T1E161B6FD051D1EE101C21895072ED07BBA4CBB3AC7B787A44EA1DBBDAACC29E0456CC5
MD5 SHA1 SHA512 TLSH

docs/claude-startup.md

SHA256 971fbe9468bb4810712ec6c3d252dfe6c9f99dbd6ef19a51b2af44bfe069c1b9
MD5 4b3a651faa0955866079fd618639e562
SHA1 9770a3bbd892523e50f972e7f1e9f3036a00ae00
SHA512 77b48c68885d7bc12a7ca239f3b969831f4167a341b2486b7269485127f7ff012057a2d412fb707a8fe3dac0ac4e07aa5a42e9be37f7c030352a0bf521c4899d
SSDEEP 96:QeahgE9aQpL4dYg3a6aob+X6RkobCAf6oJ4VZ9tDJ9s0HZB:iF9a0L4Pgob+X6iobCc4VZ9tD4AL
TLSH
T1F591DBAC449CDFC7069628C1129DE20B294CFE12C5B753DC8BC2C86D2A4C69E5C5D9C9
MD5 SHA1 SHA512 SSDEEP TLSH

docs/connectivity.md

SHA256 698339a267f2cd2349d7a4052ad828100dc42f3a038e075445a66eb5c0faf40d
MD5 c55121d9657fff6ce2e2aef67472dd1e
SHA1 f0c9967d39b543bebd9f9b5c8c0102165ce5aa64
SHA512 7e7a3af186ef853f3e03f4162fc024d687618b300f1ac4e2d03f50ff24b8d5aaa2b8806c98827d49a64df04439285d40bb51db9ca10539a2709ab20ad05b85ac
SSDEEP 96:5b+ZqqwdIoXT8x9RnpJY7tSuOUbBiDq+pndgRwpsJ5T/aIBAvTG:5b+CuF9RpOn/iDq+pdnsJtAvTG
TLSH
T10ED1FAD8649CAFD3040915F356AAB1AF74CDFE2FF2B492EA8962C6C916CC46C0415A4B
MD5 SHA1 SHA512 SSDEEP TLSH

docs/lan.md

SHA256 2fd1436ea937fb194a39cd35fb357fa28e5f0647c36605389b48cb1ae1518c37
MD5 d0e72cdcb898f6551641ff80cc16f62e
SHA1 24782d1bef488f626f536f5ef3c1c3589e202202
SHA512 84d6ecc87659ea47a29a002f2f2850f7934b71b1dcebb7394ddd01c4729b4fd982e8c08807609af8e1808ef20659b6e23895e1da4cdb29f9d8b8184c8eab8b09
TLSH
T13341B7A417D81BF804C78BB1179DEC73F6E4E91F41EA3B5196679A8D0D48A7A5410443
MD5 SHA1 SHA512 TLSH

docs/link-browser.md

SHA256 d11c2719c1a60f55a87ec5ea74f3b97c92a66c0d3aba5d1e0e99b84a44ae9f84
MD5 a7ffbcfae7e4c3ac605262cebfb154b2
SHA1 58461995a36a0716a69285ecbeedc99ef5b6dc10
SHA512 c75e37e4c93009ea3c86c31ff287b41b73bfc19e618694fa367b740accba727e4e15d1e44b6f2f57d3fe064fecdb50238b4f7d0810b5243781d3b62762d9c10a
TLSH
T1AE6108FD1D5A4FBC0101458327ECE11EEE8A7B27FEF149727A60986D0E80E1D0058AD7
MD5 SHA1 SHA512 TLSH

docs/localhost-callback.md

SHA256 82abd9eb58c48f11bf531021cf51990ed20d3afe0d806350ea0095c787df0348
MD5 d6250905f11e8cb2658fa004e77eb739
SHA1 9465b05b4184cff9d47f9e74c7a94f480f7c4d73
SHA512 847cf6f6b0088637419777a77d03b879c7f354af0f1b2b391f7f1e6a801d368a55a98277fce3b6c9c38603df0dd627b3159a67e659c9bbd39715864213e1b36e
TLSH
T12E812BF80789CE72007655E1335DE0FFF61BA376CDA7AE99DC92E618368936D0098285
MD5 SHA1 SHA512 TLSH

