{"_id":{"$oid":"69184e000999409cf96ec559"},"Summary":{"Architecture":"IMAGE_FILE_MACHINE_I386","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","Compilation_Date":"2025-Nov-08 09:48:44","Detected_Languages":{"Language":"English","Country":"United States"},"Debug_Artifacts":"C:\\Users\\lengo\\Desktop\\Spamming Work\\Duy\\PyApp\\workplace\\curl\\Dll1\\Release\\Dll1.pdb"},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0090","e_cp":"0x0003","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x0000","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x0000","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x00000110"},"PE Header":{"Signature":"PE","Machine":"IMAGE_FILE_MACHINE_I386","NumberofSections":5,"TimeDateStamp":"2025-Nov-08 09:48:44","PointerToSymbolTable":0,"NumberOfSymbols":0,"SizeOfOptionalHeader":224,"Characteristics":["IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_DLL","IMAGE_FILE_EXECUTABLE_IMAGE"]},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"14.0","SizeOfCode":"0x00006E00","SizeOfInitializedData":"0x00005E00","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x00006EAF (Section: .text)","BaseOfCode":"0x00001000","BaseOfData":"0x00008000","ImageBase":"0x10000000","SectionAlignment":"0x00001000","FileAlignment":"0x00000200","OperatingSystemVersion":"6.0","ImageVersion":"0.0","SubsystemVersion":"6.0","Win32VersionValue":"0","SizeOfImage":"0x00010000","SizeOfHeaders":"0x00000400","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT","SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"16"},"Sections":{"Sections":{"Section1":{"Name":".text","VirtualSize":"0x00006C92","VirtualAddress":"0x00001000","SizeOfRawData":"0x00006E00","PointerToRawData":"0x00000400","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"Entropy":6.38822},"Section2":{"Name":".rdata","VirtualSize":"0x00004B34","VirtualAddress":"0x00008000","SizeOfRawData":"0x00004C00","PointerToRawData":"0x00007200","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":5.27572},"Section3":{"Name":".data","VirtualSize":"0x00000730","VirtualAddress":"0x0000D000","SizeOfRawData":"0x00000400","PointerToRawData":"0x0000BE00","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"],"Entropy":4.04237},"Section4":{"Name":".rsrc","VirtualSize":"0x000000F8","VirtualAddress":"0x0000E000","SizeOfRawData":"0x00000200","PointerToRawData":"0x0000C200","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":2.51196},"Section5":{"Name":".reloc","VirtualSize":"0x0000060C","VirtualAddress":"0x0000F000","SizeOfRawData":"0x00000800","PointerToRawData":"0x0000C400","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"Entropy":5.58572}}},"Imports":{"KERNEL32.dll":["CreateDirectoryW","WriteFile","TerminateProcess","GetModuleFileNameW","WaitForSingleObject","CreateFileW","GetFileAttributesW","Sleep","CloseHandle","CreateProcessW","GetExitCodeProcess","UnhandledExceptionFilter","IsDebuggerPresent","InitializeSListHead","GetSystemTimeAsFileTime","GetCurrentThreadId","GetCurrentProcessId","QueryPerformanceCounter","GetCurrentProcess","SetUnhandledExceptionFilter","IsProcessorFeaturePresent"],"SHELL32.dll":["SHFileOperationW","ShellExecuteExW"],"ole32.dll":["CoCreateInstance","CoInitialize","CoUninitialize"],"OLEAUT32.dll":["VariantInit","SysFreeString","SysAllocString","VariantClear"],"MSVCP140.dll":["??1_Lockit@std@@QAE@XZ","??0_Lockit@std@@QAE@H@Z","?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ","?_Id_cnt@id@locale@std@@0HA","?_Xout_of_range@std@@YAXPBD@Z","?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z","?_Xlength_error@std@@YAXPBD@Z","?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ","??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ","?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ","?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z","??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z","unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z","?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z","?_Setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z","??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ","??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z","in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z","out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z","??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ","??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ","?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ","?_Uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ","?_Xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z","?_Xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z","?_Setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z","?_Sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ","?_Imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z","??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ","??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z","??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ","?_Always_noconv@codecvt_base@std@@QBE_NXZ","?_Xbad_alloc@std@@YAXXZ"],"VCRUNTIME140.dll":["memmove","__CxxFrameHandler3","__std_exception_destroy","__std_exception_copy","__std_terminate","memcpy","memset","_CxxThrowException","__std_type_info_destroy_list","_except_handler4_common"],"api-ms-win-crt-stdio-l1-1-0.dll":["fputc","_fseeki64","_get_stream_buffer_pointers","fread","fflush","fclose","ungetc","fgetc","setvbuf","fgetpos","fwrite","fsetpos"],"api-ms-win-crt-runtime-l1-1-0.dll":["_cexit","_invoke_watson","_initterm","_initterm_e","_seh_filter_dll","_configure_narrow_argv","_initialize_narrow_environment","_initialize_onexit_table","_register_onexit_function","_execute_onexit_table","_crt_atexit"],"api-ms-win-crt-filesystem-l1-1-0.dll":["_lock_file","_wstat64i32","_unlock_file"],"api-ms-win-crt-convert-l1-1-0.dll":["strtol"],"api-ms-win-crt-string-l1-1-0.dll":["isspace","_stricmp"],"api-ms-win-crt-heap-l1-1-0.dll":["_callnewh","malloc","free"]},"Exports":{"ax":{"Ordinal":1,"Address":"0x00002580"}},"Resources":{"Type":"RT_MANIFEST","Language":"English - United States","Codepage":"UNKNOWN","Size":145,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":4.8858},"Debug Info":{"IMAGE_DEBUG_TYPE_CODEVIEW":{"Characteristics":0,"TimeDateStamp":"2025-Nov-08 09:48:44","Version":0,"SizeofData":108,"AddressOfRawData":45628,"PointerToRawData":42044,"ReferencedFile":"C:\\Users\\lengo\\Desktop\\Spamming Work\\Duy\\PyApp\\workplace\\curl\\Dll1\\Release\\Dll1.pdb"},"IMAGE_DEBUG_TYPE_VC_FEATURE":{"Characteristics":0,"TimeDateStamp":"2025-Nov-08 09:48:44","Version":0,"SizeofData":20,"AddressOfRawData":45736,"PointerToRawData":42152},"IMAGE_DEBUG_TYPE_POGO":{"Characteristics":0,"TimeDateStamp":"2025-Nov-08 09:48:44","Version":0,"SizeofData":708,"AddressOfRawData":45756,"PointerToRawData":42172},"IMAGE_DEBUG_TYPE_ILTCG":{"Characteristics":0,"TimeDateStamp":"2025-Nov-08 09:48:44","Version":0,"SizeofData":0,"AddressOfRawData":0,"PointerToRawData":0}},"Load Configuration":{"Size":192,"TimeDateStamp":"1970-Jan-01 00:00:00","Version":"0.0","GlobalFlagsClear":"(EMPTY)","GlobalFlagsSet":"(EMPTY)","CriticalSectionDefaultTimeout":0,"DeCommitFreeBlockThreshold":0,"DeCommitTotalFreeThreshold":0,"LockPrefixTable":0,"MaximumAllocationSize":0,"VirtualMemoryThreshold":0,"ProcessAffinityMask":0,"ProcessHeapFlags":"(EMPTY)","CSDVersion":0,"Reserved1":0,"EditList":0,"SecurityCookie":268488768,"SEHandlerTable":268480912,"SEHandlerCount":10},"RICH Header":{"xor_key":"0x3271BA7A","unmarked_objects":0,"imports_vs2008_sp1":12,"asm_objects":1,"c_objects":10,"c_plus_plus_objects":18,"imports_general":4,"c_objects_ltcg":1,"exports":1,"resource_objects":1,"linker":1,"total_imports":140,"interesting_strings":["g550.onrender.com","githostaduviep-g550.onrender.com","https://githostaduviep-g550.onrender.com","onrender.com"],"common_functions":["CreateProcessW","WinHttpQueryDataAvailable","WinHttpReceiveResponse","WinHttpConnect","WinHttpSendRequest","WinHttpOpen","WinHttpCloseHandle","WinHttpReadData","WinHttpOpenRequest"],"internet_access_capabilities":["WinHttpQueryDataAvailable","WinHttpReceiveResponse","WinHttpConnect","WinHttpSendRequest","WinHttpOpen","WinHttpCloseHandle","WinHttpReadData","WinHttpOpenRequest"],"exploit_mitigation_techniques":{"stack_canary":"enabled","safe_seh":"enabled (10 registered handlers)","aslr":"enabled","dep":"enabled","cfg":"disabled"},"virus_total_score":{"total_scanned":"21/71","scanned_date":"2025-11-11 16:31:18","antivirus_detections":["AhnLab-V3: Malware/Win.Generic.C5813078","CrowdStrike: win/malicious_confidence_100% (W)","Cynet: Malicious (score: 100)","DeepInstinct: MALICIOUS","ESET-NOD32: Win32/TrojanDownloader.Agent.IKA trojan","Google: Detected","Ikarus: Trojan-Downloader.Win32.Agent","K7AntiVirus: Trojan-Downloader ( 005d8a0f1 )","K7GW: Trojan-Downloader ( 005d8a0f1 )","Kaspersky: Trojan.Win32.Agentb.tmwb","Lionic: Trojan.Win32.Agentb.X!c","McAfeeD: ti!CF9CDD5D2628","Microsoft: Trojan:Win32/Egairtigado!rfn","Rising: Trojan.Agent!8.B1E (LESS:bWQ1OsuPiB2h+9kL)","Sophos: Mal/Generic-S","Symantec: Trojan.Gen.MBT","Tencent: Win32.Trojan-Downloader.Oader.Ocnw","TrellixENS: Artemis!40784DCA35FA","TrendMicro: Backdoor.Win32.ASYNCRAT.YXFKJZ","TrendMicro-HouseCall: Backdoor.Win32.ASYNCRAT.YXFKJZ","alibabacloud: Trojan[downloader]:Win/Agentb.ttxe"]}},"file_path":["/home/apogean/projects/malware/windows/samples/dll_sample.dll"],"md5":"40784dca35fa06d4c4cb932e101e56ab"} {"_id":{"$oid":"693190fba91f83988d51bb0f"},"Summary":{"Architecture":"IMAGE_FILE_MACHINE_I386","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","Compilation Date":"2088-Mar-06 18:36:34","Debug Artifacts":"C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb","Comments":"RMM Client","CompanyName":"","FileDescription":"Client","FileVersion":"1.0.0.0","InternalName":"Client.exe","LegalCopyright":"","LegalTrademarks":"","OriginalFilename":"Client.exe","ProductName":"Client","ProductVersion":"1.0.0.0","Assembly Version":"1.0.0.0"},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0090","e_cp":"0x0003","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x0000","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x0000","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x00000080"},"PE Header":{"raw_response":"{\n \"Signature\": \"PE\",\n \"Machine\": \"IMAGE_FILE_MACHINE_I386\",\n \"NumberofSections\": 3,\n \"TimeDateStamp\": \"2088-Mar-06 18:36:34\",\n \"PointerToSymbolTable\": 0,\n \"NumberOfSymbols\": 0,\n \"SizeOfOptionalHeader\": 0x00E0,\n \"Characteristics\": [\n \"IMAGE_FILE_EXECUTABLE_IMAGE\",\n \"IMAGE_FILE_LARGE_ADDRESS_AWARE\"\n ]\n}"},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"48.0","SizeOfCode":"0x00037000","SizeOfInitializedData":"0x00000A00","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x00038F5E","BaseOfCode":"0x00002000","BaseOfData":"0x0003A000","ImageBase":"0x00400000","SectionAlignment":"0x00002000","FileAlignment":"0x00000200","OperatingSystemVersion":"4.0","ImageVersion":"0.0","SubsystemVersion":"6.0","Win32VersionValue":"0","SizeOfImage":"0x0003E000","SizeOfHeaders":"0x00000200","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE | IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA | IMAGE_DLLCHARACTERISTICS_NO_SEH | IMAGE_DLLCHARACTERISTICS_NX_COMPAT | IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":16},"Sections":{".text":{"VirtualSize":"0x00036FD0","VirtualAddress":"0x00002000","SizeOfRawData":"0x00037000","PointerToRawData":"0x00000200","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":"0","NumberOfRelocations":"0","Characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"Entropy":"5.55645"},".rsrc":{"VirtualSize":"0x000006AC","VirtualAddress":"0x0003A000","SizeOfRawData":"0x00000800","PointerToRawData":"0x00037200","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":"0","NumberOfRelocations":"0","Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":"4.50595"},".reloc":{"VirtualSize":"0x0000000C","VirtualAddress":"0x0003C000","SizeOfRawData":"0x00000200","PointerToRawData":"0x00037A00","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":"0","NumberOfRelocations":"0","Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"Entropy":"0.10191"}},"Imports":{"entity1":"mscoree.dll","entity2":"_CorExeMain"},"Resources":[{"Type":"RT_RCDATA","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":30,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":2.48173},{"Type":"RT_RCDATA","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":10,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":1.37095},{"Type":"RT_RCDATA","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":76,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":2.87727},{"Type":"RT_VERSION","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":768,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":3.16411},{"Type":"RT_MANIFEST","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":490,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":5.00112}],"Version Info":{"raw_response":"{\n \"Resource\": {\n \"LangID\": \"UNKNOWN\",\n \"VS_VERSION_INFO\": {\n \"Signature\": 0xFEEF04BD,\n \"StructVersion\": 0x00010000,\n \"FileVersion\": {\n \"Major\": 1,\n \"Minor\": 0,\n \"Build\": 0,\n \"Revision\": 0\n },\n \"ProductVersion\": {\n \"Major\": 1,\n \"Minor\": 0,\n \"Build\": 0,\n \"Revision\": 0\n },\n \"FileFlags\": 0,\n \"FileOs\": [\n \"VOS_DOS_WINDOWS32\",\n \"VOS_NT_WINDOWS32\",\n \"VOS__WINDOWS32\"\n ],\n \"FileType\": \"VFT_APP\",\n \"Language\": \"UNKNOWN\",\n \"Comments\": \"\",\n \"CompanyName\": \"\",\n \"FileDescription\": \"Client\",\n \"FileVersion_2\": \"1.0.0.0\",\n \"InternalName\": \"Client.exe\",\n \"LegalCopyright\": \"\",\n \"LegalTrademarks\": \"\",\n \"OriginalFilename\": \"Client.exe\",\n \"ProductName\": \"Client\",\n \"ProductVersion_2\": \"1.0.0.0\",\n \"Assembly_Version\": \"1.0.0.0\"\n }\n }\n}"},"Debug Info":{"raw_response":"{\n \"IMAGE_DEBUG_TYPE_CODEVIEW\": {\n \"Characteristics\": 0,\n \"TimeDateStamp\": \"2068-May-04 18:04:16\",\n \"Version\": 0.0,\n \"SizeofData\": 101,\n \"AddressOfRawData\": 0x00038EA4,\n \"PointerToRawData\": 0x000370A4,\n \"ReferencedFile\": \"C:\\\\Users\\\\sulum\\\\OneDrive\\\\Desktop\\\\datacenter\\\\stubCsharp\\\\obj\\\\Release\\\\Client.pdb\"\n },\n \"UNKNOWN\": {\n \"Characteristics\": 0,\n \"TimeDateStamp\": \"1970-Jan-01 00:00:00\",\n \"Version\": 0.0,\n \"SizeofData\": 0,\n \"AddressOfRawData\": 0x00000000,\n \"PointerToRawData\": 0x00000000\n },\n \"SUSPICIOUS_STRINGS\": [\n {\n \"Type\": \"System_or_Monitoring_Tool\",\n \"Strings\": [\n \"rundll32.exe\",\n \"schtask\"\n ]\n },\n {\n \"Type\": \"Security_Software\",\n \"Strings\": [\n \"rshell.exe\"\n ]\n },\n {\n \"Type\": \"Dropper_Capabilities\",\n \"Strings\": [\n \"CurrentVersion\\\\Run\"\n ]\n },\n {\n \"Type\": \"Miscellaneous_Malware_Strings\",\n \"Strings\": [\n \"cmd.Exe\"\n ]\n },\n {\n \"Type\": \"Domain_Names\",\n \"Strings\": [\n \"ftp://server09.mentality.cloud\",\n \"ftp://server09.mentality.cloud/public_html/sqlite3.dll\",\n \"http://ip-api.com\",\n \"ip-api.com\"\n ]\n }\n ],\n \"EXPLOIT_MITIGATION_TECHNIQUES\": {\n \"Stack_Canary\": \"disabled\",\n \"SafeSEH\": \"disabled\",\n \"ASLR\": \"enabled\",\n \"DEP\": \"enabled\",\n \"CFG\": \"disabled\"\n }\n}"}} {"_id":{"$oid":"697df9f5c45b753179b2cedc"},"Summary":{"Architecture":"IMAGE_FILE_MACHINE_I386","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","Compilation Date":"2088-Mar-06 18:36:34","Debug Artifacts":"C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb","Comments":"RMM Client","CompanyName":"","FileDescription":"Client","FileVersion":"1.0.0.0","InternalName":"Client.exe","LegalCopyright":"","LegalTrademarks":"","OriginalFilename":"Client.exe","ProductName":"Client","ProductVersion":"1.0.0.0","Assembly Version":"1.0.0.0"},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0090","e_cp":"0x0003","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x0000","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x0000","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x00000080"},"PE Header":{"raw_response":"{\n \"Signature\": \"PE\",\n \"Machine\": \"IMAGE_FILE_MACHINE_I386\",\n \"NumberofSections\": 3,\n \"TimeDateStamp\": \"2088-Mar-06 18:36:34\",\n \"PointerToSymbolTable\": 0,\n \"NumberOfSymbols\": 0,\n \"SizeOfOptionalHeader\": 0x00E0,\n \"Characteristics\": [\n \"IMAGE_FILE_EXECUTABLE_IMAGE\",\n \"IMAGE_FILE_LARGE_ADDRESS_AWARE\"\n ]\n}"},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"48.0","SizeOfCode":"0x00037000","SizeOfInitializedData":"0x00000A00","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x00038F5E","BaseOfCode":"0x00002000","BaseOfData":"0x0003A000","ImageBase":"0x00400000","SectionAlignment":"0x00002000","FileAlignment":"0x00000200","OperatingSystemVersion":"4.0","ImageVersion":"0.0","SubsystemVersion":"6.0","Win32VersionValue":"0","SizeOfImage":"0x0003E000","SizeOfHeaders":"0x00000200","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE | IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA | IMAGE_DLLCHARACTERISTICS_NO_SEH | IMAGE_DLLCHARACTERISTICS_NX_COMPAT | IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":16},"Sections":{".text":{"VirtualSize":"0x00036FD0","VirtualAddress":"0x00002000","SizeOfRawData":"0x00037000","PointerToRawData":"0x00000200","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":"0","NumberOfRelocations":"0","Characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"Entropy":"5.55645"},".rsrc":{"VirtualSize":"0x000006AC","VirtualAddress":"0x0003A000","SizeOfRawData":"0x00000800","PointerToRawData":"0x00037200","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":"0","NumberOfRelocations":"0","Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":"4.50595"},".reloc":{"VirtualSize":"0x0000000C","VirtualAddress":"0x0003C000","SizeOfRawData":"0x00000200","PointerToRawData":"0x00037A00","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":"0","NumberOfRelocations":"0","Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"Entropy":"0.10191"}},"Imports":{"entity1":"mscoree.dll","entity2":"_CorExeMain"},"Resources":[{"Type":"RT_RCDATA","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":30,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":2.48173},{"Type":"RT_RCDATA","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":10,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":1.37095},{"Type":"RT_RCDATA","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":76,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":2.87727},{"Type":"RT_VERSION","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":768,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":3.16411},{"Type":"RT_MANIFEST","Language":"UNKNOWN","Codepage":"Latin 1 / Western European","Size":490,"TimeDateStamp":"1980-Jan-01 00:00:00","Entropy":5.00112}],"Version Info":{"raw_response":"{\n \"Resource\": {\n \"LangID\": \"UNKNOWN\",\n \"VS_VERSION_INFO\": {\n \"Signature\": 0xFEEF04BD,\n \"StructVersion\": 0x00010000,\n \"FileVersion\": {\n \"Major\": 1,\n \"Minor\": 0,\n \"Build\": 0,\n \"Revision\": 0\n },\n \"ProductVersion\": {\n \"Major\": 1,\n \"Minor\": 0,\n \"Build\": 0,\n \"Revision\": 0\n },\n \"FileFlags\": 0,\n \"FileOs\": [\n \"VOS_DOS_WINDOWS32\",\n \"VOS_NT_WINDOWS32\",\n \"VOS__WINDOWS32\"\n ],\n \"FileType\": \"VFT_APP\",\n \"Language\": \"UNKNOWN\",\n \"Comments\": \"\",\n \"CompanyName\": \"\",\n \"FileDescription\": \"Client\",\n \"FileVersion_2\": \"1.0.0.0\",\n \"InternalName\": \"Client.exe\",\n \"LegalCopyright\": \"\",\n \"LegalTrademarks\": \"\",\n \"OriginalFilename\": \"Client.exe\",\n \"ProductName\": \"Client\",\n \"ProductVersion_2\": \"1.0.0.0\",\n \"Assembly_Version\": \"1.0.0.0\"\n }\n }\n}"},"Debug Info":{"raw_response":"Here is the valid JSON output extracted from the input:\n\n```json\n{\n \"IMAGE_DEBUG_TYPE_CODEVIEW\": {\n \"Characteristics\": 0,\n \"TimeDateStamp\": \"2068-May-04 18:04:16\",\n \"Version\": 0.0,\n \"SizeofData\": 101,\n \"AddressOfRawData\": 0x00038EA4,\n \"PointerToRawData\": 0x000370A4,\n \"Referenced File\": \"C:\\\\Users\\\\sulum\\\\OneDrive\\\\Desktop\\\\datacenter\\\\stubCsharp\\\\obj\\\\Release\\\\Client.pdb\"\n },\n \"UNKNOWN\": {\n \"Characteristics\": 0,\n \"TimeDateStamp\": \"1970-Jan-01 00:00:00\",\n \"Version\": 0.0,\n \"SizeofData\": 0,\n \"AddressOfRawData\": 0x00000000,\n \"PointerToRawData\": 0x00000000\n },\n \"SUSPICIOUS\": {\n \"SystemOrMonitoringTools\": [\n \"rundll32.exe\",\n \"schtask\"\n ],\n \"SecuritySoftware\": [\n \"rshell.exe\"\n ],\n \"DropperCapabilities\": [\n \"CurrentVersion\\\\Run\"\n ],\n \"MiscellaneousMalwareStrings\": [\n \"cmd.Exe\"\n ],\n \"DomainNames\": [\n \"ftp://server09.mentality.cloud\",\n \"ftp://server09.mentality.cloud/public_html/sqlite3.dll\",\n \"http://ip-api.com\",\n \"ip-api.com\"\n ]\n },\n \"ExploitMitigationTechniques\": {\n \"StackCanary\": \"disabled\",\n \"SafeSEH\": \"disabled\",\n \"ASLR\": \"enabled\",\n \"DEP\": \"enabled\",\n \"CFG\": \"disabled\"\n }\n}\n```"}} {"_id":{"$oid":"69e716f959a6632dae07ddfc"},"sha256":"e37c838dc5eaa1b302ffbd8721c6a5f52a068e8f78bbec63b19b950462fe6cf8","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/2\nDate: 2026-04-26 23:28:59\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/2\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Feb-13 01:35:27\nDebug artifacts: kZZhV.pdb\nComments: Zihin Sarayi - Hafiza Sarayi Olusturucu\nCompanyName: \nFileDescription: MindPalace\nFileVersion: 1.0.0.0\nInternalName: kZZhV.exe\nLegalCopyright: Copyright 2026\nLegalTrademarks: \nOriginalFilename: kZZhV.exe\nProductName: MindPalace\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2026-Feb-13 01:35:27\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x00182A00\nSizeOfInitializedData: 0x00000800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0018490E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00186000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0018A000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 15\n\nSections:\n---------\n.text:\n VirtualSize: 0x00182914\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00182A00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.89677\n\n.rsrc:\n VirtualSize: 0x000005E8\n VirtualAddress: 0x00186000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00182C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.19379\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00188000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00183200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 860\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.33583\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: Zihin Sarayi - Hafiza Sarayi Olusturucu\n CompanyName: \n FileDescription: MindPalace\n FileVersion (#2): 1.0.0.0\n InternalName: kZZhV.exe\n LegalCopyright: Copyright 2026\n LegalTrademarks: \n OriginalFilename: kZZhV.exe\n ProductName: MindPalace\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 1970-Jan-01 00:00:00\n Version: 0.0\n SizeofData: 34\n AddressOfRawData: 0x00184897\n PointerToRawData: 0x00182A97\n Referenced File: kZZhV.pdb\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n\nCryptographic algorithms detected in the binary:\n Uses constants related to MD5\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"architecture":"IMAGE_FILE_MACHINE_I386","subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","compilation_date":"2026-Feb-13 01:35:27","debug_artifacts":"kZZhV.pdb","comments":"Zihin Sarayi - Hafiza Sarayi Olusturucu","company_name":"","file_description":"MindPalace","file_version":"1.0.0.0","internal_name":"kZZhV.exe","legal_copyright":"Copyright 2026","legal_trademarks":"","original_filename":"kZZhV.exe","product_name":"MindPalace","product_version":"1.0.0.0","assembly_version":"1.0.0.0"},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0090","e_cp":"0x0003","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x0000","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x0000","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x00000080"},"PE Header":{"Signature":"PE","Machine":"IMAGE_FILE_MACHINE_I386","NumberofSections":3,"TimeDateStamp":"2026-Feb-13 01:35:27","PointerToSymbolTable":"0x00000000","NumberOfSymbols":0,"SizeOfOptionalHeader":"0x00E0","Characteristics":["IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE_IMAGE","IMAGE_FILE_LINE_NUMS_STRIPPED","IMAGE_FILE_LOCAL_SYMS_STRIPPED"]},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"48.0","SizeOfCode":"0x00182A00","SizeOfInitializedData":"0x00000800","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x0018490E","Section":".text","BaseOfCode":"0x00002000","BaseOfData":"0x00186000","ImageBase":"0x00400000","SectionAlignment":"0x00002000","FileAlignment":"0x00000200","OperatingSystemVersion":"4.0","ImageVersion":"0.0","SubsystemVersion":"4.0","Win32VersionValue":"0","SizeOfImage":"0x0018A000","SizeOfHeaders":"0x00000200","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":["IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NO_SEH","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"15"},"Sections":{"sections":[{"name":".text","virtual_size":"0x00182914","virtual_address":"0x00002000","size_of_raw_data":"0x00182A00","pointer_to_raw_data":"0x00000200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"entropy":7.89677},{"name":".rsrc","virtual_size":"0x000005E8","virtual_address":"0x00186000","size_of_raw_data":"0x00000600","pointer_to_raw_data":"0x00182C00","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"entropy":4.19379},{"name":".reloc","virtual_size":"0x0000000C","virtual_address":"0x00188000","size_of_raw_data":"0x00000200","pointer_to_raw_data":"0x00183200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"entropy":0.10191}]},"Imports":{"file_info":{"internal_name":"kZZhV.exe","file_description":"MindPalace","original_filename":"kZZhV.exe","product_name":"MindPalace","company_name":"","legal_copyright":"Copyright 2026","legal_trademarks":"","file_version":"1.0.0.0","product_version":"1.0.0.0","assembly_version":"1.0.0.0","comments":"Zihin Sarayi - Hafiza Sarayi Olusturucu"},"resources":[{"type":"RT_VERSION","language":"UNKNOWN","codepage":"UNKNOWN","size":860,"timedatestamp":"1980-Jan-01 00:00:00","entropy":3.33583},{"type":"RT_MANIFEST","language":"UNKNOWN","codepage":"UNKNOWN","size":490,"timedatestamp":"1980-Jan-01 00:00:00","entropy":5.00112}],"debug_info":{"type":"IMAGE_DEBUG_TYPE_CODEVIEW","characteristics":0,"timedatestamp":"1970-Jan-01 00:00:00","version":"0.0","sizeofdata":34,"addressofrawdata":"0x00184897","pointertorawdata":"0x00182A97","referenced_file":"kZZhV.pdb"},"compiler":"Microsoft Visual C# v7.0 / Basic .NET","crypto":["MD5"],"mitigations":{"stack_canary":false,"safe_seh":false,"aslr":true,"dep":true,"cfg":false}},"Exports":{},"Resources":{"entities":[{"type":"RT_VERSION","language":"UNKNOWN","codepage":"UNKNOWN","size":860,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":3.33583},{"type":"RT_MANIFEST","language":"UNKNOWN","codepage":"UNKNOWN","size":490,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":5.00112}],"version_info":{"resource_lang_id":"UNKNOWN","signature":"0xFEEF04BD","struct_version":"0x00010000","file_version":"1.0.0.0","product_version":"1.0.0.0","file_flags":"(EMPTY)","file_os":["VOS_DOS_WINDOWS32","VOS_NT_WINDOWS32","VOS__WINDOWS32"],"file_type":"VFT_APP","language":"UNKNOWN","comments":"Zihin Sarayi - Hafiza Sarayi Olusturucu","company_name":"","file_description":"MindPalace","internal_name":"kZZhV.exe","legal_copyright":"Copyright 2026","legal_trademarks":"","original_filename":"kZZhV.exe","product_name":"MindPalace","assembly_version":"1.0.0.0"}},"Debug Info":{"IMAGE_DEBUG_TYPE_CODEVIEW":{"Characteristics":0,"TimeDateStamp":"1970-Jan-01 00:00:00","Version":"0.0","SizeofData":34,"AddressOfRawData":"0x00184897","PointerToRawData":"0x00182A97","ReferencedFile":"kZZhV.pdb"},"MatchingCompilers":["Microsoft Visual C# v7.0 / Basic .NET"],"CryptographicAlgorithms":["MD5"],"ExploitMitigationTechniques":{"StackCanary":false,"SafeSEH":false,"ASLR":true,"DEP":true,"CFG":false}},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/2"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_uk15fdqw/output.txt"},"timestamp":"2026-04-26 23:29:18"} {"_id":{"$oid":"69e917a859a6632dae07de0f"},"md5":"9a5ff998dbf0f6923d0b454d89800fb4","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f.exe\nDate: 2026-04-23 00:49:03\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2088-Mar-06 18:36:34\nDebug artifacts: C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb\nComments: RMM Client\nCompanyName: \nFileDescription: Client\nFileVersion: 1.0.0.0\nInternalName: Client.exe\nLegalCopyright: \nLegalTrademarks: \nOriginalFilename: Client.exe\nProductName: Client\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2088-Mar-06 18:36:34\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x00037000\nSizeOfInitializedData: 0x00000A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00038F5E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x0003A000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0003E000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00036FD0\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00037000\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.55645\n\n.rsrc:\n VirtualSize: 0x000006AC\n VirtualAddress: 0x0003A000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00037200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.50595\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x0003C000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00037A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 30\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.48173\n\n2:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 10\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.37095\n\n3:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 76\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.87727\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 768\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16411\n\n1 (#3):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: RMM Client\n CompanyName: \n FileDescription: Client\n FileVersion (#2): 1.0.0.0\n InternalName: Client.exe\n LegalCopyright: \n LegalTrademarks: \n OriginalFilename: Client.exe\n ProductName: Client\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2068-May-04 18:04:16\n Version: 0.0\n SizeofData: 101\n AddressOfRawData: 0x00038EA4\n PointerToRawData: 0x000370A4\n Referenced File: C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 1970-Jan-01 00:00:00\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n rundll32.exe\n schtask\n Contains references to security software:\n rshell.exe\n May have dropper capabilities:\n CurrentVersion\\Run\n Miscellaneous malware strings:\n cmd.Exe\n Contains domain names:\n ftp://server09.mentality.cloud\n ftp://server09.mentality.cloud/public_html/sqlite3.dll\n http://ip-api.com\n ip-api.com\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"architecture":"IMAGE_FILE_MACHINE_I386","subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","compilation_date":"2088-Mar-06 18:36:34","debug_artifacts":"C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb","comments":"RMM Client","company_name":"","file_description":"Client","file_version":"1.0.0.0","internal_name":"Client.exe","legal_copyright":"","legal_trademarks":"","original_filename":"Client.exe","product_name":"Client","product_version":"1.0.0.0","assembly_version":"1.0.0.0"},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0090","e_cp":"0x0003","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x0000","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x0000","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x00000080"},"PE Header":{"Signature":"PE","Machine":"IMAGE_FILE_MACHINE_I386","NumberofSections":3,"TimeDateStamp":"2088-Mar-06 18:36:34","PointerToSymbolTable":"0x00000000","NumberOfSymbols":0,"SizeOfOptionalHeader":"0x00E0","Characteristics":["IMAGE_FILE_EXECUTABLE_IMAGE","IMAGE_FILE_LARGE_ADDRESS_AWARE"]},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"48.0","SizeOfCode":"0x00037000","SizeOfInitializedData":"0x00000A00","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x00038F5E","EntryPointSection":".text","BaseOfCode":"0x00002000","BaseOfData":"0x0003A000","ImageBase":"0x00400000","SectionAlignment":"0x00002000","FileAlignment":"0x00000200","OperatingSystemVersion":"4.0","ImageVersion":"0.0","SubsystemVersion":"6.0","Win32VersionValue":"0","SizeOfImage":"0x0003E000","SizeOfHeaders":"0x00000200","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":["IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","IMAGE_DLLCHARACTERISTICS_NO_SEH","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"16"},"Sections":{"sections":[{"name":".text","virtual_size":"0x00036FD0","virtual_address":"0x00002000","size_of_raw_data":"0x00037000","pointer_to_raw_data":"0x00000200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"entropy":5.55645},{"name":".rsrc","virtual_size":"0x000006AC","virtual_address":"0x0003A000","size_of_raw_data":"0x00000800","pointer_to_raw_data":"0x00037200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"entropy":4.50595},{"name":".reloc","virtual_size":"0x0000000C","virtual_address":"0x0003C000","size_of_raw_data":"0x00000200","pointer_to_raw_data":"0x00037A00","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"entropy":0.10191}]},"Imports":{"final_response":{"mscoree.dll":"_CorExeMain"},"resources":[{"id":1,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":30,"timedatestamp":"1980-Jan-01 00:00:00","entropy":2.48173},{"id":2,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":10,"timedatestamp":"1980-Jan-01 00:00:00","entropy":1.37095},{"id":3,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":76,"timedatestamp":"1980-Jan-01 00:00:00","entropy":2.87727},{"id":"1 (#2)","type":"RT_VERSION","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":768,"timedatestamp":"1980-Jan-01 00:00:00","entropy":3.16411},{"id":"1 (#3)","type":"RT_MANIFEST","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":490,"timedatestamp":"1980-Jan-01 00:00:00","entropy":5.00112}],"version_info":{"resource_langid":"UNKNOWN","vs_version_info":{"signature":"0xFEEF04BD","structversion":"0x00010000","fileversion":"1.0.0.0","productversion":"1.0.0.0","fileflags":"(EMPTY)","fileos":["VOS_DOS_WINDOWS32","VOS_NT_WINDOWS32","VOS__WINDOWS32"],"filetype":"VFT_APP","language":"UNKNOWN","comments":"RMM Client","companyname":"","filedescription":"Client","fileversion_2":"1.0.0.0","internalname":"Client.exe","legalcopyright":"","legaltrademarks":"","originalfilename":"Client.exe","productname":"Client","productversion_2":"1.0.0.0","assembly_version":"1.0.0.0"}},"debug_info":[{"type":"IMAGE_DEBUG_TYPE_CODEVIEW","characteristics":0,"timedatestamp":"2068-May-04 18:04:16","version":"0.0","sizeofdata":101,"addressofrawdata":"0x00038EA4","pointertorawdata":"0x000370A4","referenced_file":"C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb"},{"type":"UNKNOWN","characteristics":0,"timedatestamp":"1970-Jan-01 00:00:00","version":"0.0","sizeofdata":0,"addressofrawdata":"0x00000000","pointertorawdata":"0x00000000"}],"suspicious_strings":{"system_monitoring_tools":["rundll32.exe","schtask"],"security_software":["rshell.exe"],"dropper_capabilities":["CurrentVersion\\Run"],"miscellaneous_malware_strings":["cmd.Exe"],"domain_names":["ftp://server09.mentality.cloud","ftp://server09.mentality.cloud/public_html/sqlite3.dll","http://ip-api.com","ip-api.com"]},"exploit_mitigation_techniques":{"stack_canary":"disabled","safe_seh":"disabled","aslr":"enabled","dep":"enabled","cfg":"disabled"}},"Exports":{},"Resources":{"entities":[{"id":1,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":30,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":2.48173},{"id":2,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":10,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":1.37095},{"id":3,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":76,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":2.87727},{"id":"1 (#2)","type":"RT_VERSION","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":768,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":3.16411},{"id":"1 (#3)","type":"RT_MANIFEST","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":490,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":5.00112}],"version_info":{"resource_lang_id":"UNKNOWN","vs_version_info":{"signature":"0xFEEF04BD","struct_version":"0x00010000","file_version":"1.0.0.0","product_version":"1.0.0.0","file_flags":"(EMPTY)","file_os":["VOS_DOS_WINDOWS32","VOS_NT_WINDOWS32","VOS__WINDOWS32"],"file_type":"VFT_APP","language":"UNKNOWN","comments":"RMM Client","company_name":"","file_description":"Client","file_version_2":"1.0.0.0","internal_name":"Client.exe","legal_copyright":"","legal_trademarks":"","original_filename":"Client.exe","product_name":"Client","product_version_2":"1.0.0.0","assembly_version":"1.0.0.0"}}},"Debug Info":{"debug_info":[{"type":"IMAGE_DEBUG_TYPE_CODEVIEW","characteristics":0,"time_date_stamp":"2068-May-04 18:04:16","version":"0.0","size_of_data":101,"address_of_raw_data":"0x00038EA4","pointer_to_raw_data":"0x000370A4","referenced_file":"C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb"},{"type":"UNKNOWN","characteristics":0,"time_date_stamp":"1970-Jan-01 00:00:00","version":"0.0","size_of_data":0,"address_of_raw_data":"0x00000000","pointer_to_raw_data":"0x00000000"}],"suspicious_strings":{"system_monitoring_tools":["rundll32.exe","schtask"],"security_software_references":["rshell.exe"],"dropper_capabilities":["CurrentVersion\\Run"],"malware_strings":["cmd.Exe"],"domain_names":["ftp://server09.mentality.cloud","ftp://server09.mentality.cloud/public_html/sqlite3.dll","http://ip-api.com","ip-api.com"]},"exploit_mitigations":{"stack_canary":"disabled","safe_seh":"disabled","aslr":"enabled","dep":"enabled","cfg":"disabled"}},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_rs4a4k_u/output.txt"},"timestamp":"2026-04-23 00:49:24"} {"_id":{"$oid":"69e9bbc859a6632dae07de21"},"sha256":"360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/now_you_see_me_again.exe\nDate: 2026-04-29 20:29:21\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/now_you_see_me_again.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2088-Mar-06 18:36:34\nDebug artifacts: C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb\nComments: RMM Client\nCompanyName: \nFileDescription: Client\nFileVersion: 1.0.0.0\nInternalName: Client.exe\nLegalCopyright: \nLegalTrademarks: \nOriginalFilename: Client.exe\nProductName: Client\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2088-Mar-06 18:36:34\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x00037000\nSizeOfInitializedData: 0x00000A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00038F5E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x0003A000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0003E000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00036FD0\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00037000\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.55645\n\n.rsrc:\n VirtualSize: 0x000006AC\n VirtualAddress: 0x0003A000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00037200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.50595\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x0003C000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00037A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 30\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.48173\n\n2:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 10\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.37095\n\n3:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 76\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.87727\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 768\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16411\n\n1 (#3):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: RMM Client\n CompanyName: \n FileDescription: Client\n FileVersion (#2): 1.0.0.0\n InternalName: Client.exe\n LegalCopyright: \n LegalTrademarks: \n OriginalFilename: Client.exe\n ProductName: Client\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2068-May-04 18:04:16\n Version: 0.0\n SizeofData: 101\n AddressOfRawData: 0x00038EA4\n PointerToRawData: 0x000370A4\n Referenced File: C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 1970-Jan-01 00:00:00\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n rundll32.exe\n schtask\n Contains references to security software:\n rshell.exe\n May have dropper capabilities:\n CurrentVersion\\Run\n Miscellaneous malware strings:\n cmd.Exe\n Contains domain names:\n ftp://server09.mentality.cloud\n ftp://server09.mentality.cloud/public_html/sqlite3.dll\n http://ip-api.com\n ip-api.com\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"architecture":"IMAGE_FILE_MACHINE_I386","subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","compilation_date":"2088-Mar-06 18:36:34","debug_artifacts":"C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb","comments":"RMM Client","company_name":"","file_description":"Client","file_version":"1.0.0.0","internal_name":"Client.exe","legal_copyright":"","legal_trademarks":"","original_filename":"Client.exe","product_name":"Client","product_version":"1.0.0.0","assembly_version":"1.0.0.0"},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0090","e_cp":"0x0003","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x0000","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x0000","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x00000080"},"PE Header":{"signature":"PE","machine":"IMAGE_FILE_MACHINE_I386","numberOfSections":3,"timeDateStamp":"2088-Mar-06 18:36:34","pointerToSymbolTable":"0x00000000","numberOfSymbols":0,"sizeOfOptionalHeader":"0x00E0","characteristics":["IMAGE_FILE_EXECUTABLE_IMAGE","IMAGE_FILE_LARGE_ADDRESS_AWARE"]},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"48.0","SizeOfCode":"0x00037000","SizeOfInitializedData":"0x00000A00","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x00038F5E","EntryPointSection":".text","BaseOfCode":"0x00002000","BaseOfData":"0x0003A000","ImageBase":"0x00400000","SectionAlignment":"0x00002000","FileAlignment":"0x00000200","OperatingSystemVersion":"4.0","ImageVersion":"0.0","SubsystemVersion":"6.0","Win32VersionValue":"0","SizeOfImage":"0x0003E000","SizeOfHeaders":"0x00000200","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":["IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","IMAGE_DLLCHARACTERISTICS_NO_SEH","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"16"},"Sections":{"sections":[{"name":".text","virtual_size":"0x00036FD0","virtual_address":"0x00002000","size_of_raw_data":"0x00037000","pointer_to_raw_data":"0x00000200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"entropy":5.55645},{"name":".rsrc","virtual_size":"0x000006AC","virtual_address":"0x0003A000","size_of_raw_data":"0x00000800","pointer_to_raw_data":"0x00037200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"entropy":4.50595},{"name":".reloc","virtual_size":"0x0000000C","virtual_address":"0x0003C000","size_of_raw_data":"0x00000200","pointer_to_raw_data":"0x00037A00","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"entropy":0.10191}]},"Imports":{"entities":{"file_info":{"entry_point":"mscoree.dll: _CorExeMain","resources":[{"id":1,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":30,"timestamp":"1980-01-01T00:00:00","entropy":2.48173},{"id":2,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":10,"timestamp":"1980-01-01T00:00:00","entropy":1.37095},{"id":3,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":76,"timestamp":"1980-01-01T00:00:00","entropy":2.87727},{"id":"1 (#2)","type":"RT_VERSION","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":768,"timestamp":"1980-01-01T00:00:00","entropy":3.16411},{"id":"1 (#3)","type":"RT_MANIFEST","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":490,"timestamp":"1980-01-01T00:00:00","entropy":5.00112}],"version_info":{"lang_id":"UNKNOWN","signature":"0xFEEF04BD","struct_version":"0x00010000","file_version":"1.0.0.0","product_version":"1.0.0.0","file_flags":"(EMPTY)","file_os":["VOS_DOS_WINDOWS32","VOS_NT_WINDOWS32","VOS__WINDOWS32"],"file_type":"VFT_APP","language":"UNKNOWN","comments":"RMM Client","company_name":"","file_description":"Client","internal_name":"Client.exe","legal_copyright":"","legal_trademarks":"","original_filename":"Client.exe","product_name":"Client","assembly_version":"1.0.0.0"},"debug_info":[{"type":"IMAGE_DEBUG_TYPE_CODEVIEW","characteristics":0,"timestamp":"2068-05-04T18:04:16","version":"0.0","sizeof_data":101,"address_of_raw_data":"0x00038EA4","pointer_to_raw_data":"0x000370A4","referenced_file":"C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb"},{"type":"UNKNOWN","characteristics":0,"timestamp":"1970-01-01T00:00:00","version":"0.0","sizeof_data":0,"address_of_raw_data":"0x00000000","pointer_to_raw_data":"0x00000000"}]},"suspicious_strings":{"system_monitoring_tools":["rundll32.exe","schtask"],"security_software":["rshell.exe"],"dropper_capabilities":["CurrentVersion\\Run"],"malware_strings":["cmd.Exe"],"domain_names":["ftp://server09.mentality.cloud","ftp://server09.mentality.cloud/public_html/sqlite3.dll","http://ip-api.com","ip-api.com"]},"exploit_mitigations":{"stack_canary":"disabled","safe_seh":"disabled","aslr":"enabled","dep":"enabled","cfg":"disabled"}}},"Exports":{},"Resources":{"entities":[{"id":1,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":30,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":2.48173},{"id":2,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":10,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":1.37095},{"id":3,"type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":76,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":2.87727},{"id":"1 (#2)","type":"RT_VERSION","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":768,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":3.16411},{"id":"1 (#3)","type":"RT_MANIFEST","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":490,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":5.00112}],"version_info":{"resource_lang_id":"UNKNOWN","vs_version_info":{"signature":"0xFEEF04BD","struct_version":"0x00010000","file_version":"1.0.0.0","product_version":"1.0.0.0","file_flags":"(EMPTY)","file_os":["VOS_DOS_WINDOWS32","VOS_NT_WINDOWS32","VOS__WINDOWS32"],"file_type":"VFT_APP","language":"UNKNOWN","comments":"RMM Client","company_name":"","file_description":"Client","file_version_2":"1.0.0.0","internal_name":"Client.exe","legal_copyright":"","legal_trademarks":"","original_filename":"Client.exe","product_name":"Client","product_version_2":"1.0.0.0","assembly_version":"1.0.0.0"}}},"Debug Info":{"debug_info":[{"type":"IMAGE_DEBUG_TYPE_CODEVIEW","characteristics":0,"time_date_stamp":"2068-May-04 18:04:16","version":"0.0","size_of_data":101,"address_of_raw_data":"0x00038EA4","pointer_to_raw_data":"0x000370A4","referenced_file":"C:\\Users\\sulum\\OneDrive\\Desktop\\datacenter\\stubCsharp\\obj\\Release\\Client.pdb"},{"type":"UNKNOWN","characteristics":0,"time_date_stamp":"1970-Jan-01 00:00:00","version":"0.0","size_of_data":0,"address_of_raw_data":"0x00000000","pointer_to_raw_data":"0x00000000"}],"suspicious_strings":{"system_monitoring_tools":["rundll32.exe","schtask"],"security_software_references":["rshell.exe"],"dropper_capabilities":["CurrentVersion\\Run"],"malware_strings":["cmd.Exe"],"domain_names":["ftp://server09.mentality.cloud","ftp://server09.mentality.cloud/public_html/sqlite3.dll","http://ip-api.com","ip-api.com"]},"exploit_mitigations":{"stack_canary":"disabled","safe_seh":"disabled","aslr":"enabled","dep":"enabled","cfg":"disabled"}},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/now_you_see_me_again.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_xey_u5_3/output.txt"},"timestamp":"2026-04-29 20:29:55"} {"_id":{"$oid":"69edc3cf59a6632dae07de33"},"sha256":"2aa5ce3561dc657a157460383c7c9b8db54ac8a6969627009c8d1062316a6130","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_12ohn_ul/2aa5ce3561dc657a157460383c7c9b8db54ac8a6969627009c8d1062316a6130_2aa5ce3561dc/001_upx_unpacked.exe\nDate: 2026-05-15 14:31:39\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_12ohn_ul/2aa5ce3561dc657a157460383c7c9b8db54ac8a6969627009c8d1062316a6130_2aa5ce3561dc/001_upx_unpacked.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2025-Nov-28 09:36:05\nDetected languages: English - United Kingdom\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000120\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2025-Nov-28 09:36:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0009AC00\nSizeOfInitializedData: 0x00090000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000204F7 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0009C000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00131000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00400000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00400000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0009AA37\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0009AC00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.66568\n\n.rdata:\n VirtualSize: 0x0002FB92\n VirtualAddress: 0x0009C000\n SizeOfRawData: 0x0002FC00\n PointerToRawData: 0x0009B000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.61024\n\n.data:\n VirtualSize: 0x0000705C\n VirtualAddress: 0x000CC000\n SizeOfRawData: 0x00004800\n PointerToRawData: 0x000CAC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.584577\n\n.rsrc:\n VirtualSize: 0x000545C4\n VirtualAddress: 0x000D4000\n SizeOfRawData: 0x00054600\n PointerToRawData: 0x000CF400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.8804\n\n.reloc:\n VirtualSize: 0x000075CC\n VirtualAddress: 0x00129000\n SizeOfRawData: 0x00007600\n PointerToRawData: 0x00123A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.7982\n\n\nImports:\n--------\nKERNEL32.DLL: DuplicateHandle\n CreateThread\n WaitForSingleObject\n HeapAlloc\n GetProcessHeap\n HeapFree\n Sleep\n GetCurrentThreadId\n MultiByteToWideChar\n MulDiv\n GetVersionExW\n IsWow64Process\n GetSystemInfo\n FreeLibrary\n LoadLibraryA\n GetProcAddress\n SetErrorMode\n GetModuleFileNameW\n WideCharToMultiByte\n lstrcpyW\n lstrlenW\n GetModuleHandleW\n QueryPerformanceCounter\n VirtualFreeEx\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n ReadProcessMemory\n CreateFileW\n SetFilePointerEx\n SetEndOfFile\n ReadFile\n WriteFile\n FlushFileBuffers\n TerminateProcess\n CreateToolhelp32Snapshot\n Process32FirstW\n Process32NextW\n SetFileTime\n GetFileAttributesW\n FindFirstFileW\n FindClose\n GetLongPathNameW\n GetShortPathNameW\n DeleteFileW\n IsDebuggerPresent\n CopyFileExW\n MoveFileW\n CreateDirectoryW\n RemoveDirectoryW\n SetSystemPowerState\n QueryPerformanceFrequency\n LoadResource\n LockResource\n SizeofResource\n OutputDebugStringW\n GetTempPathW\n GetTempFileNameW\n DeviceIoControl\n GetLocalTime\n CompareStringW\n GetCurrentThread\n LeaveCriticalSection\n GetStdHandle\n CreatePipe\n InterlockedExchange\n TerminateThread\n LoadLibraryExW\n FindResourceExW\n CopyFileW\n VirtualFree\n FormatMessageW\n GetExitCodeProcess\n GetPrivateProfileStringW\n WritePrivateProfileStringW\n GetPrivateProfileSectionW\n WritePrivateProfileSectionW\n GetPrivateProfileSectionNamesW\n FileTimeToLocalFileTime\n FileTimeToSystemTime\n SystemTimeToFileTime\n LocalFileTimeToFileTime\n GetDriveTypeW\n GetDiskFreeSpaceExW\n GetDiskFreeSpaceW\n GetVolumeInformationW\n SetVolumeLabelW\n CreateHardLinkW\n SetFileAttributesW\n CreateEventW\n SetEvent\n GetEnvironmentVariableW\n SetEnvironmentVariableW\n GlobalLock\n GlobalUnlock\n GlobalAlloc\n GetFileSize\n GlobalFree\n GlobalMemoryStatusEx\n Beep\n GetSystemDirectoryW\n HeapReAlloc\n HeapSize\n GetComputerNameW\n GetWindowsDirectoryW\n GetCurrentProcessId\n GetProcessIoCounters\n CreateProcessW\n GetProcessId\n SetPriorityClass\n LoadLibraryW\n VirtualAlloc\n GetCurrentDirectoryW\n lstrcmpiW\n DecodePointer\n GetLastError\n RaiseException\n InitializeCriticalSectionAndSpinCount\n DeleteCriticalSection\n InterlockedDecrement\n InterlockedIncrement\n ResetEvent\n WaitForSingleObjectEx\n IsProcessorFeaturePresent\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n CloseHandle\n GetFullPathNameW\n EnterCriticalSection\n GetStartupInfoW\n GetSystemTimeAsFileTime\n InitializeSListHead\n RtlUnwind\n SetLastError\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n EncodePointer\n ExitProcess\n GetModuleHandleExW\n ExitThread\n ResumeThread\n FreeLibraryAndExitThread\n GetACP\n GetDateFormatW\n GetTimeFormatW\n LCMapStringW\n GetStringTypeW\n GetFileType\n SetStdHandle\n GetConsoleCP\n GetConsoleMode\n ReadConsoleW\n GetTimeZoneInformation\n FindFirstFileExW\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetCommandLineW\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n SetEnvironmentVariableA\n SetCurrentDirectoryW\n FindNextFileW\n WriteConsoleW\nADVAPI32.dll: GetAce\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegConnectRegistryW\n InitializeSecurityDescriptor\n InitializeAcl\n AdjustTokenPrivileges\n OpenThreadToken\n OpenProcessToken\n LookupPrivilegeValueW\n DuplicateTokenEx\n CreateProcessAsUserW\n CreateProcessWithLogonW\n GetLengthSid\n CopySid\n LogonUserW\n AllocateAndInitializeSid\n CheckTokenMembership\n FreeSid\n GetTokenInformation\n RegCreateKeyExW\n GetSecurityDescriptorDacl\n GetAclInformation\n GetUserNameW\n AddAce\n SetSecurityDescriptorDacl\n InitiateSystemShutdownExW\nCOMCTL32.dll: ImageList_ReplaceIcon\n ImageList_Destroy\n ImageList_Remove\n ImageList_SetDragCursorImage\n ImageList_BeginDrag\n ImageList_DragEnter\n ImageList_DragLeave\n ImageList_EndDrag\n ImageList_DragMove\n InitCommonControlsEx\n ImageList_Create\nCOMDLG32.dll: GetSaveFileNameW\n GetOpenFileNameW\nGDI32.dll: EndPath\n DeleteObject\n GetTextExtentPoint32W\n ExtCreatePen\n StrokeAndFillPath\n GetDeviceCaps\n SetPixel\n CloseFigure\n LineTo\n AngleArc\n MoveToEx\n Ellipse\n CreateCompatibleBitmap\n CreateCompatibleDC\n PolyDraw\n BeginPath\n Rectangle\n SetViewportOrgEx\n GetObjectW\n SetBkMode\n RoundRect\n SetBkColor\n CreatePen\n SelectObject\n StretchBlt\n CreateSolidBrush\n SetTextColor\n CreateFontW\n GetTextFaceW\n GetStockObject\n CreateDCW\n GetPixel\n DeleteDC\n GetDIBits\n StrokePath\nIPHLPAPI.DLL: IcmpSendEcho\n IcmpCloseHandle\n IcmpCreateFile\nMPR.dll: WNetGetConnectionW\n WNetCancelConnection2W\n WNetUseConnectionW\n WNetAddConnection2W\nole32.dll: CoTaskMemAlloc\n CoTaskMemFree\n CLSIDFromString\n ProgIDFromCLSID\n CLSIDFromProgID\n OleSetMenuDescriptor\n MkParseDisplayName\n OleSetContainedObject\n CoCreateInstance\n IIDFromString\n StringFromGUID2\n CreateStreamOnHGlobal\n OleInitialize\n OleUninitialize\n CoInitialize\n CoUninitialize\n GetRunningObjectTable\n CoGetInstanceFromFile\n CoGetObject\n CoInitializeSecurity\n CoCreateInstanceEx\n CoSetProxyBlanket\nOLEAUT32.dll: CreateStdDispatch\n CreateDispTypeInfo\n UnRegisterTypeLib\n UnRegisterTypeLibForUser\n RegisterTypeLibForUser\n RegisterTypeLib\n LoadTypeLibEx\n VariantCopyInd\n SysReAllocString\n SysFreeString\n VariantChangeType\n SafeArrayDestroyData\n SafeArrayUnaccessData\n SafeArrayAccessData\n SafeArrayAllocData\n SafeArrayAllocDescriptorEx\n SafeArrayCreateVector\n SysStringLen\n QueryPathOfRegTypeLib\n SysAllocString\n VariantInit\n VariantClear\n DispCallFunc\n VariantTimeToSystemTime\n VarR8FromDec\n SafeArrayGetVartype\n SafeArrayDestroyDescriptor\n VariantCopy\n OleLoadPicture\nPSAPI.DLL: GetProcessMemoryInfo\nSHELL32.dll: DragFinish\n DragQueryPoint\n ShellExecuteExW\n DragQueryFileW\n SHEmptyRecycleBinW\n SHGetPathFromIDListW\n SHBrowseForFolderW\n SHCreateShellItem\n SHGetDesktopFolder\n SHGetSpecialFolderLocation\n SHGetFolderPathW\n SHFileOperationW\n ExtractIconExW\n Shell_NotifyIconW\n ShellExecuteW\nUSER32.dll: IsCharAlphaW\n IsCharAlphaNumericW\n IsCharLowerW\n IsCharUpperW\n GetMenuStringW\n GetSubMenu\n GetCaretPos\n IsZoomed\n MonitorFromPoint\n GetMonitorInfoW\n SetWindowLongW\n SetLayeredWindowAttributes\n FlashWindow\n GetClassLongW\n TranslateAcceleratorW\n IsDialogMessageW\n GetSysColor\n InflateRect\n DrawFocusRect\n DrawTextW\n FrameRect\n DrawFrameControl\n FillRect\n PtInRect\n DestroyAcceleratorTable\n CreateAcceleratorTableW\n SetCursor\n GetWindowDC\n GetSystemMetrics\n GetActiveWindow\n CharNextW\n wsprintfW\n RedrawWindow\n DrawMenuBar\n DestroyMenu\n SetMenu\n GetWindowTextLengthW\n CreateMenu\n IsDlgButtonChecked\n DefDlgProcW\n CallWindowProcW\n ReleaseCapture\n SetCapture\n TranslateMessage\n PeekMessageW\n GetInputState\n UnregisterHotKey\n CharLowerBuffW\n MonitorFromRect\n LoadImageW\n mouse_event\n ExitWindowsEx\n SetActiveWindow\n FindWindowExW\n EnumThreadWindows\n SetMenuDefaultItem\n InsertMenuItemW\n IsMenu\n GetKeyboardLayoutNameW\n GetCursorPos\n DeleteMenu\n CheckMenuRadioItem\n GetMenuItemID\n GetMenuItemCount\n SetMenuItemInfoW\n GetMenuItemInfoW\n SetForegroundWindow\n IsIconic\n FindWindowW\n SystemParametersInfoW\n GetMessageW\n SendInput\n GetAsyncKeyState\n SetKeyboardState\n GetKeyboardState\n GetKeyState\n VkKeyScanW\n LoadStringW\n DialogBoxParamW\n MessageBeep\n EndDialog\n SendDlgItemMessageW\n GetDlgItem\n SetWindowTextW\n CopyRect\n EndPaint\n BeginPaint\n GetClientRect\n GetMenu\n DestroyWindow\n EnumWindows\n GetDesktopWindow\n IsWindow\n IsWindowEnabled\n IsWindowVisible\n EnableWindow\n InvalidateRect\n GetWindowLongW\n ReleaseDC\n GetDC\n GetWindowThreadProcessId\n AttachThreadInput\n GetFocus\n GetWindowTextW\n SendMessageTimeoutW\n EnumChildWindows\n CharUpperBuffW\n GetClassNameW\n GetParent\n GetDlgCtrlID\n SendMessageW\n MapVirtualKeyW\n PostMessageW\n GetWindowRect\n SetUserObjectSecurity\n CloseDesktop\n CloseWindowStation\n OpenDesktopW\n ClientToScreen\n RegisterHotKey\n GetCursorInfo\n SetWindowPos\n CopyImage\n AdjustWindowRectEx\n SetRect\n SetClipboardData\n EmptyClipboard\n CountClipboardFormats\n CloseClipboard\n GetClipboardData\n IsClipboardFormatAvailable\n OpenClipboard\n TrackPopupMenuEx\n BlockInput\n SetProcessWindowStation\n GetProcessWindowStation\n OpenWindowStationW\n GetUserObjectSecurity\n MessageBoxW\n DefWindowProcW\n MoveWindow\n SetFocus\n PostQuitMessage\n KillTimer\n CreatePopupMenu\n RegisterWindowMessageW\n SetTimer\n ShowWindow\n CreateWindowExW\n RegisterClassExW\n LoadIconW\n LoadCursorW\n GetSysColorBrush\n GetForegroundWindow\n MessageBoxA\n DestroyIcon\n LockWindowUpdate\n keybd_event\n DispatchMessageW\n ScreenToClient\nUSERENV.dll: DestroyEnvironmentBlock\n LoadUserProfileW\n CreateEnvironmentBlock\n UnloadUserProfile\nUxTheme.dll: IsThemeActive\nVERSION.dll: GetFileVersionInfoW\n VerQueryValueW\n GetFileVersionInfoSizeW\nWININET.dll: HttpOpenRequestW\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n HttpQueryInfoW\n InternetQueryOptionW\n InternetConnectW\n HttpSendRequestW\n FtpOpenFileW\n FtpGetFileSize\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\nWINMM.dll: timeGetTime\n waveOutSetVolume\n mciSendStringW\nWSOCK32.dll: gethostbyname\n recv\n send\n socket\n inet_ntoa\n setsockopt\n ntohs\n WSACleanup\n WSAStartup\n sendto\n htons\n __WSAFDIsSet\n select\n accept\n listen\n bind\n inet_addr\n ioctlsocket\n recvfrom\n WSAGetLastError\n closesocket\n gethostname\n connect\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.66371\n\n2:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05883\n\n3:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.25499\n\n4:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.65355\n\n5:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43704\n\n6:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.16139\n\n7:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.07494\n\n8:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.18302\n\n9:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.52312\n\n10:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.65168\n\n11:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.39178\n\n166:\n Type: RT_MENU\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 80\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68292\n\n7 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1428\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34702\n\n8 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1674\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2804\n\n9 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28849\n\n10 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1532\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28373\n\n11 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26322\n\n12:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25812\n\n313:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 344\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08572\n\nSCRIPT:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 309386\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99935\n\n99:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8695\n Detected Filetype: Icon file\n\n162:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n164:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.84274\n Detected Filetype: Icon file\n\n169:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 220\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77862\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1007\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.40026\n\n\nVersion Info:\n-------------\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x004C868C\nEndAddressOfRawData: 0x004C8694\nAddressOfIndex: 0x004D0740\nAddressOfCallbacks: 0x0049C8F8\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\n-------------------\nSize: 160\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004CC014\nSEHandlerTable: 0x00000000\nSEHandlerCount: 0\n\nRICH Header:\n------------\nXOR Key: 0xFDEDA6DE\nUnmarked objects: 0\n241 (40116): 35\n243 (40116): 157\n242 (40116): 35\n199 (41118): 1\nC++ objects (VS 2015/2017 runtime 26706): 45\nC objects (VS 2015/2017 runtime 26706): 18\nASM objects (VS 2015/2017 runtime 26706): 21\nC objects (VS2008 SP1 build 30729): 9\nImports (VS2008 SP1 build 30729): 37\nTotal imports: 553\nC++ objects (POGO O) (27045): 80\nASM objects (27045): 1\nResource objects (27045): 1\n151: 1\nLinker (27045): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Is an AutoIT compiled script:\n AutoIt Error\n reserved for AutoIt internal use\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses known Mersenne Twister constants\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryExW\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n FindWindowW\n Code injection capabilities:\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n VirtualAlloc\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegCreateKeyExW\n RegisterHotKey\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n CreateProcessWithLogonW\n ShellExecuteW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n AttachThreadInput\n MapVirtualKeyW\n GetForegroundWindow\n Has Internet access capabilities:\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n InternetQueryOptionW\n InternetConnectW\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n DuplicateTokenEx\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n GetVolumeInformationW\n Manipulates other processes:\n OpenProcess\n WriteProcessMemory\n ReadProcessMemory\n Process32FirstW\n Process32NextW\n Can take screenshots:\n CreateCompatibleDC\n FindWindowW\n GetDC\n Reads the contents of the clipboard:\n GetClipboardData\n Can shut the system down or lock the screen:\n InitiateSystemShutdownExW\n ExitWindowsEx\n\nThe PE's resources present abnormal characteristics.\n Resource SCRIPT is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"architecture":"IMAGE_FILE_MACHINE_I386","subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","compilation_date":"2025-11-28T09:36:05","detected_languages":["English - United Kingdom"]},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0090","e_cp":"0x0003","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x0000","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x0000","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x00000120"},"PE Header":{"Signature":"PE","Machine":"IMAGE_FILE_MACHINE_I386","NumberofSections":5,"TimeDateStamp":"2025-Nov-28 09:36:05","PointerToSymbolTable":"0x00000000","NumberOfSymbols":0,"SizeOfOptionalHeader":"0x00E0","Characteristics":["IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE_IMAGE","IMAGE_FILE_LARGE_ADDRESS_AWARE"]},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"14.0","SizeOfCode":"0x0009AC00","SizeOfInitializedData":"0x00090000","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x000204F7","EntryPointSection":".text","BaseOfCode":"0x00001000","BaseOfData":"0x0009C000","ImageBase":"0x00400000","SectionAlignment":"0x00001000","FileAlignment":"0x00000200","OperatingSystemVersion":"5.1","ImageVersion":"0.0","SubsystemVersion":"5.1","Win32VersionValue":"0","SizeOfImage":"0x00131000","SizeOfHeaders":"0x00000400","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":["IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"SizeofStackReserve":"0x00400000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00400000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"16"},"Sections":{"sections":[{"name":".text","virtual_size":"0x0009AA37","virtual_address":"0x00001000","size_of_raw_data":"0x0009AC00","pointer_to_raw_data":"0x00000400","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"entropy":6.66568},{"name":".rdata","virtual_size":"0x0002FB92","virtual_address":"0x0009C000","size_of_raw_data":"0x0002FC00","pointer_to_raw_data":"0x0009B000","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"entropy":5.61024},{"name":".data","virtual_size":"0x0000705C","virtual_address":"0x000CC000","size_of_raw_data":"0x00004800","pointer_to_raw_data":"0x000CAC00","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"],"entropy":0.584577},{"name":".rsrc","virtual_size":"0x000545C4","virtual_address":"0x000D4000","size_of_raw_data":"0x00054600","pointer_to_raw_data":"0x000CF400","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"entropy":7.8804},{"name":".reloc","virtual_size":"0x000075CC","virtual_address":"0x00129000","size_of_raw_data":"0x00007600","pointer_to_raw_data":"0x00123A00","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"entropy":6.7982}]},"Imports":{"entities":{"dlls":["KERNEL32.DLL","ADVAPI32.dll","COMCTL32.dll","COMDLG32.dll","GDI32.dll","IPHLPAPI.DLL","MPR.dll","ole32.dll","OLEAUT32.dll","PSAPI.DLL","SHELL32.dll","USER32.dll","USERENV.dll","UxTheme.dll","VERSION.dll","WININET.dll","WINMM.dll","WSOCK32.dll"],"resources":[{"id":1,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":296,"entropy":3.66371},{"id":2,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":296,"entropy":2.05883},{"id":3,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":296,"entropy":2.25499},{"id":4,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":744,"entropy":3.65355},{"id":5,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":296,"entropy":3.43704},{"id":6,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":3752,"entropy":4.16139},{"id":7,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":2216,"entropy":4.07494},{"id":8,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1384,"entropy":2.18302},{"id":9,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":9640,"entropy":4.52312},{"id":10,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":4264,"entropy":4.65168},{"id":11,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1128,"entropy":4.39178},{"id":166,"type":"RT_MENU","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":80,"entropy":2.68292},{"id":"7 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1428,"entropy":3.34702},{"id":"8 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1674,"entropy":3.2804},{"id":"9 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1168,"entropy":3.28849},{"id":"10 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1532,"entropy":3.28373},{"id":"11 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1628,"entropy":3.26322},{"id":12,"type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1126,"entropy":3.25812},{"id":313,"type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":344,"entropy":3.08572},{"id":"SCRIPT","type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":309386,"entropy":7.99935},{"id":99,"type":"RT_GROUP_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":118,"entropy":2.8695,"detected_filetype":"Icon file"},{"id":162,"type":"RT_GROUP_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":20,"entropy":2.02322,"detected_filetype":"Icon file"},{"id":164,"type":"RT_GROUP_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":20,"entropy":1.84274,"detected_filetype":"Icon file"},{"id":169,"type":"RT_GROUP_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":20,"entropy":2.02322,"detected_filetype":"Icon file"},{"id":"1 (#2)","type":"RT_VERSION","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":220,"entropy":2.77862},{"id":"1 (#3)","type":"RT_MANIFEST","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1007,"entropy":5.40026}],"version_info":{"resource_langid":"English - United Kingdom","signature":"0xFEEF04BD","struct_version":"0x00010000","file_version":"0.0.0.0","product_version":"0.0.0.0","file_flags":"(EMPTY)","file_os":["VOS_DOS_WINDOWS32","VOS_NT_WINDOWS32","VOS__WINDOWS32"],"file_type":"VFT_APP","language":"English - United Kingdom"},"tls_callbacks":{"start_address_of_raw_data":"0x004C868C","end_address_of_raw_data":"0x004C8694","address_of_index":"0x004D0740","address_of_callbacks":"0x0049C8F8","size_of_zero_fill":"0x00000000","characteristics":"IMAGE_SCN_ALIGN_4BYTES","callbacks":"(EMPTY)"},"load_configuration":{"size":160,"time_date_stamp":"1970-Jan-01 00:00:00","version":"0.0","global_flags_clear":"(EMPTY)","global_flags_set":"(EMPTY)","critical_section_default_timeout":0,"de_commit_free_block_threshold":"0x00000000","de_commit_total_free_threshold":"0x00000000","lock_prefix_table":"0x00000000","maximum_allocation_size":"0x00000000","virtual_memory_threshold":"0x00000000","process_affinity_mask":"0x00000000","process_heap_flags":"(EMPTY)","csd_version":0,"reserved1":"0x0000","edit_list":"0x00000000","security_cookie":"0x004CC014","se_handler_table":"0x00000000","se_handler_count":0},"rich_header":{"xor_key":"0xFDEDA6DE","unmarked_objects":0,"objects":{"151":1,"241 (40116)":35,"243 (40116)":157,"242 (40116)":35,"199 (41118)":1,"C++ objects (VS 2015/2017 runtime 26706)":45,"C objects (VS 2015/2017 runtime 26706)":18,"ASM objects (VS 2015/2017 runtime 26706)":21,"C objects (VS2008 SP1 build 30729)":9,"Imports (VS2008 SP1 build 30729)":37,"Total imports":553,"C++ objects (POGO O) (27045)":80,"ASM objects (27045)":1,"Resource objects (27045)":1,"Linker (27045)":1},"matching_compilers":["Microsoft Visual C++ 6.0 - 8.0"]},"strings":["AutoIt Error","reserved for AutoIt internal use"],"cryptographic_algorithms":["Uses constants related to CRC32","Uses known Mersenne Twister constants"],"malicious_indicators":["LoadLibraryA","GetProcAddress","LoadLibraryExW","LoadLibraryW","CreateToolhelp32Snapshot","FindWindowW","OpenProcess","VirtualAllocEx","WriteProcessMemory","VirtualAlloc","RegEnumValueW","RegDeleteValueW","RegDeleteKeyW","RegEnumKeyExW","RegSetValueExW","RegOpenKeyExW","RegCloseKey","RegQueryValueExW","RegCreateKeyExW","RegisterHotKey","CreateProcessW","CreateProcessAsUserW","CreateProcessWithLogonW","ShellExecuteW","CreateFileW","GetTempPathW","GetAsyncKeyState","AttachThreadInput","MapVirtualKeyW","GetForegroundWindow","InternetCloseHandle","InternetOpenW","InternetSetOptionW","InternetCrackUrlW","InternetQueryOptionW","InternetConnectW","InternetOpenUrlW","InternetReadFile","InternetQueryDataAvailable","AdjustTokenPrivileges","OpenProcessToken","DuplicateTokenEx","CheckTokenMembership","GetDriveTypeW","GetVolumeInformationW","ReadProcessMemory","Process32FirstW","Process32NextW","CreateCompatibleDC","GetDC","GetClipboardData","InitiateSystemShutdownExW","ExitWindowsEx"],"exploit_mitigation_techniques":{"stack_canary":"enabled","safe_seh":"enabled (0 registered handlers)","aslr":"enabled","dep":"disabled","cfg":"disabled"}}},"Exports":{},"Resources":{"entities":[{"id":1,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":296,"timestamp":"1980-Jan-01 00:00:00","entropy":3.66371},{"id":2,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":296,"timestamp":"1980-Jan-01 00:00:00","entropy":2.05883},{"id":3,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":296,"timestamp":"1980-Jan-01 00:00:00","entropy":2.25499},{"id":4,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":744,"timestamp":"1980-Jan-01 00:00:00","entropy":3.65355},{"id":5,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":296,"timestamp":"1980-Jan-01 00:00:00","entropy":3.43704},{"id":6,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":3752,"timestamp":"1980-Jan-01 00:00:00","entropy":4.16139},{"id":7,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":2216,"timestamp":"1980-Jan-01 00:00:00","entropy":4.07494},{"id":8,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1384,"timestamp":"1980-Jan-01 00:00:00","entropy":2.18302},{"id":9,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":9640,"timestamp":"1980-Jan-01 00:00:00","entropy":4.52312},{"id":10,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":4264,"timestamp":"1980-Jan-01 00:00:00","entropy":4.65168},{"id":11,"type":"RT_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1128,"timestamp":"1980-Jan-01 00:00:00","entropy":4.39178},{"id":166,"type":"RT_MENU","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":80,"timestamp":"1980-Jan-01 00:00:00","entropy":2.68292},{"id":"7 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1428,"timestamp":"1980-Jan-01 00:00:00","entropy":3.34702},{"id":"8 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1674,"timestamp":"1980-Jan-01 00:00:00","entropy":3.2804},{"id":"9 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1168,"timestamp":"1980-Jan-01 00:00:00","entropy":3.28849},{"id":"10 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1532,"timestamp":"1980-Jan-01 00:00:00","entropy":3.28373},{"id":"11 (#2)","type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1628,"timestamp":"1980-Jan-01 00:00:00","entropy":3.26322},{"id":12,"type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1126,"timestamp":"1980-Jan-01 00:00:00","entropy":3.25812},{"id":313,"type":"RT_STRING","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":344,"timestamp":"1980-Jan-01 00:00:00","entropy":3.08572},{"id":"SCRIPT","type":"RT_RCDATA","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":309386,"timestamp":"1980-Jan-01 00:00:00","entropy":7.99935},{"id":99,"type":"RT_GROUP_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":118,"timestamp":"1980-Jan-01 00:00:00","entropy":2.8695,"detected_filetype":"Icon file"},{"id":162,"type":"RT_GROUP_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":20,"timestamp":"1980-Jan-01 00:00:00","entropy":2.02322,"detected_filetype":"Icon file"},{"id":164,"type":"RT_GROUP_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":20,"timestamp":"1980-Jan-01 00:00:00","entropy":1.84274,"detected_filetype":"Icon file"},{"id":169,"type":"RT_GROUP_ICON","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":20,"timestamp":"1980-Jan-01 00:00:00","entropy":2.02322,"detected_filetype":"Icon file"},{"id":"1 (#2)","type":"RT_VERSION","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":220,"timestamp":"1980-Jan-01 00:00:00","entropy":2.77862},{"id":"1 (#3)","type":"RT_MANIFEST","language":"English - United Kingdom","codepage":"Latin 1 / Western European","size":1007,"timestamp":"1980-Jan-01 00:00:00","entropy":5.40026}]},"Debug Info":{},"Load Configuration":{"Size":160,"TimeDateStamp":"1970-Jan-01 00:00:00","Version":"0.0","GlobalFlagsClear":"","GlobalFlagsSet":"","CriticalSectionDefaultTimeout":0,"DeCommitFreeBlockThreshold":0,"DeCommitTotalFreeThreshold":0,"LockPrefixTable":0,"MaximumAllocationSize":0,"VirtualMemoryThreshold":0,"ProcessAffinityMask":0,"ProcessHeapFlags":"","CSDVersion":0,"Reserved1":0,"EditList":0,"SecurityCookie":5038100,"SEHandlerTable":0,"SEHandlerCount":0},"RICH Header":{"xor_key":"0xFDEDA6DE","unmarked_objects":0,"object_counts":{"151":1,"241_40116":35,"243_40116":157,"242_40116":35,"199_41118":1,"cpp_objects_vs_2015_2017_runtime_26706":45,"c_objects_vs_2015_2017_runtime_26706":18,"asm_objects_vs_2015_2017_runtime_26706":21,"c_objects_vs2008_sp1_build_30729":9,"imports_vs2008_sp1_build_30729":37,"total_imports":553,"cpp_objects_pogo_o_27045":80,"asm_objects_27045":1,"resource_objects_27045":1,"linker_27045":1},"matching_compilers":["Microsoft Visual C++ 6.0 - 8.0"],"suspicious_strings":{"autoit_compiled_script":["AutoIt Error","reserved for AutoIt internal use"]},"cryptographic_algorithms":["Uses constants related to CRC32","Uses known Mersenne Twister constants"],"malicious_indicators":{"hidden_imports":["LoadLibraryA","GetProcAddress","LoadLibraryExW","LoadLibraryW"],"anti_debugging_functions":["CreateToolhelp32Snapshot","FindWindowW"],"code_injection_capabilities":["OpenProcess","VirtualAllocEx","WriteProcessMemory","VirtualAlloc"],"powerloader_code_injection":["FindWindowW","GetWindowLongW"],"registry_access_functions":["RegEnumValueW","RegDeleteValueW","RegDeleteKeyW","RegEnumKeyExW","RegSetValueExW","RegOpenKeyExW","RegCloseKey","RegQueryValueExW","RegCreateKeyExW","RegisterHotKey"],"program_launching_functions":["CreateProcessW","CreateProcessAsUserW","CreateProcessWithLogonW","ShellExecuteW"],"temporary_file_creation":["CreateFileW","GetTempPathW"],"keylogger_functions":["GetAsyncKeyState","AttachThreadInput","MapVirtualKeyW","GetForegroundWindow"],"internet_access_capabilities":["InternetCloseHandle","InternetOpenW","InternetSetOptionW","InternetCrackUrlW","InternetQueryOptionW","InternetConnectW","InternetOpenUrlW","InternetReadFile","InternetQueryDataAvailable"],"privilege_level_functions":["AdjustTokenPrivileges","OpenProcessToken","DuplicateTokenEx","CheckTokenMembership"],"disk_drive_enumeration":["GetDriveTypeW","GetVolumeInformationW"],"process_manipulation":["OpenProcess","WriteProcessMemory","ReadProcessMemory","Process32FirstW","Process32NextW"],"screenshot_capabilities":["CreateCompatibleDC","FindWindowW","GetDC"],"clipboard_reading":["GetClipboardData"],"system_shutdown_lock":["InitiateSystemShutdownExW","ExitWindowsEx"]},"abnormal_resource_characteristics":["Resource SCRIPT is possibly compressed or encrypted"],"exploit_mitigation_techniques":{"stack_canary":"enabled","safe_seh":"enabled (0 registered handlers)","aslr":"enabled","dep":"disabled","cfg":"disabled"}},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_12ohn_ul/2aa5ce3561dc657a157460383c7c9b8db54ac8a6969627009c8d1062316a6130_2aa5ce3561dc/001_upx_unpacked.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_j57fwxw4/output.txt"},"timestamp":"2026-05-15 14:33:42"} {"_id":{"$oid":"69edf0bc59a6632dae07de45"},"sha256":"02aa8cabeea2a0120a31adbf0886f821d10953fc6d4d9cd1959568093c48b04d","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/secondary_sample_try\nDate: 2026-04-29 18:18:53\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/secondary_sample_try\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2023-Oct-16 21:40:53\nComments: \nCompanyName: Google LLC\nFileDescription: Note-taking and task management application\nFileVersion: 5.9.1.204\nInternalName: GoogleKeep.exe\nLegalCopyright: © Google LLC\nLegalTrademarks: Google, Keep\nOriginalFilename: GoogleKeep.exe\nProductName: Google Keep\nProductVersion: 5.9.1.204\nAssembly Version: 5.9.1.204\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2023-Oct-16 21:40:53\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x0000A800\nSizeOfInitializedData: 0x00001A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000C72E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x0000E000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00012000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000A734\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x0000A800\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.50576\n\n.rsrc:\n VirtualSize: 0x00001708\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00001800\n PointerToRawData: 0x0000AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.55153\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000C200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0815394\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 3476\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.05814\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.15402\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 924\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39908\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1171\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.22615\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 5.9.1.204\n ProductVersion: 5.9.1.204\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: Google LLC\n FileDescription: Note-taking and task management application\n FileVersion (#2): 5.9.1.204\n InternalName: GoogleKeep.exe\n LegalCopyright: © Google LLC\n LegalTrademarks: Google, Keep\n OriginalFilename: GoogleKeep.exe\n ProductName: Google Keep\n ProductVersion (#2): 5.9.1.204\n Assembly Version: 5.9.1.204\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n schtask\n Looks for VMWare presence:\n vmware\n Looks for Sandboxie presence:\n SbieDll.dll\n Accesses the WMI:\n root\\Security\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ MALICIOUS ] The program tries to mislead users about its origins.\n The PE pretends to be from Google but is not signed!\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"architecture":"IMAGE_FILE_MACHINE_I386","subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","compilation_date":"2023-Oct-16 21:40:53","company_name":"Google LLC","file_description":"Note-taking and task management application","file_version":"5.9.1.204","internal_name":"GoogleKeep.exe","legal_copyright":"© Google LLC","legal_trademarks":"Google, Keep","original_filename":"GoogleKeep.exe","product_name":"Google Keep","product_version":"5.9.1.204","assembly_version":"5.9.1.204"},"DOS Header":{"e_magic":"MZ","e_cblp":144,"e_cp":3,"e_crlc":0,"e_cparhdr":4,"e_minalloc":0,"e_maxalloc":65535,"e_ss":0,"e_sp":184,"e_csum":0,"e_ip":0,"e_cs":0,"e_ovno":0,"e_oemid":0,"e_oeminfo":0,"e_lfanew":128},"PE Header":{"Signature":"PE","Machine":"IMAGE_FILE_MACHINE_I386","NumberofSections":3,"TimeDateStamp":"2023-Oct-16 21:40:53","PointerToSymbolTable":"0x00000000","NumberOfSymbols":0,"SizeOfOptionalHeader":"0x00E0","Characteristics":["IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE_IMAGE"]},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"8.0","SizeOfCode":"0x0000A800","SizeOfInitializedData":"0x00001A00","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x0000C72E","BaseOfCode":"0x00002000","BaseOfData":"0x0000E000","ImageBase":"0x00400000","SectionAlignment":"0x00002000","FileAlignment":"0x00000200","OperatingSystemVersion":"4.0","ImageVersion":"0.0","SubsystemVersion":"4.0","Win32VersionValue":"0","SizeOfImage":"0x00012000","SizeOfHeaders":"0x00000200","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":["IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NO_SEH","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"16"},"Sections":{"sections":[{"name":".text","virtual_size":"0x0000A734","virtual_address":"0x00002000","size_of_raw_data":"0x0000A800","pointer_to_raw_data":"0x00000200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"entropy":5.50576},{"name":".rsrc","virtual_size":"0x00001708","virtual_address":"0x0000E000","size_of_raw_data":"0x00001800","pointer_to_raw_data":"0x0000AA00","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"entropy":6.55153},{"name":".reloc","virtual_size":"0x0000000C","virtual_address":"0x00010000","size_of_raw_data":"0x00000200","pointer_to_raw_data":"0x0000C200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"entropy":0.0815394}]},"Imports":{"entities":{"file":{"name":"GoogleKeep.exe","version":"5.9.1.204","description":"Note-taking and task management application","company":"Google LLC","copyright":"© Google LLC","trademarks":"Google, Keep","internal_name":"GoogleKeep.exe","original_filename":"GoogleKeep.exe","product_name":"Google Keep","assembly_version":"5.9.1.204"},"resources":[{"type":"RT_ICON","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":3476,"timestamp":"1980-Jan-01 00:00:00","entropy":7.05814,"filetype":"PNG graphic file"},{"type":"RT_GROUP_ICON","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":20,"timestamp":"1980-Jan-01 00:00:00","entropy":1.15402,"filetype":"Icon file"},{"type":"RT_VERSION","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":924,"timestamp":"1980-Jan-01 00:00:00","entropy":3.39908},{"type":"RT_MANIFEST","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":1171,"timestamp":"1980-Jan-01 00:00:00","entropy":5.22615}],"compiler":["Microsoft Visual C# v7.0 / Basic .NET",".NET executable -> Microsoft"],"suspicious_strings":["schtask","vmware","SbieDll.dll","root\\Security"],"mitigations":{"stack_canary":false,"safe_seh":false,"aslr":true,"dep":true,"cfg":false},"malicious_indicators":["The PE pretends to be from Google but is not signed!"]}},"Exports":{},"Resources":{"entities":[{"type":"RT_ICON","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":3476,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":7.05814,"detected_filetype":"PNG graphic file"},{"type":"RT_GROUP_ICON","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":20,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":1.15402,"detected_filetype":"Icon file"},{"type":"RT_VERSION","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":924,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":3.39908},{"type":"RT_MANIFEST","language":"UNKNOWN","codepage":"Latin 1 / Western European","size":1171,"time_date_stamp":"1980-Jan-01 00:00:00","entropy":5.22615}],"version_info":{"resource_lang_id":"UNKNOWN","signature":"0xFEEF04BD","struct_version":"0x00010000","file_version":"5.9.1.204","product_version":"5.9.1.204","file_flags":"(EMPTY)","file_os":["VOS_DOS_WINDOWS32","VOS_NT_WINDOWS32","VOS__WINDOWS32"],"file_type":"VFT_APP","language":"UNKNOWN","comments":"","company_name":"Google LLC","file_description":"Note-taking and task management application","internal_name":"GoogleKeep.exe","legal_copyright":"© Google LLC","legal_trademarks":"Google, Keep","original_filename":"GoogleKeep.exe","product_name":"Google Keep","assembly_version":"5.9.1.204"},"compiler_info":["Microsoft Visual C# v7.0 / Basic .NET",".NET executable -> Microsoft"],"suspicious_strings":["schtask","vmware","SbieDll.dll","root\\Security"],"exploit_mitigation":{"stack_canary":false,"safe_seh":false,"aslr":true,"dep":true,"cfg":false},"malicious_indicators":["The PE pretends to be from Google but is not signed!"]},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/secondary_sample_try"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_wf9fp3on/output.txt"},"timestamp":"2026-04-29 18:19:08"} {"_id":{"$oid":"69edf1ce59a6632dae07de55"},"sha256":"6ba13af0263cd61f957f2ce738120c8a419e1eb157e489bc79f1d57ad8277324","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/3\nDate: 2026-04-27 00:20:32\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/3\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2016-Aug-20 04:34:21\nDetected languages: English - United States\nDebug artifacts: wextract.pdb\nCompanyName: Microsoft Corporation\nFileDescription: Win32 Cabinet Self-Extractor \nFileVersion: 11.00.22688.1 (WinBuild.160101.0800)\nInternalName: Wextract \nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: WEXTRACT.EXE .MUI\nProductName: Internet Explorer\nProductVersion: 11.00.22688.1\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2016-Aug-20 04:34:21\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00007C00\nSizeOfInitializedData: 0x0026D800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000008200 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: A.0\nImageVersion: A.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0027B000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0027F3E6\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000080000\nSizeofStackCommit: 0x0000000000002000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00007B80\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.09647\n\n.rdata:\n VirtualSize: 0x000022C8\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00002400\n PointerToRawData: 0x00008000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.72784\n\n.data:\n VirtualSize: 0x00001F00\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x0000A400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.18898\n\n.pdata:\n VirtualSize: 0x00000408\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0000A800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.15637\n\n.rsrc:\n VirtualSize: 0x0026A616\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x0026A800\n PointerToRawData: 0x0000AE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.74936\n\n.reloc:\n VirtualSize: 0x00000020\n VirtualAddress: 0x0027A000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00275600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.406847\n\n\nImports:\n--------\nADVAPI32.dll: GetTokenInformation\n RegDeleteValueA\n RegOpenKeyExA\n RegQueryInfoKeyA\n FreeSid\n OpenProcessToken\n RegSetValueExA\n RegCreateKeyExA\n LookupPrivilegeValueA\n AllocateAndInitializeSid\n RegQueryValueExA\n EqualSid\n RegCloseKey\n AdjustTokenPrivileges\nKERNEL32.dll: _lopen\n _llseek\n CompareStringA\n GetLastError\n GetFileAttributesA\n GetSystemDirectoryA\n LoadLibraryA\n DeleteFileA\n GlobalAlloc\n GlobalFree\n CloseHandle\n WritePrivateProfileStringA\n IsDBCSLeadByte\n GetWindowsDirectoryA\n SetFileAttributesA\n GetProcAddress\n GlobalLock\n LocalFree\n RemoveDirectoryA\n FreeLibrary\n _lclose\n CreateDirectoryA\n GetPrivateProfileIntA\n GetPrivateProfileStringA\n GlobalUnlock\n ReadFile\n SizeofResource\n WriteFile\n GetDriveTypeA\n LoadLibraryExA\n SetFileTime\n SetFilePointer\n FindResourceA\n CreateMutexA\n GetVolumeInformationA\n WaitForSingleObject\n GetCurrentDirectoryA\n FreeResource\n GetVersion\n SetCurrentDirectoryA\n GetTempPathA\n LocalFileTimeToFileTime\n CreateFileA\n SetEvent\n TerminateThread\n GetVersionExA\n LockResource\n GetSystemInfo\n CreateThread\n ResetEvent\n LoadResource\n ExitProcess\n GetModuleHandleW\n CreateProcessA\n FormatMessageA\n GetTempFileNameA\n DosDateTimeToFileTime\n CreateEventA\n GetExitCodeProcess\n ExpandEnvironmentStringsA\n LocalAlloc\n lstrcmpA\n FindNextFileA\n GetCurrentProcess\n FindFirstFileA\n GetModuleFileNameA\n GetShortPathNameA\n Sleep\n GetStartupInfoW\n RtlCaptureContext\n RtlLookupFunctionEntry\n RtlVirtualUnwind\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n TerminateProcess\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n GetTickCount\n EnumResourceLanguagesA\n GetDiskFreeSpaceA\n MulDiv\n FindClose\nGDI32.dll: GetDeviceCaps\nUSER32.dll: ShowWindow\n MsgWaitForMultipleObjects\n SetWindowPos\n GetDC\n GetWindowRect\n DispatchMessageA\n GetSystemMetrics\n CallWindowProcA\n SetWindowTextA\n MessageBoxA\n SendDlgItemMessageA\n SendMessageA\n GetDlgItem\n DialogBoxIndirectParamA\n GetWindowLongPtrA\n SetWindowLongPtrA\n SetForegroundWindow\n ReleaseDC\n EnableWindow\n CharNextA\n LoadStringA\n CharPrevA\n EndDialog\n MessageBeep\n ExitWindowsEx\n SetDlgItemTextA\n CharUpperA\n GetDesktopWindow\n PeekMessageA\n GetDlgItemTextA\nmsvcrt.dll: ?terminate@@YAXXZ\n _commode\n _fmode\n _acmdln\n __C_specific_handler\n memset\n __setusermatherr\n _ismbblead\n _cexit\n _exit\n exit\n __set_app_type\n __getmainargs\n _amsg_exit\n _XcptFilter\n memcpy_s\n _vsnprintf\n _initterm\n memcpy\nCOMCTL32.dll: #17\nCabinet.dll: #20\n #21\n #23\n #22\nVERSION.dll: VerQueryValueA\n GetFileVersionInfoSizeA\n GetFileVersionInfoA\n\nResources:\n----------\n3001:\n Type: AVI\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 11802\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.52241\n Detected Filetype: AVI Resource Interchange File Format\n Detected Filetype (#2): Windows animated cursor\n\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 278568\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.16766\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 278568\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.16766\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 17448\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.135\n\n2001:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 754\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.25575\n\n2002:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 432\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.16025\n\n2003:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 358\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.99713\n\n2004:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 448\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.11992\n\n2005:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 304\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.97326\n\n2006:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 288\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.97672\n\n63:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 140\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.48958\n\n76:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1312\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.2674\n\n77:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1484\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.29977\n\n80:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1200\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.27174\n\n83:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1098\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.2912\n\n85:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 974\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.13591\n\nADMQCMD:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 7\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.80735\n\nCABINET:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1932347\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 7.99986\n Detected Filetype: CAB Installer file\n\nEXTRACTOPT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 0.811278\n\nFILESIZES:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 36\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.6383\n\nFINISHMSG:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 7\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.80735\n\nLICENSE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 7\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.80735\n\nPACKINSTSPACE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 0\n\nPOSTRUNPROGRAM:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 45\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 4.37171\n\nREBOOT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 0\n\nRUNPROGRAM:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 24\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.26789\n\nSHOWWINDOW:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 0.811278\n\nTITLE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 10\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.84644\n\nUPROMPT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 7\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.80735\n\nUSRQCMD:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 7\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.80735\n\n3000:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 2.22035\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1032\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 3.38987\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2022\n TimeDateStamp: 2059-Dec-25 05:41:58\n Entropy: 5.00142\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 11.0.22688.1\n ProductVersion: 11.0.22688.1\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Win32 Cabinet Self-Extractor \n FileVersion (#2): 11.00.22688.1 (WinBuild.160101.0800)\n InternalName: Wextract \n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: WEXTRACT.EXE .MUI\n ProductName: Internet Explorer\n ProductVersion (#2): 11.00.22688.1\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2062-Jul-25 12:18:00\n Version: 0.0\n SizeofData: 37\n AddressOfRawData: 0x00009A64\n PointerToRawData: 0x00008A64\n Referenced File: wextract.pdb\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2062-Jul-25 12:18:00\n Version: 0.0\n SizeofData: 496\n AddressOfRawData: 0x00009A8C\n PointerToRawData: 0x00008A8C\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 2062-Jul-25 12:18:00\n Version: 0.0\n SizeofData: 36\n AddressOfRawData: 0x00009C7C\n PointerToRawData: 0x00008C7C\n\n\nLoad Configuration:\n-------------------\nSize: 280\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x000000014000C008\nGuardCFCheckFunctionPointer: 0x0000000140009648\nGuardCFDispatchFunctionPointer: 0x0000000000000000\nGuardCFFunctionTable: 0x0000000000000000\nGuardCFFunctionCount: 0x0000000000000000\nGuardFlags: (EMPTY)\nCodeIntegrity.Flags: 0x0000\nCodeIntegrity.Catalog: 0x0000\nCodeIntegrity.CatalogOffset: 0x00000000\nCodeIntegrity.Reserved: 0x00000000\nGuardAddressTakenIatEntryTable: 0x0000000000000000\nGuardAddressTakenIatEntryCount: 0\nGuardLongJumpTargetTable: 0x0000000000000000\nGuardLongJumpTargetCount: 0\n\nRICH Header:\n------------\nXOR Key: 0x3690B900\nUnmarked objects: 0\nC++ objects (27412): 1\nASM objects (27412): 2\nC objects (27412): 18\nImports (27412): 17\nTotal imports: 160\nC objects (LTCG) (27412): 10\nResource objects (27412): 1\nLinker (27412): 1\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n rundll32.exe\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n Command.com\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryExA\n Can access the registry:\n RegDeleteValueA\n RegOpenKeyExA\n RegQueryInfoKeyA\n RegSetValueExA\n RegCreateKeyExA\n RegQueryValueExA\n RegCloseKey\n Possibly launches other programs:\n CreateProcessA\n Can create temporary files:\n GetTempPathA\n CreateFileA\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n Enumerates local disk drives:\n GetDriveTypeA\n GetVolumeInformationA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\n[ MALICIOUS ] The PE header may have been manually modified.\n Resource CABINET detected as a CAB Installer file.