docs/network-backend-review.md

SHA256 e88ab8be27b54a3ecf2ebb1147dc637d56af9adbf7c66febe39293f703aec506
MD5 fe0780b465c42227df7768d7f69a3b7d
SHA1 fb8615fe63b9da26cfcc48a6e3f75683df5d49c0
SHA512 f198c65ba799be05237d26ad1b39aebb229ae74482abca7b706c47091e551d3e71c47032e4d83fc3c5a7ce5d2b9458d0d10de0c6604e5d6641d3067195687543
SSDEEP 192:mZUpuEf+64ujiHTBb+ElutfmmNqr7YotnelBg:mZUpuEff4uMVDluZmprNm6
TLSH
T16DE11ADF04A868C4062620D06DCCD0EB250D6A7BCBE6F99ACFC7DE49BB884770416D13
MD5 SHA1 SHA512 SSDEEP TLSH

docs/proxy-settings.md

SHA256 d89f407d897e1b8017941ddc09e90c800dbe3d3d53349b8ba254aecc92cd5e30
MD5 5ad0bf190febfa8e92f18468a0bd9386
SHA1 bf7bd826f668c17a315281441242bf978ac177d9
SHA512 56af4d9a553306963e14207e9cd8c46ab4fa0f6b480900df4e0b0204c97505d8c5ac6a479d6e59e3d95ef3e5445b0308cbf3df51ddaeb417f93a7083046413cd
SSDEEP 96:v2O8Vf+MSUjqR++s/sst46EVxzCDl4iRCkyrxwlnE:F67SEqJs7fEVQR4BkyrxaE
TLSH
T16381C5DE26ADEED4A0CA66ED46DDF17B75CCF71295AD737168C1E6CD3248A290402C02
MD5 SHA1 SHA512 SSDEEP TLSH

docs/quick-start.md

SHA256 176d9faa7a611ec7d25e87b7d86440c9531668ad4d34d9b29a726823526667a5
MD5 283ed8cedab7a29830bb063995964d03
SHA1 0065d06de700510cc4a136a30e812a3e32b1f649
SHA512 91217bc77bdcf6ca4bf7c19a6f2a2c46b94b2d9d42bb75db4ac0380f421eb5d0930395db2626b20b7f27a233936138058ec984afd4c31d51f59778c15059dc50
TLSH
T10051B6EA240FEE97054304AA02AEF1CFD595FF287BF5D3F558A8C088558CE586419C12
MD5 SHA1 SHA512 TLSH

docs/registry-region.md

SHA256 16796a08e9c00764a8270a16af7f777e9cd7af281a8db331d216c356b1cd73bd
MD5 a9e6e8d2acb86c9e5d81fa064b01e092
SHA1 1c86bbd9ed7e52b0e23d5e10b0984cb372765b94
SHA512 104036c4b999a054f90db30535fe48361a53e2bae144323b73dd811316e52f5f1bbb46a18f31502020268f62604b4b10e32df5d435f29e4aa1368fb85e080a2e
TLSH
T1DB61F99C48AAD7CD1181814F132DD2FEB04DB32591FECE5247A2889471C8928467B3E3
MD5 SHA1 SHA512 TLSH

docs/remote-diagnostic.md

SHA256 18327cd133a983c2684a3df0836109343b002749404be3c9fde8c97c433ff3c3
MD5 2f36e9103ba8f01868b621af4e830bff
SHA1 efd6144dca30342e578852e51dbae252b0c79663
SHA512 9080312defbe8bb7a57ea56e5dbcc787bb1b422b2c2a7a65a31de738567420c7ec614c897b1f0a9f09a82b7d347785abd4efd8402bf44396184141c89689d91b
TLSH
T1FA41A5EC42E9EFE6295E34803362D59A7309FB3B6B517B2D0F8282CD5C0DEAC40A1146
MD5 SHA1 SHA512 TLSH

docs/service.md

SHA256 1c1dddec77dc25d2e83912c7170200e5910377d0022a8b145fc0052bd7698357
MD5 9b416221bd8277fad15ec50ff98dc470
SHA1 62e6cabef88bef10c49c4ff96f2dad7a7125c3bb
SHA512 ecc78bc3999be5b2296486ff8c911b0eef284ac320bacd12f22a4fcffaa28d36a374dc006b7a5a614c834e1c0058f7776234d0642c57983e668724447e85bf3d
SSDEEP 192:AOCx9jfLFAENE8PO7gzPA+G04PsEHYfqaV+ii+MjJAz4w8:Ad9jfLFvNE8PO7gzYf040jfeii+Unz
TLSH
T1EE023BFD04AC9EC6259459F0270D921FB95CFE2AD3FFD7585FE28788158C4390815927
MD5 SHA1 SHA512 SSDEEP TLSH

docs/shutdown.md

SHA256 86c79d5f0b9f051538119b1ad1180403d4541f443b4360a57582e1884ce47513
MD5 20c7111a063336c08315a12bd120fb49
SHA1 8ee49b2079e7ca2758c1a2d4522dc320c2f722cd
SHA512 3e73edbfd1753289ba3e96ddccd70555584a18c6d64b9167f5c22047778e4d9a05adb767b7b442200fa1085e7891b9c4aa40a4f26c97db01cafc7e16abd4eaef
TLSH
T1A641B40E30E85CA7528738C7163CA02E20CDFA3EDDA377826956E1460A881BCC207D82
MD5 SHA1 SHA512 TLSH

docs/subscriptions.md

SHA256 b9a5284a33fa4a3bd4c1f7129ee55b90d19032ac275f30dc819a32b5007afca4
MD5 f4785ea574787fe2936295ac4160c4bb
SHA1 4ec4e2b7edf3ca495e407e083e37067df5f190e1
SHA512 6735b130bd54a743a93ae6a6f16375ce2c2a37395109eb5b5d8023ca15deb49ae53d9f8178e365f44ad361c8bf3f1c96963c1a17f3426a15933484e83bfb60bb
TLSH
T1ED61D6B929ECDEEC702F6A5553D5EE8F604D7B5A05A6C709EBF18DC0624C61C1206A22
MD5 SHA1 SHA512 TLSH

docs/uu-coexistence.md

SHA256 839cbb976841df34efb4f247f7e75a26a074edec0b935c49523338c4b6b34f61
MD5 948ab0a82668e01a3042113a903d6894
SHA1 07703d6dbb4ff5326ff39bc8ce2bd941d1d3febf
SHA512 c02b0530f9c092ad5e32f744427cd525cdeb201ebdc5e3f585aba627aa90b7c71ef73913236d334eaaf226480c9519f2f1dd3da1c976da5fa7cd45b271bbbf0c
SSDEEP 192:/byOklzf3HUQc1t2baoMIDU9v/5lIXl66Sm:/Xac1gOZIDg/QA6Sm
TLSH
T158D12A9A15E46FA8024A2C90230CF13F69CCF733E5B3216D6DC7DE26264CABF80011A7
MD5 SHA1 SHA512 SSDEEP TLSH

docs/validation-20261109.md

SHA256 89aeed15a1e480667c7bba9dedeecbd8835dfb226af89e252cf84df7a09eb50b
MD5 a7f8189208490fbe27b68d34848dbca9
SHA1 41a0848c2ca284b899a39a101862cd87665245dd
SHA512 7b2c22fba362ac8bc3bfc3e75e47ffdc2002022bdfa0f47f2739e76b7fde34ee518588e2bde6b0c4045cb7355f13bb53862fce888752dac47d9f77a5209da198
SSDEEP 96:vhqMVZFtGsV5pq/DXHcSe/xvSqaqEsVyK2qCytGB9/YPvy3BCQ6yrnQw6bVbkt7V:FTsbXHUraqEA/GB9wPvpwtxdnocdf
TLSH
T1ABD11AED089D1EDA2400A9E22F19C087BDCDE52FE236D3A6DFD28D1E7494D1D4119ED2
MD5 SHA1 SHA512 SSDEEP TLSH