\n The resource timestamps differ from the PE header:\n 2059-Dec-25 05:41:58\n Resources amount for 98.1524% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: enabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"architecture":"IMAGE_FILE_MACHINE_AMD64","subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","compilation_date":"2016-Aug-20 04:34:21","detected_languages":["English - United States"],"debug_artifacts":["wextract.pdb"],"company_name":"Microsoft Corporation","file_description":"Win32 Cabinet Self-Extractor","file_version":"11.00.22688.1 (WinBuild.160101.0800)","internal_name":"Wextract","legal_copyright":"© Microsoft Corporation. All rights reserved.","original_filename":"WEXTRACT.EXE.MUI","product_name":"Internet Explorer","product_version":"11.00.22688.1"},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0090","e_cp":"0x0003","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x0000","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x0000","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x000000E8"},"PE Header":{"Signature":"PE","Machine":"IMAGE_FILE_MACHINE_AMD64","NumberofSections":6,"TimeDateStamp":"2016-Aug-20 04:34:21","PointerToSymbolTable":"0x00000000","NumberOfSymbols":0,"SizeOfOptionalHeader":"0x00F0","Characteristics":["IMAGE_FILE_EXECUTABLE_IMAGE","IMAGE_FILE_LARGE_ADDRESS_AWARE"]},"Image Optional Header":{"Magic":"PE32+","LinkerVersion":"14.0","SizeOfCode":"0x00007C00","SizeOfInitializedData":"0x0026D800","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x0000000000008200","BaseOfCode":"0x00001000","ImageBase":"0x0000000140000000","SectionAlignment":"0x00001000","FileAlignment":"0x00000200","OperatingSystemVersion":"A.0","ImageVersion":"A.0","SubsystemVersion":"6.0","Win32VersionValue":"0","SizeOfImage":"0x0027B000","SizeOfHeaders":"0x00000400","Checksum":"0x0027F3E6","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":["IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_GUARD_CF","IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"SizeofStackReserve":"0x0000000000080000","SizeofStackCommit":"0x0000000000002000","SizeofHeapReserve":"0x0000000000100000","SizeofHeapCommit":"0x0000000000001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"16"},"Sections":{"sections":[{"name":".text","VirtualSize":"0x00007B80","VirtualAddress":"0x00001000","SizeOfRawData":"0x00007C00","PointerToRawData":"0x00000400","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"Entropy":6.09647},{"name":".rdata","VirtualSize":"0x000022C8","VirtualAddress":"0x00009000","SizeOfRawData":"0x00002400","PointerToRawData":"0x00008000","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":4.72784},{"name":".data","VirtualSize":"0x00001F00","VirtualAddress":"0x0000C000","SizeOfRawData":"0x00000400","PointerToRawData":"0x0000A400","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"],"Entropy":3.18898},{"name":".pdata","VirtualSize":"0x00000408","VirtualAddress":"0x0000E000","SizeOfRawData":"0x00000600","PointerToRawData":"0x0000A800","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":3.15637},{"name":".rsrc","VirtualSize":"0x0026A616","VirtualAddress":"0x0000F000","SizeOfRawData":"0x0026A800","PointerToRawData":"0x0000AE00","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":7.74936},{"name":".reloc","VirtualSize":"0x00000020","VirtualAddress":"0x0027A000","SizeOfRawData":"0x00000200","PointerToRawData":"0x00275600","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"Entropy":0.406847}]},"Imports":{"entities":{"dlls":["ADVAPI32.dll","KERNEL32.dll","GDI32.dll","USER32.dll","msvcrt.dll","COMCTL32.dll","Cabinet.dll","VERSION.dll"],"functions":{"ADVAPI32.dll":["GetTokenInformation","RegDeleteValueA","RegOpenKeyExA","RegQueryInfoKeyA","FreeSid","OpenProcessToken","RegSetValueExA","RegCreateKeyExA","LookupPrivilegeValueA","AllocateAndInitializeSid","RegQueryValueExA","EqualSid","RegCloseKey","AdjustTokenPrivileges"],"KERNEL32.dll":["_lopen","_llseek","CompareStringA","GetLastError","GetFileAttributesA","GetSystemDirectoryA","LoadLibraryA","DeleteFileA","GlobalAlloc","GlobalFree","CloseHandle","WritePrivateProfileStringA","IsDBCSLeadByte","GetWindowsDirectoryA","SetFileAttributesA","GetProcAddress","GlobalLock","LocalFree","RemoveDirectoryA","FreeLibrary","_lclose","CreateDirectoryA","GetPrivateProfileIntA","GetPrivateProfileStringA","GlobalUnlock","ReadFile","SizeofResource","WriteFile","GetDriveTypeA","LoadLibraryExA","SetFileTime","SetFilePointer","FindResourceA","CreateMutexA","GetVolumeInformationA","WaitForSingleObject","GetCurrentDirectoryA","FreeResource","GetVersion","SetCurrentDirectoryA","GetTempPathA","LocalFileTimeToFileTime","CreateFileA","SetEvent","TerminateThread","GetVersionExA","LockResource","GetSystemInfo","CreateThread","ResetEvent","LoadResource","ExitProcess","GetModuleHandleW","CreateProcessA","FormatMessageA","GetTempFileNameA","DosDateTimeToFileTime","CreateEventA","GetExitCodeProcess","ExpandEnvironmentStringsA","LocalAlloc","lstrcmpA","FindNextFileA","GetCurrentProcess","FindFirstFileA","GetModuleFileNameA","GetShortPathNameA","Sleep","GetStartupInfoW","RtlCaptureContext","RtlLookupFunctionEntry","RtlVirtualUnwind","UnhandledExceptionFilter","SetUnhandledExceptionFilter","TerminateProcess","QueryPerformanceCounter","GetCurrentProcessId","GetCurrentThreadId","GetSystemTimeAsFileTime","GetTickCount","EnumResourceLanguagesA","GetDiskFreeSpaceA","MulDiv","FindClose"],"GDI32.dll":["GetDeviceCaps"],"USER32.dll":["ShowWindow","MsgWaitForMultipleObjects","SetWindowPos","GetDC","GetWindowRect","DispatchMessageA","GetSystemMetrics","CallWindowProcA","SetWindowTextA","MessageBoxA","SendDlgItemMessageA","SendMessageA","GetDlgItem","DialogBoxIndirectParamA","GetWindowLongPtrA","SetWindowLongPtrA","SetForegroundWindow","ReleaseDC","EnableWindow","CharNextA","LoadStringA","CharPrevA","EndDialog","MessageBeep","ExitWindowsEx","SetDlgItemTextA","CharUpperA","GetDesktopWindow","PeekMessageA","GetDlgItemTextA"],"msvcrt.dll":["?terminate@@YAXXZ","_commode","_fmode","_acmdln","__C_specific_handler","memset","__setusermatherr","_ismbblead","_cexit","_exit","exit","__set_app_type","__getmainargs","_amsg_exit","_XcptFilter","memcpy_s","_vsnprintf","_initterm","memcpy"],"COMCTL32.dll":["#17"],"Cabinet.dll":["#20","#21","#23","#22"],"VERSION.dll":["VerQueryValueA","GetFileVersionInfoSizeA","GetFileVersionInfoA"]},"resources":[{"id":"3001","type":"AVI","language":"English - United States","codepage":"Latin 1 / Western European","size":11802,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.52241,"detected_filetype":"AVI Resource Interchange File Format","detected_filetype_2":"Windows animated cursor"},{"id":"1","type":"RT_ICON","language":"English - United States","codepage":"UNKNOWN","size":278568,"timedatestamp":"1980-Jan-01 00:00:00","entropy":6.16766},{"id":"2","type":"RT_ICON","language":"English - United States","codepage":"UNKNOWN","size":278568,"timedatestamp":"1980-Jan-01 00:00:00","entropy":6.16766},{"id":"3","type":"RT_ICON","language":"English - United States","codepage":"UNKNOWN","size":17448,"timedatestamp":"1980-Jan-01 00:00:00","entropy":6.135},{"id":"2001","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":754,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.25575},{"id":"2002","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":432,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.16025},{"id":"2003","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":358,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.99713},{"id":"2004","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":448,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.11992},{"id":"2005","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":304,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.97326},{"id":"2006","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":288,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.97672},{"id":"63","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":140,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.48958},{"id":"76","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":1312,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.2674},{"id":"77","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":1484,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.29977},{"id":"80","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":1200,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.27174},{"id":"83","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":1098,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.2912},{"id":"85","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":974,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.13591},{"id":"ADMQCMD","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.80735},{"id":"CABINET","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":1932347,"timedatestamp":"2059-Dec-25 05:41:58","entropy":7.99986,"detected_filetype":"CAB Installer file"},{"id":"EXTRACTOPT","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":4,"timedatestamp":"2059-Dec-25 05:41:58","entropy":0.811278},{"id":"FILESIZES","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":36,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.6383},{"id":"FINISHMSG","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.80735},{"id":"LICENSE","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.80735},{"id":"PACKINSTSPACE","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":4,"timedatestamp":"2059-Dec-25 05:41:58","entropy":0},{"id":"POSTRUNPROGRAM","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":45,"timedatestamp":"2059-Dec-25 05:41:58","entropy":4.37171},{"id":"REBOOT","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":4,"timedatestamp":"2059-Dec-25 05:41:58","entropy":0},{"id":"RUNPROGRAM","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":24,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.26789},{"id":"SHOWWINDOW","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":4,"timedatestamp":"2059-Dec-25 05:41:58","entropy":0.811278},{"id":"TITLE","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":10,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.84644},{"id":"UPROMPT","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.80735},{"id":"USRQCMD","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.80735},{"id":"3000","type":"RT_GROUP_ICON","language":"English - United States","codepage":"Latin 1 / Western European","size":48,"timedatestamp":"2059-Dec-25 05:41:58","entropy":2.22035,"detected_filetype":"Icon file"},{"id":"1 (#2)","type":"RT_VERSION","language":"English - United States","codepage":"Latin 1 / Western European","size":1032,"timedatestamp":"2059-Dec-25 05:41:58","entropy":3.38987},{"id":"1 (#3)","type":"RT_MANIFEST","language":"English - United States","codepage":"Latin 1 / Western European","size":2022,"timedatestamp":"2059-Dec-25 05:41:58","entropy":5.00142}],"version_info":{"resource_langid":"English - United States","vs_version_info":{"signature":"0xFEEF04BD","structversion":"0x00010000","fileversion":"11.0.22688.1","productversion":"11.0.22688.1","fileflags":"(EMPTY)","fileos":["VOS_DOS_WINDOWS32","VOS_NT","VOS_NT_WINDOWS32","VOS_WINCE","VOS__WINDOWS32"],"filetype":"VFT_APP","language":"English - United States","companyname":"Microsoft Corporation","filedescription":"Win32 Cabinet Self-Extractor","fileversion_2":"11.00.22688.1 (WinBuild.160101.0800)","internalname":"Wextract","legalcopyright":"© Microsoft Corporation. All rights reserved.","originalfilename":"WEXTRACT.EXE .MUI","productname":"Internet Explorer","productversion_2":"11.00.22688.1"}},"debug_info":[{"type":"IMAGE_DEBUG_TYPE_CODEVIEW","characteristics":0,"timedatestamp":"2062-Jul-25 12:18:00","version":"0.0","sizeofdata":37,"addressofrawdata":"0x00009A64","pointertorawdata":"0x00008A64","referenced_file":"wextract.pdb"},{"type":"IMAGE_DEBUG_TYPE_POGO","characteristics":0,"timedatestamp":"2062-Jul-25 12:18:00","version":"0.0","sizeofdata":496,"addressofrawdata":"0x00009A8C","pointertorawdata":"0x00008A8C"},{"type":"UNKNOWN","characteristics":0,"timedatestamp":"2062-Jul-25 12:18:00","version":"0.0","sizeofdata":36,"addressofrawdata":"0x00009C7C","pointertorawdata":"0x00008C7C"}],"load_configuration":{"size":280,"timedatestamp":"1970-Jan-01 00:00:00","version":"0.0","globalflagsclear":"(EMPTY)","globalflagsset":"(EMPTY)","criticalsectiondefaulttimeout":0,"decommitfreeblockthreshold":"0x0000000000000000","decommittotalfreethreshold":"0x0000000000000000","lockprefixtable":"0x0000000000000000","maximumallocationsize":"0x0000000000000000","virtualmemorythreshold":"0x0000000000000000","processaffinitymask":"0x0000000000000000","processheapflags":"(EMPTY)","csdversion":0,"reserved1":"0x0000","editlist":"0x0000000000000000","securitycookie":"0x000000014000C008","guardcfcheckfunctionpointer":"0x0000000140009648","guardcfdispatchfunctionpointer":"0x0000000000000000","guardcffunctiontable":"0x0000000000000000","guardcffunctioncount":"0x0000000000000000","guardflags":"(EMPTY)","codeintegrity_flags":"0x0000","codeintegrity_catalog":"0x0000","codeintegrity_catalogoffset":"0x00000000","codeintegrity_reserved":"0x00000000","guardaddresstakeniatentrytable":"0x0000000000000000","guardaddresstakeniatentrycount":0,"guardlongjumptargettable":"0x0000000000000000","guardlongjumptargetcount":0},"rich_header":{"xor_key":"0x3690B900","unmarked_objects":0,"cpp_objects":1,"asm_objects":2,"c_objects":18,"imports":17,"total_imports":160,"c_objects_ltcg":10,"resource_objects":1,"linker":1},"suspicious_strings":["rundll32.exe","CurrentVersion\\Run","Command.com"],"malicious_indicators":["LoadLibraryA","GetProcAddress","LoadLibraryExA","RegDeleteValueA","RegOpenKeyExA","RegQueryInfoKeyA","RegSetValueExA","RegCreateKeyExA","RegQueryValueExA","RegCloseKey","CreateProcessA","GetTempPathA","CreateFileA","OpenProcessToken","AdjustTokenPrivileges","GetDriveTypeA","GetVolumeInformationA","ExitWindowsEx"],"exploit_mitigation_techniques":["Stack Canary: enabled","SafeSEH: enabled (0 registered handlers)","ASLR: enabled","DEP: enabled","CFG: enabled"]}},"Exports":{},"Resources":{"entities":[{"id":"3001","type":"AVI","language":"English - United States","codepage":"Latin 1 / Western European","size":11802,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.52241,"detected_filetype":"AVI Resource Interchange File Format","detected_filetype_2":"Windows animated cursor"},{"id":"1","type":"RT_ICON","language":"English - United States","codepage":"UNKNOWN","size":278568,"time_date_stamp":"1980-01-01T00:00:00","entropy":6.16766},{"id":"2","type":"RT_ICON","language":"English - United States","codepage":"UNKNOWN","size":278568,"time_date_stamp":"1980-01-01T00:00:00","entropy":6.16766},{"id":"3","type":"RT_ICON","language":"English - United States","codepage":"UNKNOWN","size":17448,"time_date_stamp":"1980-01-01T00:00:00","entropy":6.135},{"id":"2001","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":754,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.25575},{"id":"2002","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":432,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.16025},{"id":"2003","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":358,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.99713},{"id":"2004","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":448,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.11992},{"id":"2005","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":304,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.97326},{"id":"2006","type":"RT_DIALOG","language":"English - United States","codepage":"Latin 1 / Western European","size":288,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.97672},{"id":"63","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":140,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.48958},{"id":"76","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":1312,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.2674},{"id":"77","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":1484,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.29977},{"id":"80","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":1200,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.27174},{"id":"83","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":1098,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.2912},{"id":"85","type":"RT_STRING","language":"English - United States","codepage":"Latin 1 / Western European","size":974,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.13591},{"id":"ADMQCMD","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.80735},{"id":"CABINET","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":1932347,"time_date_stamp":"2059-12-25T05:41:58","entropy":7.99986,"detected_filetype":"CAB Installer file"},{"id":"EXTRACTOPT","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":4,"time_date_stamp":"2059-12-25T05:41:58","entropy":0.811278},{"id":"FILESIZES","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":36,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.6383},{"id":"FINISHMSG","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.80735},{"id":"LICENSE","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.80735},{"id":"PACKINSTSPACE","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":4,"time_date_stamp":"2059-12-25T05:41:58","entropy":0},{"id":"POSTRUNPROGRAM","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":45,"time_date_stamp":"2059-12-25T05:41:58","entropy":4.37171},{"id":"REBOOT","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":4,"time_date_stamp":"2059-12-25T05:41:58","entropy":0},{"id":"RUNPROGRAM","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":24,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.26789},{"id":"SHOWWINDOW","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":4,"time_date_stamp":"2059-12-25T05:41:58","entropy":0.811278},{"id":"TITLE","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":10,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.84644},{"id":"UPROMPT","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.80735},{"id":"USRQCMD","type":"RT_RCDATA","language":"English - United States","codepage":"Latin 1 / Western European","size":7,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.80735},{"id":"3000","type":"RT_GROUP_ICON","language":"English - United States","codepage":"Latin 1 / Western European","size":48,"time_date_stamp":"2059-12-25T05:41:58","entropy":2.22035,"detected_filetype":"Icon file"},{"id":"1 (#2)","type":"RT_VERSION","language":"English - United States","codepage":"Latin 1 / Western European","size":1032,"time_date_stamp":"2059-12-25T05:41:58","entropy":3.38987},{"id":"1 (#3)","type":"RT_MANIFEST","language":"English - United States","codepage":"Latin 1 / Western European","size":2022,"time_date_stamp":"2059-12-25T05:41:58","entropy":5.00142}],"version_info":{"resource_lang_id":"English - United States","vs_version_info":{"signature":"0xFEEF04BD","struct_version":"0x00010000","file_version":"11.0.22688.1","product_version":"11.0.22688.1","file_flags":"(EMPTY)","file_os":["VOS_DOS_WINDOWS32","VOS_NT","VOS_NT_WINDOWS32","VOS_WINCE","VOS__WINDOWS32"],"file_type":"VFT_APP","language":"English - United States","company_name":"Microsoft Corporation","file_description":"Win32 Cabinet Self-Extractor","file_version_2":"11.00.22688.1 (WinBuild.160101.0800)","internal_name":"Wextract","legal_copyright":"© Microsoft Corporation. All rights reserved.","original_filename":"WEXTRACT.EXE .MUI","product_name":"Internet Explorer","product_version_2":"11.00.22688.1"}}},"Debug Info":{"debug_entries":[{"type":"IMAGE_DEBUG_TYPE_CODEVIEW","characteristics":0,"time_date_stamp":"2062-Jul-25 12:18:00","version":"0.0","size_of_data":37,"address_of_raw_data":"0x00009A64","pointer_to_raw_data":"0x00008A64","referenced_file":"wextract.pdb"},{"type":"IMAGE_DEBUG_TYPE_POGO","characteristics":0,"time_date_stamp":"2062-Jul-25 12:18:00","version":"0.0","size_of_data":496,"address_of_raw_data":"0x00009A8C","pointer_to_raw_data":"0x00008A8C"},{"type":"UNKNOWN","characteristics":0,"time_date_stamp":"2062-Jul-25 12:18:00","version":"0.0","size_of_data":36,"address_of_raw_data":"0x00009C7C","pointer_to_raw_data":"0x00008C7C"}]},"Load Configuration":{"Size":280,"TimeDateStamp":"1970-Jan-01 00:00:00","Version":"0.0","GlobalFlagsClear":"","GlobalFlagsSet":"","CriticalSectionDefaultTimeout":0,"DeCommitFreeBlockThreshold":0,"DeCommitTotalFreeThreshold":0,"LockPrefixTable":0,"MaximumAllocationSize":0,"VirtualMemoryThreshold":0,"ProcessAffinityMask":0,"ProcessHeapFlags":"","CSDVersion":0,"Reserved1":0,"EditList":0,"SecurityCookie":"0x000000014000C008","GuardCFCheckFunctionPointer":"0x0000000140009648","GuardCFDispatchFunctionPointer":0,"GuardCFFunctionTable":0,"GuardCFFunctionCount":0,"GuardFlags":"","CodeIntegrity":{"Flags":0,"Catalog":0,"CatalogOffset":0,"Reserved":0},"GuardAddressTakenIatEntryTable":0,"GuardAddressTakenIatEntryCount":0,"GuardLongJumpTargetTable":0,"GuardLongJumpTargetCount":0},"RICH Header":{"xor_key":"0x3690B900","unmarked_objects":0,"cpp_objects":1,"asm_objects":2,"c_objects":18,"imports":17,"total_imports":160,"ltcg_c_objects":10,"resource_objects":1,"linker":1,"suspicious_strings":{"system_tools":["rundll32.exe"],"dropper_capabilities":["CurrentVersion\\Run"],"domain_names":["Command.com"]},"malicious_functions":{"hidden_imports":["LoadLibraryA","GetProcAddress","LoadLibraryExA"],"registry_access":["RegDeleteValueA","RegOpenKeyExA","RegQueryInfoKeyA","RegSetValueExA","RegCreateKeyExA","RegQueryValueExA","RegCloseKey"],"process_creation":["CreateProcessA"],"temp_files":["GetTempPathA","CreateFileA"],"privilege_functions":["OpenProcessToken","AdjustTokenPrivileges"],"disk_enumeration":["GetDriveTypeA","GetVolumeInformationA"],"system_shutdown":["ExitWindowsEx"]},"pe_modifications":{"resource_cabinet":true,"timestamp_mismatch":"2059-Dec-25 05:41:58","resource_percentage":98.1524},"exploit_mitigations":{"stack_canary":true,"safe_seh":{"enabled":true,"handlers":0},"aslr":true,"dep":true,"cfg":true}},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/3"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_re990g1q/output.txt"},"timestamp":"2026-04-27 00:24:29"} {"_id":{"$oid":"69f0fbd759a6632dae07de67"},"sha256":"c5ae6f6ec23fd8d5ba1343e49bf805bbc016545715a413227bd5afe9c795002e","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/c5ae6f6ec23fd8d5ba1343e49bf805bbc016545715a413227bd5afe9c795002e-019f7c1a0e677960bfb1f850c5b3a274.exe\nDate: 2026-07-20 02:12:23\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/c5ae6f6ec23fd8d5ba1343e49bf805bbc016545715a413227bd5afe9c795002e-019f7c1a0e677960bfb1f850c5b3a274.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Feb-26 07:28:46\nDetected languages: English - United Kingdom\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000120\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2026-Feb-26 07:28:46\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0009AC00\nSizeOfInitializedData: 0x00077000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000204F7 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0009C000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00118000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0011F1CB\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00400000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00400000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0009AA37\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0009AC00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.66568\n\n.rdata:\n VirtualSize: 0x0002FB92\n VirtualAddress: 0x0009C000\n SizeOfRawData: 0x0002FC00\n PointerToRawData: 0x0009B000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.6928\n\n.data:\n VirtualSize: 0x0000705C\n VirtualAddress: 0x000CC000\n SizeOfRawData: 0x00004800\n PointerToRawData: 0x000CAC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.584577\n\n.rsrc:\n VirtualSize: 0x0003B508\n VirtualAddress: 0x000D4000\n SizeOfRawData: 0x0003B600\n PointerToRawData: 0x000CF400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.79942\n\n.reloc:\n VirtualSize: 0x000075CC\n VirtualAddress: 0x00110000\n SizeOfRawData: 0x00007600\n PointerToRawData: 0x0010AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.7982\n\n\nImports:\n--------\nWSOCK32.dll: gethostbyname\n recv\n send\n socket\n inet_ntoa\n setsockopt\n ntohs\n WSACleanup\n WSAStartup\n sendto\n htons\n __WSAFDIsSet\n select\n accept\n listen\n bind\n inet_addr\n ioctlsocket\n recvfrom\n WSAGetLastError\n closesocket\n gethostname\n connect\nVERSION.dll: GetFileVersionInfoW\n VerQueryValueW\n GetFileVersionInfoSizeW\nWINMM.dll: timeGetTime\n waveOutSetVolume\n mciSendStringW\nCOMCTL32.dll: ImageList_ReplaceIcon\n ImageList_Destroy\n ImageList_Remove\n ImageList_SetDragCursorImage\n ImageList_BeginDrag\n ImageList_DragEnter\n ImageList_DragLeave\n ImageList_EndDrag\n ImageList_DragMove\n InitCommonControlsEx\n ImageList_Create\nMPR.dll: WNetGetConnectionW\n WNetCancelConnection2W\n WNetUseConnectionW\n WNetAddConnection2W\nWININET.dll: HttpOpenRequestW\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n HttpQueryInfoW\n InternetQueryOptionW\n InternetConnectW\n HttpSendRequestW\n FtpOpenFileW\n FtpGetFileSize\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\nPSAPI.DLL: GetProcessMemoryInfo\nIPHLPAPI.DLL: IcmpSendEcho\n IcmpCloseHandle\n IcmpCreateFile\nUSERENV.dll: DestroyEnvironmentBlock\n LoadUserProfileW\n CreateEnvironmentBlock\n UnloadUserProfile\nUxTheme.dll: IsThemeActive\nKERNEL32.dll: DuplicateHandle\n CreateThread\n WaitForSingleObject\n HeapAlloc\n GetProcessHeap\n HeapFree\n Sleep\n GetCurrentThreadId\n MultiByteToWideChar\n MulDiv\n GetVersionExW\n IsWow64Process\n GetSystemInfo\n FreeLibrary\n LoadLibraryA\n GetProcAddress\n SetErrorMode\n GetModuleFileNameW\n WideCharToMultiByte\n lstrcpyW\n lstrlenW\n GetModuleHandleW\n QueryPerformanceCounter\n VirtualFreeEx\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n ReadProcessMemory\n CreateFileW\n SetFilePointerEx\n SetEndOfFile\n ReadFile\n WriteFile\n FlushFileBuffers\n TerminateProcess\n CreateToolhelp32Snapshot\n Process32FirstW\n Process32NextW\n SetFileTime\n GetFileAttributesW\n FindFirstFileW\n FindClose\n GetLongPathNameW\n GetShortPathNameW\n DeleteFileW\n IsDebuggerPresent\n CopyFileExW\n MoveFileW\n CreateDirectoryW\n RemoveDirectoryW\n SetSystemPowerState\n QueryPerformanceFrequency\n LoadResource\n LockResource\n SizeofResource\n OutputDebugStringW\n GetTempPathW\n GetTempFileNameW\n DeviceIoControl\n GetLocalTime\n CompareStringW\n GetCurrentThread\n LeaveCriticalSection\n GetStdHandle\n CreatePipe\n InterlockedExchange\n TerminateThread\n LoadLibraryExW\n FindResourceExW\n CopyFileW\n VirtualFree\n FormatMessageW\n GetExitCodeProcess\n GetPrivateProfileStringW\n WritePrivateProfileStringW\n GetPrivateProfileSectionW\n WritePrivateProfileSectionW\n GetPrivateProfileSectionNamesW\n FileTimeToLocalFileTime\n FileTimeToSystemTime\n SystemTimeToFileTime\n LocalFileTimeToFileTime\n GetDriveTypeW\n GetDiskFreeSpaceExW\n GetDiskFreeSpaceW\n GetVolumeInformationW\n SetVolumeLabelW\n CreateHardLinkW\n SetFileAttributesW\n CreateEventW\n SetEvent\n GetEnvironmentVariableW\n SetEnvironmentVariableW\n GlobalLock\n GlobalUnlock\n GlobalAlloc\n GetFileSize\n GlobalFree\n GlobalMemoryStatusEx\n Beep\n GetSystemDirectoryW\n HeapReAlloc\n HeapSize\n GetComputerNameW\n GetWindowsDirectoryW\n GetCurrentProcessId\n GetProcessIoCounters\n CreateProcessW\n GetProcessId\n SetPriorityClass\n LoadLibraryW\n VirtualAlloc\n GetCurrentDirectoryW\n lstrcmpiW\n DecodePointer\n GetLastError\n RaiseException\n InitializeCriticalSectionAndSpinCount\n DeleteCriticalSection\n InterlockedDecrement\n InterlockedIncrement\n ResetEvent\n WaitForSingleObjectEx\n IsProcessorFeaturePresent\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n CloseHandle\n GetFullPathNameW\n EnterCriticalSection\n GetStartupInfoW\n GetSystemTimeAsFileTime\n InitializeSListHead\n RtlUnwind\n SetLastError\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n EncodePointer\n ExitProcess\n GetModuleHandleExW\n ExitThread\n ResumeThread\n FreeLibraryAndExitThread\n GetACP\n GetDateFormatW\n GetTimeFormatW\n LCMapStringW\n GetStringTypeW\n GetFileType\n SetStdHandle\n GetConsoleCP\n GetConsoleMode\n ReadConsoleW\n GetTimeZoneInformation\n FindFirstFileExW\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetCommandLineW\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n SetEnvironmentVariableA\n SetCurrentDirectoryW\n FindNextFileW\n WriteConsoleW\nUSER32.dll: IsCharAlphaW\n IsCharAlphaNumericW\n IsCharLowerW\n IsCharUpperW\n GetMenuStringW\n GetSubMenu\n GetCaretPos\n IsZoomed\n MonitorFromPoint\n GetMonitorInfoW\n SetWindowLongW\n SetLayeredWindowAttributes\n FlashWindow\n GetClassLongW\n TranslateAcceleratorW\n IsDialogMessageW\n GetSysColor\n InflateRect\n DrawFocusRect\n DrawTextW\n FrameRect\n DrawFrameControl\n FillRect\n PtInRect\n DestroyAcceleratorTable\n CreateAcceleratorTableW\n SetCursor\n GetWindowDC\n GetSystemMetrics\n GetActiveWindow\n CharNextW\n wsprintfW\n RedrawWindow\n DrawMenuBar\n DestroyMenu\n SetMenu\n GetWindowTextLengthW\n CreateMenu\n IsDlgButtonChecked\n DefDlgProcW\n CallWindowProcW\n ReleaseCapture\n SetCapture\n TranslateMessage\n PeekMessageW\n GetInputState\n UnregisterHotKey\n CharLowerBuffW\n MonitorFromRect\n LoadImageW\n mouse_event\n ExitWindowsEx\n SetActiveWindow\n FindWindowExW\n EnumThreadWindows\n SetMenuDefaultItem\n InsertMenuItemW\n IsMenu\n GetKeyboardLayoutNameW\n GetCursorPos\n DeleteMenu\n CheckMenuRadioItem\n GetMenuItemID\n GetMenuItemCount\n SetMenuItemInfoW\n GetMenuItemInfoW\n SetForegroundWindow\n IsIconic\n FindWindowW\n SystemParametersInfoW\n GetMessageW\n SendInput\n GetAsyncKeyState\n SetKeyboardState\n GetKeyboardState\n GetKeyState\n VkKeyScanW\n LoadStringW\n DialogBoxParamW\n MessageBeep\n EndDialog\n SendDlgItemMessageW\n GetDlgItem\n SetWindowTextW\n CopyRect\n EndPaint\n BeginPaint\n GetClientRect\n GetMenu\n DestroyWindow\n EnumWindows\n GetDesktopWindow\n IsWindow\n IsWindowEnabled\n IsWindowVisible\n EnableWindow\n InvalidateRect\n GetWindowLongW\n ReleaseDC\n GetDC\n GetWindowThreadProcessId\n AttachThreadInput\n GetFocus\n GetWindowTextW\n SendMessageTimeoutW\n EnumChildWindows\n CharUpperBuffW\n GetClassNameW\n GetParent\n GetDlgCtrlID\n SendMessageW\n MapVirtualKeyW\n PostMessageW\n GetWindowRect\n SetUserObjectSecurity\n CloseDesktop\n CloseWindowStation\n OpenDesktopW\n ClientToScreen\n RegisterHotKey\n GetCursorInfo\n SetWindowPos\n CopyImage\n AdjustWindowRectEx\n SetRect\n SetClipboardData\n EmptyClipboard\n CountClipboardFormats\n CloseClipboard\n GetClipboardData\n IsClipboardFormatAvailable\n OpenClipboard\n TrackPopupMenuEx\n BlockInput\n SetProcessWindowStation\n GetProcessWindowStation\n OpenWindowStationW\n GetUserObjectSecurity\n MessageBoxW\n DefWindowProcW\n MoveWindow\n SetFocus\n PostQuitMessage\n KillTimer\n CreatePopupMenu\n RegisterWindowMessageW\n SetTimer\n ShowWindow\n CreateWindowExW\n RegisterClassExW\n LoadIconW\n LoadCursorW\n GetSysColorBrush\n GetForegroundWindow\n MessageBoxA\n DestroyIcon\n LockWindowUpdate\n keybd_event\n DispatchMessageW\n ScreenToClient\nGDI32.dll: EndPath\n DeleteObject\n GetTextExtentPoint32W\n ExtCreatePen\n StrokeAndFillPath\n GetDeviceCaps\n SetPixel\n CloseFigure\n LineTo\n AngleArc\n MoveToEx\n Ellipse\n CreateCompatibleBitmap\n CreateCompatibleDC\n PolyDraw\n BeginPath\n Rectangle\n SetViewportOrgEx\n GetObjectW\n SetBkMode\n RoundRect\n SetBkColor\n CreatePen\n SelectObject\n StretchBlt\n CreateSolidBrush\n SetTextColor\n CreateFontW\n GetTextFaceW\n GetStockObject\n CreateDCW\n GetPixel\n DeleteDC\n GetDIBits\n StrokePath\nCOMDLG32.dll: GetSaveFileNameW\n GetOpenFileNameW\nADVAPI32.dll: GetAce\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegConnectRegistryW\n InitializeSecurityDescriptor\n InitializeAcl\n AdjustTokenPrivileges\n OpenThreadToken\n OpenProcessToken\n LookupPrivilegeValueW\n DuplicateTokenEx\n CreateProcessAsUserW\n CreateProcessWithLogonW\n GetLengthSid\n CopySid\n LogonUserW\n AllocateAndInitializeSid\n CheckTokenMembership\n FreeSid\n GetTokenInformation\n RegCreateKeyExW\n GetSecurityDescriptorDacl\n GetAclInformation\n GetUserNameW\n AddAce\n SetSecurityDescriptorDacl\n InitiateSystemShutdownExW\nSHELL32.dll: DragFinish\n DragQueryPoint\n ShellExecuteExW\n DragQueryFileW\n SHEmptyRecycleBinW\n SHGetPathFromIDListW\n SHBrowseForFolderW\n SHCreateShellItem\n SHGetDesktopFolder\n SHGetSpecialFolderLocation\n SHGetFolderPathW\n SHFileOperationW\n ExtractIconExW\n Shell_NotifyIconW\n ShellExecuteW\nole32.dll: CoTaskMemAlloc\n CoTaskMemFree\n CLSIDFromString\n ProgIDFromCLSID\n CLSIDFromProgID\n OleSetMenuDescriptor\n MkParseDisplayName\n OleSetContainedObject\n CoCreateInstance\n IIDFromString\n StringFromGUID2\n CreateStreamOnHGlobal\n OleInitialize\n OleUninitialize\n CoInitialize\n CoUninitialize\n GetRunningObjectTable\n CoGetInstanceFromFile\n CoGetObject\n CoInitializeSecurity\n CoCreateInstanceEx\n CoSetProxyBlanket\nOLEAUT32.dll: CreateStdDispatch\n CreateDispTypeInfo\n UnRegisterTypeLib\n UnRegisterTypeLibForUser\n RegisterTypeLibForUser\n RegisterTypeLib\n LoadTypeLibEx\n VariantCopyInd\n SysReAllocString\n SysFreeString\n VariantChangeType\n SafeArrayDestroyData\n SafeArrayUnaccessData\n SafeArrayAccessData\n SafeArrayAllocData\n SafeArrayAllocDescriptorEx\n SafeArrayCreateVector\n SysStringLen\n QueryPathOfRegTypeLib\n SysAllocString\n VariantInit\n VariantClear\n DispCallFunc\n VariantTimeToSystemTime\n VarR8FromDec\n SafeArrayGetVartype\n SafeArrayDestroyDescriptor\n VariantCopy\n OleLoadPicture\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.66371\n\n2:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05883\n\n3:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.25499\n\n4:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.65355\n\n5:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43704\n\n6:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.16139\n\n7:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.07494\n\n8:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.18302\n\n9:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.52312\n\n10:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.65168\n\n11:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.39178\n\n166:\n Type: RT_MENU\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 80\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68292\n\n7 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1428\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34702\n\n8 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1674\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2804\n\n9 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28849\n\n10 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1532\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28373\n\n11 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26322\n\n12:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25812\n\n313:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 344\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08572\n\nSCRIPT:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 206799\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.999\n\n99:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8695\n Detected Filetype: Icon file\n\n162:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n164:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.84274\n Detected Filetype: Icon file\n\n169:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 220\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77862\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1007\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.40026\n\n\nVersion Info:\n-------------\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Mar-06 00:51:55\n Version: 0.0\n SizeofData: 1116\n AddressOfRawData: 0x000C8210\n PointerToRawData: 0x000C7210\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x004C868C\nEndAddressOfRawData: 0x004C8694\nAddressOfIndex: 0x004D0740\nAddressOfCallbacks: 0x0049C8F8\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\n-------------------\nSize: 160\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004CC014\nSEHandlerTable: 0x00000000\nSEHandlerCount: 0\n\nRICH Header:\n------------\nXOR Key: 0xFDEDA6DE\nUnmarked objects: 0\n241 (40116): 35\n243 (40116): 157\n242 (40116): 35\n199 (41118): 1\nC++ objects (VS 2015/2017 runtime 26706): 45\nC objects (VS 2015/2017 runtime 26706): 18\nASM objects (VS 2015/2017 runtime 26706): 21\nC objects (VS2008 SP1 build 30729): 9\nImports (VS2008 SP1 build 30729): 37\nTotal imports: 553\nC++ objects (POGO O) (27045): 80\nASM objects (27045): 1\nResource objects (27045): 1\n151: 1\nLinker (27045): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Is an AutoIT compiled script:\n AutoIt Error\n reserved for AutoIt internal use\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses known Mersenne Twister constants\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryExW\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n FindWindowW\n Code injection capabilities:\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n VirtualAlloc\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n RegisterHotKey\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n CreateProcessWithLogonW\n ShellExecuteW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n AttachThreadInput\n MapVirtualKeyW\n GetForegroundWindow\n Has Internet access capabilities:\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n InternetQueryOptionW\n InternetConnectW\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n DuplicateTokenEx\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n GetVolumeInformationW\n Manipulates other processes:\n OpenProcess\n WriteProcessMemory\n ReadProcessMemory\n Process32FirstW\n Process32NextW\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n Reads the contents of the clipboard:\n GetClipboardData\n Can shut the system down or lock the screen:\n ExitWindowsEx\n InitiateSystemShutdownExW\n\nThe PE's resources present abnormal characteristics.\n Resource SCRIPT is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Feb-26 07:28:46\nDetected languages: English - United Kingdom"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000120"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2026-Feb-26 07:28:46\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0009AC00\nSizeOfInitializedData: 0x00077000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000204F7 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0009C000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00118000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0011F1CB\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00400000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00400000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0009AA37\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0009AC00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.66568\n\n.rdata:\n VirtualSize: 0x0002FB92\n VirtualAddress: 0x0009C000\n SizeOfRawData: 0x0002FC00\n PointerToRawData: 0x0009B000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.6928\n\n.data:\n VirtualSize: 0x0000705C\n VirtualAddress: 0x000CC000\n SizeOfRawData: 0x00004800\n PointerToRawData: 0x000CAC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.584577\n\n.rsrc:\n VirtualSize: 0x0003B508\n VirtualAddress: 0x000D4000\n SizeOfRawData: 0x0003B600\n PointerToRawData: 0x000CF400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.79942\n\n.reloc:\n VirtualSize: 0x000075CC\n VirtualAddress: 0x00110000\n SizeOfRawData: 0x00007600\n PointerToRawData: 0x0010AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.7982"},"Imports":{"raw":"WSOCK32.dll: gethostbyname\n recv\n send\n socket\n inet_ntoa\n setsockopt\n ntohs\n WSACleanup\n WSAStartup\n sendto\n htons\n __WSAFDIsSet\n select\n accept\n listen\n bind\n inet_addr\n ioctlsocket\n recvfrom\n WSAGetLastError\n closesocket\n gethostname\n connect\nVERSION.dll: GetFileVersionInfoW\n VerQueryValueW\n GetFileVersionInfoSizeW\nWINMM.dll: timeGetTime\n waveOutSetVolume\n mciSendStringW\nCOMCTL32.dll: ImageList_ReplaceIcon\n ImageList_Destroy\n ImageList_Remove\n ImageList_SetDragCursorImage\n ImageList_BeginDrag\n ImageList_DragEnter\n ImageList_DragLeave\n ImageList_EndDrag\n ImageList_DragMove\n InitCommonControlsEx\n ImageList_Create\nMPR.dll: WNetGetConnectionW\n WNetCancelConnection2W\n WNetUseConnectionW\n WNetAddConnection2W\nWININET.dll: HttpOpenRequestW\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n HttpQueryInfoW\n InternetQueryOptionW\n InternetConnectW\n HttpSendRequestW\n FtpOpenFileW\n FtpGetFileSize\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\nPSAPI.DLL: GetProcessMemoryInfo\nIPHLPAPI.DLL: IcmpSendEcho\n IcmpCloseHandle\n IcmpCreateFile\nUSERENV.dll: DestroyEnvironmentBlock\n LoadUserProfileW\n CreateEnvironmentBlock\n UnloadUserProfile\nUxTheme.dll: IsThemeActive\nKERNEL32.dll: DuplicateHandle\n CreateThread\n WaitForSingleObject\n HeapAlloc\n GetProcessHeap\n HeapFree\n Sleep\n GetCurrentThreadId\n MultiByteToWideChar\n MulDiv\n GetVersionExW\n IsWow64Process\n GetSystemInfo\n FreeLibrary\n LoadLibraryA\n GetProcAddress\n SetErrorMode\n GetModuleFileNameW\n WideCharToMultiByte\n lstrcpyW\n lstrlenW\n GetModuleHandleW\n QueryPerformanceCounter\n VirtualFreeEx\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n ReadProcessMemory\n CreateFileW\n SetFilePointerEx\n SetEndOfFile\n ReadFile\n WriteFile\n FlushFileBuffers\n TerminateProcess\n CreateToolhelp32Snapshot\n Process32FirstW\n Process32NextW\n SetFileTime\n GetFileAttributesW\n FindFirstFileW\n FindClose\n GetLongPathNameW\n GetShortPathNameW\n DeleteFileW\n IsDebuggerPresent\n CopyFileExW\n MoveFileW\n CreateDirectoryW\n RemoveDirectoryW\n SetSystemPowerState\n QueryPerformanceFrequency\n LoadResource\n LockResource\n SizeofResource\n OutputDebugStringW\n GetTempPathW\n GetTempFileNameW\n DeviceIoControl\n GetLocalTime\n CompareStringW\n GetCurrentThread\n LeaveCriticalSection\n GetStdHandle\n CreatePipe\n InterlockedExchange\n TerminateThread\n LoadLibraryExW\n FindResourceExW\n CopyFileW\n VirtualFree\n FormatMessageW\n GetExitCodeProcess\n GetPrivateProfileStringW\n WritePrivateProfileStringW\n GetPrivateProfileSectionW\n WritePrivateProfileSectionW\n GetPrivateProfileSectionNamesW\n FileTimeToLocalFileTime\n FileTimeToSystemTime\n SystemTimeToFileTime\n LocalFileTimeToFileTime\n GetDriveTypeW\n GetDiskFreeSpaceExW\n GetDiskFreeSpaceW\n GetVolumeInformationW\n SetVolumeLabelW\n CreateHardLinkW\n SetFileAttributesW\n CreateEventW\n SetEvent\n GetEnvironmentVariableW\n SetEnvironmentVariableW\n GlobalLock\n GlobalUnlock\n GlobalAlloc\n GetFileSize\n GlobalFree\n GlobalMemoryStatusEx\n Beep\n GetSystemDirectoryW\n HeapReAlloc\n HeapSize\n GetComputerNameW\n GetWindowsDirectoryW\n GetCurrentProcessId\n GetProcessIoCounters\n CreateProcessW\n GetProcessId\n SetPriorityClass\n LoadLibraryW\n VirtualAlloc\n GetCurrentDirectoryW\n lstrcmpiW\n DecodePointer\n GetLastError\n RaiseException\n InitializeCriticalSectionAndSpinCount\n DeleteCriticalSection\n InterlockedDecrement\n InterlockedIncrement\n ResetEvent\n WaitForSingleObjectEx\n IsProcessorFeaturePresent\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n CloseHandle\n GetFullPathNameW\n EnterCriticalSection\n GetStartupInfoW\n GetSystemTimeAsFileTime\n InitializeSListHead\n RtlUnwind\n SetLastError\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n EncodePointer\n ExitProcess\n GetModuleHandleExW\n ExitThread\n ResumeThread\n FreeLibraryAndExitThread\n GetACP\n GetDateFormatW\n GetTimeFormatW\n LCMapStringW\n GetStringTypeW\n GetFileType\n SetStdHandle\n GetConsoleCP\n GetConsoleMode\n ReadConsoleW\n GetTimeZoneInformation\n FindFirstFileExW\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetCommandLineW\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n SetEnvironmentVariableA\n SetCurrentDirectoryW\n FindNextFileW\n WriteConsoleW\nUSER32.dll: IsCharAlphaW\n IsCharAlphaNumericW\n IsCharLowerW\n IsCharUpperW\n GetMenuStringW\n GetSubMenu\n GetCaretPos\n IsZoomed\n MonitorFromPoint\n GetMonitorInfoW\n SetWindowLongW\n SetLayeredWindowAttributes\n FlashWindow\n GetClassLongW\n TranslateAcceleratorW\n IsDialogMessageW\n GetSysColor\n InflateRect\n DrawFocusRect\n DrawTextW\n FrameRect\n DrawFrameControl\n FillRect\n PtInRect\n DestroyAcceleratorTable\n CreateAcceleratorTableW\n SetCursor\n GetWindowDC\n GetSystemMetrics\n GetActiveWindow\n CharNextW\n wsprintfW\n RedrawWindow\n DrawMenuBar\n DestroyMenu\n SetMenu\n GetWindowTextLengthW\n CreateMenu\n IsDlgButtonChecked\n DefDlgProcW\n CallWindowProcW\n ReleaseCapture\n SetCapture\n TranslateMessage\n PeekMessageW\n GetInputState\n UnregisterHotKey\n CharLowerBuffW\n MonitorFromRect\n LoadImageW\n mouse_event\n ExitWindowsEx\n SetActiveWindow\n FindWindowExW\n EnumThreadWindows\n SetMenuDefaultItem\n InsertMenuItemW\n IsMenu\n GetKeyboardLayoutNameW\n GetCursorPos\n DeleteMenu\n CheckMenuRadioItem\n GetMenuItemID\n GetMenuItemCount\n SetMenuItemInfoW\n GetMenuItemInfoW\n SetForegroundWindow\n IsIconic\n FindWindowW\n SystemParametersInfoW\n GetMessageW\n SendInput\n GetAsyncKeyState\n SetKeyboardState\n GetKeyboardState\n GetKeyState\n VkKeyScanW\n LoadStringW\n DialogBoxParamW\n MessageBeep\n EndDialog\n SendDlgItemMessageW\n GetDlgItem\n SetWindowTextW\n CopyRect\n EndPaint\n BeginPaint\n GetClientRect\n GetMenu\n DestroyWindow\n EnumWindows\n GetDesktopWindow\n IsWindow\n IsWindowEnabled\n IsWindowVisible\n EnableWindow\n InvalidateRect\n GetWindowLongW\n ReleaseDC\n GetDC\n GetWindowThreadProcessId\n AttachThreadInput\n GetFocus\n GetWindowTextW\n SendMessageTimeoutW\n EnumChildWindows\n CharUpperBuffW\n GetClassNameW\n GetParent\n GetDlgCtrlID\n SendMessageW\n MapVirtualKeyW\n PostMessageW\n GetWindowRect\n SetUserObjectSecurity\n CloseDesktop\n CloseWindowStation\n OpenDesktopW\n ClientToScreen\n RegisterHotKey\n GetCursorInfo\n SetWindowPos\n CopyImage\n AdjustWindowRectEx\n SetRect\n SetClipboardData\n EmptyClipboard\n CountClipboardFormats\n CloseClipboard\n GetClipboardData\n IsClipboardFormatAvailable\n OpenClipboard\n TrackPopupMenuEx\n BlockInput\n SetProcessWindowStation\n GetProcessWindowStation\n OpenWindowStationW\n GetUserObjectSecurity\n MessageBoxW\n DefWindowProcW\n MoveWindow\n SetFocus\n PostQuitMessage\n KillTimer\n CreatePopupMenu\n RegisterWindowMessageW\n SetTimer\n ShowWindow\n CreateWindowExW\n RegisterClassExW\n LoadIconW\n LoadCursorW\n GetSysColorBrush\n GetForegroundWindow\n MessageBoxA\n DestroyIcon\n LockWindowUpdate\n keybd_event\n DispatchMessageW\n ScreenToClient\nGDI32.dll: EndPath\n DeleteObject\n GetTextExtentPoint32W\n ExtCreatePen\n StrokeAndFillPath\n GetDeviceCaps\n SetPixel\n CloseFigure\n LineTo\n AngleArc\n MoveToEx\n Ellipse\n CreateCompatibleBitmap\n CreateCompatibleDC\n PolyDraw\n BeginPath\n Rectangle\n SetViewportOrgEx\n GetObjectW\n SetBkMode\n RoundRect\n SetBkColor\n CreatePen\n SelectObject\n StretchBlt\n CreateSolidBrush\n SetTextColor\n CreateFontW\n GetTextFaceW\n GetStockObject\n CreateDCW\n GetPixel\n DeleteDC\n GetDIBits\n StrokePath\nCOMDLG32.dll: GetSaveFileNameW\n GetOpenFileNameW\nADVAPI32.dll: GetAce\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegConnectRegistryW\n InitializeSecurityDescriptor\n InitializeAcl\n AdjustTokenPrivileges\n OpenThreadToken\n OpenProcessToken\n LookupPrivilegeValueW\n DuplicateTokenEx\n CreateProcessAsUserW\n CreateProcessWithLogonW\n GetLengthSid\n CopySid\n LogonUserW\n AllocateAndInitializeSid\n CheckTokenMembership\n FreeSid\n GetTokenInformation\n RegCreateKeyExW\n GetSecurityDescriptorDacl\n GetAclInformation\n GetUserNameW\n AddAce\n SetSecurityDescriptorDacl\n InitiateSystemShutdownExW\nSHELL32.dll: DragFinish\n DragQueryPoint\n ShellExecuteExW\n DragQueryFileW\n SHEmptyRecycleBinW\n SHGetPathFromIDListW\n SHBrowseForFolderW\n SHCreateShellItem\n SHGetDesktopFolder\n SHGetSpecialFolderLocation\n SHGetFolderPathW\n SHFileOperationW\n ExtractIconExW\n Shell_NotifyIconW\n ShellExecuteW\nole32.dll: CoTaskMemAlloc\n CoTaskMemFree\n CLSIDFromString\n ProgIDFromCLSID\n CLSIDFromProgID\n OleSetMenuDescriptor\n MkParseDisplayName\n OleSetContainedObject\n CoCreateInstance\n IIDFromString\n StringFromGUID2\n CreateStreamOnHGlobal\n OleInitialize\n OleUninitialize\n CoInitialize\n CoUninitialize\n GetRunningObjectTable\n CoGetInstanceFromFile\n CoGetObject\n CoInitializeSecurity\n CoCreateInstanceEx\n CoSetProxyBlanket\nOLEAUT32.dll: CreateStdDispatch\n CreateDispTypeInfo\n UnRegisterTypeLib\n UnRegisterTypeLibForUser\n RegisterTypeLibForUser\n RegisterTypeLib\n LoadTypeLibEx\n VariantCopyInd\n SysReAllocString\n SysFreeString\n VariantChangeType\n SafeArrayDestroyData\n SafeArrayUnaccessData\n SafeArrayAccessData\n SafeArrayAllocData\n SafeArrayAllocDescriptorEx\n SafeArrayCreateVector\n SysStringLen\n QueryPathOfRegTypeLib\n SysAllocString\n VariantInit\n VariantClear\n DispCallFunc\n VariantTimeToSystemTime\n VarR8FromDec\n SafeArrayGetVartype\n SafeArrayDestroyDescriptor\n VariantCopy\n OleLoadPicture\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.66371\n\n2:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05883\n\n3:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.25499\n\n4:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.65355\n\n5:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43704\n\n6:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.16139\n\n7:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.07494\n\n8:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.18302\n\n9:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.52312\n\n10:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.65168\n\n11:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.39178\n\n166:\n Type: RT_MENU\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 80\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68292\n\n7 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1428\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34702\n\n8 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1674\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2804\n\n9 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28849\n\n10 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1532\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28373\n\n11 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26322\n\n12:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25812\n\n313:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 344\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08572\n\nSCRIPT:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 206799\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.999\n\n99:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8695\n Detected Filetype: Icon file\n\n162:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n164:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.84274\n Detected Filetype: Icon file\n\n169:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 220\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77862\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1007\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.40026\n\n\nVersion Info:\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Mar-06 00:51:55\n Version: 0.0\n SizeofData: 1116\n AddressOfRawData: 0x000C8210\n PointerToRawData: 0x000C7210\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x004C868C\nEndAddressOfRawData: 0x004C8694\nAddressOfIndex: 0x004D0740\nAddressOfCallbacks: 0x0049C8F8\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\nSize: 160\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004CC014\nSEHandlerTable: 0x00000000\nSEHandlerCount: 0\n\nRICH Header:\nXOR Key: 0xFDEDA6DE\nUnmarked objects: 0\n241 (40116): 35\n243 (40116): 157\n242 (40116): 35\n199 (41118): 1\nC++ objects (VS 2015/2017 runtime 26706): 45\nC objects (VS 2015/2017 runtime 26706): 18\nASM objects (VS 2015/2017 runtime 26706): 21\nC objects (VS2008 SP1 build 30729): 9\nImports (VS2008 SP1 build 30729): 37\nTotal imports: 553\nC++ objects (POGO O) (27045): 80\nASM objects (27045): 1\nResource objects (27045): 1\n151: 1\nLinker (27045): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Is an AutoIT compiled script:\n AutoIt Error\n reserved for AutoIt internal use\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses known Mersenne Twister constants\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryExW\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n FindWindowW\n Code injection capabilities:\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n VirtualAlloc\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n RegisterHotKey\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n CreateProcessWithLogonW\n ShellExecuteW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n AttachThreadInput\n MapVirtualKeyW\n GetForegroundWindow\n Has Internet access capabilities:\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n InternetQueryOptionW\n InternetConnectW\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n DuplicateTokenEx\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n GetVolumeInformationW\n Manipulates other processes:\n OpenProcess\n WriteProcessMemory\n ReadProcessMemory\n Process32FirstW\n Process32NextW\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n Reads the contents of the clipboard:\n GetClipboardData\n Can shut the system down or lock the screen:\n ExitWindowsEx\n InitiateSystemShutdownExW\n\nThe PE's resources present abnormal characteristics.\n Resource SCRIPT is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.66371\n\n2:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05883\n\n3:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.25499\n\n4:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.65355\n\n5:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43704\n\n6:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.16139\n\n7:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.07494\n\n8:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.18302\n\n9:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.52312\n\n10:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.65168\n\n11:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.39178\n\n166:\n Type: RT_MENU\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 80\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68292\n\n7 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1428\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34702\n\n8 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1674\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2804\n\n9 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28849\n\n10 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1532\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28373\n\n11 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26322\n\n12:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25812\n\n313:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 344\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08572\n\nSCRIPT:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 206799\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.999\n\n99:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8695\n Detected Filetype: Icon file\n\n162:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n164:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.84274\n Detected Filetype: Icon file\n\n169:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 220\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77862\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United Kingdom\n Codepage: Latin 1 / Western European\n Size: 1007\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.40026\n\n\nVersion Info:\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Mar-06 00:51:55\n Version: 0.0\n SizeofData: 1116\n AddressOfRawData: 0x000C8210\n PointerToRawData: 0x000C7210\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x004C868C\nEndAddressOfRawData: 0x004C8694\nAddressOfIndex: 0x004D0740\nAddressOfCallbacks: 0x0049C8F8\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)"},"Load Configuration":{"raw":"Size: 160\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004CC014\nSEHandlerTable: 0x00000000\nSEHandlerCount: 0"},"RICH Header":{"raw":"XOR Key: 0xFDEDA6DE\nUnmarked objects: 0\n241 (40116): 35\n243 (40116): 157\n242 (40116): 35\n199 (41118): 1\nC++ objects (VS 2015/2017 runtime 26706): 45\nC objects (VS 2015/2017 runtime 26706): 18\nASM objects (VS 2015/2017 runtime 26706): 21\nC objects (VS2008 SP1 build 30729): 9\nImports (VS2008 SP1 build 30729): 37\nTotal imports: 553\nC++ objects (POGO O) (27045): 80\nASM objects (27045): 1\nResource objects (27045): 1\n151: 1\nLinker (27045): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Is an AutoIT compiled script:\n AutoIt Error\n reserved for AutoIt internal use\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses known Mersenne Twister constants\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryExW\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n FindWindowW\n Code injection capabilities:\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n VirtualAlloc\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n RegisterHotKey\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n CreateProcessWithLogonW\n ShellExecuteW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n AttachThreadInput\n MapVirtualKeyW\n GetForegroundWindow\n Has Internet access capabilities:\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n InternetQueryOptionW\n InternetConnectW\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n DuplicateTokenEx\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n GetVolumeInformationW\n Manipulates other processes:\n OpenProcess\n WriteProcessMemory\n ReadProcessMemory\n Process32FirstW\n Process32NextW\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n Reads the contents of the clipboard:\n GetClipboardData\n Can shut the system down or lock the screen:\n ExitWindowsEx\n InitiateSystemShutdownExW\n\nThe PE's resources present abnormal characteristics.\n Resource SCRIPT is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/c5ae6f6ec23fd8d5ba1343e49bf805bbc016545715a413227bd5afe9c795002e-019f7c1a0e677960bfb1f850c5b3a274.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_f0qb2nkj/output.txt"},"timestamp":"2026-07-20 02:12:23"} {"_id":{"$oid":"69f1fc1f59a6632dae07de7b"},"sha256":"778c2e260d8d3982c7b93c1ecc8201fb16bd62f085004c2886d3c69ef45cec27","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/custom_edid.bin\nDate: 2026-04-29 18:09:59\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/custom_edid.bin!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/custom_edid.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_5w_xv943/output.txt"},"timestamp":"2026-04-29 18:09:59"} {"_id":{"$oid":"69f24e7259a6632dae07de82"},"sha256":"4792cd702b952d39c1cd215f842223b96e2c17ce9981629cce63014bf095329e","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/mamamia.exe\nDate: 2026-04-29 23:44:42\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/mamamia.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2025-Nov-17 20:35:38\nDetected languages: English - United States\n Portuguese - Brazil\nFileDescription: WinLSP\nFileVersion: 1.0.0.0\nProductName: WinLSP\nProductVersion: 1.0.0.0\nProgramID: com.embarcadero.WinLSP\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0050\ne_cp: 0x0002\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x000F\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x001A\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000100\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 11\nTimeDateStamp: 2025-Nov-17 20:35:38\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00AD7200\nSizeOfInitializedData: 0x02A96C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00AD81E4 (Section: .itext)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00AD9000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x035A0000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00004000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00AD0C04\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00AD0E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.49067\n\n.itext:\n VirtualSize: 0x00006240\n VirtualAddress: 0x00AD2000\n SizeOfRawData: 0x00006400\n PointerToRawData: 0x00AD1200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.31899\n\n.data:\n VirtualSize: 0x0002D1E4\n VirtualAddress: 0x00AD9000\n SizeOfRawData: 0x0002D200\n PointerToRawData: 0x00AD7600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.64362\n\n.bss:\n VirtualSize: 0x000298FC\n VirtualAddress: 0x00B07000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00004C18\n VirtualAddress: 0x00B31000\n SizeOfRawData: 0x00004E00\n PointerToRawData: 0x00B04800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.1625\n\n.didata:\n VirtualSize: 0x000011B0\n VirtualAddress: 0x00B36000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00B09600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.40898\n\n.edata:\n VirtualSize: 0x0000006F\n VirtualAddress: 0x00B38000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00B0A800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.32437\n\n.tls:\n VirtualSize: 0x00000060\n VirtualAddress: 0x00B39000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rdata:\n VirtualSize: 0x0000005D\n VirtualAddress: 0x00B3A000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00B0AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.38389\n\n.reloc:\n VirtualSize: 0x0010D040\n VirtualAddress: 0x00B3B000\n SizeOfRawData: 0x0010D200\n PointerToRawData: 0x00B0AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.62953\n\n.rsrc:\n VirtualSize: 0x02956400\n VirtualAddress: 0x00C49000\n SizeOfRawData: 0x02956400\n PointerToRawData: 0x00C17E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.36329\n\n\nImports:\n--------\nshlwapi.dll: SHCreateStreamOnFileW\nwininet.dll: InternetCloseHandle\n InternetGetConnectedState\n InternetReadFile\n HttpOpenRequestW\n HttpSendRequestW\n InternetConnectW\n InternetOpenW\n InternetOpenUrlW\nwinspool.drv: DocumentPropertiesW\n ClosePrinter\n OpenPrinterW\n GetDefaultPrinterW\n EnumPrintersW\ncomctl32.dll: ImageList_GetImageInfo\n FlatSB_SetScrollInfo\n InitCommonControls\n ImageList_DragMove\n ImageList_Destroy\n _TrackMouseEvent\n ImageList_DragShowNolock\n ImageList_Add\n FlatSB_SetScrollProp\n ImageList_GetDragImage\n ImageList_Create\n ImageList_EndDrag\n ImageList_DrawEx\n ImageList_AddMasked\n ImageList_SetImageCount\n FlatSB_GetScrollPos\n FlatSB_SetScrollPos\n InitializeFlatSB\n ImageList_Copy\n FlatSB_GetScrollInfo\n ImageList_Write\n ImageList_DrawIndirect\n ImageList_SetBkColor\n ImageList_GetBkColor\n ImageList_BeginDrag\n ImageList_GetIcon\n ImageList_Replace\n ImageList_GetImageCount\n ImageList_DragEnter\n ImageList_GetIconSize\n ImageList_SetIconSize\n ImageList_Read\n ImageList_DragLeave\n ImageList_LoadImageW\n ImageList_Draw\n ImageList_Remove\n ImageList_ReplaceIcon\n ImageList_SetOverlayImage\nshell32.dll: SHGetMalloc\n SHGetFolderPathW\n SHGetFileInfoW\n SHGetDesktopFolder\n DragQueryFileW\n SHGetSpecialFolderLocation\n Shell_NotifyIconW\n SHAppBarMessage\n ShellExecuteW\n ShellExecuteExW\nuser32.dll: CopyImage\n MoveWindow\n SetMenuItemInfoW\n GetMenuItemInfoW\n DefFrameProcW\n GetCaretPos\n ScrollWindowEx\n GetDlgCtrlID\n GetUpdateRgn\n FrameRect\n RegisterWindowMessageW\n GetMenuStringW\n FillRect\n SendMessageA\n IsClipboardFormatAvailable\n EnumWindows\n ShowOwnedPopups\n GetClassInfoW\n GetScrollRange\n SetActiveWindow\n GetActiveWindow\n DrawEdge\n GetKeyboardLayoutList\n LoadBitmapW\n EnumChildWindows\n SendNotifyMessageW\n GetScrollBarInfo\n UnhookWindowsHookEx\n SetCapture\n GetCapture\n ChildWindowFromPointEx\n CreatePopupMenu\n ShowCaret\n GetMenuItemID\n CharLowerBuffW\n ChangeDisplaySettingsW\n PostMessageW\n SetWindowLongW\n IsZoomed\n SetParent\n DrawMenuBar\n InvalidateRgn\n SetSystemCursor\n GetClientRect\n IsChild\n IntersectRect\n IsIconic\n CallNextHookEx\n ShowWindow\n SetForegroundWindow\n GetWindowTextW\n GetAsyncKeyState\n GetWindowTextLengthW\n DestroyWindow\n IsDialogMessageW\n RegisterClassW\n EndMenu\n CharNextW\n GetFocus\n GetDC\n SetFocus\n ReleaseDC\n mouse_event\n ExitWindowsEx\n GetClassLongW\n SetScrollRange\n DrawTextW\n PeekMessageA\n TabbedTextOutW\n MessageBeep\n SetClassLongW\n SetRectEmpty\n LockWindowUpdate\n RemovePropW\n GetSubMenu\n EqualRect\n DestroyIcon\n IsWindowVisible\n DispatchMessageA\n PtInRect\n UnregisterClassW\n GetTopWindow\n SendMessageW\n GetTabbedTextExtentW\n GetMessageTime\n NotifyWinEvent\n CreateMenu\n LoadStringW\n CharLowerW\n SetWindowRgn\n SetWindowPos\n GetWindowRgn\n GetMenuItemCount\n GetSysColorBrush\n GetWindowDC\n DrawTextExW\n CharLowerBuffA\n EnumClipboardFormats\n GetScrollInfo\n SetWindowTextW\n GetMessageExtraInfo\n GetSysColor\n EnableScrollBar\n TrackPopupMenu\n DrawIconEx\n keybd_event\n GetClassNameW\n GetMessagePos\n GetIconInfo\n SetScrollInfo\n GetKeyNameTextW\n GetDesktopWindow\n SetCursorPos\n GetCursorPos\n SetMenu\n GetMenuState\n GetMenu\n SetRect\n GetKeyState\n IsRectEmpty\n ValidateRect\n IsCharAlphaW\n GetCursor\n KillTimer\n BeginDeferWindowPos\n WaitMessage\n TranslateMDISysAccel\n GetWindowPlacement\n CreateIconIndirect\n CreateWindowExW\n ChildWindowFromPoint\n GetMessageW\n GetDCEx\n PeekMessageW\n MonitorFromWindow\n GetUpdateRect\n SetTimer\n WindowFromPoint\n BeginPaint\n RegisterClipboardFormatW\n MapVirtualKeyW\n OffsetRect\n IsWindowUnicode\n DispatchMessageW\n CreateAcceleratorTableW\n DefMDIChildProcW\n GetSystemMenu\n SetScrollPos\n GetScrollPos\n InflateRect\n DrawFocusRect\n ReleaseCapture\n LoadCursorW\n GetGUIThreadInfo\n ScrollWindow\n GetLastActivePopup\n SetMenuInfo\n GetMenuInfo\n GetSystemMetrics\n CharUpperBuffW\n ClientToScreen\n SetClipboardData\n GetClipboardData\n SetWindowPlacement\n GetMonitorInfoW\n CheckMenuItem\n CharUpperW\n DefWindowProcW\n GetForegroundWindow\n ToAscii\n EnableWindow\n GetWindowThreadProcessId\n RedrawWindow\n EndPaint\n MsgWaitForMultipleObjectsEx\n LoadKeyboardLayoutW\n EnumDisplaySettingsW\n ActivateKeyboardLayout\n GetParent\n MonitorFromRect\n InsertMenuItemW\n GetPropW\n MessageBoxW\n SetPropW\n UpdateWindow\n MsgWaitForMultipleObjects\n DestroyMenu\n SetWindowsHookExW\n GetDoubleClickTime\n EmptyClipboard\n GetAncestor\n AdjustWindowRectEx\n DrawIcon\n IsWindow\n EnumThreadWindows\n InvalidateRect\n LookupIconIdFromDirectoryEx\n SetKeyboardState\n GetKeyboardState\n DrawFrameControl\n ScreenToClient\n IsCharAlphaNumericW\n WindowFromDC\n BringWindowToTop\n SetCursor\n CreateIcon\n RemoveMenu\n AppendMenuW\n SubtractRect\n GetKeyboardLayoutNameW\n OpenClipboard\n TranslateMessage\n MapWindowPoints\n EnumDisplayMonitors\n CallWindowProcW\n CountClipboardFormats\n CloseClipboard\n DestroyCursor\n CharUpperBuffA\n CopyIcon\n PostQuitMessage\n ShowScrollBar\n LoadImageW\n EnableMenuItem\n DeferWindowPos\n HideCaret\n EndDeferWindowPos\n FindWindowExW\n MonitorFromPoint\n LoadIconW\n SystemParametersInfoW\n GetWindow\n GetWindowLongW\n GetWindowRect\n ToUnicode\n InsertMenuW\n IsWindowEnabled\n IsDialogMessageA\n FindWindowW\n DeleteMenu\n GetKeyboardLayout\nversion.dll: GetFileVersionInfoSizeW\n VerQueryValueW\n GetFileVersionInfoW\noleaut32.dll: SafeArrayPutElement\n GetErrorInfo\n VariantInit\n VariantClear\n SysFreeString\n SafeArrayAccessData\n SysReAllocStringLen\n SafeArrayCreate\n SafeArrayGetElement\n GetActiveObject\n SysAllocStringLen\n SafeArrayUnaccessData\n SafeArrayPtrOfIndex\n SafeArrayCreateVector\n SafeArrayGetElemsize\n VariantCopy\n SafeArrayGetUBound\n SafeArrayGetLBound\n VariantCopyInd\n VariantChangeType\nadvapi32.dll: RegSetValueExW\n RegConnectRegistryW\n RegEnumKeyExW\n RegLoadKeyW\n AdjustTokenPrivileges\n RegDeleteKeyW\n LookupPrivilegeValueW\n OpenProcessToken\n RegOpenKeyExW\n RegQueryInfoKeyW\n RegUnLoadKeyW\n RegSaveKeyW\n RegDeleteValueW\n RegReplaceKeyW\n RegFlushKey\n RegQueryValueExW\n RegEnumValueW\n RegCloseKey\n RegCreateKeyExW\n RegRestoreKeyW\nmsvcrt.dll: isupper\n isalpha\n isalnum\n toupper\n memchr\n memcmp\n memcpy\n memset\n isprint\n isspace\n iscntrl\n isxdigit\n ispunct\n isgraph\n islower\n tolower\nwinhttp.dll: WinHttpGetIEProxyConfigForCurrentUser\n WinHttpSetTimeouts\n WinHttpSetStatusCallback\n WinHttpConnect\n WinHttpReceiveResponse\n WinHttpQueryAuthSchemes\n WinHttpGetProxyForUrl\n WinHttpReadData\n WinHttpCloseHandle\n WinHttpQueryHeaders\n WinHttpOpenRequest\n WinHttpAddRequestHeaders\n WinHttpOpen\n WinHttpWriteData\n WinHttpSetCredentials\n WinHttpQueryDataAvailable\n WinHttpSetOption\n WinHttpSendRequest\n WinHttpQueryOption\nkernel32.dll: GetFileType\n QueryDosDeviceW\n GetACP\n CloseHandle\n LocalFree\n GetCurrentProcessId\n SizeofResource\n TerminateThread\n QueryPerformanceFrequency\n SetProcessWorkingSetSize\n IsDebuggerPresent\n FindNextFileW\n GetFullPathNameW\n VirtualFree\n GetProcessHeap\n ExitProcess\n HeapAlloc\n GetCPInfoExW\n GlobalSize\n RtlUnwind\n GetCPInfo\n EnumSystemLocalesW\n GetStdHandle\n GetTimeZoneInformation\n FileTimeToLocalFileTime\n GetModuleHandleW\n FreeLibrary\n TryEnterCriticalSection\n HeapDestroy\n FileTimeToDosDateTime\n ReadFile\n GetUserDefaultLCID\n GetLastError\n GetModuleFileNameW\n SetLastError\n GlobalAlloc\n GlobalUnlock\n FindResourceW\n CreateThread\n CompareStringW\n MapViewOfFile\n LoadLibraryA\n GetVolumeInformationW\n ResetEvent\n MulDiv\n FreeResource\n GetDriveTypeW\n GetVersion\n RaiseException\n GlobalAddAtomW\n FormatMessageW\n OpenProcess\n SwitchToThread\n GetExitCodeThread\n GetStringTypeW\n OutputDebugStringW\n GetCurrentThread\n GetFileAttributesExW\n IsBadReadPtr\n ExpandEnvironmentStringsW\n GetComputerNameA\n LoadLibraryExW\n TerminateProcess\n LockResource\n FileTimeToSystemTime\n GetCurrentThreadId\n UnhandledExceptionFilter\n GlobalFindAtomW\n VirtualQuery\n GlobalFree\n VirtualQueryEx\n Sleep\n EnterCriticalSection\n SetFilePointer\n ReleaseMutex\n LoadResource\n SuspendThread\n GetTickCount\n WaitForMultipleObjects\n GetFileSize\n GlobalDeleteAtom\n GetStartupInfoW\n GetFileAttributesW\n SetCurrentDirectoryW\n GetCurrentDirectoryW\n InitializeCriticalSection\n GetThreadPriority\n GetCurrentProcess\n GlobalLock\n SetThreadPriority\n VirtualAlloc\n GetTempPathW\n GetCommandLineW\n GetSystemInfo\n LeaveCriticalSection\n GetProcAddress\n ResumeThread\n GetLogicalDriveStringsW\n GetVersionExW\n VerifyVersionInfoW\n HeapCreate\n LCMapStringW\n GetDiskFreeSpaceW\n VerSetConditionMask\n FindFirstFileW\n GetUserDefaultUILanguage\n GetConsoleOutputCP\n UnmapViewOfFile\n GetConsoleCP\n lstrlenW\n CompareStringA\n QueryPerformanceCounter\n SetEndOfFile\n lstrcmpW\n InitializeCriticalSectionAndSpinCount\n HeapFree\n WideCharToMultiByte\n FindClose\n MultiByteToWideChar\n CreateMutexA\n LoadLibraryW\n SetEvent\n GetLocaleInfoW\n CreateFileW\n EnumResourceNamesW\n DeleteFileW\n IsDBCSLeadByteEx\n GetEnvironmentVariableW\n GetLocalTime\n WaitForSingleObject\n WriteFile\n CreateFileMappingW\n ExitThread\n DeleteCriticalSection\n GetDateFormatW\n GetTimeFormatW\n TlsGetValue\n SetErrorMode\n GetComputerNameW\n IsValidLocale\n SleepEx\n TlsSetValue\n GetSystemDefaultUILanguage\n EnumCalendarInfoW\n LocalAlloc\n RemoveDirectoryW\n CreateEventW\n WaitForMultipleObjectsEx\n GetThreadLocale\n SetThreadLocale\nwsock32.dll: gethostbyaddr\n WSACleanup\n gethostbyname\n bind\n gethostname\n closesocket\n WSAGetLastError\n connect\n inet_addr\n getpeername\n WSAAsyncSelect\n WSAAsyncGetServByName\n WSACancelAsyncRequest\n send\n ntohs\n htons\n WSAStartup\n getservbyname\n getsockname\n listen\n socket\n recv\n inet_ntoa\n ioctlsocket\n WSAAsyncGetHostByName\nole32.dll: RevokeDragDrop\n OleRegEnumVerbs\n IsAccelerator\n CoCreateInstance\n CoUninitialize\n CLSIDFromString\n RegisterDragDrop\n IsEqualGUID\n ProgIDFromCLSID\n CreateStreamOnHGlobal\n OleInitialize\n CoInitializeEx\n OleUninitialize\n CoGetClassObject\n CoInitialize\n CoTaskMemFree\n OleDraw\n CoTaskMemAlloc\n StringFromCLSID\n OleSetMenuDescriptor\n DoDragDrop\ngdi32.dll: Pie\n SetBkMode\n GetTextCharsetInfo\n GetRandomRgn\n CreateCompatibleBitmap\n CreatePolygonRgn\n BeginPath\n GetEnhMetaFileHeader\n CloseEnhMetaFile\n RectVisible\n AngleArc\n TranslateCharsetInfo\n ResizePalette\n SetAbortProc\n SetTextColor\n GetTextColor\n StretchBlt\n PathToRegion\n GetCharABCWidthsFloatW\n GetGlyphIndicesW\n ExtSelectClipRgn\n RoundRect\n SelectClipRgn\n RectInRegion\n RestoreDC\n FillPath\n SetRectRgn\n GetTextMetricsW\n GetWindowOrgEx\n CreatePalette\n GetTextCharset\n CreateDCW\n CreateICW\n FillRgn\n PolyBezierTo\n GetStockObject\n CreateSolidBrush\n GetFontUnicodeRanges\n Polygon\n MoveToEx\n PlayEnhMetaFile\n Ellipse\n ModifyWorldTransform\n StartPage\n GetBitmapBits\n StartDocW\n AbortDoc\n GetSystemPaletteEntries\n GetEnhMetaFileBits\n CreatePenIndirect\n GetEnhMetaFilePaletteEntries\n SetMapMode\n CreateFontIndirectW\n PolyBezier\n DPtoLP\n LPtoDP\n GetNearestColor\n EndDoc\n GetObjectW\n GetCurrentObject\n GetFontData\n GetWinMetaFileBits\n SetROP2\n GetTextExtentExPointW\n GetROP2\n GetOutlineTextMetricsW\n PtVisible\n GetEnhMetaFileDescriptionW\n ArcTo\n CreateEnhMetaFileW\n Arc\n CreateRectRgnIndirect\n TextOutW\n SelectPalette\n SetGraphicsMode\n SetLayout\n ExcludeClipRect\n SetTextJustification\n SetWindowOrgEx\n MaskBlt\n GetCharacterPlacementW\n CreatePatternBrush\n EndPage\n EndPath\n EqualRgn\n DeleteEnhMetaFile\n Chord\n SetDIBits\n SetViewportOrgEx\n GetViewportOrgEx\n CreateRectRgn\n RealizePalette\n GetObjectType\n SetDIBColorTable\n GetDIBColorTable\n OffsetClipRgn\n GetTextMetricsA\n CreateBrushIndirect\n PatBlt\n SetEnhMetaFileBits\n CreateEllipticRgn\n Rectangle\n DeleteDC\n SaveDC\n GetWorldTransform\n BitBlt\n FrameRgn\n SetWorldTransform\n GetDeviceCaps\n GetTextExtentPoint32W\n PtInRegion\n GetClipBox\n GetClipRgn\n Polyline\n IntersectClipRect\n CombineTransform\n CreateBitmap\n CombineRgn\n SetWinMetaFileBits\n CreateDIBitmap\n GetStretchBltMode\n CreateDIBSection\n SetStretchBltMode\n GetDIBits\n CreateFontIndirectA\n LineTo\n GetRgnBox\n EnumFontFamiliesW\n EnumFontsW\n SetWindowExtEx\n CreateHalftonePalette\n DeleteObject\n SelectObject\n ExtFloodFill\n UnrealizeObject\n CopyEnhMetaFileW\n OffsetRgn\n GetBkColor\n SetBkColor\n CreateCompatibleDC\n GetBrushOrgEx\n GetCurrentPositionEx\n GetNearestPaletteIndex\n SetTextAlign\n GetTextAlign\n CreateRoundRectRgn\n GetTextExtentPointW\n ExtTextOutW\n SetBrushOrgEx\n GetPixel\n GdiFlush\n GetTextFaceW\n SetViewportExtEx\n SetPixel\n EnumFontFamiliesExW\n StretchDIBits\n WidenPath\n GetPaletteEntries\nkernel32.dll (delay-loaded): GetFileType\n QueryDosDeviceW\n GetACP\n CloseHandle\n LocalFree\n GetCurrentProcessId\n SizeofResource\n TerminateThread\n QueryPerformanceFrequency\n SetProcessWorkingSetSize\n IsDebuggerPresent\n FindNextFileW\n GetFullPathNameW\n VirtualFree\n GetProcessHeap\n ExitProcess\n HeapAlloc\n GetCPInfoExW\n GlobalSize\n RtlUnwind\n GetCPInfo\n EnumSystemLocalesW\n GetStdHandle\n GetTimeZoneInformation\n FileTimeToLocalFileTime\n GetModuleHandleW\n FreeLibrary\n TryEnterCriticalSection\n HeapDestroy\n FileTimeToDosDateTime\n ReadFile\n GetUserDefaultLCID\n GetLastError\n GetModuleFileNameW\n SetLastError\n GlobalAlloc\n GlobalUnlock\n FindResourceW\n CreateThread\n CompareStringW\n MapViewOfFile\n LoadLibraryA\n GetVolumeInformationW\n ResetEvent\n MulDiv\n FreeResource\n GetDriveTypeW\n GetVersion\n RaiseException\n GlobalAddAtomW\n FormatMessageW\n OpenProcess\n SwitchToThread\n GetExitCodeThread\n GetStringTypeW\n OutputDebugStringW\n GetCurrentThread\n GetFileAttributesExW\n IsBadReadPtr\n ExpandEnvironmentStringsW\n GetComputerNameA\n LoadLibraryExW\n TerminateProcess\n LockResource\n FileTimeToSystemTime\n GetCurrentThreadId\n UnhandledExceptionFilter\n GlobalFindAtomW\n VirtualQuery\n GlobalFree\n VirtualQueryEx\n Sleep\n EnterCriticalSection\n SetFilePointer\n ReleaseMutex\n LoadResource\n SuspendThread\n GetTickCount\n WaitForMultipleObjects\n GetFileSize\n GlobalDeleteAtom\n GetStartupInfoW\n GetFileAttributesW\n SetCurrentDirectoryW\n GetCurrentDirectoryW\n InitializeCriticalSection\n GetThreadPriority\n GetCurrentProcess\n GlobalLock\n SetThreadPriority\n VirtualAlloc\n GetTempPathW\n GetCommandLineW\n GetSystemInfo\n LeaveCriticalSection\n GetProcAddress\n ResumeThread\n GetLogicalDriveStringsW\n GetVersionExW\n VerifyVersionInfoW\n HeapCreate\n LCMapStringW\n GetDiskFreeSpaceW\n VerSetConditionMask\n FindFirstFileW\n GetUserDefaultUILanguage\n GetConsoleOutputCP\n UnmapViewOfFile\n GetConsoleCP\n lstrlenW\n CompareStringA\n QueryPerformanceCounter\n SetEndOfFile\n lstrcmpW\n InitializeCriticalSectionAndSpinCount\n HeapFree\n WideCharToMultiByte\n FindClose\n MultiByteToWideChar\n CreateMutexA\n LoadLibraryW\n SetEvent\n GetLocaleInfoW\n CreateFileW\n EnumResourceNamesW\n DeleteFileW\n IsDBCSLeadByteEx\n GetEnvironmentVariableW\n GetLocalTime\n WaitForSingleObject\n WriteFile\n CreateFileMappingW\n ExitThread\n DeleteCriticalSection\n GetDateFormatW\n GetTimeFormatW\n TlsGetValue\n SetErrorMode\n GetComputerNameW\n IsValidLocale\n SleepEx\n TlsSetValue\n GetSystemDefaultUILanguage\n EnumCalendarInfoW\n LocalAlloc\n RemoveDirectoryW\n CreateEventW\n WaitForMultipleObjectsEx\n GetThreadLocale\n SetThreadLocale\n\nExports:\n--------\ndbkFCallWrapperAddr:\n Ordinal: 1\n Address: 0x00B0A648\n\n__dbk_fcall_wrapper:\n Ordinal: 2\n Address: 0x0001316C\n\n\nResources:\n----------\nBASIC:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 392648\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.03979\n\nBLACK:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 632474\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.40358\n\nBLUE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 629461\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.38328\n\nBLUEPRINT:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 408130\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.79472\n\nCARAMEL:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 517231\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.45167\n\nCOFFEE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 427858\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.77092\n\nDARKROOM:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 552169\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.32537\n\nDARKSIDE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 657696\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.27633\n\nDEFAULTSKINICONLARGE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2970\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.93178\n Detected Filetype: PNG graphic file\n\nDEFAULTSKINICONSMALL:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 841\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.70582\n Detected Filetype: PNG graphic file\n\nDEFAULTUSERSKINDATA:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 449884\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.1206\n\nDEVEXPRESSDARKSTYLE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 632434\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.29812\n\nDEVEXPRESSSTYLE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 713226\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.75435\n\nFOGGY:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 448912\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.8669\n\nGLASSOCEANS:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 407575\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.82211\n\nHIGHCONTRAST:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 349369\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.22293\n\nIMAGINARY:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 428106\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.98271\n\nLILIAN:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 427394\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.99915\n\nLIQUIDSKY:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 460727\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.9265\n\nLONDONLIQUIDSKY:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 454069\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.97707\n\nMCSKIN:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 485925\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.95053\n\nMETROPOLIS:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 617978\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.04259\n\nMETROPOLISDARK:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 636851\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.40651\n\nMONEYTWINS:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 995952\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.18537\n\nOFFICE2007BLACK:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 651624\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.68278\n\nOFFICE2007BLUE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 656344\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.6159\n\nOFFICE2007GREEN:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 650938\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.68461\n\nOFFICE2007PINK:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 653529\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.67542\n\nOFFICE2007SILVER:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 656142\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.67262\n\nOFFICE2010BLACK:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 655570\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.25224\n\nOFFICE2010BLUE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 702488\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.62031\n\nOFFICE2010SILVER:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 655204\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.45266\n\nOFFICE2013DARKGRAY:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 695957\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.91297\n\nOFFICE2013LIGHTGRAY:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 706232\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.8502\n\nOFFICE2013WHITE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 810216\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.16607\n\nOFFICE2016COLORFUL:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 672435\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.79291\n\nOFFICE2016DARK:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 670058\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.71935\n\nOFFICE2019BLACK:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 372492\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.92104\n\nOFFICE2019COLORFUL:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 373845\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.9163\n\nOFFICE2019DARKGRAY:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 373646\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.92917\n\nOFFICE2019WHITE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 375261\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.92395\n\nPUMPKIN:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 889258\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.5233\n\nSEVEN:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 887639\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.78871\n\nSEVENCLASSIC:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 723526\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.01114\n\nSHARP:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 508719\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.87009\n\nSHARPPLUS:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 537748\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.88953\n\nSILVER:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 551015\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.03051\n\nSPRINGTIME:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3920521\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.03097\n\nSTARDUST:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 497794\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.86685\n\nSUMMER2008:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2528764\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.19403\n\nTHEASPHALTWORLD:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 388167\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.74479\n\nTHEBEZIER:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 420659\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.91153\n\nVALENTINE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1978265\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.64581\n\nVISUALSTUDIO2013BLUE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 666983\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.98091\n\nVISUALSTUDIO2013DARK:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 747629\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.74274\n\nVISUALSTUDIO2013LIGHT:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 713307\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.76112\n\nVS2010:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 582724\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.32297\n\nWHITEPRINT:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 408630\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.06764\n\nXMAS2008BLUE:\n Type: DXSKINS\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2746608\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.66403\n\nCX_BACKBUTTON:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4778\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.94404\n Detected Filetype: PNG graphic file\n\nCX_CLOCKFACE:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 13546\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88\n Detected Filetype: PNG graphic file\n\nCX_CLOCKGLASS:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 8741\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.86413\n Detected Filetype: PNG graphic file\n\nCX_COMMANDLINKGLYPH:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 972\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.67671\n Detected Filetype: PNG graphic file\n\nCX_DATAROWFIXEDNONE:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 117\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.71906\n Detected Filetype: PNG graphic file\n\nCX_DATAROWFIXEDONBOTTOM:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 153\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.20847\n Detected Filetype: PNG graphic file\n\nCX_DATAROWFIXEDONTOP:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 154\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.117\n Detected Filetype: PNG graphic file\n\nCX_FIXEDGROUPINDICATOR:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 320\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.14129\n Detected Filetype: PNG graphic file\n\nCX_LOOKANDFEELSTYLEICON_FLAT16:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 822\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.95107\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_FLAT48:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9270\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.07825\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_NATIVE16:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 822\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.91815\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_NATIVE48:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9270\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.69514\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_OFFICE1116:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 822\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.50548\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_OFFICE1148:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9270\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.1877\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_STANDARD16:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1078\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.41483\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_STANDARD48:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9270\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.56675\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_ULTRAFLAT16:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 822\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.19295\n Detected Filetype: Bitmap graphic\n\nCX_LOOKANDFEELSTYLEICON_ULTRAFLAT48:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9270\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.97473\n Detected Filetype: Bitmap graphic\n\nCX_RATINGCONTROLINDICATOR:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1556\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.80381\n Detected Filetype: PNG graphic file\n\nDX_MAPPUSHPIN:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3113\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88674\n Detected Filetype: PNG graphic file\n\nDX_NAVIGATIONBARCUSTOMIZATIONBUTTON:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 193\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.28168\n Detected Filetype: PNG graphic file\n\nDX_SEARCHBUTTONGLYPH:\n Type: PNG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 418\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.90065\n Detected Filetype: PNG graphic file\n\nCXEDIT_GLYPH_ERROR:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 568\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.4707\n\nCXEDIT_GLYPH_INFO:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 773\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.6317\n\nCXEDIT_GLYPH_WARNING:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.54468\n\nCX_ARROWBITMAP:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 336\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.31976\n\nCX_CALENDARBUTTON:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 824\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.51986\n\nCX_CLEARBUTTON:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 458\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.19984\n\nCX_DATAROWFIXEDNONE (#2):\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 257\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.39795\n\nCX_DATAROWFIXEDONBOTTOM (#2):\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 385\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.28039\n\nCX_DATAROWFIXEDONTOP (#2):\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 386\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.28109\n\nCX_DOWN:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 647\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.48306\n\nCX_EDITBITMAP:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 415\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.42433\n\nCX_FILTERBITMAP:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 317\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.36397\n\nCX_GROUPBYBOXSEARCHBUTTON:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 587\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.22382\n\nCX_INPLACEEDITBITMAP:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 429\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.28476\n\nCX_INSERTBITMAP:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 429\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.28476\n\nCX_MULTIARROWBITMAP:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 310\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.42971\n\nCX_MULTIDOTBITMAP:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 319\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.34395\n\nCX_SMARTTAG:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 623\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.26675\n\nCX_SORTBYSUMMARYVALUE:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 446\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.06562\n\nCX_UP:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 646\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.49047\n\nDX_FILTERCONTROLADDBUTTON:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 454\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.23254\n\nDX_FILTERCONTROLREMOVEBUTTON:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 716\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.85024\n\nDX_FILTERPANELREMOVEBUTTON:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 631\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.16361\n\nDX_PASSWORDREVEALINVISIBLEBUTTON:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 602\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.47557\n\nDX_PASSWORDREVEALVISIBLEBUTTON:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 911\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.31247\n\nDX_PIN:\n Type: SVG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 708\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.50335\n\n1:\n Type: RT_CURSOR\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.14151\n\n2:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.80231\n\n3:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.00046\n\n4:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.56318\n\n5:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.6949\n\n6:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.62527\n\n7:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.91604\n\n8:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.576453\n\n9:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.689326\n\n10:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.476246\n\n11:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.454895\n\n12:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.733178\n\n13:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.836149\n\n14:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.787415\n\n15:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.47067\n\n16:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.697878\n\n17:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.902945\n\n18:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.71419\n\n19:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.99434\n\n20:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.938912\n\n21:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.05969\n\n22:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.591048\n\n23:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.692732\n\n24:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.692569\n\n25:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.748841\n\n26:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.840899\n\n27:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.841059\n\n28:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.35706\n\n29:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.77516\n\n30:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.493939\n\n31:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.598455\n\n32:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.482178\n\n33:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.46661\n\n34:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.94672\n\n35:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3244\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.773365\n\n36:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.94672\n\n37:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3244\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.773365\n\n38:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.841214\n\n39:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3244\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.711323\n\n40:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.516503\n\n41:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.533632\n\n42:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.443345\n\n43:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.489437\n\n44:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.443345\n\n45:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.489437\n\n46:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.454962\n\n47:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.472779\n\n48:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.454962\n\n49:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.472779\n\n50:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.873215\n\n51:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.897314\n\n52:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.699505\n\n53:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.692865\n\n54:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.707519\n\n55:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.841358\n\n56:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.580793\n\n57:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.708058\n\n58:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.557228\n\n59:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.698536\n\n60:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.778059\n\n61:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.800326\n\n62:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.891475\n\n63:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.918294\n\n64:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.894286\n\n65:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.05551\n\n66:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.824634\n\n67:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.901645\n\n68:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.736642\n\n69:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3244\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.535273\n\n70:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.73268\n\n71:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3244\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.535273\n\n72:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.621542\n\n73:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3244\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.470425\n\n74:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.19424\n\n75:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.31665\n\n76:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.38496\n\n77:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3244\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.15859\n\n78:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 300\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.48952\n\n79:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.38701\n\n80:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.475108\n\n81:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.877765\n\n82:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.35311\n\n83:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.35706\n\n84:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.37092\n\n85:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.388534\n\n86:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.458239\n\n87:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.77592\n\n88:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.35388\n\n89:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.483042\n\n90:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.483529\n\n91:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.476246\n\n92:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.56287\n\n93:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.6633\n\n102:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.40392\n\n103:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.435441\n\n104:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.435847\n\n105:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.700205\n\n106:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.72859\n\n107:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4268\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.778747\n\n111:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.356038\n\n112:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.384864\n\n113:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.90609\n\n114:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16940\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.356038\n\n115:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9644\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.384864\n\n116:\n Type: RT_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.94133\n\nCXBMBLOB_BLOB:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 664\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.21261\n\nCXBMBLOB_BLOB_NULL:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 664\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.45952\n\nCXBMBLOB_MEMO:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 664\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.87218\n\nCXBMBLOB_MEMO_NULL:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 664\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.45952\n\nCXBMBLOB_OLE:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 664\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.92557\n\nCXBMBLOB_OLE_NULL:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 664\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.64339\n\nCXBMBLOB_PICT:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 664\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 6.00448\n\nCXBMBLOB_PICT_NULL:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 664\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.0098\n\nCXEDIT_GLYPH_ERROR (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.56046\n\nCXEDIT_GLYPH_INFO (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.78064\n\nCXEDIT_GLYPH_WARNING (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.96087\n\nCXNAVIGATORBUTTONS:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 8048\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.99946\n\nCX_ARROWBITMAP (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 140\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.84802\n\nCX_DROPARROW:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 364\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.09162\n\nCX_DROPARROW_150:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 768\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.07197\n\nCX_DROPARROW_200:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1264\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.03879\n\nCX_EDITBITMAP (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 140\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.0601\n\nCX_FILTERBITMAP (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 140\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.01358\n\nCX_FULLSCROLLBITMAP:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 568\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.07418\n\nCX_HORSCROLLBITMAP:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 568\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.01517\n\nCX_INPLACEEDITBITMAP (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 256\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4.31849\n\nCX_INSERTBITMAP (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 140\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.0601\n\nCX_MULTIARROWBITMAP (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 140\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.04925\n\nCX_MULTIDOTBITMAP (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 140\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.9371\n\nCX_SCROLLBITMAPNESW:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3404\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.512834\n\nCX_SCROLLBITMAPNS:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3404\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.512834\n\nCX_SCROLLBITMAPNWSE:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3404\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.18306\n\nCX_SCROLLBITMAPWE:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3404\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.512834\n\nCX_SORTBYSUMMARYVALUE (#2):\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 140\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.03605\n\nCX_VERSCROLLBITMAP:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 568\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.941\n\nCX_ZOOMINBUTTONGLYPH:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.37076\n\nCX_ZOOMOUTBUTTONGLYPH:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 0.92557\n\nDXEXPANDBUTTON_MINUS:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 524\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.63296\n\nDXEXPANDBUTTON_PLUS:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 524\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.72678\n\nDXSUBMENUEXPAND:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1320\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.95444\n\n1 (#2):\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 387\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.24043\n Detected Filetype: PNG graphic file\n\n2 (#2):\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 512\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.43683\n Detected Filetype: PNG graphic file\n\n3 (#2):\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 625\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.51744\n Detected Filetype: PNG graphic file\n\n4 (#2):\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 973\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.71103\n Detected Filetype: PNG graphic file\n\n5 (#2):\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1211\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.80385\n Detected Filetype: PNG graphic file\n\n6 (#2):\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1469\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.86111\n Detected Filetype: PNG graphic file\n\n7 (#2):\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1947\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88021\n Detected Filetype: PNG graphic file\n\n8 (#2):\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 8104\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.9117\n Detected Filetype: PNG graphic file\n\n3998:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 856\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.28907\n\n3999:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1064\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.2383\n\n4000:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1460\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.45896\n\n4001:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 884\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.35615\n\n4002:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 688\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.39708\n\n4003:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1608\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.25623\n\n4004:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 852\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.27593\n\n4005:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 412\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.45641\n\n4006:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 336\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.33839\n\n4007:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 304\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.28148\n\n4008:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 388\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.44438\n\n4009:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 480\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.33625\n\n4010:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 464\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.46985\n\n4011:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 624\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.35158\n\n4012:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 444\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.39737\n\n4013:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 504\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.40738\n\n4014:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 340\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.45014\n\n4015:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 496\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.48175\n\n4016:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 320\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.303\n\n4017:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 416\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.39955\n\n4018:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31507\n\n4019:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 440\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.47255\n\n4020:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 472\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.43704\n\n4021:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 332\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.41524\n\n4022:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 776\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.32212\n\n4023:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1024\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.28021\n\n4024:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1756\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.22714\n\n4025:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1928\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.29081\n\n4026:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 440\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.29762\n\n4027:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 284\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.47583\n\n4028:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 212\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.45085\n\n4029:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 712\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31609\n\n4030:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 320\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.37447\n\n4031:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 456\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.08484\n\n4032:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 708\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.22777\n\n4033:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.35162\n\n4034:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 344\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31597\n\n4035:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 456\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.34277\n\n4036:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.38574\n\n4037:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4440\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.1204\n\n4038:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2400\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.224\n\n4039:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2452\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.18348\n\n4040:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2344\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.18617\n\n4041:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1672\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.19955\n\n4042:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 488\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.36005\n\n4043:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1176\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.40081\n\n4044:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1396\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.18951\n\n4045:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1344\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31222\n\n4046:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1228\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.33018\n\n4047:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1228\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.37154\n\n4048:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1032\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.28652\n\n4049:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.24094\n\n4050:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 964\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.32652\n\n4051:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1236\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.21476\n\n4052:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 524\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31721\n\n4053:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 908\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.23181\n\n4054:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1220\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.27989\n\n4055:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1224\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.27271\n\n4056:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2744\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.28182\n\n4057:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2364\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.30529\n\n4058:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1080\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.28579\n\n4059:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 860\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.3585\n\n4060:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1656\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.35051\n\n4061:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1176\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31689\n\n4062:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 876\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.33929\n\n4063:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 628\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.41819\n\n4064:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 416\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.39545\n\n4065:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 916\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.39142\n\n4066:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 880\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.26592\n\n4067:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 912\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.22975\n\n4068:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 636\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.37224\n\n4069:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 816\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.32765\n\n4070:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1132\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.28691\n\n4071:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 860\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31349\n\n4072:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1100\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.30049\n\n4073:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 344\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.42093\n\n4074:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 212\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.40358\n\n4075:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 