docs/validation-lifecycle-20261109.md

SHA256 a1fa69d998b4890bc0d2fac12d6550a311e6ab64d17d9989540b76f9582d16ac
MD5 117847e98253c43f437cafd07b0cb9c4
SHA1 2b0f0c8e9b2c9ddc7786356a4068cc4865f48b97
SHA512 6992cc2f9ccb2dfe1f90f34570b2499c6ecd67ca82b0c33aab222b3077469f423dd78cb460730836d58c5be68f4750592e413909e9bcc9f6cf51b7b326c28fd5
SSDEEP 192:QqH3npWJYT1Nfub66Q4de6LJ3t6BMh8jet:QqH3pgYTZ6TdtLJ3t666Kt
TLSH
T17CE1FBE508B47E9B1004594723EEF19F79ECF63EE1F2CB69D995D94F62085BE1408052
MD5 SHA1 SHA512 SSDEEP TLSH

docs/validation-unicode-20261110.md

SHA256 9979e8accb566cacc86227ceff6bb2c7c0d37afa8fbe41e2ce7a1fa919c020c5
MD5 105d6754a546c6c7e70996feaf5d2e89
SHA1 061013afbf9c066ff78efe061da44a26b87fe3e0
SHA512 b1e81e69376b215289c7064bb60369bc7b2e730519a50cc8c728a5374445977967cee8900711562232d8787be3d70adc99cc2ea020d1dd01a58ca6a82cd55c00
TLSH
T12F519548C5CE4FC602876C61135EE056354DFA7BDE56E2884FC1ED895B8C0BE0861A8F
MD5 SHA1 SHA512 TLSH

docs/validation.md

SHA256 d646145356d43cd11759e49337016d3755a09e523d2ccfa396c33a8f955c97fc
MD5 0a8fd3268a3bd077ab664be20dd3af0a
SHA1 9c191f1ebd11693d1292fb4a158d8aa1a23e87bf
SHA512 58197eeb0d867a82394ee5fe5e364bf6a394231d07995f23499e3b4db9b94c375a3fde930e1213466e357126b6effd77c710a15aa27c44dd2e8f7dbe38aba087
SSDEEP 384:XdtzTbmHJBr5gROfuL6dnTJstFSG2VL3BnXblwfWRXZa:EHgRasmnTqvW3BB7XE
TLSH
T174524AEC15DD5DCD0140E5D3275EC46A798CFA33C2BA9B0EAE82DD8D4444BBE0422D83
MD5 SHA1 SHA512 SSDEEP TLSH

install/package/ProxyBridgeCore.dll

IMPHASH cbbc578ebea457754f19bedcecc9a642
SHA256 b7161a69c8cfb96288e9a36c6d2f5d0853514a6ad7fe574248175ef7ae093a03
MD5 1860c8bb83e8af97d51b7b2bc0b85cf2
SHA1 6bdec3771521ee413b8ff36f36dfced5e71363dc
SHA512 7c66efcc017d041988b1296221eac0acf33a76ac2dca70b0c8d02edbccab3bd43d1cd72cfc81604222c72df2d2f358970cd5833678854b3e2f9eba0f6fe1fe9b
SSDEEP 3072:HBleNMyGc5c98zM8ZkwOMlIeXVLehLJblqsC48cOPo89xT3UAH7:HeNMyvCt9wOMfFLehJbcFms7
TLSH
T154347D45B7A10CF9EC63C13DC9939616E7B278050720DBEF03604666AF2B7E1663E752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

61472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

windivert

WinDivertClose WinDivertHelperCalcChecksums WinDivertHelperParsePacket WinDivertOpen WinDivertRecv WinDivertSend WinDivertSetParam WinDivertShutdown

ws2_32

recv freeaddrinfo getaddrinfo getsockopt ioctlsocket inet_pton WSASend WSARecv WSAIoctl WSAGetLastError WSACleanup WSAStartup shutdown sendto select recvfrom ntohl listen htonl bind accept __WSAFDIsSet socket setsockopt inet_ntoa htons connect closesocket ntohs inet_ntop send

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable

kernel32

GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers HeapSize SetStdHandle SetFilePointerEx GetStringTypeW GetProcessHeap LCMapStringW CreateFileW LoadLibraryExW VirtualProtect FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose WriteConsoleW InitializeSListHead ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetTickCount GetTickCount64 InitializeSRWLock CloseHandle OpenProcess QueryFullProcessImageNameW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CancelIoEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject Sleep WaitForMultipleObjects CreateThread GetSystemInfo QueueUserWorkItem QueryPerformanceCounter QueryPerformanceFrequency SwitchToThread GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapReAlloc RtlUnwindEx InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW IsProcessorFeaturePresent HeapAlloc HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetStdHandle GetFileType

Name

.text

Size

157KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

782KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

install/package/RegionNetworkService.exe

IMPHASH b2850f13617ce2a0260cd2ed39c325ed
SHA256 54bab635f76569f78485e9b772a86faeb4eb704e7283bd1fec8556111075d9e9
MD5 ad2062a363ece4ce0471f4caadf39fd9
SHA1 3a7a4f98a3d2e121e9869f54cbdfc6e0e3c24660
SHA512 3f1189275dae4f0f2c14c66d8703bf2bca9df9b56713edaa9e51c3388dbe40cbcd18a642942496a7f9ab8e4a743731120a37183fe8732af2e2f6b9fa5c5a1cc3
SSDEEP 3072:dt43niM77aXx8xiQO3qYDpP95U806B9mqBQttW5kKMX2l2D3xn:dt43niM77lKDpPTu6NQtcg3
TLSH
T120147D15B7A510FAE2678578C9420902FB737C4647A0AADF43904BF59F376E0AE3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

24064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ImpersonateNamedPipeClient OpenProcessToken OpenThreadToken GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation RevertToSelf RegGetValueW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW ConvertSidToStringSidW ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityInfo

ws2_32

ntohl inet_ntop

kernel32

WriteConsoleW SetEndOfFile HeapReAlloc ReadFile WriteFile CloseHandle DuplicateHandle GetLastError SetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetOverlappedResult CancelIoEx SetEvent ResetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects GetCurrentProcess ExitProcess TerminateProcess GetCurrentThread CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenProcess IsProcessInJob TerminateJobObject QueryInformationJobObject GetModuleFileNameW GetProcAddress LoadLibraryExW SetDefaultDllDirectories LocalFree GetNamedPipeClientProcessId SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead HeapSize RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection FreeLibrary GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VirtualProtect CompareStringW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW CreateFileW SetFilePointerEx ReadConsoleW GetFileSizeEx

Name

.text

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

install/package/WinDivert.dll

IMPHASH 0b649f8e17494bb31b47f6e959a1769c
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

install/package/WinDivert64.sys

IMPHASH db584dd0570594898805dd67d7ff391c
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 20, 2022

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 20, 2022

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

01

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

61:50:19:91:b1:8f:32:38:04:52:51:37:dc:25:00:5a

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2022 - May 25, 2023

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

4484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\WinDivert-2.2.2\install\MSVC\amd64\WinDivert64.pdb

ntoskrnl.exe

RtlCopyUnicodeString KeBugCheckEx IoGetRequestorProcess PsGetProcessId ExUuidCreate ObfDereferenceObject ObfReferenceObject IoWriteErrorLogEntry IoGetCurrentProcess IoFreeMdl IoAllocateMdl IoAllocateErrorLogEntry MmMapLockedPagesSpecifyCache MmBuildMdlForNonPagedPool ExFreePoolWithTag ExAllocatePoolWithTag KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock RtlGetVersion RtlIntegerToUnicodeString

hal

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool NdisFreeNetBufferPool NdisAllocateNetBufferListPool NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

fwpkclnt.sys

FwpmTransactionAbort0 FwpmTransactionBegin0 FwpmEngineClose0 FwpmEngineOpen0 FwpsQueryPacketInjectionState0 FwpmProviderAdd0 FwpmProviderDeleteByKey0 FwpsInjectNetworkReceiveAsync0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 FwpmFilterAdd0 FwpmFilterDeleteByKey0 FwpmTransactionCommit0 FwpsCalloutRegister0 FwpsCalloutUnregisterByKey0 FwpsFlowAssociateContext0 FwpsFlowRemoveContext0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsInjectForwardAsync0