404\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.45344\n\n4076:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 692\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.33871\n\n4077:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 992\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.3395\n\n4078:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1016\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.30476\n\n4079:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1068\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.23623\n\n4080:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1252\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.28886\n\n4081:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 540\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.23935\n\n4082:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.42191\n\n4083:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1140\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.32815\n\n4084:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1448\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.29144\n\n4085:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1216\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31952\n\n4086:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 952\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.20276\n\n4087:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1016\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.35803\n\n4088:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1108\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.32373\n\n4089:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 492\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.33528\n\n4090:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 196\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.36848\n\n4091:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 420\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.42061\n\n4092:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 852\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.34802\n\n4093:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1176\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.31262\n\n4094:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.3639\n\n4095:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.27523\n\n4096:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 872\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.19144\n\nBBABORT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3421\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89162\n Detected Filetype: PNG graphic file\n\nBBABORT_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3415\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89925\n Detected Filetype: PNG graphic file\n\nBBALL:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3324\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88971\n Detected Filetype: PNG graphic file\n\nBBALL_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3289\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88726\n Detected Filetype: PNG graphic file\n\nBBCANCEL:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3421\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89162\n Detected Filetype: PNG graphic file\n\nBBCANCEL_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3415\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89925\n Detected Filetype: PNG graphic file\n\nBBCLOSE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3150\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88443\n Detected Filetype: PNG graphic file\n\nBBCLOSE_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3150\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.8746\n Detected Filetype: PNG graphic file\n\nBBHELP:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3253\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88589\n Detected Filetype: PNG graphic file\n\nBBHELP_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3248\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88975\n Detected Filetype: PNG graphic file\n\nBBIGNORE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3414\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88943\n Detected Filetype: PNG graphic file\n\nBBIGNORE_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3399\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88308\n Detected Filetype: PNG graphic file\n\nBBNO:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3522\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89641\n Detected Filetype: PNG graphic file\n\nBBNO_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3525\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89332\n Detected Filetype: PNG graphic file\n\nBBOK:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3315\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88545\n Detected Filetype: PNG graphic file\n\nBBOK_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3309\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89033\n Detected Filetype: PNG graphic file\n\nBBRETRY:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3497\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89289\n Detected Filetype: PNG graphic file\n\nBBRETRY_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3494\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89259\n Detected Filetype: PNG graphic file\n\nBBYES:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3315\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88545\n Detected Filetype: PNG graphic file\n\nBBYES_DISABLED:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3309\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89033\n Detected Filetype: PNG graphic file\n\nDBEDIT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2851\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.86863\n Detected Filetype: PNG graphic file\n\nDBEDIT_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2939\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.8721\n Detected Filetype: PNG graphic file\n\nDBGARROW:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2875\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87425\n Detected Filetype: PNG graphic file\n\nDBGARROW_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2977\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87406\n Detected Filetype: PNG graphic file\n\nDBINSERT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2933\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87679\n Detected Filetype: PNG graphic file\n\nDBINSERT_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3035\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87878\n Detected Filetype: PNG graphic file\n\nDBMULTIARROW:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2959\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87319\n Detected Filetype: PNG graphic file\n\nDBMULTIARROW_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3132\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87994\n Detected Filetype: PNG graphic file\n\nDBMULTIDOT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2872\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87516\n Detected Filetype: PNG graphic file\n\nDBMULTIDOT_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2941\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.8724\n Detected Filetype: PNG graphic file\n\nDBN_APPLYUPDATES:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3070\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88307\n Detected Filetype: PNG graphic file\n\nDBN_APPLYUPDATES_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3332\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89104\n Detected Filetype: PNG graphic file\n\nDBN_CANCEL:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3086\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88536\n Detected Filetype: PNG graphic file\n\nDBN_CANCELUPDATES:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3099\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88515\n Detected Filetype: PNG graphic file\n\nDBN_CANCELUPDATES_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3382\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88809\n Detected Filetype: PNG graphic file\n\nDBN_CANCEL_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3343\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88897\n Detected Filetype: PNG graphic file\n\nDBN_DELETE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2823\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.86505\n Detected Filetype: PNG graphic file\n\nDBN_DELETE_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2857\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.86626\n Detected Filetype: PNG graphic file\n\nDBN_EDIT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2939\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.8754\n Detected Filetype: PNG graphic file\n\nDBN_EDIT_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3028\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.8824\n Detected Filetype: PNG graphic file\n\nDBN_FIRST:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2957\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87733\n Detected Filetype: PNG graphic file\n\nDBN_FIRST_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3091\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87983\n Detected Filetype: PNG graphic file\n\nDBN_INSERT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2845\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.86506\n Detected Filetype: PNG graphic file\n\nDBN_INSERT_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2885\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.86961\n Detected Filetype: PNG graphic file\n\nDBN_LAST:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2950\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87466\n Detected Filetype: PNG graphic file\n\nDBN_LAST_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3072\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87807\n Detected Filetype: PNG graphic file\n\nDBN_NEXT:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2938\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.8754\n Detected Filetype: PNG graphic file\n\nDBN_NEXT_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3062\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88351\n Detected Filetype: PNG graphic file\n\nDBN_POST:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3051\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88381\n Detected Filetype: PNG graphic file\n\nDBN_POST_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3205\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88693\n Detected Filetype: PNG graphic file\n\nDBN_PRIOR:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2947\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.87443\n Detected Filetype: PNG graphic file\n\nDBN_PRIOR_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3075\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.8801\n Detected Filetype: PNG graphic file\n\nDBN_REFRESH:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3116\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88464\n Detected Filetype: PNG graphic file\n\nDBN_REFRESH_20X:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3397\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.88955\n Detected Filetype: PNG graphic file\n\nDVCLAL:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 4\n\nFILTERCONTROLIMAGES:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 18256\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.77418\n Detected Filetype: Zip Compressed Archive\n\nMSG_ERROR:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5259\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.93139\n Detected Filetype: PNG graphic file\n\nMSG_INFO:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4382\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.90721\n Detected Filetype: PNG graphic file\n\nMSG_WARNING:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3468\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 7.89203\n Detected Filetype: PNG graphic file\n\nPACKAGEINFO:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 9308\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.51388\n\nPLATFORMTARGETS:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1\n\nTDV_CREAT_MAIN:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1719\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.58283\n\nTDXFRMCOMMONFILEDIALOG:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 43833\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.18698\n\nTDXLAYOUTCONTROLCUSTOMIZEFORM:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 81046\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.97717\n\nTDXMESSAGEDIALOGFORM:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1250\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.37099\n\nTFMFILTERCONTROLDIALOG:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2821\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.40815\n\nTFMSHELLDIALOGCOLUMNCUSTOMIZATION:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 5238\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.39429\n\nTFORMULARIOBLOQUEIO:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3016\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.86649\n\nTFRMRECORTE:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 715\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.38095\n\nTLAYOUTEDITFORM:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1720\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.33516\n\nTLOGINDIALOG:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1160\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.40016\n\nTMESA_BRANCA:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 352\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.23166\n\nTPAIT_GRAFIC:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 442\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.26042\n\nTPASSWORDDIALOG:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 964\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.41548\n\nCURSOR_1:\n Type: RT_GROUP_CURSOR\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.83876\n Detected Filetype: Cursor file\n\nCXDROPAFTERCOPY:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCXDROPBEFORECOPY:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.71817\n Detected Filetype: Cursor file\n\nCXDROPINSIDECOPY:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCXEDIT_MOUSEWHEEL:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 34\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.30604\n Detected Filetype: Cursor file\n\nCX_COLORPICKERCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_CROSSCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_DOWNSCROLLCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_DRAGCOPYCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_DRAGCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.71817\n Detected Filetype: Cursor file\n\nCX_FULLSCROLLCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_HANDCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.1815\n Detected Filetype: Cursor file\n\nCX_HANDDRAGCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.1815\n Detected Filetype: Cursor file\n\nCX_HANDPOINT:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_HANDPOINTCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_HORSCROLLCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_HORZRESIZECURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_HORZSIZECURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_LEFTARROWCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.71521\n Detected Filetype: Cursor file\n\nCX_LEFTSCROLLCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_MULTIDRAGCOPYCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_MULTIDRAGCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_NODROPCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.70244\n Detected Filetype: Cursor file\n\nCX_REMOVECURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.71817\n Detected Filetype: Cursor file\n\nCX_RIGHTARROWCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.71521\n Detected Filetype: Cursor file\n\nCX_RIGHTSCROLLCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.71817\n Detected Filetype: Cursor file\n\nCX_TASKLINKCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_UPSCROLLCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.71817\n Detected Filetype: Cursor file\n\nCX_VERSCROLLCURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nCX_VERTSIZECURSOR:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.67355\n Detected Filetype: Cursor file\n\nDXLAYOUTCONTROLDROPAFTER:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nDXLAYOUTCONTROLDROPBEFORE:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nDXLAYOUTCONTROLDROPINSIDE:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nDXLAYOUTCONTROLNODROP:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\nDXLAYOUTCONTROLREMOVE:\n Type: RT_GROUP_CURSOR\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.75983\n Detected Filetype: Cursor file\n\n32761:\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n32762:\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 1.91924\n Detected Filetype: Cursor file\n\n32763:\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n32764:\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n32765:\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n32766:\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n32767:\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\nMAINICON:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 2.6162\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 500\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 3.14455\n\n1 (#4):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1803\n TimeDateStamp: 2025-Nov-17 17:35:38\n Entropy: 5.27093\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n FileDescription: WinLSP\n FileVersion (#2): 1.0.0.0\n ProductName: WinLSP\n ProductVersion (#2): 1.0.0.0\n ProgramID: com.embarcadero.WinLSP\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x00F39000\nEndAddressOfRawData: 0x00F39060\nAddressOfIndex: 0x00ED9C38\nAddressOfCallbacks: 0x00F3A010\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: (EMPTY)\n\nDelayed Imports:\n----------------\nAttributes: 0x00000001\nName: kernel32.dll\nModuleHandle: 0x00B36240\nDelayImportAddressTable: 0x00B36288\nDelayImportNameTable: 0x00B3643C\nBoundDelayImportTable: 0x00B365F0\nUnloadDelayImportTable: 0x00B36760\nTimeStamp: 1970-Jan-01 00:00:00\n\n[ SUSPICIOUS ] PEiD Signature:\n Crunch 4\n\nInteresting strings found in the binary:\n Contains domain names:\n .zapto.org\n accounts.google.com\n adobe.com\n google.com\n googleapis.com\n graph.microsoft.com\n http://ns.adobe.com\n http://ns.adobe.com/xap/1.0/\n http://ns.adobe.com/xap/1.0/mm/\n http://ns.adobe.com/xap/1.0/rights/\n http://ns.adobe.com/xap/1.0/sType/ResourceRef#\n http://www.indyproject.org\n http://www.indyproject.org/\n http://www.microsoft.com\n http://www.microsoft.com/downloads\n http://www.w3.org\n http://www.w3.org/1999/02/22-rdf-syntax-ns#\n http://www.w3.org/1999/xlink\n http://www.w3.org/1999/xlink"\n http://www.w3.org/2000/svg\n https://accounts.google.com\n https://accounts.google.com/o/oauth2/revoke?token\n https://accounts.google.com/o/oauth2/v2/auth?scope\n https://google.com\n https://graph.microsoft.com\n https://graph.microsoft.com/v1.0/me/\n https://login.microsoftonline.com\n https://login.microsoftonline.com/common/oauth2/v2.0/authorize?access_type\n https://login.microsoftonline.com/common/oauth2/v2.0/revoke?token\n https://www.google.com\n https://www.google.com/sorry/index\n https://www.googleapis.com\n https://www.googleapis.com/userinfo/v2/me\n indyproject.org\n login.microsoftonline.com\n microsoft.com\n microsoftonline.com\n ns.adobe.com\n www.google.com\n www.googleapis.com\n www.indyproject.org\n www.microsoft.com\n www.w3.org\n zapto.org\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to MD5\n Uses constants related to SHA1\n Uses constants related to Blowfish\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .itext\n Unusual section name found: .didata\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExW\n GetProcAddress\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n FindWindowW\n SwitchToThread\n Code injection capabilities (PowerLoader):\n GetWindowLongW\n FindWindowW\n Can access the registry:\n RegSetValueExW\n RegEnumKeyExW\n RegLoadKeyW\n RegDeleteKeyW\n RegOpenKeyExW\n RegQueryInfoKeyW\n RegUnLoadKeyW\n RegSaveKeyW\n RegDeleteValueW\n RegReplaceKeyW\n RegFlushKey\n RegQueryValueExW\n RegEnumValueW\n RegCloseKey\n RegCreateKeyExW\n RegRestoreKeyW\n Possibly launches other programs:\n ShellExecuteW\n Can create temporary files:\n GetTempPathW\n CreateFileW\n Uses functions commonly found in keyloggers:\n CallNextHookEx\n GetAsyncKeyState\n MapVirtualKeyW\n GetForegroundWindow\n Has Internet access capabilities:\n InternetCloseHandle\n InternetGetConnectedState\n InternetReadFile\n InternetConnectW\n InternetOpenW\n InternetOpenUrlW\n WinHttpGetIEProxyConfigForCurrentUser\n WinHttpSetTimeouts\n WinHttpSetStatusCallback\n WinHttpConnect\n WinHttpReceiveResponse\n WinHttpQueryAuthSchemes\n WinHttpGetProxyForUrl\n WinHttpReadData\n WinHttpCloseHandle\n WinHttpQueryHeaders\n WinHttpOpenRequest\n WinHttpAddRequestHeaders\n WinHttpOpen\n WinHttpWriteData\n WinHttpSetCredentials\n WinHttpQueryDataAvailable\n WinHttpSetOption\n WinHttpSendRequest\n WinHttpQueryOption\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n GetLogicalDriveStringsW\n Manipulates other processes:\n OpenProcess\n Can take screenshots:\n GetDC\n GetDCEx\n FindWindowW\n BitBlt\n CreateCompatibleDC\n Reads the contents of the clipboard:\n GetClipboardData\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resource BLACK is possibly compressed or encrypted.\n Resource BLUE is possibly compressed or encrypted.\n Resource DARKSIDE is possibly compressed or encrypted.\n Resource DEFAULTUSERSKINDATA is possibly compressed or encrypted.\n Resource MONEYTWINS is possibly compressed or encrypted.\n Resource PUMPKIN is possibly compressed or encrypted.\n Resource SILVER is possibly compressed or encrypted.\n The binary may have been compiled on a machine in the UTC-3 timezone.\n Resources amount for 77.3092% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"architecture":"IMAGE_FILE_MACHINE_I386","subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","compilation_date":"2025-11-17T20:35:38","detected_languages":["English - United States","Portuguese - Brazil"],"file_description":"WinLSP","file_version":"1.0.0.0","product_name":"WinLSP","product_version":"1.0.0.0","program_id":"com.embarcadero.WinLSP"},"DOS Header":{"e_magic":"MZ","e_cblp":"0x0050","e_cp":"0x0002","e_crlc":"0x0000","e_cparhdr":"0x0004","e_minalloc":"0x000F","e_maxalloc":"0xFFFF","e_ss":"0x0000","e_sp":"0x00B8","e_csum":"0x0000","e_ip":"0x0000","e_cs":"0x0000","e_ovno":"0x001A","e_oemid":"0x0000","e_oeminfo":"0x0000","e_lfanew":"0x00000100"},"PE Header":{"Signature":"PE","Machine":"IMAGE_FILE_MACHINE_I386","NumberofSections":11,"TimeDateStamp":"2025-Nov-17 20:35:38","PointerToSymbolTable":"0x00000000","NumberOfSymbols":0,"SizeOfOptionalHeader":"0x00E0","Characteristics":["IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE_IMAGE"]},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"2.0","SizeOfCode":"0x00AD7200","SizeOfInitializedData":"0x02A96C00","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x00AD81E4","BaseOfCode":"0x00001000","BaseOfData":"0x00AD9000","ImageBase":"0x00400000","SectionAlignment":"0x00001000","FileAlignment":"0x00000200","OperatingSystemVersion":"6.0","ImageVersion":"0.0","SubsystemVersion":"6.0","Win32VersionValue":"0","SizeOfImage":"0x035A0000","SizeOfHeaders":"0x00000400","Checksum":"0x00000000","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":["IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00004000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"16"},"Sections":{"sections":[{"name":".text","VirtualSize":"0x00AD0C04","VirtualAddress":"0x00001000","SizeOfRawData":"0x00AD0E00","PointerToRawData":"0x00000400","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"Entropy":6.49067},{"name":".itext","VirtualSize":"0x00006240","VirtualAddress":"0x00AD2000","SizeOfRawData":"0x00006400","PointerToRawData":"0x00AD1200","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"Entropy":6.31899},{"name":".data","VirtualSize":"0x0002D1E4","VirtualAddress":"0x00AD9000","SizeOfRawData":"0x0002D200","PointerToRawData":"0x00AD7600","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"],"Entropy":5.64362},{"name":".bss","VirtualSize":"0x000298FC","VirtualAddress":"0x00B07000","SizeOfRawData":"0x00000000","PointerToRawData":"0x00000000","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"]},{"name":".idata","VirtualSize":"0x00004C18","VirtualAddress":"0x00B31000","SizeOfRawData":"0x00004E00","PointerToRawData":"0x00B04800","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"],"Entropy":5.1625},{"name":".didata","VirtualSize":"0x000011B0","VirtualAddress":"0x00B36000","SizeOfRawData":"0x00001200","PointerToRawData":"0x00B09600","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"],"Entropy":4.40898},{"name":".edata","VirtualSize":"0x0000006F","VirtualAddress":"0x00B38000","SizeOfRawData":"0x00000200","PointerToRawData":"0x00B0A800","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":1.32437},{"name":".tls","VirtualSize":"0x00000060","VirtualAddress":"0x00B39000","SizeOfRawData":"0x00000000","PointerToRawData":"0x00000000","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"]},{"name":".rdata","VirtualSize":"0x0000005D","VirtualAddress":"0x00B3A000","SizeOfRawData":"0x00000200","PointerToRawData":"0x00B0AA00","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":1.38389},{"name":".reloc","VirtualSize":"0x0010D040","VirtualAddress":"0x00B3B000","SizeOfRawData":"0x0010D200","PointerToRawData":"0x00B0AC00","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"Entropy":6.62953},{"name":".rsrc","VirtualSize":"0x02956400","VirtualAddress":"0x00C49000","SizeOfRawData":"0x02956400","PointerToRawData":"0x00C17E00","PointerToRelocations":"0x00000000","PointerToLineNumbers":"0x00000000","NumberOfLineNumbers":0,"NumberOfRelocations":0,"Characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"Entropy":6.36329}]},"Imports":{"entities":[{"library":"shlwapi.dll","functions":["SHCreateStreamOnFileW"]},{"library":"wininet.dll","functions":["InternetCloseHandle","InternetGetConnectedState","InternetReadFile","HttpOpenRequestW","HttpSendRequestW","InternetConnectW","InternetOpenW","InternetOpenUrlW"]},{"library":"winspool.drv","functions":["DocumentPropertiesW","ClosePrinter","OpenPrinterW","GetDefaultPrinterW","EnumPrintersW"]},{"library":"comctl32.dll","functions":["ImageList_GetImageInfo","FlatSB_SetScrollInfo","InitCommonControls","ImageList_DragMove","ImageList_Destroy","_TrackMouseEvent","ImageList_DragShowNolock","ImageList_Add","FlatSB_SetScrollProp","ImageList_GetDragImage","ImageList_Create","ImageList_EndDrag","ImageList_DrawEx","ImageList_AddMasked","ImageList_SetImageCount","FlatSB_GetScrollPos","FlatSB_SetScrollPos","InitializeFlatSB","ImageList_Copy","FlatSB_GetScrollInfo","ImageList_Write","ImageList_DrawIndirect","ImageList_SetBkColor","ImageList_GetBkColor","ImageList_BeginDrag","ImageList_GetIcon","ImageList_Replace","ImageList_GetImageCount","ImageList_DragEnter","ImageList_GetIconSize","ImageList_SetIconSize","ImageList_Read","ImageList_DragLeave","ImageList_LoadImageW","ImageList_Draw","ImageList_Remove","ImageList_ReplaceIcon","ImageList_SetOverlayImage"]},{"library":"shell32.dll","functions":["SHGetMalloc","SHGetFolderPathW","SHGetFileInfoW","SHGetDesktopFolder","DragQueryFileW","SHGetSpecialFolderLocation","Shell_NotifyIconW","SHAppBarMessage","ShellExecuteW","ShellExecuteExW"]},{"library":"user32.dll","functions":["CopyImage","MoveWindow","SetMenuItemInfoW","GetMenuItemInfoW","DefFrameProcW","GetCaretPos","ScrollWindowEx","GetDlgCtrlID","GetUpdateRgn","FrameRect","RegisterWindowMessageW","GetMenuStringW","FillRect","SendMessageA","IsClipboardFormatAvailable","EnumWindows","ShowOwnedPopups","GetClassInfoW","GetScrollRange","SetActiveWindow","GetActiveWindow","DrawEdge","GetKeyboardLayoutList","LoadBitmapW","EnumChildWindows","SendNotifyMessageW","GetScrollBarInfo","UnhookWindowsHookEx","SetCapture","GetCapture","ChildWindowFromPointEx","CreatePopupMenu","ShowCaret","GetMenuItemID","CharLowerBuffW","ChangeDisplaySettingsW","PostMessageW","SetWindowLongW","IsZoomed","SetParent","DrawMenuBar","InvalidateRgn","SetSystemCursor","GetClientRect","IsChild","IntersectRect","IsIconic","CallNextHookEx","ShowWindow","SetForegroundWindow","GetWindowTextW","GetAsyncKeyState","GetWindowTextLengthW","DestroyWindow","IsDialogMessageW","RegisterClassW","EndMenu","CharNextW","GetFocus","GetDC","SetFocus","ReleaseDC","mouse_event","ExitWindowsEx","GetClassLongW","SetScrollRange","DrawTextW","PeekMessageA","TabbedTextOutW","MessageBeep","SetClassLongW","SetRectEmpty","LockWindowUpdate","RemovePropW","GetSubMenu","EqualRect","DestroyIcon","IsWindowVisible","DispatchMessageA","PtInRect","UnregisterClassW","GetTopWindow","SendMessageW","GetTabbedTextExtentW","GetMessageTime","NotifyWinEvent","CreateMenu","LoadStringW","CharLowerW","SetWindowRgn","SetWindowPos","GetWindowRgn","GetMenuItemCount","GetSysColorBrush","GetWindowDC","DrawTextExW","CharLowerBuffA","EnumClipboardFormats","GetScrollInfo","SetWindowTextW","GetMessageExtraInfo","GetSysColor","EnableScrollBar","TrackPopupMenu","DrawIconEx","keybd_event","GetClassNameW","GetMessagePos","GetIconInfo","SetScrollInfo","GetKeyNameTextW","GetDesktopWindow","SetCursorPos","GetCursorPos","SetMenu","GetMenuState","GetMenu","SetRect","GetKeyState","IsRectEmpty","ValidateRect","IsCharAlphaW","GetCursor","KillTimer","BeginDeferWindowPos","WaitMessage","TranslateMDISysAccel","GetWindowPlacement","CreateIconIndirect","CreateWindowExW","ChildWindowFromPoint","GetMessageW","GetDCEx","PeekMessageW","MonitorFromWindow","GetUpdateRect","SetTimer","WindowFromPoint","BeginPaint","RegisterClipboardFormatW","MapVirtualKeyW","OffsetRect","IsWindowUnicode","DispatchMessageW","CreateAcceleratorTableW","DefMDIChildProcW","GetSystemMenu","SetScrollPos","GetScrollPos","InflateRect","DrawFocusRect","ReleaseCapture","LoadCursorW","GetGUIThreadInfo","ScrollWindow","GetLastActivePopup","SetMenuInfo","GetMenuInfo","GetSystemMetrics","CharUpperBuffW","ClientToScreen","SetClipboardData","GetClipboardData","SetWindowPlacement","GetMonitorInfoW","CheckMenuItem","CharUpperW","DefWindowProcW","GetForegroundWindow","ToAscii","EnableWindow","GetWindowThreadProcessId","RedrawWindow","EndPaint","MsgWaitForMultipleObjectsEx","LoadKeyboardLayoutW","EnumDisplaySettingsW","ActivateKeyboardLayout","GetParent","MonitorFromRect","InsertMenuItemW","GetPropW","MessageBoxW","SetPropW","UpdateWindow","MsgWaitForMultipleObjects","DestroyMenu","SetWindowsHookExW","GetDoubleClickTime","GetAncestor","AdjustWindowRectEx","DrawIcon","IsWindow","EnumThreadWindows","InvalidateRect","LookupIconIdFromDirectoryEx","SetKeyboardState","GetKeyboardState","DrawFrameControl","ScreenToClient","IsCharAlphaNumericW","WindowFromDC","BringWindowToTop","SetCursor","CreateIcon","RemoveMenu","AppendMenuW","SubtractRect","GetKeyboardLayoutNameW","OpenClipboard","TranslateMessage","MapWindowPoints","EnumDisplayMonitors","CallWindowProcW","CountClipboardFormats","CloseClipboard","DestroyCursor","CharUpperBuffA","CopyIcon","PostQuitMessage","ShowScrollBar","LoadImageW","EnableMenuItem","DeferWindowPos","HideCaret","EndDeferWindowPos","FindWindowExW","MonitorFromPoint","LoadIconW","SystemParametersInfoW","GetWindow","GetWindowLongW","GetWindowRect","ToUnicode","InsertMenuW","IsWindowEnabled","IsDialogMessageA","FindWindowW","DeleteMenu","GetKeyboardLayout"]},{"library":"version.dll","functions":["GetFileVersionInfoSizeW","VerQueryValueW","GetFileVersionInfoW"]},{"library":"oleaut32.dll","functions":["SafeArrayPutElement","GetErrorInfo","VariantInit","VariantClear","SysFreeString","SafeArrayAccessData","SysReAllocStringLen","SafeArrayCreate","SafeArrayGetElement","GetActiveObject","SysAllocStringLen","SafeArrayUnaccessData","SafeArrayPtrOfIndex","SafeArrayCreateVector","SafeArrayGetElemsize","VariantCopy","SafeArrayGetUBound","SafeArrayGetLBound","VariantCopyInd","VariantChangeType"]},{"library":"advapi32.dll","functions":["RegSetValueExW","RegConnectRegistryW","RegEnumKeyExW","RegLoadKeyW","AdjustTokenPrivileges","RegDeleteKeyW","LookupPrivilegeValueW","OpenProcessToken","RegOpenKeyExW","RegQueryInfoKeyW","RegUnLoadKeyW","RegSaveKeyW","RegDeleteValueW","RegReplaceKeyW","RegFlushKey","RegQueryValueExW","RegEnumValueW","RegCloseKey","RegCreateKeyExW","RegRestoreKeyW"]},{"library":"msvcrt.dll","functions":["isupper","isalpha","isalnum","toupper","memchr","memcmp","memcpy","memset","isprint","isspace","iscntrl","isxdigit","ispunct","isgraph","islower","tolower"]},{"library":"winhttp.dll","functions":["WinHttpGetIEProxyConfigForCurrentUser","WinHttpSetTimeouts","WinHttpSetStatusCallback","WinHttpConnect","WinHttpReceiveResponse","WinHttpQueryAuthSchemes","WinHttpGetProxyForUrl","WinHttpReadData","WinHttpCloseHandle","WinHttpQueryHeaders","WinHttpOpenRequest","WinHttpAddRequestHeaders","WinHttpOpen","WinHttpWriteData","WinHttpSetCredentials","WinHttpQueryDataAvailable","WinHttpSetOption","WinHttpSendRequest","WinHttpQueryOption"]},{"library":"kernel32.dll","functions":["GetFileType","QueryDosDeviceW","GetACP","CloseHandle","LocalFree","GetCurrentProcessId","SizeofResource","TerminateThread","QueryPerformanceFrequency","SetProcessWorkingSetSize","IsDebuggerPresent","FindNextFileW","GetFullPathNameW","VirtualFree","GetProcessHeap","ExitProcess","HeapAlloc","GetCPInfoExW","GlobalSize","RtlUnwind","GetCPInfo","EnumSystemLocalesW","GetStdHandle","GetTimeZoneInformation","FileTimeToLocalFileTime","GetModuleHandleW","FreeLibrary","TryEnterCriticalSection","HeapDestroy","FileTimeToDosDateTime","ReadFile","GetUserDefaultLCID","GetLastError","GetModuleFileNameW","SetLastError","GlobalAlloc","GlobalUnlock","FindResourceW","CreateThread","CompareStringW","MapViewOfFile","LoadLibraryA","GetVolumeInformationW","ResetEvent","MulDiv","FreeResource","GetDriveTypeW","GetVersion","RaiseException","GlobalAddAtomW","FormatMessageW","OpenProcess","SwitchToThread","GetExitCodeThread","GetStringTypeW","OutputDebugStringW","GetCurrentThread","GetFileAttributesExW","IsBadReadPtr","ExpandEnvironmentStringsW","GetComputerNameA","LoadLibraryExW","TerminateProcess","LockResource","FileTimeToSystemTime","GetCurrentThreadId","UnhandledExceptionFilter","GlobalFindAtomW","VirtualQuery","GlobalFree","VirtualQueryEx","Sleep","EnterCriticalSection","SetFilePointer","ReleaseMutex","LoadResource","SuspendThread","GetTickCount","WaitForMultipleObjects","GetFileSize","GlobalDeleteAtom","GetStartupInfoW","GetFileAttributesW","SetCurrentDirectoryW","GetCurrentDirectoryW","InitializeCriticalSection","GetThreadPriority","GetCurrentProcess","GlobalLock","SetThreadPriority","VirtualAlloc","GetTempPathW","GetCommandLineW","GetSystemInfo","LeaveCriticalSection","GetProcAddress","ResumeThread","GetLogicalDriveStringsW","GetVersionExW","VerifyVersionInfoW","HeapCreate","LCMapStringW","GetDiskFreeSpaceW","VerSetConditionMask","FindFirstFileW","GetUserDefaultUILanguage","GetConsoleOutputCP","UnmapViewOfFile","GetConsoleCP","lstrlenW","CompareStringA","QueryPerformanceCounter","SetEndOfFile","lstrcmpW","InitializeCriticalSectionAndSpinCount","HeapFree","WideCharToMultiByte","FindClose","MultiByteToWideChar","CreateMutexA","LoadLibraryW","SetEvent","GetLocaleInfoW","CreateFileW","EnumResourceNamesW","DeleteFileW","IsDBCSLeadByteEx","GetEnvironmentVariableW","GetLocalTime","WaitForSingleObject","WriteFile","CreateFileMappingW","ExitThread","DeleteCriticalSection","GetDateFormatW","GetTimeFormatW","TlsGetValue","SetErrorMode","GetComputerNameW","IsValidLocale","SleepEx","TlsSetValue","GetSystemDefaultUILanguage","EnumCalendarInfoW","LocalAlloc","RemoveDirectoryW","CreateEventW","WaitForMultipleObjectsEx","GetThreadLocale","SetThreadLocale"]},{"library":"wsock32.dll","functions":["gethostbyaddr","WSACleanup","gethostbyname","bind","gethostname","closesocket","WSAGetLastError","connect","inet_addr","getpeername","WSAAsyncSelect","WSAAsyncGetServByName","WSACancelAsyncRequest","send","ntohs","htons","WSAStartup","getservbyname","getsockname","listen","socket","recv","inet_ntoa","ioctlsocket","WSAAsyncGetHostByName"]},{"library":"ole32.dll","functions":["RevokeDragDrop","OleRegEnumVerbs","IsAccelerator","CoCreateInstance","CoUninitialize","CLSIDFromString","RegisterDragDrop","IsEqualGUID","ProgIDFromCLSID","CreateStreamOnHGlobal","OleInitialize","CoInitializeEx","OleUninitialize","CoGetClassObject","CoInitialize","CoTaskMemFree","OleDraw","CoTaskMemAlloc","StringFromCLSID","OleSetMenuDescriptor","DoDragDrop"]},{"library":"gdi32.dll","functions":["Pie","SetBkMode","GetTextCharsetInfo","GetRandomRgn","CreateCompatibleBitmap","CreatePolygonRgn","BeginPath","GetEnhMetaFileHeader","CloseEnhMetaFile","RectVisible","AngleArc","TranslateCharsetInfo","ResizePalette","SetAbortProc","SetTextColor","GetTextColor","StretchBlt","PathToRegion","GetCharABCWidthsFloatW","GetGlyphIndicesW","ExtSelectClipRgn","RoundRect","SelectClipRgn","RectInRegion","RestoreDC","FillPath","SetRectRgn","GetTextMetricsW","GetWindowOrgEx","CreatePalette","GetTextCharset","CreateDCW","CreateICW","FillRgn","PolyBezierTo","GetStockObject","CreateSolidBrush","GetFontUnicodeRanges","Polygon","MoveToEx","PlayEnhMetaFile","Ellipse","ModifyWorldTransform","StartPage","GetBitmapBits","StartDocW","AbortDoc","GetSystemPaletteEntries","GetEnhMetaFileBits","CreatePenIndirect","GetEnhMetaFilePaletteEntries","SetMapMode","CreateFontIndirectW","PolyBezier","DPtoLP","LPtoDP","GetNearestColor","EndDoc","GetObjectW","GetCurrentObject","GetFontData","GetWinMetaFileBits","SetROP2","GetTextExtentExPointW","GetROP2","GetOutlineTextMetricsW","PtVisible","GetEnhMetaFileDescriptionW","ArcTo","CreateEnhMetaFileW","Arc","CreateRectRgnIndirect","TextOutW","SelectPalette","SetGraphicsMode","SetLayout","ExcludeClipRect","SetTextJustification","SetWindowOrgEx","MaskBlt","GetCharacterPlacementW","CreatePatternBrush","EndPage","EndPath","EqualRgn","DeleteEnhMetaFile","Chord","SetDIBits","SetViewportOrgEx","GetViewportOrgEx","CreateRectRgn","RealizePalette","GetObjectType","SetDIBColorTable","GetDIBColorTable","OffsetClipRgn","GetTextMetricsA","CreateBrushIndirect","PatBlt","SetEnhMetaFileBits","CreateEllipticRgn","Rectangle","DeleteDC","SaveDC","GetWorldTransform","BitBlt","FrameRgn","SetWorldTransform","GetDeviceCaps","GetTextExtentPoint32W","PtInRegion","GetClipBox","GetClipRgn","Polyline","IntersectClipRect","CombineTransform","CreateBitmap","CombineRgn","SetWinMetaFileBits","CreateDIBitmap","GetStretchBltMode","CreateDIBSection","SetStretchBltMode","GetDIBits","CreateFontIndirectA","LineTo","GetRgnBox","EnumFontFamiliesW","EnumFontsW","SetWindowExtEx","CreateHalftonePalette","DeleteObject","SelectObject","ExtFloodFill","UnrealizeObject","CopyEnhMetaFileW","OffsetRgn","GetBkColor","SetBkColor","CreateCompatibleDC","GetBrushOrgEx","GetCurrentPositionEx","GetNearestPaletteIndex","SetTextAlign","GetTextAlign","CreateRoundRectRgn","GetTextExtentPointW","ExtTextOutW","SetBrushOrgEx","GetPixel","GdiFlush","GetTextFaceW","SetViewportExtEx","SetPixel","EnumFontFamiliesExW","StretchDIBits","WidenPath","GetPaletteEntries"]}]},"Exports":{"entities":[{"name":"dbkFCallWrapperAddr","ordinal":1,"address":"0x00B0A648"},{"name":"__dbk_fcall_wrapper","ordinal":2,"address":"0x0001316C"}]},"Resources":{"raw_response":"Error: Read timeout on endpoint URL: \"https://bedrock-runtime.ap-south-1.amazonaws.com/model/qwen.qwen3-coder-480b-a35b-v1%3A0/converse\""},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{"domain_names":[".zapto.org","accounts.google.com","adobe.com","google.com","googleapis.com","graph.microsoft.com","http://ns.adobe.com","http://ns.adobe.com/xap/1.0/","http://ns.adobe.com/xap/1.0/mm/","http://ns.adobe.com/xap/1.0/rights/","http://ns.adobe.com/xap/1.0/sType/ResourceRef#","http://www.indyproject.org","http://www.indyproject.org/","http://www.microsoft.com","http://www.microsoft.com/downloads","http://www.w3.org","http://www.w3.org/1999/02/22-rdf-syntax-ns#","http://www.w3.org/1999/xlink","http://www.w3.org/1999/xlink"","http://www.w3.org/2000/svg","https://accounts.google.com","https://accounts.google.com/o/oauth2/revoke?token","https://accounts.google.com/o/oauth2/v2/auth?scope","https://google.com","https://graph.microsoft.com","https://graph.microsoft.com/v1.0/me/","https://login.microsoftonline.com","https://login.microsoftonline.com/common/oauth2/v2.0/authorize?access_type","https://login.microsoftonline.com/common/oauth2/v2.0/revoke?token","https://www.google.com","https://www.google.com/sorry/index","https://www.googleapis.com","https://www.googleapis.com/userinfo/v2/me","indyproject.org","login.microsoftonline.com","microsoft.com","microsoftonline.com","ns.adobe.com","www.google.com","www.googleapis.com","www.indyproject.org","www.microsoft.com","www.w3.org","zapto.org"],"cryptographic_algorithms":["CRC32","MD5","SHA1","Blowfish"],"suspicious_indicators":{"packed_pe":true,"unusual_section_names":[".itext",".didata"],"possible_dropper":true,"compressed_or_encrypted_resources":["BLACK","BLUE","DARKSIDE","DEFAULTUSERSKINDATA","MONEYTWINS","PUMPKIN","SILVER"],"timezone_info":"UTC-3","resource_percentage":77.3092},"malicious_functions":{"hidden_imports":["LoadLibraryA","LoadLibraryExW","GetProcAddress","LoadLibraryW"],"anti_debugging":["FindWindowW","SwitchToThread"],"code_injection":["GetWindowLongW","FindWindowW"],"registry_access":["RegSetValueExW","RegEnumKeyExW","RegLoadKeyW","RegDeleteKeyW","RegOpenKeyExW","RegQueryInfoKeyW","RegUnLoadKeyW","RegSaveKeyW","RegDeleteValueW","RegReplaceKeyW","RegFlushKey","RegQueryValueExW","RegEnumValueW","RegCloseKey","RegCreateKeyExW","RegRestoreKeyW"],"launch_programs":["ShellExecuteW"],"create_temp_files":["GetTempPathW","CreateFileW"],"keylogger_functions":["CallNextHookEx","GetAsyncKeyState","MapVirtualKeyW","GetForegroundWindow"],"internet_access":["InternetCloseHandle","InternetGetConnectedState","InternetReadFile","InternetConnectW","InternetOpenW","InternetOpenUrlW","WinHttpGetIEProxyConfigForCurrentUser","WinHttpSetTimeouts","WinHttpSetStatusCallback","WinHttpConnect","WinHttpReceiveResponse","WinHttpQueryAuthSchemes","WinHttpGetProxyForUrl","WinHttpReadData","WinHttpCloseHandle","WinHttpQueryHeaders","WinHttpOpenRequest","WinHttpAddRequestHeaders","WinHttpOpen","WinHttpWriteData","WinHttpSetCredentials","WinHttpQueryDataAvailable","WinHttpSetOption","WinHttpSendRequest","WinHttpQueryOption"],"privilege_level_functions":["AdjustTokenPrivileges","OpenProcessToken"],"enumerate_drives":["GetVolumeInformationW","GetDriveTypeW","GetLogicalDriveStringsW"],"manipulate_processes":["OpenProcess"],"take_screenshots":["GetDC","GetDCEx","FindWindowW","BitBlt","CreateCompatibleDC"],"read_clipboard":["GetClipboardData"],"shutdown_lock":["ExitWindowsEx"]},"exploit_mitigation_techniques":{"stack_canary":false,"safe_seh":false,"aslr":true,"dep":true,"cfg":false}},"file_path":"/home/apogean/projects/malware/windows/all_runs/mamamia.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_k3efqp35/output.txt"},"timestamp":"2026-04-30 00:01:14"} {"_id":{"$oid":"6a049827204ca8b07f91707b"},"sha256":"0d6e72e20edd52cf3f8cb41446a5eff46c59fb2b79700fb791a85661a5a8f5b4","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Server_Encrypted.ps1.bin\nDate: 2026-05-13 20:56:31\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Server_Encrypted.ps1.bin!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Server_Encrypted.ps1.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_lrq7jh_j/output.txt"},"timestamp":"2026-05-13 20:56:31"} {"_id":{"$oid":"6a0716cb204ca8b07f91707f"},"sha256":"f450cef035a0355bdc9c5da156a92a83ea1ca3787cf8ccc6ace3559c3c1100f9","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/MBSetup-3.3-019e2b88-d6a1-74d0-8824-310d46fb50a0.exe\nDate: 2026-05-15 17:49:12\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/MBSetup-3.3-019e2b88-d6a1-74d0-8824-310d46fb50a0.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-May-06 22:16:41\nDetected languages: Dutch - Netherlands\n English - United States\n French - France\n German - Germany\n Italian - Italy\n Polish - Poland\n Portuguese - Brazil\n Portuguese - Portugal\n Russian - Russia\n Spanish - Spain (Traditional sort)\nDebug artifacts: C:\\Jenkins\\workspace\\MBAM-Windows\\A_MB5_MBSetup\\bin\\Win32\\Release\\MBSetup.pdb\nCompanyName: Malwarebytes\nFileDescription: Malwarebytes Setup\nFileVersion: 5.5.7.145\nLegalCopyright: Copyright (C) 2017 - 2026 Malwarebytes, Inc. All rights reserved.\nInternalName: MBSetup.exe\nOriginalFilename: MBSetup.exe\nProductName: Malwarebytes\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000110\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2026-May-06 22:16:41\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x000C7E00\nSizeOfInitializedData: 0x001E4C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00094BEF (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x000C9000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x002AF000\nSizeOfHeaders: 0x00000400\nChecksum: 0x002C7F60\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000C7DDC\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x000C7E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.54276\n\n.rdata:\n VirtualSize: 0x00046952\n VirtualAddress: 0x000C9000\n SizeOfRawData: 0x00046A00\n PointerToRawData: 0x000C8200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.98262\n\n.data:\n VirtualSize: 0x00004D2C\n VirtualAddress: 0x00110000\n SizeOfRawData: 0x00003A00\n PointerToRawData: 0x0010EC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.29593\n\n.rsrc:\n VirtualSize: 0x0018EA88\n VirtualAddress: 0x00115000\n SizeOfRawData: 0x0018EC00\n PointerToRawData: 0x00112600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.17308\n\n.reloc:\n VirtualSize: 0x0000A688\n VirtualAddress: 0x002A4000\n SizeOfRawData: 0x0000A800\n PointerToRawData: 0x002A1200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.69893\n\n\nImports:\n--------\nKERNEL32.dll: LeaveCriticalSection\n EnterCriticalSection\n GetLastError\n MultiByteToWideChar\n SizeofResource\n LoadResource\n FindResourceW\n LoadLibraryExW\n GetModuleFileNameW\n InitializeCriticalSectionEx\n DeleteCriticalSection\n RaiseException\n IsWow64Process\n GetCurrentProcess\n VerifyVersionInfoW\n VerSetConditionMask\n GetSystemDirectoryW\n CreateFileW\n DeviceIoControl\n CloseHandle\n GetCurrentThreadId\n SetLastError\n LockResource\n FindResourceExW\n Sleep\n DeleteFileW\n GlobalFree\n LocalFree\n FormatMessageW\n LocalAlloc\n CallNamedPipeW\n GetWindowsDirectoryW\n SetCurrentDirectoryW\n GetCommandLineW\n DecodePointer\n CreateMutexW\n lstrcmpiW\n GetDiskFreeSpaceExW\n FindFirstFileW\n FindClose\n CreateProcessW\n FindNextFileW\n WideCharToMultiByte\n GlobalAlloc\n GlobalLock\n SetThreadUILanguage\n LoadLibraryW\n CreateDirectoryW\n GetLogicalDrives\n GetTempPathW\n MoveFileExW\n InitializeProcThreadAttributeList\n UpdateProcThreadAttribute\n DeleteProcThreadAttributeList\n OpenProcess\n ResumeThread\n TerminateProcess\n CreateToolhelp32Snapshot\n Process32FirstW\n Process32NextW\n K32GetModuleFileNameExW\n GetCurrentDirectoryW\n GetCurrentProcessId\n GetModuleFileNameA\n ProcessIdToSessionId\n OutputDebugStringW\n GetLocalTime\n GetFileSizeEx\n GetFileAttributesW\n WriteConsoleW\n SetStdHandle\n SetEnvironmentVariableW\n GetProcAddress\n GetModuleHandleW\n FreeLibrary\n GetProcessHeap\n HeapAlloc\n HeapFree\n HeapReAlloc\n HeapSize\n HeapDestroy\n GetNativeSystemInfo\n MulDiv\n FreeEnvironmentStringsW\n GetEnvironmentStringsW\n GetOEMCP\n GetACP\n IsValidCodePage\n GetTimeZoneInformation\n ReadConsoleW\n EnumSystemLocalesW\n GetUserDefaultLCID\n IsValidLocale\n SetEndOfFile\n GetLocaleInfoW\n LCMapStringW\n CompareStringW\n GetTimeFormatW\n GetDateFormatW\n GetSystemInfo\n VirtualProtect\n VirtualQuery\n LoadLibraryExA\n FormatMessageA\n GetStringTypeW\n GetLocaleInfoEx\n FindFirstFileExW\n GetFileAttributesExW\n GetFileInformationByHandle\n SetFileInformationByHandle\n AreFileApisANSI\n CopyFileW\n GetFileInformationByHandleEx\n QueryPerformanceCounter\n QueryPerformanceFrequency\n ReleaseSRWLockExclusive\n AcquireSRWLockExclusive\n EncodePointer\n LCMapStringEx\n WakeAllConditionVariable\n SleepConditionVariableSRW\n GetSystemTimeAsFileTime\n GetCPInfo\n IsDebuggerPresent\n InitializeSListHead\n InterlockedPopEntrySList\n InterlockedPushEntrySList\n FlushInstructionCache\n IsProcessorFeaturePresent\n VirtualAlloc\n VirtualFree\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetStartupInfoW\n RtlUnwind\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n ExitProcess\n GetModuleHandleExW\n CreateThread\n ExitThread\n FreeLibraryAndExitThread\n GetCommandLineA\n GetStdHandle\n WriteFile\n GetFileType\n FlushFileBuffers\n GetConsoleOutputCP\n GetConsoleMode\n SetFilePointerEx\n ReadFile\ndwmapi.dll: DwmGetWindowAttribute\nCRYPT32.dll: CryptMsgClose\n CertCloseStore\n CertFreeCertificateContext\n CertGetNameStringW\n CertFindCertificateInStore\n CryptMsgGetParam\n CryptQueryObject\nRPCRT4.dll: UuidToStringW\n RpcStringFreeW\n UuidCreate\nWTSAPI32.dll: WTSQuerySessionInformationW\n WTSFreeMemory\nUSER32.dll (delay-loaded): GetClassInfoExW\n RegisterClassExW\n LoadAcceleratorsW\n LoadMenuW\n PostQuitMessage\n LoadStringA\n MonitorFromPoint\n PeekMessageW\n GetMessageW\n TranslateMessage\n DispatchMessageW\n GetWindowInfo\n IsRectEmpty\n GetLastActivePopup\n GetDlgCtrlID\n GetDlgItemTextW\n ReleaseDC\n SetDlgItemTextW\n SendDlgItemMessageW\n LoadBitmapW\n MessageBoxW\n LoadStringW\n FindWindowW\n EndDialog\n GetWindow\n MonitorFromWindow\n GetMonitorInfoW\n MapWindowPoints\n IsWindow\n UnionRect\n DrawFocusRect\n InflateRect\n DrawTextW\n CopyRect\n CallWindowProcW\n DefWindowProcW\n KillTimer\n SetTimer\n LoadCursorW\n MessageBoxA\n InvalidateRect\n DestroyMenu\n DestroyWindow\n TranslateAcceleratorW\n EnableMenuItem\n CreateDialogParamW\n DialogBoxParamW\n UnregisterClassW\n GetWindowLongW\n SetWindowPos\n SetLayeredWindowAttributes\n GetSystemMenu\n GetActiveWindow\n ShowWindow\n RegisterWindowMessageW\n IsProcessDPIAware\n CharNextW\n OffsetRect\n SetWindowLongW\n GetParent\n PostMessageW\n GetWindowTextLengthW\n GetWindowTextW\n GetMenuItemCount\n PtInRect\n TrackPopupMenuEx\n AppendMenuW\n GetMenuItemInfoW\n GetDC\n LoadImageW\n GetSystemMetrics\n SendMessageW\n GetWindowRect\n GetClientRect\n IsDialogMessageW\n MessageBeep\n CreateWindowExW\n wsprintfW\n GetWindowThreadProcessId\n FillRect\n GetShellWindow\n EndPaint\n BeginPaint\n SetFocus\n EnableWindow\n GetDlgItem\n MoveWindow\n CreatePopupMenu\n SetWindowTextW\n RemoveMenu\n\nResources:\n----------\n10:\n Type: BINARY\n Language: English - United States\n Codepage: UNKNOWN\n Size: 167336\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.48739\n Detected Filetype: TrueType font file\n\n11:\n Type: BINARY\n Language: English - United States\n Codepage: UNKNOWN\n Size: 168260\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.48684\n Detected Filetype: TrueType font file\n\n10 (#2):\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 347\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.75455\n Detected Filetype: PNG graphic file\n\n11 (#2):\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1178\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.76742\n Detected Filetype: PNG graphic file\n\n12:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1519\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.81057\n Detected Filetype: PNG graphic file\n\n13:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 533\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.34081\n Detected Filetype: PNG graphic file\n\n20:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 974\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.71936\n Detected Filetype: PNG graphic file\n\n21:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1218\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.74801\n Detected Filetype: PNG graphic file\n\n22:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1434\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.79791\n Detected Filetype: PNG graphic file\n\n23:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1820\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.84927\n Detected Filetype: PNG graphic file\n\n30:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 912\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.7041\n Detected Filetype: PNG graphic file\n\n31:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1200\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.7578\n Detected Filetype: PNG graphic file\n\n32:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1330\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.80465\n Detected Filetype: PNG graphic file\n\n33:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1738\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.84466\n Detected Filetype: PNG graphic file\n\n40:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 18141\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.858\n Detected Filetype: PNG graphic file\n\n41:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 23600\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.68108\n Detected Filetype: PNG graphic file\n\n42:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 27856\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.79672\n Detected Filetype: PNG graphic file\n\n43:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 39152\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.66305\n Detected Filetype: PNG graphic file\n\n50:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5485\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9415\n Detected Filetype: PNG graphic file\n\n51:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 7578\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96177\n Detected Filetype: PNG graphic file\n\n52:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 10158\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97452\n Detected Filetype: PNG graphic file\n\n53:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16202\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98299\n Detected Filetype: PNG graphic file\n\n60:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 7725\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94\n Detected Filetype: PNG graphic file\n\n61:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9795\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.89902\n Detected Filetype: PNG graphic file\n\n62:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 12033\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.89567\n Detected Filetype: PNG graphic file\n\n63:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15749\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.87168\n Detected Filetype: PNG graphic file\n\n70:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 14077\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95958\n Detected Filetype: PNG graphic file\n\n71:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19339\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97617\n Detected Filetype: PNG graphic file\n\n72:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 25270\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97643\n Detected Filetype: PNG graphic file\n\n73:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 39031\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97414\n Detected Filetype: PNG graphic file\n\n80:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9041\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9479\n Detected Filetype: PNG graphic file\n\n81:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 12987\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95981\n Detected Filetype: PNG graphic file\n\n82:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 17221\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.92035\n Detected Filetype: PNG graphic file\n\n83:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 26736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9454\n Detected Filetype: PNG graphic file\n\n90:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11969\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96535\n Detected Filetype: PNG graphic file\n\n91:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16057\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96688\n Detected Filetype: PNG graphic file\n\n92:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20854\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96838\n Detected Filetype: PNG graphic file\n\n93:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 31242\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95611\n Detected Filetype: PNG graphic file\n\n100:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 12179\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96673\n Detected Filetype: PNG graphic file\n\n101:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16899\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96887\n Detected Filetype: PNG graphic file\n\n102:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 22385\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95956\n Detected Filetype: PNG graphic file\n\n103:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 35448\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95745\n Detected Filetype: PNG graphic file\n\n110:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1129\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.62419\n Detected Filetype: PNG graphic file\n\n111:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1793\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.73443\n Detected Filetype: PNG graphic file\n\n112:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2373\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.84997\n Detected Filetype: PNG graphic file\n\n113:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2646\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.83369\n Detected Filetype: PNG graphic file\n\n120:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5979\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94471\n Detected Filetype: PNG graphic file\n\n121:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 7933\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95785\n Detected Filetype: PNG graphic file\n\n122:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9191\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95049\n Detected Filetype: PNG graphic file\n\n123:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 12630\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95791\n Detected Filetype: PNG graphic file\n\n130:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 6503\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95371\n Detected Filetype: PNG graphic file\n\n131:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9400\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97349\n Detected Filetype: PNG graphic file\n\n132:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 12534\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97711\n Detected Filetype: PNG graphic file\n\n133:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20400\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98545\n Detected Filetype: PNG graphic file\n\n140:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 820\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.62687\n Detected Filetype: PNG graphic file\n\n141:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1093\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.72757\n Detected Filetype: PNG graphic file\n\n142:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1243\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.76702\n Detected Filetype: PNG graphic file\n\n143:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1602\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.82154\n Detected Filetype: PNG graphic file\n\n150:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1150\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.71455\n Detected Filetype: PNG graphic file\n\n151:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2392\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.90283\n Detected Filetype: PNG graphic file\n\n152:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2807\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.90061\n Detected Filetype: PNG graphic file\n\n153:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2305\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.76961\n Detected Filetype: PNG graphic file\n\n160:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 276\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.76997\n Detected Filetype: PNG graphic file\n\n161:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 351\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.04693\n Detected Filetype: PNG graphic file\n\n162:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 392\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.11264\n Detected Filetype: PNG graphic file\n\n163:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 378\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.01976\n Detected Filetype: PNG graphic file\n\n170:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 832\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.45367\n Detected Filetype: PNG graphic file\n\n171:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 976\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.56396\n Detected Filetype: PNG graphic file\n\n172:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1160\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.65503\n Detected Filetype: PNG graphic file\n\n173:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1554\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.72858\n Detected Filetype: PNG graphic file\n\n180:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5412\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9455\n Detected Filetype: PNG graphic file\n\n181:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 6966\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94007\n Detected Filetype: PNG graphic file\n\n182:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 8117\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.93815\n Detected Filetype: PNG graphic file\n\n183:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11224\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95186\n Detected Filetype: PNG graphic file\n\n190:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1171\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.65964\n Detected Filetype: PNG graphic file\n\n191:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1430\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.70715\n Detected Filetype: PNG graphic file\n\n192:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1674\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.78279\n Detected Filetype: PNG graphic file\n\n193:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2247\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.81812\n Detected Filetype: PNG graphic file\n\n200:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9492\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95741\n Detected Filetype: PNG graphic file\n\n201:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 12293\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97172\n Detected Filetype: PNG graphic file\n\n202:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16630\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97583\n Detected Filetype: PNG graphic file\n\n203:\n Type: PNG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 25086\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96565\n Detected Filetype: PNG graphic file\n\nEULA:\n Type: RESOURCEFILE\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 62958\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.99786\n\nPOLICY:\n Type: RESOURCEFILE\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 60260\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.41222\n\n129:\n Type: RT_BITMAP\n Language: English - United States\n Codepage: UNKNOWN\n Size: 10984\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52429\n\n130 (#2):\n Type: RT_BITMAP\n Language: English - United States\n Codepage: UNKNOWN\n Size: 17200\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19334\n\n131 (#2):\n Type: RT_BITMAP\n Language: English - United States\n Codepage: UNKNOWN\n Size: 24376\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.92106\n\n132 (#2):\n Type: RT_BITMAP\n Language: English - United States\n Codepage: UNKNOWN\n Size: 45316\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.60509\n\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.87443\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.77941\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.75136\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.54513\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.48768\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.42116\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.37626\n\n100 (#2):\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 272\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.62266\n\n110 (#2):\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 376\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.5246\n\n120 (#2):\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 260\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.65465\n\n140 (#2):\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 472\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.45731\n\n150 (#2):\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.5793\n\n160 (#2):\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.494\n\n170 (#2):\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.71292\n\n999:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 288\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02415\n\n9:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 72\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.08391\n\n9 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 78\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.21387\n\n9 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 72\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05614\n\n9 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 72\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.10121\n\n9 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 72\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.09072\n\n9 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 72\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.10121\n\n9 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 72\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.07343\n\n9 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 78\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.22015\n\n9 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 72\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.07343\n\n9 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 78\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.22015\n\n63 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 342\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08368\n\n63 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 276\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02297\n\n63 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 358\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.97098\n\n63 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 376\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99727\n\n63 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00852\n\n63 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 348\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02329\n\n63 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15361\n\n63 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 332\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02278\n\n63 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 360\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.8204\n\n63 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 374\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05012\n\n64:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 520\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21887\n\n64 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 438\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18944\n\n64 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 534\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.17962\n\n64 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 590\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16347\n\n64 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 610\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.14042\n\n64 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 556\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.17266\n\n64 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 502\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43302\n\n64 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 520\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1719\n\n64 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 556\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.8741\n\n64 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 514\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.17805\n\n69:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 318\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04866\n\n69 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 322\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00679\n\n69 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 306\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99827\n\n69 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 322\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99159\n\n69 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 320\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98595\n\n69 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 318\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00927\n\n69 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.22982\n\n69 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 298\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.01573\n\n69 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.86128\n\n69 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 298\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.01573\n\n70 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 318\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.60018\n\n70 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 298\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.55828\n\n70 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 328\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50914\n\n70 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 326\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50849\n\n70 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.57047\n\n70 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 314\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52591\n\n70 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 298\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.69287\n\n70 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 322\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.54286\n\n70 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 314\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.12465\n\n70 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 326\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52631\n\n71 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 670\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16528\n\n71 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 572\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.97746\n\n71 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 660\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98797\n\n71 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 722\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.13125\n\n71 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 734\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.06133\n\n71 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 654\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.92384\n\n71 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40994\n\n71 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 650\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.10139\n\n71 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 530\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51756\n\n71 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 650\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.11158\n\n76:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 354\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.29895\n\n76 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 282\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15852\n\n76 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 320\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.22244\n\n76 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 334\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15299\n\n76 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 322\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09632\n\n76 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 320\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1807\n\n76 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 302\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.33408\n\n76 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 326\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.13748\n\n76 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 312\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.68469\n\n76 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 332\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18624\n\n82 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.22847\n\n82 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 500\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15649\n\n82 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.12955\n\n82 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 638\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1553\n\n82 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 584\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08737\n\n82 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 576\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.12621\n\n82 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 650\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4717\n\n82 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 572\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09685\n\n82 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 616\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.70029\n\n82 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 592\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.07932\n\n88:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 456\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1579\n\n88 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 360\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08499\n\n88 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 394\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.06094\n\n88 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 436\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09257\n\n88 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 422\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.10098\n\n88 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 430\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09725\n\n88 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 342\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.37804\n\n88 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09744\n\n88 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 430\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.86995\n\n88 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 422\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09156\n\n89:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 2094\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.35685\n\n89 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1910\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26856\n\n89 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.22736\n\n89 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 2240\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28244\n\n89 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 2314\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.20368\n\n89 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 2086\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23346\n\n89 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1984\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52843\n\n89 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25932\n\n89 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2092\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.93753\n\n89 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 2228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2432\n\n90 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 2602\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.302\n\n90 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2444\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21316\n\n90 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 2930\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19403\n\n90 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 2944\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23119\n\n90 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 2972\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.17996\n\n90 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 2682\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18834\n\n90 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2522\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50334\n\n90 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 2960\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.24534\n\n90 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2564\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.92409\n\n90 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 2904\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21787\n\n91 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 378\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90956\n\n91 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 272\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02237\n\n91 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 328\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.01403\n\n91 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 382\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.07905\n\n91 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 466\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.96879\n\n91 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 314\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.07605\n\n91 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 318\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27076\n\n91 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 320\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02592\n\n91 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 284\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52759\n\n91 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.92577\n\n92 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 1528\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27775\n\n92 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1284\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2272\n\n92 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 1468\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.20998\n\n92 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 1418\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2976\n\n92 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 1646\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15848\n\n92 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 1342\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.22086\n\n92 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1274\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.54845\n\n92 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 1354\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25076\n\n92 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1236\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88672\n\n92 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 1342\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2469\n\n93 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 564\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.10511\n\n93 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 468\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.01358\n\n93 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 538\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.01928\n\n93 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 534\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.13986\n\n93 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 534\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98906\n\n93 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 534\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99595\n\n93 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 458\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.29732\n\n93 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04301\n\n93 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 508\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.76016\n\n93 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 506\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05451\n\n94:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 206\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.92317\n\n94 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 170\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.82898\n\n94 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 186\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.82105\n\n94 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 240\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90743\n\n94 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 240\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.84846\n\n94 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 222\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.88525\n\n94 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 198\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.01541\n\n94 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 178\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.82457\n\n94 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 150\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43712\n\n94 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 184\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.87053\n\n95:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 224\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8922\n\n95 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 198\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90713\n\n95 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 222\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8752\n\n95 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 222\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.97751\n\n95 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 238\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89249\n\n95 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 222\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89257\n\n95 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 196\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16922\n\n95 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 220\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94531\n\n95 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 174\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45359\n\n95 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 202\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8423\n\n101 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 362\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.96303\n\n101 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 290\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90751\n\n101 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 292\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90735\n\n101 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 388\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.07171\n\n101 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 348\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90258\n\n101 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 328\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94945\n\n101 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21501\n\n101 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 292\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9211\n\n101 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52608\n\n101 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 238\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.80023\n\n107:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 276\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90003\n\n107 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 250\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.87762\n\n107 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 246\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.87874\n\n107 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 270\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.97758\n\n107 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 284\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.92296\n\n107 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 272\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94802\n\n107 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 234\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.10733\n\n107 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 258\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98646\n\n107 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 238\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.74235\n\n107 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 252\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00864\n\n113 (#2):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 284\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.83545\n\n113 (#3):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 258\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.82913\n\n113 (#4):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 248\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.81451\n\n113 (#5):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 278\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89917\n\n113 (#6):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 324\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94367\n\n113 (#7):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 284\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8976\n\n113 (#8):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 246\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08948\n\n113 (#9):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 270\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.93365\n\n113 (#10):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 250\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.78198\n\n113 (#11):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94982\n\n119:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 366\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.11235\n\n119 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 274\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00438\n\n119 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 370\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.95233\n\n119 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 344\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.97658\n\n119 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 354\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.97094\n\n119 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 340\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.0206\n\n119 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 324\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.35141\n\n119 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 322\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98739\n\n119 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 358\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.77363\n\n119 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 402\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04852\n\n120 (#3):\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 120\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.63181\n\n120 (#4):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 112\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.49205\n\n120 (#5):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 174\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68187\n\n120 (#6):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 134\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61857\n\n120 (#7):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.47281\n\n120 (#8):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 136\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.70281\n\n120 (#9):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 150\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.96354\n\n120 (#10):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 130\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.5532\n\n120 (#11):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 134\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41466\n\n120 (#12):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 130\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.59431\n\n126:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 1170\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15807\n\n126 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 850\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.12623\n\n126 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 906\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.12353\n\n126 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 1006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.11844\n\n126 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 1172\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.14341\n\n126 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 754\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08653\n\n126 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1100\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39327\n\n126 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 898\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.14561\n\n126 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 854\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.9462\n\n126 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 878\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09652\n\n563:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61121\n\n563 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61121\n\n563 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 138\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.64518\n\n563 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61121\n\n563 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61121\n\n563 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61121\n\n563 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 180\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.92977\n\n563 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61121\n\n563 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61121\n\n563 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61121\n\n564:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02914\n\n564 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 212\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.93076\n\n564 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 240\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.93485\n\n564 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 240\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99286\n\n564 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 218\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.97531\n\n564 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 220\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.93298\n\n564 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.07316\n\n564 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 234\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9872\n\n564 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 274\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.79502\n\n564 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.91487\n\n565:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 1208\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.30059\n\n565 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 884\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.12625\n\n565 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 966\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.07858\n\n565 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 1066\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.17\n\n565 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 1026\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15068\n\n565 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 1060\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.13888\n\n565 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1064\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42878\n\n565 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 916\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16292\n\n565 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 888\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88654\n\n565 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 974\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1365\n\n566:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 1372\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.22991\n\n566 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1254\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19619\n\n566 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 1314\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19311\n\n566 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 1334\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23005\n\n566 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 1336\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18939\n\n566 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 1342\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2056\n\n566 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1204\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.36365\n\n566 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 1262\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.24106\n\n566 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.09804\n\n566 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 1262\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21707\n\n567:\n Type: RT_STRING\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 506\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.22209\n\n567 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 404\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.13697\n\n567 (#3):\n Type: RT_STRING\n Language: Spanish - Spain (Traditional sort)\n Codepage: UNKNOWN\n Size: 446\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.13015\n\n567 (#4):\n Type: RT_STRING\n Language: French - France\n Codepage: UNKNOWN\n Size: 478\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18303\n\n567 (#5):\n Type: RT_STRING\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 494\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1464\n\n567 (#6):\n Type: RT_STRING\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 418\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18152\n\n567 (#7):\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 484\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.29686\n\n567 (#8):\n Type: RT_STRING\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 438\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.20791\n\n567 (#9):\n Type: RT_STRING\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 478\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.94232\n\n567 (#10):\n Type: RT_STRING\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 436\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.20827\n\n128:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.0112\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.44984\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2082\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.18995\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 5.5.7.145\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Malwarebytes\n FileDescription: Malwarebytes Setup\n FileVersion (#2): 5.5.7.145\n LegalCopyright: Copyright (C) 2017 - 2026 Malwarebytes, Inc. All rights reserved.\n InternalName: MBSetup.exe\n OriginalFilename: MBSetup.exe\n ProductName: Malwarebytes\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2026-May-06 22:16:41\n Version: 0.0\n SizeofData: 102\n AddressOfRawData: 0x001036F0\n PointerToRawData: 0x001028F0\n Referenced File: C:\\Jenkins\\workspace\\MBAM-Windows\\A_MB5_MBSetup\\bin\\Win32\\Release\\MBSetup.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2026-May-06 22:16:41\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00103758\n PointerToRawData: 0x00102958\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2026-May-06 22:16:41\n Version: 0.0\n SizeofData: 1116\n AddressOfRawData: 0x0010376C\n PointerToRawData: 0x0010296C\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2026-May-06 22:16:41\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x00503BD8\nEndAddressOfRawData: 0x00503BE0\nAddressOfIndex: 0x00514224\nAddressOfCallbacks: 0x004C9574\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\n-------------------\nSize: 192\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00510080\nSEHandlerTable: 0x00502D1C\nSEHandlerCount: 375\n\nDelayed Imports:\n----------------\nAttributes: 0x00000001\nName: USER32.dll\nModuleHandle: 0x00113890\nDelayImportAddressTable: 0x0011360C\nDelayImportNameTable: 0x0010D1DC\nBoundDelayImportTable: 0x0010E554\nUnloadDelayImportTable: 0x00000000\nTimeStamp: 1970-Jan-01 00:00:00\n\nRICH Header:\n------------\nXOR Key: 0x304765BC\nUnmarked objects: 0\nASM objects (30795): 11\nC++ objects (30795): 191\nC objects (VS 2015-2022 runtime 33030): 19\nASM objects (VS 2015-2022 runtime 33030): 24\nC++ objects (VS 2015-2022 runtime 33030): 111\nC objects (30795): 29\nC objects (CVTCIL) (30795): 1\nImports (30795): 15\nTotal imports: 460\nC++ objects (LTCG) (33134): 35\nResource objects (33134): 1\n151: 2\nLinker (33134): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n firefox.exe\n Tries to detect virtualized environments:\n Hardware\\Description\\System\n Looks for VMWare presence:\n VMware\n May have dropper capabilities:\n CurrentControlSet\\Services\n Accesses the WMI:\n ROOT\\CIMV2\n Miscellaneous malware strings:\n Exploit\n VIRUS\n cmd.exe\n exploit\n Contains domain names:\n amazon.com\n amplitude.com\n apache.org\n api2.amplitude.com\n ark-stage.mwbsys.com\n ark.mwbsys.com\n ark.threatdown.com\n ark.threatdownstage.com\n aws.amazon.com\n br.malwarebytes.com\n cdn.cookielaw.org\n cdn.jsdelivr.net\n cdnjs.cloudflare.com\n cloudflare.com\n code.jquery.com\n cookielaw.org\n de.malwarebytes.com\n downloads.malwarebytes.com\n dse.mwb-dev.net\n es.malwarebytes.com\n fr.malwarebytes.com\n google.com\n http://www.adr.org\n http://www.adr.org/Forms\n http://www.adr.org/Rules\n http://www.apache.org\n http://www.apache.org/licenses/LICENSE-2.0\n http://www.google.com\n http://www.google.com/policies/privacy\n http://www.malwarebytes.com\n http://www.malwarebytes.com/legal\n https://ark.mwbsys.com\n https://ark.mwbsys.com/bgext\n https://aws.amazon.com\n https://aws.amazon.com/compliance/\n https://br.malwarebytes.com\n https://br.malwarebytes.com/privacy/\n https://cdn.cookielaw.org\n https://cdn.cookielaw.org/consent/9530a107-0af8-4204-a2c2-217efb78222b.js\n https://cdn.jsdelivr.net\n https://cdn.jsdelivr.net/npm/slick-carousel\n https://cdnjs.cloudflare.com\n https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick-theme.css\n https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.css\n https://code.jquery.com\n https://code.jquery.com/jquery-3.3.1.min.js\n https://de.malwarebytes.com\n https://de.malwarebytes.com/privacy/\n https://downloads.malwarebytes.com\n https://downloads.malwarebytes.com/file/mb5_offline\n https://es.malwarebytes.com\n https://es.malwarebytes.com/privacy/\n https://fr.malwarebytes.com\n https://fr.malwarebytes.com/privacy/\n https://it.malwarebytes.com\n https://it.malwarebytes.com/privacy/\n https://links.malwarebytes.com\n https://links.malwarebytes.com/link/uninstalled?\n https://links.malwarebytes.com/support/general/business/ms-2019-09-security-update\n https://links.malwarebytes.com/support/installer/AVBlocking\n https://links.malwarebytes.com/support/mb/windows/security-other-av\n https://links.malwarebytes.com/support/mb/windows/system-requirements\n https://links.malwarebytes.com/windows/support/installation-troubleshooting\n https://nl.malwarebytes.com\n https://nl.malwarebytes.com/privacy/\n https://pl.malwarebytes.com\n https://pl.malwarebytes.com/privacy/\n https://preferences-mgr.truste.com\n https://preferences-mgr.truste.com/\n https://pt.malwarebytes.com\n https://pt.malwarebytes.com/privacy/\n https://ru.malwarebytes.com\n https://ru.malwarebytes.com/privacy/\n https://support.malwarebytes.com\n https://support.malwarebytes.com/hc/en-us/articles/4402964326419\n https://www.google.com\n https://www.google.com/policies/privacy\n https://www.jamsadr.com\n https://www.jamsadr.com/eu-us-privacy-shield.\n https://www.malwarebytes.com\n https://www.malwarebytes.com/\n https://www.malwarebytes.com/eula/\n https://www.malwarebytes.com/eula/services-agreement/\n https://www.malwarebytes.com/images/mb-logo-2.png\n https://www.malwarebytes.com/images/share/Malwarebytes-homepage-share.jpg\n https://www.malwarebytes.com/images/uploads/2020/07/30233020/EULA_Chart-2.png\n https://www.malwarebytes.com/jobs\n https://www.malwarebytes.com/js/mess.js\n https://www.malwarebytes.com/legal/privacy-policy\n https://www.malwarebytes.com/privacy/\n https://www.malwarebytes.com/support/lifecycle/\n https://www.privacyshield.gov\n https://www.privacyshield.gov/article?id\n https://www.privacyshield.gov/list\n https://www.youronlinechoices.eu\n https://www.youronlinechoices.eu/\n it.malwarebytes.com\n jamsadr.com\n jquery.com\n jsdelivr.net\n links.malwarebytes.com\n malwarebytes.com\n mgr.truste.com\n mwb-dev.net\n mwbsys.com\n my.malwarebytes.com\n nl.malwarebytes.com\n pl.malwarebytes.com\n preferences-mgr.truste.com\n privacyshield.gov\n pt.malwarebytes.com\n ru.malwarebytes.com\n stage.mwbsys.com\n support.malwarebytes.com\n telemetry.dse.mwb-dev.net\n telemetry.malwarebytes.com\n threatdown.com\n threatdownstage.com\n truste.com\n www.adr.org\n www.apache.org\n www.google.com\n www.jamsadr.com\n www.malwarebytes.com\n www.privacyshield.gov\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n LoadLibraryW\n GetProcAddress\n LoadLibraryExA\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n FindWindowW\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Possibly launches other programs:\n CreateProcessW\n Uses Microsoft's cryptographic API:\n CryptMsgClose\n CryptMsgGetParam\n CryptQueryObject\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Memory manipulation functions often used by packers:\n VirtualProtect\n VirtualAlloc\n Manipulates other processes:\n OpenProcess\n Process32FirstW\n Process32NextW\n Can take screenshots:\n FindWindowW\n GetDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (375 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Malwarebytes Inc\n Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"architecture":"IMAGE_FILE_MACHINE_I386","subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","compilation_date":"2026-05-06T22:16:41","detected_languages":["Dutch - Netherlands","English - United States","French - France","German - Germany","Italian - Italy","Polish - Poland","Portuguese - Brazil","Portuguese - Portugal","Russian - Russia","Spanish - Spain (Traditional sort)"],"debug_artifacts":"C:\\Jenkins\\workspace\\MBAM-Windows\\A_MB5_MBSetup\\bin\\Win32\\Release\\MBSetup.pdb","company_name":"Malwarebytes","file_description":"Malwarebytes Setup","file_version":"5.5.7.145","legal_copyright":"Copyright (C) 2017 - 2026 Malwarebytes, Inc. All rights reserved.","internal_name":"MBSetup.exe","original_filename":"MBSetup.exe","product_name":"Malwarebytes"},"DOS Header":{"e_magic":"MZ","e_cblp":144,"e_cp":3,"e_crlc":0,"e_cparhdr":4,"e_minalloc":0,"e_maxalloc":65535,"e_ss":0,"e_sp":184,"e_csum":0,"e_ip":0,"e_cs":0,"e_ovno":0,"e_oemid":0,"e_oeminfo":0,"e_lfanew":272},"PE Header":{"Signature":"PE","Machine":"IMAGE_FILE_MACHINE_I386","NumberofSections":5,"TimeDateStamp":"2026-May-06 22:16:41","PointerToSymbolTable":"0x00000000","NumberOfSymbols":0,"SizeOfOptionalHeader":"0x00E0","Characteristics":["IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE_IMAGE"]},"Image Optional Header":{"Magic":"PE32","LinkerVersion":"14.0","SizeOfCode":"0x000C7E00","SizeOfInitializedData":"0x001E4C00","SizeOfUninitializedData":"0x00000000","AddressOfEntryPoint":"0x00094BEF","EntryPointSection":".text","BaseOfCode":"0x00001000","BaseOfData":"0x000C9000","ImageBase":"0x00400000","SectionAlignment":"0x00001000","FileAlignment":"0x00000200","OperatingSystemVersion":"6.0","ImageVersion":"0.0","SubsystemVersion":"6.0","Win32VersionValue":"0","SizeOfImage":"0x002AF000","SizeOfHeaders":"0x00000400","Checksum":"0x002C7F60","Subsystem":"IMAGE_SUBSYSTEM_WINDOWS_GUI","DllCharacteristics":["IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"SizeofStackReserve":"0x00100000","SizeofStackCommit":"0x00001000","SizeofHeapReserve":"0x00100000","SizeofHeapCommit":"0x00001000","LoaderFlags":"0x00000000","NumberOfRvaAndSizes":"16"},"Sections":{"sections":[{"name":".text","virtual_size":"0x000C7DDC","virtual_address":"0x00001000","size_of_raw_data":"0x000C7E00","pointer_to_raw_data":"0x00000400","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"],"entropy":6.54276},{"name":".rdata","virtual_size":"0x00046952","virtual_address":"0x000C9000","size_of_raw_data":"0x00046A00","pointer_to_raw_data":"0x000C8200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"entropy":5.98262},{"name":".data","virtual_size":"0x00004D2C","virtual_address":"0x00110000","size_of_raw_data":"0x00003A00","pointer_to_raw_data":"0x0010EC00","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"],"entropy":4.29593},{"name":".rsrc","virtual_size":"0x0018EA88","virtual_address":"0x00115000","size_of_raw_data":"0x0018EC00","pointer_to_raw_data":"0x00112600","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"],"entropy":7.17308},{"name":".reloc","virtual_size":"0x0000A688","virtual_address":"0x002A4000","size_of_raw_data":"0x0000A800","pointer_to_raw_data":"0x002A1200","pointer_to_relocations":"0x00000000","pointer_to_line_numbers":"0x00000000","number_of_line_numbers":0,"number_of_relocations":0,"characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"],"entropy":6.69893}]},"Imports":{"raw_response":"Error: Read timeout on endpoint URL: \"https://bedrock-runtime.ap-south-1.amazonaws.com/model/qwen.qwen3-coder-480b-a35b-v1%3A0/converse\""},"Exports":{},"Resources":{"raw_response":"Error: Read timeout on endpoint URL: \"https://bedrock-runtime.ap-south-1.amazonaws.com/model/qwen.qwen3-coder-480b-a35b-v1%3A0/converse\""},"Debug Info":{"debug_entries":[{"type":"IMAGE_DEBUG_TYPE_CODEVIEW","characteristics":0,"time_date_stamp":"2026-May-06 22:16:41","version":"0.0","size_of_data":102,"address_of_raw_data":"0x001036F0","pointer_to_raw_data":"0x001028F0","referenced_file":"C:\\Jenkins\\workspace\\MBAM-Windows\\A_MB5_MBSetup\\bin\\Win32\\Release\\MBSetup.pdb"},{"type":"IMAGE_DEBUG_TYPE_VC_FEATURE","characteristics":0,"time_date_stamp":"2026-May-06 22:16:41","version":"0.0","size_of_data":20,"address_of_raw_data":"0x00103758","pointer_to_raw_data":"0x00102958"},{"type":"IMAGE_DEBUG_TYPE_POGO","characteristics":0,"time_date_stamp":"2026-May-06 22:16:41","version":"0.0","size_of_data":1116,"address_of_raw_data":"0x0010376C","pointer_to_raw_data":"0x0010296C"},{"type":"IMAGE_DEBUG_TYPE_ILTCG","characteristics":0,"time_date_stamp":"2026-May-06 22:16:41","version":"0.0","size_of_data":0,"address_of_raw_data":"0x00000000","pointer_to_raw_data":"0x00000000"}],"tls_callbacks":{"start_address_of_raw_data":"0x00503BD8","end_address_of_raw_data":"0x00503BE0","address_of_index":"0x00514224","address_of_callbacks":"0x004C9574","size_of_zero_fill":"0x00000000","characteristics":"IMAGE_SCN_ALIGN_4BYTES","callbacks":"EMPTY"}},"Load Configuration":{"size":192,"timeDateStamp":"1970-Jan-01 00:00:00","version":"0.0","globalFlagsClear":"","globalFlagsSet":"","criticalSectionDefaultTimeout":0,"deCommitFreeBlockThreshold":0,"deCommitTotalFreeThreshold":0,"lockPrefixTable":0,"maximumAllocationSize":0,"virtualMemoryThreshold":0,"processAffinityMask":0,"processHeapFlags":"","csdVersion":0,"reserved1":0,"editList":0,"securityCookie":5308544,"seHandlerTable":5254428,"seHandlerCount":375,"delayedImports":{"attributes":1,"name":"USER32.dll","moduleHandle":1128592,"delayImportAddressTable":1128076,"delayImportNameTable":1102300,"boundDelayImportTable":1107284,"unloadDelayImportTable":0,"timeStamp":"1970-Jan-01 00:00:00"}},"RICH Header":{"xor_key":"0x304765BC","unmarked_objects":0,"asm_objects_30795":11,"cpp_objects_30795":191,"c_objects_vs_runtime_33030":19,"asm_objects_vs_runtime_33030":24,"cpp_objects_vs_runtime_33030":111,"c_objects_30795":29,"c_objects_cvtcil_30795":1,"imports_30795":15,"total_imports":460,"cpp_objects_ltcg_33134":35,"resource_objects_33134":1,"unknown_151":2,"linker_33134":1,"matching_compilers":["Microsoft Visual C++ 6.0 - 8.0"],"suspicious_strings":{"internet_browsers":["chrome.exe","firefox.exe"],"virtualization_detection":["Hardware\\Description\\System"],"vmware_references":["VMware"],"dropper_indicators":["CurrentControlSet\\Services"],"wmi_access":["ROOT\\CIMV2"],"malware_related_strings":["Exploit","VIRUS","cmd.exe","exploit"],"domain_names":["amazon.com","amplitude.com","apache.org","api2.amplitude.com","ark-stage.mwbsys.com","ark.mwbsys.com","ark.threatdown.com","ark.threatdownstage.com","aws.amazon.com","br.malwarebytes.com","cdn.cookielaw.org","cdn.jsdelivr.net","cdnjs.cloudflare.com","cloudflare.com","code.jquery.com","cookielaw.org","de.malwarebytes.com","downloads.malwarebytes.com","dse.mwb-dev.net","es.malwarebytes.com","fr.malwarebytes.com","google.com","http://www.adr.org","http://www.adr.org/Forms","http://www.adr.org/Rules","http://www.apache.org","http://www.apache.org/licenses/LICENSE-2.0","http://www.google.com","http://www.google.com/policies/privacy","http://www.malwarebytes.com","http://www.malwarebytes.com/legal","https://ark.mwbsys.com","https://ark.mwbsys.com/bgext","https://aws.amazon.com","https://aws.amazon.com/compliance/","https://br.malwarebytes.com","https://br.malwarebytes.com/privacy/","https://cdn.cookielaw.org","https://cdn.cookielaw.org/consent/9530a107-0af8-4204-a2c2-217efb78222b.js","https://cdn.jsdelivr.net","https://cdn.jsdelivr.net/npm/slick-carousel","https://cdnjs.cloudflare.com","https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick-theme.css","https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.css","https://code.jquery.com","https://code.jquery.com/jquery-3.3.1.min.js","https://de.malwarebytes.com","https://de.malwarebytes.com/privacy/","https://downloads.malwarebytes.com","https://downloads.malwarebytes.com/file/mb5_offline","https://es.malwarebytes.com","https://es.malwarebytes.com/privacy/","https://fr.malwarebytes.com","https://fr.malwarebytes.com/privacy/","https://it.malwarebytes.com","https://it.malwarebytes.com/privacy/","https://links.malwarebytes.com","https://links.malwarebytes.com/link/uninstalled?","https://links.malwarebytes.com/support/general/business/ms-2019-09-security-update","https://links.malwarebytes.com/support/installer/AVBlocking","https://links.malwarebytes.com/support/mb/windows/security-other-av","https://links.malwarebytes.com/support/mb/windows/system-requirements","https://links.malwarebytes.com/windows/support/installation-troubleshooting","https://nl.malwarebytes.com","https://nl.malwarebytes.com/privacy/","https://pl.malwarebytes.com","https://pl.malwarebytes.com/privacy/","https://preferences-mgr.truste.com","https://preferences-mgr.truste.com/","https://pt.malwarebytes.com","https://pt.malwarebytes.com/privacy/","https://ru.malwarebytes.com","https://ru.malwarebytes.com/privacy/","https://support.malwarebytes.com","https://support.malwarebytes.com/hc/en-us/articles/4402964326419","https://www.google.com","https://www.google.com/policies/privacy","https://www.jamsadr.com","https://www.jamsadr.com/eu-us-privacy-shield.","https://www.malwarebytes.com","https://www.malwarebytes.com/","https://www.malwarebytes.com/eula/","https://www.malwarebytes.com/eula/services-agreement/","https://www.malwarebytes.com/images/mb-logo-2.png","https://www.malwarebytes.com/images/share/Malwarebytes-homepage-share.jpg","https://www.malwarebytes.com/images/uploads/2020/07/30233020/EULA_Chart-2.png","https://www.malwarebytes.com/jobs","https://www.malwarebytes.com/js/mess.js","https://www.malwarebytes.com/legal/privacy-policy","https://www.malwarebytes.com/privacy/","https://www.malwarebytes.com/support/lifecycle/","https://www.privacyshield.gov","https://www.privacyshield.gov/article?id","https://www.privacyshield.gov/list","https://www.youronlinechoices.eu","https://www.youronlinechoices.eu/","it.malwarebytes.com","jamsadr.com","jquery.com","jsdelivr.net","links.malwarebytes.com","malwarebytes.com","mgr.truste.com","mwb-dev.net","mwbsys.com","my.malwarebytes.com","nl.malwarebytes.com","pl.malwarebytes.com","preferences-mgr.truste.com","privacyshield.gov","pt.malwarebytes.com","ru.malwarebytes.com","stage.mwbsys.com","support.malwarebytes.com","telemetry.dse.mwb-dev.net","telemetry.malwarebytes.com","threatdown.com","threatdownstage.com","truste.com","www.adr.org","www.apache.org","www.google.com","www.jamsadr.com","www.malwarebytes.com","www.privacyshield.gov"]},"cryptographic_libraries":["Microsoft's Cryptography API"],"malicious_indicators":{"hidden_imports":["LoadLibraryExW","LoadLibraryW","GetProcAddress","LoadLibraryExA"],"anti_debugging_functions":["CreateToolhelp32Snapshot","FindWindowW"],"code_injection_capabilities":["FindWindowW","GetWindowLongW"],"process_launching":["CreateProcessW"],"crypto_api_usage":["CryptMsgClose","CryptMsgGetParam","CryptQueryObject"],"temporary_file_creation":["CreateFileW","GetTempPathW"],"memory_manipulation":["VirtualProtect","VirtualAlloc"],"process_manipulation":["OpenProcess","Process32FirstW","Process32NextW"],"screenshot_capabilities":["FindWindowW","GetDC"]},"exploit_mitigation":{"stack_canary":"enabled","safe_seh":"enabled (375 registered handlers)","aslr":"enabled","dep":"enabled","cfg":"disabled"},"digital_signature":{"signer":"Malwarebytes Inc","issuer":"DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"}},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/MBSetup-3.3-019e2b88-d6a1-74d0-8824-310d46fb50a0.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_7aqj1emj/output.txt"},"timestamp":"2026-05-15 18:21:23"} {"_id":{"$oid":"6a11b9a532de6bb6782baab1"},"sha256":"dccfa4b16aa79e273cc7ffc35493c495a7fd09f92a4b790f2dc41c65f64d5378","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/HxDSetup-019f4697afc57a618c20213defc8d8b0.exe\nDate: 2026-07-09 16:55:47\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/HxDSetup-019f4697afc57a618c20213defc8d8b0.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2018-Jun-14 13:27:46\nDetected languages: Dutch - Netherlands\n English - United States\nComments: This installation was built with Inno Setup.\nCompanyName: Maël Hörz \nFileDescription: HxD Hex Editor Setup \nFileVersion: 2.5 \nLegalCopyright: Copyright © 2002-2021 Maël Hörz \nProductName: HxD Hex Editor \nProductVersion: 2.5 \n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0050\ne_cp: 0x0002\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x000F\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x001A\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000100\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 8\nTimeDateStamp: 2018-Jun-14 13:27:46\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_BYTES_REVERSED_HI\n IMAGE_FILE_BYTES_REVERSED_LO\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00010400\nSizeOfInitializedData: 0x0000D200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0001181C (Section: .itext)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00012000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 6.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x00028000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00004000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000F25C\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000F400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.37588\n\n.itext:\n VirtualSize: 0x00000FA4\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x0000F800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.77877\n\n.data:\n VirtualSize: 0x00000C8C\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x00010800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.30283\n\n.bss:\n VirtualSize: 0x000056BC\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00011600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00000E04\n VirtualAddress: 0x00019000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00011600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.59781\n\n.tls:\n VirtualSize: 0x00000008\n VirtualAddress: 0x0001A000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00012600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rdata:\n VirtualSize: 0x00000018\n VirtualAddress: 0x0001B000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00012600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.204488\n\n.rsrc:\n VirtualSize: 0x0000B200\n VirtualAddress: 0x0001C000\n SizeOfRawData: 0x0000B200\n PointerToRawData: 0x00012800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.14272\n\n\nImports:\n--------\noleaut32.dll: SysFreeString\n SysReAllocStringLen\n SysAllocStringLen\nadvapi32.dll: RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\nuser32.dll: GetKeyboardType\n LoadStringW\n MessageBoxA\n CharNextW\nkernel32.dll: GetACP\n Sleep\n VirtualFree\n VirtualAlloc\n GetSystemInfo\n GetTickCount\n QueryPerformanceCounter\n GetVersion\n GetCurrentThreadId\n VirtualQuery\n WideCharToMultiByte\n MultiByteToWideChar\n lstrlenW\n lstrcpynW\n LoadLibraryExW\n GetThreadLocale\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n GetLocaleInfoW\n GetCommandLineW\n FreeLibrary\n FindFirstFileW\n FindClose\n ExitProcess\n WriteFile\n UnhandledExceptionFilter\n RtlUnwind\n RaiseException\n GetStdHandle\n CloseHandle\nkernel32.dll (#2): GetACP\n Sleep\n VirtualFree\n VirtualAlloc\n GetSystemInfo\n GetTickCount\n QueryPerformanceCounter\n GetVersion\n GetCurrentThreadId\n VirtualQuery\n WideCharToMultiByte\n MultiByteToWideChar\n lstrlenW\n lstrcpynW\n LoadLibraryExW\n GetThreadLocale\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n GetLocaleInfoW\n GetCommandLineW\n FreeLibrary\n FindFirstFileW\n FindClose\n ExitProcess\n WriteFile\n UnhandledExceptionFilter\n RtlUnwind\n RaiseException\n GetStdHandle\n CloseHandle\nuser32.dll (#2): GetKeyboardType\n LoadStringW\n MessageBoxA\n CharNextW\nkernel32.dll (#3): GetACP\n Sleep\n VirtualFree\n VirtualAlloc\n GetSystemInfo\n GetTickCount\n QueryPerformanceCounter\n GetVersion\n GetCurrentThreadId\n VirtualQuery\n WideCharToMultiByte\n MultiByteToWideChar\n lstrlenW\n lstrcpynW\n LoadLibraryExW\n GetThreadLocale\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n GetLocaleInfoW\n GetCommandLineW\n FreeLibrary\n FindFirstFileW\n FindClose\n ExitProcess\n WriteFile\n UnhandledExceptionFilter\n RtlUnwind\n RaiseException\n GetStdHandle\n CloseHandle\nadvapi32.dll (#2): RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\ncomctl32.dll: InitCommonControls\nkernel32.dll (#4): GetACP\n Sleep\n VirtualFree\n VirtualAlloc\n GetSystemInfo\n GetTickCount\n QueryPerformanceCounter\n GetVersion\n GetCurrentThreadId\n VirtualQuery\n WideCharToMultiByte\n MultiByteToWideChar\n lstrlenW\n lstrcpynW\n LoadLibraryExW\n GetThreadLocale\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n GetLocaleInfoW\n GetCommandLineW\n FreeLibrary\n FindFirstFileW\n FindClose\n ExitProcess\n WriteFile\n UnhandledExceptionFilter\n RtlUnwind\n RaiseException\n GetStdHandle\n CloseHandle\nadvapi32.dll (#3): RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.25755\n\n2:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.47151\n\n3:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.91708\n\n4:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.91366\n\n4091:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.56031\n\n4092:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 212\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.25287\n\n4093:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 164\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.26919\n\n4094:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 684\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.33268\n\n4095:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 844\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.34579\n\n4096:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 660\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.28057\n\nCHARTABLE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 33512\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.5072\n\nDVCLAL:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 4\n\nPACKAGEINFO:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 336\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 5.17906\n\n11111:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 44\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 4.52263\n\nMAINICON:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 62\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.64576\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1268\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.75253\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1580\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 5.13965\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2.5.0.0\n ProductVersion: 2.5.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: This installation was built with Inno Setup.\n CompanyName: Maël Hörz \n FileDescription: HxD Hex Editor Setup \n FileVersion (#2): 2.5 \n LegalCopyright: Copyright © 2002-2021 Maël Hörz \n ProductName: HxD Hex Editor \n ProductVersion (#2): 2.5 \n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x0041A000\nEndAddressOfRawData: 0x0041A008\nAddressOfIndex: 0x004127AC\nAddressOfCallbacks: 0x0041B010\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: (EMPTY)\n\nInteresting strings found in the binary:\n Contains domain names:\n http://www.jrsoftware.org\n http://www.jrsoftware.org/ishelp/index.php?topic\n jrsoftware.org\n www.jrsoftware.org\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .itext\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n LoadLibraryW\n Can access the registry:\n RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe PE's resources present abnormal characteristics.\n The binary may have been compiled on a machine in the UTC+2 timezone.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 3323613 bytes of data starting at offset 0x1da00.\n The overlay data has an entropy of 7.9999 and is possibly compressed or encrypted.\n Overlay data amounts for 96.4776% of the executable.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2018-Jun-14 13:27:46\nDetected languages: Dutch - Netherlands\n English - United States\nComments: This installation was built with Inno Setup.\nCompanyName: Maël Hörz \nFileDescription: HxD Hex Editor Setup \nFileVersion: 2.5 \nLegalCopyright: Copyright © 2002-2021 Maël Hörz \nProductName: HxD Hex Editor \nProductVersion: 2.5"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0050\ne_cp: 0x0002\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x000F\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x001A\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000100"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 8\nTimeDateStamp: 2018-Jun-14 13:27:46\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_BYTES_REVERSED_HI\n IMAGE_FILE_BYTES_REVERSED_LO\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00010400\nSizeOfInitializedData: 0x0000D200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0001181C (Section: .itext)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00012000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 6.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x00028000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00004000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000F25C\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000F400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.37588\n\n.itext:\n VirtualSize: 0x00000FA4\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x0000F800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.77877\n\n.data:\n VirtualSize: 0x00000C8C\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x00010800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.30283\n\n.bss:\n VirtualSize: 0x000056BC\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00011600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00000E04\n VirtualAddress: 0x00019000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00011600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.59781\n\n.tls:\n VirtualSize: 0x00000008\n VirtualAddress: 0x0001A000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00012600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rdata:\n VirtualSize: 0x00000018\n VirtualAddress: 0x0001B000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00012600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.204488\n\n.rsrc:\n VirtualSize: 0x0000B200\n VirtualAddress: 0x0001C000\n SizeOfRawData: 0x0000B200\n PointerToRawData: 0x00012800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.14272"},"Imports":{"raw":"oleaut32.dll: SysFreeString\n SysReAllocStringLen\n SysAllocStringLen\nadvapi32.dll: RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\nuser32.dll: GetKeyboardType\n LoadStringW\n MessageBoxA\n CharNextW\nkernel32.dll: GetACP\n Sleep\n VirtualFree\n VirtualAlloc\n GetSystemInfo\n GetTickCount\n QueryPerformanceCounter\n GetVersion\n GetCurrentThreadId\n VirtualQuery\n WideCharToMultiByte\n MultiByteToWideChar\n lstrlenW\n lstrcpynW\n LoadLibraryExW\n GetThreadLocale\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n GetLocaleInfoW\n GetCommandLineW\n FreeLibrary\n FindFirstFileW\n FindClose\n ExitProcess\n WriteFile\n UnhandledExceptionFilter\n RtlUnwind\n RaiseException\n GetStdHandle\n CloseHandle\nkernel32.dll (#2): GetACP\n Sleep\n VirtualFree\n VirtualAlloc\n GetSystemInfo\n GetTickCount\n QueryPerformanceCounter\n GetVersion\n GetCurrentThreadId\n VirtualQuery\n WideCharToMultiByte\n MultiByteToWideChar\n lstrlenW\n lstrcpynW\n LoadLibraryExW\n GetThreadLocale\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n GetLocaleInfoW\n GetCommandLineW\n FreeLibrary\n FindFirstFileW\n FindClose\n ExitProcess\n WriteFile\n UnhandledExceptionFilter\n RtlUnwind\n RaiseException\n GetStdHandle\n CloseHandle\nuser32.dll (#2): GetKeyboardType\n LoadStringW\n MessageBoxA\n CharNextW\nkernel32.dll (#3): GetACP\n Sleep\n VirtualFree\n VirtualAlloc\n GetSystemInfo\n GetTickCount\n QueryPerformanceCounter\n GetVersion\n GetCurrentThreadId\n VirtualQuery\n WideCharToMultiByte\n MultiByteToWideChar\n lstrlenW\n lstrcpynW\n LoadLibraryExW\n GetThreadLocale\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n GetLocaleInfoW\n GetCommandLineW\n FreeLibrary\n FindFirstFileW\n FindClose\n ExitProcess\n WriteFile\n UnhandledExceptionFilter\n RtlUnwind\n RaiseException\n GetStdHandle\n CloseHandle\nadvapi32.dll (#2): RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\ncomctl32.dll: InitCommonControls\nkernel32.dll (#4): GetACP\n Sleep\n VirtualFree\n VirtualAlloc\n GetSystemInfo\n GetTickCount\n QueryPerformanceCounter\n GetVersion\n GetCurrentThreadId\n VirtualQuery\n WideCharToMultiByte\n MultiByteToWideChar\n lstrlenW\n lstrcpynW\n LoadLibraryExW\n GetThreadLocale\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n GetLocaleInfoW\n GetCommandLineW\n FreeLibrary\n FindFirstFileW\n FindClose\n ExitProcess\n WriteFile\n UnhandledExceptionFilter\n RtlUnwind\n RaiseException\n GetStdHandle\n CloseHandle\nadvapi32.dll (#3): RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\n\nResources:\n1:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.25755\n\n2:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.47151\n\n3:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.91708\n\n4:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.91366\n\n4091:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.56031\n\n4092:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 212\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.25287\n\n4093:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 164\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.26919\n\n4094:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 684\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.33268\n\n4095:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 844\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.34579\n\n4096:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 660\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.28057\n\nCHARTABLE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 33512\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.5072\n\nDVCLAL:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 4\n\nPACKAGEINFO:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 336\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 5.17906\n\n11111:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 44\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 4.52263\n\nMAINICON:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 62\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.64576\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1268\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.75253\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1580\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 5.13965\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2.5.0.0\n ProductVersion: 2.5.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: This installation was built with Inno Setup.\n CompanyName: Maël Hörz \n FileDescription: HxD Hex Editor Setup \n FileVersion (#2): 2.5 \n LegalCopyright: Copyright © 2002-2021 Maël Hörz \n ProductName: HxD Hex Editor \n ProductVersion (#2): 2.5 \n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x0041A000\nEndAddressOfRawData: 0x0041A008\nAddressOfIndex: 0x004127AC\nAddressOfCallbacks: 0x0041B010\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: (EMPTY)\n\nInteresting strings found in the binary:\n Contains domain names:\n http://www.jrsoftware.org\n http://www.jrsoftware.org/ishelp/index.php?topic\n jrsoftware.org\n www.jrsoftware.org\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .itext\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n LoadLibraryW\n Can access the registry:\n RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe PE's resources present abnormal characteristics.\n The binary may have been compiled on a machine in the UTC+2 timezone.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 3323613 bytes of data starting at offset 0x1da00.\n The overlay data has an entropy of 7.9999 and is possibly compressed or encrypted.\n Overlay data amounts for 96.4776% of the executable.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.25755\n\n2:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.47151\n\n3:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.91708\n\n4:\n Type: RT_ICON\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.91366\n\n4091:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.56031\n\n4092:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 212\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.25287\n\n4093:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 164\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.26919\n\n4094:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 684\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.33268\n\n4095:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 844\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.34579\n\n4096:\n Type: RT_STRING\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 660\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.28057\n\nCHARTABLE:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 33512\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 3.5072\n\nDVCLAL:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 4\n\nPACKAGEINFO:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 336\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 5.17906\n\n11111:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 44\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 4.52263\n\nMAINICON:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 62\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.64576\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1268\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 2.75253\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1580\n TimeDateStamp: 2018-Jun-14 15:27:48\n Entropy: 5.13965\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2.5.0.0\n ProductVersion: 2.5.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: This installation was built with Inno Setup.\n CompanyName: Maël Hörz \n FileDescription: HxD Hex Editor Setup \n FileVersion (#2): 2.5 \n LegalCopyright: Copyright © 2002-2021 Maël Hörz \n ProductName: HxD Hex Editor \n ProductVersion (#2): 2.5 \n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x0041A000\nEndAddressOfRawData: 0x0041A008\nAddressOfIndex: 0x004127AC\nAddressOfCallbacks: 0x0041B010\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: (EMPTY)\n\nInteresting strings found in the binary:\n Contains domain names:\n http://www.jrsoftware.org\n http://www.jrsoftware.org/ishelp/index.php?topic\n jrsoftware.org\n www.jrsoftware.org\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .itext\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n LoadLibraryW\n Can access the registry:\n RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe PE's resources present abnormal characteristics.\n The binary may have been compiled on a machine in the UTC+2 timezone.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 3323613 bytes of data starting at offset 0x1da00.\n The overlay data has an entropy of 7.9999 and is possibly compressed or encrypted.\n Overlay data amounts for 96.4776% of the executable.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{"raw":"Contains domain names:\n http://www.jrsoftware.org\n http://www.jrsoftware.org/ishelp/index.php?topic\n jrsoftware.org\n www.jrsoftware.org\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .itext\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n LoadLibraryW\n Can access the registry:\n RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe PE's resources present abnormal characteristics.\n The binary may have been compiled on a machine in the UTC+2 timezone.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 3323613 bytes of data starting at offset 0x1da00.\n The overlay data has an entropy of 7.9999 and is possibly compressed or encrypted.\n Overlay data amounts for 96.4776% of the executable.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/HxDSetup-019f4697afc57a618c20213defc8d8b0.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze__1ekbdp6/output.txt"},"timestamp":"2026-07-09 16:55:47"} {"_id":{"$oid":"6a131b4032de6bb6782baac2"},"sha256":"a14055e8b09fd980e82a3eb551fe7ca60018b5486d46e462fda29ee88f252ca0","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/BrowsingHistoryView-019e5a9f39047902b64b76f6e25fc509.exe\nDate: 2026-05-24 21:07:35\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/BrowsingHistoryView-019e5a9f39047902b64b76f6e25fc509.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2025-Mar-26 10:28:47\nDetected languages: English - United States\n Hebrew - Israel\nCompanyName: NirSoft\nFileDescription: Web Browser History Viewer\nFileVersion: 2.60\nLegalCopyright: Copyright © 2012 - 2025 Nir Sofer\nOriginalFilename: BrowsingHistoryView.exe\nProductName: BrowsingHistoryView\nProductVersion: 2.60\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2025-Mar-26 10:28:47\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00089000\nSizeOfInitializedData: 0x00018400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000193E (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0008A000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x000A5000\nSizeOfHeaders: 0x00000400\nChecksum: 0x000A9703\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00088EEB\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00089000\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.57183\n\n.rdata:\n VirtualSize: 0x0000BA16\n VirtualAddress: 0x0008A000\n SizeOfRawData: 0x0000BC00\n PointerToRawData: 0x00089400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.79085\n\n.data:\n VirtualSize: 0x00002BE8\n VirtualAddress: 0x00096000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00095000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.37625\n\n.rsrc:\n VirtualSize: 0x0000B50C\n VirtualAddress: 0x00099000\n SizeOfRawData: 0x0000B600\n PointerToRawData: 0x00096200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.39067\n\n\nImports:\n--------\nCOMCTL32.dll: CreateToolbarEx\n CreateStatusWindowW\n ImageList_SetImageCount\n ImageList_AddMasked\n ImageList_Add\n #17\n ImageList_Create\n ImageList_ReplaceIcon\nVERSION.dll: GetFileVersionInfoSizeW\n VerQueryValueW\n GetFileVersionInfoW\nmsvcrt.dll: strftime\n qsort\n _wcslwr\n _itow\n strchr\n _endthreadex\n memmove\n modf\n wcstoul\n _memicmp\n free\n _msize\n _beginthreadex\n _gmtime64\n realloc\n _wcsnicmp\n __dllonexit\n wcsrchr\n malloc\n ??3@YAXPAX@Z\n ??2@YAPAXI@Z\n _purecall\n _ultow\n sprintf\n _wcsupr\n _wtoi\n _wcsicmp\n wcschr\n wcsncat\n _snwprintf\n _onexit\n _c_exit\n _exit\n _XcptFilter\n _cexit\n exit\n _wcmdln\n __wgetmainargs\n _initterm\n __setusermatherr\n _adjust_fdiv\n __p__commode\n __p__fmode\n memcpy\n _except_handler3\n _controlfp\n __set_app_type\n memset\nWININET.dll: FindFirstUrlCacheEntryW\n FindCloseUrlCache\n FindNextUrlCacheEntryW\nKERNEL32.dll: GetStartupInfoW\n GetModuleHandleA\n HeapSize\n DeleteCriticalSection\n InitializeCriticalSection\n SetEndOfFile\n GetFileAttributesExW\n FormatMessageA\n TryEnterCriticalSection\n FlushFileBuffers\n GetProcessHeap\n UnlockFileEx\n OutputDebugStringW\n SystemTimeToFileTime\n FileTimeToSystemTime\n GetFileSize\n CloseHandle\n GetSystemTimeAsFileTime\n ExpandEnvironmentStringsW\n CompareFileTime\n CopyFileW\n CreateFileW\n DeleteFileW\n FreeLibrary\n GetModuleHandleW\n LoadLibraryW\n GetProcAddress\n GetTickCount\n SetFilePointerEx\n GetLastError\n MultiByteToWideChar\n lstrcpyW\n LockResource\n ReadFile\n LocalFileTimeToFileTime\n FindFirstFileW\n GetModuleFileNameW\n SetFilePointer\n lstrlenW\n WriteFile\n GlobalUnlock\n GetTempPathW\n GlobalAlloc\n FindResourceW\n GetSystemDirectoryW\n LoadResource\n WideCharToMultiByte\n FindNextFileW\n LoadLibraryExW\n SizeofResource\n FindClose\n FormatMessageW\n GetWindowsDirectoryW\n GlobalLock\n GetVersionExW\n FileTimeToLocalFileTime\n LocalFree\n GetDateFormatW\n GetTimeFormatW\n GetTempFileNameW\n GetFileAttributesW\n DosDateTimeToFileTime\n CreateFileMappingW\n OpenProcess\n DuplicateHandle\n GetCurrentProcessId\n MapViewOfFile\n UnmapViewOfFile\n GetDriveTypeW\n GetCurrentProcess\n GetPrivateProfileStringW\n WritePrivateProfileStringW\n GetPrivateProfileIntW\n EnumResourceNamesW\n GetStdHandle\n GetCurrentDirectoryW\n SetErrorMode\n ExitProcess\n ReadProcessMemory\n Process32NextW\n CreateToolhelp32Snapshot\n Process32FirstW\n EnumResourceTypesW\n GetCurrentThreadId\n HeapAlloc\n OutputDebugStringA\n GetVersionExA\n LockFileEx\n Sleep\n EnterCriticalSection\n QueryPerformanceCounter\n GetDiskFreeSpaceW\n HeapDestroy\n HeapFree\n GetFullPathNameW\n LeaveCriticalSection\n GetTempPathA\n GetFileAttributesA\n GetFullPathNameA\n WaitForSingleObject\n CreateFileMappingA\n GetSystemTime\n HeapCreate\n AreFileApisANSI\n InterlockedCompareExchange\n DeleteFileA\n HeapValidate\n UnlockFile\n HeapReAlloc\n FlushViewOfFile\n CreateFileA\n GetDiskFreeSpaceA\n LockFile\n WaitForSingleObjectEx\n CreateMutexW\n GetSystemInfo\n HeapCompact\nUSER32.dll: CreatePopupMenu\n ReleaseDC\n SetCursor\n LoadCursorW\n GetSysColorBrush\n ShowWindow\n ChildWindowFromPoint\n GetDC\n SetDlgItemTextW\n GetDlgItemTextW\n GetSystemMetrics\n GetWindowRect\n GetWindowPlacement\n GetDlgItemInt\n DeferWindowPos\n SetDlgItemInt\n SetWindowPlacement\n CreateWindowExW\n BeginPaint\n EndPaint\n GetWindow\n GetClientRect\n SendDlgItemMessageW\n DrawFrameControl\n EndDialog\n SetWindowLongW\n GetDlgItem\n SetWindowTextW\n UpdateWindow\n SendMessageW\n InvalidateRect\n SetMenu\n SetWindowPos\n LoadAcceleratorsW\n DefWindowProcW\n PostMessageW\n RegisterClassW\n MessageBoxW\n TranslateAcceleratorW\n LoadImageW\n LoadIconW\n GetSysColor\n GetWindowLongW\n EndDeferWindowPos\n BeginDeferWindowPos\n SetFocus\n GetParent\n GetFocus\n KillTimer\n SetTimer\n OpenClipboard\n CloseClipboard\n EmptyClipboard\n SetClipboardData\n CheckMenuItem\n GetCursorPos\n GetSubMenu\n GetMenu\n EnableWindow\n MapWindowPoints\n InsertMenuItemW\n FillRect\n EnableMenuItem\n GetClassNameW\n GetMenuStringW\n ScreenToClient\n MoveWindow\n GetMenuItemCount\n CheckMenuRadioItem\n EnumChildWindows\n DestroyWindow\n LoadStringW\n GetDesktopWindow\n GetWindowTextW\n LoadMenuW\n ModifyMenuW\n GetMenuItemInfoW\n GetDlgCtrlID\n DestroyMenu\n DialogBoxParamW\n CreateDialogParamW\n GetKeyState\n SetMenuItemInfoW\n RegisterWindowMessageW\n TrackPopupMenu\n PostQuitMessage\n GetMessageW\n DrawTextExW\n DispatchMessageW\n InsertMenuW\n RemoveMenu\n IsDialogMessageW\n TranslateMessage\n PeekMessageW\n GetMonitorInfoW\n MonitorFromWindow\n ReleaseCapture\n SetCapture\nGDI32.dll: SetBkColor\n GetTextExtentPoint32W\n SetStretchBltMode\n CreateSolidBrush\n StretchBlt\n PatBlt\n GetStockObject\n SetPixel\n GetObjectW\n GetPixel\n SetDIBits\n DeleteDC\n SelectObject\n CreateCompatibleDC\n CreateCompatibleBitmap\n DeleteObject\n SetTextColor\n CreateFontIndirectW\n GetDeviceCaps\n SetBkMode\ncomdlg32.dll: FindTextW\n GetSaveFileNameW\n GetOpenFileNameW\n ChooseFontW\nADVAPI32.dll: RegOpenKeyExW\n RegCloseKey\n RegSetValueExW\n RegQueryValueExW\n RegDeleteValueW\nSHELL32.dll: ShellExecuteW\n SHGetFileInfoW\n SHGetPathFromIDListW\n SHGetMalloc\n SHBrowseForFolderW\nole32.dll: CoUninitialize\n CoCreateInstance\n CoInitialize\nOLEAUT32.dll: SysAllocString\n SysFreeString\n\nResources:\n----------\n1:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77748\n\n2:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.27305\n\n111:\n Type: RT_BITMAP\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 7720\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.19556\n\n133:\n Type: RT_BITMAP\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.40854\n\n134:\n Type: RT_BITMAP\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.44509\n\n3:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.28929\n\n4:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.63268\n\n5:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.732\n\n6:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.05338\n\n7:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.60488\n\n8:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.59465\n\n9:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.03789\n\n10:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.53675\n\n11:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.04518\n\n12:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.78929\n\n13:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.23257\n\n14:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.37777\n\n15:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.20672\n\n16:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.74254\n\n102:\n Type: RT_MENU\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1840\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46766\n\n104:\n Type: RT_MENU\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28652\n\n110:\n Type: RT_MENU\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 18\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05583\n\n105:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 188\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.88349\n\n107:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.38237\n\n109:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 3052\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.53493\n\n112:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 250\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09378\n\n113:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1150\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52003\n\n114:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 248\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00572\n\n1096:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 822\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.54616\n\n1 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 522\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2537\n\n32:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 280\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.03744\n\n38:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 208\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09029\n\n39:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 236\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.32896\n\n44:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 258\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.75952\n\n45:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 500\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.03585\n\n47:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 68\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.88341\n\n48:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 492\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08588\n\n49:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 160\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.53036\n\n51:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 800\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1455\n\n57:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 266\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.31291\n\n58:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 176\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04003\n\n63:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 160\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.97371\n\n64:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 194\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16434\n\n103:\n Type: RT_ACCELERATOR\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.07271\n\n103 (#2):\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83876\n Detected Filetype: Cursor file\n\n113 (#2):\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.91924\n Detected Filetype: Cursor file\n\n101:\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 34\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.30604\n Detected Filetype: Icon file\n\n102 (#2):\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n103 (#3):\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n104 (#2):\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n105 (#2):\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n106:\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n107 (#2):\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n114 (#2):\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n115:\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n116:\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n117:\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n118:\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n119:\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.94375\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 720\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40921\n\n1 (#4):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1093\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.40431\n\n\nVersion Info:\n-------------\nResource LangID: Hebrew - Israel\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2.6.0.34\n ProductVersion: 2.6.0.34\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: NirSoft\n FileDescription: Web Browser History Viewer\n FileVersion (#2): 2.60\n LegalCopyright: Copyright © 2012 - 2025 Nir Sofer\n OriginalFilename: BrowsingHistoryView.exe\n ProductName: BrowsingHistoryView\n ProductVersion (#2): 2.60\n\n\nRICH Header:\n------------\nXOR Key: 0xBB3AD956\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 3\nASM objects (9210): 12\nC objects (9178): 11\nImports (9210): 2\nImports (VS2003 (.NET) build 4035): 23\nTotal imports: 364\n114 (VS2012 build 50727 / VS2005 build 50727): 45\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n firefox.exe\n Contains domain names:\n http://www.nirsoft.net\n http://www.nirsoft.net/\n nirsoft.net\n www.nirsoft.net\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryW\n GetProcAddress\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n Can access the registry:\n RegOpenKeyExW\n RegCloseKey\n RegSetValueExW\n RegQueryValueExW\n RegDeleteValueW\n Possibly launches other programs:\n ShellExecuteW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n GetTempPathA\n CreateFileA\n Enumerates local disk drives:\n GetDriveTypeW\n Manipulates other processes:\n OpenProcess\n ReadProcessMemory\n Process32NextW\n Process32FirstW\n Can take screenshots:\n GetDC\n CreateCompatibleDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"DOS Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"PE Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Image Optional Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Sections":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Imports":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Exports":{},"Resources":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/BrowsingHistoryView-019e5a9f39047902b64b76f6e25fc509.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_vdphkyja/output.txt"},"timestamp":"2026-05-24 21:07:36"} {"_id":{"$oid":"6a13e5be32de6bb6782baac7"},"sha256":"637175bedfe6852886341e15c4d48241d7a58083a45272df0aac35469c653f6f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_k1vcrp4_/WirelessNetView-019e5db7803a7fb0825cc53140c34d58.exe_637175bedfe6/001_upx_unpacked.exe\nDate: 2026-05-25 11:31:33\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_k1vcrp4_/WirelessNetView-019e5db7803a7fb0825cc53140c34d58.exe_637175bedfe6/001_upx_unpacked.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-Oct-03 11:43:56\nDetected languages: English - United States\n Hebrew - Israel\nCompanyName: NirSoft\nFileDescription: WirelessNetView\nFileVersion: 1.75\nInternalName: WirelessNetView\nLegalCopyright: Copyright © 2008 - 2017 Nir Sofer\nOriginalFilename: WirelessNetView.exe\nProductName: WirelessNetView\nProductVersion: 1.75\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2017-Oct-03 11:43:56\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x0000C800\nSizeOfInitializedData: 0x00007E00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000D3D0 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000E000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00018000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000C747\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000C800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.4016\n\n.rdata:\n VirtualSize: 0x00002E12\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00003000\n PointerToRawData: 0x0000CC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.27786\n\n.data:\n VirtualSize: 0x00001B28\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0000FC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.02075\n\n.rsrc:\n VirtualSize: 0x000045BC\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00004600\n PointerToRawData: 0x00010400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.79506\n\n\nImports:\n--------\nKERNEL32.DLL: OpenProcess\n GetCurrentProcessId\n ReadProcessMemory\n GetCurrentProcess\n ExitProcess\n WaitForSingleObject\n SetErrorMode\n CreateThread\n DeleteFileW\n GetPrivateProfileIntW\n WritePrivateProfileStringW\n GetPrivateProfileStringW\n EnumResourceNamesW\n WriteFile\n EnumResourceTypesW\n Sleep\n GetModuleHandleA\n GetStartupInfoW\n GetProcAddress\n FileTimeToLocalFileTime\n CompareFileTime\n GetSystemTimeAsFileTime\n MultiByteToWideChar\n LoadLibraryW\n FileTimeToSystemTime\n FreeLibrary\n LocalFree\n FindResourceW\n GlobalAlloc\n GlobalUnlock\n LoadResource\n GetTempPathW\n WideCharToMultiByte\n LoadLibraryExW\n GetLastError\n GetLocaleInfoW\n SizeofResource\n GlobalLock\n FormatMessageW\n GetVersionExW\n CloseHandle\n GetDateFormatW\n GetWindowsDirectoryW\n GetTempFileNameW\n GetTimeFormatW\n GetFileSize\n GetModuleHandleW\n GetFileAttributesW\n GetNumberFormatW\n ReadFile\n LockResource\n GetModuleFileNameW\n CreateFileW\nADVAPI32.dll: RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\nCOMCTL32.dll: ImageList_SetImageCount\n ImageList_ReplaceIcon\n #17\n ImageList_Create\n ImageList_AddMasked\n CreateToolbarEx\n CreateStatusWindowW\ncomdlg32.dll: GetSaveFileNameW\n FindTextW\nGDI32.dll: DeleteObject\n GetStockObject\n GetTextExtentPoint32W\n SetBkColor\n GetDeviceCaps\n SelectObject\n SetTextColor\n CreateFontIndirectW\n SetBkMode\nmsvcrt.dll: __p__commode\n _adjust_fdiv\n __setusermatherr\n _initterm\n __wgetmainargs\n _wcmdln\n exit\n _cexit\n _XcptFilter\n _exit\n _c_exit\n _onexit\n __p__fmode\n strtoul\n strncpy\n strcpy\n _wcslwr\n strlen\n qsort\n _purecall\n wcsrchr\n wcsncpy\n malloc\n wcschr\n __set_app_type\n _controlfp\n __dllonexit\n _except_handler3\n free\n modf\n wcscmp\n _wtoi\n wcstoul\n _memicmp\n ??2@YAPAXI@Z\n ??3@YAXPAX@Z\n wcslen\n _ultow\n memcmp\n _itow\n _wcsicmp\n memcpy\n wcscpy\n memset\n wcscat\n _snwprintf\n wcsncat\nSHELL32.dll: SHGetFileInfoW\n ShellExecuteW\n Shell_NotifyIconW\nUSER32.dll: SetForegroundWindow\n PostQuitMessage\n TrackPopupMenu\n RegisterWindowMessageW\n SendMessageTimeoutW\n KillTimer\n MessageBeep\n IsWindowVisible\n FindWindowW\n SetCursor\n LoadCursorW\n GetSysColorBrush\n ShowWindow\n ChildWindowFromPoint\n CreateWindowExW\n GetWindowRect\n GetDlgItemInt\n GetWindowTextLengthW\n SendDlgItemMessageW\n EndDialog\n EndPaint\n GetDlgItem\n InvalidateRect\n SetDlgItemInt\n GetWindow\n BeginPaint\n DrawFrameControl\n GetClientRect\n SetWindowTextW\n SetDlgItemTextW\n GetDlgItemTextW\n GetSystemMetrics\n DeferWindowPos\n UpdateWindow\n SendMessageW\n TranslateAcceleratorW\n RegisterClassW\n MessageBoxW\n SetMenu\n SetWindowPos\n GetWindowPlacement\n LoadAcceleratorsW\n PostMessageW\n DefWindowProcW\n LoadImageW\n LoadIconW\n GetWindowLongW\n SetWindowLongW\n EndDeferWindowPos\n BeginDeferWindowPos\n SetFocus\n GetKeyState\n CallWindowProcW\n GetDC\n EmptyClipboard\n EnableMenuItem\n ReleaseDC\n GetClassNameW\n OpenClipboard\n GetMenuStringW\n CloseClipboard\n MoveWindow\n GetMenuItemCount\n CheckMenuRadioItem\n GetParent\n CheckMenuItem\n GetCursorPos\n GetSysColor\n SetClipboardData\n GetMenu\n GetSubMenu\n EnableWindow\n MapWindowPoints\n ModifyMenuW\n GetMenuItemInfoW\n DialogBoxParamW\n GetDlgCtrlID\n DestroyMenu\n DestroyWindow\n CreateDialogParamW\n EnumChildWindows\n LoadStringW\n GetWindowTextW\n LoadMenuW\n GetMessageW\n SetTimer\n IsDialogMessageW\n DispatchMessageW\n TranslateMessage\n DrawTextExW\n\nResources:\n----------\n1:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77748\n\n104:\n Type: RT_BITMAP\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1000\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.6489\n\n133:\n Type: RT_BITMAP\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.40854\n\n134:\n Type: RT_BITMAP\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.44509\n\n2:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.77341\n\n3:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.5351\n\n4:\n Type: RT_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.5351\n\n102:\n Type: RT_MENU\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2234\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.47794\n\n104 (#2):\n Type: RT_MENU\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 536\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21183\n\n109:\n Type: RT_MENU\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 82\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98862\n\n105:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 162\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15596\n\n107:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.38237\n\n112:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 250\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.09378\n\n115:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 424\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.31215\n\n121:\n Type: RT_DIALOG\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 320\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.24686\n\n1096:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 822\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.54616\n\n1 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 586\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23536\n\n2 (#2):\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 544\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.10956\n\n7:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 88\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.54309\n\n13:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 148\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.03559\n\n32:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 280\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04212\n\n38:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 152\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.01634\n\n39:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.24891\n\n41:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 72\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.10121\n\n63:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 206\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.03729\n\n64:\n Type: RT_STRING\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 360\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49639\n\n103:\n Type: RT_ACCELERATOR\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 136\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25605\n\n103 (#2):\n Type: RT_GROUP_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83876\n Detected Filetype: Cursor file\n\n101:\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 34\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.42369\n Detected Filetype: Icon file\n\n102 (#2):\n Type: RT_GROUP_ICON\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0815\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: Hebrew - Israel\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.36935\n\n1 (#4):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 362\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07251\n\n\nVersion Info:\n-------------\nResource LangID: Hebrew - Israel\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.7.5.0\n ProductVersion: 1.7.5.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: NirSoft\n FileDescription: WirelessNetView\n FileVersion (#2): 1.75\n InternalName: WirelessNetView\n LegalCopyright: Copyright © 2008 - 2017 Nir Sofer\n OriginalFilename: WirelessNetView.exe\n ProductName: WirelessNetView\n ProductVersion (#2): 1.75\n\n\nRICH Header:\n------------\nXOR Key: 0x231B48D6\nUnmarked objects: 0\nImports (VS2003 (.NET) build 4035): 14\nASM objects (9210): 3\nC objects (9178): 11\nTotal imports: 264\nImports (9210): 3\n114 (VS2012 build 50727 / VS2005 build 50727): 28\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nInteresting strings found in the binary:\n Contains domain names:\n comodo.net\n comodoca.com\n crl.comodoca.com\n crl.usertrust.com\n crt.comodoca.com\n crt.usertrust.com\n http://crl.comodoca.com\n http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r\n http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q\n http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t\n http://crl.usertrust.com\n http://crl.usertrust.com/AddTrustExternalCARoot.crl05\n http://crl.usertrust.com/UTN-USERFirst-Object.crl05\n http://crl.usertrust.com/UTN-USERFirst-Object.crl0t\n http://crt.comodoca.com\n http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$\n http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$\n http://crt.comodoca.com/COMODORSACodeSigningCA.crt0$\n http://crt.usertrust.com\n http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%\n http://ocsp.comodoca.com0\n http://ocsp.usertrust.com0\n http://www.nirsoft.net\n http://www.nirsoft.net/\n http://www.usertrust.com1\n https://secure.comodo.net\n https://secure.comodo.net/CPS0A\n https://secure.comodo.net/CPS0C\n nirsoft.net\n secure.comodo.net\n usertrust.com\n www.nirsoft.net\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to SHA256\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n FindWindowW\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n RegQueryValueExW\n RegOpenKeyExW\n RegCloseKey\n Possibly launches other programs:\n ShellExecuteW\n Can create temporary files:\n GetTempPathW\n CreateFileW\n Manipulates other processes:\n OpenProcess\n ReadProcessMemory\n Can take screenshots:\n FindWindowW\n GetDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 11984 bytes of data starting at offset 0x14a00.\n The overlay data has an entropy of 7.42164 and is possibly compressed or encrypted.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"DOS Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"PE Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Image Optional Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Sections":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Imports":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Exports":{},"Resources":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Interesting strings found in the binary":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"file_path":"/tmp/sdm_unpack_k1vcrp4_/WirelessNetView-019e5db7803a7fb0825cc53140c34d58.exe_637175bedfe6/001_upx_unpacked.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_oxdpdd71/output.txt"},"timestamp":"2026-05-25 11:31:34"} {"_id":{"$oid":"6a14627d32de6bb6782baad8"},"sha256":"bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_decoded_c8oa189i/zlib_offset_0x6aee8_7.bin\nDate: 2026-05-26 00:28:50\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_decoded_c8oa189i/zlib_offset_0x6aee8_7.bin\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Apr-02 07:53:11\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000100\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2026-Apr-02 07:53:11\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00025200\nSizeOfInitializedData: 0x00010C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000253F4 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0003A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00025018\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00025200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.20152\n\n.rdata:\n VirtualSize: 0x000088D4\n VirtualAddress: 0x00027000\n SizeOfRawData: 0x00008A00\n PointerToRawData: 0x00025600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.25688\n\n.data:\n VirtualSize: 0x00005C28\n VirtualAddress: 0x00030000\n SizeOfRawData: 0x00004A00\n PointerToRawData: 0x0002E000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.61748\n\n.pdata:\n VirtualSize: 0x0000180C\n VirtualAddress: 0x00036000\n SizeOfRawData: 0x00001A00\n PointerToRawData: 0x00032A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.85358\n\n.rsrc:\n VirtualSize: 0x000000F8\n VirtualAddress: 0x00038000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00034400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.52592\n\n.reloc:\n VirtualSize: 0x00000700\n VirtualAddress: 0x00039000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00034600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.1969\n\n\nImports:\n--------\npython314.dll: _Py_ctype_table\n PyObject_SetAttrString\n PyObject_GC_UnTrack\n PyNumber_Xor\n PyDict_GetItemWithError\n PyComplex_FromDoubles\n PySet_Contains\n PyObject_GetAttr\n PyDict_Contains\n PyUnicode_FromOrdinal\n PyFloat_AsDouble\n _Py_NoneStruct\n PyTuple_New\n PyLong_FromString\n PySequence_Contains\n PyObject_GenericSetDict\n PyUnicode_ReadChar\n PyObject_VisitManagedDict\n PyVectorcall_Call\n PyDict_Size\n PyFloat_FromDouble\n PySet_Add\n PyExc_AttributeError\n PyTuple_GetSlice\n PyUnicode_New\n PyUnicode_Split\n PyNumber_Multiply\n PyErr_SetString\n PyExc_ZeroDivisionError\n _PyErr_ChainExceptions1\n PyIter_Next\n PyObject_GetIter\n PyNumber_Add\n PyExc_ValueError\n PyUnicode_InternInPlace\n PyDict_Next\n PyErr_Format\n PyDict_Type\n PyObject_RichCompare\n PyBool_Type\n PyTuple_Type\n _Py_FalseStruct\n PyImport_GetModule\n PyNumber_InPlaceAdd\n PyLong_FromDouble\n PyFloat_Type\n PyType_IsSubtype\n PyNumber_Subtract\n PyErr_Restore\n PyUnicode_Join\n PyExc_OverflowError\n _Py_Dealloc\n PyImport_GetModuleDict\n PyModule_GetDict\n PyErr_ExceptionMatches\n PyObject_ClearManagedDict\n _Py_ctype_tolower\n PyUnicode_FindChar\n PyNumber_And\n PyObject_GC_Del\n PyErr_Fetch\n PyObject_CallFunctionObjArgs\n PyObject_GenericGetDict\n PyObject_ClearWeakRefs\n PyObject_Vectorcall\n PyUnicode_AsUTF8\n PyUnicode_FromFormat\n PyList_New\n PyModule_Create2\n PyMethod_New\n PySlice_New\n PyType_Ready\n PyUnicode_Contains\n PyObject_GetAttrString\n PyErr_Clear\n PyList_Append\n PyObject_RichCompareBool\n _PyUnicode_IsDigit\n PyCapsule_New\n PyObject_VectorcallDict\n PyDict_SetItem\n PyDict_New\n PyUnicode_Type\n _PyUnicode_IsWhitespace\n PyObject_VectorcallMethod\n PyObject_IsInstance\n PyMem_Free\n PyObject_GetOptionalAttr\n PyType_GenericAlloc\n PyFrozenSet_New\n PyErr_NoMemory\n PyObject_GetItem\n PyObject_GC_Track\n PyBytes_FromStringAndSize\n PyImport_Import\n PyExc_TypeError\n PyUnicode_Tailmatch\n PyLongWriter_Finish\n PyObject_IsTrue\n PyObject_Str\n PyTuple_Pack\n PyMem_Malloc\n PyList_AsTuple\n PyExc_IndexError\n PyExc_ImportError\n _Py_TrueStruct\n PyExc_SystemError\n PyObject_SetItem\n PyNumber_TrueDivide\n PyNumber_Or\n PyRange_Type\n PyErr_SetImportError\n PyUnicode_GetLength\n PyUnicode_FromString\n PyObject_CallNoArgs\n PyUnicode_CompareWithASCIIString\n PyType_Type\n PyUnicode_EqualToUTF8\n PyUnicode_Substring\n PyObject_DelItem\n PyExc_RuntimeError\n PyList_SetSlice\n PyTraceBack_Here\n PyNumber_Absolute\n PyList_Sort\n PyUnicode_DecodeUTF8\n PySuper_Type\n PyLong_FromSsize_t\n PyBytes_FromObject\n PyUnicode_Equal\n PyLongWriter_Create\n PyErr_Occurred\n PyImport_ImportModuleLevelObject\n PyImport_ImportModule\n PyExc_KeyError\n PyUnicode_Replace\n PyLong_AsSsize_t\n _Py_ascii_whitespace\n PyFrame_New\n PyCode_NewEmpty\n PyErr_SetObject\n PyThreadState_Get\n PyUnicode_InternFromString\n PyObject_SetAttr\n PyObject_GetOptionalAttrString\n PyBaseObject_Type\n PyDict_GetItemStringRef\n PySequence_List\n PyUnicode_CopyCharacters\n PyFrozenSet_Type\n PyModule_GetFilenameObject\nKERNEL32.dll: QueryPerformanceCounter\n RtlCaptureContext\n RtlLookupFunctionEntry\n RtlVirtualUnwind\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n TerminateProcess\n IsProcessorFeaturePresent\n IsDebuggerPresent\n GetCurrentProcessId\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n DisableThreadLibraryCalls\n InitializeSListHead\nVCRUNTIME140.dll: memcpy\n memcmp\n strchr\n __C_specific_handler\n __std_type_info_destroy_list\n memset\napi-ms-win-crt-runtime-l1-1-0.dll: _cexit\n abort\n _initterm\n _initterm_e\n _seh_filter_dll\n _configure_narrow_argv\n _initialize_narrow_environment\n _initialize_onexit_table\n _execute_onexit_table\napi-ms-win-crt-stdio-l1-1-0.dll: fflush\n __stdio_common_vfprintf\n __acrt_iob_func\n __stdio_common_vsprintf\napi-ms-win-crt-string-l1-1-0.dll: strcmp\n\nExports:\n--------\nPyInit_81d243bd2c585b0f4821__mypyc:\n Ordinal: 1\n Address: 0x00024F50\n\n\nResources:\n----------\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 145\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.8858\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2026-Apr-02 07:53:11\n Version: 0.0\n SizeofData: 600\n AddressOfRawData: 0x0002CF6C\n PointerToRawData: 0x0002B56C\n\n\nLoad Configuration:\n-------------------\nSize: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180030000\n\nRICH Header:\n------------\nXOR Key: 0xF1CCD5F2\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 8\nImports (35207): 2\nImports (33145): 2\nASM objects (35207): 3\nC objects (35207): 8\nC++ objects (35207): 13\nImports (35222): 3\nTotal imports: 285\nC objects (LTCG) (35225): 1\nExports (35225): 1\nResource objects (35225): 1\nLinker (35225): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"DOS Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"PE Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Image Optional Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Sections":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Imports":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Exports":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Resources":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Debug Info":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Load Configuration":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"RICH Header":{"raw_response":"Error: An error occurred (UnrecognizedClientException) when calling the Converse operation: The security token included in the request is invalid."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_decoded_c8oa189i/zlib_offset_0x6aee8_7.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_4afxrpqd/output.txt"},"timestamp":"2026-05-26 00:28:50"} {"_id":{"$oid":"6a2eafb5ae36b72c92a10920"},"sha256":"ac4253e726af6a9b61ae53b915c49c031e65abdc03bcb81106ba0f422c61ec8d","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/NutanixVSSSWProvider-019ec65bb42e78e294f3218cc073c72e.exe\nDate: 2026-06-14 19:12:13\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/NutanixVSSSWProvider-019ec65bb42e78e294f3218cc073c72e.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-Oct-19 14:07:54\nDetected languages: English - United States\nDebug artifacts: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSSWProvider.pdb\nCompanyName: Nutanix\nFileDescription: Nutanix VSS Software Provider Service\nFileVersion: 1.1.0.0\nInternalName: NutanixVSSSWProvider.exe\nLegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\nOriginalFilename: NutanixVSSSWProvider.exe\nProductName: Nutanix VSS Solution\nProductVersion: 1.1.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000128\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 8\nTimeDateStamp: 2024-Oct-19 14:07:54\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x0000E800\nSizeOfInitializedData: 0x0000E200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000000DBA0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00024000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000E65C\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000E800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.14636\n\n.rdata:\n VirtualSize: 0x0000A062\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x0000A200\n PointerToRawData: 0x0000EC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.23834\n\n.data:\n VirtualSize: 0x000013A0\n VirtualAddress: 0x0001B000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00018E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.16936\n\n.pdata:\n VirtualSize: 0x00001014\n VirtualAddress: 0x0001D000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00019800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.55959\n\n.gfids:\n VirtualSize: 0x00000038\n VirtualAddress: 0x0001F000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0001AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.277186\n\n.tls:\n VirtualSize: 0x00000009\n VirtualAddress: 0x00020000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0001AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.0203931\n\n.rsrc:\n VirtualSize: 0x00001020\n VirtualAddress: 0x00021000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x0001AE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.90697\n\n.reloc:\n VirtualSize: 0x00000214\n VirtualAddress: 0x00023000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x0001C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.38104\n\n\nImports:\n--------\nKERNEL32.dll: MultiByteToWideChar\n HeapDestroy\n HeapAlloc\n HeapReAlloc\n HeapFree\n HeapSize\n GetProcessHeap\n GetComputerNameW\n DeviceIoControl\n CreateFileW\n LockResource\n FindResourceW\n InitializeSListHead\n GetSystemTimeAsFileTime\n GetCurrentProcessId\n QueryPerformanceCounter\n GetStartupInfoW\n IsDebuggerPresent\n WaitForSingleObjectEx\n ResetEvent\n IsProcessorFeaturePresent\n TerminateProcess\n lstrcmpiW\n SizeofResource\n LoadResource\n LoadLibraryExW\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n FreeLibrary\n GetCurrentThreadId\n CreateThread\n Sleep\n CreateEventW\n WaitForSingleObject\n SetEvent\n DeleteCriticalSection\n InitializeCriticalSectionEx\n LeaveCriticalSection\n EnterCriticalSection\n GetLastError\n RaiseException\n CloseHandle\n DecodePointer\n FindResourceExW\n GetCommandLineW\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n RtlCaptureContext\n OutputDebugStringW\nUSER32.dll: PostThreadMessageW\n DispatchMessageW\n TranslateMessage\n GetMessageW\n LoadStringW\n MessageBoxW\n CharNextW\n CharUpperW\nADVAPI32.dll: SetServiceStatus\n RegisterServiceCtrlHandlerW\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CreateServiceW\n ControlService\n CloseServiceHandle\n ChangeServiceConfig2W\n ChangeServiceConfigW\n RegSetValueExW\n RegQueryValueExW\n RegQueryInfoKeyW\n RegOpenKeyExW\n RegEnumKeyExW\n RegDeleteValueW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n ReportEventW\n RegisterEventSourceW\n DeregisterEventSource\n StartServiceCtrlDispatcherW\nole32.dll: CoInitializeEx\n CoUninitialize\n CoRegisterClassObject\n CoRevokeClassObject\n CoResumeClassObjects\n CoAddRefServerProcess\n CoReleaseServerProcess\n CoTaskMemFree\n CoTaskMemRealloc\n CoTaskMemAlloc\n StringFromGUID2\n CoCreateInstance\nOLEAUT32.dll: LoadTypeLib\n UnRegisterTypeLib\n RegisterTypeLib\n LoadRegTypeLib\n SysAllocString\n VarUI4FromStr\n SysStringLen\n SysFreeString\nNutanixUtilityLibrary.dll: ?GetErrorMessage@NutanixException@utilitylibrary@nutanix@@QEBAPEBDXZ\n ?FormatString@utilitylibrary@nutanix@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WZZ\n ?gpCommunicationLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?gpWarningLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ??1TcpClient@utilitylibrary@nutanix@@UEAA@XZ\n ??0TcpClient@utilitylibrary@nutanix@@QEAA@XZ\n ?CloseSocket@TcpClient@utilitylibrary@nutanix@@QEAAXXZ\n ?AbortSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXPEBDV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?ValidateTransaction@TcpClient@utilitylibrary@nutanix@@QEAAXXZ\n ?HandleWin32APIError@utilitylibrary@nutanix@@YAXGPEA_WK@Z\n ??0NutanixException@utilitylibrary@nutanix@@QEAA@JAEBQEB_W@Z\n ??0NutanixException@utilitylibrary@nutanix@@QEAA@AEBV012@@Z\n ??1NutanixException@utilitylibrary@nutanix@@UEAA@XZ\n ?gpInfoLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?gpErrorLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?gpDebugLogger@utilitylibrary@nutanix@@3P6AXPEB_WZZEA\n ?CreateSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXXZ\n ?DeleteProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ\n ?CompareProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA_NXZ\n ??1WindowsRegistryOperations@utilitylibrary@nutanix@@UEAA@XZ\n ??0WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA@XZ\n ?EnableFileLogging@utilitylibrary@nutanix@@YAX_N@Z\nMSVCP140.dll: ?_Xout_of_range@std@@YAXPEBD@Z\n ?_Xlength_error@std@@YAXPEBD@Z\n ?_Xbad_alloc@std@@YAXXZ\nVCRUNTIME140.dll: __std_exception_copy\n __std_exception_destroy\n _CxxThrowException\n __CxxFrameHandler3\n memcmp\n memcpy\n memset\n __C_specific_handler\n __vcrt_InitializeCriticalSectionEx\n memmove\n __std_terminate\n _purecall\n wcsstr\napi-ms-win-crt-runtime-l1-1-0.dll: terminate\n _initialize_onexit_table\n _register_onexit_function\n _crt_atexit\n _cexit\n _seh_filter_exe\n _set_app_type\n _invalid_parameter_noinfo_noreturn\n _configure_wide_argv\n _initialize_wide_environment\n _get_wide_winmain_command_line\n _initterm\n _initterm_e\n exit\n _exit\n _errno\n _c_exit\n _invalid_parameter_noinfo\n _register_thread_local_exe_atexit_callback\napi-ms-win-crt-heap-l1-1-0.dll: _recalloc\n malloc\n free\n _set_new_mode\n _callnewh\napi-ms-win-crt-string-l1-1-0.dll: wcscpy_s\n wmemcpy_s\n iswspace\n wcsncpy_s\n wcscat_s\napi-ms-win-crt-stdio-l1-1-0.dll: __p__commode\n _putws\n __stdio_common_vsnwprintf_s\n _set_fmode\n __stdio_common_vswprintf\napi-ms-win-crt-math-l1-1-0.dll: __setusermatherr\napi-ms-win-crt-locale-l1-1-0.dll: _configthreadlocale\n\nResources:\n----------\nIDR_NUTANIXVSSSWPROVIDER:\n Type: REGISTRY\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.6416\n\n106:\n Type: REGISTRY\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 347\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.97934\n\n1:\n Type: TYPELIB\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1632\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00111\n\n7:\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 358\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.0096\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.37216\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.0.0\n ProductVersion: 1.1.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Nutanix\n FileDescription: Nutanix VSS Software Provider Service\n FileVersion (#2): 1.1.0.0\n InternalName: NutanixVSSSWProvider.exe\n LegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\n OriginalFilename: NutanixVSSSWProvider.exe\n ProductName: Nutanix VSS Solution\n ProductVersion (#2): 1.1.0.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 160\n AddressOfRawData: 0x00015994\n PointerToRawData: 0x00014594\n Referenced File: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSSWProvider.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00015A34\n PointerToRawData: 0x00014634\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 956\n AddressOfRawData: 0x00015A48\n PointerToRawData: 0x00014648\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x0000000140020000\nEndAddressOfRawData: 0x0000000140020008\nAddressOfIndex: 0x000000014001C228\nAddressOfCallbacks: 0x0000000140010680\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\n-------------------\nSize: 148\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x000000014001B060\n\nRICH Header:\n------------\nXOR Key: 0xF739AB5E\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 12\nImports (VS2015 UPD3 build 24123): 4\nC++ objects (23013): 2\nASM objects (VS2015 UPD3 build 24123): 3\nC++ objects (VS2015 UPD3 build 24123): 34\nC objects (VS2015 UPD3 build 24123): 13\nImports (VS2015 UPD3.1 build 24215): 2\nC objects (65501): 5\nImports (65501): 11\nTotal imports: 186\nC++ objects (LTCG) (VS2015 UPD3.1 build 24215): 1\nC objects (VS2015 UPD3.1 build 24215): 1\nC++ objects (VS2015 UPD3.1 build 24215): 2\nResource objects (VS2015 UPD3 build 24210): 1\n151: 1\nLinker (VS2015 UPD3.1 build 24215): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Looks for VMWare presence:\n VMware\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n Can access the registry:\n RegSetValueExW\n RegQueryValueExW\n RegQueryInfoKeyW\n RegOpenKeyExW\n RegEnumKeyExW\n RegDeleteValueW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n Interacts with services:\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CreateServiceW\n ControlService\n ChangeServiceConfigW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-Oct-19 14:07:54\nDetected languages: English - United States\nDebug artifacts: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSSWProvider.pdb\nCompanyName: Nutanix\nFileDescription: Nutanix VSS Software Provider Service\nFileVersion: 1.1.0.0\nInternalName: NutanixVSSSWProvider.exe\nLegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\nOriginalFilename: NutanixVSSSWProvider.exe\nProductName: Nutanix VSS Solution\nProductVersion: 1.1.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000128"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 8\nTimeDateStamp: 2024-Oct-19 14:07:54\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x0000E800\nSizeOfInitializedData: 0x0000E200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000000DBA0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00024000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000E65C\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000E800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.14636\n\n.rdata:\n VirtualSize: 0x0000A062\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x0000A200\n PointerToRawData: 0x0000EC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.23834\n\n.data:\n VirtualSize: 0x000013A0\n VirtualAddress: 0x0001B000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00018E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.16936\n\n.pdata:\n VirtualSize: 0x00001014\n VirtualAddress: 0x0001D000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00019800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.55959\n\n.gfids:\n VirtualSize: 0x00000038\n VirtualAddress: 0x0001F000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0001AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.277186\n\n.tls:\n VirtualSize: 0x00000009\n VirtualAddress: 0x00020000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0001AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.0203931\n\n.rsrc:\n VirtualSize: 0x00001020\n VirtualAddress: 0x00021000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x0001AE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.90697\n\n.reloc:\n VirtualSize: 0x00000214\n VirtualAddress: 0x00023000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x0001C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.38104"},"Imports":{"raw":"KERNEL32.dll: MultiByteToWideChar\n HeapDestroy\n HeapAlloc\n HeapReAlloc\n HeapFree\n HeapSize\n GetProcessHeap\n GetComputerNameW\n DeviceIoControl\n CreateFileW\n LockResource\n FindResourceW\n InitializeSListHead\n GetSystemTimeAsFileTime\n GetCurrentProcessId\n QueryPerformanceCounter\n GetStartupInfoW\n IsDebuggerPresent\n WaitForSingleObjectEx\n ResetEvent\n IsProcessorFeaturePresent\n TerminateProcess\n lstrcmpiW\n SizeofResource\n LoadResource\n LoadLibraryExW\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n FreeLibrary\n GetCurrentThreadId\n CreateThread\n Sleep\n CreateEventW\n WaitForSingleObject\n SetEvent\n DeleteCriticalSection\n InitializeCriticalSectionEx\n LeaveCriticalSection\n EnterCriticalSection\n GetLastError\n RaiseException\n CloseHandle\n DecodePointer\n FindResourceExW\n GetCommandLineW\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n RtlCaptureContext\n OutputDebugStringW\nUSER32.dll: PostThreadMessageW\n DispatchMessageW\n TranslateMessage\n GetMessageW\n LoadStringW\n MessageBoxW\n CharNextW\n CharUpperW\nADVAPI32.dll: SetServiceStatus\n RegisterServiceCtrlHandlerW\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CreateServiceW\n ControlService\n CloseServiceHandle\n ChangeServiceConfig2W\n ChangeServiceConfigW\n RegSetValueExW\n RegQueryValueExW\n RegQueryInfoKeyW\n RegOpenKeyExW\n RegEnumKeyExW\n RegDeleteValueW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n ReportEventW\n RegisterEventSourceW\n DeregisterEventSource\n StartServiceCtrlDispatcherW\nole32.dll: CoInitializeEx\n CoUninitialize\n CoRegisterClassObject\n CoRevokeClassObject\n CoResumeClassObjects\n CoAddRefServerProcess\n CoReleaseServerProcess\n CoTaskMemFree\n CoTaskMemRealloc\n CoTaskMemAlloc\n StringFromGUID2\n CoCreateInstance\nOLEAUT32.dll: LoadTypeLib\n UnRegisterTypeLib\n RegisterTypeLib\n LoadRegTypeLib\n SysAllocString\n VarUI4FromStr\n SysStringLen\n SysFreeString\nNutanixUtilityLibrary.dll: ?GetErrorMessage@NutanixException@utilitylibrary@nutanix@@QEBAPEBDXZ\n ?FormatString@utilitylibrary@nutanix@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WZZ\n ?gpCommunicationLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?gpWarningLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ??1TcpClient@utilitylibrary@nutanix@@UEAA@XZ\n ??0TcpClient@utilitylibrary@nutanix@@QEAA@XZ\n ?CloseSocket@TcpClient@utilitylibrary@nutanix@@QEAAXXZ\n ?AbortSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXPEBDV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?ValidateTransaction@TcpClient@utilitylibrary@nutanix@@QEAAXXZ\n ?HandleWin32APIError@utilitylibrary@nutanix@@YAXGPEA_WK@Z\n ??0NutanixException@utilitylibrary@nutanix@@QEAA@JAEBQEB_W@Z\n ??0NutanixException@utilitylibrary@nutanix@@QEAA@AEBV012@@Z\n ??1NutanixException@utilitylibrary@nutanix@@UEAA@XZ\n ?gpInfoLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?gpErrorLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?gpDebugLogger@utilitylibrary@nutanix@@3P6AXPEB_WZZEA\n ?CreateSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXXZ\n ?DeleteProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ\n ?CompareProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA_NXZ\n ??1WindowsRegistryOperations@utilitylibrary@nutanix@@UEAA@XZ\n ??0WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA@XZ\n ?EnableFileLogging@utilitylibrary@nutanix@@YAX_N@Z\nMSVCP140.dll: ?_Xout_of_range@std@@YAXPEBD@Z\n ?_Xlength_error@std@@YAXPEBD@Z\n ?_Xbad_alloc@std@@YAXXZ\nVCRUNTIME140.dll: __std_exception_copy\n __std_exception_destroy\n _CxxThrowException\n __CxxFrameHandler3\n memcmp\n memcpy\n memset\n __C_specific_handler\n __vcrt_InitializeCriticalSectionEx\n memmove\n __std_terminate\n _purecall\n wcsstr\napi-ms-win-crt-runtime-l1-1-0.dll: terminate\n _initialize_onexit_table\n _register_onexit_function\n _crt_atexit\n _cexit\n _seh_filter_exe\n _set_app_type\n _invalid_parameter_noinfo_noreturn\n _configure_wide_argv\n _initialize_wide_environment\n _get_wide_winmain_command_line\n _initterm\n _initterm_e\n exit\n _exit\n _errno\n _c_exit\n _invalid_parameter_noinfo\n _register_thread_local_exe_atexit_callback\napi-ms-win-crt-heap-l1-1-0.dll: _recalloc\n malloc\n free\n _set_new_mode\n _callnewh\napi-ms-win-crt-string-l1-1-0.dll: wcscpy_s\n wmemcpy_s\n iswspace\n wcsncpy_s\n wcscat_s\napi-ms-win-crt-stdio-l1-1-0.dll: __p__commode\n _putws\n __stdio_common_vsnwprintf_s\n _set_fmode\n __stdio_common_vswprintf\napi-ms-win-crt-math-l1-1-0.dll: __setusermatherr\napi-ms-win-crt-locale-l1-1-0.dll: _configthreadlocale\n\nResources:\nIDR_NUTANIXVSSSWPROVIDER:\n Type: REGISTRY\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.6416\n\n106:\n Type: REGISTRY\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 347\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.97934\n\n1:\n Type: TYPELIB\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1632\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00111\n\n7:\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 358\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.0096\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.37216\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.0.0\n ProductVersion: 1.1.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Nutanix\n FileDescription: Nutanix VSS Software Provider Service\n FileVersion (#2): 1.1.0.0\n InternalName: NutanixVSSSWProvider.exe\n LegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\n OriginalFilename: NutanixVSSSWProvider.exe\n ProductName: Nutanix VSS Solution\n ProductVersion (#2): 1.1.0.0\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 160\n AddressOfRawData: 0x00015994\n PointerToRawData: 0x00014594\n Referenced File: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSSWProvider.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00015A34\n PointerToRawData: 0x00014634\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 956\n AddressOfRawData: 0x00015A48\n PointerToRawData: 0x00014648\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x0000000140020000\nEndAddressOfRawData: 0x0000000140020008\nAddressOfIndex: 0x000000014001C228\nAddressOfCallbacks: 0x0000000140010680\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\nSize: 148\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x000000014001B060\n\nRICH Header:\nXOR Key: 0xF739AB5E\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 12\nImports (VS2015 UPD3 build 24123): 4\nC++ objects (23013): 2\nASM objects (VS2015 UPD3 build 24123): 3\nC++ objects (VS2015 UPD3 build 24123): 34\nC objects (VS2015 UPD3 build 24123): 13\nImports (VS2015 UPD3.1 build 24215): 2\nC objects (65501): 5\nImports (65501): 11\nTotal imports: 186\nC++ objects (LTCG) (VS2015 UPD3.1 build 24215): 1\nC objects (VS2015 UPD3.1 build 24215): 1\nC++ objects (VS2015 UPD3.1 build 24215): 2\nResource objects (VS2015 UPD3 build 24210): 1\n151: 1\nLinker (VS2015 UPD3.1 build 24215): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Looks for VMWare presence:\n VMware\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n Can access the registry:\n RegSetValueExW\n RegQueryValueExW\n RegQueryInfoKeyW\n RegOpenKeyExW\n RegEnumKeyExW\n RegDeleteValueW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n Interacts with services:\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CreateServiceW\n ControlService\n ChangeServiceConfigW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"IDR_NUTANIXVSSSWPROVIDER:\n Type: REGISTRY\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.6416\n\n106:\n Type: REGISTRY\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 347\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.97934\n\n1:\n Type: TYPELIB\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1632\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00111\n\n7:\n Type: RT_STRING\n Language: English - United States\n Codepage: UNKNOWN\n Size: 358\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.0096\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.37216\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.0.0\n ProductVersion: 1.1.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Nutanix\n FileDescription: Nutanix VSS Software Provider Service\n FileVersion (#2): 1.1.0.0\n InternalName: NutanixVSSSWProvider.exe\n LegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\n OriginalFilename: NutanixVSSSWProvider.exe\n ProductName: Nutanix VSS Solution\n ProductVersion (#2): 1.1.0.0"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 160\n AddressOfRawData: 0x00015994\n PointerToRawData: 0x00014594\n Referenced File: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSSWProvider.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00015A34\n PointerToRawData: 0x00014634\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:54\n Version: 0.0\n SizeofData: 956\n AddressOfRawData: 0x00015A48\n PointerToRawData: 0x00014648\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x0000000140020000\nEndAddressOfRawData: 0x0000000140020008\nAddressOfIndex: 0x000000014001C228\nAddressOfCallbacks: 0x0000000140010680\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)"},"Load Configuration":{"raw":"Size: 148\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x000000014001B060"},"RICH Header":{"raw":"XOR Key: 0xF739AB5E\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 12\nImports (VS2015 UPD3 build 24123): 4\nC++ objects (23013): 2\nASM objects (VS2015 UPD3 build 24123): 3\nC++ objects (VS2015 UPD3 build 24123): 34\nC objects (VS2015 UPD3 build 24123): 13\nImports (VS2015 UPD3.1 build 24215): 2\nC objects (65501): 5\nImports (65501): 11\nTotal imports: 186\nC++ objects (LTCG) (VS2015 UPD3.1 build 24215): 1\nC objects (VS2015 UPD3.1 build 24215): 1\nC++ objects (VS2015 UPD3.1 build 24215): 2\nResource objects (VS2015 UPD3 build 24210): 1\n151: 1\nLinker (VS2015 UPD3.1 build 24215): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Looks for VMWare presence:\n VMware\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n Can access the registry:\n RegSetValueExW\n RegQueryValueExW\n RegQueryInfoKeyW\n RegOpenKeyExW\n RegEnumKeyExW\n RegDeleteValueW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n Interacts with services:\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CreateServiceW\n ControlService\n ChangeServiceConfigW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/NutanixVSSSWProvider-019ec65bb42e78e294f3218cc073c72e.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_epww_1ng/output.txt"},"timestamp":"2026-06-14 19:12:13"} {"_id":{"$oid":"6a2eb45eae36b72c92a10924"},"sha256":"794cf7644115198db451431bca7c89ff9a97550482b1e3f7f13eb7aca6120a11","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/NutanixVSSRequestor-019ec65bf02475e1ab1ed55c08a591d3.exe\nDate: 2026-06-14 19:32:06\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/NutanixVSSRequestor-019ec65bf02475e1ab1ed55c08a591d3.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2019-May-06 23:16:59\nDetected languages: Arabic - Saudi Arabia\n Bulgarian - Bulgaria\n Catalan - Spain\n Chinese - Hong Kong SAR\n Chinese - PRC\n Chinese - Taiwan\n Croatian - Croatia\n Czech - Czech Republic\n Danish - Denmark\n Dutch - Netherlands\n English - United Kingdom\n English - United States\n Estonian - Estonia\n Farsi - Iran\n Finnish - Finland\n French - France\n German - Germany\n Greek - Greece\n Gujarati - India\n Hebrew - Israel\n Hindi - India\n Hungarian - Hungary\n Icelandic - Iceland\n Indonesian - Indonesia (Bahasa)\n Italian - Italy\n Japanese - Japan\n Kannada - India (Kannada script)\n Korean - Korea\n Latvian - Latvia\n Lithuanian - Lithuania\n Malay - Malaysia\n Marathi - India\n Norwegian - Norway (Bokmal)\n Polish - Poland\n Portuguese - Brazil\n Portuguese - Portugal\n Process Default Language\n Romanian - Romania\n Russian - Russia\n Serbian - Serbia (Cyrillic)\n Serbian - Serbia (Latin)\n Slovak - Slovakia\n Slovenian - Slovenia\n Spanish - Mexico\n Spanish - Spain (International sort)\n Spanish - Spain (Traditional sort)\n Swahili - Kenya\n Swedish - Sweden\n Tamil - India\n Telugu - India (Telugu script)\n Thai - Thailand\n Turkish - Turkey\n Ukrainian - Ukraine\n Urdu - Pakistan\n Vietnamese - Viet Nam\nDebug artifacts: GoogleUpdate_unsigned.pdb\nCompanyName: Google LLC\nFileDescription: Google Installer\nFileVersion: 1.3.34.11\nInternalName: Google Update\nLegalCopyright: Ауторска права 2007–2010. Google LLC\nOriginalFilename: GoogleUpdate.exe\nProductName: Google ажурирање\nProductVersion: 1.3.34.11\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000110\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2019-May-06 23:16:59\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x00011E00\nSizeOfInitializedData: 0x00011000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00007442 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00013000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00026000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0002A3FE\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00011C54\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00011E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.37113\n\n.data:\n VirtualSize: 0x000012EC\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00012200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.00757\n\n.idata:\n VirtualSize: 0x000008D0\n VirtualAddress: 0x00015000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00012A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.95199\n\n.rsrc:\n VirtualSize: 0x0000E050\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x0000E200\n PointerToRawData: 0x00013400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.24364\n\n.reloc:\n VirtualSize: 0x00000ED8\n VirtualAddress: 0x00025000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00021600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.33141\n\n\nImports:\n--------\nADVAPI32.dll: RegOpenKeyExW\nKERNEL32.dll: SizeofResource\n HeapFree\n GetCommandLineW\n GetModuleFileNameW\n InitializeCriticalSectionAndSpinCount\n HeapSize\n GetLastError\n GetFileAttributesExW\n LockResource\n HeapReAlloc\n RaiseException\n FindResourceExW\n LoadResource\n FindResourceW\n HeapAlloc\n DecodePointer\n HeapDestroy\n GetProcAddress\n DeleteCriticalSection\n GetProcessHeap\n GetModuleHandleW\n FreeLibrary\n LoadLibraryExW\n WriteConsoleW\n SetFilePointerEx\n GetConsoleMode\n GetConsoleCP\n FlushFileBuffers\n GetStringTypeW\n SetStdHandle\n CloseHandle\n IsDebuggerPresent\n OutputDebugStringW\n EnterCriticalSection\n LeaveCriticalSection\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n TerminateProcess\n IsProcessorFeaturePresent\n GetStartupInfoW\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n InitializeSListHead\n SetLastError\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n RtlUnwind\n ExitProcess\n GetModuleHandleExW\n MultiByteToWideChar\n WideCharToMultiByte\n GetStdHandle\n WriteFile\n GetACP\n LCMapStringW\n FindClose\n FindFirstFileExW\n FindNextFileW\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n GetFileType\n CreateFileW\nSHELL32.dll: SHGetFolderPathW\nUSER32.dll: CharLowerBuffW\nSHLWAPI.dll: SHQueryValueExW\n PathAppendW\n PathRemoveFileSpecW\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.76602\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.13669\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.91985\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.83772\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.68656\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.50268\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.86669\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Process Default Language\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40043\n\n1 (#3):\n Type: RT_VERSION\n Language: Arabic - Saudi Arabia\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.74808\n\n1 (#4):\n Type: RT_VERSION\n Language: Bulgarian - Bulgaria\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52449\n\n1 (#5):\n Type: RT_VERSION\n Language: Catalan - Spain\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40172\n\n1 (#6):\n Type: RT_VERSION\n Language: Chinese - Taiwan\n Codepage: UNKNOWN\n Size: 724\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51827\n\n1 (#7):\n Type: RT_VERSION\n Language: Czech - Czech Republic\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45618\n\n1 (#8):\n Type: RT_VERSION\n Language: Danish - Denmark\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40759\n\n1 (#9):\n Type: RT_VERSION\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41351\n\n1 (#10):\n Type: RT_VERSION\n Language: Greek - Greece\n Codepage: UNKNOWN\n Size: 768\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.62358\n\n1 (#11):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41928\n\n1 (#12):\n Type: RT_VERSION\n Language: Finnish - Finland\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43625\n\n1 (#13):\n Type: RT_VERSION\n Language: French - France\n Codepage: UNKNOWN\n Size: 780\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41435\n\n1 (#14):\n Type: RT_VERSION\n Language: Hebrew - Israel\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49072\n\n1 (#15):\n Type: RT_VERSION\n Language: Hungarian - Hungary\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4383\n\n1 (#16):\n Type: RT_VERSION\n Language: Icelandic - Iceland\n Codepage: UNKNOWN\n Size: 780\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42899\n\n1 (#17):\n Type: RT_VERSION\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40443\n\n1 (#18):\n Type: RT_VERSION\n Language: Japanese - Japan\n Codepage: UNKNOWN\n Size: 736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49911\n\n1 (#19):\n Type: RT_VERSION\n Language: Korean - Korea\n Codepage: UNKNOWN\n Size: 736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59931\n\n1 (#20):\n Type: RT_VERSION\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40394\n\n1 (#21):\n Type: RT_VERSION\n Language: Norwegian - Norway (Bokmal)\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43022\n\n1 (#22):\n Type: RT_VERSION\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42509\n\n1 (#23):\n Type: RT_VERSION\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4061\n\n1 (#24):\n Type: RT_VERSION\n Language: Romanian - Romania\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40797\n\n1 (#25):\n Type: RT_VERSION\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5437\n\n1 (#26):\n Type: RT_VERSION\n Language: Croatian - Croatia\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43215\n\n1 (#27):\n Type: RT_VERSION\n Language: Slovak - Slovakia\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.44116\n\n1 (#28):\n Type: RT_VERSION\n Language: Swedish - Sweden\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41809\n\n1 (#29):\n Type: RT_VERSION\n Language: Thai - Thailand\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.61895\n\n1 (#30):\n Type: RT_VERSION\n Language: Turkish - Turkey\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43921\n\n1 (#31):\n Type: RT_VERSION\n Language: Urdu - Pakistan\n Codepage: UNKNOWN\n Size: 764\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.81473\n\n1 (#32):\n Type: RT_VERSION\n Language: Indonesian - Indonesia (Bahasa)\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41064\n\n1 (#33):\n Type: RT_VERSION\n Language: Ukrainian - Ukraine\n Codepage: UNKNOWN\n Size: 776\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.63185\n\n1 (#34):\n Type: RT_VERSION\n Language: Slovenian - Slovenia\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42964\n\n1 (#35):\n Type: RT_VERSION\n Language: Estonian - Estonia\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42723\n\n1 (#36):\n Type: RT_VERSION\n Language: Latvian - Latvia\n Codepage: UNKNOWN\n Size: 804\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.48071\n\n1 (#37):\n Type: RT_VERSION\n Language: Lithuanian - Lithuania\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51354\n\n1 (#38):\n Type: RT_VERSION\n Language: Farsi - Iran\n Codepage: UNKNOWN\n Size: 764\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67812\n\n1 (#39):\n Type: RT_VERSION\n Language: Vietnamese - Viet Nam\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45171\n\n1 (#40):\n Type: RT_VERSION\n Language: Hindi - India\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.6486\n\n1 (#41):\n Type: RT_VERSION\n Language: Malay - Malaysia\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42753\n\n1 (#42):\n Type: RT_VERSION\n Language: Swahili - Kenya\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42029\n\n1 (#43):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.73065\n\n1 (#44):\n Type: RT_VERSION\n Language: Gujarati - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67324\n\n1 (#45):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67238\n\n1 (#46):\n Type: RT_VERSION\n Language: Tamil - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.69101\n\n1 (#47):\n Type: RT_VERSION\n Language: Telugu - India (Telugu script)\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.68742\n\n1 (#48):\n Type: RT_VERSION\n Language: Kannada - India (Kannada script)\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5466\n\n1 (#49):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.79339\n\n1 (#50):\n Type: RT_VERSION\n Language: Marathi - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59714\n\n1 (#51):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 720\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.55668\n\n1 (#52):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40086\n\n1 (#53):\n Type: RT_VERSION\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 716\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.55838\n\n1 (#54):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41407\n\n1 (#55):\n Type: RT_VERSION\n Language: Spanish - Mexico\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40592\n\n1 (#56):\n Type: RT_VERSION\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41737\n\n1 (#57):\n Type: RT_VERSION\n Language: Chinese - Hong Kong SAR\n Codepage: UNKNOWN\n Size: 724\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52242\n\n1 (#58):\n Type: RT_VERSION\n Language: Spanish - Spain (International sort)\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39932\n\n1 (#59):\n Type: RT_VERSION\n Language: Serbian - Serbia (Cyrillic)\n Codepage: UNKNOWN\n Size: 776\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.61676\n\n1 (#60):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1504\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10444\n\n\nVersion Info (#2):\n------------------\nResource LangID: Process Default Language\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Process Default Language\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Arabic - Saudi Arabia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Arabic - Saudi Arabia\n CompanyName: Google LLC\n FileDescription: مثبِّت Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حقوق الطبع والنشر لعام 2018 محفوظة لشركة Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Process Default Language\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Process Default Language\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Arabic - Saudi Arabia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Arabic - Saudi Arabia\n CompanyName: Google LLC\n FileDescription: مثبِّت Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حقوق الطبع والنشر لعام 2018 محفوظة لشركة Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Bulgarian - Bulgaria\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Bulgarian - Bulgaria\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Актуализация\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Catalan - Spain\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Catalan - Spain\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Bulgarian - Bulgaria\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Bulgarian - Bulgaria\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Актуализация\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Catalan - Spain\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Catalan - Spain\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Chinese - Taiwan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Taiwan\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Czech - Czech Republic\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Czech - Czech Republic\n CompanyName: Google LLC\n FileDescription: Instalační program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Chinese - Taiwan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Taiwan\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Czech - Czech Republic\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Czech - Czech Republic\n CompanyName: Google LLC\n FileDescription: Instalační program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Danish - Denmark\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Danish - Denmark\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): German - Germany\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: German - Germany\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007 - 2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Danish - Denmark\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Danish - Denmark\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): German - Germany\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: German - Germany\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007 - 2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Greek - Greece\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Greek - Greece\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Πνευματικά δικαιώματα 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): English - United States\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Greek - Greece\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Greek - Greece\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Πνευματικά δικαιώματα 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): English - United States\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Finnish - Finland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Finnish - Finland\n CompanyName: Google LLC\n FileDescription: Google-asennusohjelma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Päivitä\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): French - France\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: French - France\n CompanyName: Google LLC\n FileDescription: Programme d'installation de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright Google LLC 2018\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Finnish - Finland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Finnish - Finland\n CompanyName: Google LLC\n FileDescription: Google-asennusohjelma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Päivitä\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): French - France\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: French - France\n CompanyName: Google LLC\n FileDescription: Programme d'installation de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright Google LLC 2018\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Hebrew - Israel\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hebrew - Israel\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC‎\n OriginalFilename: GoogleUpdate.exe\n ProductName: עדכון Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Hungarian - Hungary\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hungarian - Hungary\n CompanyName: Google LLC\n FileDescription: Google telepítő\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google frissítés\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Hebrew - Israel\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hebrew - Israel\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC‎\n OriginalFilename: GoogleUpdate.exe\n ProductName: עדכון Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Hungarian - Hungary\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hungarian - Hungary\n CompanyName: Google LLC\n FileDescription: Google telepítő\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google frissítés\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Icelandic - Iceland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Icelandic - Iceland\n CompanyName: Google LLC\n FileDescription: Google uppsetningarforrit\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Höfundarréttur 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google uppfærsla\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Italian - Italy\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Italian - Italy\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Icelandic - Iceland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Icelandic - Iceland\n CompanyName: Google LLC\n FileDescription: Google uppsetningarforrit\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Höfundarréttur 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google uppfærsla\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Italian - Italy\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Italian - Italy\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Japanese - Japan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Japanese - Japan\n CompanyName: Google LLC\n FileDescription: Google インストーラ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Korean - Korea\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Korean - Korea\n CompanyName: Google LLC\n FileDescription: Google 설치 프로그램\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 업데이트\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Japanese - Japan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Japanese - Japan\n CompanyName: Google LLC\n FileDescription: Google インストーラ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Korean - Korea\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Korean - Korea\n CompanyName: Google LLC\n FileDescription: Google 설치 프로그램\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 업데이트\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Dutch - Netherlands\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Dutch - Netherlands\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Norwegian - Norway (Bokmal)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Norwegian - Norway (Bokmal)\n CompanyName: Google LLC\n FileDescription: Installasjonsprogram for Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google-oppdatering\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Dutch - Netherlands\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Dutch - Netherlands\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Norwegian - Norway (Bokmal)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Norwegian - Norway (Bokmal)\n CompanyName: Google LLC\n FileDescription: Installasjonsprogram for Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google-oppdatering\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Polish - Poland\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Portuguese - Brazil\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Brazil\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Polish - Poland\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Portuguese - Brazil\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Brazil\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Romanian - Romania\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Romanian - Romania\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Russian - Russia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Russian - Russia\n CompanyName: Google LLC\n FileDescription: Установщик Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © Google LLC, 2018 гг.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Romanian - Romania\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Romanian - Romania\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Russian - Russia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Russian - Russia\n CompanyName: Google LLC\n FileDescription: Установщик Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © Google LLC, 2018 гг.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Croatian - Croatia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Croatian - Croatia\n CompanyName: Google LLC\n FileDescription: Google alat za instalaciju\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autorska prava 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ažuriranje\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Slovak - Slovakia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovak - Slovakia\n CompanyName: Google LLC\n FileDescription: Inštalačný program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Croatian - Croatia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Croatian - Croatia\n CompanyName: Google LLC\n FileDescription: Google alat za instalaciju\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autorska prava 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ažuriranje\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Slovak - Slovakia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovak - Slovakia\n CompanyName: Google LLC\n FileDescription: Inštalačný program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Swedish - Sweden\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swedish - Sweden\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Thai - Thailand\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Thai - Thailand\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ลิขสิทธิ์ 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: ข่าวอัพเดต Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Swedish - Sweden\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swedish - Sweden\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Thai - Thailand\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Thai - Thailand\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ลิขสิทธิ์ 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: ข่าวอัพเดต Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Turkish - Turkey\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Turkish - Turkey\n CompanyName: Google LLC\n FileDescription: Google Yükleyici\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Telif Hakkı 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Güncelleme\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Urdu - Pakistan\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Urdu - Pakistan\n CompanyName: Google LLC\n FileDescription: گوگل انسٹالر\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق اشاعت 2018 گوگل انکارپوریٹڈ\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google تازہ کاری کریں\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Turkish - Turkey\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Turkish - Turkey\n CompanyName: Google LLC\n FileDescription: Google Yükleyici\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Telif Hakkı 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Güncelleme\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Urdu - Pakistan\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Urdu - Pakistan\n CompanyName: Google LLC\n FileDescription: گوگل انسٹالر\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق اشاعت 2018 گوگل انکارپوریٹڈ\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google تازہ کاری کریں\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Indonesian - Indonesia (Bahasa)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Indonesian - Indonesia (Bahasa)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak Cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Ukrainian - Ukraine\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Ukrainian - Ukraine\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Авторське право 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Оновлення Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Indonesian - Indonesia (Bahasa)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Indonesian - Indonesia (Bahasa)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak Cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Ukrainian - Ukraine\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Ukrainian - Ukraine\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Авторське право 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Оновлення Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Slovenian - Slovenia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovenian - Slovenia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Posodobitve za Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Estonian - Estonia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Estonian - Estonia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autoriõigustega kaitstud. 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google'i uuendus\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Slovenian - Slovenia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovenian - Slovenia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Posodobitve za Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Estonian - Estonia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Estonian - Estonia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autoriõigustega kaitstud. 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google'i uuendus\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Latvian - Latvia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Latvian - Latvia\n CompanyName: Google LLC\n FileDescription: Google instalēšanas programma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autortiesības 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google atjauninājums\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Lithuanian - Lithuania\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Lithuanian - Lithuania\n CompanyName: „Google Inc.“\n FileDescription: „Google“ diegimo programa\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © „Google Inc.“, 2007–2010 m.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google“ naujinimas\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Latvian - Latvia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Latvian - Latvia\n CompanyName: Google LLC\n FileDescription: Google instalēšanas programma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autortiesības 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google atjauninājums\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Lithuanian - Lithuania\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Lithuanian - Lithuania\n CompanyName: „Google Inc.“\n FileDescription: „Google“ diegimo programa\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © „Google Inc.“, 2007–2010 m.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google“ naujinimas\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Farsi - Iran\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Farsi - Iran\n CompanyName: Google LLC\n FileDescription: نصب کننده Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق نسخه برداری 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: بروزرسانی Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Vietnamese - Viet Nam\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Vietnamese - Viet Nam\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Bản quyền 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Farsi - Iran\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Farsi - Iran\n CompanyName: Google LLC\n FileDescription: نصب کننده Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق نسخه برداری 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: بروزرسانی Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Vietnamese - Viet Nam\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Vietnamese - Viet Nam\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Bản quyền 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Hindi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hindi - India\n CompanyName: Google LLC\n FileDescription: Google इंस्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: कॉपीराइट 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अपडेट\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Malay - Malaysia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Malay - Malaysia\n CompanyName: Google LLC\n FileDescription: Pemasang Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Kemas Kini Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Hindi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hindi - India\n CompanyName: Google LLC\n FileDescription: Google इंस्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: कॉपीराइट 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अपडेट\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Malay - Malaysia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Malay - Malaysia\n CompanyName: Google LLC\n FileDescription: Pemasang Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Kemas Kini Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Swahili - Kenya\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swahili - Kenya\n CompanyName: Google LLC\n FileDescription: Kisakinishi cha Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ইনস্টলার\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: কপিরাইট 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google আধুনিকীকরণ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Swahili - Kenya\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swahili - Kenya\n CompanyName: Google LLC\n FileDescription: Kisakinishi cha Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ইনস্টলার\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: কপিরাইট 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google আধুনিকীকরণ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Gujarati - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Gujarati - India\n CompanyName: Google LLC\n FileDescription: Google ઇન્સ્ટોલર\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: કૉપીરાઇટ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google અઘતન\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ସଂସ୍ଥାପକ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ସତ୍ବାଧିକାର2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ଅଦ୍ୟତନ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Gujarati - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Gujarati - India\n CompanyName: Google LLC\n FileDescription: Google ઇન્સ્ટોલર\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: કૉપીરાઇટ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google અઘતન\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ସଂସ୍ଥାପକ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ସତ୍ବାଧିକାର2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ଅଦ୍ୟତନ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Tamil - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Tamil - India\n CompanyName: Google LLC\n FileDescription: Google நிறுவி\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: பதிப்புரிமை 2007 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google புதுப்பி\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Telugu - India (Telugu script)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Telugu - India (Telugu script)\n CompanyName: Google LLC\n FileDescription: Google ఇన్స్టాలర్\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: కాపీరైట్ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google నవీకరణ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Tamil - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Tamil - India\n CompanyName: Google LLC\n FileDescription: Google நிறுவி\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: பதிப்புரிமை 2007 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google புதுப்பி\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Telugu - India (Telugu script)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Telugu - India (Telugu script)\n CompanyName: Google LLC\n FileDescription: Google ఇన్స్టాలర్\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: కాపీరైట్ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google నవీకరణ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Kannada - India (Kannada script)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Kannada - India (Kannada script)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ಮಾರ್ಪಡಿಸಿ\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ഇന്‍സ്റ്റാളര്‍\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: പകര്‍‌പ്പവകാശം 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google കാലാനുസൃതമാക്കുക\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Kannada - India (Kannada script)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Kannada - India (Kannada script)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ಮಾರ್ಪಡಿಸಿ\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ഇന്‍സ്റ്റാളര്‍\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: പകര്‍‌പ്പവകാശം 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google കാലാനുസൃതമാക്കുക\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Marathi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Marathi - India\n CompanyName: Google LLC\n FileDescription: Google इन्स्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अद्यतन\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ጫኝ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: የቅጂ መብት 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ዝመና\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Marathi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Marathi - India\n CompanyName: Google LLC\n FileDescription: Google इन्स्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अद्यतन\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ጫኝ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: የቅጂ መብት 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ዝመና\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - PRC\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - PRC\n CompanyName: Google LLC\n FileDescription: Google 安装程序\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: 版权所有 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - PRC\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - PRC\n CompanyName: Google LLC\n FileDescription: Google 安装程序\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: 版权所有 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Spanish - Mexico\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Mexico\n CompanyName: Google LLC\n FileDescription: El instalador de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Derechos de autor 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Spanish - Mexico\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Mexico\n CompanyName: Google LLC\n FileDescription: El instalador de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Derechos de autor 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Portuguese - Portugal\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Portugal\n CompanyName: Google LLC\n FileDescription: Instalador do Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - Hong Kong SAR\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Hong Kong SAR\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Portuguese - Portugal\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Portugal\n CompanyName: Google LLC\n FileDescription: Instalador do Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - Hong Kong SAR\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Hong Kong SAR\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Spanish - Spain (International sort)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Spain (Traditional sort)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Serbian - Serbia (Cyrillic)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Serbian - Serbia (Latin)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Ауторска права 2007–2010. Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ажурирање\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\n------------------\nResource LangID: Spanish - Spain (International sort)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Spain (Traditional sort)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Serbian - Serbia (Cyrillic)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Serbian - Serbia (Latin)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Ауторска права 2007–2010. Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ажурирање\n ProductVersion (#2): 1.3.34.11\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 50\n AddressOfRawData: 0x00005C9C\n PointerToRawData: 0x0000509C\n Referenced File: GoogleUpdate_unsigned.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00005CD0\n PointerToRawData: 0x000050D0\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 716\n AddressOfRawData: 0x00005CE4\n PointerToRawData: 0x000050E4\n\n\nLoad Configuration:\n-------------------\nSize: 164\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00413008\nSEHandlerTable: 0x00405C90\nSEHandlerCount: 3\n\nRICH Header:\n------------\nXOR Key: 0xC796FF77\nUnmarked objects: 0\n241 (40116): 10\n243 (40116): 124\n242 (40116): 24\nC objects (27316): 17\nASM objects (27316): 18\nC++ objects (27316): 41\n239 (40116): 13\nTotal imports: 99\nC++ objects (LTCG) (VS2019 RTM compiler 27508): 1\nResource objects (VS2019 RTM compiler 27508): 1\n151: 58\nLinker (VS2019 RTM compiler 27508): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryExW\n Can access the registry:\n RegOpenKeyExW\n SHQueryValueExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Google Inc\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2019-May-06 23:16:59\nDetected languages: Arabic - Saudi Arabia\n Bulgarian - Bulgaria\n Catalan - Spain\n Chinese - Hong Kong SAR\n Chinese - PRC\n Chinese - Taiwan\n Croatian - Croatia\n Czech - Czech Republic\n Danish - Denmark\n Dutch - Netherlands\n English - United Kingdom\n English - United States\n Estonian - Estonia\n Farsi - Iran\n Finnish - Finland\n French - France\n German - Germany\n Greek - Greece\n Gujarati - India\n Hebrew - Israel\n Hindi - India\n Hungarian - Hungary\n Icelandic - Iceland\n Indonesian - Indonesia (Bahasa)\n Italian - Italy\n Japanese - Japan\n Kannada - India (Kannada script)\n Korean - Korea\n Latvian - Latvia\n Lithuanian - Lithuania\n Malay - Malaysia\n Marathi - India\n Norwegian - Norway (Bokmal)\n Polish - Poland\n Portuguese - Brazil\n Portuguese - Portugal\n Process Default Language\n Romanian - Romania\n Russian - Russia\n Serbian - Serbia (Cyrillic)\n Serbian - Serbia (Latin)\n Slovak - Slovakia\n Slovenian - Slovenia\n Spanish - Mexico\n Spanish - Spain (International sort)\n Spanish - Spain (Traditional sort)\n Swahili - Kenya\n Swedish - Sweden\n Tamil - India\n Telugu - India (Telugu script)\n Thai - Thailand\n Turkish - Turkey\n Ukrainian - Ukraine\n Urdu - Pakistan\n Vietnamese - Viet Nam\nDebug artifacts: GoogleUpdate_unsigned.pdb\nCompanyName: Google LLC\nFileDescription: Google Installer\nFileVersion: 1.3.34.11\nInternalName: Google Update\nLegalCopyright: Ауторска права 2007–2010. Google LLC\nOriginalFilename: GoogleUpdate.exe\nProductName: Google ажурирање\nProductVersion: 1.3.34.11"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000110"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2019-May-06 23:16:59\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x00011E00\nSizeOfInitializedData: 0x00011000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00007442 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00013000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00026000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0002A3FE\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00011C54\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00011E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.37113\n\n.data:\n VirtualSize: 0x000012EC\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00012200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.00757\n\n.idata:\n VirtualSize: 0x000008D0\n VirtualAddress: 0x00015000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00012A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.95199\n\n.rsrc:\n VirtualSize: 0x0000E050\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x0000E200\n PointerToRawData: 0x00013400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.24364\n\n.reloc:\n VirtualSize: 0x00000ED8\n VirtualAddress: 0x00025000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00021600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.33141"},"Imports":{"raw":"ADVAPI32.dll: RegOpenKeyExW\nKERNEL32.dll: SizeofResource\n HeapFree\n GetCommandLineW\n GetModuleFileNameW\n InitializeCriticalSectionAndSpinCount\n HeapSize\n GetLastError\n GetFileAttributesExW\n LockResource\n HeapReAlloc\n RaiseException\n FindResourceExW\n LoadResource\n FindResourceW\n HeapAlloc\n DecodePointer\n HeapDestroy\n GetProcAddress\n DeleteCriticalSection\n GetProcessHeap\n GetModuleHandleW\n FreeLibrary\n LoadLibraryExW\n WriteConsoleW\n SetFilePointerEx\n GetConsoleMode\n GetConsoleCP\n FlushFileBuffers\n GetStringTypeW\n SetStdHandle\n CloseHandle\n IsDebuggerPresent\n OutputDebugStringW\n EnterCriticalSection\n LeaveCriticalSection\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n TerminateProcess\n IsProcessorFeaturePresent\n GetStartupInfoW\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n InitializeSListHead\n SetLastError\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n RtlUnwind\n ExitProcess\n GetModuleHandleExW\n MultiByteToWideChar\n WideCharToMultiByte\n GetStdHandle\n WriteFile\n GetACP\n LCMapStringW\n FindClose\n FindFirstFileExW\n FindNextFileW\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n GetFileType\n CreateFileW\nSHELL32.dll: SHGetFolderPathW\nUSER32.dll: CharLowerBuffW\nSHLWAPI.dll: SHQueryValueExW\n PathAppendW\n PathRemoveFileSpecW\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.76602\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.13669\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.91985\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.83772\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.68656\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.50268\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.86669\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Process Default Language\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40043\n\n1 (#3):\n Type: RT_VERSION\n Language: Arabic - Saudi Arabia\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.74808\n\n1 (#4):\n Type: RT_VERSION\n Language: Bulgarian - Bulgaria\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52449\n\n1 (#5):\n Type: RT_VERSION\n Language: Catalan - Spain\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40172\n\n1 (#6):\n Type: RT_VERSION\n Language: Chinese - Taiwan\n Codepage: UNKNOWN\n Size: 724\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51827\n\n1 (#7):\n Type: RT_VERSION\n Language: Czech - Czech Republic\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45618\n\n1 (#8):\n Type: RT_VERSION\n Language: Danish - Denmark\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40759\n\n1 (#9):\n Type: RT_VERSION\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41351\n\n1 (#10):\n Type: RT_VERSION\n Language: Greek - Greece\n Codepage: UNKNOWN\n Size: 768\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.62358\n\n1 (#11):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41928\n\n1 (#12):\n Type: RT_VERSION\n Language: Finnish - Finland\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43625\n\n1 (#13):\n Type: RT_VERSION\n Language: French - France\n Codepage: UNKNOWN\n Size: 780\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41435\n\n1 (#14):\n Type: RT_VERSION\n Language: Hebrew - Israel\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49072\n\n1 (#15):\n Type: RT_VERSION\n Language: Hungarian - Hungary\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4383\n\n1 (#16):\n Type: RT_VERSION\n Language: Icelandic - Iceland\n Codepage: UNKNOWN\n Size: 780\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42899\n\n1 (#17):\n Type: RT_VERSION\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40443\n\n1 (#18):\n Type: RT_VERSION\n Language: Japanese - Japan\n Codepage: UNKNOWN\n Size: 736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49911\n\n1 (#19):\n Type: RT_VERSION\n Language: Korean - Korea\n Codepage: UNKNOWN\n Size: 736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59931\n\n1 (#20):\n Type: RT_VERSION\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40394\n\n1 (#21):\n Type: RT_VERSION\n Language: Norwegian - Norway (Bokmal)\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43022\n\n1 (#22):\n Type: RT_VERSION\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42509\n\n1 (#23):\n Type: RT_VERSION\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4061\n\n1 (#24):\n Type: RT_VERSION\n Language: Romanian - Romania\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40797\n\n1 (#25):\n Type: RT_VERSION\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5437\n\n1 (#26):\n Type: RT_VERSION\n Language: Croatian - Croatia\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43215\n\n1 (#27):\n Type: RT_VERSION\n Language: Slovak - Slovakia\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.44116\n\n1 (#28):\n Type: RT_VERSION\n Language: Swedish - Sweden\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41809\n\n1 (#29):\n Type: RT_VERSION\n Language: Thai - Thailand\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.61895\n\n1 (#30):\n Type: RT_VERSION\n Language: Turkish - Turkey\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43921\n\n1 (#31):\n Type: RT_VERSION\n Language: Urdu - Pakistan\n Codepage: UNKNOWN\n Size: 764\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.81473\n\n1 (#32):\n Type: RT_VERSION\n Language: Indonesian - Indonesia (Bahasa)\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41064\n\n1 (#33):\n Type: RT_VERSION\n Language: Ukrainian - Ukraine\n Codepage: UNKNOWN\n Size: 776\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.63185\n\n1 (#34):\n Type: RT_VERSION\n Language: Slovenian - Slovenia\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42964\n\n1 (#35):\n Type: RT_VERSION\n Language: Estonian - Estonia\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42723\n\n1 (#36):\n Type: RT_VERSION\n Language: Latvian - Latvia\n Codepage: UNKNOWN\n Size: 804\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.48071\n\n1 (#37):\n Type: RT_VERSION\n Language: Lithuanian - Lithuania\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51354\n\n1 (#38):\n Type: RT_VERSION\n Language: Farsi - Iran\n Codepage: UNKNOWN\n Size: 764\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67812\n\n1 (#39):\n Type: RT_VERSION\n Language: Vietnamese - Viet Nam\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45171\n\n1 (#40):\n Type: RT_VERSION\n Language: Hindi - India\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.6486\n\n1 (#41):\n Type: RT_VERSION\n Language: Malay - Malaysia\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42753\n\n1 (#42):\n Type: RT_VERSION\n Language: Swahili - Kenya\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42029\n\n1 (#43):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.73065\n\n1 (#44):\n Type: RT_VERSION\n Language: Gujarati - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67324\n\n1 (#45):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67238\n\n1 (#46):\n Type: RT_VERSION\n Language: Tamil - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.69101\n\n1 (#47):\n Type: RT_VERSION\n Language: Telugu - India (Telugu script)\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.68742\n\n1 (#48):\n Type: RT_VERSION\n Language: Kannada - India (Kannada script)\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5466\n\n1 (#49):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.79339\n\n1 (#50):\n Type: RT_VERSION\n Language: Marathi - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59714\n\n1 (#51):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 720\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.55668\n\n1 (#52):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40086\n\n1 (#53):\n Type: RT_VERSION\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 716\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.55838\n\n1 (#54):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41407\n\n1 (#55):\n Type: RT_VERSION\n Language: Spanish - Mexico\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40592\n\n1 (#56):\n Type: RT_VERSION\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41737\n\n1 (#57):\n Type: RT_VERSION\n Language: Chinese - Hong Kong SAR\n Codepage: UNKNOWN\n Size: 724\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52242\n\n1 (#58):\n Type: RT_VERSION\n Language: Spanish - Spain (International sort)\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39932\n\n1 (#59):\n Type: RT_VERSION\n Language: Serbian - Serbia (Cyrillic)\n Codepage: UNKNOWN\n Size: 776\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.61676\n\n1 (#60):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1504\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10444\n\n\nVersion Info (#2):\nResource LangID: Process Default Language\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Process Default Language\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Arabic - Saudi Arabia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Arabic - Saudi Arabia\n CompanyName: Google LLC\n FileDescription: مثبِّت Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حقوق الطبع والنشر لعام 2018 محفوظة لشركة Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Process Default Language\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Process Default Language\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Arabic - Saudi Arabia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Arabic - Saudi Arabia\n CompanyName: Google LLC\n FileDescription: مثبِّت Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حقوق الطبع والنشر لعام 2018 محفوظة لشركة Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Bulgarian - Bulgaria\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Bulgarian - Bulgaria\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Актуализация\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Catalan - Spain\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Catalan - Spain\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Bulgarian - Bulgaria\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Bulgarian - Bulgaria\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Актуализация\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Catalan - Spain\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Catalan - Spain\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Chinese - Taiwan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Taiwan\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Czech - Czech Republic\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Czech - Czech Republic\n CompanyName: Google LLC\n FileDescription: Instalační program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Chinese - Taiwan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Taiwan\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Czech - Czech Republic\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Czech - Czech Republic\n CompanyName: Google LLC\n FileDescription: Instalační program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Danish - Denmark\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Danish - Denmark\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): German - Germany\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: German - Germany\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007 - 2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Danish - Denmark\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Danish - Denmark\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): German - Germany\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: German - Germany\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007 - 2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Greek - Greece\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Greek - Greece\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Πνευματικά δικαιώματα 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): English - United States\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Greek - Greece\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Greek - Greece\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Πνευματικά δικαιώματα 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): English - United States\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Finnish - Finland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Finnish - Finland\n CompanyName: Google LLC\n FileDescription: Google-asennusohjelma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Päivitä\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): French - France\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: French - France\n CompanyName: Google LLC\n FileDescription: Programme d'installation de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright Google LLC 2018\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Finnish - Finland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Finnish - Finland\n CompanyName: Google LLC\n FileDescription: Google-asennusohjelma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Päivitä\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): French - France\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: French - France\n CompanyName: Google LLC\n FileDescription: Programme d'installation de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright Google LLC 2018\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Hebrew - Israel\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hebrew - Israel\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC‎\n OriginalFilename: GoogleUpdate.exe\n ProductName: עדכון Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Hungarian - Hungary\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hungarian - Hungary\n CompanyName: Google LLC\n FileDescription: Google telepítő\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google frissítés\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Hebrew - Israel\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hebrew - Israel\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC‎\n OriginalFilename: GoogleUpdate.exe\n ProductName: עדכון Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Hungarian - Hungary\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hungarian - Hungary\n CompanyName: Google LLC\n FileDescription: Google telepítő\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google frissítés\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Icelandic - Iceland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Icelandic - Iceland\n CompanyName: Google LLC\n FileDescription: Google uppsetningarforrit\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Höfundarréttur 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google uppfærsla\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Italian - Italy\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Italian - Italy\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Icelandic - Iceland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Icelandic - Iceland\n CompanyName: Google LLC\n FileDescription: Google uppsetningarforrit\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Höfundarréttur 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google uppfærsla\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Italian - Italy\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Italian - Italy\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Japanese - Japan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Japanese - Japan\n CompanyName: Google LLC\n FileDescription: Google インストーラ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Korean - Korea\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Korean - Korea\n CompanyName: Google LLC\n FileDescription: Google 설치 프로그램\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 업데이트\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Japanese - Japan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Japanese - Japan\n CompanyName: Google LLC\n FileDescription: Google インストーラ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Korean - Korea\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Korean - Korea\n CompanyName: Google LLC\n FileDescription: Google 설치 프로그램\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 업데이트\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Dutch - Netherlands\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Dutch - Netherlands\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Norwegian - Norway (Bokmal)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Norwegian - Norway (Bokmal)\n CompanyName: Google LLC\n FileDescription: Installasjonsprogram for Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google-oppdatering\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Dutch - Netherlands\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Dutch - Netherlands\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Norwegian - Norway (Bokmal)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Norwegian - Norway (Bokmal)\n CompanyName: Google LLC\n FileDescription: Installasjonsprogram for Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google-oppdatering\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Polish - Poland\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Portuguese - Brazil\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Brazil\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Polish - Poland\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Portuguese - Brazil\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Brazil\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Romanian - Romania\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Romanian - Romania\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Russian - Russia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Russian - Russia\n CompanyName: Google LLC\n FileDescription: Установщик Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © Google LLC, 2018 гг.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Romanian - Romania\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Romanian - Romania\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Russian - Russia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Russian - Russia\n CompanyName: Google LLC\n FileDescription: Установщик Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © Google LLC, 2018 гг.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Croatian - Croatia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Croatian - Croatia\n CompanyName: Google LLC\n FileDescription: Google alat za instalaciju\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autorska prava 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ažuriranje\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Slovak - Slovakia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovak - Slovakia\n CompanyName: Google LLC\n FileDescription: Inštalačný program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Croatian - Croatia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Croatian - Croatia\n CompanyName: Google LLC\n FileDescription: Google alat za instalaciju\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autorska prava 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ažuriranje\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Slovak - Slovakia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovak - Slovakia\n CompanyName: Google LLC\n FileDescription: Inštalačný program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Swedish - Sweden\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swedish - Sweden\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Thai - Thailand\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Thai - Thailand\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ลิขสิทธิ์ 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: ข่าวอัพเดต Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Swedish - Sweden\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swedish - Sweden\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Thai - Thailand\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Thai - Thailand\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ลิขสิทธิ์ 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: ข่าวอัพเดต Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Turkish - Turkey\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Turkish - Turkey\n CompanyName: Google LLC\n FileDescription: Google Yükleyici\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Telif Hakkı 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Güncelleme\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Urdu - Pakistan\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Urdu - Pakistan\n CompanyName: Google LLC\n FileDescription: گوگل انسٹالر\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق اشاعت 2018 گوگل انکارپوریٹڈ\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google تازہ کاری کریں\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Turkish - Turkey\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Turkish - Turkey\n CompanyName: Google LLC\n FileDescription: Google Yükleyici\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Telif Hakkı 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Güncelleme\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Urdu - Pakistan\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Urdu - Pakistan\n CompanyName: Google LLC\n FileDescription: گوگل انسٹالر\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق اشاعت 2018 گوگل انکارپوریٹڈ\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google تازہ کاری کریں\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Indonesian - Indonesia (Bahasa)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Indonesian - Indonesia (Bahasa)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak Cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Ukrainian - Ukraine\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Ukrainian - Ukraine\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Авторське право 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Оновлення Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Indonesian - Indonesia (Bahasa)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Indonesian - Indonesia (Bahasa)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak Cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Ukrainian - Ukraine\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Ukrainian - Ukraine\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Авторське право 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Оновлення Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Slovenian - Slovenia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovenian - Slovenia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Posodobitve za Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Estonian - Estonia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Estonian - Estonia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autoriõigustega kaitstud. 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google'i uuendus\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Slovenian - Slovenia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovenian - Slovenia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Posodobitve za Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Estonian - Estonia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Estonian - Estonia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autoriõigustega kaitstud. 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google'i uuendus\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Latvian - Latvia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Latvian - Latvia\n CompanyName: Google LLC\n FileDescription: Google instalēšanas programma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autortiesības 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google atjauninājums\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Lithuanian - Lithuania\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Lithuanian - Lithuania\n CompanyName: „Google Inc.“\n FileDescription: „Google“ diegimo programa\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © „Google Inc.“, 2007–2010 m.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google“ naujinimas\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Latvian - Latvia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Latvian - Latvia\n CompanyName: Google LLC\n FileDescription: Google instalēšanas programma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autortiesības 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google atjauninājums\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Lithuanian - Lithuania\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Lithuanian - Lithuania\n CompanyName: „Google Inc.“\n FileDescription: „Google“ diegimo programa\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © „Google Inc.“, 2007–2010 m.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google“ naujinimas\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Farsi - Iran\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Farsi - Iran\n CompanyName: Google LLC\n FileDescription: نصب کننده Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق نسخه برداری 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: بروزرسانی Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Vietnamese - Viet Nam\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Vietnamese - Viet Nam\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Bản quyền 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Farsi - Iran\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Farsi - Iran\n CompanyName: Google LLC\n FileDescription: نصب کننده Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق نسخه برداری 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: بروزرسانی Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Vietnamese - Viet Nam\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Vietnamese - Viet Nam\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Bản quyền 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Hindi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hindi - India\n CompanyName: Google LLC\n FileDescription: Google इंस्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: कॉपीराइट 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अपडेट\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Malay - Malaysia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Malay - Malaysia\n CompanyName: Google LLC\n FileDescription: Pemasang Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Kemas Kini Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Hindi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hindi - India\n CompanyName: Google LLC\n FileDescription: Google इंस्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: कॉपीराइट 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अपडेट\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Malay - Malaysia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Malay - Malaysia\n CompanyName: Google LLC\n FileDescription: Pemasang Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Kemas Kini Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Swahili - Kenya\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swahili - Kenya\n CompanyName: Google LLC\n FileDescription: Kisakinishi cha Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ইনস্টলার\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: কপিরাইট 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google আধুনিকীকরণ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Swahili - Kenya\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swahili - Kenya\n CompanyName: Google LLC\n FileDescription: Kisakinishi cha Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ইনস্টলার\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: কপিরাইট 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google আধুনিকীকরণ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Gujarati - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Gujarati - India\n CompanyName: Google LLC\n FileDescription: Google ઇન્સ્ટોલર\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: કૉપીરાઇટ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google અઘતન\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ସଂସ୍ଥାପକ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ସତ୍ବାଧିକାର2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ଅଦ୍ୟତନ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Gujarati - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Gujarati - India\n CompanyName: Google LLC\n FileDescription: Google ઇન્સ્ટોલર\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: કૉપીરાઇટ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google અઘતન\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ସଂସ୍ଥାପକ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ସତ୍ବାଧିକାର2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ଅଦ୍ୟତନ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Tamil - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Tamil - India\n CompanyName: Google LLC\n FileDescription: Google நிறுவி\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: பதிப்புரிமை 2007 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google புதுப்பி\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Telugu - India (Telugu script)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Telugu - India (Telugu script)\n CompanyName: Google LLC\n FileDescription: Google ఇన్స్టాలర్\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: కాపీరైట్ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google నవీకరణ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Tamil - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Tamil - India\n CompanyName: Google LLC\n FileDescription: Google நிறுவி\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: பதிப்புரிமை 2007 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google புதுப்பி\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Telugu - India (Telugu script)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Telugu - India (Telugu script)\n CompanyName: Google LLC\n FileDescription: Google ఇన్స్టాలర్\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: కాపీరైట్ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google నవీకరణ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Kannada - India (Kannada script)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Kannada - India (Kannada script)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ಮಾರ್ಪಡಿಸಿ\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ഇന്‍സ്റ്റാളര്‍\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: പകര്‍‌പ്പവകാശം 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google കാലാനുസൃതമാക്കുക\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Kannada - India (Kannada script)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Kannada - India (Kannada script)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ಮಾರ್ಪಡಿಸಿ\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ഇന്‍സ്റ്റാളര്‍\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: പകര്‍‌പ്പവകാശം 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google കാലാനുസൃതമാക്കുക\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Marathi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Marathi - India\n CompanyName: Google LLC\n FileDescription: Google इन्स्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अद्यतन\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ጫኝ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: የቅጂ መብት 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ዝመና\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Marathi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Marathi - India\n CompanyName: Google LLC\n FileDescription: Google इन्स्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अद्यतन\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ጫኝ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: የቅጂ መብት 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ዝመና\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - PRC\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - PRC\n CompanyName: Google LLC\n FileDescription: Google 安装程序\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: 版权所有 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - PRC\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - PRC\n CompanyName: Google LLC\n FileDescription: Google 安装程序\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: 版权所有 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Spanish - Mexico\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Mexico\n CompanyName: Google LLC\n FileDescription: El instalador de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Derechos de autor 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Spanish - Mexico\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Mexico\n CompanyName: Google LLC\n FileDescription: El instalador de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Derechos de autor 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Portuguese - Portugal\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Portugal\n CompanyName: Google LLC\n FileDescription: Instalador do Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - Hong Kong SAR\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Hong Kong SAR\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Portuguese - Portugal\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Portugal\n CompanyName: Google LLC\n FileDescription: Instalador do Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - Hong Kong SAR\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Hong Kong SAR\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Spanish - Spain (International sort)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Spain (Traditional sort)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Serbian - Serbia (Cyrillic)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Serbian - Serbia (Latin)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Ауторска права 2007–2010. Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ажурирање\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Spanish - Spain (International sort)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Spain (Traditional sort)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Serbian - Serbia (Cyrillic)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Serbian - Serbia (Latin)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Ауторска права 2007–2010. Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ажурирање\n ProductVersion (#2): 1.3.34.11\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 50\n AddressOfRawData: 0x00005C9C\n PointerToRawData: 0x0000509C\n Referenced File: GoogleUpdate_unsigned.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00005CD0\n PointerToRawData: 0x000050D0\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 716\n AddressOfRawData: 0x00005CE4\n PointerToRawData: 0x000050E4\n\n\nLoad Configuration:\nSize: 164\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00413008\nSEHandlerTable: 0x00405C90\nSEHandlerCount: 3\n\nRICH Header:\nXOR Key: 0xC796FF77\nUnmarked objects: 0\n241 (40116): 10\n243 (40116): 124\n242 (40116): 24\nC objects (27316): 17\nASM objects (27316): 18\nC++ objects (27316): 41\n239 (40116): 13\nTotal imports: 99\nC++ objects (LTCG) (VS2019 RTM compiler 27508): 1\nResource objects (VS2019 RTM compiler 27508): 1\n151: 58\nLinker (VS2019 RTM compiler 27508): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryExW\n Can access the registry:\n RegOpenKeyExW\n SHQueryValueExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Google Inc\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.76602\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.13669\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.91985\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.83772\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.68656\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.50268\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.86669\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Process Default Language\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40043\n\n1 (#3):\n Type: RT_VERSION\n Language: Arabic - Saudi Arabia\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.74808\n\n1 (#4):\n Type: RT_VERSION\n Language: Bulgarian - Bulgaria\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52449\n\n1 (#5):\n Type: RT_VERSION\n Language: Catalan - Spain\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40172\n\n1 (#6):\n Type: RT_VERSION\n Language: Chinese - Taiwan\n Codepage: UNKNOWN\n Size: 724\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51827\n\n1 (#7):\n Type: RT_VERSION\n Language: Czech - Czech Republic\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45618\n\n1 (#8):\n Type: RT_VERSION\n Language: Danish - Denmark\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40759\n\n1 (#9):\n Type: RT_VERSION\n Language: German - Germany\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41351\n\n1 (#10):\n Type: RT_VERSION\n Language: Greek - Greece\n Codepage: UNKNOWN\n Size: 768\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.62358\n\n1 (#11):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41928\n\n1 (#12):\n Type: RT_VERSION\n Language: Finnish - Finland\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43625\n\n1 (#13):\n Type: RT_VERSION\n Language: French - France\n Codepage: UNKNOWN\n Size: 780\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41435\n\n1 (#14):\n Type: RT_VERSION\n Language: Hebrew - Israel\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49072\n\n1 (#15):\n Type: RT_VERSION\n Language: Hungarian - Hungary\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4383\n\n1 (#16):\n Type: RT_VERSION\n Language: Icelandic - Iceland\n Codepage: UNKNOWN\n Size: 780\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42899\n\n1 (#17):\n Type: RT_VERSION\n Language: Italian - Italy\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40443\n\n1 (#18):\n Type: RT_VERSION\n Language: Japanese - Japan\n Codepage: UNKNOWN\n Size: 736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49911\n\n1 (#19):\n Type: RT_VERSION\n Language: Korean - Korea\n Codepage: UNKNOWN\n Size: 736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59931\n\n1 (#20):\n Type: RT_VERSION\n Language: Dutch - Netherlands\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40394\n\n1 (#21):\n Type: RT_VERSION\n Language: Norwegian - Norway (Bokmal)\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43022\n\n1 (#22):\n Type: RT_VERSION\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42509\n\n1 (#23):\n Type: RT_VERSION\n Language: Portuguese - Brazil\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4061\n\n1 (#24):\n Type: RT_VERSION\n Language: Romanian - Romania\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40797\n\n1 (#25):\n Type: RT_VERSION\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5437\n\n1 (#26):\n Type: RT_VERSION\n Language: Croatian - Croatia\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43215\n\n1 (#27):\n Type: RT_VERSION\n Language: Slovak - Slovakia\n Codepage: UNKNOWN\n Size: 760\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.44116\n\n1 (#28):\n Type: RT_VERSION\n Language: Swedish - Sweden\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41809\n\n1 (#29):\n Type: RT_VERSION\n Language: Thai - Thailand\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.61895\n\n1 (#30):\n Type: RT_VERSION\n Language: Turkish - Turkey\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43921\n\n1 (#31):\n Type: RT_VERSION\n Language: Urdu - Pakistan\n Codepage: UNKNOWN\n Size: 764\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.81473\n\n1 (#32):\n Type: RT_VERSION\n Language: Indonesian - Indonesia (Bahasa)\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41064\n\n1 (#33):\n Type: RT_VERSION\n Language: Ukrainian - Ukraine\n Codepage: UNKNOWN\n Size: 776\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.63185\n\n1 (#34):\n Type: RT_VERSION\n Language: Slovenian - Slovenia\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42964\n\n1 (#35):\n Type: RT_VERSION\n Language: Estonian - Estonia\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42723\n\n1 (#36):\n Type: RT_VERSION\n Language: Latvian - Latvia\n Codepage: UNKNOWN\n Size: 804\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.48071\n\n1 (#37):\n Type: RT_VERSION\n Language: Lithuanian - Lithuania\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51354\n\n1 (#38):\n Type: RT_VERSION\n Language: Farsi - Iran\n Codepage: UNKNOWN\n Size: 764\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67812\n\n1 (#39):\n Type: RT_VERSION\n Language: Vietnamese - Viet Nam\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45171\n\n1 (#40):\n Type: RT_VERSION\n Language: Hindi - India\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.6486\n\n1 (#41):\n Type: RT_VERSION\n Language: Malay - Malaysia\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42753\n\n1 (#42):\n Type: RT_VERSION\n Language: Swahili - Kenya\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42029\n\n1 (#43):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.73065\n\n1 (#44):\n Type: RT_VERSION\n Language: Gujarati - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67324\n\n1 (#45):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 740\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.67238\n\n1 (#46):\n Type: RT_VERSION\n Language: Tamil - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.69101\n\n1 (#47):\n Type: RT_VERSION\n Language: Telugu - India (Telugu script)\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.68742\n\n1 (#48):\n Type: RT_VERSION\n Language: Kannada - India (Kannada script)\n Codepage: UNKNOWN\n Size: 756\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5466\n\n1 (#49):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 784\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.79339\n\n1 (#50):\n Type: RT_VERSION\n Language: Marathi - India\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59714\n\n1 (#51):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 720\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.55668\n\n1 (#52):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40086\n\n1 (#53):\n Type: RT_VERSION\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 716\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.55838\n\n1 (#54):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41407\n\n1 (#55):\n Type: RT_VERSION\n Language: Spanish - Mexico\n Codepage: UNKNOWN\n Size: 772\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40592\n\n1 (#56):\n Type: RT_VERSION\n Language: Portuguese - Portugal\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41737\n\n1 (#57):\n Type: RT_VERSION\n Language: Chinese - Hong Kong SAR\n Codepage: UNKNOWN\n Size: 724\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52242\n\n1 (#58):\n Type: RT_VERSION\n Language: Spanish - Spain (International sort)\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39932\n\n1 (#59):\n Type: RT_VERSION\n Language: Serbian - Serbia (Cyrillic)\n Codepage: UNKNOWN\n Size: 776\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.61676\n\n1 (#60):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1504\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10444\n\n\nVersion Info (#2):\nResource LangID: Process Default Language\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Process Default Language\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Arabic - Saudi Arabia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Arabic - Saudi Arabia\n CompanyName: Google LLC\n FileDescription: مثبِّت Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حقوق الطبع والنشر لعام 2018 محفوظة لشركة Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Process Default Language\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Process Default Language\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Arabic - Saudi Arabia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Arabic - Saudi Arabia\n CompanyName: Google LLC\n FileDescription: مثبِّت Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حقوق الطبع والنشر لعام 2018 محفوظة لشركة Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Bulgarian - Bulgaria\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Bulgarian - Bulgaria\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Актуализация\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Catalan - Spain\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Catalan - Spain\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Bulgarian - Bulgaria\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Bulgarian - Bulgaria\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Актуализация\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Catalan - Spain\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Catalan - Spain\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Chinese - Taiwan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Taiwan\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Czech - Czech Republic\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Czech - Czech Republic\n CompanyName: Google LLC\n FileDescription: Instalační program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Chinese - Taiwan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Taiwan\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Czech - Czech Republic\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Czech - Czech Republic\n CompanyName: Google LLC\n FileDescription: Instalační program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Danish - Denmark\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Danish - Denmark\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): German - Germany\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: German - Germany\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007 - 2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Danish - Denmark\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Danish - Denmark\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): German - Germany\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: German - Germany\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007 - 2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Greek - Greece\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Greek - Greece\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Πνευματικά δικαιώματα 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): English - United States\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Greek - Greece\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Greek - Greece\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Πνευματικά δικαιώματα 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): English - United States\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Finnish - Finland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Finnish - Finland\n CompanyName: Google LLC\n FileDescription: Google-asennusohjelma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Päivitä\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): French - France\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: French - France\n CompanyName: Google LLC\n FileDescription: Programme d'installation de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright Google LLC 2018\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Finnish - Finland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Finnish - Finland\n CompanyName: Google LLC\n FileDescription: Google-asennusohjelma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Päivitä\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): French - France\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: French - France\n CompanyName: Google LLC\n FileDescription: Programme d'installation de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright Google LLC 2018\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Hebrew - Israel\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hebrew - Israel\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC‎\n OriginalFilename: GoogleUpdate.exe\n ProductName: עדכון Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Hungarian - Hungary\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hungarian - Hungary\n CompanyName: Google LLC\n FileDescription: Google telepítő\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google frissítés\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Hebrew - Israel\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hebrew - Israel\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC‎\n OriginalFilename: GoogleUpdate.exe\n ProductName: עדכון Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Hungarian - Hungary\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hungarian - Hungary\n CompanyName: Google LLC\n FileDescription: Google telepítő\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google frissítés\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Icelandic - Iceland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Icelandic - Iceland\n CompanyName: Google LLC\n FileDescription: Google uppsetningarforrit\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Höfundarréttur 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google uppfærsla\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Italian - Italy\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Italian - Italy\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Icelandic - Iceland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Icelandic - Iceland\n CompanyName: Google LLC\n FileDescription: Google uppsetningarforrit\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Höfundarréttur 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google uppfærsla\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Italian - Italy\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Italian - Italy\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Japanese - Japan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Japanese - Japan\n CompanyName: Google LLC\n FileDescription: Google インストーラ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Korean - Korea\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Korean - Korea\n CompanyName: Google LLC\n FileDescription: Google 설치 프로그램\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 업데이트\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Japanese - Japan\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Japanese - Japan\n CompanyName: Google LLC\n FileDescription: Google インストーラ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Korean - Korea\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Korean - Korea\n CompanyName: Google LLC\n FileDescription: Google 설치 프로그램\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 업데이트\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Dutch - Netherlands\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Dutch - Netherlands\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Norwegian - Norway (Bokmal)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Norwegian - Norway (Bokmal)\n CompanyName: Google LLC\n FileDescription: Installasjonsprogram for Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google-oppdatering\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Dutch - Netherlands\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Dutch - Netherlands\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Norwegian - Norway (Bokmal)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Norwegian - Norway (Bokmal)\n CompanyName: Google LLC\n FileDescription: Installasjonsprogram for Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google-oppdatering\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Polish - Poland\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Portuguese - Brazil\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Brazil\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Polish - Poland\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Portuguese - Brazil\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Brazil\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Romanian - Romania\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Romanian - Romania\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Russian - Russia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Russian - Russia\n CompanyName: Google LLC\n FileDescription: Установщик Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © Google LLC, 2018 гг.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Romanian - Romania\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Romanian - Romania\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Russian - Russia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Russian - Russia\n CompanyName: Google LLC\n FileDescription: Установщик Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © Google LLC, 2018 гг.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Croatian - Croatia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Croatian - Croatia\n CompanyName: Google LLC\n FileDescription: Google alat za instalaciju\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autorska prava 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ažuriranje\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Slovak - Slovakia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovak - Slovakia\n CompanyName: Google LLC\n FileDescription: Inštalačný program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Croatian - Croatia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Croatian - Croatia\n CompanyName: Google LLC\n FileDescription: Google alat za instalaciju\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autorska prava 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ažuriranje\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Slovak - Slovakia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovak - Slovakia\n CompanyName: Google LLC\n FileDescription: Inštalačný program Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Swedish - Sweden\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swedish - Sweden\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Thai - Thailand\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Thai - Thailand\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ลิขสิทธิ์ 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: ข่าวอัพเดต Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Swedish - Sweden\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swedish - Sweden\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Thai - Thailand\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Thai - Thailand\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ลิขสิทธิ์ 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: ข่าวอัพเดต Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Turkish - Turkey\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Turkish - Turkey\n CompanyName: Google LLC\n FileDescription: Google Yükleyici\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Telif Hakkı 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Güncelleme\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Urdu - Pakistan\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Urdu - Pakistan\n CompanyName: Google LLC\n FileDescription: گوگل انسٹالر\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق اشاعت 2018 گوگل انکارپوریٹڈ\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google تازہ کاری کریں\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Turkish - Turkey\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Turkish - Turkey\n CompanyName: Google LLC\n FileDescription: Google Yükleyici\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Telif Hakkı 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Güncelleme\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Urdu - Pakistan\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Urdu - Pakistan\n CompanyName: Google LLC\n FileDescription: گوگل انسٹالر\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق اشاعت 2018 گوگل انکارپوریٹڈ\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google تازہ کاری کریں\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Indonesian - Indonesia (Bahasa)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Indonesian - Indonesia (Bahasa)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak Cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Ukrainian - Ukraine\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Ukrainian - Ukraine\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Авторське право 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Оновлення Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Indonesian - Indonesia (Bahasa)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Indonesian - Indonesia (Bahasa)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak Cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Ukrainian - Ukraine\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Ukrainian - Ukraine\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Авторське право 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Оновлення Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Slovenian - Slovenia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovenian - Slovenia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Posodobitve za Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Estonian - Estonia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Estonian - Estonia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autoriõigustega kaitstud. 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google'i uuendus\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Slovenian - Slovenia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Slovenian - Slovenia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Posodobitve za Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Estonian - Estonia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Estonian - Estonia\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autoriõigustega kaitstud. 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google'i uuendus\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Latvian - Latvia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Latvian - Latvia\n CompanyName: Google LLC\n FileDescription: Google instalēšanas programma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autortiesības 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google atjauninājums\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Lithuanian - Lithuania\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Lithuanian - Lithuania\n CompanyName: „Google Inc.“\n FileDescription: „Google“ diegimo programa\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © „Google Inc.“, 2007–2010 m.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google“ naujinimas\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Latvian - Latvia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Latvian - Latvia\n CompanyName: Google LLC\n FileDescription: Google instalēšanas programma\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Autortiesības 2007–2010 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google atjauninājums\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Lithuanian - Lithuania\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Lithuanian - Lithuania\n CompanyName: „Google Inc.“\n FileDescription: „Google“ diegimo programa\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: © „Google Inc.“, 2007–2010 m.\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google“ naujinimas\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Farsi - Iran\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Farsi - Iran\n CompanyName: Google LLC\n FileDescription: نصب کننده Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق نسخه برداری 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: بروزرسانی Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Vietnamese - Viet Nam\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Vietnamese - Viet Nam\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Bản quyền 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Farsi - Iran\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Farsi - Iran\n CompanyName: Google LLC\n FileDescription: نصب کننده Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: حق نسخه برداری 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: بروزرسانی Google\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Vietnamese - Viet Nam\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Vietnamese - Viet Nam\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Bản quyền 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Hindi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hindi - India\n CompanyName: Google LLC\n FileDescription: Google इंस्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: कॉपीराइट 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अपडेट\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Malay - Malaysia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Malay - Malaysia\n CompanyName: Google LLC\n FileDescription: Pemasang Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Kemas Kini Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Hindi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Hindi - India\n CompanyName: Google LLC\n FileDescription: Google इंस्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: कॉपीराइट 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अपडेट\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Malay - Malaysia\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Malay - Malaysia\n CompanyName: Google LLC\n FileDescription: Pemasang Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Hak cipta 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Kemas Kini Google\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Swahili - Kenya\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swahili - Kenya\n CompanyName: Google LLC\n FileDescription: Kisakinishi cha Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ইনস্টলার\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: কপিরাইট 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google আধুনিকীকরণ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Swahili - Kenya\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Swahili - Kenya\n CompanyName: Google LLC\n FileDescription: Kisakinishi cha Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ইনস্টলার\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: কপিরাইট 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google আধুনিকীকরণ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Gujarati - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Gujarati - India\n CompanyName: Google LLC\n FileDescription: Google ઇન્સ્ટોલર\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: કૉપીરાઇટ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google અઘતન\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ସଂସ୍ଥାପକ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ସତ୍ବାଧିକାର2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ଅଦ୍ୟତନ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Gujarati - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Gujarati - India\n CompanyName: Google LLC\n FileDescription: Google ઇન્સ્ટોલર\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: કૉપીરાઇટ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google અઘતન\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ସଂସ୍ଥାପକ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: ସତ୍ବାଧିକାର2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ଅଦ୍ୟତନ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Tamil - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Tamil - India\n CompanyName: Google LLC\n FileDescription: Google நிறுவி\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: பதிப்புரிமை 2007 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google புதுப்பி\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Telugu - India (Telugu script)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Telugu - India (Telugu script)\n CompanyName: Google LLC\n FileDescription: Google ఇన్స్టాలర్\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: కాపీరైట్ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google నవీకరణ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Tamil - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Tamil - India\n CompanyName: Google LLC\n FileDescription: Google நிறுவி\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: பதிப்புரிமை 2007 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google புதுப்பி\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Telugu - India (Telugu script)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Telugu - India (Telugu script)\n CompanyName: Google LLC\n FileDescription: Google ఇన్స్టాలర్\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: కాపీరైట్ © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google నవీకరణ\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Kannada - India (Kannada script)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Kannada - India (Kannada script)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ಮಾರ್ಪಡಿಸಿ\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ഇന്‍സ്റ്റാളര്‍\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: പകര്‍‌പ്പവകാശം 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google കാലാനുസൃതമാക്കുക\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Kannada - India (Kannada script)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Kannada - India (Kannada script)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright © 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ಮಾರ್ಪಡಿಸಿ\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ഇന്‍സ്റ്റാളര്‍\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: പകര്‍‌പ്പവകാശം 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google കാലാനുസൃതമാക്കുക\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Marathi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Marathi - India\n CompanyName: Google LLC\n FileDescription: Google इन्स्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अद्यतन\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ጫኝ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: የቅጂ መብት 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ዝመና\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Marathi - India\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Marathi - India\n CompanyName: Google LLC\n FileDescription: Google इन्स्टॉलर\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google अद्यतन\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): UNKNOWN\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google ጫኝ\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: የቅጂ መብት 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ዝመና\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - PRC\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - PRC\n CompanyName: Google LLC\n FileDescription: Google 安装程序\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: 版权所有 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - PRC\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - PRC\n CompanyName: Google LLC\n FileDescription: Google 安装程序\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: 版权所有 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Spanish - Mexico\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Mexico\n CompanyName: Google LLC\n FileDescription: El instalador de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Derechos de autor 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United Kingdom\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Spanish - Mexico\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Mexico\n CompanyName: Google LLC\n FileDescription: El instalador de Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Derechos de autor 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Portuguese - Portugal\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Portugal\n CompanyName: Google LLC\n FileDescription: Instalador do Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - Hong Kong SAR\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Hong Kong SAR\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Portuguese - Portugal\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Portuguese - Portugal\n CompanyName: Google LLC\n FileDescription: Instalador do Google\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Chinese - Hong Kong SAR\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Chinese - Hong Kong SAR\n CompanyName: Google LLC\n FileDescription: Google 安裝程式\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google 更新\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Spanish - Spain (International sort)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Spain (Traditional sort)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Serbian - Serbia (Cyrillic)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Serbian - Serbia (Latin)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Ауторска права 2007–2010. Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ажурирање\n ProductVersion (#2): 1.3.34.11\n\n\nVersion Info (#2):\nResource LangID: Spanish - Spain (International sort)\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Spanish - Spain (Traditional sort)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Copyright 2018 Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google Update\n ProductVersion (#2): 1.3.34.11\n\nResource LangID (#2): Serbian - Serbia (Cyrillic)\nVS_VERSION_INFO (#2):\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.3.34.11\n ProductVersion: 1.3.34.11\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: Serbian - Serbia (Latin)\n CompanyName: Google LLC\n FileDescription: Google Installer\n FileVersion (#2): 1.3.34.11\n InternalName: Google Update\n LegalCopyright: Ауторска права 2007–2010. Google LLC\n OriginalFilename: GoogleUpdate.exe\n ProductName: Google ажурирање\n ProductVersion (#2): 1.3.34.11"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 50\n AddressOfRawData: 0x00005C9C\n PointerToRawData: 0x0000509C\n Referenced File: GoogleUpdate_unsigned.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00005CD0\n PointerToRawData: 0x000050D0\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2019-May-06 23:16:59\n Version: 0.0\n SizeofData: 716\n AddressOfRawData: 0x00005CE4\n PointerToRawData: 0x000050E4"},"Load Configuration":{"raw":"Size: 164\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00413008\nSEHandlerTable: 0x00405C90\nSEHandlerCount: 3"},"RICH Header":{"raw":"XOR Key: 0xC796FF77\nUnmarked objects: 0\n241 (40116): 10\n243 (40116): 124\n242 (40116): 24\nC objects (27316): 17\nASM objects (27316): 18\nC++ objects (27316): 41\n239 (40116): 13\nTotal imports: 99\nC++ objects (LTCG) (VS2019 RTM compiler 27508): 1\nResource objects (VS2019 RTM compiler 27508): 1\n151: 58\nLinker (VS2019 RTM compiler 27508): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryExW\n Can access the registry:\n RegOpenKeyExW\n SHQueryValueExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Google Inc\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[*] Warning: Multiple nodes using the name Version Info in a dictionary.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/NutanixVSSRequestor-019ec65bf02475e1ab1ed55c08a591d3.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_m3zu9xl1/output.txt"},"timestamp":"2026-06-14 19:32:06"} {"_id":{"$oid":"6a2eb7ccae36b72c92a10927"},"sha256":"de78577b54a8f71b2f6f4289cdabbfa971d5b7a1bd2ad8ef71b797e9c7d86e7a","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/NutanixVSSRequestor-019ec65c196b75e199a853889f4dd1f1.dll\nDate: 2026-06-14 19:46:44\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/NutanixVSSRequestor-019ec65c196b75e199a853889f4dd1f1.dll\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-Oct-19 14:08:01\nDetected languages: English - United States\nDebug artifacts: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSRequestor.pdb\nCompanyName: Nutanix\nFileDescription: Nutanix VSS requestor DLL\nFileVersion: 1.1.0.0\nInternalName: NutanixVSSRequestor.dll\nLegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\nOriginalFilename: NutanixVSSRequestor.dll\nProductName: Nutanix VSS Solution\nProductVersion: 1.1.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000118\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 7\nTimeDateStamp: 2024-Oct-19 14:08:01\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00024200\nSizeOfInitializedData: 0x0001D000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000001E7C0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00046000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000240D8\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00024200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.11458\n\n.rdata:\n VirtualSize: 0x00019A86\n VirtualAddress: 0x00026000\n SizeOfRawData: 0x00019C00\n PointerToRawData: 0x00024600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.26306\n\n.data:\n VirtualSize: 0x00000C40\n VirtualAddress: 0x00040000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0003E200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.24135\n\n.pdata:\n VirtualSize: 0x00001B78\n VirtualAddress: 0x00041000\n SizeOfRawData: 0x00001C00\n PointerToRawData: 0x0003E800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.4369\n\n.gfids:\n VirtualSize: 0x00000034\n VirtualAddress: 0x00043000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00040400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.255391\n\n.rsrc:\n VirtualSize: 0x00000568\n VirtualAddress: 0x00044000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00040600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.84499\n\n.reloc:\n VirtualSize: 0x000000D8\n VirtualAddress: 0x00045000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00040C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 2.59063\n\n\nImports:\n--------\nVSSAPI.DLL: CreateVssBackupComponentsInternal\nKERNEL32.dll: RtlCaptureContext\n GetModuleFileNameW\n InitializeCriticalSectionEx\n GetLastError\n DeleteCriticalSection\n QueryDosDeviceW\n FindFirstVolumeW\n DeviceIoControl\n GetVolumePathNameW\n CreateFileW\n GetVolumeNameForVolumeMountPointW\n CloseHandle\n FindVolumeClose\n GetVolumePathNamesForVolumeNameW\n FindNextVolumeW\n GetFirmwareEnvironmentVariableW\n CreateDirectoryW\n FindFirstFileW\n FindNextFileW\n WriteFile\n ExpandEnvironmentStringsW\n RemoveDirectoryW\n FindClose\n DeleteFileW\n RtlLookupFunctionEntry\n RtlVirtualUnwind\n OutputDebugStringW\n InitializeSListHead\n GetSystemTimeAsFileTime\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n TerminateProcess\n IsProcessorFeaturePresent\n IsDebuggerPresent\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\nole32.dll: CoUninitialize\n CoInitializeSecurity\n CoInitializeEx\nOLEAUT32.dll: SysStringLen\n SysFreeString\nNutanixUtilityLibrary.dll: ?gpDebugLogger@utilitylibrary@nutanix@@3P6AXPEB_WZZEA\n ?StringToGUID@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAU_GUID@@@Z\n ?AppendBackSlash@utilitylibrary@nutanix@@YAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?IsStringInVector@utilitylibrary@nutanix@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z\n ?ExpandPath@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV34@@Z\n ?HandleHresult@utilitylibrary@nutanix@@YAXGPEB_WJ@Z\n ?ExecuteProcess@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAH_NK@Z\n ?AbortSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXPEBDV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?SetTransactionId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?GetVSSServiceStatus@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAK@Z\n ?DeleteTransactionIdKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ\n ?GetInstallationPath@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ??1WindowsRegistryOperations@utilitylibrary@nutanix@@UEAA@XZ\n ??0WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA@XZ\n ?GUIDToString@utilitylibrary@nutanix@@YAXAEBU_GUID@@AEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?FinishSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z\n ?CloseSocket@TcpClient@utilitylibrary@nutanix@@QEAAXXZ\n ??0TcpClient@utilitylibrary@nutanix@@QEAA@XZ\n ??1TcpClient@utilitylibrary@nutanix@@UEAA@XZ\n ?SetProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?DeleteProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ\n ?GenerateProviderParticipationKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ??0CabinetBuilder@utilitylibrary@nutanix@@QEAA@GKKK@Z\n ??1CabinetBuilder@utilitylibrary@nutanix@@UEAA@XZ\n ?InitCabinet@CabinetBuilder@utilitylibrary@nutanix@@QEAAHPEB_W00@Z\n ?AddFile@CabinetBuilder@utilitylibrary@nutanix@@QEAAHPEB_W0HH@Z\n ?FlushCabinet@CabinetBuilder@utilitylibrary@nutanix@@QEAAHXZ\n ?EnableFileLogging@utilitylibrary@nutanix@@YAX_N@Z\n ??0NutanixException@utilitylibrary@nutanix@@QEAA@AEBV012@@Z\n ?VectorToString@utilitylibrary@nutanix@@YAXAEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@AEAV54@@Z\n ?gpWarningLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?FormatString@utilitylibrary@nutanix@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WZZ\n ?gpInfoLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?HandleWin32APIError@utilitylibrary@nutanix@@YAXGPEA_WK@Z\n ?gpErrorLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?GetErrorCode@NutanixException@utilitylibrary@nutanix@@QEBAJXZ\n ?GetErrorMessage@NutanixException@utilitylibrary@nutanix@@QEBAPEBDXZ\n ??1NutanixException@utilitylibrary@nutanix@@UEAA@XZ\n ??0NutanixException@utilitylibrary@nutanix@@QEAA@JAEBQEB_W@Z\nMSVCP140.dll: ?toupper@?$ctype@_W@std@@QEBA_W_W@Z\n ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z\n ??Bid@locale@std@@QEAA_KXZ\n ?widen@?$ctype@_W@std@@QEBA_WD@Z\n ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z\n ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ\n ?id@?$ctype@_W@std@@2V0locale@2@A\n ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ\n ??0_Lockit@std@@QEAA@H@Z\n ??1_Lockit@std@@QEAA@XZ\n ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z\n ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z\n ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z\n ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ\n ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z\n ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z\n ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z\n ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ\n ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ\n ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ\n ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ\n ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z\n ?_Xbad_alloc@std@@YAXXZ\n ?_Xout_of_range@std@@YAXPEBD@Z\n ?_Xlength_error@std@@YAXPEBD@Z\n ?uncaught_exception@std@@YA_NXZ\n ?_BADOFF@std@@3_JB\n ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z\n ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z\n ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ\n ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ\n ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ\n ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z\n ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ\nSHLWAPI.dll: StrCmpW\n PathFileExistsW\n PathIsDirectoryW\n PathCombineW\nRESUTILS.dll: ClusterGetVolumeNameForVolumeMountPoint\n ClusterGetVolumePathName\n ClusterIsPathOnSharedVolume\nVERSION.dll: GetFileVersionInfoW\n VerQueryValueW\n GetFileVersionInfoSizeW\nVCRUNTIME140.dll: __C_specific_handler\n __CxxFrameHandler3\n __std_type_info_destroy_list\n memcpy\n __std_exception_destroy\n __std_terminate\n memmove\n __std_exception_copy\n _CxxThrowException\n memset\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vswprintf\n __stdio_common_vswprintf_s\napi-ms-win-crt-heap-l1-1-0.dll: _callnewh\n malloc\n free\napi-ms-win-crt-runtime-l1-1-0.dll: _crt_atexit\n _execute_onexit_table\n _seh_filter_dll\n _initterm_e\n _initterm\n _register_onexit_function\n _initialize_onexit_table\n _initialize_narrow_environment\n _cexit\n _invalid_parameter_noinfo_noreturn\n _configure_narrow_argv\napi-ms-win-crt-convert-l1-1-0.dll: _itow_s\napi-ms-win-crt-string-l1-1-0.dll: _wcsicmp\n wcscpy_s\n\nExports:\n--------\nAreAllWritersStable:\n Ordinal: 1\n Address: 0x00001860\n\nCreateSnapshot:\n Ordinal: 2\n Address: 0x000015E0\n\nGetVersionInfo:\n Ordinal: 3\n Address: 0x00001260\n\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 836\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39408\n\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.0.0\n ProductVersion: 1.1.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Nutanix\n FileDescription: Nutanix VSS requestor DLL\n FileVersion (#2): 1.1.0.0\n InternalName: NutanixVSSRequestor.dll\n LegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\n OriginalFilename: NutanixVSSRequestor.dll\n ProductName: Nutanix VSS Solution\n ProductVersion (#2): 1.1.0.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:08:01\n Version: 0.0\n SizeofData: 159\n AddressOfRawData: 0x00035A9C\n PointerToRawData: 0x0003409C\n Referenced File: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSRequestor.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:08:01\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00035B3C\n PointerToRawData: 0x0003413C\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:08:01\n Version: 0.0\n SizeofData: 712\n AddressOfRawData: 0x00035B50\n PointerToRawData: 0x00034150\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:08:01\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n\n\nLoad Configuration:\n-------------------\nSize: 148\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180040008\n\nRICH Header:\n------------\nXOR Key: 0xFC14EF21\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 10\nC++ objects (23013): 2\nASM objects (VS2015 UPD3 build 24123): 3\nC objects (VS2015 UPD3 build 24123): 11\nImports (VS2015 UPD3 build 24123): 4\nC++ objects (VS2015 UPD3 build 24123): 21\nImports (VS2015 UPD3.1 build 24215): 2\nC objects (65501): 1\nImports (65501): 17\nTotal imports: 191\nC++ objects (LTCG) (VS2015 UPD3.1 build 24215): 9\nExports (VS2015 UPD3.1 build 24215): 1\nResource objects (VS2015 UPD3 build 24210): 1\n151: 1\nLinker (VS2015 UPD3.1 build 24215): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n %TEMP%\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-Oct-19 14:08:01\nDetected languages: English - United States\nDebug artifacts: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSRequestor.pdb\nCompanyName: Nutanix\nFileDescription: Nutanix VSS requestor DLL\nFileVersion: 1.1.0.0\nInternalName: NutanixVSSRequestor.dll\nLegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\nOriginalFilename: NutanixVSSRequestor.dll\nProductName: Nutanix VSS Solution\nProductVersion: 1.1.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000118"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 7\nTimeDateStamp: 2024-Oct-19 14:08:01\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00024200\nSizeOfInitializedData: 0x0001D000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000001E7C0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00046000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000240D8\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00024200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.11458\n\n.rdata:\n VirtualSize: 0x00019A86\n VirtualAddress: 0x00026000\n SizeOfRawData: 0x00019C00\n PointerToRawData: 0x00024600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.26306\n\n.data:\n VirtualSize: 0x00000C40\n VirtualAddress: 0x00040000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0003E200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.24135\n\n.pdata:\n VirtualSize: 0x00001B78\n VirtualAddress: 0x00041000\n SizeOfRawData: 0x00001C00\n PointerToRawData: 0x0003E800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.4369\n\n.gfids:\n VirtualSize: 0x00000034\n VirtualAddress: 0x00043000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00040400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.255391\n\n.rsrc:\n VirtualSize: 0x00000568\n VirtualAddress: 0x00044000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00040600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.84499\n\n.reloc:\n VirtualSize: 0x000000D8\n VirtualAddress: 0x00045000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00040C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 2.59063"},"Imports":{"raw":"VSSAPI.DLL: CreateVssBackupComponentsInternal\nKERNEL32.dll: RtlCaptureContext\n GetModuleFileNameW\n InitializeCriticalSectionEx\n GetLastError\n DeleteCriticalSection\n QueryDosDeviceW\n FindFirstVolumeW\n DeviceIoControl\n GetVolumePathNameW\n CreateFileW\n GetVolumeNameForVolumeMountPointW\n CloseHandle\n FindVolumeClose\n GetVolumePathNamesForVolumeNameW\n FindNextVolumeW\n GetFirmwareEnvironmentVariableW\n CreateDirectoryW\n FindFirstFileW\n FindNextFileW\n WriteFile\n ExpandEnvironmentStringsW\n RemoveDirectoryW\n FindClose\n DeleteFileW\n RtlLookupFunctionEntry\n RtlVirtualUnwind\n OutputDebugStringW\n InitializeSListHead\n GetSystemTimeAsFileTime\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n TerminateProcess\n IsProcessorFeaturePresent\n IsDebuggerPresent\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\nole32.dll: CoUninitialize\n CoInitializeSecurity\n CoInitializeEx\nOLEAUT32.dll: SysStringLen\n SysFreeString\nNutanixUtilityLibrary.dll: ?gpDebugLogger@utilitylibrary@nutanix@@3P6AXPEB_WZZEA\n ?StringToGUID@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAU_GUID@@@Z\n ?AppendBackSlash@utilitylibrary@nutanix@@YAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?IsStringInVector@utilitylibrary@nutanix@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z\n ?ExpandPath@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV34@@Z\n ?HandleHresult@utilitylibrary@nutanix@@YAXGPEB_WJ@Z\n ?ExecuteProcess@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAH_NK@Z\n ?AbortSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXPEBDV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?SetTransactionId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?GetVSSServiceStatus@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAK@Z\n ?DeleteTransactionIdKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ\n ?GetInstallationPath@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ??1WindowsRegistryOperations@utilitylibrary@nutanix@@UEAA@XZ\n ??0WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA@XZ\n ?GUIDToString@utilitylibrary@nutanix@@YAXAEBU_GUID@@AEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?FinishSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z\n ?CloseSocket@TcpClient@utilitylibrary@nutanix@@QEAAXXZ\n ??0TcpClient@utilitylibrary@nutanix@@QEAA@XZ\n ??1TcpClient@utilitylibrary@nutanix@@UEAA@XZ\n ?SetProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ?DeleteProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ\n ?GenerateProviderParticipationKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z\n ??0CabinetBuilder@utilitylibrary@nutanix@@QEAA@GKKK@Z\n ??1CabinetBuilder@utilitylibrary@nutanix@@UEAA@XZ\n ?InitCabinet@CabinetBuilder@utilitylibrary@nutanix@@QEAAHPEB_W00@Z\n ?AddFile@CabinetBuilder@utilitylibrary@nutanix@@QEAAHPEB_W0HH@Z\n ?FlushCabinet@CabinetBuilder@utilitylibrary@nutanix@@QEAAHXZ\n ?EnableFileLogging@utilitylibrary@nutanix@@YAX_N@Z\n ??0NutanixException@utilitylibrary@nutanix@@QEAA@AEBV012@@Z\n ?VectorToString@utilitylibrary@nutanix@@YAXAEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@AEAV54@@Z\n ?gpWarningLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?FormatString@utilitylibrary@nutanix@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WZZ\n ?gpInfoLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?HandleWin32APIError@utilitylibrary@nutanix@@YAXGPEA_WK@Z\n ?gpErrorLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA\n ?GetErrorCode@NutanixException@utilitylibrary@nutanix@@QEBAJXZ\n ?GetErrorMessage@NutanixException@utilitylibrary@nutanix@@QEBAPEBDXZ\n ??1NutanixException@utilitylibrary@nutanix@@UEAA@XZ\n ??0NutanixException@utilitylibrary@nutanix@@QEAA@JAEBQEB_W@Z\nMSVCP140.dll: ?toupper@?$ctype@_W@std@@QEBA_W_W@Z\n ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z\n ??Bid@locale@std@@QEAA_KXZ\n ?widen@?$ctype@_W@std@@QEBA_WD@Z\n ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z\n ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ\n ?id@?$ctype@_W@std@@2V0locale@2@A\n ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ\n ??0_Lockit@std@@QEAA@H@Z\n ??1_Lockit@std@@QEAA@XZ\n ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z\n ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z\n ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z\n ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ\n ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z\n ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z\n ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z\n ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ\n ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ\n ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ\n ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ\n ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z\n ?_Xbad_alloc@std@@YAXXZ\n ?_Xout_of_range@std@@YAXPEBD@Z\n ?_Xlength_error@std@@YAXPEBD@Z\n ?uncaught_exception@std@@YA_NXZ\n ?_BADOFF@std@@3_JB\n ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z\n ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z\n ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ\n ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ\n ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ\n ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z\n ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ\nSHLWAPI.dll: StrCmpW\n PathFileExistsW\n PathIsDirectoryW\n PathCombineW\nRESUTILS.dll: ClusterGetVolumeNameForVolumeMountPoint\n ClusterGetVolumePathName\n ClusterIsPathOnSharedVolume\nVERSION.dll: GetFileVersionInfoW\n VerQueryValueW\n GetFileVersionInfoSizeW\nVCRUNTIME140.dll: __C_specific_handler\n __CxxFrameHandler3\n __std_type_info_destroy_list\n memcpy\n __std_exception_destroy\n __std_terminate\n memmove\n __std_exception_copy\n _CxxThrowException\n memset\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vswprintf\n __stdio_common_vswprintf_s\napi-ms-win-crt-heap-l1-1-0.dll: _callnewh\n malloc\n free\napi-ms-win-crt-runtime-l1-1-0.dll: _crt_atexit\n _execute_onexit_table\n _seh_filter_dll\n _initterm_e\n _initterm\n _register_onexit_function\n _initialize_onexit_table\n _initialize_narrow_environment\n _cexit\n _invalid_parameter_noinfo_noreturn\n _configure_narrow_argv\napi-ms-win-crt-convert-l1-1-0.dll: _itow_s\napi-ms-win-crt-string-l1-1-0.dll: _wcsicmp\n wcscpy_s"},"Exports":{"raw":"AreAllWritersStable:\n Ordinal: 1\n Address: 0x00001860\n\nCreateSnapshot:\n Ordinal: 2\n Address: 0x000015E0\n\nGetVersionInfo:\n Ordinal: 3\n Address: 0x00001260"},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 836\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39408\n\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.0.0\n ProductVersion: 1.1.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Nutanix\n FileDescription: Nutanix VSS requestor DLL\n FileVersion (#2): 1.1.0.0\n InternalName: NutanixVSSRequestor.dll\n LegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\n OriginalFilename: NutanixVSSRequestor.dll\n ProductName: Nutanix VSS Solution\n ProductVersion (#2): 1.1.0.0"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:08:01\n Version: 0.0\n SizeofData: 159\n AddressOfRawData: 0x00035A9C\n PointerToRawData: 0x0003409C\n Referenced File: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixVSSRequestor.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:08:01\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00035B3C\n PointerToRawData: 0x0003413C\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:08:01\n Version: 0.0\n SizeofData: 712\n AddressOfRawData: 0x00035B50\n PointerToRawData: 0x00034150\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:08:01\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000"},"Load Configuration":{"raw":"Size: 148\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180040008"},"RICH Header":{"raw":"XOR Key: 0xFC14EF21\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 10\nC++ objects (23013): 2\nASM objects (VS2015 UPD3 build 24123): 3\nC objects (VS2015 UPD3 build 24123): 11\nImports (VS2015 UPD3 build 24123): 4\nC++ objects (VS2015 UPD3 build 24123): 21\nImports (VS2015 UPD3.1 build 24215): 2\nC objects (65501): 1\nImports (65501): 17\nTotal imports: 191\nC++ objects (LTCG) (VS2015 UPD3.1 build 24215): 9\nExports (VS2015 UPD3.1 build 24215): 1\nResource objects (VS2015 UPD3 build 24210): 1\n151: 1\nLinker (VS2015 UPD3.1 build 24215): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n %TEMP%\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/NutanixVSSRequestor-019ec65c196b75e199a853889f4dd1f1.dll"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_lqpmk0a_/output.txt"},"timestamp":"2026-06-14 19:46:44"} {"_id":{"$oid":"6a2eb8bbae36b72c92a10929"},"sha256":"81d5cf4c95743f8fbff1801437aab774b572e7ab720f42678b7be0db422aced7","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/NutanixUtilityLibrary-019ec65c5ac27a3283d8b6fdbf5472e9.dll\nDate: 2026-06-14 19:50:43\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/NutanixUtilityLibrary-019ec65c5ac27a3283d8b6fdbf5472e9.dll\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-Oct-19 14:07:46\nDetected languages: English - United States\nDebug artifacts: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixUtilityLibrary.pdb\nCompanyName: Nutanix\nFileDescription: Nutanix Utility Library\nFileVersion: 1.1.0.0\nInternalName: NutanixUtilityLibrary.dll\nLegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\nOriginalFilename: NutanixUtilityLibrary.dll\nProductName: Nutanix VSS Solution\nProductVersion: 1.1.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000110\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 7\nTimeDateStamp: 2024-Oct-19 14:07:46\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00033C00\nSizeOfInitializedData: 0x00027000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000002DDD8 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0005F000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00033B5E\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00033C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.18491\n\n.rdata:\n VirtualSize: 0x00021698\n VirtualAddress: 0x00035000\n SizeOfRawData: 0x00021800\n PointerToRawData: 0x00034000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.62473\n\n.data:\n VirtualSize: 0x00001E58\n VirtualAddress: 0x00057000\n SizeOfRawData: 0x00001800\n PointerToRawData: 0x00055800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.63178\n\n.pdata:\n VirtualSize: 0x00002670\n VirtualAddress: 0x00059000\n SizeOfRawData: 0x00002800\n PointerToRawData: 0x00057000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.44333\n\n.gfids:\n VirtualSize: 0x00000040\n VirtualAddress: 0x0005C000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00059800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.312429\n\n.rsrc:\n VirtualSize: 0x000006F0\n VirtualAddress: 0x0005D000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00059A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.61524\n\n.reloc:\n VirtualSize: 0x000004E4\n VirtualAddress: 0x0005E000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0005A200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.82304\n\n\nImports:\n--------\nCRYPT32.dll: CryptProtectData\n CryptUnprotectData\nCabinet.dll: #13\n #10\n #14\n #11\n #12\nSHLWAPI.dll: PathFileExistsW\nKERNEL32.dll: DeleteFileA\n DeleteFileW\n CloseHandle\n FileTimeToLocalFileTime\n CreateDirectoryA\n GetTempFileNameA\n WriteFile\n LocalFree\n GetEnvironmentVariableW\n GetEnvironmentVariableA\n OutputDebugStringW\n CreateFileA\n ExpandEnvironmentStringsW\n WaitForSingleObject\n LocalAlloc\n MultiByteToWideChar\n FormatMessageW\n CreateProcessW\n WideCharToMultiByte\n GetExitCodeProcess\n ReadFile\n GetCurrentThreadId\n InitializeSListHead\n GetFileAttributesA\n GetLastError\n GetTempPathA\n GetFileInformationByHandle\n GetSystemTimeAsFileTime\n SetFilePointer\n FileTimeToDosDateTime\n GetCurrentProcessId\n QueryPerformanceCounter\n IsDebuggerPresent\n IsProcessorFeaturePresent\n TerminateProcess\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n RtlCaptureContext\nADVAPI32.dll: RegisterEventSourceW\n RegCloseKey\n RegDeleteKeyValueW\n RegCreateKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegQueryValueExW\n ReportEventW\nole32.dll: CoUninitialize\n CoCreateInstance\n CoSetProxyBlanket\n CoInitializeSecurity\n CoInitializeEx\n CLSIDFromString\n StringFromGUID2\nOLEAUT32.dll: SysFreeString\n SysAllocString\n VariantClear\nMSVCP140.dll: ?_Xout_of_range@std@@YAXPEBD@Z\n ?_Xlength_error@std@@YAXPEBD@Z\n ??1_Lockit@std@@QEAA@XZ\n ??0_Lockit@std@@QEAA@H@Z\n ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A\n ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ\n ?uncaught_exception@std@@YA_NXZ\n ?_BADOFF@std@@3_JB\n ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A\n ?_Xbad_function_call@std@@YAXXZ\n ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A\n ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z\n ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z\n ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z\n ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z\n ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z\n ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ\n ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ\n ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ\n ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ\n ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z\n ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z\n ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z\n ?_Xbad_alloc@std@@YAXXZ\n ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ\n ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z\n ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z\n ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z\n ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z\n ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z\n ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ\n ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ\n ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ\n ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ\n ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ\n ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ\n ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z\n ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z\n ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z\n ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ\n ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z\n ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ\n ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z\n ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z\n ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ\n ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z\n ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z\n ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z\n ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z\n ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z\n ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ\n ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ\n ?always_noconv@codecvt_base@std@@QEBA_NXZ\n ??Bid@locale@std@@QEAA_KXZ\n ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ\n ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ\n ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z\n ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z\n ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z\n ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ\n ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ\n ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z\n ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ\n ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ\n ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ\n ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ\n ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z\n ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z\n ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z\n ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ\n ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z\n ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\nWS2_32.dll: WSACleanup\n closesocket\n getaddrinfo\n WSAStartup\n send\n socket\n connect\n recv\n WSAGetLastError\n freeaddrinfo\nVCRUNTIME140.dll: memchr\n memmove\n __std_exception_destroy\n __std_exception_copy\n _purecall\n __CxxFrameHandler3\n __C_specific_handler\n _CxxThrowException\n memset\n __std_type_info_destroy_list\n memcmp\n __std_terminate\n memcpy\napi-ms-win-crt-string-l1-1-0.dll: strtok_s\n wcstok_s\n wcstok\n strncpy_s\n wcscpy_s\n strcpy_s\n isspace\n strcat_s\n _wcsicmp\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vsprintf_s\n fflush\n fgetc\n __stdio_common_vswprintf_s\n _get_stream_buffer_pointers\n _fseeki64\n ungetc\n __stdio_common_vswprintf\n setvbuf\n fgetpos\n fwrite\n __stdio_common_vsnprintf_s\n fputc\n fclose\n fsetpos\napi-ms-win-crt-heap-l1-1-0.dll: _callnewh\n calloc\n free\n malloc\napi-ms-win-crt-runtime-l1-1-0.dll: _invalid_parameter_noinfo_noreturn\n signal\n _cexit\n _initterm\n _crt_atexit\n abort\n _execute_onexit_table\n _initialize_onexit_table\n _invalid_parameter_noinfo\n _register_onexit_function\n _errno\n _initterm_e\n terminate\n _seh_filter_dll\n _configure_narrow_argv\n _initialize_narrow_environment\napi-ms-win-crt-filesystem-l1-1-0.dll: _lock_file\n _mkdir\n _unlock_file\n _splitpath_s\n rename\napi-ms-win-crt-time-l1-1-0.dll: _localtime64_s\n _time64\napi-ms-win-crt-convert-l1-1-0.dll: mbstowcs\n wcstombs\n _wtoi\n atol\n wcsrtombs_s\n\nExports:\n--------\n??0CabinetBase@utilitylibrary@nutanix@@QEAA@$$QEAV012@@Z:\n Ordinal: 1\n Address: 0x000014F0\n\n??0CabinetBase@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 2\n Address: 0x00001440\n\n??0CabinetBase@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 3\n Address: 0x00001320\n\n??0CabinetBuilder@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 4\n Address: 0x00001700\n\n??0CabinetBuilder@utilitylibrary@nutanix@@QEAA@GKKK@Z:\n Ordinal: 5\n Address: 0x000025E0\n\n??0NutanixException@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 6\n Address: 0x000065F0\n\n??0NutanixException@utilitylibrary@nutanix@@QEAA@JAEBQEB_W@Z:\n Ordinal: 7\n Address: 0x0001F940\n\n??0NutanixInitializeLogger@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 8\n Address: 0x00011CE0\n\n??0RPCCliWrapper@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 9\n Address: 0x00023630\n\n??0RPCCliWrapper@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 10\n Address: 0x000236F0\n\n??0TcpClient@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 11\n Address: 0x00026200\n\n??0TcpClient@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 12\n Address: 0x00026370\n\n??0WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 13\n Address: 0x00011670\n\n??0WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 14\n Address: 0x00011670\n\n??1CabinetBase@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 15\n Address: 0x00001420\n\n??1CabinetBuilder@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 16\n Address: 0x000026D0\n\n??1NutanixException@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 17\n Address: 0x00006540\n\n??1RPCCliWrapper@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 18\n Address: 0x00023770\n\n??1TcpClient@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 19\n Address: 0x000264D0\n\n??1WindowsRegistryOperations@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 20\n Address: 0x00011660\n\n??4CabinetBase@utilitylibrary@nutanix@@QEAAAEAV012@$$QEAV012@@Z:\n Ordinal: 21\n Address: 0x000015E0\n\n??4CabinetBase@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 22\n Address: 0x00001570\n\n??4CabinetBuilder@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 23\n Address: 0x00001870\n\n??4EncryptionLibrary@utilitylibrary@nutanix@@QEAAAEAV012@$$QEAV012@@Z:\n Ordinal: 24\n Address: 0x00006760\n\n??4EncryptionLibrary@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 25\n Address: 0x00006760\n\n??4NutanixException@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 26\n Address: 0x00006640\n\n??4NutanixInitializeLogger@utilitylibrary@nutanix@@QEAAAEAV012@$$QEAV012@@Z:\n Ordinal: 27\n Address: 0x00001AA0\n\n??4NutanixInitializeLogger@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 28\n Address: 0x00001AA0\n\n??4RPCCliWrapper@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 29\n Address: 0x00023650\n\n??4TcpClient@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 30\n Address: 0x00026260\n\n??4WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 31\n Address: 0x00006760\n\n??_7CabinetBuilder@utilitylibrary@nutanix@@6B@:\n Ordinal: 32\n Address: 0x000372A0\n\n??_7NutanixException@utilitylibrary@nutanix@@6B@:\n Ordinal: 33\n Address: 0x000376C8\n\n??_7RPCCliWrapper@utilitylibrary@nutanix@@6B@:\n Ordinal: 34\n Address: 0x0003B988\n\n??_7TcpClient@utilitylibrary@nutanix@@6B@:\n Ordinal: 35\n Address: 0x0003CBC0\n\n??_7WindowsRegistryOperations@utilitylibrary@nutanix@@6B@:\n Ordinal: 36\n Address: 0x00039E60\n\n??_FCabinetBuilder@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 37\n Address: 0x000019E0\n\n??_FNutanixException@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 38\n Address: 0x00006690\n\n?AbortSnapshot@RPCCliWrapper@utilitylibrary@nutanix@@QEAAXPEBDV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 39\n Address: 0x00024080\n\n?AbortSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXPEBDV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 40\n Address: 0x00026DF0\n\n?AddFile@CabinetBuilder@utilitylibrary@nutanix@@QEAAHPEB_W0HH@Z:\n Ordinal: 41\n Address: 0x000041D0\n\n?AppendBackSlash@utilitylibrary@nutanix@@YAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 42\n Address: 0x000215E0\n\n?CloseKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXPEAPEAUHKEY__@@@Z:\n Ordinal: 43\n Address: 0x00029F80\n\n?CloseSocket@TcpClient@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 44\n Address: 0x000266C0\n\n?CompareProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA_NXZ:\n Ordinal: 45\n Address: 0x0002AB90\n\n?Connect@TcpClient@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 46\n Address: 0x00026530\n\n?ConvertRegistryValueTypeToString@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z:\n Ordinal: 47\n Address: 0x00028350\n\n?ConvertStringToWstring@utilitylibrary@nutanix@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z:\n Ordinal: 48\n Address: 0x000201A0\n\n?ConvertTstringToString@utilitylibrary@nutanix@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z:\n Ordinal: 49\n Address: 0x00020810\n\n?ConvertWstringToString@utilitylibrary@nutanix@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z:\n Ordinal: 50\n Address: 0x00020510\n\n?CopyTstringToByteArray@EncryptionLibrary@utilitylibrary@nutanix@@AEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_KPEAPEAE@Z:\n Ordinal: 51\n Address: 0x00006770\n\n?CreateCabinetFilePath@CabinetBuilder@utilitylibrary@nutanix@@AEAAHXZ:\n Ordinal: 52\n Address: 0x000038A0\n\n?CreateKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAPEAUHKEY__@@@Z:\n Ordinal: 53\n Address: 0x00028A00\n\n?CreateSnapshot@RPCCliWrapper@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 54\n Address: 0x000237E0\n\n?CreateSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 55\n Address: 0x00026AA0\n\n?DecryptData@EncryptionLibrary@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAPEAEAEAK@Z:\n Ordinal: 56\n Address: 0x00006C10\n\n?DeleteProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 57\n Address: 0x0002A8B0\n\n?DeleteRegistryKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXPEB_W0@Z:\n Ordinal: 58\n Address: 0x0002A080\n\n?DeleteTempDebugLogsDestination@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 59\n Address: 0x00029ED0\n\n?DeleteTransactionIdKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 60\n Address: 0x0002A940\n\n?EnableFileLogging@utilitylibrary@nutanix@@YAX_N@Z:\n Ordinal: 61\n Address: 0x00012B40\n\n?EncryptData@EncryptionLibrary@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAPEAEAEAK@Z:\n Ordinal: 62\n Address: 0x00006810\n\n?ExecuteProcess@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAH_NK@Z:\n Ordinal: 63\n Address: 0x00021CD0\n\n?ExpandPath@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV34@@Z:\n Ordinal: 64\n Address: 0x00021270\n\n?FileClose@CabinetBase@utilitylibrary@nutanix@@KAHHPEAHPEAX@Z:\n Ordinal: 65\n Address: 0x000024C0\n\n?FileCloseProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AH_JPEAHPEAX@ZXZ:\n Ordinal: 66\n Address: 0x00001690\n\n?FileDelete@CabinetBuilder@utilitylibrary@nutanix@@KAHPEADPEAHPEAX@Z:\n Ordinal: 67\n Address: 0x00002760\n\n?FileDeleteProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AHPEADPEAHPEAX@ZXZ:\n Ordinal: 68\n Address: 0x000016A0\n\n?FileOpen@CabinetBase@utilitylibrary@nutanix@@KAHPEADHHPEAHPEAX@Z:\n Ordinal: 69\n Address: 0x00001CA0\n\n?FileOpenProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6A_JPEADHHPEAHPEAX@ZXZ:\n Ordinal: 70\n Address: 0x00001650\n\n?FileRead@CabinetBase@utilitylibrary@nutanix@@KAIHPEAXIPEAH0@Z:\n Ordinal: 71\n Address: 0x000020B0\n\n?FileReadProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AI_JPEAXIPEAH1@ZXZ:\n Ordinal: 72\n Address: 0x00001660\n\n?FileSeek@CabinetBase@utilitylibrary@nutanix@@KAJHJHPEAHPEAX@Z:\n Ordinal: 73\n Address: 0x00002350\n\n?FileSeekProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AJ_JJHPEAHPEAX@ZXZ:\n Ordinal: 74\n Address: 0x00001680\n\n?FileWrite@CabinetBase@utilitylibrary@nutanix@@KAIHPEAXIPEAH0@Z:\n Ordinal: 75\n Address: 0x00002210\n\n?FileWriteProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AI_JPEAXIPEAH1@ZXZ:\n Ordinal: 76\n Address: 0x00001670\n\n?FinishSnapshot@RPCCliWrapper@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 77\n Address: 0x00025560\n\n?FinishSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z:\n Ordinal: 78\n Address: 0x000276E0\n\n?FlushCabinet@CabinetBuilder@utilitylibrary@nutanix@@QEAAHXZ:\n Ordinal: 79\n Address: 0x00004750\n\n?FlushFolder@CabinetBuilder@utilitylibrary@nutanix@@QEAAHXZ:\n Ordinal: 80\n Address: 0x000046E0\n\n?FormatString@utilitylibrary@nutanix@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WZZ:\n Ordinal: 81\n Address: 0x00020870\n\n?GUIDToString@utilitylibrary@nutanix@@YAXAEBU_GUID@@AEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 82\n Address: 0x00020EB0\n\n?GeneratePasswordForCurrentMachine@EncryptionLibrary@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 83\n Address: 0x00007050\n\n?GenerateProviderParticipationKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 84\n Address: 0x0002A9D0\n\n?GetAuthenticationKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 85\n Address: 0x0002B2F0\n\n?GetDebugLogsDestination@utilitylibrary@nutanix@@YAJQEA_W@Z:\n Ordinal: 86\n Address: 0x00029940\n\n?GetErrorCode@CabinetBase@utilitylibrary@nutanix@@QEBAHXZ:\n Ordinal: 87\n Address: 0x00001370\n\n?GetErrorCode@NutanixException@utilitylibrary@nutanix@@QEBAJXZ:\n Ordinal: 88\n Address: 0x000065E0\n\n?GetErrorCodeEx@CabinetBase@utilitylibrary@nutanix@@QEBAHXZ:\n Ordinal: 89\n Address: 0x00001380\n\n?GetErrorMessage@NutanixException@utilitylibrary@nutanix@@QEBAPEBDXZ:\n Ordinal: 90\n Address: 0x000065D0\n\n?GetFciErrorString@CabinetBase@utilitylibrary@nutanix@@QEAAPEADH@Z:\n Ordinal: 91\n Address: 0x00001390\n\n?GetFileInfo@CabinetBuilder@utilitylibrary@nutanix@@KAHPEADPEAG11PEAHPEAX@Z:\n Ordinal: 92\n Address: 0x00002B10\n\n?GetFileInfoProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6A_JPEADPEAG11PEAHPEAX@ZXZ:\n Ordinal: 93\n Address: 0x000016C0\n\n?GetGuestAgentTcpPort@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 94\n Address: 0x0002A3A0\n\n?GetInstallationPath@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 95\n Address: 0x0002B400\n\n?GetKeySubKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV45@AEAPEAUHKEY__@@@Z:\n Ordinal: 96\n Address: 0x000294F0\n\n?GetNextCabinet@CabinetBuilder@utilitylibrary@nutanix@@KAHPEAUCCAB@@KPEAX@Z:\n Ordinal: 97\n Address: 0x00002D70\n\n?GetNextCabinetProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AHPEAUCCAB@@KPEAX@ZXZ:\n Ordinal: 98\n Address: 0x000016D0\n\n?GetProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 99\n Address: 0x0002A780\n\n?GetServerIpAddress@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 100\n Address: 0x0002AE70\n\n?GetStatus@CabinetBase@utilitylibrary@nutanix@@QEBAHXZ:\n Ordinal: 101\n Address: 0x00001350\n\n?GetTempFile@CabinetBuilder@utilitylibrary@nutanix@@KAHPEADHPEAX@Z:\n Ordinal: 102\n Address: 0x000029A0\n\n?GetTempFileProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AHPEADHPEAX@ZXZ:\n Ordinal: 103\n Address: 0x000016B0\n\n?GetTransactionId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 104\n Address: 0x0002A270\n\n?GetVSSServiceStatus@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAK@Z:\n Ordinal: 105\n Address: 0x0002A540\n\n?GetVmId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 106\n Address: 0x0002B0A0\n\n?HandleHresult@utilitylibrary@nutanix@@YAXGPEB_WJ@Z:\n Ordinal: 107\n Address: 0x00020CE0\n\n?HandleWin32APIError@utilitylibrary@nutanix@@YAXGPEA_WK@Z:\n Ordinal: 108\n Address: 0x0001FE10\n\n?InitCabinet@CabinetBuilder@utilitylibrary@nutanix@@QEAAHPEB_W00@Z:\n Ordinal: 109\n Address: 0x00003B10\n\n?IsStringInVector@utilitylibrary@nutanix@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z:\n Ordinal: 110\n Address: 0x000214A0\n\n?LogDebugMessageToDebugView@utilitylibrary@nutanix@@YAXPEB_WZZ:\n Ordinal: 111\n Address: 0x000135A0\n\n?LogDebugMessageToTextFile@utilitylibrary@nutanix@@YAXPEB_WZZ:\n Ordinal: 112\n Address: 0x000136D0\n\n?ManufactureCabinetName@CabinetBuilder@utilitylibrary@nutanix@@QEAAXPEAUCCAB@@@Z:\n Ordinal: 113\n Address: 0x000037B0\n\n?ManufactureDiskName@CabinetBuilder@utilitylibrary@nutanix@@QEAAXPEAUCCAB@@@Z:\n Ordinal: 114\n Address: 0x000036F0\n\n?MapToString@utilitylibrary@nutanix@@YAXAEBV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@std@@AEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z:\n Ordinal: 115\n Address: 0x00021740\n\n?MemAlloc@CabinetBase@utilitylibrary@nutanix@@KAPEAXK@Z:\n Ordinal: 116\n Address: 0x00001AE0\n\n?MemAllocProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6APEAXK@ZXZ:\n Ordinal: 117\n Address: 0x00001630\n\n?MemFree@CabinetBase@utilitylibrary@nutanix@@KAXPEAX@Z:\n Ordinal: 118\n Address: 0x00001BC0\n\n?MemFreeProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AXPEAX@ZXZ:\n Ordinal: 119\n Address: 0x00001640\n\n?NotifyCabinetFlush@CabinetBuilder@utilitylibrary@nutanix@@IEAAKKK@Z:\n Ordinal: 120\n Address: 0x000034E0\n\n?NotifyCompress@CabinetBuilder@utilitylibrary@nutanix@@IEAAHKK@Z:\n Ordinal: 121\n Address: 0x00003320\n\n?NotifyFilePlaced@CabinetBuilder@utilitylibrary@nutanix@@KAHPEAUCCAB@@PEADJHPEAX@Z:\n Ordinal: 122\n Address: 0x000030C0\n\n?NotifyFilePlacedProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AHPEAUCCAB@@PEADJHPEAX@ZXZ:\n Ordinal: 123\n Address: 0x000016F0\n\n?NotifyFolderFlush@CabinetBuilder@utilitylibrary@nutanix@@IEAAHKK@Z:\n Ordinal: 124\n Address: 0x00003400\n\n?NotifyPlaced@CabinetBuilder@utilitylibrary@nutanix@@IEAAHPEADJHH0@Z:\n Ordinal: 125\n Address: 0x00002E70\n\n?NotifyProgress@CabinetBuilder@utilitylibrary@nutanix@@KAJIKKPEAX@Z:\n Ordinal: 126\n Address: 0x000035C0\n\n?NotifyProgressProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AJIKKPEAX@ZXZ:\n Ordinal: 127\n Address: 0x000016E0\n\n?OpenKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAPEAUHKEY__@@@Z:\n Ordinal: 128\n Address: 0x000287E0\n\n?ReadDebugLogsDestination@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXQEA_W@Z:\n Ordinal: 129\n Address: 0x00029B30\n\n?ReadLogLevel@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAJQEA_W@Z:\n Ordinal: 130\n Address: 0x00029880\n\n?ReadRegistryKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAJPEB_W0KAEAPEAEPEAK@Z:\n Ordinal: 131\n Address: 0x00028CA0\n\n?ReadTempDebugLogsDestination@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXQEA_W@Z:\n Ordinal: 132\n Address: 0x00029C40\n\n?SendRpc@TcpClient@utilitylibrary@nutanix@@QEAAHAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAHH@Z:\n Ordinal: 133\n Address: 0x000266F0\n\n?SetAuthenticationKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 134\n Address: 0x0002B5A0\n\n?SetProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 135\n Address: 0x0002A650\n\n?SetServerIpAddress@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 136\n Address: 0x0002AF80\n\n?SetTempDebugLogsDestination@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXQEB_W@Z:\n Ordinal: 137\n Address: 0x00029DA0\n\n?SetTransactionId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 138\n Address: 0x0002B6C0\n\n?SetVmId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 139\n Address: 0x0002B1D0\n\n?StringToGUID@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAU_GUID@@@Z:\n Ordinal: 140\n Address: 0x00021010\n\n?TokenizeWString@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@0@Z:\n Ordinal: 141\n Address: 0x00021B60\n\n?ValidateTransaction@RPCCliWrapper@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 142\n Address: 0x00024C90\n\n?ValidateTransaction@TcpClient@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 143\n Address: 0x00027400\n\n?VectorToString@utilitylibrary@nutanix@@YAXAEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@AEAV54@@Z:\n Ordinal: 144\n Address: 0x00021860\n\n?WriteRegistryKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAJPEB_W0KPEBEK@Z:\n Ordinal: 145\n Address: 0x00029300\n\n?gpCommunicationLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA:\n Ordinal: 146\n Address: 0x00057068\n\n?gpDebugLogger@utilitylibrary@nutanix@@3P6AXPEB_WZZEA:\n Ordinal: 147\n Address: 0x00057080\n\n?gpErrorLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA:\n Ordinal: 148\n Address: 0x00057078\n\n?gpInfoLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA:\n Ordinal: 149\n Address: 0x00057070\n\n?gpWarningLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA:\n Ordinal: 150\n Address: 0x00057058\n\nGetConfiguredLogLevel:\n Ordinal: 151\n Address: 0x00011830\n\nGetConfiguredLogLocation:\n Ordinal: 152\n Address: 0x00011940\n\nGetControllerIpAddress:\n Ordinal: 153\n Address: 0x0002BD60\n\nGetVmId:\n Ordinal: 154\n Address: 0x0002BEF0\n\nGetWindowsServiceProperties:\n Ordinal: 155\n Address: 0x0001FD00\n\nLogToWindowsEventLog:\n Ordinal: 156\n Address: 0x00013B00\n\nSetAuthenticationKeyWrapper:\n Ordinal: 157\n Address: 0x0002BC00\n\nSetServerIpAddressWrapper:\n Ordinal: 158\n Address: 0x0002B940\n\nSetTransactionIdWrapper:\n Ordinal: 159\n Address: 0x0002B7E0\n\nSetVmIdWrapper:\n Ordinal: 160\n Address: 0x0002BAA0\n\n\nResources:\n----------\n1:\n Type: RT_MESSAGETABLE\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27423\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 840\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.38421\n\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.0.0\n ProductVersion: 1.1.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Nutanix\n FileDescription: Nutanix Utility Library\n FileVersion (#2): 1.1.0.0\n InternalName: NutanixUtilityLibrary.dll\n LegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\n OriginalFilename: NutanixUtilityLibrary.dll\n ProductName: Nutanix VSS Solution\n ProductVersion (#2): 1.1.0.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:46\n Version: 0.0\n SizeofData: 161\n AddressOfRawData: 0x00045FEC\n PointerToRawData: 0x00044FEC\n Referenced File: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixUtilityLibrary.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:46\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00046090\n PointerToRawData: 0x00045090\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:46\n Version: 0.0\n SizeofData: 732\n AddressOfRawData: 0x000460A4\n PointerToRawData: 0x000450A4\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:46\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n\n\nLoad Configuration:\n-------------------\nSize: 148\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180057008\n\nRICH Header:\n------------\nXOR Key: 0xC41CE44F\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 14\n208 (65501): 1\nASM objects (VS2015 UPD3 build 24123): 3\nC objects (VS2015 UPD3 build 24123): 12\nImports (VS2015 UPD3 build 24123): 4\nC++ objects (VS2015 UPD3 build 24123): 28\nC objects (65501): 1\nImports (65501): 17\nTotal imports: 269\nC++ objects (LTCG) (VS2015 UPD3.1 build 24215): 10\nExports (VS2015 UPD3.1 build 24215): 1\nResource objects (VS2015 UPD3 build 24210): 1\n151: 1\nLinker (VS2015 UPD3.1 build 24215): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentControlSet\\Services\n Accesses the WMI:\n ROOT\\CIMV2\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Can access the registry:\n RegCloseKey\n RegDeleteKeyValueW\n RegCreateKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegQueryValueExW\n Possibly launches other programs:\n CreateProcessW\n Uses Microsoft's cryptographic API:\n CryptProtectData\n CryptUnprotectData\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Leverages the raw socket API to access the Internet:\n WSACleanup\n closesocket\n getaddrinfo\n WSAStartup\n send\n socket\n connect\n recv\n WSAGetLastError\n freeaddrinfo\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-Oct-19 14:07:46\nDetected languages: English - United States\nDebug artifacts: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixUtilityLibrary.pdb\nCompanyName: Nutanix\nFileDescription: Nutanix Utility Library\nFileVersion: 1.1.0.0\nInternalName: NutanixUtilityLibrary.dll\nLegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\nOriginalFilename: NutanixUtilityLibrary.dll\nProductName: Nutanix VSS Solution\nProductVersion: 1.1.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000110"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 7\nTimeDateStamp: 2024-Oct-19 14:07:46\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00033C00\nSizeOfInitializedData: 0x00027000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000002DDD8 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0005F000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00033B5E\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00033C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.18491\n\n.rdata:\n VirtualSize: 0x00021698\n VirtualAddress: 0x00035000\n SizeOfRawData: 0x00021800\n PointerToRawData: 0x00034000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.62473\n\n.data:\n VirtualSize: 0x00001E58\n VirtualAddress: 0x00057000\n SizeOfRawData: 0x00001800\n PointerToRawData: 0x00055800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.63178\n\n.pdata:\n VirtualSize: 0x00002670\n VirtualAddress: 0x00059000\n SizeOfRawData: 0x00002800\n PointerToRawData: 0x00057000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.44333\n\n.gfids:\n VirtualSize: 0x00000040\n VirtualAddress: 0x0005C000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00059800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.312429\n\n.rsrc:\n VirtualSize: 0x000006F0\n VirtualAddress: 0x0005D000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00059A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.61524\n\n.reloc:\n VirtualSize: 0x000004E4\n VirtualAddress: 0x0005E000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0005A200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.82304"},"Imports":{"raw":"CRYPT32.dll: CryptProtectData\n CryptUnprotectData\nCabinet.dll: #13\n #10\n #14\n #11\n #12\nSHLWAPI.dll: PathFileExistsW\nKERNEL32.dll: DeleteFileA\n DeleteFileW\n CloseHandle\n FileTimeToLocalFileTime\n CreateDirectoryA\n GetTempFileNameA\n WriteFile\n LocalFree\n GetEnvironmentVariableW\n GetEnvironmentVariableA\n OutputDebugStringW\n CreateFileA\n ExpandEnvironmentStringsW\n WaitForSingleObject\n LocalAlloc\n MultiByteToWideChar\n FormatMessageW\n CreateProcessW\n WideCharToMultiByte\n GetExitCodeProcess\n ReadFile\n GetCurrentThreadId\n InitializeSListHead\n GetFileAttributesA\n GetLastError\n GetTempPathA\n GetFileInformationByHandle\n GetSystemTimeAsFileTime\n SetFilePointer\n FileTimeToDosDateTime\n GetCurrentProcessId\n QueryPerformanceCounter\n IsDebuggerPresent\n IsProcessorFeaturePresent\n TerminateProcess\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n RtlCaptureContext\nADVAPI32.dll: RegisterEventSourceW\n RegCloseKey\n RegDeleteKeyValueW\n RegCreateKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegQueryValueExW\n ReportEventW\nole32.dll: CoUninitialize\n CoCreateInstance\n CoSetProxyBlanket\n CoInitializeSecurity\n CoInitializeEx\n CLSIDFromString\n StringFromGUID2\nOLEAUT32.dll: SysFreeString\n SysAllocString\n VariantClear\nMSVCP140.dll: ?_Xout_of_range@std@@YAXPEBD@Z\n ?_Xlength_error@std@@YAXPEBD@Z\n ??1_Lockit@std@@QEAA@XZ\n ??0_Lockit@std@@QEAA@H@Z\n ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A\n ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ\n ?uncaught_exception@std@@YA_NXZ\n ?_BADOFF@std@@3_JB\n ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A\n ?_Xbad_function_call@std@@YAXXZ\n ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A\n ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z\n ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z\n ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z\n ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z\n ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z\n ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ\n ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ\n ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ\n ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ\n ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z\n ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z\n ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z\n ?_Xbad_alloc@std@@YAXXZ\n ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ\n ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z\n ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z\n ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z\n ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z\n ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z\n ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ\n ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ\n ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ\n ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ\n ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ\n ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ\n ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z\n ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z\n ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z\n ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ\n ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z\n ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ\n ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z\n ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z\n ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ\n ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z\n ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z\n ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z\n ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z\n ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z\n ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ\n ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ\n ?always_noconv@codecvt_base@std@@QEBA_NXZ\n ??Bid@locale@std@@QEAA_KXZ\n ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ\n ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ\n ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z\n ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z\n ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z\n ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ\n ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ\n ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z\n ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\n ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ\n ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ\n ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ\n ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ\n ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z\n ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z\n ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z\n ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ\n ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z\n ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ\nWS2_32.dll: WSACleanup\n closesocket\n getaddrinfo\n WSAStartup\n send\n socket\n connect\n recv\n WSAGetLastError\n freeaddrinfo\nVCRUNTIME140.dll: memchr\n memmove\n __std_exception_destroy\n __std_exception_copy\n _purecall\n __CxxFrameHandler3\n __C_specific_handler\n _CxxThrowException\n memset\n __std_type_info_destroy_list\n memcmp\n __std_terminate\n memcpy\napi-ms-win-crt-string-l1-1-0.dll: strtok_s\n wcstok_s\n wcstok\n strncpy_s\n wcscpy_s\n strcpy_s\n isspace\n strcat_s\n _wcsicmp\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vsprintf_s\n fflush\n fgetc\n __stdio_common_vswprintf_s\n _get_stream_buffer_pointers\n _fseeki64\n ungetc\n __stdio_common_vswprintf\n setvbuf\n fgetpos\n fwrite\n __stdio_common_vsnprintf_s\n fputc\n fclose\n fsetpos\napi-ms-win-crt-heap-l1-1-0.dll: _callnewh\n calloc\n free\n malloc\napi-ms-win-crt-runtime-l1-1-0.dll: _invalid_parameter_noinfo_noreturn\n signal\n _cexit\n _initterm\n _crt_atexit\n abort\n _execute_onexit_table\n _initialize_onexit_table\n _invalid_parameter_noinfo\n _register_onexit_function\n _errno\n _initterm_e\n terminate\n _seh_filter_dll\n _configure_narrow_argv\n _initialize_narrow_environment\napi-ms-win-crt-filesystem-l1-1-0.dll: _lock_file\n _mkdir\n _unlock_file\n _splitpath_s\n rename\napi-ms-win-crt-time-l1-1-0.dll: _localtime64_s\n _time64\napi-ms-win-crt-convert-l1-1-0.dll: mbstowcs\n wcstombs\n _wtoi\n atol\n wcsrtombs_s"},"Exports":{"raw":"??0CabinetBase@utilitylibrary@nutanix@@QEAA@$$QEAV012@@Z:\n Ordinal: 1\n Address: 0x000014F0\n\n??0CabinetBase@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 2\n Address: 0x00001440\n\n??0CabinetBase@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 3\n Address: 0x00001320\n\n??0CabinetBuilder@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 4\n Address: 0x00001700\n\n??0CabinetBuilder@utilitylibrary@nutanix@@QEAA@GKKK@Z:\n Ordinal: 5\n Address: 0x000025E0\n\n??0NutanixException@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 6\n Address: 0x000065F0\n\n??0NutanixException@utilitylibrary@nutanix@@QEAA@JAEBQEB_W@Z:\n Ordinal: 7\n Address: 0x0001F940\n\n??0NutanixInitializeLogger@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 8\n Address: 0x00011CE0\n\n??0RPCCliWrapper@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 9\n Address: 0x00023630\n\n??0RPCCliWrapper@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 10\n Address: 0x000236F0\n\n??0TcpClient@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 11\n Address: 0x00026200\n\n??0TcpClient@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 12\n Address: 0x00026370\n\n??0WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA@AEBV012@@Z:\n Ordinal: 13\n Address: 0x00011670\n\n??0WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 14\n Address: 0x00011670\n\n??1CabinetBase@utilitylibrary@nutanix@@QEAA@XZ:\n Ordinal: 15\n Address: 0x00001420\n\n??1CabinetBuilder@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 16\n Address: 0x000026D0\n\n??1NutanixException@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 17\n Address: 0x00006540\n\n??1RPCCliWrapper@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 18\n Address: 0x00023770\n\n??1TcpClient@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 19\n Address: 0x000264D0\n\n??1WindowsRegistryOperations@utilitylibrary@nutanix@@UEAA@XZ:\n Ordinal: 20\n Address: 0x00011660\n\n??4CabinetBase@utilitylibrary@nutanix@@QEAAAEAV012@$$QEAV012@@Z:\n Ordinal: 21\n Address: 0x000015E0\n\n??4CabinetBase@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 22\n Address: 0x00001570\n\n??4CabinetBuilder@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 23\n Address: 0x00001870\n\n??4EncryptionLibrary@utilitylibrary@nutanix@@QEAAAEAV012@$$QEAV012@@Z:\n Ordinal: 24\n Address: 0x00006760\n\n??4EncryptionLibrary@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 25\n Address: 0x00006760\n\n??4NutanixException@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 26\n Address: 0x00006640\n\n??4NutanixInitializeLogger@utilitylibrary@nutanix@@QEAAAEAV012@$$QEAV012@@Z:\n Ordinal: 27\n Address: 0x00001AA0\n\n??4NutanixInitializeLogger@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 28\n Address: 0x00001AA0\n\n??4RPCCliWrapper@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 29\n Address: 0x00023650\n\n??4TcpClient@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 30\n Address: 0x00026260\n\n??4WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAAEAV012@AEBV012@@Z:\n Ordinal: 31\n Address: 0x00006760\n\n??_7CabinetBuilder@utilitylibrary@nutanix@@6B@:\n Ordinal: 32\n Address: 0x000372A0\n\n??_7NutanixException@utilitylibrary@nutanix@@6B@:\n Ordinal: 33\n Address: 0x000376C8\n\n??_7RPCCliWrapper@utilitylibrary@nutanix@@6B@:\n Ordinal: 34\n Address: 0x0003B988\n\n??_7TcpClient@utilitylibrary@nutanix@@6B@:\n Ordinal: 35\n Address: 0x0003CBC0\n\n??_7WindowsRegistryOperations@utilitylibrary@nutanix@@6B@:\n Ordinal: 36\n Address: 0x00039E60\n\n??_FCabinetBuilder@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 37\n Address: 0x000019E0\n\n??_FNutanixException@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 38\n Address: 0x00006690\n\n?AbortSnapshot@RPCCliWrapper@utilitylibrary@nutanix@@QEAAXPEBDV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 39\n Address: 0x00024080\n\n?AbortSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXPEBDV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 40\n Address: 0x00026DF0\n\n?AddFile@CabinetBuilder@utilitylibrary@nutanix@@QEAAHPEB_W0HH@Z:\n Ordinal: 41\n Address: 0x000041D0\n\n?AppendBackSlash@utilitylibrary@nutanix@@YAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 42\n Address: 0x000215E0\n\n?CloseKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXPEAPEAUHKEY__@@@Z:\n Ordinal: 43\n Address: 0x00029F80\n\n?CloseSocket@TcpClient@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 44\n Address: 0x000266C0\n\n?CompareProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA_NXZ:\n Ordinal: 45\n Address: 0x0002AB90\n\n?Connect@TcpClient@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 46\n Address: 0x00026530\n\n?ConvertRegistryValueTypeToString@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z:\n Ordinal: 47\n Address: 0x00028350\n\n?ConvertStringToWstring@utilitylibrary@nutanix@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z:\n Ordinal: 48\n Address: 0x000201A0\n\n?ConvertTstringToString@utilitylibrary@nutanix@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z:\n Ordinal: 49\n Address: 0x00020810\n\n?ConvertWstringToString@utilitylibrary@nutanix@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z:\n Ordinal: 50\n Address: 0x00020510\n\n?CopyTstringToByteArray@EncryptionLibrary@utilitylibrary@nutanix@@AEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_KPEAPEAE@Z:\n Ordinal: 51\n Address: 0x00006770\n\n?CreateCabinetFilePath@CabinetBuilder@utilitylibrary@nutanix@@AEAAHXZ:\n Ordinal: 52\n Address: 0x000038A0\n\n?CreateKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAPEAUHKEY__@@@Z:\n Ordinal: 53\n Address: 0x00028A00\n\n?CreateSnapshot@RPCCliWrapper@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 54\n Address: 0x000237E0\n\n?CreateSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 55\n Address: 0x00026AA0\n\n?DecryptData@EncryptionLibrary@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAPEAEAEAK@Z:\n Ordinal: 56\n Address: 0x00006C10\n\n?DeleteProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 57\n Address: 0x0002A8B0\n\n?DeleteRegistryKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXPEB_W0@Z:\n Ordinal: 58\n Address: 0x0002A080\n\n?DeleteTempDebugLogsDestination@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 59\n Address: 0x00029ED0\n\n?DeleteTransactionIdKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 60\n Address: 0x0002A940\n\n?EnableFileLogging@utilitylibrary@nutanix@@YAX_N@Z:\n Ordinal: 61\n Address: 0x00012B40\n\n?EncryptData@EncryptionLibrary@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAPEAEAEAK@Z:\n Ordinal: 62\n Address: 0x00006810\n\n?ExecuteProcess@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAH_NK@Z:\n Ordinal: 63\n Address: 0x00021CD0\n\n?ExpandPath@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV34@@Z:\n Ordinal: 64\n Address: 0x00021270\n\n?FileClose@CabinetBase@utilitylibrary@nutanix@@KAHHPEAHPEAX@Z:\n Ordinal: 65\n Address: 0x000024C0\n\n?FileCloseProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AH_JPEAHPEAX@ZXZ:\n Ordinal: 66\n Address: 0x00001690\n\n?FileDelete@CabinetBuilder@utilitylibrary@nutanix@@KAHPEADPEAHPEAX@Z:\n Ordinal: 67\n Address: 0x00002760\n\n?FileDeleteProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AHPEADPEAHPEAX@ZXZ:\n Ordinal: 68\n Address: 0x000016A0\n\n?FileOpen@CabinetBase@utilitylibrary@nutanix@@KAHPEADHHPEAHPEAX@Z:\n Ordinal: 69\n Address: 0x00001CA0\n\n?FileOpenProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6A_JPEADHHPEAHPEAX@ZXZ:\n Ordinal: 70\n Address: 0x00001650\n\n?FileRead@CabinetBase@utilitylibrary@nutanix@@KAIHPEAXIPEAH0@Z:\n Ordinal: 71\n Address: 0x000020B0\n\n?FileReadProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AI_JPEAXIPEAH1@ZXZ:\n Ordinal: 72\n Address: 0x00001660\n\n?FileSeek@CabinetBase@utilitylibrary@nutanix@@KAJHJHPEAHPEAX@Z:\n Ordinal: 73\n Address: 0x00002350\n\n?FileSeekProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AJ_JJHPEAHPEAX@ZXZ:\n Ordinal: 74\n Address: 0x00001680\n\n?FileWrite@CabinetBase@utilitylibrary@nutanix@@KAIHPEAXIPEAH0@Z:\n Ordinal: 75\n Address: 0x00002210\n\n?FileWriteProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AI_JPEAXIPEAH1@ZXZ:\n Ordinal: 76\n Address: 0x00001670\n\n?FinishSnapshot@RPCCliWrapper@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 77\n Address: 0x00025560\n\n?FinishSnapshot@TcpClient@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z:\n Ordinal: 78\n Address: 0x000276E0\n\n?FlushCabinet@CabinetBuilder@utilitylibrary@nutanix@@QEAAHXZ:\n Ordinal: 79\n Address: 0x00004750\n\n?FlushFolder@CabinetBuilder@utilitylibrary@nutanix@@QEAAHXZ:\n Ordinal: 80\n Address: 0x000046E0\n\n?FormatString@utilitylibrary@nutanix@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_WZZ:\n Ordinal: 81\n Address: 0x00020870\n\n?GUIDToString@utilitylibrary@nutanix@@YAXAEBU_GUID@@AEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 82\n Address: 0x00020EB0\n\n?GeneratePasswordForCurrentMachine@EncryptionLibrary@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 83\n Address: 0x00007050\n\n?GenerateProviderParticipationKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 84\n Address: 0x0002A9D0\n\n?GetAuthenticationKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 85\n Address: 0x0002B2F0\n\n?GetDebugLogsDestination@utilitylibrary@nutanix@@YAJQEA_W@Z:\n Ordinal: 86\n Address: 0x00029940\n\n?GetErrorCode@CabinetBase@utilitylibrary@nutanix@@QEBAHXZ:\n Ordinal: 87\n Address: 0x00001370\n\n?GetErrorCode@NutanixException@utilitylibrary@nutanix@@QEBAJXZ:\n Ordinal: 88\n Address: 0x000065E0\n\n?GetErrorCodeEx@CabinetBase@utilitylibrary@nutanix@@QEBAHXZ:\n Ordinal: 89\n Address: 0x00001380\n\n?GetErrorMessage@NutanixException@utilitylibrary@nutanix@@QEBAPEBDXZ:\n Ordinal: 90\n Address: 0x000065D0\n\n?GetFciErrorString@CabinetBase@utilitylibrary@nutanix@@QEAAPEADH@Z:\n Ordinal: 91\n Address: 0x00001390\n\n?GetFileInfo@CabinetBuilder@utilitylibrary@nutanix@@KAHPEADPEAG11PEAHPEAX@Z:\n Ordinal: 92\n Address: 0x00002B10\n\n?GetFileInfoProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6A_JPEADPEAG11PEAHPEAX@ZXZ:\n Ordinal: 93\n Address: 0x000016C0\n\n?GetGuestAgentTcpPort@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 94\n Address: 0x0002A3A0\n\n?GetInstallationPath@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 95\n Address: 0x0002B400\n\n?GetKeySubKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV45@AEAPEAUHKEY__@@@Z:\n Ordinal: 96\n Address: 0x000294F0\n\n?GetNextCabinet@CabinetBuilder@utilitylibrary@nutanix@@KAHPEAUCCAB@@KPEAX@Z:\n Ordinal: 97\n Address: 0x00002D70\n\n?GetNextCabinetProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AHPEAUCCAB@@KPEAX@ZXZ:\n Ordinal: 98\n Address: 0x000016D0\n\n?GetProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 99\n Address: 0x0002A780\n\n?GetServerIpAddress@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 100\n Address: 0x0002AE70\n\n?GetStatus@CabinetBase@utilitylibrary@nutanix@@QEBAHXZ:\n Ordinal: 101\n Address: 0x00001350\n\n?GetTempFile@CabinetBuilder@utilitylibrary@nutanix@@KAHPEADHPEAX@Z:\n Ordinal: 102\n Address: 0x000029A0\n\n?GetTempFileProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AHPEADHPEAX@ZXZ:\n Ordinal: 103\n Address: 0x000016B0\n\n?GetTransactionId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 104\n Address: 0x0002A270\n\n?GetVSSServiceStatus@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAK@Z:\n Ordinal: 105\n Address: 0x0002A540\n\n?GetVmId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 106\n Address: 0x0002B0A0\n\n?HandleHresult@utilitylibrary@nutanix@@YAXGPEB_WJ@Z:\n Ordinal: 107\n Address: 0x00020CE0\n\n?HandleWin32APIError@utilitylibrary@nutanix@@YAXGPEA_WK@Z:\n Ordinal: 108\n Address: 0x0001FE10\n\n?InitCabinet@CabinetBuilder@utilitylibrary@nutanix@@QEAAHPEB_W00@Z:\n Ordinal: 109\n Address: 0x00003B10\n\n?IsStringInVector@utilitylibrary@nutanix@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z:\n Ordinal: 110\n Address: 0x000214A0\n\n?LogDebugMessageToDebugView@utilitylibrary@nutanix@@YAXPEB_WZZ:\n Ordinal: 111\n Address: 0x000135A0\n\n?LogDebugMessageToTextFile@utilitylibrary@nutanix@@YAXPEB_WZZ:\n Ordinal: 112\n Address: 0x000136D0\n\n?ManufactureCabinetName@CabinetBuilder@utilitylibrary@nutanix@@QEAAXPEAUCCAB@@@Z:\n Ordinal: 113\n Address: 0x000037B0\n\n?ManufactureDiskName@CabinetBuilder@utilitylibrary@nutanix@@QEAAXPEAUCCAB@@@Z:\n Ordinal: 114\n Address: 0x000036F0\n\n?MapToString@utilitylibrary@nutanix@@YAXAEBV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@std@@AEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z:\n Ordinal: 115\n Address: 0x00021740\n\n?MemAlloc@CabinetBase@utilitylibrary@nutanix@@KAPEAXK@Z:\n Ordinal: 116\n Address: 0x00001AE0\n\n?MemAllocProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6APEAXK@ZXZ:\n Ordinal: 117\n Address: 0x00001630\n\n?MemFree@CabinetBase@utilitylibrary@nutanix@@KAXPEAX@Z:\n Ordinal: 118\n Address: 0x00001BC0\n\n?MemFreeProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AXPEAX@ZXZ:\n Ordinal: 119\n Address: 0x00001640\n\n?NotifyCabinetFlush@CabinetBuilder@utilitylibrary@nutanix@@IEAAKKK@Z:\n Ordinal: 120\n Address: 0x000034E0\n\n?NotifyCompress@CabinetBuilder@utilitylibrary@nutanix@@IEAAHKK@Z:\n Ordinal: 121\n Address: 0x00003320\n\n?NotifyFilePlaced@CabinetBuilder@utilitylibrary@nutanix@@KAHPEAUCCAB@@PEADJHPEAX@Z:\n Ordinal: 122\n Address: 0x000030C0\n\n?NotifyFilePlacedProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AHPEAUCCAB@@PEADJHPEAX@ZXZ:\n Ordinal: 123\n Address: 0x000016F0\n\n?NotifyFolderFlush@CabinetBuilder@utilitylibrary@nutanix@@IEAAHKK@Z:\n Ordinal: 124\n Address: 0x00003400\n\n?NotifyPlaced@CabinetBuilder@utilitylibrary@nutanix@@IEAAHPEADJHH0@Z:\n Ordinal: 125\n Address: 0x00002E70\n\n?NotifyProgress@CabinetBuilder@utilitylibrary@nutanix@@KAJIKKPEAX@Z:\n Ordinal: 126\n Address: 0x000035C0\n\n?NotifyProgressProc@CabinetBuilder@utilitylibrary@nutanix@@IEBAP6AJIKKPEAX@ZXZ:\n Ordinal: 127\n Address: 0x000016E0\n\n?OpenKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAPEAUHKEY__@@@Z:\n Ordinal: 128\n Address: 0x000287E0\n\n?ReadDebugLogsDestination@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXQEA_W@Z:\n Ordinal: 129\n Address: 0x00029B30\n\n?ReadLogLevel@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAJQEA_W@Z:\n Ordinal: 130\n Address: 0x00029880\n\n?ReadRegistryKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAJPEB_W0KAEAPEAEPEAK@Z:\n Ordinal: 131\n Address: 0x00028CA0\n\n?ReadTempDebugLogsDestination@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXQEA_W@Z:\n Ordinal: 132\n Address: 0x00029C40\n\n?SendRpc@TcpClient@utilitylibrary@nutanix@@QEAAHAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAHH@Z:\n Ordinal: 133\n Address: 0x000266F0\n\n?SetAuthenticationKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 134\n Address: 0x0002B5A0\n\n?SetProviderParticipationSwitchKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 135\n Address: 0x0002A650\n\n?SetServerIpAddress@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 136\n Address: 0x0002AF80\n\n?SetTempDebugLogsDestination@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXQEB_W@Z:\n Ordinal: 137\n Address: 0x00029DA0\n\n?SetTransactionId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 138\n Address: 0x0002B6C0\n\n?SetVmId@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z:\n Ordinal: 139\n Address: 0x0002B1D0\n\n?StringToGUID@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAU_GUID@@@Z:\n Ordinal: 140\n Address: 0x00021010\n\n?TokenizeWString@utilitylibrary@nutanix@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@0@Z:\n Ordinal: 141\n Address: 0x00021B60\n\n?ValidateTransaction@RPCCliWrapper@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 142\n Address: 0x00024C90\n\n?ValidateTransaction@TcpClient@utilitylibrary@nutanix@@QEAAXXZ:\n Ordinal: 143\n Address: 0x00027400\n\n?VectorToString@utilitylibrary@nutanix@@YAXAEBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@AEAV54@@Z:\n Ordinal: 144\n Address: 0x00021860\n\n?WriteRegistryKey@WindowsRegistryOperations@utilitylibrary@nutanix@@QEAAJPEB_W0KPEBEK@Z:\n Ordinal: 145\n Address: 0x00029300\n\n?gpCommunicationLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA:\n Ordinal: 146\n Address: 0x00057068\n\n?gpDebugLogger@utilitylibrary@nutanix@@3P6AXPEB_WZZEA:\n Ordinal: 147\n Address: 0x00057080\n\n?gpErrorLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA:\n Ordinal: 148\n Address: 0x00057078\n\n?gpInfoLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA:\n Ordinal: 149\n Address: 0x00057070\n\n?gpWarningLogger@utilitylibrary@nutanix@@3P6AXGKPEB_WZZEA:\n Ordinal: 150\n Address: 0x00057058\n\nGetConfiguredLogLevel:\n Ordinal: 151\n Address: 0x00011830\n\nGetConfiguredLogLocation:\n Ordinal: 152\n Address: 0x00011940\n\nGetControllerIpAddress:\n Ordinal: 153\n Address: 0x0002BD60\n\nGetVmId:\n Ordinal: 154\n Address: 0x0002BEF0\n\nGetWindowsServiceProperties:\n Ordinal: 155\n Address: 0x0001FD00\n\nLogToWindowsEventLog:\n Ordinal: 156\n Address: 0x00013B00\n\nSetAuthenticationKeyWrapper:\n Ordinal: 157\n Address: 0x0002BC00\n\nSetServerIpAddressWrapper:\n Ordinal: 158\n Address: 0x0002B940\n\nSetTransactionIdWrapper:\n Ordinal: 159\n Address: 0x0002B7E0\n\nSetVmIdWrapper:\n Ordinal: 160\n Address: 0x0002BAA0"},"Resources":{"raw":"1:\n Type: RT_MESSAGETABLE\n Language: English - United States\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27423\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 840\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.38421\n\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.0.0\n ProductVersion: 1.1.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Nutanix\n FileDescription: Nutanix Utility Library\n FileVersion (#2): 1.1.0.0\n InternalName: NutanixUtilityLibrary.dll\n LegalCopyright: Copyright © 2015 Nutanix. All rights reserved.\n OriginalFilename: NutanixUtilityLibrary.dll\n ProductName: Nutanix VSS Solution\n ProductVersion (#2): 1.1.0.0"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:46\n Version: 0.0\n SizeofData: 161\n AddressOfRawData: 0x00045FEC\n PointerToRawData: 0x00044FEC\n Referenced File: C:\\Users\\Administrator\\Documents\\NGT\\ngt_20241019_140230\\ngt\\vss\\windows\\source\\NutanixVSSSolution\\x64\\Release\\NutanixUtilityLibrary.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:46\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00046090\n PointerToRawData: 0x00045090\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:46\n Version: 0.0\n SizeofData: 732\n AddressOfRawData: 0x000460A4\n PointerToRawData: 0x000450A4\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2024-Oct-19 14:07:46\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000"},"Load Configuration":{"raw":"Size: 148\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180057008"},"RICH Header":{"raw":"XOR Key: 0xC41CE44F\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 14\n208 (65501): 1\nASM objects (VS2015 UPD3 build 24123): 3\nC objects (VS2015 UPD3 build 24123): 12\nImports (VS2015 UPD3 build 24123): 4\nC++ objects (VS2015 UPD3 build 24123): 28\nC objects (65501): 1\nImports (65501): 17\nTotal imports: 269\nC++ objects (LTCG) (VS2015 UPD3.1 build 24215): 10\nExports (VS2015 UPD3.1 build 24215): 1\nResource objects (VS2015 UPD3 build 24210): 1\n151: 1\nLinker (VS2015 UPD3.1 build 24215): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentControlSet\\Services\n Accesses the WMI:\n ROOT\\CIMV2\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Can access the registry:\n RegCloseKey\n RegDeleteKeyValueW\n RegCreateKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegQueryValueExW\n Possibly launches other programs:\n CreateProcessW\n Uses Microsoft's cryptographic API:\n CryptProtectData\n CryptUnprotectData\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Leverages the raw socket API to access the Internet:\n WSACleanup\n closesocket\n getaddrinfo\n WSAStartup\n send\n socket\n connect\n recv\n WSAGetLastError\n freeaddrinfo\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/NutanixUtilityLibrary-019ec65c5ac27a3283d8b6fdbf5472e9.dll"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_3ukg7bxs/output.txt"},"timestamp":"2026-06-14 19:50:43"} {"_id":{"$oid":"6a2ebb45ae36b72c92a1092e"},"sha256":"5d902bd00a37c03539790f378dd557bcaab3dc85fd8ac30f57ad6d9644509dc4","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/index-019ec65c7ba4747196439b12eb731026.dat\nDate: 2026-06-14 20:01:33\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/index-019ec65c7ba4747196439b12eb731026.dat!\nDetected file type(s):\n\t7-Zip compressed file\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/index-019ec65c7ba4747196439b12eb731026.dat"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_pzc8_go7/output.txt"},"timestamp":"2026-06-14 20:01:33"} {"_id":{"$oid":"6a2ebc5dae36b72c92a10933"},"sha256":"50ff90147ed994daa56f18819e1dc34002be0a6150f358af629583e8d2c314e3","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/goopdate-019ec65ca5f57df1a10859b7d2a3a9b6.dll\nDate: 2026-06-14 20:06:13\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/goopdate-019ec65ca5f57df1a10859b7d2a3a9b6.dll\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2020-Apr-21 07:19:04\nDetected languages: English - United States\nDebug artifacts: G:\\learn\\r3\\dllgoodate\\Release\\dllgoodate.pdb\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000110\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2020-Apr-21 07:19:04\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0000EA00\nSizeOfInitializedData: 0x00A09400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00002982 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00010000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00A1C000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000E82F\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000EA00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.60263\n\n.rdata:\n VirtualSize: 0x00006A14\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00006C00\n PointerToRawData: 0x0000EE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.96465\n\n.data:\n VirtualSize: 0x00A013F0\n VirtualAddress: 0x00017000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00015A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.34862\n\n.rsrc:\n VirtualSize: 0x000001B0\n VirtualAddress: 0x00A19000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00016400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.49768\n\n.reloc:\n VirtualSize: 0x00001154\n VirtualAddress: 0x00A1A000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00016600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.47633\n\n\nImports:\n--------\nSHLWAPI.dll: PathRemoveFileSpecA\nKERNEL32.dll: TlsFree\n WriteConsoleW\n GetModuleFileNameA\n SetCurrentDirectoryA\n GetLastError\n DisableThreadLibraryCalls\n GetSystemDirectoryA\n LoadLibraryA\n lstrcpyA\n GetProcAddress\n ExitProcess\n FreeLibrary\n HeapFree\n SetLastError\n VirtualFree\n VirtualAlloc\n GetNativeSystemInfo\n HeapAlloc\n GetProcessHeap\n IsBadReadPtr\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n TerminateProcess\n IsProcessorFeaturePresent\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n InitializeSListHead\n IsDebuggerPresent\n GetStartupInfoW\n GetModuleHandleW\n RtlUnwind\n RaiseException\n InterlockedFlushSList\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n DecodePointer\n LoadLibraryExW\n GetModuleHandleExW\n GetModuleFileNameW\n CloseHandle\n ReadFile\n GetConsoleMode\n ReadConsoleW\n MultiByteToWideChar\n HeapReAlloc\n WideCharToMultiByte\n FindClose\n FindFirstFileExW\n FindNextFileW\n IsValidCodePage\n GetACP\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetCommandLineW\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n LCMapStringW\n GetStdHandle\n GetFileType\n CreateFileW\n SetStdHandle\n FlushFileBuffers\n WriteFile\n GetConsoleCP\n SetFilePointerEx\n GetStringTypeW\n HeapSize\n SetEndOfFile\n\nExports:\n--------\nDllEntry:\n Ordinal: 1\n Address: 0x000015C0\n\nzip_close:\n Ordinal: 2\n Address: 0x000015E0\n\nzip_discard:\n Ordinal: 3\n Address: 0x00001600\n\nzip_error_code_system:\n Ordinal: 4\n Address: 0x00001620\n\nzip_error_code_zip:\n Ordinal: 5\n Address: 0x00001640\n\nzip_error_fini:\n Ordinal: 6\n Address: 0x00001660\n\nzip_error_init:\n Ordinal: 7\n Address: 0x00001680\n\nzip_error_init_with_code:\n Ordinal: 8\n Address: 0x000016A0\n\nzip_error_set:\n Ordinal: 9\n Address: 0x000016C0\n\nzip_error_system_type:\n Ordinal: 10\n Address: 0x000016E0\n\nzip_error_to_data:\n Ordinal: 11\n Address: 0x00001700\n\nzip_fclose:\n Ordinal: 12\n Address: 0x00001720\n\nzip_fopen_index:\n Ordinal: 13\n Address: 0x00001740\n\nzip_fopen_index_encrypted:\n Ordinal: 14\n Address: 0x00001760\n\nzip_fread:\n Ordinal: 15\n Address: 0x00001780\n\nzip_get_name:\n Ordinal: 16\n Address: 0x000017A0\n\nzip_get_num_entries:\n Ordinal: 17\n Address: 0x000017C0\n\nzip_open:\n Ordinal: 18\n Address: 0x000017E0\n\nzip_open_from_source:\n Ordinal: 19\n Address: 0x00001800\n\nzip_register_progress_callback:\n Ordinal: 20\n Address: 0x00001820\n\nzip_register_progress_callback_with_state:\n Ordinal: 21\n Address: 0x00001840\n\nzip_source_begin_write:\n Ordinal: 22\n Address: 0x00001860\n\nzip_source_buffer:\n Ordinal: 23\n Address: 0x00001880\n\nzip_source_buffer_create:\n Ordinal: 24\n Address: 0x000018A0\n\nzip_source_close:\n Ordinal: 25\n Address: 0x000018C0\n\nzip_source_commit_write:\n Ordinal: 26\n Address: 0x000018E0\n\nzip_source_error:\n Ordinal: 27\n Address: 0x00001900\n\nzip_source_file:\n Ordinal: 28\n Address: 0x00001920\n\nzip_source_file_create:\n Ordinal: 29\n Address: 0x00001940\n\nzip_source_free:\n Ordinal: 30\n Address: 0x00001960\n\nzip_source_function:\n Ordinal: 31\n Address: 0x00001980\n\nzip_source_function_create:\n Ordinal: 32\n Address: 0x000019A0\n\nzip_source_keep:\n Ordinal: 33\n Address: 0x000019C0\n\nzip_source_make_command_bitmap:\n Ordinal: 34\n Address: 0x000019E0\n\nzip_source_open:\n Ordinal: 35\n Address: 0x00001A00\n\nzip_source_read:\n Ordinal: 36\n Address: 0x00001A20\n\nzip_source_rollback_write:\n Ordinal: 37\n Address: 0x00001A40\n\nzip_source_seek:\n Ordinal: 38\n Address: 0x00001A60\n\nzip_source_seek_compute_offset:\n Ordinal: 39\n Address: 0x00001A80\n\nzip_source_seek_write:\n Ordinal: 40\n Address: 0x00001AA0\n\nzip_source_stat:\n Ordinal: 41\n Address: 0x00001AC0\n\nzip_source_tell:\n Ordinal: 42\n Address: 0x00001AE0\n\nzip_source_tell_write:\n Ordinal: 43\n Address: 0x00001B00\n\nzip_source_win32handle:\n Ordinal: 44\n Address: 0x00001B20\n\nzip_source_win32handle_create:\n Ordinal: 45\n Address: 0x00001B40\n\nzip_source_win32w:\n Ordinal: 46\n Address: 0x00001B60\n\nzip_source_win32w_create:\n Ordinal: 47\n Address: 0x00001B80\n\nzip_source_write:\n Ordinal: 48\n Address: 0x00001BA0\n\nzip_stat_index:\n Ordinal: 49\n Address: 0x00001BC0\n\nzip_stat_init:\n Ordinal: 50\n Address: 0x00001BE0\n\n\nResources:\n----------\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 334\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.06245\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2020-Apr-21 07:19:04\n Version: 0.0\n SizeofData: 70\n AddressOfRawData: 0x0001547C\n PointerToRawData: 0x0001427C\n Referenced File: G:\\learn\\r3\\dllgoodate\\Release\\dllgoodate.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2020-Apr-21 07:19:04\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x000154C4\n PointerToRawData: 0x000142C4\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2020-Apr-21 07:19:04\n Version: 0.0\n SizeofData: 648\n AddressOfRawData: 0x000154D8\n PointerToRawData: 0x000142D8\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2020-Apr-21 07:19:04\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n\n\nLoad Configuration:\n-------------------\nSize: 164\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x10017004\nSEHandlerTable: 0x10015470\nSEHandlerCount: 3\n\nRICH Header:\n------------\nXOR Key: 0x8C0E7383\nUnmarked objects: 0\nASM objects (VS2017 v14.15 compiler 26715): 10\nC++ objects (VS2017 v14.15 compiler 26715): 150\nC objects (VS2017 v14.15 compiler 26715): 18\nC objects (VS 2015/2017/2019 runtime 28117): 15\nASM objects (VS 2015/2017/2019 runtime 28117): 17\nImports (VS2017 v14.15 compiler 26715): 5\nTotal imports: 94\nC++ objects (VS 2015/2017/2019 runtime 28117): 32\nC++ objects (LTCG) (VS2019 Update 4 (16.4.6) compiler 28319): 2\nExports (VS2019 Update 4 (16.4.6) compiler 28319): 1\nResource objects (VS2019 Update 4 (16.4.6) compiler 28319): 1\nLinker (VS2019 Update 4 (16.4.6) compiler 28319): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2020-Apr-21 07:19:04\nDetected languages: English - United States\nDebug artifacts: G:\\learn\\r3\\dllgoodate\\Release\\dllgoodate.pdb"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000110"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2020-Apr-21 07:19:04\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0000EA00\nSizeOfInitializedData: 0x00A09400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00002982 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00010000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00A1C000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000E82F\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000EA00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.60263\n\n.rdata:\n VirtualSize: 0x00006A14\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00006C00\n PointerToRawData: 0x0000EE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.96465\n\n.data:\n VirtualSize: 0x00A013F0\n VirtualAddress: 0x00017000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00015A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.34862\n\n.rsrc:\n VirtualSize: 0x000001B0\n VirtualAddress: 0x00A19000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00016400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.49768\n\n.reloc:\n VirtualSize: 0x00001154\n VirtualAddress: 0x00A1A000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00016600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.47633"},"Imports":{"raw":"SHLWAPI.dll: PathRemoveFileSpecA\nKERNEL32.dll: TlsFree\n WriteConsoleW\n GetModuleFileNameA\n SetCurrentDirectoryA\n GetLastError\n DisableThreadLibraryCalls\n GetSystemDirectoryA\n LoadLibraryA\n lstrcpyA\n GetProcAddress\n ExitProcess\n FreeLibrary\n HeapFree\n SetLastError\n VirtualFree\n VirtualAlloc\n GetNativeSystemInfo\n HeapAlloc\n GetProcessHeap\n IsBadReadPtr\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n TerminateProcess\n IsProcessorFeaturePresent\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n InitializeSListHead\n IsDebuggerPresent\n GetStartupInfoW\n GetModuleHandleW\n RtlUnwind\n RaiseException\n InterlockedFlushSList\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n DecodePointer\n LoadLibraryExW\n GetModuleHandleExW\n GetModuleFileNameW\n CloseHandle\n ReadFile\n GetConsoleMode\n ReadConsoleW\n MultiByteToWideChar\n HeapReAlloc\n WideCharToMultiByte\n FindClose\n FindFirstFileExW\n FindNextFileW\n IsValidCodePage\n GetACP\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetCommandLineW\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n LCMapStringW\n GetStdHandle\n GetFileType\n CreateFileW\n SetStdHandle\n FlushFileBuffers\n WriteFile\n GetConsoleCP\n SetFilePointerEx\n GetStringTypeW\n HeapSize\n SetEndOfFile"},"Exports":{"raw":"DllEntry:\n Ordinal: 1\n Address: 0x000015C0\n\nzip_close:\n Ordinal: 2\n Address: 0x000015E0\n\nzip_discard:\n Ordinal: 3\n Address: 0x00001600\n\nzip_error_code_system:\n Ordinal: 4\n Address: 0x00001620\n\nzip_error_code_zip:\n Ordinal: 5\n Address: 0x00001640\n\nzip_error_fini:\n Ordinal: 6\n Address: 0x00001660\n\nzip_error_init:\n Ordinal: 7\n Address: 0x00001680\n\nzip_error_init_with_code:\n Ordinal: 8\n Address: 0x000016A0\n\nzip_error_set:\n Ordinal: 9\n Address: 0x000016C0\n\nzip_error_system_type:\n Ordinal: 10\n Address: 0x000016E0\n\nzip_error_to_data:\n Ordinal: 11\n Address: 0x00001700\n\nzip_fclose:\n Ordinal: 12\n Address: 0x00001720\n\nzip_fopen_index:\n Ordinal: 13\n Address: 0x00001740\n\nzip_fopen_index_encrypted:\n Ordinal: 14\n Address: 0x00001760\n\nzip_fread:\n Ordinal: 15\n Address: 0x00001780\n\nzip_get_name:\n Ordinal: 16\n Address: 0x000017A0\n\nzip_get_num_entries:\n Ordinal: 17\n Address: 0x000017C0\n\nzip_open:\n Ordinal: 18\n Address: 0x000017E0\n\nzip_open_from_source:\n Ordinal: 19\n Address: 0x00001800\n\nzip_register_progress_callback:\n Ordinal: 20\n Address: 0x00001820\n\nzip_register_progress_callback_with_state:\n Ordinal: 21\n Address: 0x00001840\n\nzip_source_begin_write:\n Ordinal: 22\n Address: 0x00001860\n\nzip_source_buffer:\n Ordinal: 23\n Address: 0x00001880\n\nzip_source_buffer_create:\n Ordinal: 24\n Address: 0x000018A0\n\nzip_source_close:\n Ordinal: 25\n Address: 0x000018C0\n\nzip_source_commit_write:\n Ordinal: 26\n Address: 0x000018E0\n\nzip_source_error:\n Ordinal: 27\n Address: 0x00001900\n\nzip_source_file:\n Ordinal: 28\n Address: 0x00001920\n\nzip_source_file_create:\n Ordinal: 29\n Address: 0x00001940\n\nzip_source_free:\n Ordinal: 30\n Address: 0x00001960\n\nzip_source_function:\n Ordinal: 31\n Address: 0x00001980\n\nzip_source_function_create:\n Ordinal: 32\n Address: 0x000019A0\n\nzip_source_keep:\n Ordinal: 33\n Address: 0x000019C0\n\nzip_source_make_command_bitmap:\n Ordinal: 34\n Address: 0x000019E0\n\nzip_source_open:\n Ordinal: 35\n Address: 0x00001A00\n\nzip_source_read:\n Ordinal: 36\n Address: 0x00001A20\n\nzip_source_rollback_write:\n Ordinal: 37\n Address: 0x00001A40\n\nzip_source_seek:\n Ordinal: 38\n Address: 0x00001A60\n\nzip_source_seek_compute_offset:\n Ordinal: 39\n Address: 0x00001A80\n\nzip_source_seek_write:\n Ordinal: 40\n Address: 0x00001AA0\n\nzip_source_stat:\n Ordinal: 41\n Address: 0x00001AC0\n\nzip_source_tell:\n Ordinal: 42\n Address: 0x00001AE0\n\nzip_source_tell_write:\n Ordinal: 43\n Address: 0x00001B00\n\nzip_source_win32handle:\n Ordinal: 44\n Address: 0x00001B20\n\nzip_source_win32handle_create:\n Ordinal: 45\n Address: 0x00001B40\n\nzip_source_win32w:\n Ordinal: 46\n Address: 0x00001B60\n\nzip_source_win32w_create:\n Ordinal: 47\n Address: 0x00001B80\n\nzip_source_write:\n Ordinal: 48\n Address: 0x00001BA0\n\nzip_stat_index:\n Ordinal: 49\n Address: 0x00001BC0\n\nzip_stat_init:\n Ordinal: 50\n Address: 0x00001BE0"},"Resources":{"raw":"2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 334\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.06245"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2020-Apr-21 07:19:04\n Version: 0.0\n SizeofData: 70\n AddressOfRawData: 0x0001547C\n PointerToRawData: 0x0001427C\n Referenced File: G:\\learn\\r3\\dllgoodate\\Release\\dllgoodate.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2020-Apr-21 07:19:04\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x000154C4\n PointerToRawData: 0x000142C4\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2020-Apr-21 07:19:04\n Version: 0.0\n SizeofData: 648\n AddressOfRawData: 0x000154D8\n PointerToRawData: 0x000142D8\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2020-Apr-21 07:19:04\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000"},"Load Configuration":{"raw":"Size: 164\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x10017004\nSEHandlerTable: 0x10015470\nSEHandlerCount: 3"},"RICH Header":{"raw":"XOR Key: 0x8C0E7383\nUnmarked objects: 0\nASM objects (VS2017 v14.15 compiler 26715): 10\nC++ objects (VS2017 v14.15 compiler 26715): 150\nC objects (VS2017 v14.15 compiler 26715): 18\nC objects (VS 2015/2017/2019 runtime 28117): 15\nASM objects (VS 2015/2017/2019 runtime 28117): 17\nImports (VS2017 v14.15 compiler 26715): 5\nTotal imports: 94\nC++ objects (VS 2015/2017/2019 runtime 28117): 32\nC++ objects (LTCG) (VS2019 Update 4 (16.4.6) compiler 28319): 2\nExports (VS2019 Update 4 (16.4.6) compiler 28319): 1\nResource objects (VS2019 Update 4 (16.4.6) compiler 28319): 1\nLinker (VS2019 Update 4 (16.4.6) compiler 28319): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/goopdate-019ec65ca5f57df1a10859b7d2a3a9b6.dll"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_x4ma_hi1/output.txt"},"timestamp":"2026-06-14 20:06:13"} {"_id":{"$oid":"6a2ebcf9ae36b72c92a10936"},"sha256":"81b29996dc471e6437e81cd02f6b22c189b35c2ab075a009dec089c34e5117de","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/d3d33185120718-019ec65cc3db7b1294e614afab69b104.sam\nDate: 2026-06-14 20:08:49\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/d3d33185120718-019ec65cc3db7b1294e614afab69b104.sam!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/d3d33185120718-019ec65cc3db7b1294e614afab69b104.sam"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_kzevk1vo/output.txt"},"timestamp":"2026-06-14 20:08:49"} {"_id":{"$oid":"6a2ebd39ae36b72c92a1093a"},"sha256":"30752d23aa8c73b8249316ac4dadf35296e9261959e6d993f15ce43b49914a4b","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/amcompat-019ec65cf3087ff2937b36f4a09570b2.tlb\nDate: 2026-06-14 20:09:53\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/amcompat-019ec65cf3087ff2937b36f4a09570b2.tlb!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/amcompat-019ec65cf3087ff2937b36f4a09570b2.tlb"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_j5n5ok8j/output.txt"},"timestamp":"2026-06-14 20:09:53"} {"_id":{"$oid":"6a2efe0dae36b72c92a1093d"},"sha256":"03cb208292e6522bf69771f4bf634a8da9f789710cddd792a53b30797ee9d689","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/amcompat.tlb.bin-019ec78c4dbd72f0bd534efa6358048f.decrypted\nDate: 2026-06-15 00:46:29\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/amcompat.tlb.bin-019ec78c4dbd72f0bd534efa6358048f.decrypted\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2020-Jan-07 06:53:38\nDetected languages: Chinese - PRC\n English - United States\nCompanyName: Microsoft Corporation. All rights reserved\nFileDescription: Host Precess for Windows Services \nFileVersion: 6, 1, 7600, 16385\nInternalName: svchost\nLegalCopyright: Microsoft Corporation\nProductName: Microsoft Windows Operating System\nProductVersion: 6, 1, 7600, 16385\nSpecialBuild: 61760016385\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2020-Jan-07 06:53:38\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x0000B600\nSizeOfInitializedData: 0x0000A000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000030BB (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00018000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000B55B\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000B600\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.69841\n\n.rdata:\n VirtualSize: 0x00003DBA\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00003E00\n PointerToRawData: 0x0000BA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.27347\n\n.data:\n VirtualSize: 0x00003F18\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00001A00\n PointerToRawData: 0x0000F800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.8181\n\n.rsrc:\n VirtualSize: 0x00000618\n VirtualAddress: 0x00015000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00011200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.36331\n\n.reloc:\n VirtualSize: 0x0000191C\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x00001A00\n PointerToRawData: 0x00011A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.27273\n\n\nImports:\n--------\nKERNEL32.dll: GetEnvironmentVariableA\n CreateFileA\n FindClose\n FindFirstFileA\n GetFileSize\n ReadFile\n SetEndOfFile\n SetFilePointer\n WriteFile\n GetCurrentProcess\n ExitProcess\n GetCurrentThread\n SetThreadPriority\n ResumeThread\n CreateProcessA\n SetPriorityClass\n OpenProcess\n GetLocalTime\n GetWindowsDirectoryA\n FreeLibrary\n GetModuleFileNameA\n GetProcAddress\n GlobalSize\n GlobalLock\n GlobalUnlock\n GetShortPathNameA\n lstrcmpiA\n lstrcpyA\n lstrcatA\n lstrlenA\n GetLogicalDriveStringsA\n LoadLibraryA\n QueryDosDeviceA\n CreateFileW\n FlushFileBuffers\n HeapSize\n HeapReAlloc\n WriteConsoleW\n SetStdHandle\n RtlUnwind\n LoadLibraryW\n OutputDebugStringW\n LoadLibraryExW\n LCMapStringEx\n GetStringTypeW\n Sleep\n SetFilePointerEx\n GetConsoleMode\n GetConsoleCP\n LeaveCriticalSection\n GetSystemTimeAsFileTime\n GetLastError\n HeapFree\n HeapAlloc\n GetCommandLineA\n IsDebuggerPresent\n EncodePointer\n DecodePointer\n IsProcessorFeaturePresent\n RaiseException\n InterlockedIncrement\n InterlockedDecrement\n IsValidCodePage\n GetACP\n GetOEMCP\n GetCPInfo\n SetLastError\n GetCurrentThreadId\n MultiByteToWideChar\n GetProcessHeap\n GetModuleHandleExW\n GetStdHandle\n GetModuleFileNameW\n GetFileType\n InitializeCriticalSectionAndSpinCount\n DeleteCriticalSection\n InitOnceExecuteOnce\n GetStartupInfoW\n QueryPerformanceCounter\n GetTickCount64\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n WideCharToMultiByte\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n FlsAlloc\n FlsGetValue\n FlsSetValue\n FlsFree\n TerminateProcess\n GetModuleHandleW\n EnterCriticalSection\n CloseHandle\nUSER32.dll: LoadIconA\n LoadCursorA\n GetWindow\n GetWindowThreadProcessId\n GetClassNameA\n GetWindowTextA\n GetForegroundWindow\n UpdateWindow\n GetKeyState\n CharUpperA\n IsClipboardFormatAvailable\n CloseClipboard\n OpenClipboard\n ShowWindow\n CreateWindowExA\n RegisterClassA\n PostQuitMessage\n DefWindowProcA\n PeekMessageA\n DispatchMessageA\n TranslateMessage\n GetMessageA\n wsprintfA\n GetClipboardData\nPSAPI.DLL: GetProcessImageFileNameA\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 1016\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4494\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\n-------------\nResource LangID: Chinese - PRC\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.1.7600.16385\n ProductVersion: 6.1.7600.16385\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Microsoft Corporation. All rights reserved\n FileDescription: Host Precess for Windows Services \n FileVersion (#2): 6, 1, 7600, 16385\n InternalName: svchost\n LegalCopyright: Microsoft Corporation\n ProductName: Microsoft Windows Operating System\n ProductVersion (#2): 6, 1, 7600, 16385\n SpecialBuild: 61760016385\n\n\nLoad Configuration:\n-------------------\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004118A0\nSEHandlerTable: 0x0040FFB0\nSEHandlerCount: 3\n\nRICH Header:\n------------\nXOR Key: 0x2C0E3FCE\nUnmarked objects: 0\nC++ objects (50628): 38\nASM objects (50628): 17\nC objects (50628): 107\nTotal imports: 130\n185 (30716): 7\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 4\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\n151: 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryW\n LoadLibraryExW\n Possibly launches other programs:\n CreateProcessA\n Enumerates local disk drives:\n GetLogicalDriveStringsA\n Manipulates other processes:\n OpenProcess\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: Query to VirusTotal failed (resolve: Host not found (authoritative) [asio.netdb:1 at /usr/include/boost/asio/detail/resolver_service.hpp:84 in function 'resolve']).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2020-Jan-07 06:53:38\nDetected languages: Chinese - PRC\n English - United States\nCompanyName: Microsoft Corporation. All rights reserved\nFileDescription: Host Precess for Windows Services \nFileVersion: 6, 1, 7600, 16385\nInternalName: svchost\nLegalCopyright: Microsoft Corporation\nProductName: Microsoft Windows Operating System\nProductVersion: 6, 1, 7600, 16385\nSpecialBuild: 61760016385"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2020-Jan-07 06:53:38\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x0000B600\nSizeOfInitializedData: 0x0000A000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000030BB (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00018000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000B55B\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000B600\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.69841\n\n.rdata:\n VirtualSize: 0x00003DBA\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00003E00\n PointerToRawData: 0x0000BA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.27347\n\n.data:\n VirtualSize: 0x00003F18\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00001A00\n PointerToRawData: 0x0000F800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.8181\n\n.rsrc:\n VirtualSize: 0x00000618\n VirtualAddress: 0x00015000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00011200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.36331\n\n.reloc:\n VirtualSize: 0x0000191C\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x00001A00\n PointerToRawData: 0x00011A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.27273"},"Imports":{"raw":"KERNEL32.dll: GetEnvironmentVariableA\n CreateFileA\n FindClose\n FindFirstFileA\n GetFileSize\n ReadFile\n SetEndOfFile\n SetFilePointer\n WriteFile\n GetCurrentProcess\n ExitProcess\n GetCurrentThread\n SetThreadPriority\n ResumeThread\n CreateProcessA\n SetPriorityClass\n OpenProcess\n GetLocalTime\n GetWindowsDirectoryA\n FreeLibrary\n GetModuleFileNameA\n GetProcAddress\n GlobalSize\n GlobalLock\n GlobalUnlock\n GetShortPathNameA\n lstrcmpiA\n lstrcpyA\n lstrcatA\n lstrlenA\n GetLogicalDriveStringsA\n LoadLibraryA\n QueryDosDeviceA\n CreateFileW\n FlushFileBuffers\n HeapSize\n HeapReAlloc\n WriteConsoleW\n SetStdHandle\n RtlUnwind\n LoadLibraryW\n OutputDebugStringW\n LoadLibraryExW\n LCMapStringEx\n GetStringTypeW\n Sleep\n SetFilePointerEx\n GetConsoleMode\n GetConsoleCP\n LeaveCriticalSection\n GetSystemTimeAsFileTime\n GetLastError\n HeapFree\n HeapAlloc\n GetCommandLineA\n IsDebuggerPresent\n EncodePointer\n DecodePointer\n IsProcessorFeaturePresent\n RaiseException\n InterlockedIncrement\n InterlockedDecrement\n IsValidCodePage\n GetACP\n GetOEMCP\n GetCPInfo\n SetLastError\n GetCurrentThreadId\n MultiByteToWideChar\n GetProcessHeap\n GetModuleHandleExW\n GetStdHandle\n GetModuleFileNameW\n GetFileType\n InitializeCriticalSectionAndSpinCount\n DeleteCriticalSection\n InitOnceExecuteOnce\n GetStartupInfoW\n QueryPerformanceCounter\n GetTickCount64\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n WideCharToMultiByte\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n FlsAlloc\n FlsGetValue\n FlsSetValue\n FlsFree\n TerminateProcess\n GetModuleHandleW\n EnterCriticalSection\n CloseHandle\nUSER32.dll: LoadIconA\n LoadCursorA\n GetWindow\n GetWindowThreadProcessId\n GetClassNameA\n GetWindowTextA\n GetForegroundWindow\n UpdateWindow\n GetKeyState\n CharUpperA\n IsClipboardFormatAvailable\n CloseClipboard\n OpenClipboard\n ShowWindow\n CreateWindowExA\n RegisterClassA\n PostQuitMessage\n DefWindowProcA\n PeekMessageA\n DispatchMessageA\n TranslateMessage\n GetMessageA\n wsprintfA\n GetClipboardData\nPSAPI.DLL: GetProcessImageFileNameA\n\nResources:\n1:\n Type: RT_VERSION\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 1016\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4494\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\nResource LangID: Chinese - PRC\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.1.7600.16385\n ProductVersion: 6.1.7600.16385\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Microsoft Corporation. All rights reserved\n FileDescription: Host Precess for Windows Services \n FileVersion (#2): 6, 1, 7600, 16385\n InternalName: svchost\n LegalCopyright: Microsoft Corporation\n ProductName: Microsoft Windows Operating System\n ProductVersion (#2): 6, 1, 7600, 16385\n SpecialBuild: 61760016385\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004118A0\nSEHandlerTable: 0x0040FFB0\nSEHandlerCount: 3\n\nRICH Header:\nXOR Key: 0x2C0E3FCE\nUnmarked objects: 0\nC++ objects (50628): 38\nASM objects (50628): 17\nC objects (50628): 107\nTotal imports: 130\n185 (30716): 7\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 4\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\n151: 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryW\n LoadLibraryExW\n Possibly launches other programs:\n CreateProcessA\n Enumerates local disk drives:\n GetLogicalDriveStringsA\n Manipulates other processes:\n OpenProcess\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: Query to VirusTotal failed (resolve: Host not found (authoritative) [asio.netdb:1 at /usr/include/boost/asio/detail/resolver_service.hpp:84 in function 'resolve']).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 1016\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4494\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\nResource LangID: Chinese - PRC\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.1.7600.16385\n ProductVersion: 6.1.7600.16385\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Microsoft Corporation. All rights reserved\n FileDescription: Host Precess for Windows Services \n FileVersion (#2): 6, 1, 7600, 16385\n InternalName: svchost\n LegalCopyright: Microsoft Corporation\n ProductName: Microsoft Windows Operating System\n ProductVersion (#2): 6, 1, 7600, 16385\n SpecialBuild: 61760016385\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004118A0\nSEHandlerTable: 0x0040FFB0\nSEHandlerCount: 3\n\nRICH Header:\nXOR Key: 0x2C0E3FCE\nUnmarked objects: 0\nC++ objects (50628): 38\nASM objects (50628): 17\nC objects (50628): 107\nTotal imports: 130\n185 (30716): 7\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 4\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\n151: 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryW\n LoadLibraryExW\n Possibly launches other programs:\n CreateProcessA\n Enumerates local disk drives:\n GetLogicalDriveStringsA\n Manipulates other processes:\n OpenProcess\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: Query to VirusTotal failed (resolve: Host not found (authoritative) [asio.netdb:1 at /usr/include/boost/asio/detail/resolver_service.hpp:84 in function 'resolve']).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{"raw":"Size: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004118A0\nSEHandlerTable: 0x0040FFB0\nSEHandlerCount: 3"},"RICH Header":{"raw":"XOR Key: 0x2C0E3FCE\nUnmarked objects: 0\nC++ objects (50628): 38\nASM objects (50628): 17\nC objects (50628): 107\nTotal imports: 130\n185 (30716): 7\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 4\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\n151: 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryW\n LoadLibraryExW\n Possibly launches other programs:\n CreateProcessA\n Enumerates local disk drives:\n GetLogicalDriveStringsA\n Manipulates other processes:\n OpenProcess\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: Query to VirusTotal failed (resolve: Host not found (authoritative) [asio.netdb:1 at /usr/include/boost/asio/detail/resolver_service.hpp:84 in function 'resolve']).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/amcompat.tlb.bin-019ec78c4dbd72f0bd534efa6358048f.decrypted"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_dahabyeh/output.txt"},"timestamp":"2026-06-15 00:46:29"} {"_id":{"$oid":"6a3d3b4d6c8e273a010a1923"},"sha256":"e63ac91d2bc21f0dd05f546f92112162ce8200cf97b59f6c46f608d1a6365502","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/jli-019eff2b84057d02a4e5c7dd15948c9b.dll\nDate: 2026-07-02 22:51:43\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/jli-019eff2b84057d02a4e5c7dd15948c9b.dll\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2026-Jun-10 05:45:15\nTLS Callbacks: 2 callback(s) detected.\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 11\nTimeDateStamp: 2026-Jun-10 05:45:15\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 2.0\nSizeOfCode: 0x00003C00\nSizeOfInitializedData: 0x000C3C00\nSizeOfUninitializedData: 0x00000A00\nAddressOfEntryPoint: 0x00000000000013E0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000063EC0000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x000CF000\nSizeOfHeaders: 0x00000400\nChecksum: 0x000D0ACD\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000200000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00003B90\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00003C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.01942\n\n.data:\n VirtualSize: 0x0001FFC0\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00020000\n PointerToRawData: 0x00004000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.87713\n\n.rdata:\n VirtualSize: 0x00099D60\n VirtualAddress: 0x00025000\n SizeOfRawData: 0x00099E00\n PointerToRawData: 0x00024000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.13878\n\n.pdata:\n VirtualSize: 0x0000039C\n VirtualAddress: 0x000BF000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x000BDE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.96\n\n.xdata:\n VirtualSize: 0x0000032C\n VirtualAddress: 0x000C0000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x000BE200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.67005\n\n.bss:\n VirtualSize: 0x00000990\n VirtualAddress: 0x000C1000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.edata:\n VirtualSize: 0x000003C4\n VirtualAddress: 0x000C2000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x000BE600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.10094\n\n.idata:\n VirtualSize: 0x00000A7C\n VirtualAddress: 0x000C3000\n SizeOfRawData: 0x00000C00\n PointerToRawData: 0x000BEA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.06317\n\n.CRT:\n VirtualSize: 0x00000058\n VirtualAddress: 0x000C4000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000BF600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.201539\n\n.tls:\n VirtualSize: 0x00000068\n VirtualAddress: 0x000C5000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000BF800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.270157\n\n.reloc:\n VirtualSize: 0x000080D0\n VirtualAddress: 0x000C6000\n SizeOfRawData: 0x00008200\n PointerToRawData: 0x000BFA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.42837\n\n\nImports:\n--------\nADVAPI32.dll: RegCloseKey\n RegOpenKeyExA\nKERNEL32.dll: CloseHandle\n CreateFileA\n CreateFileMappingA\n DeleteCriticalSection\n DeleteFileA\n EnterCriticalSection\n GetACP\n GetCommandLineA\n GetCurrentProcess\n GetCurrentProcessId\n GetCurrentThreadId\n GetFileSize\n GetLastError\n GetModuleHandleA\n GetProcAddress\n GetProcessHeap\n GetSystemDirectoryA\n GetSystemTimeAsFileTime\n GetTempFileNameA\n GetTempPathA\n GetTickCount\n InitializeCriticalSection\n LeaveCriticalSection\n LoadLibraryA\n MapViewOfFile\n QueryPerformanceCounter\n RtlAddFunctionTable\n RtlCaptureContext\n RtlLookupFunctionEntry\n RtlVirtualUnwind\n SetUnhandledExceptionFilter\n Sleep\n TerminateProcess\n TlsGetValue\n UnhandledExceptionFilter\n UnmapViewOfFile\n VirtualProtect\n VirtualQuery\nmsvcrt.dll: __dllonexit\n __iob_func\n __setusermatherr\n _amsg_exit\n _errno\n _initterm\n _lock\n _onexit\n _unlock\n abort\n calloc\n fprintf\n free\n fwrite\n malloc\n memcpy\n memset\n printf\n rand\n signal\n strcmp\n strlen\n strncmp\n tan\n vfprintf\nSHELL32.dll: SHGetFolderPathA\nUSER32.dll: GetSystemMetrics\n\nExports:\n--------\nJLI_AddArgsFromEnvVar:\n Ordinal: 1\n Address: 0x00004230\n\nJLI_CmdToArgs:\n Ordinal: 2\n Address: 0x00004240\n\nJLI_GetAppArgIndex:\n Ordinal: 3\n Address: 0x000042D0\n\nJLI_GetStdArgc:\n Ordinal: 4\n Address: 0x000042E0\n\nJLI_GetStdArgs:\n Ordinal: 5\n Address: 0x000042F0\n\nJLI_InitArgProcessing:\n Ordinal: 6\n Address: 0x00004300\n\nJLI_Launch:\n Ordinal: 7\n Address: 0x00004B30\n\nJLI_List_add:\n Ordinal: 8\n Address: 0x00004B40\n\nJLI_List_new:\n Ordinal: 9\n Address: 0x00004B50\n\nJLI_ManifestIterate:\n Ordinal: 10\n Address: 0x00004B60\n\nJLI_MemAlloc:\n Ordinal: 11\n Address: 0x00004250\n\nJLI_MemFree:\n Ordinal: 12\n Address: 0x00004260\n\nJLI_PreprocessArg:\n Ordinal: 13\n Address: 0x00004270\n\nJLI_ReportErrorMessage:\n Ordinal: 14\n Address: 0x00004280\n\nJLI_ReportExceptionDescription:\n Ordinal: 15\n Address: 0x00004290\n\nJLI_ReportMessage:\n Ordinal: 16\n Address: 0x000042A0\n\nJLI_SetTraceLauncher:\n Ordinal: 17\n Address: 0x000042B0\n\nJLI_StringDup:\n Ordinal: 18\n Address: 0x000042C0\n\nproxy_func_0:\n Ordinal: 19\n Address: 0x00004230\n\nproxy_func_1:\n Ordinal: 20\n Address: 0x00004240\n\nproxy_func_10:\n Ordinal: 21\n Address: 0x00004250\n\nproxy_func_11:\n Ordinal: 22\n Address: 0x00004260\n\nproxy_func_12:\n Ordinal: 23\n Address: 0x00004270\n\nproxy_func_13:\n Ordinal: 24\n Address: 0x00004280\n\nproxy_func_14:\n Ordinal: 25\n Address: 0x00004290\n\nproxy_func_15:\n Ordinal: 26\n Address: 0x000042A0\n\nproxy_func_16:\n Ordinal: 27\n Address: 0x000042B0\n\nproxy_func_17:\n Ordinal: 28\n Address: 0x000042C0\n\nproxy_func_2:\n Ordinal: 29\n Address: 0x000042D0\n\nproxy_func_3:\n Ordinal: 30\n Address: 0x000042E0\n\nproxy_func_4:\n Ordinal: 31\n Address: 0x000042F0\n\nproxy_func_5:\n Ordinal: 32\n Address: 0x00004300\n\nproxy_func_6:\n Ordinal: 33\n Address: 0x00004B30\n\nproxy_func_7:\n Ordinal: 34\n Address: 0x00004B40\n\nproxy_func_8:\n Ordinal: 35\n Address: 0x00004B50\n\nproxy_func_9:\n Ordinal: 36\n Address: 0x00004B60\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x0000000063F85000\nEndAddressOfRawData: 0x0000000063F85060\nAddressOfIndex: 0x0000000063F818CC\nAddressOfCallbacks: 0x0000000063F84030\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x0000000063EC2080\n 0x0000000063EC2050\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .xdata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Can access the registry:\n RegCloseKey\n RegOpenKeyExA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2026-Jun-10 05:45:15\nTLS Callbacks: 2 callback(s) detected."},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 11\nTimeDateStamp: 2026-Jun-10 05:45:15\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 2.0\nSizeOfCode: 0x00003C00\nSizeOfInitializedData: 0x000C3C00\nSizeOfUninitializedData: 0x00000A00\nAddressOfEntryPoint: 0x00000000000013E0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000063EC0000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x000CF000\nSizeOfHeaders: 0x00000400\nChecksum: 0x000D0ACD\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000200000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00003B90\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00003C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.01942\n\n.data:\n VirtualSize: 0x0001FFC0\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00020000\n PointerToRawData: 0x00004000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.87713\n\n.rdata:\n VirtualSize: 0x00099D60\n VirtualAddress: 0x00025000\n SizeOfRawData: 0x00099E00\n PointerToRawData: 0x00024000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.13878\n\n.pdata:\n VirtualSize: 0x0000039C\n VirtualAddress: 0x000BF000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x000BDE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.96\n\n.xdata:\n VirtualSize: 0x0000032C\n VirtualAddress: 0x000C0000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x000BE200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.67005\n\n.bss:\n VirtualSize: 0x00000990\n VirtualAddress: 0x000C1000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.edata:\n VirtualSize: 0x000003C4\n VirtualAddress: 0x000C2000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x000BE600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.10094\n\n.idata:\n VirtualSize: 0x00000A7C\n VirtualAddress: 0x000C3000\n SizeOfRawData: 0x00000C00\n PointerToRawData: 0x000BEA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.06317\n\n.CRT:\n VirtualSize: 0x00000058\n VirtualAddress: 0x000C4000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000BF600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.201539\n\n.tls:\n VirtualSize: 0x00000068\n VirtualAddress: 0x000C5000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000BF800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.270157\n\n.reloc:\n VirtualSize: 0x000080D0\n VirtualAddress: 0x000C6000\n SizeOfRawData: 0x00008200\n PointerToRawData: 0x000BFA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.42837"},"Imports":{"raw":"ADVAPI32.dll: RegCloseKey\n RegOpenKeyExA\nKERNEL32.dll: CloseHandle\n CreateFileA\n CreateFileMappingA\n DeleteCriticalSection\n DeleteFileA\n EnterCriticalSection\n GetACP\n GetCommandLineA\n GetCurrentProcess\n GetCurrentProcessId\n GetCurrentThreadId\n GetFileSize\n GetLastError\n GetModuleHandleA\n GetProcAddress\n GetProcessHeap\n GetSystemDirectoryA\n GetSystemTimeAsFileTime\n GetTempFileNameA\n GetTempPathA\n GetTickCount\n InitializeCriticalSection\n LeaveCriticalSection\n LoadLibraryA\n MapViewOfFile\n QueryPerformanceCounter\n RtlAddFunctionTable\n RtlCaptureContext\n RtlLookupFunctionEntry\n RtlVirtualUnwind\n SetUnhandledExceptionFilter\n Sleep\n TerminateProcess\n TlsGetValue\n UnhandledExceptionFilter\n UnmapViewOfFile\n VirtualProtect\n VirtualQuery\nmsvcrt.dll: __dllonexit\n __iob_func\n __setusermatherr\n _amsg_exit\n _errno\n _initterm\n _lock\n _onexit\n _unlock\n abort\n calloc\n fprintf\n free\n fwrite\n malloc\n memcpy\n memset\n printf\n rand\n signal\n strcmp\n strlen\n strncmp\n tan\n vfprintf\nSHELL32.dll: SHGetFolderPathA\nUSER32.dll: GetSystemMetrics"},"Exports":{"raw":"JLI_AddArgsFromEnvVar:\n Ordinal: 1\n Address: 0x00004230\n\nJLI_CmdToArgs:\n Ordinal: 2\n Address: 0x00004240\n\nJLI_GetAppArgIndex:\n Ordinal: 3\n Address: 0x000042D0\n\nJLI_GetStdArgc:\n Ordinal: 4\n Address: 0x000042E0\n\nJLI_GetStdArgs:\n Ordinal: 5\n Address: 0x000042F0\n\nJLI_InitArgProcessing:\n Ordinal: 6\n Address: 0x00004300\n\nJLI_Launch:\n Ordinal: 7\n Address: 0x00004B30\n\nJLI_List_add:\n Ordinal: 8\n Address: 0x00004B40\n\nJLI_List_new:\n Ordinal: 9\n Address: 0x00004B50\n\nJLI_ManifestIterate:\n Ordinal: 10\n Address: 0x00004B60\n\nJLI_MemAlloc:\n Ordinal: 11\n Address: 0x00004250\n\nJLI_MemFree:\n Ordinal: 12\n Address: 0x00004260\n\nJLI_PreprocessArg:\n Ordinal: 13\n Address: 0x00004270\n\nJLI_ReportErrorMessage:\n Ordinal: 14\n Address: 0x00004280\n\nJLI_ReportExceptionDescription:\n Ordinal: 15\n Address: 0x00004290\n\nJLI_ReportMessage:\n Ordinal: 16\n Address: 0x000042A0\n\nJLI_SetTraceLauncher:\n Ordinal: 17\n Address: 0x000042B0\n\nJLI_StringDup:\n Ordinal: 18\n Address: 0x000042C0\n\nproxy_func_0:\n Ordinal: 19\n Address: 0x00004230\n\nproxy_func_1:\n Ordinal: 20\n Address: 0x00004240\n\nproxy_func_10:\n Ordinal: 21\n Address: 0x00004250\n\nproxy_func_11:\n Ordinal: 22\n Address: 0x00004260\n\nproxy_func_12:\n Ordinal: 23\n Address: 0x00004270\n\nproxy_func_13:\n Ordinal: 24\n Address: 0x00004280\n\nproxy_func_14:\n Ordinal: 25\n Address: 0x00004290\n\nproxy_func_15:\n Ordinal: 26\n Address: 0x000042A0\n\nproxy_func_16:\n Ordinal: 27\n Address: 0x000042B0\n\nproxy_func_17:\n Ordinal: 28\n Address: 0x000042C0\n\nproxy_func_2:\n Ordinal: 29\n Address: 0x000042D0\n\nproxy_func_3:\n Ordinal: 30\n Address: 0x000042E0\n\nproxy_func_4:\n Ordinal: 31\n Address: 0x000042F0\n\nproxy_func_5:\n Ordinal: 32\n Address: 0x00004300\n\nproxy_func_6:\n Ordinal: 33\n Address: 0x00004B30\n\nproxy_func_7:\n Ordinal: 34\n Address: 0x00004B40\n\nproxy_func_8:\n Ordinal: 35\n Address: 0x00004B50\n\nproxy_func_9:\n Ordinal: 36\n Address: 0x00004B60\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x0000000063F85000\nEndAddressOfRawData: 0x0000000063F85060\nAddressOfIndex: 0x0000000063F818CC\nAddressOfCallbacks: 0x0000000063F84030\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x0000000063EC2080\n 0x0000000063EC2050\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .xdata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Can access the registry:\n RegCloseKey\n RegOpenKeyExA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/jli-019eff2b84057d02a4e5c7dd15948c9b.dll"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_lx5on0th/output.txt"},"timestamp":"2026-07-02 22:51:43"} {"_id":{"$oid":"6a3d3bcf6c8e273a010a1926"},"sha256":"1e75fd701998008590a79fb60f57c6111ff3c6a3a23b584f061df96f17cdf6ff","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Read-019eff2bd118752095707ab445f35507.exe\nDate: 2026-07-02 22:52:40\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Read-019eff2bd118752095707ab445f35507.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2099-May-25 23:30:58\nDetected languages: English - United States\nDebug artifacts: javaw.exe.pdb\nCompanyName: JetBrains s.r.o.\nFileDescription: OpenJDK Platform binary\nFileVersion: 25.0.2.0\nFull Version: 25.0.2+1-b329.72\nInternalName: javaw\nLegalCopyright: Copyright © 2026\nOriginalFilename: javaw.exe\nProductName: OpenJDK Platform 25.0.2\nProductVersion: 25.0.2.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000108\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2099-May-25 23:30:58\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00001000\nSizeOfInitializedData: 0x00004800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000014D8 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0000A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00011330\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00000EDC\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.79852\n\n.rdata:\n VirtualSize: 0x000011DE\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00001400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.24614\n\n.data:\n VirtualSize: 0x00000138\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00002600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.672812\n\n.pdata:\n VirtualSize: 0x00000150\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00002800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.62816\n\n.rsrc:\n VirtualSize: 0x00002EA8\n VirtualAddress: 0x00006000\n SizeOfRawData: 0x00003000\n PointerToRawData: 0x00002A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.96521\n\n.reloc:\n VirtualSize: 0x00000038\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00005A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.760861\n\n\nImports:\n--------\njli.dll: JLI_Launch\n JLI_MemAlloc\n JLI_CmdToArgs\n JLI_GetStdArgc\n JLI_GetStdArgs\n JLI_MemFree\n JLI_InitArgProcessing\nKERNEL32.dll: GetCurrentProcessId\n GetStartupInfoW\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n IsDebuggerPresent\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n GetModuleHandleW\n GetCommandLineW\n WideCharToMultiByte\n QueryPerformanceCounter\n IsProcessorFeaturePresent\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n InitializeSListHead\n RtlCaptureContext\nVCRUNTIME140.dll: __current_exception\n __current_exception_context\n memset\n memcpy\n __C_specific_handler\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vfprintf\n __acrt_iob_func\n _set_fmode\n __p__commode\napi-ms-win-crt-runtime-l1-1-0.dll: _register_onexit_function\n exit\n __p___argc\n __p___argv\n terminate\n _seh_filter_exe\n _set_app_type\n _configure_narrow_argv\n _initialize_narrow_environment\n _get_narrow_winmain_command_line\n _initterm\n _initterm_e\n _exit\n _initialize_onexit_table\n _cexit\n _c_exit\n _register_thread_local_exe_atexit_callback\n perror\n _crt_atexit\napi-ms-win-crt-environment-l1-1-0.dll: __p__environ\n getenv\napi-ms-win-crt-math-l1-1-0.dll: __setusermatherr\napi-ms-win-crt-locale-l1-1-0.dll: _configthreadlocale\napi-ms-win-crt-heap-l1-1-0.dll: _set_new_mode\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07241\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.29019\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.77547\n\n2000:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.53369\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42688\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1544\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.3085\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 25.0.2.0\n ProductVersion: 25.0.2.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: JetBrains s.r.o.\n FileDescription: OpenJDK Platform binary\n FileVersion (#2): 25.0.2.0\n Full Version: 25.0.2+1-b329.72\n InternalName: javaw\n LegalCopyright: Copyright © 2026\n OriginalFilename: javaw.exe\n ProductName: OpenJDK Platform 25.0.2\n ProductVersion (#2): 25.0.2.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 38\n AddressOfRawData: 0x000025D8\n PointerToRawData: 0x000019D8\n Referenced File: javaw.exe.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00002600\n PointerToRawData: 0x00001A00\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 644\n AddressOfRawData: 0x00002614\n PointerToRawData: 0x00001A14\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 36\n AddressOfRawData: 0x00002898\n PointerToRawData: 0x00001C98\n\n\nLoad Configuration:\n-------------------\nSize: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000140004040\n\nRICH Header:\n------------\nXOR Key: 0x0932650C\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 12\nImports (35207): 2\nImports (27412): 2\nASM objects (35207): 2\nC objects (35207): 9\nC++ objects (35207): 18\nImports (35223): 3\nTotal imports: 60\nC objects (35223): 1\nResource objects (35223): 1\nLinker (35223): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: JetBrains s.r.o.\n Issuer: DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2099-May-25 23:30:58\nDetected languages: English - United States\nDebug artifacts: javaw.exe.pdb\nCompanyName: JetBrains s.r.o.\nFileDescription: OpenJDK Platform binary\nFileVersion: 25.0.2.0\nFull Version: 25.0.2+1-b329.72\nInternalName: javaw\nLegalCopyright: Copyright © 2026\nOriginalFilename: javaw.exe\nProductName: OpenJDK Platform 25.0.2\nProductVersion: 25.0.2.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000108"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2099-May-25 23:30:58\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00001000\nSizeOfInitializedData: 0x00004800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000014D8 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0000A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00011330\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00000EDC\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.79852\n\n.rdata:\n VirtualSize: 0x000011DE\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00001400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.24614\n\n.data:\n VirtualSize: 0x00000138\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00002600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.672812\n\n.pdata:\n VirtualSize: 0x00000150\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00002800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.62816\n\n.rsrc:\n VirtualSize: 0x00002EA8\n VirtualAddress: 0x00006000\n SizeOfRawData: 0x00003000\n PointerToRawData: 0x00002A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.96521\n\n.reloc:\n VirtualSize: 0x00000038\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00005A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.760861"},"Imports":{"raw":"jli.dll: JLI_Launch\n JLI_MemAlloc\n JLI_CmdToArgs\n JLI_GetStdArgc\n JLI_GetStdArgs\n JLI_MemFree\n JLI_InitArgProcessing\nKERNEL32.dll: GetCurrentProcessId\n GetStartupInfoW\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n IsDebuggerPresent\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n GetModuleHandleW\n GetCommandLineW\n WideCharToMultiByte\n QueryPerformanceCounter\n IsProcessorFeaturePresent\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n InitializeSListHead\n RtlCaptureContext\nVCRUNTIME140.dll: __current_exception\n __current_exception_context\n memset\n memcpy\n __C_specific_handler\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vfprintf\n __acrt_iob_func\n _set_fmode\n __p__commode\napi-ms-win-crt-runtime-l1-1-0.dll: _register_onexit_function\n exit\n __p___argc\n __p___argv\n terminate\n _seh_filter_exe\n _set_app_type\n _configure_narrow_argv\n _initialize_narrow_environment\n _get_narrow_winmain_command_line\n _initterm\n _initterm_e\n _exit\n _initialize_onexit_table\n _cexit\n _c_exit\n _register_thread_local_exe_atexit_callback\n perror\n _crt_atexit\napi-ms-win-crt-environment-l1-1-0.dll: __p__environ\n getenv\napi-ms-win-crt-math-l1-1-0.dll: __setusermatherr\napi-ms-win-crt-locale-l1-1-0.dll: _configthreadlocale\napi-ms-win-crt-heap-l1-1-0.dll: _set_new_mode\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07241\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.29019\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.77547\n\n2000:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.53369\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42688\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1544\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.3085\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 25.0.2.0\n ProductVersion: 25.0.2.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: JetBrains s.r.o.\n FileDescription: OpenJDK Platform binary\n FileVersion (#2): 25.0.2.0\n Full Version: 25.0.2+1-b329.72\n InternalName: javaw\n LegalCopyright: Copyright © 2026\n OriginalFilename: javaw.exe\n ProductName: OpenJDK Platform 25.0.2\n ProductVersion (#2): 25.0.2.0\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 38\n AddressOfRawData: 0x000025D8\n PointerToRawData: 0x000019D8\n Referenced File: javaw.exe.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00002600\n PointerToRawData: 0x00001A00\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 644\n AddressOfRawData: 0x00002614\n PointerToRawData: 0x00001A14\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 36\n AddressOfRawData: 0x00002898\n PointerToRawData: 0x00001C98\n\n\nLoad Configuration:\nSize: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000140004040\n\nRICH Header:\nXOR Key: 0x0932650C\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 12\nImports (35207): 2\nImports (27412): 2\nASM objects (35207): 2\nC objects (35207): 9\nC++ objects (35207): 18\nImports (35223): 3\nTotal imports: 60\nC objects (35223): 1\nResource objects (35223): 1\nLinker (35223): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: JetBrains s.r.o.\n Issuer: DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07241\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.29019\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.77547\n\n2000:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.53369\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.42688\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1544\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.3085\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 25.0.2.0\n ProductVersion: 25.0.2.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: JetBrains s.r.o.\n FileDescription: OpenJDK Platform binary\n FileVersion (#2): 25.0.2.0\n Full Version: 25.0.2+1-b329.72\n InternalName: javaw\n LegalCopyright: Copyright © 2026\n OriginalFilename: javaw.exe\n ProductName: OpenJDK Platform 25.0.2\n ProductVersion (#2): 25.0.2.0"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 38\n AddressOfRawData: 0x000025D8\n PointerToRawData: 0x000019D8\n Referenced File: javaw.exe.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x00002600\n PointerToRawData: 0x00001A00\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 644\n AddressOfRawData: 0x00002614\n PointerToRawData: 0x00001A14\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 2099-May-25 23:30:58\n Version: 0.0\n SizeofData: 36\n AddressOfRawData: 0x00002898\n PointerToRawData: 0x00001C98"},"Load Configuration":{"raw":"Size: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000140004040"},"RICH Header":{"raw":"XOR Key: 0x0932650C\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 12\nImports (35207): 2\nImports (27412): 2\nASM objects (35207): 2\nC objects (35207): 9\nC++ objects (35207): 18\nImports (35223): 3\nTotal imports: 60\nC objects (35223): 1\nResource objects (35223): 1\nLinker (35223): 1\n\nMatching compiler(s):\n MASM/TASM - sig1(h)\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: JetBrains s.r.o.\n Issuer: DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Read-019eff2bd118752095707ab445f35507.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_l6txd5a9/output.txt"},"timestamp":"2026-07-02 22:52:40"} {"_id":{"$oid":"6a4129d6ef40726c21470d79"},"sha256":"be5dcbece8635a9753fa1a9e6df99e8f7f1f40d787ced52cf13a85ea9c045181","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/simple_add-019f0e88427f739393f2488c24f373d8.exe\nDate: 2026-06-28 19:34:06\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/simple_add-019f0e88427f739393f2488c24f373d8.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2025-Dec-08 20:36:34\nTLS Callbacks: 2 callback(s) detected.\nDebug artifacts: Embedded COFF debugging symbols\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 18\nTimeDateStamp: 2025-Dec-08 20:36:34\nPointerToSymbolTable: 0x0006FC00\nNumberOfSymbols: 1908\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 2.0\nSizeOfCode: 0x00006C00\nSizeOfInitializedData: 0x00009600\nSizeOfUninitializedData: 0x00000C00\nAddressOfEntryPoint: 0x00000000000014F0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x0007A000\nSizeOfHeaders: 0x00000600\nChecksum: 0x00083E5E\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000200000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00006A78\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00006C00\n PointerToRawData: 0x00000600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.22454\n\n.data:\n VirtualSize: 0x000000F0\n VirtualAddress: 0x00008000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.97105\n\n.rdata:\n VirtualSize: 0x00000DC0\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x00007400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.04171\n\n.pdata:\n VirtualSize: 0x000004A4\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00008200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.44592\n\n.xdata:\n VirtualSize: 0x00000450\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00008800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.52921\n\n.bss:\n VirtualSize: 0x00000BA0\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00000718\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00008E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.60244\n\n.CRT:\n VirtualSize: 0x00000068\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00009600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.340642\n\n.tls:\n VirtualSize: 0x00000010\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00009800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.reloc:\n VirtualSize: 0x0000008C\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00009A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 1.61564\n\n/4:\n VirtualSize: 0x00000680\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00009C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 1.64777\n\n/19:\n VirtualSize: 0x0004628E\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00046400\n PointerToRawData: 0x0000A400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.05204\n\n/31:\n VirtualSize: 0x00003A87\n VirtualAddress: 0x00059000\n SizeOfRawData: 0x00003C00\n PointerToRawData: 0x00050800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.65191\n\n/45:\n VirtualSize: 0x00007ADE\n VirtualAddress: 0x0005D000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x00054400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.43356\n\n/57:\n VirtualSize: 0x00001790\n VirtualAddress: 0x00065000\n SizeOfRawData: 0x00001800\n PointerToRawData: 0x0005C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.534\n\n/70:\n VirtualSize: 0x000008C6\n VirtualAddress: 0x00067000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x0005D800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.53662\n\n/81:\n VirtualSize: 0x000108D1\n VirtualAddress: 0x00068000\n SizeOfRawData: 0x00010A00\n PointerToRawData: 0x0005E200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 2.68329\n\n/92:\n VirtualSize: 0x00000E20\n VirtualAddress: 0x00079000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x0006EC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 1.64172\n\n\nImports:\n--------\nKERNEL32.dll: DeleteCriticalSection\n EnterCriticalSection\n GetLastError\n GetStartupInfoA\n InitializeCriticalSection\n IsDBCSLeadByteEx\n LeaveCriticalSection\n MultiByteToWideChar\n SetUnhandledExceptionFilter\n Sleep\n TlsGetValue\n VirtualProtect\n VirtualQuery\n WideCharToMultiByte\nmsvcrt.dll: __C_specific_handler\n ___lc_codepage_func\n ___mb_cur_max_func\n __getmainargs\n __initenv\n __iob_func\n __lconv_init\n __set_app_type\n __setusermatherr\n _acmdln\n _amsg_exit\n _cexit\n _commode\n _errno\n _fmode\n _initterm\n _lock\n _onexit\n _unlock\n abort\n calloc\n exit\n fprintf\n fputc\n free\n fwrite\n localeconv\n malloc\n memcpy\n signal\n strerror\n strlen\n strncmp\n vfprintf\n wcslen\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x000000014000F000\nEndAddressOfRawData: 0x000000014000F008\nAddressOfIndex: 0x000000014000C07C\nAddressOfCallbacks: 0x000000014000E040\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x00000001400016E0\n 0x00000001400016B0\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .xdata\n Unusual section name found: /4\n Unusual section name found: /19\n Unusual section name found: /31\n Unusual section name found: /45\n Unusual section name found: /57\n Unusual section name found: /70\n Unusual section name found: /81\n Unusual section name found: /92\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 41138 bytes of data starting at offset 0x6fc00.\n\n\n\n[*] Warning: Tried to read outside the COFF string table to get the name of section /4!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /19!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /31!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /45!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /57!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /70!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /81!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /92!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF String Table's reported size is bigger than the remaining bytes!\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2025-Dec-08 20:36:34\nTLS Callbacks: 2 callback(s) detected.\nDebug artifacts: Embedded COFF debugging symbols"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 18\nTimeDateStamp: 2025-Dec-08 20:36:34\nPointerToSymbolTable: 0x0006FC00\nNumberOfSymbols: 1908\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 2.0\nSizeOfCode: 0x00006C00\nSizeOfInitializedData: 0x00009600\nSizeOfUninitializedData: 0x00000C00\nAddressOfEntryPoint: 0x00000000000014F0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x0007A000\nSizeOfHeaders: 0x00000600\nChecksum: 0x00083E5E\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000200000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00006A78\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00006C00\n PointerToRawData: 0x00000600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.22454\n\n.data:\n VirtualSize: 0x000000F0\n VirtualAddress: 0x00008000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.97105\n\n.rdata:\n VirtualSize: 0x00000DC0\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x00007400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.04171\n\n.pdata:\n VirtualSize: 0x000004A4\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00008200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.44592\n\n.xdata:\n VirtualSize: 0x00000450\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00008800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.52921\n\n.bss:\n VirtualSize: 0x00000BA0\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00000718\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00008E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.60244\n\n.CRT:\n VirtualSize: 0x00000068\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00009600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.340642\n\n.tls:\n VirtualSize: 0x00000010\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00009800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.reloc:\n VirtualSize: 0x0000008C\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00009A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 1.61564\n\n/4:\n VirtualSize: 0x00000680\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00009C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 1.64777\n\n/19:\n VirtualSize: 0x0004628E\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00046400\n PointerToRawData: 0x0000A400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.05204\n\n/31:\n VirtualSize: 0x00003A87\n VirtualAddress: 0x00059000\n SizeOfRawData: 0x00003C00\n PointerToRawData: 0x00050800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.65191\n\n/45:\n VirtualSize: 0x00007ADE\n VirtualAddress: 0x0005D000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x00054400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.43356\n\n/57:\n VirtualSize: 0x00001790\n VirtualAddress: 0x00065000\n SizeOfRawData: 0x00001800\n PointerToRawData: 0x0005C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.534\n\n/70:\n VirtualSize: 0x000008C6\n VirtualAddress: 0x00067000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x0005D800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.53662\n\n/81:\n VirtualSize: 0x000108D1\n VirtualAddress: 0x00068000\n SizeOfRawData: 0x00010A00\n PointerToRawData: 0x0005E200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 2.68329\n\n/92:\n VirtualSize: 0x00000E20\n VirtualAddress: 0x00079000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x0006EC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 1.64172"},"Imports":{"raw":"KERNEL32.dll: DeleteCriticalSection\n EnterCriticalSection\n GetLastError\n GetStartupInfoA\n InitializeCriticalSection\n IsDBCSLeadByteEx\n LeaveCriticalSection\n MultiByteToWideChar\n SetUnhandledExceptionFilter\n Sleep\n TlsGetValue\n VirtualProtect\n VirtualQuery\n WideCharToMultiByte\nmsvcrt.dll: __C_specific_handler\n ___lc_codepage_func\n ___mb_cur_max_func\n __getmainargs\n __initenv\n __iob_func\n __lconv_init\n __set_app_type\n __setusermatherr\n _acmdln\n _amsg_exit\n _cexit\n _commode\n _errno\n _fmode\n _initterm\n _lock\n _onexit\n _unlock\n abort\n calloc\n exit\n fprintf\n fputc\n free\n fwrite\n localeconv\n malloc\n memcpy\n signal\n strerror\n strlen\n strncmp\n vfprintf\n wcslen\n\nTLS Callbacks:\nStartAddressOfRawData: 0x000000014000F000\nEndAddressOfRawData: 0x000000014000F008\nAddressOfIndex: 0x000000014000C07C\nAddressOfCallbacks: 0x000000014000E040\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x00000001400016E0\n 0x00000001400016B0\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .xdata\n Unusual section name found: /4\n Unusual section name found: /19\n Unusual section name found: /31\n Unusual section name found: /45\n Unusual section name found: /57\n Unusual section name found: /70\n Unusual section name found: /81\n Unusual section name found: /92\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 41138 bytes of data starting at offset 0x6fc00.\n\n\n\n[*] Warning: Tried to read outside the COFF string table to get the name of section /4!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /19!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /31!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /45!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /57!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /70!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /81!\n[*] Warning: Tried to read outside the COFF string table to get the name of section /92!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF symbol's section number is bigger than the number of sections!\n[*] Warning: COFF String Table's reported size is bigger than the remaining bytes!\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/simple_add-019f0e88427f739393f2488c24f373d8.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_s8azzh78/output.txt"},"timestamp":"2026-06-28 19:34:06"} {"_id":{"$oid":"6a44e261ef40726c21470db1"},"sha256":"f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Mozi-019f1d12eb797860bd64e1ea66587cdf.elf\nDate: 2026-07-01 15:18:17\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Mozi-019f1d12eb797860bd64e1ea66587cdf.elf!\nDetected file type(s):\n\tExecutable and Linking Format executable file (Linux/Unix)\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Mozi-019f1d12eb797860bd64e1ea66587cdf.elf"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_p4in14xw/output.txt"},"timestamp":"2026-07-01 15:18:17"} {"_id":{"$oid":"6a44e98cef40726c21470db6"},"sha256":"35bbf0234535438e8cbc25031e6501e259c847270467d45bc18af065d03fc537","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/35bbf0234535438e8cbc25031e6501e259c847270467d45bc18af065d03fc537-019f1d2172a17831bd2148315a9b4d97.elf\nDate: 2026-07-01 15:48:52\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/35bbf0234535438e8cbc25031e6501e259c847270467d45bc18af065d03fc537-019f1d2172a17831bd2148315a9b4d97.elf!\nDetected file type(s):\n\tExecutable and Linking Format executable file (Linux/Unix)\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/35bbf0234535438e8cbc25031e6501e259c847270467d45bc18af065d03fc537-019f1d2172a17831bd2148315a9b4d97.elf"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_n_kypitb/output.txt"},"timestamp":"2026-07-01 15:48:52"} {"_id":{"$oid":"6a44eb06ef40726c21470db7"},"sha256":"c480d1d8b50d9c94655b26755431d2d5a3c7d741a30047a21d1e13723109718f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/pf-019f1d172d3d7dd09ee0bacd4e900bc1.dll\nDate: 2026-07-01 15:55:10\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/pf-019f1d172d3d7dd09ee0bacd4e900bc1.dll\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jun-24 18:19:06\nTLS Callbacks: 3 callback(s) detected.\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 12\nTimeDateStamp: 2026-Jun-24 18:19:06\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x0003D400\nSizeOfInitializedData: 0x00385200\nSizeOfUninitializedData: 0x00000C00\nAddressOfEntryPoint: 0x00BC2AEB (Section: )\nBaseOfCode: 0x00001000\nBaseOfData: 0x0003F000\nImageBase: 0x70F00000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 1.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x00CEF000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00D71B48\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0003D334\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0003D400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 1.1432\n\n.data:\n VirtualSize: 0x00265220\n VirtualAddress: 0x0003F000\n SizeOfRawData: 0x00265400\n PointerToRawData: 0x0003D800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.11644\n\n.rdata:\n VirtualSize: 0x00000ED8\n VirtualAddress: 0x002A5000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x002A2C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.16221\n\n.bss:\n VirtualSize: 0x00000A30\n VirtualAddress: 0x002A6000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.edata:\n VirtualSize: 0x0000005A\n VirtualAddress: 0x002A7000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x002A3C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.13321\n\n.idata:\n VirtualSize: 0x00000588\n VirtualAddress: 0x002A8000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x002A3E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.93533\n\n.CRT:\n VirtualSize: 0x0000002C\n VirtualAddress: 0x002A9000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x002A4400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.210826\n\n.tls:\n VirtualSize: 0x00000008\n VirtualAddress: 0x002AA000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x002A4600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\nSection_9:\n VirtualSize: 0x00785127\n VirtualAddress: 0x002AB000\n SizeOfRawData: 0x00785200\n PointerToRawData: 0x002A4800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.89746\n\nSection_10:\n VirtualSize: 0x0000002C\n VirtualAddress: 0x00A31000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00A29A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.183339\n\nSection_11:\n VirtualSize: 0x001DA5EE\n VirtualAddress: 0x00A32000\n SizeOfRawData: 0x001DA600\n PointerToRawData: 0x00A29C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.96406\n\n.reloc:\n VirtualSize: 0x000E1E6C\n VirtualAddress: 0x00C0D000\n SizeOfRawData: 0x000E2000\n PointerToRawData: 0x00C04200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.90936\n\n\nImports:\n--------\nKERNEL32.dll: AddVectoredExceptionHandler\nmsvcrt.dll: __mb_cur_max\n\nExports:\n--------\nEventDebuggerLaunchCallback:\n Ordinal: 1\n Address: 0x0003DFA4\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x711AA000\nEndAddressOfRawData: 0x711AA004\nAddressOfIndex: 0x711A6028\nAddressOfCallbacks: 0x71A687DC\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x71A52280\n 0x70F37630\n 0x70F375E0\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n The PE only has 2 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 525824 bytes of data starting at offset 0xce6200.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jun-24 18:19:06\nTLS Callbacks: 3 callback(s) detected."},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 12\nTimeDateStamp: 2026-Jun-24 18:19:06\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x0003D400\nSizeOfInitializedData: 0x00385200\nSizeOfUninitializedData: 0x00000C00\nAddressOfEntryPoint: 0x00BC2AEB (Section: )\nBaseOfCode: 0x00001000\nBaseOfData: 0x0003F000\nImageBase: 0x70F00000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 1.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x00CEF000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00D71B48\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0003D334\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0003D400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 1.1432\n\n.data:\n VirtualSize: 0x00265220\n VirtualAddress: 0x0003F000\n SizeOfRawData: 0x00265400\n PointerToRawData: 0x0003D800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.11644\n\n.rdata:\n VirtualSize: 0x00000ED8\n VirtualAddress: 0x002A5000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x002A2C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.16221\n\n.bss:\n VirtualSize: 0x00000A30\n VirtualAddress: 0x002A6000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.edata:\n VirtualSize: 0x0000005A\n VirtualAddress: 0x002A7000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x002A3C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.13321\n\n.idata:\n VirtualSize: 0x00000588\n VirtualAddress: 0x002A8000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x002A3E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.93533\n\n.CRT:\n VirtualSize: 0x0000002C\n VirtualAddress: 0x002A9000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x002A4400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.210826\n\n.tls:\n VirtualSize: 0x00000008\n VirtualAddress: 0x002AA000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x002A4600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\nSection_9:\n VirtualSize: 0x00785127\n VirtualAddress: 0x002AB000\n SizeOfRawData: 0x00785200\n PointerToRawData: 0x002A4800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.89746\n\nSection_10:\n VirtualSize: 0x0000002C\n VirtualAddress: 0x00A31000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00A29A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.183339\n\nSection_11:\n VirtualSize: 0x001DA5EE\n VirtualAddress: 0x00A32000\n SizeOfRawData: 0x001DA600\n PointerToRawData: 0x00A29C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.96406\n\n.reloc:\n VirtualSize: 0x000E1E6C\n VirtualAddress: 0x00C0D000\n SizeOfRawData: 0x000E2000\n PointerToRawData: 0x00C04200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.90936"},"Imports":{"raw":"KERNEL32.dll: AddVectoredExceptionHandler\nmsvcrt.dll: __mb_cur_max"},"Exports":{"raw":"EventDebuggerLaunchCallback:\n Ordinal: 1\n Address: 0x0003DFA4\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x711AA000\nEndAddressOfRawData: 0x711AA004\nAddressOfIndex: 0x711A6028\nAddressOfCallbacks: 0x71A687DC\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x71A52280\n 0x70F37630\n 0x70F375E0\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n The PE only has 2 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 525824 bytes of data starting at offset 0xce6200.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/pf-019f1d172d3d7dd09ee0bacd4e900bc1.dll"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_z9er0943/output.txt"},"timestamp":"2026-07-01 15:55:10"} {"_id":{"$oid":"6a4f8bde0108394cb24cdcae"},"sha256":"d0cca6601229f60c0cc2ece0de632c2787e9ed34ac64bff0114d507d6ced7f54","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/I-WORM~1-019f46b6354b77b0b98508e1d9da0cba.VBS\nDate: 2026-07-09 17:24:06\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/I-WORM~1-019f46b6354b77b0b98508e1d9da0cba.VBS!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/I-WORM~1-019f46b6354b77b0b98508e1d9da0cba.VBS"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_hj9o8w8m/output.txt"},"timestamp":"2026-07-09 17:24:06"} {"_id":{"$oid":"6a4f8c780108394cb24cdcb1"},"sha256":"173671beefa95df1a34493514264da0506fe533c420a0b0f9920124ce8344a44","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Script.VBScript-019f46b6bc7076639cad432aa48be38f.HTM\nDate: 2026-07-09 17:26:40\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Script.VBScript-019f46b6bc7076639cad432aa48be38f.HTM!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Script.VBScript-019f46b6bc7076639cad432aa48be38f.HTM"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_bw4r7xci/output.txt"},"timestamp":"2026-07-09 17:26:40"} {"_id":{"$oid":"6a4f939d0108394cb24cdcb7"},"sha256":"427ece485005f1bd517b8f0c6c38a8f73bf32350795b83fb8cf937c86f99dfc8","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/dino-019f46b98e5478418c53ff4deb91d86d.bin\nDate: 2026-07-09 17:57:09\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/dino-019f46b98e5478418c53ff4deb91d86d.bin!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/dino-019f46b98e5478418c53ff4deb91d86d.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_ob5n_qa6/output.txt"},"timestamp":"2026-07-09 17:57:09"} {"_id":{"$oid":"6a4f94600108394cb24cdcb9"},"sha256":"523d40c69b0972ddeff0682fcb569e8a346cf10b2894479ab227bbb24e19846e","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_jnvu2x1a/conficker-019f46bbbdcd7df3a29dcdf19949a4e7_523d40c69b09/001_upx_unpacked.exe\nDate: 2026-07-09 18:00:24\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_jnvu2x1a/conficker-019f46bbbdcd7df3a29dcdf19949a4e7_523d40c69b09/001_upx_unpacked.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2000-Oct-07 17:18:51\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000D8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2000-Oct-07 17:18:51\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 7.0\nSizeOfCode: 0x00004000\nSizeOfInitializedData: 0x00010000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000434B (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00005000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 5.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00015000\nSizeOfHeaders: 0x00001000\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000033EE\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00004000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.38383\n\n.rdata:\n VirtualSize: 0x00000478\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00005000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.39442\n\n.data:\n VirtualSize: 0x0000DAA8\n VirtualAddress: 0x00006000\n SizeOfRawData: 0x0000E000\n PointerToRawData: 0x00006000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.48444\n\n.reloc:\n VirtualSize: 0x00000968\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00014000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.54368\n\n\nImports:\n--------\nKERNEL32.DLL: LocalFlags\n VirtualAlloc\n VirtualProtect\n GlobalFlags\n GetVersionExA\n IsDBCSLeadByte\n GetProcAddress\n InterlockedExchange\n InterlockedDecrement\n GetComputerNameA\n LoadLibraryA\n VirtualQuery\nADVAPI32.dll: IsValidSid\n InitializeSecurityDescriptor\n IsValidSecurityDescriptor\n GetUserNameA\n RevertToSelf\n IsValidAcl\nMSVCRT.dll: _isctype\n _adjust_fdiv\n malloc\n __doserrno\n ldiv\n _hypot\n modf\n localeconv\n frexp\n ceil\n _pctype\n ldexp\n __mb_cur_max\n _CIsinh\n _CIcosh\n _CItanh\n memchr\n _memicmp\n free\n _initterm\nUSER32.dll: IsCharAlphaNumericA\n IsCharUpperA\n IsCharLowerA\n IsCharAlphaA\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 DLL\n\nInteresting strings found in the binary:\n Contains domain names:\n http://www.w3.org\n http://www.w3.org/TR/1999/REC-html401-19991224/strict.dtd\n http://www.w3.org/TR/html4/strict.dtd\n www.w3.org\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 415 bytes of data starting at offset 0x15000.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2000-Oct-07 17:18:51"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000D8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2000-Oct-07 17:18:51\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 7.0\nSizeOfCode: 0x00004000\nSizeOfInitializedData: 0x00010000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000434B (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00005000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 5.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00015000\nSizeOfHeaders: 0x00001000\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000033EE\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00004000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.38383\n\n.rdata:\n VirtualSize: 0x00000478\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00005000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.39442\n\n.data:\n VirtualSize: 0x0000DAA8\n VirtualAddress: 0x00006000\n SizeOfRawData: 0x0000E000\n PointerToRawData: 0x00006000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.48444\n\n.reloc:\n VirtualSize: 0x00000968\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00014000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.54368"},"Imports":{"raw":"KERNEL32.DLL: LocalFlags\n VirtualAlloc\n VirtualProtect\n GlobalFlags\n GetVersionExA\n IsDBCSLeadByte\n GetProcAddress\n InterlockedExchange\n InterlockedDecrement\n GetComputerNameA\n LoadLibraryA\n VirtualQuery\nADVAPI32.dll: IsValidSid\n InitializeSecurityDescriptor\n IsValidSecurityDescriptor\n GetUserNameA\n RevertToSelf\n IsValidAcl\nMSVCRT.dll: _isctype\n _adjust_fdiv\n malloc\n __doserrno\n ldiv\n _hypot\n modf\n localeconv\n frexp\n ceil\n _pctype\n ldexp\n __mb_cur_max\n _CIsinh\n _CIcosh\n _CItanh\n memchr\n _memicmp\n free\n _initterm\nUSER32.dll: IsCharAlphaNumericA\n IsCharUpperA\n IsCharLowerA\n IsCharAlphaA\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 DLL\n\nInteresting strings found in the binary:\n Contains domain names:\n http://www.w3.org\n http://www.w3.org/TR/1999/REC-html401-19991224/strict.dtd\n http://www.w3.org/TR/html4/strict.dtd\n www.w3.org\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 415 bytes of data starting at offset 0x15000.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{"raw":"Contains domain names:\n http://www.w3.org\n http://www.w3.org/TR/1999/REC-html401-19991224/strict.dtd\n http://www.w3.org/TR/html4/strict.dtd\n www.w3.org\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 415 bytes of data starting at offset 0x15000.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/tmp/sdm_unpack_jnvu2x1a/conficker-019f46bbbdcd7df3a29dcdf19949a4e7_523d40c69b09/001_upx_unpacked.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_mskr0_tb/output.txt"},"timestamp":"2026-07-09 18:00:24"} {"_id":{"$oid":"6a4f961b0108394cb24cdcbd"},"sha256":"62dd0d4b0ac16f65e363b601e65cbc171d0c48c528fd9bf71f5561f0b3f877a2","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/build_4_17_2014_id29303-019f46bc185f7221be9bef7b7fcaadfe.bin\nDate: 2026-07-09 18:07:47\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/build_4_17_2014_id29303-019f46bc185f7221be9bef7b7fcaadfe.bin\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Jan-10 00:46:30\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000C8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2014-Jan-10 00:46:30\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x00000A00\nSizeOfInitializedData: 0x00021A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000120A (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00002000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00026000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00010D86\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000089E\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.89387\n\n.rdata:\n VirtualSize: 0x000001E6\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00000E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.34578\n\n.rsrc:\n VirtualSize: 0x0002156C\n VirtualAddress: 0x00003000\n SizeOfRawData: 0x00021600\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.93899\n\n.reloc:\n VirtualSize: 0x00000036\n VirtualAddress: 0x00025000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00022600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.342786\n\n\nImports:\n--------\nKERNEL32.dll: ExitProcess\n GetModuleHandleW\n VirtualFreeEx\n VirtualProtectEx\n VirtualAllocEx\n\nResources:\n----------\n30070:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 135758\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.93818\n\n1:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 622\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.02301\n\n\nRICH Header:\n------------\nXOR Key: 0x95A31777\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 9\n175 (VS2010 SP1 build 40219): 3\nLinker (VS2010 SP1 build 40219): 1\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 5 import(s).\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Memory manipulation functions often used by packers:\n VirtualProtectEx\n VirtualAllocEx\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resource 30070 is possibly compressed or encrypted.\n Resources amount for 96.5099% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Jan-10 00:46:30\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000C8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2014-Jan-10 00:46:30\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x00000A00\nSizeOfInitializedData: 0x00021A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000120A (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00002000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00026000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00010D86\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000089E\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.89387\n\n.rdata:\n VirtualSize: 0x000001E6\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00000E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.34578\n\n.rsrc:\n VirtualSize: 0x0002156C\n VirtualAddress: 0x00003000\n SizeOfRawData: 0x00021600\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.93899\n\n.reloc:\n VirtualSize: 0x00000036\n VirtualAddress: 0x00025000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00022600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.342786"},"Imports":{"raw":"KERNEL32.dll: ExitProcess\n GetModuleHandleW\n VirtualFreeEx\n VirtualProtectEx\n VirtualAllocEx\n\nResources:\n30070:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 135758\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.93818\n\n1:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 622\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.02301\n\n\nRICH Header:\nXOR Key: 0x95A31777\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 9\n175 (VS2010 SP1 build 40219): 3\nLinker (VS2010 SP1 build 40219): 1\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 5 import(s).\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Memory manipulation functions often used by packers:\n VirtualProtectEx\n VirtualAllocEx\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resource 30070 is possibly compressed or encrypted.\n Resources amount for 96.5099% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"30070:\n Type: RT_BITMAP\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 135758\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.93818\n\n1:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 622\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.02301\n\n\nRICH Header:\nXOR Key: 0x95A31777\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 9\n175 (VS2010 SP1 build 40219): 3\nLinker (VS2010 SP1 build 40219): 1\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 5 import(s).\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Memory manipulation functions often used by packers:\n VirtualProtectEx\n VirtualAllocEx\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resource 30070 is possibly compressed or encrypted.\n Resources amount for 96.5099% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x95A31777\nUnmarked objects: 0\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 9\n175 (VS2010 SP1 build 40219): 3\nLinker (VS2010 SP1 build 40219): 1\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 5 import(s).\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Memory manipulation functions often used by packers:\n VirtualProtectEx\n VirtualAllocEx\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resource 30070 is possibly compressed or encrypted.\n Resources amount for 96.5099% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/build_4_17_2014_id29303-019f46bc185f7221be9bef7b7fcaadfe.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_8gl0oxbw/output.txt"},"timestamp":"2026-07-09 18:07:47"} {"_id":{"$oid":"6a4f976e0108394cb24cdcc1"},"sha256":"2a1f5a04025b7837d187ed8e9aaab7b5fff607327866e9bc9e5da83a84b56dda","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/2a1f5a04025b7837d187ed8e9aaab7b5fff607327866e9bc9e5da83a84b56dda-019f46bc651d7072bb5082e562c6cc13.bin\nDate: 2026-07-09 18:13:26\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/2a1f5a04025b7837d187ed8e9aaab7b5fff607327866e9bc9e5da83a84b56dda-019f46bc651d7072bb5082e562c6cc13.bin\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2015-May-22 11:41:33\nDetected languages: English - United States\nCompanyName: TeamSpeak Systems GmbH\nFileDescription: TeamSpeak 3 Client Updater\nFileVersion: 1, 0, 0, 0\nInternalName: TeamSpeak 3 Client Updater\nLegalCopyright: (C) 2007-2014 TeamSpeak Systems GmbH\nProductName: TeamSpeak 3 Client Updater\nProductVersion: 1, 0, 0, 0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2015-May-22 11:41:33\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 9.0\nSizeOfCode: 0x00037E00\nSizeOfInitializedData: 0x00007000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00032C22 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00039000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 0.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x00045000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00037C64\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00037E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.33259\n\n.rdata:\n VirtualSize: 0x00001EE6\n VirtualAddress: 0x00039000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x00038200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.54507\n\n.data:\n VirtualSize: 0x000069FC\n VirtualAddress: 0x0003B000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x0003A200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.88685\n\n.rsrc:\n VirtualSize: 0x00002F50\n VirtualAddress: 0x00042000\n SizeOfRawData: 0x00003000\n PointerToRawData: 0x0003C200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.81514\n\n\nImports:\n--------\nUSER32.dll: TrackPopupMenuEx\n GetInputState\n GetCursor\n GetUserObjectInformationW\n GetMenu\n CloseClipboard\n GetClassWord\n GetDesktopWindow\n ArrangeIconicWindows\n IsGUIThread\n GetAncestor\n IsCharAlphaNumericA\n GetMenuDefaultItem\nGDI32.dll: ExtTextOutA\n SetICMProfileA\n RestoreDC\n AngleArc\n MaskBlt\n InvertRgn\n GetGlyphIndicesW\n LineTo\n SetTextAlign\n GetPaletteEntries\n GetFontData\nKERNEL32.dll: GetStringTypeA\n MultiByteToWideChar\n GetStringTypeW\n LCMapStringA\n LCMapStringW\n HeapSize\n AreFileApisANSI\n ReplaceFileA\n WTSGetActiveConsoleSessionId\n ClearCommBreak\n GetFileSize\n SetHandleCount\n SetInformationJobObject\n CreateTapePartition\n GetCurrentProcess\n QueueUserAPC\n SetProcessShutdownParameters\n PeekNamedPipe\n ReleaseSemaphore\n CreateTimerQueue\n HeapAlloc\n GetProcessHeap\n SetSystemTimeAdjustment\n GetThreadTimes\n GetCommandLineA\n GetStartupInfoA\n GetModuleHandleW\n GetProcAddress\n TlsGetValue\n TlsAlloc\n TlsSetValue\n TlsFree\n InterlockedIncrement\n SetLastError\n GetCurrentThreadId\n GetLastError\n InterlockedDecrement\n TerminateProcess\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n IsDebuggerPresent\n Sleep\n ExitProcess\n WriteFile\n GetStdHandle\n GetModuleFileNameA\n FreeEnvironmentStringsA\n GetEnvironmentStrings\n FreeEnvironmentStringsW\n WideCharToMultiByte\n GetEnvironmentStringsW\n GetFileType\n DeleteCriticalSection\n HeapCreate\n VirtualFree\n HeapFree\n QueryPerformanceCounter\n GetTickCount\n GetCurrentProcessId\n GetSystemTimeAsFileTime\n LeaveCriticalSection\n EnterCriticalSection\n GetCPInfo\n GetACP\n GetOEMCP\n IsValidCodePage\n LoadLibraryA\n InitializeCriticalSectionAndSpinCount\n VirtualAlloc\n HeapReAlloc\n RtlUnwind\n GetLocaleInfoA\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 800\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.30454\n\n20:\n Type: RT_HTML\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 10730\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96539\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.79597\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: UNKNOWN\n CompanyName: TeamSpeak Systems GmbH\n FileDescription: TeamSpeak 3 Client Updater\n FileVersion (#2): 1, 0, 0, 0\n InternalName: TeamSpeak 3 Client Updater\n LegalCopyright: (C) 2007-2014 TeamSpeak Systems GmbH\n ProductName: TeamSpeak 3 Client Updater\n ProductVersion (#2): 1, 0, 0, 0\n\n\nLoad Configuration:\n-------------------\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x0043C1CC\nSEHandlerTable: 0x0043A350\nSEHandlerCount: 3\n\nRICH Header:\n------------\nXOR Key: 0x23C11C41\nUnmarked objects: 0\nASM objects (VS2008 build 21022): 16\nC objects (VS2008 build 21022): 74\nImports (VS2008 SP1 build 30729): 7\nTotal imports: 112\nC++ objects (VS2008 build 21022): 27\nLinker (VS2008 build 21022): 1\nResource objects (VS2008 build 21022): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n\nThe PE's resources present abnormal characteristics.\n Resource 20 is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2015-May-22 11:41:33\nDetected languages: English - United States\nCompanyName: TeamSpeak Systems GmbH\nFileDescription: TeamSpeak 3 Client Updater\nFileVersion: 1, 0, 0, 0\nInternalName: TeamSpeak 3 Client Updater\nLegalCopyright: (C) 2007-2014 TeamSpeak Systems GmbH\nProductName: TeamSpeak 3 Client Updater\nProductVersion: 1, 0, 0, 0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2015-May-22 11:41:33\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 9.0\nSizeOfCode: 0x00037E00\nSizeOfInitializedData: 0x00007000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00032C22 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00039000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 0.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x00045000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00037C64\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00037E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.33259\n\n.rdata:\n VirtualSize: 0x00001EE6\n VirtualAddress: 0x00039000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x00038200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.54507\n\n.data:\n VirtualSize: 0x000069FC\n VirtualAddress: 0x0003B000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x0003A200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.88685\n\n.rsrc:\n VirtualSize: 0x00002F50\n VirtualAddress: 0x00042000\n SizeOfRawData: 0x00003000\n PointerToRawData: 0x0003C200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.81514"},"Imports":{"raw":"USER32.dll: TrackPopupMenuEx\n GetInputState\n GetCursor\n GetUserObjectInformationW\n GetMenu\n CloseClipboard\n GetClassWord\n GetDesktopWindow\n ArrangeIconicWindows\n IsGUIThread\n GetAncestor\n IsCharAlphaNumericA\n GetMenuDefaultItem\nGDI32.dll: ExtTextOutA\n SetICMProfileA\n RestoreDC\n AngleArc\n MaskBlt\n InvertRgn\n GetGlyphIndicesW\n LineTo\n SetTextAlign\n GetPaletteEntries\n GetFontData\nKERNEL32.dll: GetStringTypeA\n MultiByteToWideChar\n GetStringTypeW\n LCMapStringA\n LCMapStringW\n HeapSize\n AreFileApisANSI\n ReplaceFileA\n WTSGetActiveConsoleSessionId\n ClearCommBreak\n GetFileSize\n SetHandleCount\n SetInformationJobObject\n CreateTapePartition\n GetCurrentProcess\n QueueUserAPC\n SetProcessShutdownParameters\n PeekNamedPipe\n ReleaseSemaphore\n CreateTimerQueue\n HeapAlloc\n GetProcessHeap\n SetSystemTimeAdjustment\n GetThreadTimes\n GetCommandLineA\n GetStartupInfoA\n GetModuleHandleW\n GetProcAddress\n TlsGetValue\n TlsAlloc\n TlsSetValue\n TlsFree\n InterlockedIncrement\n SetLastError\n GetCurrentThreadId\n GetLastError\n InterlockedDecrement\n TerminateProcess\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n IsDebuggerPresent\n Sleep\n ExitProcess\n WriteFile\n GetStdHandle\n GetModuleFileNameA\n FreeEnvironmentStringsA\n GetEnvironmentStrings\n FreeEnvironmentStringsW\n WideCharToMultiByte\n GetEnvironmentStringsW\n GetFileType\n DeleteCriticalSection\n HeapCreate\n VirtualFree\n HeapFree\n QueryPerformanceCounter\n GetTickCount\n GetCurrentProcessId\n GetSystemTimeAsFileTime\n LeaveCriticalSection\n EnterCriticalSection\n GetCPInfo\n GetACP\n GetOEMCP\n IsValidCodePage\n LoadLibraryA\n InitializeCriticalSectionAndSpinCount\n VirtualAlloc\n HeapReAlloc\n RtlUnwind\n GetLocaleInfoA\n\nResources:\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 800\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.30454\n\n20:\n Type: RT_HTML\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 10730\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96539\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.79597\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: UNKNOWN\n CompanyName: TeamSpeak Systems GmbH\n FileDescription: TeamSpeak 3 Client Updater\n FileVersion (#2): 1, 0, 0, 0\n InternalName: TeamSpeak 3 Client Updater\n LegalCopyright: (C) 2007-2014 TeamSpeak Systems GmbH\n ProductName: TeamSpeak 3 Client Updater\n ProductVersion (#2): 1, 0, 0, 0\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x0043C1CC\nSEHandlerTable: 0x0043A350\nSEHandlerCount: 3\n\nRICH Header:\nXOR Key: 0x23C11C41\nUnmarked objects: 0\nASM objects (VS2008 build 21022): 16\nC objects (VS2008 build 21022): 74\nImports (VS2008 SP1 build 30729): 7\nTotal imports: 112\nC++ objects (VS2008 build 21022): 27\nLinker (VS2008 build 21022): 1\nResource objects (VS2008 build 21022): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n\nThe PE's resources present abnormal characteristics.\n Resource 20 is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 800\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.30454\n\n20:\n Type: RT_HTML\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 10730\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96539\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.79597\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: UNKNOWN\n CompanyName: TeamSpeak Systems GmbH\n FileDescription: TeamSpeak 3 Client Updater\n FileVersion (#2): 1, 0, 0, 0\n InternalName: TeamSpeak 3 Client Updater\n LegalCopyright: (C) 2007-2014 TeamSpeak Systems GmbH\n ProductName: TeamSpeak 3 Client Updater\n ProductVersion (#2): 1, 0, 0, 0\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x0043C1CC\nSEHandlerTable: 0x0043A350\nSEHandlerCount: 3\n\nRICH Header:\nXOR Key: 0x23C11C41\nUnmarked objects: 0\nASM objects (VS2008 build 21022): 16\nC objects (VS2008 build 21022): 74\nImports (VS2008 SP1 build 30729): 7\nTotal imports: 112\nC++ objects (VS2008 build 21022): 27\nLinker (VS2008 build 21022): 1\nResource objects (VS2008 build 21022): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n\nThe PE's resources present abnormal characteristics.\n Resource 20 is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{"raw":"Size: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x0043C1CC\nSEHandlerTable: 0x0043A350\nSEHandlerCount: 3"},"RICH Header":{"raw":"XOR Key: 0x23C11C41\nUnmarked objects: 0\nASM objects (VS2008 build 21022): 16\nC objects (VS2008 build 21022): 74\nImports (VS2008 SP1 build 30729): 7\nTotal imports: 112\nC++ objects (VS2008 build 21022): 27\nLinker (VS2008 build 21022): 1\nResource objects (VS2008 build 21022): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n\nThe PE's resources present abnormal characteristics.\n Resource 20 is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/2a1f5a04025b7837d187ed8e9aaab7b5fff607327866e9bc9e5da83a84b56dda-019f46bc651d7072bb5082e562c6cc13.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_mmt5imav/output.txt"},"timestamp":"2026-07-09 18:13:26"} {"_id":{"$oid":"6a4f9a890108394cb24cdcc5"},"sha256":"eea059174127860154f4dce1a7d8995a9a5056febf73819d63ddadb522ed6c8f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Nivdort-019f46ced0397a61b6eb666f648767ac.exe\nDate: 2026-07-10 01:19:43\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Nivdort-019f46ced0397a61b6eb666f648767ac.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Jul-10 22:49:27\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2013-Jul-10 22:49:27\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 9.0\nSizeOfCode: 0x000B3200\nSizeOfInitializedData: 0x0002E800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0009B6A7 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x000B5000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 0.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x000E5000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000B31D4\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x000B3200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.43864\n\n.rdata:\n VirtualSize: 0x00008402\n VirtualAddress: 0x000B5000\n SizeOfRawData: 0x00008600\n PointerToRawData: 0x000B3600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.69973\n\n.data:\n VirtualSize: 0x000261E0\n VirtualAddress: 0x000BE000\n SizeOfRawData: 0x0001E200\n PointerToRawData: 0x000BBC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.93056\n\n\nImports:\n--------\nGDI32.dll: GetDeviceCaps\n SetTextAlign\n GetStretchBltMode\n GetFontLanguageInfo\n SetTextJustification\n GetRandomRgn\n GetPixelFormat\n GetCurrentObject\n UpdateColors\n GetTextAlign\n GetTextCharset\n GetTextCharsetInfo\n GetFontUnicodeRanges\n SetSystemPaletteUse\n SetTextColor\n GetBkColor\n GetNearestColor\n GetDCBrushColor\n GetTextColor\n GetSystemPaletteUse\n SetPixel\n GetPolyFillMode\n GetDCPenColor\n GetMapMode\n GetClipRgn\n GetNearestPaletteIndex\n GetMetaRgn\n SetTextCharacterExtra\n GetTextCharacterExtra\n GetGraphicsMode\nKERNEL32.dll: GetModuleHandleA\n GetProcAddress\n LoadResource\n FindResourceA\n GetDriveTypeA\n WriteFile\n LocalFlags\n IsProcessorFeaturePresent\n GetFileTime\n LockResource\n DeleteFileA\n GlobalSize\n SizeofResource\n MoveFileA\n GetProcessId\n GlobalFlags\n FindClose\n GetProcessHeap\n SetFilePointer\n GetFileType\n GetVersion\n GlobalHandle\n GetCurrentThreadId\n GetTickCount\n GetCurrentProcessId\n IsDebuggerPresent\n GetCurrentProcess\n GetLastError\n QueryPerformanceCounter\n LocalAlloc\n SetEnvironmentVariableA\n CompareStringW\n CompareStringA\n SetEndOfFile\n CreateProcessA\n WaitForSingleObject\n GetExitCodeProcess\n CreateFileA\n FlushFileBuffers\n SetStdHandle\n WriteConsoleW\n GetConsoleOutputCP\n WriteConsoleA\n GetLocaleInfoW\n GetStringTypeW\n GetStringTypeA\n IsValidLocale\n EnumSystemLocalesA\n GetLocaleInfoA\n GetUserDefaultLCID\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n GetEnvironmentStrings\n FreeEnvironmentStringsA\n HeapSize\n GetFileAttributesA\n GetTimeZoneInformation\n SetHandleCount\n ReadFile\n CloseHandle\n GetConsoleMode\n GetConsoleCP\n InitializeCriticalSectionAndSpinCount\n LoadLibraryA\n FreeLibrary\n InterlockedIncrement\n InterlockedDecrement\n WideCharToMultiByte\n Sleep\n InterlockedExchange\n InitializeCriticalSection\n DeleteCriticalSection\n EnterCriticalSection\n LeaveCriticalSection\n MultiByteToWideChar\n GetSystemTimeAsFileTime\n RtlUnwind\n FileTimeToSystemTime\n FileTimeToLocalFileTime\n FindFirstFileA\n TerminateProcess\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n HeapFree\n HeapAlloc\n GetModuleHandleW\n ExitProcess\n HeapReAlloc\n RaiseException\n GetCommandLineA\n GetStartupInfoA\n LCMapStringA\n LCMapStringW\n GetCPInfo\n TlsGetValue\n TlsAlloc\n TlsSetValue\n TlsFree\n SetLastError\n GetFullPathNameA\n GetCurrentDirectoryA\n HeapCreate\n VirtualFree\n VirtualAlloc\n GetStdHandle\n GetModuleFileNameA\n GetACP\n GetOEMCP\n IsValidCodePage\nUSER32.dll: CheckDlgButton\n GetWindowContextHelpId\n IsWindowEnabled\n ShowWindow\n GetPropA\n GetDialogBaseUnits\n GetDlgItemInt\n WindowFromDC\n GetDlgItem\n EndPaint\n PostMessageA\n GetMenuContextHelpId\n GetDC\n GetMenuState\n IsWindowUnicode\n GetWindowDC\n EnableWindow\n GetForegroundWindow\n GetCursor\n BeginPaint\n EndDialog\n GetScrollPos\n GetKeyboardType\n GetWindowLongA\n GetMenuItemCount\n GetMenuCheckMarkDimensions\n GetMenuItemID\n RemovePropA\n GetMenu\n SetFocus\n DrawTextA\n LoadIconA\n GetQueueStatus\n CallWindowProcA\n GetInputState\n SendMessageA\n MoveWindow\n SetWindowTextA\n SetDlgItemTextA\nWS2_32.dll (delay-loaded): recv\n htons\n inet_addr\n accept\n listen\n bind\n socket\n WSAStartup\n gethostbyname\n send\n connect\n __WSAFDIsSet\n select\n inet_ntoa\n WSACleanup\n closesocket\n\nLoad Configuration:\n-------------------\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004DACFC\nSEHandlerTable: 0x004B81B0\nSEHandlerCount: 195\n\nDelayed Imports:\n----------------\nAttributes: 0x00000001\nName: WS2_32.dll\nModuleHandle: 0x000E2370\nDelayImportAddressTable: 0x000DC094\nDelayImportNameTable: 0x000BC3B4\nBoundDelayImportTable: 0x000BC3F8\nUnloadDelayImportTable: 0x00000000\nTimeStamp: 1970-Jan-01 00:00:00\n\nRICH Header:\n------------\nXOR Key: 0x041B73B4\nUnmarked objects: 0\n150 (20413): 3\nASM objects (VS2008 build 21022): 28\nC objects (VS2008 build 21022): 162\nC objects (VS2012 build 50727 / VS2005 build 50727): 1\nImports (VS2012 build 50727 / VS2005 build 50727): 7\nTotal imports: 204\nC++ objects (VS2008 build 21022): 76\nResource objects (VS2008 build 21022): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Possibly launches other programs:\n CreateProcessA\n Leverages the raw socket API to access the Internet:\n recv\n htons\n inet_addr\n accept\n listen\n bind\n socket\n WSAStartup\n gethostbyname\n send\n connect\n __WSAFDIsSet\n select\n inet_ntoa\n WSACleanup\n closesocket\n Enumerates local disk drives:\n GetDriveTypeA\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (195 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Jul-10 22:49:27"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2013-Jul-10 22:49:27\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 9.0\nSizeOfCode: 0x000B3200\nSizeOfInitializedData: 0x0002E800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0009B6A7 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x000B5000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 0.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x000E5000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000B31D4\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x000B3200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.43864\n\n.rdata:\n VirtualSize: 0x00008402\n VirtualAddress: 0x000B5000\n SizeOfRawData: 0x00008600\n PointerToRawData: 0x000B3600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.69973\n\n.data:\n VirtualSize: 0x000261E0\n VirtualAddress: 0x000BE000\n SizeOfRawData: 0x0001E200\n PointerToRawData: 0x000BBC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.93056"},"Imports":{"raw":"GDI32.dll: GetDeviceCaps\n SetTextAlign\n GetStretchBltMode\n GetFontLanguageInfo\n SetTextJustification\n GetRandomRgn\n GetPixelFormat\n GetCurrentObject\n UpdateColors\n GetTextAlign\n GetTextCharset\n GetTextCharsetInfo\n GetFontUnicodeRanges\n SetSystemPaletteUse\n SetTextColor\n GetBkColor\n GetNearestColor\n GetDCBrushColor\n GetTextColor\n GetSystemPaletteUse\n SetPixel\n GetPolyFillMode\n GetDCPenColor\n GetMapMode\n GetClipRgn\n GetNearestPaletteIndex\n GetMetaRgn\n SetTextCharacterExtra\n GetTextCharacterExtra\n GetGraphicsMode\nKERNEL32.dll: GetModuleHandleA\n GetProcAddress\n LoadResource\n FindResourceA\n GetDriveTypeA\n WriteFile\n LocalFlags\n IsProcessorFeaturePresent\n GetFileTime\n LockResource\n DeleteFileA\n GlobalSize\n SizeofResource\n MoveFileA\n GetProcessId\n GlobalFlags\n FindClose\n GetProcessHeap\n SetFilePointer\n GetFileType\n GetVersion\n GlobalHandle\n GetCurrentThreadId\n GetTickCount\n GetCurrentProcessId\n IsDebuggerPresent\n GetCurrentProcess\n GetLastError\n QueryPerformanceCounter\n LocalAlloc\n SetEnvironmentVariableA\n CompareStringW\n CompareStringA\n SetEndOfFile\n CreateProcessA\n WaitForSingleObject\n GetExitCodeProcess\n CreateFileA\n FlushFileBuffers\n SetStdHandle\n WriteConsoleW\n GetConsoleOutputCP\n WriteConsoleA\n GetLocaleInfoW\n GetStringTypeW\n GetStringTypeA\n IsValidLocale\n EnumSystemLocalesA\n GetLocaleInfoA\n GetUserDefaultLCID\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n GetEnvironmentStrings\n FreeEnvironmentStringsA\n HeapSize\n GetFileAttributesA\n GetTimeZoneInformation\n SetHandleCount\n ReadFile\n CloseHandle\n GetConsoleMode\n GetConsoleCP\n InitializeCriticalSectionAndSpinCount\n LoadLibraryA\n FreeLibrary\n InterlockedIncrement\n InterlockedDecrement\n WideCharToMultiByte\n Sleep\n InterlockedExchange\n InitializeCriticalSection\n DeleteCriticalSection\n EnterCriticalSection\n LeaveCriticalSection\n MultiByteToWideChar\n GetSystemTimeAsFileTime\n RtlUnwind\n FileTimeToSystemTime\n FileTimeToLocalFileTime\n FindFirstFileA\n TerminateProcess\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n HeapFree\n HeapAlloc\n GetModuleHandleW\n ExitProcess\n HeapReAlloc\n RaiseException\n GetCommandLineA\n GetStartupInfoA\n LCMapStringA\n LCMapStringW\n GetCPInfo\n TlsGetValue\n TlsAlloc\n TlsSetValue\n TlsFree\n SetLastError\n GetFullPathNameA\n GetCurrentDirectoryA\n HeapCreate\n VirtualFree\n VirtualAlloc\n GetStdHandle\n GetModuleFileNameA\n GetACP\n GetOEMCP\n IsValidCodePage\nUSER32.dll: CheckDlgButton\n GetWindowContextHelpId\n IsWindowEnabled\n ShowWindow\n GetPropA\n GetDialogBaseUnits\n GetDlgItemInt\n WindowFromDC\n GetDlgItem\n EndPaint\n PostMessageA\n GetMenuContextHelpId\n GetDC\n GetMenuState\n IsWindowUnicode\n GetWindowDC\n EnableWindow\n GetForegroundWindow\n GetCursor\n BeginPaint\n EndDialog\n GetScrollPos\n GetKeyboardType\n GetWindowLongA\n GetMenuItemCount\n GetMenuCheckMarkDimensions\n GetMenuItemID\n RemovePropA\n GetMenu\n SetFocus\n DrawTextA\n LoadIconA\n GetQueueStatus\n CallWindowProcA\n GetInputState\n SendMessageA\n MoveWindow\n SetWindowTextA\n SetDlgItemTextA\nWS2_32.dll (delay-loaded): recv\n htons\n inet_addr\n accept\n listen\n bind\n socket\n WSAStartup\n gethostbyname\n send\n connect\n __WSAFDIsSet\n select\n inet_ntoa\n WSACleanup\n closesocket\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004DACFC\nSEHandlerTable: 0x004B81B0\nSEHandlerCount: 195\n\nDelayed Imports:\nAttributes: 0x00000001\nName: WS2_32.dll\nModuleHandle: 0x000E2370\nDelayImportAddressTable: 0x000DC094\nDelayImportNameTable: 0x000BC3B4\nBoundDelayImportTable: 0x000BC3F8\nUnloadDelayImportTable: 0x00000000\nTimeStamp: 1970-Jan-01 00:00:00\n\nRICH Header:\nXOR Key: 0x041B73B4\nUnmarked objects: 0\n150 (20413): 3\nASM objects (VS2008 build 21022): 28\nC objects (VS2008 build 21022): 162\nC objects (VS2012 build 50727 / VS2005 build 50727): 1\nImports (VS2012 build 50727 / VS2005 build 50727): 7\nTotal imports: 204\nC++ objects (VS2008 build 21022): 76\nResource objects (VS2008 build 21022): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Possibly launches other programs:\n CreateProcessA\n Leverages the raw socket API to access the Internet:\n recv\n htons\n inet_addr\n accept\n listen\n bind\n socket\n WSAStartup\n gethostbyname\n send\n connect\n __WSAFDIsSet\n select\n inet_ntoa\n WSACleanup\n closesocket\n Enumerates local disk drives:\n GetDriveTypeA\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (195 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{"raw":"Size: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004DACFC\nSEHandlerTable: 0x004B81B0\nSEHandlerCount: 195\n\nDelayed Imports:\nAttributes: 0x00000001\nName: WS2_32.dll\nModuleHandle: 0x000E2370\nDelayImportAddressTable: 0x000DC094\nDelayImportNameTable: 0x000BC3B4\nBoundDelayImportTable: 0x000BC3F8\nUnloadDelayImportTable: 0x00000000\nTimeStamp: 1970-Jan-01 00:00:00"},"RICH Header":{"raw":"XOR Key: 0x041B73B4\nUnmarked objects: 0\n150 (20413): 3\nASM objects (VS2008 build 21022): 28\nC objects (VS2008 build 21022): 162\nC objects (VS2012 build 50727 / VS2005 build 50727): 1\nImports (VS2012 build 50727 / VS2005 build 50727): 7\nTotal imports: 204\nC++ objects (VS2008 build 21022): 76\nResource objects (VS2008 build 21022): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Possibly launches other programs:\n CreateProcessA\n Leverages the raw socket API to access the Internet:\n recv\n htons\n inet_addr\n accept\n listen\n bind\n socket\n WSAStartup\n gethostbyname\n send\n connect\n __WSAFDIsSet\n select\n inet_ntoa\n WSACleanup\n closesocket\n Enumerates local disk drives:\n GetDriveTypeA\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (195 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Nivdort-019f46ced0397a61b6eb666f648767ac.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_hmox5472/output.txt"},"timestamp":"2026-07-10 01:19:43"} {"_id":{"$oid":"6a4fa1c00108394cb24cdcc8"},"sha256":"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa-019f46be0a5e70b1841ab0a3fb675a4c.exe\nDate: 2026-07-10 12:24:41\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa-019f46be0a5e70b1841ab0a3fb675a4c.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2010-Nov-20 09:05:05\nDetected languages: English - United States\nCompanyName: Microsoft Corporation\nFileDescription: DiskPart\nFileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\nInternalName: diskpart.exe\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: diskpart.exe\nProductName: Microsoft® Windows® Operating System\nProductVersion: 6.1.7601.17514\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2010-Nov-20 09:05:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00007000\nSizeOfInitializedData: 0x00352000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000077BA (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00008000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0035A000\nSizeOfHeaders: 0x00001000\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000069B0\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.40424\n\n.rdata:\n VirtualSize: 0x00005F70\n VirtualAddress: 0x00008000\n SizeOfRawData: 0x00006000\n PointerToRawData: 0x00008000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.66357\n\n.data:\n VirtualSize: 0x00001958\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x0000E000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.45575\n\n.rsrc:\n VirtualSize: 0x00349FA0\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x0034A000\n PointerToRawData: 0x00010000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.99987\n\n\nImports:\n--------\nKERNEL32.dll: GetFileAttributesW\n GetFileSizeEx\n CreateFileA\n InitializeCriticalSection\n DeleteCriticalSection\n ReadFile\n GetFileSize\n WriteFile\n LeaveCriticalSection\n EnterCriticalSection\n SetFileAttributesW\n SetCurrentDirectoryW\n CreateDirectoryW\n GetTempPathW\n GetWindowsDirectoryW\n GetFileAttributesA\n SizeofResource\n LockResource\n LoadResource\n MultiByteToWideChar\n Sleep\n OpenMutexA\n GetFullPathNameA\n CopyFileA\n GetModuleFileNameA\n VirtualAlloc\n VirtualFree\n FreeLibrary\n HeapAlloc\n GetProcessHeap\n GetModuleHandleA\n SetLastError\n VirtualProtect\n IsBadReadPtr\n HeapFree\n SystemTimeToFileTime\n LocalFileTimeToFileTime\n CreateDirectoryA\n GetStartupInfoA\n SetFilePointer\n SetFileTime\n GetComputerNameW\n GetCurrentDirectoryA\n SetCurrentDirectoryA\n GlobalAlloc\n LoadLibraryA\n GetProcAddress\n GlobalFree\n CreateProcessA\n CloseHandle\n WaitForSingleObject\n TerminateProcess\n GetExitCodeProcess\n FindResourceA\nUSER32.dll: wsprintfA\nADVAPI32.dll: CreateServiceA\n OpenServiceA\n StartServiceA\n CloseServiceHandle\n CryptReleaseContext\n RegCreateKeyW\n RegSetValueExA\n RegQueryValueExA\n RegCloseKey\n OpenSCManagerA\nMSVCRT.dll: realloc\n fclose\n fwrite\n fread\n fopen\n sprintf\n rand\n srand\n strcpy\n memset\n strlen\n wcscat\n wcslen\n __CxxFrameHandler\n ??3@YAXPAX@Z\n memcmp\n _except_handler3\n _local_unwind2\n wcsrchr\n swprintf\n ??2@YAPAXI@Z\n memcpy\n strcmp\n strrchr\n __p___argv\n __p___argc\n _stricmp\n free\n malloc\n ??0exception@@QAE@ABV0@@Z\n ??1exception@@UAE@XZ\n ??0exception@@QAE@ABQBD@Z\n _CxxThrowException\n calloc\n strcat\n _mbsstr\n ??1type_info@@UAE@XZ\n _exit\n _XcptFilter\n exit\n _acmdln\n __getmainargs\n _initterm\n __setusermatherr\n _adjust_fdiv\n __p__commode\n __p__fmode\n __set_app_type\n _controlfp\n\nResources:\n----------\n2058:\n Type: XIA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 3446325\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99991\n Detected Filetype: Zip Compressed Archive\n\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 904\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52974\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1263\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.03919\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.1.7601.17514\n ProductVersion: 6.1.7601.17514\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: DiskPart\n FileVersion (#2): 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n InternalName: diskpart.exe\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: diskpart.exe\n ProductName: Microsoft® Windows® Operating System\n ProductVersion (#2): 6.1.7601.17514\n\n\nRICH Header:\n------------\nXOR Key: 0x8254A4A4\nUnmarked objects: 0\n12 (7291): 2\nC++ objects (8047): 1\n14 (7299): 4\nC objects (8047): 11\nLinker (8047): 4\nImports (VS2003 (.NET) build 4035): 13\nTotal imports: 163\nC++ objects (VS98 SP6 build 8804): 7\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n Microsoft's Cryptography API\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Can access the registry:\n RegCreateKeyW\n RegSetValueExA\n RegQueryValueExA\n RegCloseKey\n Possibly launches other programs:\n CreateProcessA\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n Can create temporary files:\n CreateFileA\n GetTempPathW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Interacts with services:\n CreateServiceA\n OpenServiceA\n OpenSCManagerA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.1255% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2010-Nov-20 09:05:05\nDetected languages: English - United States\nCompanyName: Microsoft Corporation\nFileDescription: DiskPart\nFileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\nInternalName: diskpart.exe\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: diskpart.exe\nProductName: Microsoft® Windows® Operating System\nProductVersion: 6.1.7601.17514"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2010-Nov-20 09:05:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00007000\nSizeOfInitializedData: 0x00352000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000077BA (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00008000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0035A000\nSizeOfHeaders: 0x00001000\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000069B0\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.40424\n\n.rdata:\n VirtualSize: 0x00005F70\n VirtualAddress: 0x00008000\n SizeOfRawData: 0x00006000\n PointerToRawData: 0x00008000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.66357\n\n.data:\n VirtualSize: 0x00001958\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x0000E000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.45575\n\n.rsrc:\n VirtualSize: 0x00349FA0\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x0034A000\n PointerToRawData: 0x00010000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.99987"},"Imports":{"raw":"KERNEL32.dll: GetFileAttributesW\n GetFileSizeEx\n CreateFileA\n InitializeCriticalSection\n DeleteCriticalSection\n ReadFile\n GetFileSize\n WriteFile\n LeaveCriticalSection\n EnterCriticalSection\n SetFileAttributesW\n SetCurrentDirectoryW\n CreateDirectoryW\n GetTempPathW\n GetWindowsDirectoryW\n GetFileAttributesA\n SizeofResource\n LockResource\n LoadResource\n MultiByteToWideChar\n Sleep\n OpenMutexA\n GetFullPathNameA\n CopyFileA\n GetModuleFileNameA\n VirtualAlloc\n VirtualFree\n FreeLibrary\n HeapAlloc\n GetProcessHeap\n GetModuleHandleA\n SetLastError\n VirtualProtect\n IsBadReadPtr\n HeapFree\n SystemTimeToFileTime\n LocalFileTimeToFileTime\n CreateDirectoryA\n GetStartupInfoA\n SetFilePointer\n SetFileTime\n GetComputerNameW\n GetCurrentDirectoryA\n SetCurrentDirectoryA\n GlobalAlloc\n LoadLibraryA\n GetProcAddress\n GlobalFree\n CreateProcessA\n CloseHandle\n WaitForSingleObject\n TerminateProcess\n GetExitCodeProcess\n FindResourceA\nUSER32.dll: wsprintfA\nADVAPI32.dll: CreateServiceA\n OpenServiceA\n StartServiceA\n CloseServiceHandle\n CryptReleaseContext\n RegCreateKeyW\n RegSetValueExA\n RegQueryValueExA\n RegCloseKey\n OpenSCManagerA\nMSVCRT.dll: realloc\n fclose\n fwrite\n fread\n fopen\n sprintf\n rand\n srand\n strcpy\n memset\n strlen\n wcscat\n wcslen\n __CxxFrameHandler\n ??3@YAXPAX@Z\n memcmp\n _except_handler3\n _local_unwind2\n wcsrchr\n swprintf\n ??2@YAPAXI@Z\n memcpy\n strcmp\n strrchr\n __p___argv\n __p___argc\n _stricmp\n free\n malloc\n ??0exception@@QAE@ABV0@@Z\n ??1exception@@UAE@XZ\n ??0exception@@QAE@ABQBD@Z\n _CxxThrowException\n calloc\n strcat\n _mbsstr\n ??1type_info@@UAE@XZ\n _exit\n _XcptFilter\n exit\n _acmdln\n __getmainargs\n _initterm\n __setusermatherr\n _adjust_fdiv\n __p__commode\n __p__fmode\n __set_app_type\n _controlfp\n\nResources:\n2058:\n Type: XIA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 3446325\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99991\n Detected Filetype: Zip Compressed Archive\n\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 904\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52974\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1263\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.03919\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.1.7601.17514\n ProductVersion: 6.1.7601.17514\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: DiskPart\n FileVersion (#2): 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n InternalName: diskpart.exe\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: diskpart.exe\n ProductName: Microsoft® Windows® Operating System\n ProductVersion (#2): 6.1.7601.17514\n\n\nRICH Header:\nXOR Key: 0x8254A4A4\nUnmarked objects: 0\n12 (7291): 2\nC++ objects (8047): 1\n14 (7299): 4\nC objects (8047): 11\nLinker (8047): 4\nImports (VS2003 (.NET) build 4035): 13\nTotal imports: 163\nC++ objects (VS98 SP6 build 8804): 7\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n Microsoft's Cryptography API\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Can access the registry:\n RegCreateKeyW\n RegSetValueExA\n RegQueryValueExA\n RegCloseKey\n Possibly launches other programs:\n CreateProcessA\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n Can create temporary files:\n CreateFileA\n GetTempPathW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Interacts with services:\n CreateServiceA\n OpenServiceA\n OpenSCManagerA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.1255% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"2058:\n Type: XIA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 3446325\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99991\n Detected Filetype: Zip Compressed Archive\n\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 904\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.52974\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1263\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.03919\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.1.7601.17514\n ProductVersion: 6.1.7601.17514\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: DiskPart\n FileVersion (#2): 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n InternalName: diskpart.exe\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: diskpart.exe\n ProductName: Microsoft® Windows® Operating System\n ProductVersion (#2): 6.1.7601.17514\n\n\nRICH Header:\nXOR Key: 0x8254A4A4\nUnmarked objects: 0\n12 (7291): 2\nC++ objects (8047): 1\n14 (7299): 4\nC objects (8047): 11\nLinker (8047): 4\nImports (VS2003 (.NET) build 4035): 13\nTotal imports: 163\nC++ objects (VS98 SP6 build 8804): 7\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n Microsoft's Cryptography API\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Can access the registry:\n RegCreateKeyW\n RegSetValueExA\n RegQueryValueExA\n RegCloseKey\n Possibly launches other programs:\n CreateProcessA\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n Can create temporary files:\n CreateFileA\n GetTempPathW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Interacts with services:\n CreateServiceA\n OpenServiceA\n OpenSCManagerA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.1255% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x8254A4A4\nUnmarked objects: 0\n12 (7291): 2\nC++ objects (8047): 1\n14 (7299): 4\nC objects (8047): 11\nLinker (8047): 4\nImports (VS2003 (.NET) build 4035): 13\nTotal imports: 163\nC++ objects (VS98 SP6 build 8804): 7\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n Microsoft's Cryptography API\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Can access the registry:\n RegCreateKeyW\n RegSetValueExA\n RegQueryValueExA\n RegCloseKey\n Possibly launches other programs:\n CreateProcessA\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n Can create temporary files:\n CreateFileA\n GetTempPathW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Interacts with services:\n CreateServiceA\n OpenServiceA\n OpenSCManagerA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.1255% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa-019f46be0a5e70b1841ab0a3fb675a4c.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_0fk47xv0/output.txt"},"timestamp":"2026-07-10 12:24:41"} {"_id":{"$oid":"6a4fa7e90108394cb24cdcca"},"sha256":"55504677f82981962d85495231695d3a92aa0b31ec35a957bd9cbbef618658e3","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Win32.Wannacry-019f46be5b007b008f44380f3d6b7c78.exe\nDate: 2026-07-09 19:23:45\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Win32.Wannacry-019f46be5b007b008f44380f3d6b7c78.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-May-11 12:21:37\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2017-May-11 12:21:37\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00001000\nSizeOfInitializedData: 0x00504000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000011E9 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00002000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00506000\nSizeOfHeaders: 0x00001000\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000028C\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 1.443\n\n.rdata:\n VirtualSize: 0x000001D8\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00002000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.734602\n\n.data:\n VirtualSize: 0x00000154\n VirtualAddress: 0x00003000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00003000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.0852387\n\n.rsrc:\n VirtualSize: 0x00500060\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x00501000\n PointerToRawData: 0x00004000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.74214\n\n.reloc:\n VirtualSize: 0x000002AC\n VirtualAddress: 0x00505000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00505000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0\n\n\nImports:\n--------\nKERNEL32.dll: CloseHandle\n WriteFile\n CreateFileA\n SizeofResource\n LockResource\n LoadResource\n FindResourceA\n CreateProcessA\nMSVCRT.dll: free\n _initterm\n malloc\n _adjust_fdiv\n sprintf\n\nExports:\n--------\nPlayGame:\n Ordinal: 1\n Address: 0x00001114\n\n\nResources:\n----------\n101:\n Type: W\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5242880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.74511\n\n\nRICH Header:\n------------\nXOR Key: 0x0C1CFD39\nUnmarked objects: 0\nC objects (VS98 build 8168): 4\nTotal imports: 15\nImports (VS2003 (.NET) build 4035): 3\nC++ objects (VS98 build 8168): 1\nResource objects (VS98 cvtres build 1720): 1\nLinker (VS98 build 8168): 3\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n 2Fdts.search.ask.com\n google.com\n http://wireless.unair.ac.id\n http://wireless.unair.ac.id/login?dst\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n http://www.sciencedirect.com\n http://www.sciencedirect.com/science/article/pii/S2352250X17301884/pdfft?md5\n http://www.search.ask.com\n http://www.search.ask.com/web?apn_dtid\n http://www.search.ask.com/web?l\n http://www.search.ask.com/web?q\n https://accounts.google.co.id\n https://accounts.google.co.id/accounts/SetSID?ssdc\n https://mail.google.com\n https://mail.google.com/mail/?auth%3DIQWcD5bS6dHIPAdUnr7YE63CdXsU6o5SpbVnn18jpNaZObI1Qi9iherHmuW9dmXac2L75A.%26authuser%3D1\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n mail.google.com\n sciencedirect.com\n search.ask.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n www.sciencedirect.com\n www.search.ask.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 99.5334% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 3 bytes of data starting at offset 0x506000.\n\n\n\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-May-11 12:21:37\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2017-May-11 12:21:37\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00001000\nSizeOfInitializedData: 0x00504000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000011E9 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00002000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00506000\nSizeOfHeaders: 0x00001000\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000028C\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 1.443\n\n.rdata:\n VirtualSize: 0x000001D8\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00002000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0.734602\n\n.data:\n VirtualSize: 0x00000154\n VirtualAddress: 0x00003000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00003000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.0852387\n\n.rsrc:\n VirtualSize: 0x00500060\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x00501000\n PointerToRawData: 0x00004000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.74214\n\n.reloc:\n VirtualSize: 0x000002AC\n VirtualAddress: 0x00505000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00505000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0"},"Imports":{"raw":"KERNEL32.dll: CloseHandle\n WriteFile\n CreateFileA\n SizeofResource\n LockResource\n LoadResource\n FindResourceA\n CreateProcessA\nMSVCRT.dll: free\n _initterm\n malloc\n _adjust_fdiv\n sprintf"},"Exports":{"raw":"PlayGame:\n Ordinal: 1\n Address: 0x00001114"},"Resources":{"raw":"101:\n Type: W\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5242880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.74511\n\n\nRICH Header:\nXOR Key: 0x0C1CFD39\nUnmarked objects: 0\nC objects (VS98 build 8168): 4\nTotal imports: 15\nImports (VS2003 (.NET) build 4035): 3\nC++ objects (VS98 build 8168): 1\nResource objects (VS98 cvtres build 1720): 1\nLinker (VS98 build 8168): 3\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n 2Fdts.search.ask.com\n google.com\n http://wireless.unair.ac.id\n http://wireless.unair.ac.id/login?dst\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n http://www.sciencedirect.com\n http://www.sciencedirect.com/science/article/pii/S2352250X17301884/pdfft?md5\n http://www.search.ask.com\n http://www.search.ask.com/web?apn_dtid\n http://www.search.ask.com/web?l\n http://www.search.ask.com/web?q\n https://accounts.google.co.id\n https://accounts.google.co.id/accounts/SetSID?ssdc\n https://mail.google.com\n https://mail.google.com/mail/?auth%3DIQWcD5bS6dHIPAdUnr7YE63CdXsU6o5SpbVnn18jpNaZObI1Qi9iherHmuW9dmXac2L75A.%26authuser%3D1\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n mail.google.com\n sciencedirect.com\n search.ask.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n www.sciencedirect.com\n www.search.ask.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 99.5334% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 3 bytes of data starting at offset 0x506000.\n\n\n\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x0C1CFD39\nUnmarked objects: 0\nC objects (VS98 build 8168): 4\nTotal imports: 15\nImports (VS2003 (.NET) build 4035): 3\nC++ objects (VS98 build 8168): 1\nResource objects (VS98 cvtres build 1720): 1\nLinker (VS98 build 8168): 3\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n 2Fdts.search.ask.com\n google.com\n http://wireless.unair.ac.id\n http://wireless.unair.ac.id/login?dst\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n http://www.sciencedirect.com\n http://www.sciencedirect.com/science/article/pii/S2352250X17301884/pdfft?md5\n http://www.search.ask.com\n http://www.search.ask.com/web?apn_dtid\n http://www.search.ask.com/web?l\n http://www.search.ask.com/web?q\n https://accounts.google.co.id\n https://accounts.google.co.id/accounts/SetSID?ssdc\n https://mail.google.com\n https://mail.google.com/mail/?auth%3DIQWcD5bS6dHIPAdUnr7YE63CdXsU6o5SpbVnn18jpNaZObI1Qi9iherHmuW9dmXac2L75A.%26authuser%3D1\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n mail.google.com\n sciencedirect.com\n search.ask.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n www.sciencedirect.com\n www.search.ask.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 99.5334% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 3 bytes of data starting at offset 0x506000.\n\n\n\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Win32.Wannacry-019f46be5b007b008f44380f3d6b7c78.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_o11cnp5x/output.txt"},"timestamp":"2026-07-09 19:23:45"} {"_id":{"$oid":"6a4faa320108394cb24cdcce"},"sha256":"ddf2542dc5ac74a98d5ee9e55497572104d6c880aad9137caf884d10ca5953ce","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Somoto-019f46cb30ff74629c5dbc498a84a55e.exe\nDate: 2026-07-09 22:19:46\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Somoto-019f46cb30ff74629c5dbc498a84a55e.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2010-Dec-17 09:14:12\nDetected languages: English - United States\nCompanyName: \nFileDescription: Powered by BetterInstaller\nFileVersion: 2.0.0.0\nLegalCopyright: \nProductName: \nProductVersion: \n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 7\nTimeDateStamp: 2010-Dec-17 09:14:12\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00007200\nSizeOfInitializedData: 0x00003A00\nSizeOfUninitializedData: 0x0001B000\nAddressOfEntryPoint: 0x000039AC (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00009000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00035000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000070BC\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.30324\n\n.data:\n VirtualSize: 0x0000008C\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.18045\n\n.rdata:\n VirtualSize: 0x00000C7C\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x00007800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.1135\n\n.bss:\n VirtualSize: 0x0001AE08\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00001344\n VirtualAddress: 0x00026000\n SizeOfRawData: 0x00001400\n PointerToRawData: 0x00008600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.09883\n\n.ndata:\n VirtualSize: 0x00008000\n VirtualAddress: 0x00028000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00009A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.rsrc:\n VirtualSize: 0x00004588\n VirtualAddress: 0x00030000\n SizeOfRawData: 0x00004600\n PointerToRawData: 0x00009E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.69789\n\n\nImports:\n--------\nADVAPI32.DLL: RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\nCOMCTL32.DLL: ImageList_AddMasked\n ImageList_Create\n ImageList_Destroy\n InitCommonControls\nGDI32.dll: CreateBrushIndirect\n CreateFontIndirectA\n DeleteObject\n GetDeviceCaps\n SelectObject\n SetBkColor\n SetBkMode\n SetTextColor\nKERNEL32.dll: CloseHandle\n CompareFileTime\n CopyFileA\n CreateDirectoryA\n CreateFileA\n CreateProcessA\n CreateThread\n DeleteFileA\n ExitProcess\n ExpandEnvironmentStringsA\n FindClose\n FindFirstFileA\n FindNextFileA\n FreeLibrary\n GetCommandLineA\n GetCurrentProcess\n GetDiskFreeSpaceA\n GetExitCodeProcess\n GetFileAttributesA\n GetFileSize\n GetFullPathNameA\n GetLastError\n GetModuleFileNameA\n GetModuleHandleA\n GetPrivateProfileStringA\n GetProcAddress\n GetShortPathNameA\n GetSystemDirectoryA\n GetTempFileNameA\n GetTempPathA\n GetTickCount\n GetVersion\n GetWindowsDirectoryA\n GlobalAlloc\n GlobalFree\n GlobalLock\n GlobalUnlock\n LoadLibraryA\n LoadLibraryExA\n MoveFileA\n MulDiv\n MultiByteToWideChar\n ReadFile\n RemoveDirectoryA\n SearchPathA\n SetCurrentDirectoryA\n SetErrorMode\n SetFileAttributesA\n SetFilePointer\n SetFileTime\n Sleep\n WaitForSingleObject\n WriteFile\n WritePrivateProfileStringA\n lstrcatA\n lstrcmpA\n lstrcmpiA\n lstrcpynA\n lstrlenA\nOLE32.dll: CoCreateInstance\n CoTaskMemFree\n OleInitialize\n OleUninitialize\nSHELL32.DLL: SHBrowseForFolderA\n SHFileOperationA\n SHGetFileInfoA\n SHGetPathFromIDListA\n SHGetSpecialFolderLocation\n ShellExecuteA\nUSER32.dll: AppendMenuA\n BeginPaint\n CallWindowProcA\n CharNextA\n CharPrevA\n CheckDlgButton\n CloseClipboard\n CreateDialogParamA\n CreatePopupMenu\n CreateWindowExA\n DefWindowProcA\n DestroyWindow\n DialogBoxParamA\n DispatchMessageA\n DrawTextA\n EmptyClipboard\n EnableMenuItem\n EnableWindow\n EndDialog\n EndPaint\n ExitWindowsEx\n FillRect\n FindWindowExA\n GetClassInfoA\n GetClientRect\n GetDC\n GetDlgItem\n GetDlgItemTextA\n GetMessagePos\n GetSysColor\n GetSystemMenu\n GetSystemMetrics\n GetWindowLongA\n GetWindowRect\n InvalidateRect\n IsWindow\n IsWindowEnabled\n IsWindowVisible\n LoadBitmapA\n LoadCursorA\n LoadImageA\n MessageBoxIndirectA\n OpenClipboard\n PeekMessageA\n PostQuitMessage\n RegisterClassA\n ScreenToClient\n SendMessageA\n SendMessageTimeoutA\n SetClassLongA\n SetClipboardData\n SetCursor\n SetDlgItemTextA\n SetForegroundWindow\n SetTimer\n SetWindowLongA\n SetWindowPos\n SetWindowTextA\n ShowWindow\n SystemParametersInfoA\n TrackPopupMenu\n wsprintfA\nVERSION.dll: GetFileVersionInfoA\n GetFileVersionInfoSizeA\n VerQueryValueA\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.50639\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.72073\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.86997\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 280\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.68696\n\n106:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.78455\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.45849\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 516\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05491\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 958\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.21482\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 2.0.0.0\n ProductVersion: 2.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: \n FileDescription: Powered by BetterInstaller\n FileVersion (#2): 2.0.0.0\n LegalCopyright: \n ProductName: \n ProductVersion (#2): \n\n\nInteresting strings found in the binary:\n Contains domain names:\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n nsis.sf.net\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExA\n Can access the registry:\n RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Somoto Ltd.\n Issuer: COMODO Code Signing CA 2\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2010-Dec-17 09:14:12\nDetected languages: English - United States\nCompanyName: \nFileDescription: Powered by BetterInstaller\nFileVersion: 2.0.0.0\nLegalCopyright: \nProductName: \nProductVersion:"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 7\nTimeDateStamp: 2010-Dec-17 09:14:12\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00007200\nSizeOfInitializedData: 0x00003A00\nSizeOfUninitializedData: 0x0001B000\nAddressOfEntryPoint: 0x000039AC (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00009000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00035000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000070BC\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.30324\n\n.data:\n VirtualSize: 0x0000008C\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.18045\n\n.rdata:\n VirtualSize: 0x00000C7C\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x00007800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.1135\n\n.bss:\n VirtualSize: 0x0001AE08\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00001344\n VirtualAddress: 0x00026000\n SizeOfRawData: 0x00001400\n PointerToRawData: 0x00008600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.09883\n\n.ndata:\n VirtualSize: 0x00008000\n VirtualAddress: 0x00028000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00009A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.rsrc:\n VirtualSize: 0x00004588\n VirtualAddress: 0x00030000\n SizeOfRawData: 0x00004600\n PointerToRawData: 0x00009E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.69789"},"Imports":{"raw":"ADVAPI32.DLL: RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\nCOMCTL32.DLL: ImageList_AddMasked\n ImageList_Create\n ImageList_Destroy\n InitCommonControls\nGDI32.dll: CreateBrushIndirect\n CreateFontIndirectA\n DeleteObject\n GetDeviceCaps\n SelectObject\n SetBkColor\n SetBkMode\n SetTextColor\nKERNEL32.dll: CloseHandle\n CompareFileTime\n CopyFileA\n CreateDirectoryA\n CreateFileA\n CreateProcessA\n CreateThread\n DeleteFileA\n ExitProcess\n ExpandEnvironmentStringsA\n FindClose\n FindFirstFileA\n FindNextFileA\n FreeLibrary\n GetCommandLineA\n GetCurrentProcess\n GetDiskFreeSpaceA\n GetExitCodeProcess\n GetFileAttributesA\n GetFileSize\n GetFullPathNameA\n GetLastError\n GetModuleFileNameA\n GetModuleHandleA\n GetPrivateProfileStringA\n GetProcAddress\n GetShortPathNameA\n GetSystemDirectoryA\n GetTempFileNameA\n GetTempPathA\n GetTickCount\n GetVersion\n GetWindowsDirectoryA\n GlobalAlloc\n GlobalFree\n GlobalLock\n GlobalUnlock\n LoadLibraryA\n LoadLibraryExA\n MoveFileA\n MulDiv\n MultiByteToWideChar\n ReadFile\n RemoveDirectoryA\n SearchPathA\n SetCurrentDirectoryA\n SetErrorMode\n SetFileAttributesA\n SetFilePointer\n SetFileTime\n Sleep\n WaitForSingleObject\n WriteFile\n WritePrivateProfileStringA\n lstrcatA\n lstrcmpA\n lstrcmpiA\n lstrcpynA\n lstrlenA\nOLE32.dll: CoCreateInstance\n CoTaskMemFree\n OleInitialize\n OleUninitialize\nSHELL32.DLL: SHBrowseForFolderA\n SHFileOperationA\n SHGetFileInfoA\n SHGetPathFromIDListA\n SHGetSpecialFolderLocation\n ShellExecuteA\nUSER32.dll: AppendMenuA\n BeginPaint\n CallWindowProcA\n CharNextA\n CharPrevA\n CheckDlgButton\n CloseClipboard\n CreateDialogParamA\n CreatePopupMenu\n CreateWindowExA\n DefWindowProcA\n DestroyWindow\n DialogBoxParamA\n DispatchMessageA\n DrawTextA\n EmptyClipboard\n EnableMenuItem\n EnableWindow\n EndDialog\n EndPaint\n ExitWindowsEx\n FillRect\n FindWindowExA\n GetClassInfoA\n GetClientRect\n GetDC\n GetDlgItem\n GetDlgItemTextA\n GetMessagePos\n GetSysColor\n GetSystemMenu\n GetSystemMetrics\n GetWindowLongA\n GetWindowRect\n InvalidateRect\n IsWindow\n IsWindowEnabled\n IsWindowVisible\n LoadBitmapA\n LoadCursorA\n LoadImageA\n MessageBoxIndirectA\n OpenClipboard\n PeekMessageA\n PostQuitMessage\n RegisterClassA\n ScreenToClient\n SendMessageA\n SendMessageTimeoutA\n SetClassLongA\n SetClipboardData\n SetCursor\n SetDlgItemTextA\n SetForegroundWindow\n SetTimer\n SetWindowLongA\n SetWindowPos\n SetWindowTextA\n ShowWindow\n SystemParametersInfoA\n TrackPopupMenu\n wsprintfA\nVERSION.dll: GetFileVersionInfoA\n GetFileVersionInfoSizeA\n VerQueryValueA\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.50639\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.72073\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.86997\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 280\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.68696\n\n106:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.78455\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.45849\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 516\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05491\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 958\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.21482\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 2.0.0.0\n ProductVersion: 2.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: \n FileDescription: Powered by BetterInstaller\n FileVersion (#2): 2.0.0.0\n LegalCopyright: \n ProductName: \n ProductVersion (#2): \n\n\nInteresting strings found in the binary:\n Contains domain names:\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n nsis.sf.net\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExA\n Can access the registry:\n RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Somoto Ltd.\n Issuer: COMODO Code Signing CA 2\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.50639\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.72073\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.86997\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 280\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.68696\n\n106:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.78455\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 2010-Dec-17 09:14:12\n Entropy: 2.45849\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 516\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05491\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 958\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.21482\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 2.0.0.0\n ProductVersion: 2.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: \n FileDescription: Powered by BetterInstaller\n FileVersion (#2): 2.0.0.0\n LegalCopyright: \n ProductName: \n ProductVersion (#2): \n\n\nInteresting strings found in the binary:\n Contains domain names:\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n nsis.sf.net\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExA\n Can access the registry:\n RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Somoto Ltd.\n Issuer: COMODO Code Signing CA 2\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{"raw":"Contains domain names:\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n nsis.sf.net\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExA\n Can access the registry:\n RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Somoto Ltd.\n Issuer: COMODO Code Signing CA 2\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/Somoto-019f46cb30ff74629c5dbc498a84a55e.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_f189o6nl/output.txt"},"timestamp":"2026-07-09 22:19:46"} {"_id":{"$oid":"6a4fbb6d0108394cb24cdcd4"},"sha256":"0d8d45f33c3be34a5523241113bdc5bac128630a9ceb879f67f0aa877787f08f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Friday_the_13th.408-019f46c9b92c7f60a959d8da4a0f24d1.com\nDate: 2026-07-09 20:47:01\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Friday_the_13th.408-019f46c9b92c7f60a959d8da4a0f24d1.com!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Friday_the_13th.408-019f46c9b92c7f60a959d8da4a0f24d1.com"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_zyg85xmt/output.txt"},"timestamp":"2026-07-09 20:47:01"} {"_id":{"$oid":"6a4fbbd10108394cb24cdcd6"},"sha256":"527511694daa041f613b9f5fbdae45062bc69dc655f3f584ccba725cd418ea5c","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Friday_the_13th.416.A-019f46c9d29e7ae1b1dcb7709b878fda.com\nDate: 2026-07-09 20:48:41\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Friday_the_13th.416.A-019f46c9d29e7ae1b1dcb7709b878fda.com!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Friday_the_13th.416.A-019f46c9d29e7ae1b1dcb7709b878fda.com"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_s1tzq4vz/output.txt"},"timestamp":"2026-07-09 20:48:41"} {"_id":{"$oid":"6a4fbeed0108394cb24cdcda"},"sha256":"6e391ec12f638b91dfee7d7cfc5cd4f47683fc9a2d1fdc88e96956f7f36a60fc","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Friday_the_13th.416.B-019f46ca0a4e7010bc9b23655fc3f78a.com\nDate: 2026-07-09 21:01:57\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Friday_the_13th.416.B-019f46ca0a4e7010bc9b23655fc3f78a.com!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Friday_the_13th.416.B-019f46ca0a4e7010bc9b23655fc3f78a.com"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_u0lo7s6s/output.txt"},"timestamp":"2026-07-09 21:01:57"} {"_id":{"$oid":"6a4fc2590108394cb24cdcdf"},"sha256":"834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/InstallBC201401-019f46c5a43678739e5341f28c14821d.exe\nDate: 2026-07-09 21:16:33\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/InstallBC201401-019f46c5a43678739e5341f28c14821d.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Dec-25 02:09:40\nDebug artifacts: D:\\Dev\\Tin9\\InstallDir\\vc80-win32u\\Loader.pdb\nProductName: CSRS-FERS Benefits Calculator and Retirement Analyzer\nProductVersion: v14.01\nCompanyName: Decision Support Software LLC\nLegalCopyright: Copyright © 2014 Decision Support Software LLC\nEmail: ActivationDepartment@FedRetireSoftware.com\nWebSite: http://www.FedRetireSoftware.com\nFileDescription: Installer for CSRS-FERS Benefits Calculator and Retirement Analy\nFileVersion: 2014.1.4.1230\nInternalName: TSULoader\nOriginalFilename: TSULoader.exe\nComments: WinNT (x86) Unicode Lib Rel\nProductCode: {1E453EA8-BB42-419D-8067-D2477A36B761}\nPackageCode: {D449BC32-6D28-4AF0-BB00-AB3391EF0F9A}\nArguments: \nSpecialBuild: \n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 7\nTimeDateStamp: 2013-Dec-25 02:09:40\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00001E00\nSizeOfInitializedData: 0x00CBE400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00001495 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00003000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00CC6000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00CC56F4\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00001DBB\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00001E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.47323\n\n.rdata:\n VirtualSize: 0x000006FE\n VirtualAddress: 0x00003000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00002200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.69859\n\n.data:\n VirtualSize: 0x0000040C\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rsrc:\n VirtualSize: 0x00002060\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00002200\n PointerToRawData: 0x00002A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.50655\n\n.reloc:\n VirtualSize: 0x00000160\n VirtualAddress: 0x00008000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00004C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.02908\n\n.tsustub:\n VirtualSize: 0x0001E4CA\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x0001E600\n PointerToRawData: 0x00004E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99748\n\n.tsuarch:\n VirtualSize: 0x00C9D200\n VirtualAddress: 0x00028000\n SizeOfRawData: 0x00C9D200\n PointerToRawData: 0x00023400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99999\n\n\nImports:\n--------\nKERNEL32.dll: OutputDebugStringA\n lstrcpynW\n UnmapViewOfFile\n MultiByteToWideChar\n MapViewOfFile\n CloseHandle\n CreateFileMappingW\n GetFileSize\n CreateFileW\n lstrlenW\n GetCommandLineW\n ExitProcess\n Sleep\n DeleteFileW\n SetFileAttributesW\n GetFileAttributesW\n FreeLibrary\n GetProcAddress\n LoadLibraryW\n GetTempPathW\n GetModuleHandleW\n GetLastError\n GetModuleFileNameW\n GetTickCount\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n GetCurrentProcessId\n HeapAlloc\n GetProcessHeap\n HeapFree\n ReadFile\n WriteFile\n SetFileTime\n SetFilePointer\nUSER32.dll: MessageBoxA\n wvsprintfA\n wsprintfW\n PostMessageW\nVERSION.dll: GetFileVersionInfoW\n GetFileVersionInfoSizeW\n VerQueryValueW\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.91708\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28155\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28728\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.7193\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2212\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.71323\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 833\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.15019\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2014.1.4.1230\n ProductVersion: 0.0.0.0\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n ProductName: CSRS-FERS Benefits Calculator and Retirement Analyzer\n ProductVersion (#2): v14.01\n CompanyName: Decision Support Software LLC\n LegalCopyright: Copyright © 2014 Decision Support Software LLC\n Email: ActivationDepartment@FedRetireSoftware.com\n WebSite: http://www.FedRetireSoftware.com\n FileDescription: Installer for CSRS-FERS Benefits Calculator and Retirement Analy\n FileVersion (#2): 2014.1.4.1230\n InternalName: TSULoader\n OriginalFilename: TSULoader.exe\n Comments: WinNT (x86) Unicode Lib Rel\n ProductCode: {1E453EA8-BB42-419D-8067-D2477A36B761}\n PackageCode: {D449BC32-6D28-4AF0-BB00-AB3391EF0F9A}\n Arguments: \n SpecialBuild: \n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2013-Dec-25 02:09:40\n Version: 0.0\n SizeofData: 70\n AddressOfRawData: 0x000036B8\n PointerToRawData: 0x000028B8\n Referenced File: D:\\Dev\\Tin9\\InstallDir\\vc80-win32u\\Loader.pdb\n\n\nRICH Header:\n------------\nXOR Key: 0xD07C1CFB\nUnmarked objects: 0\nImports (VS2003 (.NET) build 4035): 7\nTotal imports: 44\nC objects (VS2012 build 50727 / VS2005 build 50727): 4\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 1\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nUnmarked objects (#2): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n FedRetireSoftware.com\n http://www.FedRetireSoftware.com\n www.FedRetireSoftware.com\n\n[ SUSPICIOUS ] This PE is packed with TSULoader\n Unusual section name found: .tsustub\n Unusual section name found: .tsuarch\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Dec-25 02:09:40\nDebug artifacts: D:\\Dev\\Tin9\\InstallDir\\vc80-win32u\\Loader.pdb\nProductName: CSRS-FERS Benefits Calculator and Retirement Analyzer\nProductVersion: v14.01\nCompanyName: Decision Support Software LLC\nLegalCopyright: Copyright © 2014 Decision Support Software LLC\nEmail: ActivationDepartment@FedRetireSoftware.com\nWebSite: http://www.FedRetireSoftware.com\nFileDescription: Installer for CSRS-FERS Benefits Calculator and Retirement Analy\nFileVersion: 2014.1.4.1230\nInternalName: TSULoader\nOriginalFilename: TSULoader.exe\nComments: WinNT (x86) Unicode Lib Rel\nProductCode: {1E453EA8-BB42-419D-8067-D2477A36B761}\nPackageCode: {D449BC32-6D28-4AF0-BB00-AB3391EF0F9A}\nArguments: \nSpecialBuild:"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 7\nTimeDateStamp: 2013-Dec-25 02:09:40\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00001E00\nSizeOfInitializedData: 0x00CBE400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00001495 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00003000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00CC6000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00CC56F4\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00001DBB\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00001E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.47323\n\n.rdata:\n VirtualSize: 0x000006FE\n VirtualAddress: 0x00003000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00002200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.69859\n\n.data:\n VirtualSize: 0x0000040C\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rsrc:\n VirtualSize: 0x00002060\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00002200\n PointerToRawData: 0x00002A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.50655\n\n.reloc:\n VirtualSize: 0x00000160\n VirtualAddress: 0x00008000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00004C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.02908\n\n.tsustub:\n VirtualSize: 0x0001E4CA\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x0001E600\n PointerToRawData: 0x00004E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99748\n\n.tsuarch:\n VirtualSize: 0x00C9D200\n VirtualAddress: 0x00028000\n SizeOfRawData: 0x00C9D200\n PointerToRawData: 0x00023400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99999"},"Imports":{"raw":"KERNEL32.dll: OutputDebugStringA\n lstrcpynW\n UnmapViewOfFile\n MultiByteToWideChar\n MapViewOfFile\n CloseHandle\n CreateFileMappingW\n GetFileSize\n CreateFileW\n lstrlenW\n GetCommandLineW\n ExitProcess\n Sleep\n DeleteFileW\n SetFileAttributesW\n GetFileAttributesW\n FreeLibrary\n GetProcAddress\n LoadLibraryW\n GetTempPathW\n GetModuleHandleW\n GetLastError\n GetModuleFileNameW\n GetTickCount\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n GetCurrentProcessId\n HeapAlloc\n GetProcessHeap\n HeapFree\n ReadFile\n WriteFile\n SetFileTime\n SetFilePointer\nUSER32.dll: MessageBoxA\n wvsprintfA\n wsprintfW\n PostMessageW\nVERSION.dll: GetFileVersionInfoW\n GetFileVersionInfoSizeW\n VerQueryValueW\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.91708\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28155\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28728\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.7193\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2212\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.71323\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 833\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.15019\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2014.1.4.1230\n ProductVersion: 0.0.0.0\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n ProductName: CSRS-FERS Benefits Calculator and Retirement Analyzer\n ProductVersion (#2): v14.01\n CompanyName: Decision Support Software LLC\n LegalCopyright: Copyright © 2014 Decision Support Software LLC\n Email: ActivationDepartment@FedRetireSoftware.com\n WebSite: http://www.FedRetireSoftware.com\n FileDescription: Installer for CSRS-FERS Benefits Calculator and Retirement Analy\n FileVersion (#2): 2014.1.4.1230\n InternalName: TSULoader\n OriginalFilename: TSULoader.exe\n Comments: WinNT (x86) Unicode Lib Rel\n ProductCode: {1E453EA8-BB42-419D-8067-D2477A36B761}\n PackageCode: {D449BC32-6D28-4AF0-BB00-AB3391EF0F9A}\n Arguments: \n SpecialBuild: \n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2013-Dec-25 02:09:40\n Version: 0.0\n SizeofData: 70\n AddressOfRawData: 0x000036B8\n PointerToRawData: 0x000028B8\n Referenced File: D:\\Dev\\Tin9\\InstallDir\\vc80-win32u\\Loader.pdb\n\n\nRICH Header:\nXOR Key: 0xD07C1CFB\nUnmarked objects: 0\nImports (VS2003 (.NET) build 4035): 7\nTotal imports: 44\nC objects (VS2012 build 50727 / VS2005 build 50727): 4\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 1\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nUnmarked objects (#2): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n FedRetireSoftware.com\n http://www.FedRetireSoftware.com\n www.FedRetireSoftware.com\n\n[ SUSPICIOUS ] This PE is packed with TSULoader\n Unusual section name found: .tsustub\n Unusual section name found: .tsuarch\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.91708\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28155\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28728\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.7193\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2212\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.71323\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 833\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.15019\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2014.1.4.1230\n ProductVersion: 0.0.0.0\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n ProductName: CSRS-FERS Benefits Calculator and Retirement Analyzer\n ProductVersion (#2): v14.01\n CompanyName: Decision Support Software LLC\n LegalCopyright: Copyright © 2014 Decision Support Software LLC\n Email: ActivationDepartment@FedRetireSoftware.com\n WebSite: http://www.FedRetireSoftware.com\n FileDescription: Installer for CSRS-FERS Benefits Calculator and Retirement Analy\n FileVersion (#2): 2014.1.4.1230\n InternalName: TSULoader\n OriginalFilename: TSULoader.exe\n Comments: WinNT (x86) Unicode Lib Rel\n ProductCode: {1E453EA8-BB42-419D-8067-D2477A36B761}\n PackageCode: {D449BC32-6D28-4AF0-BB00-AB3391EF0F9A}\n Arguments: \n SpecialBuild:"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2013-Dec-25 02:09:40\n Version: 0.0\n SizeofData: 70\n AddressOfRawData: 0x000036B8\n PointerToRawData: 0x000028B8\n Referenced File: D:\\Dev\\Tin9\\InstallDir\\vc80-win32u\\Loader.pdb\n\n\nRICH Header:\nXOR Key: 0xD07C1CFB\nUnmarked objects: 0\nImports (VS2003 (.NET) build 4035): 7\nTotal imports: 44\nC objects (VS2012 build 50727 / VS2005 build 50727): 4\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 1\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nUnmarked objects (#2): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n FedRetireSoftware.com\n http://www.FedRetireSoftware.com\n www.FedRetireSoftware.com\n\n[ SUSPICIOUS ] This PE is packed with TSULoader\n Unusual section name found: .tsustub\n Unusual section name found: .tsuarch\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0xD07C1CFB\nUnmarked objects: 0\nImports (VS2003 (.NET) build 4035): 7\nTotal imports: 44\nC objects (VS2012 build 50727 / VS2005 build 50727): 4\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 1\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nUnmarked objects (#2): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1"},"Interesting strings found in the binary":{"raw":"Contains domain names:\n FedRetireSoftware.com\n http://www.FedRetireSoftware.com\n www.FedRetireSoftware.com\n\n[ SUSPICIOUS ] This PE is packed with TSULoader\n Unusual section name found: .tsustub\n Unusual section name found: .tsuarch\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/InstallBC201401-019f46c5a43678739e5341f28c14821d.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_kbtp4z7q/output.txt"},"timestamp":"2026-07-09 21:16:33"} {"_id":{"$oid":"6a4fc2970108394cb24cdce0"},"sha256":"2b89d0638a967deec3a203472dccbaf331a2a806efe85ec8b6b57da6f55c3552","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Friday_the_13th.540.A-019f46ca357379839bddcbeb9989ac8b.com\nDate: 2026-07-09 21:17:35\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Friday_the_13th.540.A-019f46ca357379839bddcbeb9989ac8b.com!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Friday_the_13th.540.A-019f46ca357379839bddcbeb9989ac8b.com"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_metly41o/output.txt"},"timestamp":"2026-07-09 21:17:35"} {"_id":{"$oid":"6a4fc2f00108394cb24cdce3"},"sha256":"df7409e284e6a62f07d790e9c4a436b7217a842983c1c1aea93a9cb77fc64f29","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/df7409e284e6a62f07d790e9c4a436b7217a842983c1c1aea93a9cb77fc64f29-019f74fad94476c1848071113c8911a3\nDate: 2026-07-18 16:59:05\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/df7409e284e6a62f07d790e9c4a436b7217a842983c1c1aea93a9cb77fc64f29-019f74fad94476c1848071113c8911a3!\nDetected file type(s):\n\tWord Document\n\tOLE Compound File\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/df7409e284e6a62f07d790e9c4a436b7217a842983c1c1aea93a9cb77fc64f29-019f74fad94476c1848071113c8911a3"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_r6v5hby7/output.txt"},"timestamp":"2026-07-18 16:59:05"} {"_id":{"$oid":"6a4fc3b00108394cb24cdce7"},"sha256":"b12cd68c5712badcf74719ab5315c9615896539e84e95b88b996abe956e5f8b3","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Win32.ShadowHammer-019f46ca96c37511b6601e00ec2dd212.bin\nDate: 2026-07-09 21:22:16\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Win32.ShadowHammer-019f46ca96c37511b6601e00ec2dd212.bin!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Win32.ShadowHammer-019f46ca96c37511b6601e00ec2dd212.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_cvbropms/output.txt"},"timestamp":"2026-07-09 21:22:16"} {"_id":{"$oid":"6a4fc6520108394cb24cdcea"},"sha256":"9d88425e266b3a74045186837fbd71de657b47d11efefcf8b3cd185a884b5306","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/TrojanWin32.Duqu.Stuxnet-019f46cab6a272e0abc2b0a2836dd472.exe\nDate: 2026-07-09 21:33:30\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/TrojanWin32.Duqu.Stuxnet-019f46cab6a272e0abc2b0a2836dd472.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_NATIVE\nCompilation Date: 2011-Oct-17 19:06:28\nDetected languages: English - United States\nCompanyName: IBM Corporation ©\nFileDescription: IBM ServeRAID Controller Driver\nFileVersion: 4.33.0.12\nInternalName: nfrd965.sys\nInternalCopyright: (C) Copyright IBM Corp. 1994, 2002.\nOriginalFilename: nfrd965.sys\nProductName: IBM ServeRAID Contoller\nProductVersion: 4.33.0.12\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 6\nTimeDateStamp: 2011-Oct-17 19:06:28\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00003600\nSizeOfInitializedData: 0x00002880\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000570 (Section: .text)\nBaseOfCode: 0x00000300\nBaseOfData: 0x00003380\nImageBase: 0x00010000\nSectionAlignment: 0x00000080\nFileAlignment: 0x00000080\nOperatingSystemVersion: 6.0\nImageVersion: 6.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x00006180\nSizeOfHeaders: 0x00000300\nChecksum: 0x00013EE1\nSubsystem: IMAGE_SUBSYSTEM_NATIVE\nSizeofStackReserve: 0x00040000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00003011\n VirtualAddress: 0x00000300\n SizeOfRawData: 0x00003080\n PointerToRawData: 0x00000300\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_NOT_PAGED\n IMAGE_SCN_MEM_READ\n Entropy: 6.30767\n\n.rdata:\n VirtualSize: 0x00001D94\n VirtualAddress: 0x00003380\n SizeOfRawData: 0x00001E00\n PointerToRawData: 0x00003380\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_NOT_PAGED\n IMAGE_SCN_MEM_READ\n Entropy: 5.12571\n\n.data:\n VirtualSize: 0x00000274\n VirtualAddress: 0x00005180\n SizeOfRawData: 0x00000280\n PointerToRawData: 0x00005180\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_NOT_PAGED\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.08744\n\nINIT:\n VirtualSize: 0x00000522\n VirtualAddress: 0x00005400\n SizeOfRawData: 0x00000580\n PointerToRawData: 0x00005400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.02773\n\n.rsrc:\n VirtualSize: 0x00000388\n VirtualAddress: 0x00005980\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00005980\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.7389\n\n.reloc:\n VirtualSize: 0x000003C4\n VirtualAddress: 0x00005D80\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00005D80\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.95603\n\n\nImports:\n--------\nntoskrnl.exe: IoDeleteDevice\n IoFreeWorkItem\n MmUnmapIoSpace\n MmGetPhysicalAddress\n ExAllocatePool\n IoAllocateWorkItem\n MmMapIoSpace\n IoAttachDeviceToDeviceStack\n IoCreateSymbolicLink\n IoInitializeRemoveLockEx\n IoCreateDevice\n IoQueueWorkItem\n RtlInitUnicodeString\n ZwClose\n ZwOpenFile\n ZwQueryInformationFile\n KdDebuggerEnabled\n InitSafeBootMode\n IofCompleteRequest\n RtlDeleteElementGenericTable\n KeGetCurrentThread\n RtlLookupElementGenericTable\n RtlInitializeGenericTable\n RtlInsertElementGenericTable\n RtlUpcaseUnicodeChar\n IoRegisterDriverReinitialization\n ExFreePoolWithTag\n ZwReadFile\n IoDeleteSymbolicLink\n ZwAllocateVirtualMemory\n KeInitializeMutex\n KeReleaseMutex\n KeWaitForSingleObject\n ZwQueryValueKey\n ZwOpenKey\n _stricmp\n MmGetSystemRoutineAddress\n PsGetVersion\n ZwQueryInformationProcess\n ObOpenObjectByPointer\n PsLookupProcessByProcessId\n ObfDereferenceObject\n memcpy\n _except_handler3\n memset\nHAL.dll: KfAcquireSpinLock\n KeGetCurrentIrql\n KfReleaseSpinLock\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 816\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4612\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 4.33.0.12\n ProductVersion: 4.33.0.12\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DRV\n FileSubtype: VFT2_UNKNOWN\n Language: English - United States\n CompanyName: IBM Corporation ©\n FileDescription: IBM ServeRAID Controller Driver\n FileVersion (#2): 4.33.0.12\n InternalName: nfrd965.sys\n InternalCopyright: (C) Copyright IBM Corp. 1994, 2002.\n OriginalFilename: nfrd965.sys\n ProductName: IBM ServeRAID Contoller\n ProductVersion (#2): 4.33.0.12\n\n\nLoad Configuration:\n-------------------\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00015348\nSEHandlerTable: 0x00015090\nSEHandlerCount: 1\n\nRICH Header:\n------------\nXOR Key: 0x90D576C6\nUnmarked objects: 0\nC objects (VS2012 build 50727 / VS2005 build 50727): 2\nTotal imports: 49\n19 (9049): 5\nC objects (VS2008 SP1 build 30729): 2\n113 (VS2012 build 50727 / VS2005 build 50727): 32\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Section INIT is both writable and executable.\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Windows's Native API:\n ZwClose\n ZwOpenFile\n ZwQueryInformationFile\n ZwReadFile\n ZwAllocateVirtualMemory\n ZwQueryValueKey\n ZwOpenKey\n ZwQueryInformationProcess\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (1 registered handler)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_NATIVE\nCompilation Date: 2011-Oct-17 19:06:28\nDetected languages: English - United States\nCompanyName: IBM Corporation ©\nFileDescription: IBM ServeRAID Controller Driver\nFileVersion: 4.33.0.12\nInternalName: nfrd965.sys\nInternalCopyright: (C) Copyright IBM Corp. 1994, 2002.\nOriginalFilename: nfrd965.sys\nProductName: IBM ServeRAID Contoller\nProductVersion: 4.33.0.12"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 6\nTimeDateStamp: 2011-Oct-17 19:06:28\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00003600\nSizeOfInitializedData: 0x00002880\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000570 (Section: .text)\nBaseOfCode: 0x00000300\nBaseOfData: 0x00003380\nImageBase: 0x00010000\nSectionAlignment: 0x00000080\nFileAlignment: 0x00000080\nOperatingSystemVersion: 6.0\nImageVersion: 6.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x00006180\nSizeOfHeaders: 0x00000300\nChecksum: 0x00013EE1\nSubsystem: IMAGE_SUBSYSTEM_NATIVE\nSizeofStackReserve: 0x00040000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00003011\n VirtualAddress: 0x00000300\n SizeOfRawData: 0x00003080\n PointerToRawData: 0x00000300\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_NOT_PAGED\n IMAGE_SCN_MEM_READ\n Entropy: 6.30767\n\n.rdata:\n VirtualSize: 0x00001D94\n VirtualAddress: 0x00003380\n SizeOfRawData: 0x00001E00\n PointerToRawData: 0x00003380\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_NOT_PAGED\n IMAGE_SCN_MEM_READ\n Entropy: 5.12571\n\n.data:\n VirtualSize: 0x00000274\n VirtualAddress: 0x00005180\n SizeOfRawData: 0x00000280\n PointerToRawData: 0x00005180\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_NOT_PAGED\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.08744\n\nINIT:\n VirtualSize: 0x00000522\n VirtualAddress: 0x00005400\n SizeOfRawData: 0x00000580\n PointerToRawData: 0x00005400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.02773\n\n.rsrc:\n VirtualSize: 0x00000388\n VirtualAddress: 0x00005980\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00005980\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.7389\n\n.reloc:\n VirtualSize: 0x000003C4\n VirtualAddress: 0x00005D80\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00005D80\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.95603"},"Imports":{"raw":"ntoskrnl.exe: IoDeleteDevice\n IoFreeWorkItem\n MmUnmapIoSpace\n MmGetPhysicalAddress\n ExAllocatePool\n IoAllocateWorkItem\n MmMapIoSpace\n IoAttachDeviceToDeviceStack\n IoCreateSymbolicLink\n IoInitializeRemoveLockEx\n IoCreateDevice\n IoQueueWorkItem\n RtlInitUnicodeString\n ZwClose\n ZwOpenFile\n ZwQueryInformationFile\n KdDebuggerEnabled\n InitSafeBootMode\n IofCompleteRequest\n RtlDeleteElementGenericTable\n KeGetCurrentThread\n RtlLookupElementGenericTable\n RtlInitializeGenericTable\n RtlInsertElementGenericTable\n RtlUpcaseUnicodeChar\n IoRegisterDriverReinitialization\n ExFreePoolWithTag\n ZwReadFile\n IoDeleteSymbolicLink\n ZwAllocateVirtualMemory\n KeInitializeMutex\n KeReleaseMutex\n KeWaitForSingleObject\n ZwQueryValueKey\n ZwOpenKey\n _stricmp\n MmGetSystemRoutineAddress\n PsGetVersion\n ZwQueryInformationProcess\n ObOpenObjectByPointer\n PsLookupProcessByProcessId\n ObfDereferenceObject\n memcpy\n _except_handler3\n memset\nHAL.dll: KfAcquireSpinLock\n KeGetCurrentIrql\n KfReleaseSpinLock\n\nResources:\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 816\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4612\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 4.33.0.12\n ProductVersion: 4.33.0.12\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DRV\n FileSubtype: VFT2_UNKNOWN\n Language: English - United States\n CompanyName: IBM Corporation ©\n FileDescription: IBM ServeRAID Controller Driver\n FileVersion (#2): 4.33.0.12\n InternalName: nfrd965.sys\n InternalCopyright: (C) Copyright IBM Corp. 1994, 2002.\n OriginalFilename: nfrd965.sys\n ProductName: IBM ServeRAID Contoller\n ProductVersion (#2): 4.33.0.12\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00015348\nSEHandlerTable: 0x00015090\nSEHandlerCount: 1\n\nRICH Header:\nXOR Key: 0x90D576C6\nUnmarked objects: 0\nC objects (VS2012 build 50727 / VS2005 build 50727): 2\nTotal imports: 49\n19 (9049): 5\nC objects (VS2008 SP1 build 30729): 2\n113 (VS2012 build 50727 / VS2005 build 50727): 32\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Section INIT is both writable and executable.\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Windows's Native API:\n ZwClose\n ZwOpenFile\n ZwQueryInformationFile\n ZwReadFile\n ZwAllocateVirtualMemory\n ZwQueryValueKey\n ZwOpenKey\n ZwQueryInformationProcess\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (1 registered handler)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 816\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4612\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 4.33.0.12\n ProductVersion: 4.33.0.12\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DRV\n FileSubtype: VFT2_UNKNOWN\n Language: English - United States\n CompanyName: IBM Corporation ©\n FileDescription: IBM ServeRAID Controller Driver\n FileVersion (#2): 4.33.0.12\n InternalName: nfrd965.sys\n InternalCopyright: (C) Copyright IBM Corp. 1994, 2002.\n OriginalFilename: nfrd965.sys\n ProductName: IBM ServeRAID Contoller\n ProductVersion (#2): 4.33.0.12\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00015348\nSEHandlerTable: 0x00015090\nSEHandlerCount: 1\n\nRICH Header:\nXOR Key: 0x90D576C6\nUnmarked objects: 0\nC objects (VS2012 build 50727 / VS2005 build 50727): 2\nTotal imports: 49\n19 (9049): 5\nC objects (VS2008 SP1 build 30729): 2\n113 (VS2012 build 50727 / VS2005 build 50727): 32\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Section INIT is both writable and executable.\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Windows's Native API:\n ZwClose\n ZwOpenFile\n ZwQueryInformationFile\n ZwReadFile\n ZwAllocateVirtualMemory\n ZwQueryValueKey\n ZwOpenKey\n ZwQueryInformationProcess\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (1 registered handler)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{"raw":"Size: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00015348\nSEHandlerTable: 0x00015090\nSEHandlerCount: 1"},"RICH Header":{"raw":"XOR Key: 0x90D576C6\nUnmarked objects: 0\nC objects (VS2012 build 50727 / VS2005 build 50727): 2\nTotal imports: 49\n19 (9049): 5\nC objects (VS2008 SP1 build 30729): 2\n113 (VS2012 build 50727 / VS2005 build 50727): 32\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Section INIT is both writable and executable.\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Windows's Native API:\n ZwClose\n ZwOpenFile\n ZwQueryInformationFile\n ZwReadFile\n ZwAllocateVirtualMemory\n ZwQueryValueKey\n ZwOpenKey\n ZwQueryInformationProcess\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (1 registered handler)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/TrojanWin32.Duqu.Stuxnet-019f46cab6a272e0abc2b0a2836dd472.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_wyp7nfj5/output.txt"},"timestamp":"2026-07-09 21:33:30"} {"_id":{"$oid":"6a4fcd050108394cb24cdced"},"sha256":"8abb47ca7c0c4871c28b89aa0e75493e5eb01e403272888c11fef9e53d633ffe","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_hqb7vhcw/Variant.Kazy-019f46cad0df73608500f9814436a2b0.exe_8abb47ca7c0c/001_upx_unpacked.exe\nDate: 2026-07-09 22:02:05\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_hqb7vhcw/Variant.Kazy-019f46cad0df73608500f9814436a2b0.exe_8abb47ca7c0c/001_upx_unpacked.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Jan-24 12:36:44\nDetected languages: Chinese - PRC\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2014-Jan-24 12:36:44\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00000A00\nSizeOfInitializedData: 0x00014C00\nSizeOfUninitializedData: 0x00000200\nAddressOfEntryPoint: 0x0000169F (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00002000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0001A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000009A0\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.84119\n\n.bss:\n VirtualSize: 0x0000019C\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.data:\n VirtualSize: 0x00000530\n VirtualAddress: 0x00003000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00000E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.22213\n\n.CRT:\n VirtualSize: 0x00000004\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00001400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.0611629\n\n.rsrc:\n VirtualSize: 0x000143A8\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00014400\n PointerToRawData: 0x00001600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.72316\n\n\nImports:\n--------\nKERNEL32.DLL: CreateFileA\n GetModuleFileNameA\n GetModuleHandleA\n FreeResource\n WriteFile\n LoadResource\n SizeofResource\n FindResourceA\n GetCurrentProcess\n GetProcAddress\n GetFileSize\n ReadFile\n SetFilePointer\n CreateProcessA\n SetFileTime\n GetFileTime\n ExitProcess\n GetTickCount\n CloseHandle\n FindFirstFileA\n GetWindowsDirectoryA\n FindClose\nADVAPI32.dll: OpenProcessToken\n AdjustTokenPrivileges\n RegCloseKey\n RegSetValueExA\n RegOpenKeyExA\n LookupPrivilegeValueA\nMSVCRT.dll: strcpy\n strcat\n strlen\n strchr\n sprintf\n memcpy\nUSER32.dll: wsprintfA\n\nResources:\n----------\n102:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 64000\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.04819\n Detected Filetype: PE Executable\n\n103:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 11264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14121\n Detected Filetype: PE Executable\n\n105:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 6656\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.149\n Detected Filetype: PE Executable\n\n1:\n Type: RT_MANIFEST\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 658\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.89849\n\n\nRICH Header:\n------------\nXOR Key: 0xA056BB27\nUnmarked objects: 0\n12 (7291): 3\n14 (7299): 1\nLinker (VS98 build 8168): 2\n19 (8034): 8\nTotal imports: 97\nImports (VS2003 (.NET) build 4035): 3\nC++ objects (VS98 build 8168): 5\nResource objects (VS98 cvtres build 1720): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Section .data is both writable and executable.\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n Can access the registry:\n RegCloseKey\n RegSetValueExA\n RegOpenKeyExA\n Possibly launches other programs:\n CreateProcessA\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\n[ MALICIOUS ] The PE is possibly a dropper.\n Resource 102 detected as a PE Executable.\n Resource 103 detected as a PE Executable.\n Resource 105 detected as a PE Executable.\n Resources amount for 92.7926% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 416 bytes of data starting at offset 0x15a00.\n\n\n\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Jan-24 12:36:44\nDetected languages: Chinese - PRC"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2014-Jan-24 12:36:44\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00000A00\nSizeOfInitializedData: 0x00014C00\nSizeOfUninitializedData: 0x00000200\nAddressOfEntryPoint: 0x0000169F (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00002000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0001A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000009A0\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.84119\n\n.bss:\n VirtualSize: 0x0000019C\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.data:\n VirtualSize: 0x00000530\n VirtualAddress: 0x00003000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00000E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.22213\n\n.CRT:\n VirtualSize: 0x00000004\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00001400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.0611629\n\n.rsrc:\n VirtualSize: 0x000143A8\n VirtualAddress: 0x00005000\n SizeOfRawData: 0x00014400\n PointerToRawData: 0x00001600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.72316"},"Imports":{"raw":"KERNEL32.DLL: CreateFileA\n GetModuleFileNameA\n GetModuleHandleA\n FreeResource\n WriteFile\n LoadResource\n SizeofResource\n FindResourceA\n GetCurrentProcess\n GetProcAddress\n GetFileSize\n ReadFile\n SetFilePointer\n CreateProcessA\n SetFileTime\n GetFileTime\n ExitProcess\n GetTickCount\n CloseHandle\n FindFirstFileA\n GetWindowsDirectoryA\n FindClose\nADVAPI32.dll: OpenProcessToken\n AdjustTokenPrivileges\n RegCloseKey\n RegSetValueExA\n RegOpenKeyExA\n LookupPrivilegeValueA\nMSVCRT.dll: strcpy\n strcat\n strlen\n strchr\n sprintf\n memcpy\nUSER32.dll: wsprintfA\n\nResources:\n102:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 64000\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.04819\n Detected Filetype: PE Executable\n\n103:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 11264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14121\n Detected Filetype: PE Executable\n\n105:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 6656\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.149\n Detected Filetype: PE Executable\n\n1:\n Type: RT_MANIFEST\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 658\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.89849\n\n\nRICH Header:\nXOR Key: 0xA056BB27\nUnmarked objects: 0\n12 (7291): 3\n14 (7299): 1\nLinker (VS98 build 8168): 2\n19 (8034): 8\nTotal imports: 97\nImports (VS2003 (.NET) build 4035): 3\nC++ objects (VS98 build 8168): 5\nResource objects (VS98 cvtres build 1720): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Section .data is both writable and executable.\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n Can access the registry:\n RegCloseKey\n RegSetValueExA\n RegOpenKeyExA\n Possibly launches other programs:\n CreateProcessA\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\n[ MALICIOUS ] The PE is possibly a dropper.\n Resource 102 detected as a PE Executable.\n Resource 103 detected as a PE Executable.\n Resource 105 detected as a PE Executable.\n Resources amount for 92.7926% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 416 bytes of data starting at offset 0x15a00.\n\n\n\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"102:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 64000\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.04819\n Detected Filetype: PE Executable\n\n103:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 11264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14121\n Detected Filetype: PE Executable\n\n105:\n Type: TLS\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 6656\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.149\n Detected Filetype: PE Executable\n\n1:\n Type: RT_MANIFEST\n Language: Chinese - PRC\n Codepage: UNKNOWN\n Size: 658\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.89849\n\n\nRICH Header:\nXOR Key: 0xA056BB27\nUnmarked objects: 0\n12 (7291): 3\n14 (7299): 1\nLinker (VS98 build 8168): 2\n19 (8034): 8\nTotal imports: 97\nImports (VS2003 (.NET) build 4035): 3\nC++ objects (VS98 build 8168): 5\nResource objects (VS98 cvtres build 1720): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Section .data is both writable and executable.\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n Can access the registry:\n RegCloseKey\n RegSetValueExA\n RegOpenKeyExA\n Possibly launches other programs:\n CreateProcessA\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\n[ MALICIOUS ] The PE is possibly a dropper.\n Resource 102 detected as a PE Executable.\n Resource 103 detected as a PE Executable.\n Resource 105 detected as a PE Executable.\n Resources amount for 92.7926% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 416 bytes of data starting at offset 0x15a00.\n\n\n\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0xA056BB27\nUnmarked objects: 0\n12 (7291): 3\n14 (7299): 1\nLinker (VS98 build 8168): 2\n19 (8034): 8\nTotal imports: 97\nImports (VS2003 (.NET) build 4035): 3\nC++ objects (VS98 build 8168): 5\nResource objects (VS98 cvtres build 1720): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Section .data is both writable and executable.\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n Can access the registry:\n RegCloseKey\n RegSetValueExA\n RegOpenKeyExA\n Possibly launches other programs:\n CreateProcessA\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\n[ MALICIOUS ] The PE is possibly a dropper.\n Resource 102 detected as a PE Executable.\n Resource 103 detected as a PE Executable.\n Resource 105 detected as a PE Executable.\n Resources amount for 92.7926% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 416 bytes of data starting at offset 0x15a00.\n\n\n\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_hqb7vhcw/Variant.Kazy-019f46cad0df73608500f9814436a2b0.exe_8abb47ca7c0c/001_upx_unpacked.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_ag755foc/output.txt"},"timestamp":"2026-07-09 22:02:05"} {"_id":{"$oid":"6a4fcde70108394cb24cdcf0"},"sha256":"036e4f452041f9d573f851d48d92092060107d9ea32e0c532849d61a598b8a71","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_0aylfp1o/Win32.Alina.3.4.B-019f46cae688784187692e81bcf5f973.exe_036e4f452041/001_upx_unpacked.exe\nDate: 2026-07-09 22:05:51\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_0aylfp1o/Win32.Alina.3.4.B-019f46cae688784187692e81bcf5f973.exe_036e4f452041/001_upx_unpacked.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Jan-17 04:22:17\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2013-Jan-17 04:22:17\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x00018400\nSizeOfInitializedData: 0x00049A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000CA9C (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0001A000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00064000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000183E1\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00018400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.63635\n\n.rdata:\n VirtualSize: 0x00005D28\n VirtualAddress: 0x0001A000\n SizeOfRawData: 0x00005E00\n PointerToRawData: 0x00018800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.94238\n\n.data:\n VirtualSize: 0x00043A24\n VirtualAddress: 0x00020000\n SizeOfRawData: 0x00001400\n PointerToRawData: 0x0001E600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.38059\n\n\nImports:\n--------\nKERNEL32.DLL: GetModuleFileNameA\n CreateFileA\n GetFileSize\n Process32First\n GetTickCount\n WriteFile\n GetCommandLineA\n OpenProcess\n Sleep\n CreateProcessA\n TerminateProcess\n ReadFile\n CopyFileA\n GetLastError\n CreateMutexA\n CreateToolhelp32Snapshot\n GetCurrentProcessId\n GetTempPathA\n DeleteFileA\n CreateThread\n InitializeCriticalSection\n LeaveCriticalSection\n EnterCriticalSection\n VirtualQueryEx\n ReadProcessMemory\n IsWow64Process\n GetVolumeInformationA\n GetComputerNameA\n CloseHandle\n GetProcAddress\n Process32Next\n GetCurrentProcess\n CreateFileW\n WriteConsoleW\n SetStdHandle\n GetConsoleMode\n GetConsoleCP\n SetFilePointer\n GetStringTypeW\n IsValidLocale\n EnumSystemLocalesA\n GetLocaleInfoA\n GetUserDefaultLCID\n GetSystemTimeAsFileTime\n QueryPerformanceCounter\n GetFileType\n SetHandleCount\n GetEnvironmentStringsW\n InterlockedIncrement\n InterlockedDecrement\n EncodePointer\n DecodePointer\n DeleteCriticalSection\n HeapFree\n HeapAlloc\n HeapReAlloc\n GetModuleHandleW\n ExitProcess\n HeapSetInformation\n GetStartupInfoW\n RaiseException\n RtlUnwind\n CompareStringW\n MultiByteToWideChar\n GetCPInfo\n WideCharToMultiByte\n LCMapStringW\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n IsDebuggerPresent\n IsProcessorFeaturePresent\n HeapCreate\n GetStdHandle\n GetModuleFileNameW\n HeapSize\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n SetLastError\n GetCurrentThreadId\n InitializeCriticalSectionAndSpinCount\n LoadLibraryW\n GetLocaleInfoW\n GetACP\n GetOEMCP\n IsValidCodePage\n FreeEnvironmentStringsW\n FlushFileBuffers\nADVAPI32.dll: AdjustTokenPrivileges\n RegDeleteValueA\n RegOpenKeyExA\n LookupPrivilegeValueA\n RegQueryValueExA\n RegSetValueExA\n OpenProcessToken\n RegCloseKey\nPSAPI.DLL: GetProcessImageFileNameA\nSHELL32.dll: SHGetSpecialFolderPathA\nSHLWAPI.dll: StrStrIA\nurlmon.dll: URLDownloadToFileA\nWININET.dll: InternetReadFile\n HttpOpenRequestA\n HttpQueryInfoA\n HttpSendRequestA\n InternetOpenA\n InternetConnectA\n InternetCloseHandle\n\nLoad Configuration:\n-------------------\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004202AC\nSEHandlerTable: 0x0041E260\nSEHandlerCount: 44\n\nRICH Header:\n------------\nXOR Key: 0x6AED66A4\nUnmarked objects: 0\n152 (20115): 2\nASM objects (VS2010 build 30319): 19\nC++ objects (VS2010 build 30319): 41\nC objects (VS2010 build 30319): 98\nImports (VS2008 SP1 build 30729): 15\nTotal imports: 119\n175 (VS2010 build 30319): 5\nLinker (VS2010 build 30319): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n firefox.exe\n iexplore.exe\n Contains references to security software:\n firewall.exe\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n someligeoas.com\n uipoqworkas.com\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n Can access the registry:\n RegDeleteValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\n RegCloseKey\n Possibly launches other programs:\n CreateProcessA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n CreateFileW\n Has Internet access capabilities:\n URLDownloadToFileA\n InternetReadFile\n InternetOpenA\n InternetConnectA\n InternetCloseHandle\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n Enumerates local disk drives:\n GetVolumeInformationA\n Manipulates other processes:\n Process32First\n OpenProcess\n ReadProcessMemory\n Process32Next\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (44 registered handlers)\n ASLR: disabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Jan-17 04:22:17"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2013-Jan-17 04:22:17\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x00018400\nSizeOfInitializedData: 0x00049A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000CA9C (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0001A000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00064000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000183E1\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00018400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.63635\n\n.rdata:\n VirtualSize: 0x00005D28\n VirtualAddress: 0x0001A000\n SizeOfRawData: 0x00005E00\n PointerToRawData: 0x00018800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.94238\n\n.data:\n VirtualSize: 0x00043A24\n VirtualAddress: 0x00020000\n SizeOfRawData: 0x00001400\n PointerToRawData: 0x0001E600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.38059"},"Imports":{"raw":"KERNEL32.DLL: GetModuleFileNameA\n CreateFileA\n GetFileSize\n Process32First\n GetTickCount\n WriteFile\n GetCommandLineA\n OpenProcess\n Sleep\n CreateProcessA\n TerminateProcess\n ReadFile\n CopyFileA\n GetLastError\n CreateMutexA\n CreateToolhelp32Snapshot\n GetCurrentProcessId\n GetTempPathA\n DeleteFileA\n CreateThread\n InitializeCriticalSection\n LeaveCriticalSection\n EnterCriticalSection\n VirtualQueryEx\n ReadProcessMemory\n IsWow64Process\n GetVolumeInformationA\n GetComputerNameA\n CloseHandle\n GetProcAddress\n Process32Next\n GetCurrentProcess\n CreateFileW\n WriteConsoleW\n SetStdHandle\n GetConsoleMode\n GetConsoleCP\n SetFilePointer\n GetStringTypeW\n IsValidLocale\n EnumSystemLocalesA\n GetLocaleInfoA\n GetUserDefaultLCID\n GetSystemTimeAsFileTime\n QueryPerformanceCounter\n GetFileType\n SetHandleCount\n GetEnvironmentStringsW\n InterlockedIncrement\n InterlockedDecrement\n EncodePointer\n DecodePointer\n DeleteCriticalSection\n HeapFree\n HeapAlloc\n HeapReAlloc\n GetModuleHandleW\n ExitProcess\n HeapSetInformation\n GetStartupInfoW\n RaiseException\n RtlUnwind\n CompareStringW\n MultiByteToWideChar\n GetCPInfo\n WideCharToMultiByte\n LCMapStringW\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n IsDebuggerPresent\n IsProcessorFeaturePresent\n HeapCreate\n GetStdHandle\n GetModuleFileNameW\n HeapSize\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n SetLastError\n GetCurrentThreadId\n InitializeCriticalSectionAndSpinCount\n LoadLibraryW\n GetLocaleInfoW\n GetACP\n GetOEMCP\n IsValidCodePage\n FreeEnvironmentStringsW\n FlushFileBuffers\nADVAPI32.dll: AdjustTokenPrivileges\n RegDeleteValueA\n RegOpenKeyExA\n LookupPrivilegeValueA\n RegQueryValueExA\n RegSetValueExA\n OpenProcessToken\n RegCloseKey\nPSAPI.DLL: GetProcessImageFileNameA\nSHELL32.dll: SHGetSpecialFolderPathA\nSHLWAPI.dll: StrStrIA\nurlmon.dll: URLDownloadToFileA\nWININET.dll: InternetReadFile\n HttpOpenRequestA\n HttpQueryInfoA\n HttpSendRequestA\n InternetOpenA\n InternetConnectA\n InternetCloseHandle\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004202AC\nSEHandlerTable: 0x0041E260\nSEHandlerCount: 44\n\nRICH Header:\nXOR Key: 0x6AED66A4\nUnmarked objects: 0\n152 (20115): 2\nASM objects (VS2010 build 30319): 19\nC++ objects (VS2010 build 30319): 41\nC objects (VS2010 build 30319): 98\nImports (VS2008 SP1 build 30729): 15\nTotal imports: 119\n175 (VS2010 build 30319): 5\nLinker (VS2010 build 30319): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n firefox.exe\n iexplore.exe\n Contains references to security software:\n firewall.exe\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n someligeoas.com\n uipoqworkas.com\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n Can access the registry:\n RegDeleteValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\n RegCloseKey\n Possibly launches other programs:\n CreateProcessA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n CreateFileW\n Has Internet access capabilities:\n URLDownloadToFileA\n InternetReadFile\n InternetOpenA\n InternetConnectA\n InternetCloseHandle\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n Enumerates local disk drives:\n GetVolumeInformationA\n Manipulates other processes:\n Process32First\n OpenProcess\n ReadProcessMemory\n Process32Next\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (44 registered handlers)\n ASLR: disabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{"raw":"Size: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004202AC\nSEHandlerTable: 0x0041E260\nSEHandlerCount: 44"},"RICH Header":{"raw":"XOR Key: 0x6AED66A4\nUnmarked objects: 0\n152 (20115): 2\nASM objects (VS2010 build 30319): 19\nC++ objects (VS2010 build 30319): 41\nC objects (VS2010 build 30319): 98\nImports (VS2008 SP1 build 30729): 15\nTotal imports: 119\n175 (VS2010 build 30319): 5\nLinker (VS2010 build 30319): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n firefox.exe\n iexplore.exe\n Contains references to security software:\n firewall.exe\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n someligeoas.com\n uipoqworkas.com\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n Can access the registry:\n RegDeleteValueA\n RegOpenKeyExA\n RegQueryValueExA\n RegSetValueExA\n RegCloseKey\n Possibly launches other programs:\n CreateProcessA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n CreateFileW\n Has Internet access capabilities:\n URLDownloadToFileA\n InternetReadFile\n InternetOpenA\n InternetConnectA\n InternetCloseHandle\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n Enumerates local disk drives:\n GetVolumeInformationA\n Manipulates other processes:\n Process32First\n OpenProcess\n ReadProcessMemory\n Process32Next\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (44 registered handlers)\n ASLR: disabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_0aylfp1o/Win32.Alina.3.4.B-019f46cae688784187692e81bcf5f973.exe_036e4f452041/001_upx_unpacked.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_sc8n_5kh/output.txt"},"timestamp":"2026-07-09 22:05:51"} {"_id":{"$oid":"6a4fcfb00108394cb24cdcf4"},"sha256":"4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Trojan.Destover-SonySigned-019f46cb019971e1850571f878e6fbb0.exe\nDate: 2026-07-09 22:13:28\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Trojan.Destover-SonySigned-019f46cb019971e1850571f878e6fbb0.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Jul-07 08:01:09\nDetected languages: English - United States\nCompanyName: Microsoft Corporation\nFileDescription: igfxstartup Module\nFileVersion: 5.6.4590.2023\nInternalName: igfxtpers.exe\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: igfxtpers.exe\nProductName: Microsoft® Windows® Operating System\nProductVersion: 5.6.4590.2023\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000D0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2014-Jul-07 08:01:09\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x0000E000\nSizeOfInitializedData: 0x00008000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000766E (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000F000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00017000\nSizeOfHeaders: 0x00001000\nChecksum: 0x0001CB4D\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000DCF5\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000E000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.54662\n\n.rdata:\n VirtualSize: 0x00000D88\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x0000F000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.85154\n\n.data:\n VirtualSize: 0x000056FC\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00004000\n PointerToRawData: 0x00010000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.13157\n\n.rsrc:\n VirtualSize: 0x00000440\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00014000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.15249\n\n\nImports:\n--------\nKERNEL32.dll: GetTickCount\n GetACP\n GetComputerNameW\n GetDriveTypeW\n LocalAlloc\n Sleep\n MoveFileA\n GetModuleFileNameA\n GetProcAddress\n LoadLibraryA\n lstrcpyA\n lstrlenA\n CompareStringW\n CompareStringA\n GetStringTypeW\n GetStringTypeA\n GetOEMCP\n GetCPInfo\n FlushFileBuffers\n SetStdHandle\n LCMapStringW\n LCMapStringA\n IsBadCodePtr\n IsBadReadPtr\n SetUnhandledExceptionFilter\n WriteFile\n GetEnvironmentStringsW\n GetTimeZoneInformation\n GetSystemTime\n GetLocalTime\n RtlUnwind\n GetLastError\n MultiByteToWideChar\n WideCharToMultiByte\n GetFileAttributesW\n HeapAlloc\n HeapFree\n GetModuleHandleA\n GetStartupInfoA\n GetCommandLineA\n GetVersion\n ExitProcess\n HeapReAlloc\n TerminateProcess\n GetCurrentProcess\n HeapSize\n GetEnvironmentVariableA\n GetVersionExA\n HeapDestroy\n HeapCreate\n VirtualFree\n VirtualAlloc\n IsBadWritePtr\n CloseHandle\n SetHandleCount\n GetStdHandle\n GetFileType\n SetFilePointer\n UnhandledExceptionFilter\n FreeEnvironmentStringsA\n FreeEnvironmentStringsW\n GetEnvironmentStrings\n SetEnvironmentVariableA\nUSER32.dll: GetSystemMetrics\nSHELL32.dll: SHGetSpecialFolderPathA\nWS2_32.dll: WSAGetLastError\n setsockopt\n send\n shutdown\n recv\n ioctlsocket\n connect\n select\n closesocket\n htons\n ntohs\n htonl\n socket\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 992\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51035\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 5.6.4590.2023\n ProductVersion: 5.6.4590.2023\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: igfxstartup Module\n FileVersion (#2): 5.6.4590.2023\n InternalName: igfxtpers.exe\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: igfxtpers.exe\n ProductName: Microsoft® Windows® Operating System\n ProductVersion (#2): 5.6.4590.2023\n\n\nRICH Header:\n------------\nXOR Key: 0xB3F26024\nUnmarked objects: 0\n14 (7299): 19\nC objects (VS98 SP6 build 8804): 106\nImports (VS2003 (.NET) build 4035): 9\nTotal imports: 82\nC++ objects (VS98 SP6 build 8804): 13\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\nInteresting strings found in the binary:\n Contains domain names:\n amazon.com\n google.com\n www.amazon.com\n www.google.com\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Leverages the raw socket API to access the Internet:\n WSAGetLastError\n setsockopt\n send\n shutdown\n recv\n ioctlsocket\n connect\n select\n closesocket\n htons\n ntohs\n htonl\n socket\n Enumerates local disk drives:\n GetDriveTypeW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Sony Pictures Entertainment Inc.\n Issuer: DigiCert Assured ID Code Signing CA-1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Jul-07 08:01:09\nDetected languages: English - United States\nCompanyName: Microsoft Corporation\nFileDescription: igfxstartup Module\nFileVersion: 5.6.4590.2023\nInternalName: igfxtpers.exe\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: igfxtpers.exe\nProductName: Microsoft® Windows® Operating System\nProductVersion: 5.6.4590.2023"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000D0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2014-Jul-07 08:01:09\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x0000E000\nSizeOfInitializedData: 0x00008000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000766E (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000F000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00017000\nSizeOfHeaders: 0x00001000\nChecksum: 0x0001CB4D\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000DCF5\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000E000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.54662\n\n.rdata:\n VirtualSize: 0x00000D88\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x0000F000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.85154\n\n.data:\n VirtualSize: 0x000056FC\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00004000\n PointerToRawData: 0x00010000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.13157\n\n.rsrc:\n VirtualSize: 0x00000440\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00014000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.15249"},"Imports":{"raw":"KERNEL32.dll: GetTickCount\n GetACP\n GetComputerNameW\n GetDriveTypeW\n LocalAlloc\n Sleep\n MoveFileA\n GetModuleFileNameA\n GetProcAddress\n LoadLibraryA\n lstrcpyA\n lstrlenA\n CompareStringW\n CompareStringA\n GetStringTypeW\n GetStringTypeA\n GetOEMCP\n GetCPInfo\n FlushFileBuffers\n SetStdHandle\n LCMapStringW\n LCMapStringA\n IsBadCodePtr\n IsBadReadPtr\n SetUnhandledExceptionFilter\n WriteFile\n GetEnvironmentStringsW\n GetTimeZoneInformation\n GetSystemTime\n GetLocalTime\n RtlUnwind\n GetLastError\n MultiByteToWideChar\n WideCharToMultiByte\n GetFileAttributesW\n HeapAlloc\n HeapFree\n GetModuleHandleA\n GetStartupInfoA\n GetCommandLineA\n GetVersion\n ExitProcess\n HeapReAlloc\n TerminateProcess\n GetCurrentProcess\n HeapSize\n GetEnvironmentVariableA\n GetVersionExA\n HeapDestroy\n HeapCreate\n VirtualFree\n VirtualAlloc\n IsBadWritePtr\n CloseHandle\n SetHandleCount\n GetStdHandle\n GetFileType\n SetFilePointer\n UnhandledExceptionFilter\n FreeEnvironmentStringsA\n FreeEnvironmentStringsW\n GetEnvironmentStrings\n SetEnvironmentVariableA\nUSER32.dll: GetSystemMetrics\nSHELL32.dll: SHGetSpecialFolderPathA\nWS2_32.dll: WSAGetLastError\n setsockopt\n send\n shutdown\n recv\n ioctlsocket\n connect\n select\n closesocket\n htons\n ntohs\n htonl\n socket\n\nResources:\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 992\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51035\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 5.6.4590.2023\n ProductVersion: 5.6.4590.2023\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: igfxstartup Module\n FileVersion (#2): 5.6.4590.2023\n InternalName: igfxtpers.exe\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: igfxtpers.exe\n ProductName: Microsoft® Windows® Operating System\n ProductVersion (#2): 5.6.4590.2023\n\n\nRICH Header:\nXOR Key: 0xB3F26024\nUnmarked objects: 0\n14 (7299): 19\nC objects (VS98 SP6 build 8804): 106\nImports (VS2003 (.NET) build 4035): 9\nTotal imports: 82\nC++ objects (VS98 SP6 build 8804): 13\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\nInteresting strings found in the binary:\n Contains domain names:\n amazon.com\n google.com\n www.amazon.com\n www.google.com\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Leverages the raw socket API to access the Internet:\n WSAGetLastError\n setsockopt\n send\n shutdown\n recv\n ioctlsocket\n connect\n select\n closesocket\n htons\n ntohs\n htonl\n socket\n Enumerates local disk drives:\n GetDriveTypeW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Sony Pictures Entertainment Inc.\n Issuer: DigiCert Assured ID Code Signing CA-1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 992\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.51035\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 5.6.4590.2023\n ProductVersion: 5.6.4590.2023\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: igfxstartup Module\n FileVersion (#2): 5.6.4590.2023\n InternalName: igfxtpers.exe\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: igfxtpers.exe\n ProductName: Microsoft® Windows® Operating System\n ProductVersion (#2): 5.6.4590.2023\n\n\nRICH Header:\nXOR Key: 0xB3F26024\nUnmarked objects: 0\n14 (7299): 19\nC objects (VS98 SP6 build 8804): 106\nImports (VS2003 (.NET) build 4035): 9\nTotal imports: 82\nC++ objects (VS98 SP6 build 8804): 13\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\nInteresting strings found in the binary:\n Contains domain names:\n amazon.com\n google.com\n www.amazon.com\n www.google.com\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Leverages the raw socket API to access the Internet:\n WSAGetLastError\n setsockopt\n send\n shutdown\n recv\n ioctlsocket\n connect\n select\n closesocket\n htons\n ntohs\n htonl\n socket\n Enumerates local disk drives:\n GetDriveTypeW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Sony Pictures Entertainment Inc.\n Issuer: DigiCert Assured ID Code Signing CA-1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0xB3F26024\nUnmarked objects: 0\n14 (7299): 19\nC objects (VS98 SP6 build 8804): 106\nImports (VS2003 (.NET) build 4035): 9\nTotal imports: 82\nC++ objects (VS98 SP6 build 8804): 13\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)"},"Interesting strings found in the binary":{"raw":"Contains domain names:\n amazon.com\n google.com\n www.amazon.com\n www.google.com\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Leverages the raw socket API to access the Internet:\n WSAGetLastError\n setsockopt\n send\n shutdown\n recv\n ioctlsocket\n connect\n select\n closesocket\n htons\n ntohs\n htonl\n socket\n Enumerates local disk drives:\n GetDriveTypeW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Sony Pictures Entertainment Inc.\n Issuer: DigiCert Assured ID Code Signing CA-1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/Trojan.Destover-SonySigned-019f46cb019971e1850571f878e6fbb0.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_l60chzib/output.txt"},"timestamp":"2026-07-09 22:13:28"} {"_id":{"$oid":"6a4fd0c00108394cb24cdcf7"},"sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_81vav_ts/Trojan.Bladabindi-019f46cb18407410b79f39c10d91fc0f.exe_6f201afc7973/001_binwalk_15CB4.exe\nDate: 2026-07-09 22:18:00\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_81vav_ts/Trojan.Bladabindi-019f46cb18407410b79f39c10d91fc0f.exe_6f201afc7973/001_binwalk_15CB4.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Oct-26 23:32:46\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2013-Oct-26 23:32:46\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00006A00\nSizeOfInitializedData: 0x00000600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000897E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00000000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0000E000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00006984\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00006A00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.56095\n\n.rsrc:\n VirtualSize: 0x00000400\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00006C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.96877\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0776332\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 487\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.96801\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n soa7.zapto.org\n zapto.org\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Oct-26 23:32:46"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2013-Oct-26 23:32:46\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00006A00\nSizeOfInitializedData: 0x00000600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000897E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00000000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0000E000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00006984\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00006A00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.56095\n\n.rsrc:\n VirtualSize: 0x00000400\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00006C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.96877\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0776332"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n1:\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 487\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.96801\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n soa7.zapto.org\n zapto.org\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 487\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.96801\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n soa7.zapto.org\n zapto.org\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_81vav_ts/Trojan.Bladabindi-019f46cb18407410b79f39c10d91fc0f.exe_6f201afc7973/001_binwalk_15CB4.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_e2g965d3/output.txt"},"timestamp":"2026-07-09 22:18:00"} {"_id":{"$oid":"6a4fd3f80108394cb24cdcfa"},"sha256":"2c7b1c5c51f6952e7b8d0ac8137bc890f0edb43f878d0e356a4bdbe1ab325127","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Trojan.Win32.Bechiro.BCD-019f46cb5c4f7bc3a7e837813cf184c8.exe\nDate: 2026-07-09 22:31:44\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Trojan.Win32.Bechiro.BCD-019f46cb5c4f7bc3a7e837813cf184c8.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Dec-31 11:25:30\nDetected languages: English - United States\nCompanyName: *Rapiddown*\nFileDescription: Setup Manager\nFileVersion: 1.0.0.30\nInternalName: *install*\nLegalCopyright: copyright·©·2013\nOriginalFilename: inst4ll·3x3 \nProductVersion: 3.0.26\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0040\ne_cp: 0x0001\ne_crlc: 0x0000\ne_cparhdr: 0x0002\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0xB400\ne_oeminfo: 0xCD09\ne_lfanew: 0x00000040\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2013-Dec-31 11:25:30\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x00019200\nSizeOfInitializedData: 0x00040E00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00060117 (Section: .\"\\xb75\\xe1\\xa1'=)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0001B000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00066000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00033F6C\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00002000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.\\xff`4`h%&:\n VirtualSize: 0x0005F000\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00023E00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.99875\n\n.\"\\xb75\\xe1\\xa1'=:\n VirtualSize: 0x00000C81\n VirtualAddress: 0x00060000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x00024000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.61901\n\n.rsrc:\n VirtualSize: 0x000045A8\n VirtualAddress: 0x00061000\n SizeOfRawData: 0x00004600\n PointerToRawData: 0x00024E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.78461\n\n\nImports:\n--------\nKERNEL32.DLL: GetModuleHandleA\n GetProcAddress\nUSER32.dll: wsprintfW\nADVAPI32.dll: RegOpenKeyExW\nSHELL32.dll: ShellExecuteExW\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.87297\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21254\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.93155\n\n105:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 55\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n106:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 46\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n107:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 43\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n108:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 58\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n109:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 26\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n110:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 44\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n111:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 41\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n112:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 57\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n113:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 47\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n114:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 59\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n115:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 45\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n116:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n117:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 61\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n118:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 26\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n119:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n104:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.45849\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.33209\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 965\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.17438\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.30\n ProductVersion: 3.0.26.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: *Rapiddown*\n FileDescription: Setup Manager\n FileVersion (#2): 1.0.0.30\n InternalName: *install*\n LegalCopyright: copyright·©·2013\n OriginalFilename: inst4ll·3x3 \n ProductVersion (#2): 3.0.26\n\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .\\xff`4`h%&\n Section .\\xff`4`h%& is both writable and executable.\n Unusual section name found: .\"\\xb75\\xe1\\xa1'=\n Section .\"\\xb75\\xe1\\xa1'= is both writable and executable.\n The PE only has 5 import(s).\n\nThe PE contains common functions which appear in legitimate applications.\n Can access the registry:\n RegOpenKeyExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: PortalProgramas\n Issuer: COMODO Code Signing CA 2\n\n\n\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Dec-31 11:25:30\nDetected languages: English - United States\nCompanyName: *Rapiddown*\nFileDescription: Setup Manager\nFileVersion: 1.0.0.30\nInternalName: *install*\nLegalCopyright: copyright·©·2013\nOriginalFilename: inst4ll·3x3 \nProductVersion: 3.0.26"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0040\ne_cp: 0x0001\ne_crlc: 0x0000\ne_cparhdr: 0x0002\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0xB400\ne_oeminfo: 0xCD09\ne_lfanew: 0x00000040"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2013-Dec-31 11:25:30\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x00019200\nSizeOfInitializedData: 0x00040E00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00060117 (Section: .\"\\xb75\\xe1\\xa1'=)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0001B000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00066000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00033F6C\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00002000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".\\xff`4`h%&:\n VirtualSize: 0x0005F000\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00023E00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.99875\n\n.\"\\xb75\\xe1\\xa1'=:\n VirtualSize: 0x00000C81\n VirtualAddress: 0x00060000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x00024000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.61901\n\n.rsrc:\n VirtualSize: 0x000045A8\n VirtualAddress: 0x00061000\n SizeOfRawData: 0x00004600\n PointerToRawData: 0x00024E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.78461"},"Imports":{"raw":"KERNEL32.DLL: GetModuleHandleA\n GetProcAddress\nUSER32.dll: wsprintfW\nADVAPI32.dll: RegOpenKeyExW\nSHELL32.dll: ShellExecuteExW\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.87297\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21254\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.93155\n\n105:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 55\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n106:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 46\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n107:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 43\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n108:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 58\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n109:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 26\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n110:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 44\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n111:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 41\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n112:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 57\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n113:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 47\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n114:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 59\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n115:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 45\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n116:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n117:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 61\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n118:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 26\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n119:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n104:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.45849\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.33209\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 965\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.17438\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.30\n ProductVersion: 3.0.26.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: *Rapiddown*\n FileDescription: Setup Manager\n FileVersion (#2): 1.0.0.30\n InternalName: *install*\n LegalCopyright: copyright·©·2013\n OriginalFilename: inst4ll·3x3 \n ProductVersion (#2): 3.0.26\n\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .\\xff`4`h%&\n Section .\\xff`4`h%& is both writable and executable.\n Unusual section name found: .\"\\xb75\\xe1\\xa1'=\n Section .\"\\xb75\\xe1\\xa1'= is both writable and executable.\n The PE only has 5 import(s).\n\nThe PE contains common functions which appear in legitimate applications.\n Can access the registry:\n RegOpenKeyExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: PortalProgramas\n Issuer: COMODO Code Signing CA 2\n\n\n\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.87297\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21254\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.93155\n\n105:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 55\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n106:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 46\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n107:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 43\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n108:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 58\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n109:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 26\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n110:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 44\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n111:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 41\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n112:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 57\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n113:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 47\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n114:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 59\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n115:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 45\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n116:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n117:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 61\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n118:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 26\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n119:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n104:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.45849\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.33209\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 965\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.17438\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.30\n ProductVersion: 3.0.26.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: *Rapiddown*\n FileDescription: Setup Manager\n FileVersion (#2): 1.0.0.30\n InternalName: *install*\n LegalCopyright: copyright·©·2013\n OriginalFilename: inst4ll·3x3 \n ProductVersion (#2): 3.0.26\n\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .\\xff`4`h%&\n Section .\\xff`4`h%& is both writable and executable.\n Unusual section name found: .\"\\xb75\\xe1\\xa1'=\n Section .\"\\xb75\\xe1\\xa1'= is both writable and executable.\n The PE only has 5 import(s).\n\nThe PE contains common functions which appear in legitimate applications.\n Can access the registry:\n RegOpenKeyExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: PortalProgramas\n Issuer: COMODO Code Signing CA 2\n\n\n\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[*] Warning: Resource is empty!\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Trojan.Win32.Bechiro.BCD-019f46cb5c4f7bc3a7e837813cf184c8.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze__sre24ph/output.txt"},"timestamp":"2026-07-09 22:31:44"} {"_id":{"$oid":"6a4fd7890108394cb24cdcfd"},"sha256":"3a93d0b4345900c5eddfaa574b721546312468a418f34b39bcefbbda9118b0cb","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Trojan.Loadmoney-019f46cc34147fd084091fe8c22bfcb2.exe\nDate: 2026-07-09 22:46:57\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Trojan.Loadmoney-019f46cc34147fd084091fe8c22bfcb2.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Feb-09 11:14:55\nDetected languages: Russian - Russia\nTLS Callbacks: 2 callback(s) detected.\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 7\nTimeDateStamp: 2014-Feb-09 11:14:55\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00002200\nSizeOfInitializedData: 0x0002E600\nSizeOfUninitializedData: 0x00000200\nAddressOfEntryPoint: 0x00001140 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00004000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00035000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000021D4\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00002200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.84195\n\n.data:\n VirtualSize: 0x0000B3A4\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x0000B400\n PointerToRawData: 0x00002600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.99396\n\n.bss:\n VirtualSize: 0x000000AC\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x000004E8\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0000DA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.32646\n\n.CRT:\n VirtualSize: 0x00000018\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000E000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.114463\n\n.tls:\n VirtualSize: 0x00000020\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000E200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.204488\n\n.rsrc:\n VirtualSize: 0x0002047C\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00020600\n PointerToRawData: 0x0000E400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.00571\n\n\nImports:\n--------\nKERNEL32.dll: DeleteCriticalSection\n EnterCriticalSection\n ExitProcess\n FreeLibrary\n GetCommandLineA\n GetLastError\n GetModuleHandleA\n GetProcAddress\n GetProcessHeap\n GetStartupInfoA\n HeapAlloc\n HeapFree\n InitializeCriticalSection\n IsBadReadPtr\n LeaveCriticalSection\n LoadLibraryA\n SetUnhandledExceptionFilter\n TlsGetValue\n VirtualAlloc\n VirtualFree\n VirtualProtect\n VirtualQuery\nmsvcrt.dll: __getmainargs\n __p__environ\n __p__fmode\n __set_app_type\n _cexit\n _iob\n _onexit\n _setmode\n _winmajor\n abort\n atexit\n calloc\n free\n fwrite\n malloc\n memcpy\n memmove\n memset\n signal\n strcmp\n vfprintf\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 3.38009\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 3.11671\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.27437\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.62105\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.20467\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 39730\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 7.92181\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.43882\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.8144\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.9451\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.26362\n\n128:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 146\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 2.92097\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 627\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.07507\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x00413019\nEndAddressOfRawData: 0x0041301C\nAddressOfIndex: 0x00410010\nAddressOfCallbacks: 0x00412004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x00402760\n 0x00402720\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n\n[ SUSPICIOUS ] The PE header may have been manually modified.\n The resource timestamps differ from the PE header:\n 2021-Jun-29 01:43:08\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: LLC Mail.Ru\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[*] Warning: [plugin_authenticode] Hashing algorithm 1.2.840.1015.13.2.5 is not supported.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Feb-09 11:14:55\nDetected languages: Russian - Russia\nTLS Callbacks: 2 callback(s) detected."},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 7\nTimeDateStamp: 2014-Feb-09 11:14:55\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00002200\nSizeOfInitializedData: 0x0002E600\nSizeOfUninitializedData: 0x00000200\nAddressOfEntryPoint: 0x00001140 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00004000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00035000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000021D4\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00002200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.84195\n\n.data:\n VirtualSize: 0x0000B3A4\n VirtualAddress: 0x00004000\n SizeOfRawData: 0x0000B400\n PointerToRawData: 0x00002600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.99396\n\n.bss:\n VirtualSize: 0x000000AC\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x000004E8\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0000DA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.32646\n\n.CRT:\n VirtualSize: 0x00000018\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000E000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.114463\n\n.tls:\n VirtualSize: 0x00000020\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000E200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.204488\n\n.rsrc:\n VirtualSize: 0x0002047C\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00020600\n PointerToRawData: 0x0000E400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.00571"},"Imports":{"raw":"KERNEL32.dll: DeleteCriticalSection\n EnterCriticalSection\n ExitProcess\n FreeLibrary\n GetCommandLineA\n GetLastError\n GetModuleHandleA\n GetProcAddress\n GetProcessHeap\n GetStartupInfoA\n HeapAlloc\n HeapFree\n InitializeCriticalSection\n IsBadReadPtr\n LeaveCriticalSection\n LoadLibraryA\n SetUnhandledExceptionFilter\n TlsGetValue\n VirtualAlloc\n VirtualFree\n VirtualProtect\n VirtualQuery\nmsvcrt.dll: __getmainargs\n __p__environ\n __p__fmode\n __set_app_type\n _cexit\n _iob\n _onexit\n _setmode\n _winmajor\n abort\n atexit\n calloc\n free\n fwrite\n malloc\n memcpy\n memmove\n memset\n signal\n strcmp\n vfprintf\n\nResources:\n1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 3.38009\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 3.11671\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.27437\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.62105\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.20467\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 39730\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 7.92181\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.43882\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.8144\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.9451\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.26362\n\n128:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 146\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 2.92097\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 627\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.07507\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x00413019\nEndAddressOfRawData: 0x0041301C\nAddressOfIndex: 0x00410010\nAddressOfCallbacks: 0x00412004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x00402760\n 0x00402720\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n\n[ SUSPICIOUS ] The PE header may have been manually modified.\n The resource timestamps differ from the PE header:\n 2021-Jun-29 01:43:08\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: LLC Mail.Ru\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[*] Warning: [plugin_authenticode] Hashing algorithm 1.2.840.1015.13.2.5 is not supported.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 3.38009\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 3.11671\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.27437\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.62105\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.20467\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 39730\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 7.92181\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.43882\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.8144\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 4.9451\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.26362\n\n128:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 146\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 2.92097\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 627\n TimeDateStamp: 2021-Jun-29 01:43:08\n Entropy: 5.07507\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x00413019\nEndAddressOfRawData: 0x0041301C\nAddressOfIndex: 0x00410010\nAddressOfCallbacks: 0x00412004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x00402760\n 0x00402720\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n\n[ SUSPICIOUS ] The PE header may have been manually modified.\n The resource timestamps differ from the PE header:\n 2021-Jun-29 01:43:08\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: LLC Mail.Ru\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[*] Warning: [plugin_authenticode] Hashing algorithm 1.2.840.1015.13.2.5 is not supported.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Trojan.Loadmoney-019f46cc34147fd084091fe8c22bfcb2.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_3nhe0oqj/output.txt"},"timestamp":"2026-07-09 22:46:57"} {"_id":{"$oid":"6a4fe21c0108394cb24cdcff"},"sha256":"69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/ZeusBankingVersion_26Nov2013-019f46cc6d177a639e90556ad66a7265.exe\nDate: 2026-07-09 23:32:04\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/ZeusBankingVersion_26Nov2013-019f46cc6d177a639e90556ad66a7265.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Nov-25 10:32:03\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000D8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 6\nTimeDateStamp: 2013-Nov-25 10:32:03\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x00023400\nSizeOfInitializedData: 0x0001A400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000A3B6 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00041000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0004CF27\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000B571\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000B600\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.70704\n\n.data:\n VirtualSize: 0x000128B1\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00012A00\n PointerToRawData: 0x0000BA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.12979\n\n.itext:\n VirtualSize: 0x0000084D\n VirtualAddress: 0x00020000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x0001E400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.81941\n\n.pdata:\n VirtualSize: 0x00017CBE\n VirtualAddress: 0x00021000\n SizeOfRawData: 0x00017E00\n PointerToRawData: 0x0001EE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.76812\n\n.rsrc:\n VirtualSize: 0x000058F2\n VirtualAddress: 0x00039000\n SizeOfRawData: 0x00005A00\n PointerToRawData: 0x00036C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.14284\n\n.reloc:\n VirtualSize: 0x000015EC\n VirtualAddress: 0x0003F000\n SizeOfRawData: 0x00001600\n PointerToRawData: 0x0003C600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.44113\n\n\nImports:\n--------\nSHLWAPI.dll: PathRemoveArgsA\n StrCmpNIA\n PathMatchSpecW\n IsCharSpaceA\n PathMakeSystemFolderA\n PathIsRelativeA\n PathIsSameRootA\n PathParseIconLocationW\n PathIsUNCServerA\n #14\n ChrCmpIW\n PathAddExtensionW\n PathCombineW\n PathQuoteSpacesA\n #157\n PathIsRootW\n #29\n PathRenameExtensionA\n PathIsPrefixA\n PathRelativePathToW\n ChrCmpIA\nKERNEL32.dll: GetPrivateProfileIntW\n LocalFree\n WinExec\n DeleteCriticalSection\n GetUserDefaultUILanguage\n FindNextFileA\n GetOEMCP\n SetCurrentDirectoryW\n LocalAlloc\n CreateFileMappingA\n GetCompressedFileSizeA\n GetEnvironmentVariableA\n GetConsoleAliasExesLengthW\n SizeofResource\n GetDriveTypeA\n WriteFile\n VirtualQueryEx\n IsBadReadPtr\n GetCurrentThread\n GetTickCount\n LocalUnlock\n GetEnvironmentVariableW\n GetSystemDefaultUILanguage\n FreeLibrary\n GlobalAddAtomA\n HeapFree\n GetLogicalDrives\n GetSystemDefaultLCID\n GetModuleHandleW\nUSER32.dll: CallWindowProcW\n GetProcessDefaultLayout\n UpdateWindow\n GetClipboardOwner\n AppendMenuA\n GetCaretPos\n GetSysColor\n DestroyCursor\n GetClipboardData\n GetScrollInfo\n FlashWindowEx\n GetAsyncKeyState\n SetLastErrorEx\n InflateRect\n GetCapture\n EnumClipboardFormats\n ShowCaret\n CopyAcceleratorTableA\n IsWindowEnabled\n DdeQueryNextServer\n LoadBitmapA\n DeleteMenu\n HideCaret\n GetWindowTextLengthW\n SwapMouseButton\n VkKeyScanA\n AllowSetForegroundWindow\n\nResources:\n----------\n1:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.85859\n\n2:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.10662\n\n3:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2508\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.16005\n\n4:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.89585\n\n5:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99214\n\n6:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2924\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.92752\n\n7:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.94345\n\n8:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.86724\n\n9:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.09483\n\n10:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.05085\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 378\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.92524\n\n\nRICH Header:\n------------\nXOR Key: 0x11BA2095\nUnmarked objects: 0\nASM objects (VS2008 SP1 build 30729): 1\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 86\n175 (VS2010 SP1 build 40219): 19\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n corect.com\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .itext\n Section .pdata is both writable and executable.\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n WinExec\n Enumerates local disk drives:\n GetDriveTypeA\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Nov-25 10:32:03\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000D8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 6\nTimeDateStamp: 2013-Nov-25 10:32:03\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x00023400\nSizeOfInitializedData: 0x0001A400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000A3B6 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00041000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0004CF27\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000B571\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000B600\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.70704\n\n.data:\n VirtualSize: 0x000128B1\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00012A00\n PointerToRawData: 0x0000BA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.12979\n\n.itext:\n VirtualSize: 0x0000084D\n VirtualAddress: 0x00020000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x0001E400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.81941\n\n.pdata:\n VirtualSize: 0x00017CBE\n VirtualAddress: 0x00021000\n SizeOfRawData: 0x00017E00\n PointerToRawData: 0x0001EE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.76812\n\n.rsrc:\n VirtualSize: 0x000058F2\n VirtualAddress: 0x00039000\n SizeOfRawData: 0x00005A00\n PointerToRawData: 0x00036C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.14284\n\n.reloc:\n VirtualSize: 0x000015EC\n VirtualAddress: 0x0003F000\n SizeOfRawData: 0x00001600\n PointerToRawData: 0x0003C600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.44113"},"Imports":{"raw":"SHLWAPI.dll: PathRemoveArgsA\n StrCmpNIA\n PathMatchSpecW\n IsCharSpaceA\n PathMakeSystemFolderA\n PathIsRelativeA\n PathIsSameRootA\n PathParseIconLocationW\n PathIsUNCServerA\n #14\n ChrCmpIW\n PathAddExtensionW\n PathCombineW\n PathQuoteSpacesA\n #157\n PathIsRootW\n #29\n PathRenameExtensionA\n PathIsPrefixA\n PathRelativePathToW\n ChrCmpIA\nKERNEL32.dll: GetPrivateProfileIntW\n LocalFree\n WinExec\n DeleteCriticalSection\n GetUserDefaultUILanguage\n FindNextFileA\n GetOEMCP\n SetCurrentDirectoryW\n LocalAlloc\n CreateFileMappingA\n GetCompressedFileSizeA\n GetEnvironmentVariableA\n GetConsoleAliasExesLengthW\n SizeofResource\n GetDriveTypeA\n WriteFile\n VirtualQueryEx\n IsBadReadPtr\n GetCurrentThread\n GetTickCount\n LocalUnlock\n GetEnvironmentVariableW\n GetSystemDefaultUILanguage\n FreeLibrary\n GlobalAddAtomA\n HeapFree\n GetLogicalDrives\n GetSystemDefaultLCID\n GetModuleHandleW\nUSER32.dll: CallWindowProcW\n GetProcessDefaultLayout\n UpdateWindow\n GetClipboardOwner\n AppendMenuA\n GetCaretPos\n GetSysColor\n DestroyCursor\n GetClipboardData\n GetScrollInfo\n FlashWindowEx\n GetAsyncKeyState\n SetLastErrorEx\n InflateRect\n GetCapture\n EnumClipboardFormats\n ShowCaret\n CopyAcceleratorTableA\n IsWindowEnabled\n DdeQueryNextServer\n LoadBitmapA\n DeleteMenu\n HideCaret\n GetWindowTextLengthW\n SwapMouseButton\n VkKeyScanA\n AllowSetForegroundWindow\n\nResources:\n1:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.85859\n\n2:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.10662\n\n3:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2508\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.16005\n\n4:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.89585\n\n5:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99214\n\n6:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2924\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.92752\n\n7:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.94345\n\n8:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.86724\n\n9:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.09483\n\n10:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.05085\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 378\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.92524\n\n\nRICH Header:\nXOR Key: 0x11BA2095\nUnmarked objects: 0\nASM objects (VS2008 SP1 build 30729): 1\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 86\n175 (VS2010 SP1 build 40219): 19"},"Exports":{},"Resources":{"raw":"1:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.85859\n\n2:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.10662\n\n3:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2508\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.16005\n\n4:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.89585\n\n5:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99214\n\n6:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2924\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.92752\n\n7:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2228\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.94345\n\n8:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1868\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.86724\n\n9:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.09483\n\n10:\n Type: RT_CURSOR\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2044\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.05085\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 378\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.92524\n\n\nRICH Header:\nXOR Key: 0x11BA2095\nUnmarked objects: 0\nASM objects (VS2008 SP1 build 30729): 1\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 86\n175 (VS2010 SP1 build 40219): 19\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n corect.com\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .itext\n Section .pdata is both writable and executable.\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n WinExec\n Enumerates local disk drives:\n GetDriveTypeA\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x11BA2095\nUnmarked objects: 0\nASM objects (VS2008 SP1 build 30729): 1\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 86\n175 (VS2010 SP1 build 40219): 19\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1"},"Interesting strings found in the binary":{"raw":"Contains domain names:\n corect.com\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .itext\n Section .pdata is both writable and executable.\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n WinExec\n Enumerates local disk drives:\n GetDriveTypeA\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/ZeusBankingVersion_26Nov2013-019f46cc6d177a639e90556ad66a7265.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_kq1xucr1/output.txt"},"timestamp":"2026-07-09 23:32:04"} {"_id":{"$oid":"6a4fe4410108394cb24cdd02"},"sha256":"d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/CryptoLocker_10Sep2013-019f46ccb6b079d0991fddbe54ea2e93.exe\nDate: 2026-07-09 23:41:13\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/CryptoLocker_10Sep2013-019f46ccb6b079d0991fddbe54ea2e93.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Sep-07 14:57:57\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2013-Sep-07 14:57:57\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x0000FC00\nSizeOfInitializedData: 0x00045600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00001E00 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00011000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00057000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000FA90\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000FC00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.34258\n\n.rdata:\n VirtualSize: 0x000045E8\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00004600\n PointerToRawData: 0x00010000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.87195\n\n.data:\n VirtualSize: 0x00000F24\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00014600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.09609\n\n.rsrc:\n VirtualSize: 0x0003DF78\n VirtualAddress: 0x00017000\n SizeOfRawData: 0x0003E000\n PointerToRawData: 0x00014800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.96587\n\n.reloc:\n VirtualSize: 0x00001F3C\n VirtualAddress: 0x00055000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x00052800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.89254\n\n\nImports:\n--------\nmsvcrt.dll: _except_handler3\n memcpy\n memmove\n _vsnprintf\n _vsnwprintf\n _purecall\n memset\nKERNEL32.dll: LoadLibraryW\n FreeLibrary\n GetProcAddress\n WideCharToMultiByte\n MultiByteToWideChar\n lstrcmpA\n GlobalLock\n GlobalAlloc\n GlobalUnlock\n GlobalFree\n CreateMutexW\n ReleaseMutex\n FindResourceExW\n LoadResource\n SizeofResource\n LockResource\n CreateProcessW\n SetFilePointerEx\n FindNextFileW\n SystemTimeToFileTime\n FileTimeToSystemTime\n FileTimeToLocalFileTime\n GetSystemTime\n GetDateFormatW\n GetTimeFormatW\n GetCurrentThreadId\n HeapReAlloc\n HeapAlloc\n HeapFree\n GetProcessHeap\n GetEnvironmentVariableW\n CopyFileExW\n GetUserDefaultUILanguage\n DeleteCriticalSection\n FindClose\n FindFirstFileW\n DeleteFileW\n GetFileTime\n SetLastError\n GetFileSizeEx\n FlushFileBuffers\n ReadFile\n WriteFile\n SetFileTime\n ResumeThread\n EnterCriticalSection\n LeaveCriticalSection\n InitializeCriticalSection\n QueryPerformanceCounter\n SetFileAttributesW\n CreateFileW\n GetFileAttributesW\n Sleep\n GetTickCount\n MoveFileExW\n ExpandEnvironmentStringsW\n GetVolumeInformationW\n GetDiskFreeSpaceExW\n WaitForMultipleObjects\n ResetEvent\n GetTempPathW\n GetLogicalDrives\n GetDriveTypeW\n LocalFree\n CloseHandle\n CreateEventW\n GetLastError\n GetHandleInformation\n SetThreadPriority\n GetModuleFileNameW\n GetCurrentThread\n GetModuleHandleW\n SetEvent\n GetComputerNameW\n WaitForSingleObject\n SetErrorMode\n GetCommandLineW\n ExitProcess\n CreateThread\nUSER32.dll: MessageBoxIndirectW\n InSendMessage\n ClientToScreen\n GetWindowLongW\n GetClassNameW\n GetCaretPos\n TrackPopupMenu\n AppendMenuW\n GetCursorPos\n CreatePopupMenu\n SetMenuDefaultItem\n DestroyMenu\n LoadIconW\n CloseClipboard\n EmptyClipboard\n OpenClipboard\n SetClipboardData\n SystemParametersInfoW\n ScrollWindowEx\n GetSystemMetrics\n UpdateWindow\n SetScrollInfo\n MessageBoxW\n EndPaint\n ScreenToClient\n GetWindowRect\n DrawTextW\n GetParent\n GetClientRect\n IsDialogMessageW\n DestroyWindow\n BeginPaint\n DrawFocusRect\n IntersectRect\n GetDlgItem\n SendMessageW\n GetDlgCtrlID\n SetWindowTextW\n MoveWindow\n GetDC\n ReleaseDC\n CharLowerW\n PostQuitMessage\n MsgWaitForMultipleObjects\n TranslateMessage\n PeekMessageW\n DispatchMessageW\n SetTimer\n PostMessageW\n SetFocus\n RegisterClassExW\n FlashWindowEx\n InvalidateRect\n GetWindowTextW\n MonitorFromWindow\n SetWindowPos\n ShowWindow\n GetForegroundWindow\n AdjustWindowRectEx\n IsWindowVisible\n GetMonitorInfoW\n DefWindowProcW\n DialogBoxParamW\n SetWindowLongW\n EndDialog\n CreateDialogParamW\n MonitorFromPoint\n UnregisterClassW\n SetForegroundWindow\n GetKeyState\n ReplyMessage\n GetScrollInfo\n CreateWindowExW\nADVAPI32.dll: CryptAcquireContextW\n RegSetValueExW\n RegEnumKeyExW\n RegFlushKey\n CryptSetKeyParam\n CryptGetKeyParam\n CryptReleaseContext\n CryptImportKey\n CryptEncrypt\n CryptGenKey\n CryptDestroyKey\n CryptDecrypt\n CryptGetHashParam\n CryptCreateHash\n CryptDestroyHash\n CryptHashData\n RegCreateKeyExW\n RegCloseKey\n CryptExportKey\n RegQueryValueExW\n RegQueryInfoKeyW\n RegDeleteKeyW\n RegDeleteValueW\n RegEnumValueW\n RegOpenKeyExW\nSHELL32.dll: SHGetFileInfoW\n SHGetFolderPathW\n ShellExecuteExW\n CommandLineToArgvW\nUxTheme.dll: SetWindowTheme\nGDI32.dll: GetDeviceCaps\n CreateSolidBrush\n GetObjectW\n CreateCompatibleDC\n SelectObject\n DeleteObject\n SetBkMode\n SetBkColor\n DeleteDC\n SetTextColor\n GetObjectA\n CreateFontIndirectW\nCOMCTL32.dll: InitCommonControlsEx\n #413\n #410\nSHLWAPI.dll: StrCmpW\n StrCmpNW\n StrCmpIW\n PathMatchSpecW\n PathRemoveBackslashW\n PathAddBackslashW\n #12\n PathFindFileNameW\n PathRemoveFileSpecW\n PathUnquoteSpacesW\n StrChrW\n PathQuoteSpacesW\nMSIMG32.dll: AlphaBlend\nWINHTTP.dll: WinHttpConnect\n WinHttpCloseHandle\n WinHttpQueryHeaders\n WinHttpWriteData\n WinHttpOpenRequest\n WinHttpReadData\n WinHttpAddRequestHeaders\n WinHttpSendRequest\n WinHttpReceiveResponse\n WinHttpOpen\ngdiplus.dll: GdipAlloc\n GdipDisposeImage\n GdipCreateHBITMAPFromBitmap\n GdipCloneImage\n GdiplusStartup\n GdipDeleteBrush\n GdipCreateBitmapFromStream\n GdipCreateFontFromLogfontA\n GdipSetStringFormatLineAlign\n GdipDeleteFont\n GdipDeleteGraphics\n GdipDrawImageRectI\n GdipSetStringFormatAlign\n GdipCreateSolidFill\n GdipDrawString\n GdipCreateFromHDC\n GdipSetStringFormatHotkeyPrefix\n GdipCreateStringFormat\n GdipDeleteStringFormat\n GdipCreateFontFromDC\n GdipGetImageHeight\n GdipGetImageWidth\n GdiplusShutdown\n GdipFree\n GdipCloneBrush\nole32.dll: CoInitializeEx\n CoUninitialize\n CoTaskMemFree\n StringFromGUID2\nCRYPT32.dll: CryptImportPublicKeyInfo\n CryptStringToBinaryA\n CryptDecodeObjectEx\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.09397\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.4059\n\n101:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 136\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.42447\n\n102:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.33711\n\n103:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 52\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83987\n\n104:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 116\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.41576\n\n105:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 108\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.46096\n\n101 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 201945\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9931\n Detected Filetype: PNG graphic file\n\n102 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 792\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.39007\n Detected Filetype: PNG graphic file\n\n103 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1499\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00093\n Detected Filetype: RTF Document\n\n2000:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 20488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98253\n Detected Filetype: PNG graphic file\n\n2002:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 10418\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96423\n Detected Filetype: PNG graphic file\n\n2003:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2305\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.27446\n Detected Filetype: PNG graphic file\n\n2004:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4162\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.92632\n Detected Filetype: PNG graphic file\n\n2010:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1229\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.11901\n Detected Filetype: RTF Document\n\n2012:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1248\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.0619\n Detected Filetype: RTF Document\n\n2013:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 786\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07183\n Detected Filetype: RTF Document\n\n2014:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1038\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.15607\n Detected Filetype: RTF Document\n\n101 (#3):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 34\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.21059\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07176\n\n\nRICH Header:\n------------\nXOR Key: 0x9B2CEDB7\nUnmarked objects: 0\nC++ objects (