wdfldr.sys

WdfVersionBindClass WdfVersionUnbindClass WdfVersionBind WdfVersionUnbind

Name

.text

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

install/package/install_service.ps1

SHA256 26b2e799e06b7a156ed681f63458d2a577d5b53b437b257cb9a3027bc06f2030
MD5 3960c1f3180e21b2eb269e67d1043c97
SHA1 876b01674ec60f9376679337cda174b47e357cea
SHA512 6603327131e4be82e94e668fdca7441ec30c727a9fbed9a3b79e9d19bccdad57dfc9db12177a265ef3786e5fc4171c732bd8dab742203d46459d618a5c9f473e
SSDEEP 192:a07FtSl+lsidNTd93gibTh4yn2TE1roI+QGZA/l4yaJtddo1HE90:a07ZBf1roISZAtC4y0
TLSH
T13AE184026BD411E412A327996DD3B2156E2F005F606A2744BEADD344FFD5A3E8BDC3E1
MD5 SHA1 SHA512 SSDEEP TLSH

install/package/manifest.json

SHA256 c4aa98c00adbbac7cff4718f9af792286463d87853e0f8bdc020e53a863c1137
MD5 0bfa3026c1945d97f6c4245511a1008b
SHA1 67daca49a6ec5a13623047f0c9a9971f6e1e6040
SHA512 33c7b18dfb3c307a34d106d1327bf19deae17b5efb56ca916c8f71c3f81a3e910feeed857d4668a6abf8e91e0232bd5fdc43d028fa65abbd64ce1dea2e5b2f86
TLSH
T1BDF0230AC4081E4115B1D3981E2319EA2F27410FE1A0247F7E31068CC5D6E1D8109415
MD5 SHA1 SHA512 TLSH

install/request_install.ps1

SHA256 b0e64d18b587384cc3ac5e99bbaefdd3de352278851c6e428cfb82c3bede655b
MD5 a1e4c1a8267ef531636800df7e89c34d
SHA1 cfaec3605058f2604db6fbfec9f94d77610b4381
SHA512 a68f4df9b2ecd863a3d2550440af7c0e705f6114c8a23ed7b74b1be0b1781770be57d180b6ba99f8158145479cb91a66019df3caa266738b53d7893780a77c2f
TLSH
T108414241CDE036654BA3034E4821A12D991F213DE14D1940F96D4204FFE6C6FEE6A3F6
MD5 SHA1 SHA512 TLSH

使用说明.md

SHA256 d784c0c6460d00db5341f2efdd708bba8764bb66fd368b2addcba59ba662b30d
MD5 ca2b68196e964afd9b9cafee59f59225
SHA1 db0cda52eb7dbf7697f0f4dd94df0c48b724db3c
SHA512 92e7eb4b9961c85133622a7571fdb4e5299dd6d7ead435b1a7a1095e44d73900d56e1c8142bcffde2513be3fac597926cfb1bfc11c795dd1d9b526fb9058ad79
SSDEEP 96:L6lOWIT9KS+VlAQxbcH15/aiwid1ek/cPyOIhI8wWirS02HwIdBpxqV2PCDsORYU:zxKvwMbxidEj8wWirS0yf/pFPq3gFD8
TLSH
T161F12AE6505C4CC61B9302A243DDF60BE04DF76AEAF6A1BDC5E4C138BD8C62A8407D53
MD5 SHA1 SHA512 SSDEEP TLSH

卸载后台服务.cmd

SHA256 12de1c9bc3cded8240946f418fed417102ad02bad8c089f7d232fc89381eea98
MD5 002262dc743015d7a60f15d680f9bb01
SHA1 2e0ccf5349d84ff43da37b6b5615372e9e94468e
SHA512 ed3fd9b5db797f400281b7d700ebd585f04f0c048269d46159b51b8521963b7aebae6d98c553e76e66898ca56e7b742d066c7894012e85d25d8de07fba155725
TLSH
T174D0A9228264C2A8FDE25A1D208BE079752BB004A260CA80B2E1421CA84A32CCA2A082
MD5 SHA1 SHA512 TLSH

安装或更新后台服务.cmd

SHA256 e0c9fc1756b58b60e98e28777de6a333a9bd6544a19b4afd94f98ba32c7ec7db
MD5 d9897788a07219c790035987fc8f7249
SHA1 167c5407455eed3b1764e19fac335e6164c50a24
SHA512 74ea2fb269e3de7ba20d0a30ac935c0d08b35b4c07ede7c53a9ba73fa3d2f1d193f161b57fb53110a9ee325da2f40727d358e800b7732dd7752770b464e933c9
TLSH
T16FC022224225C3A8FDE25A1D10CBE175343FB004A060CA8173F1421CEC4A33CCA3D082
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer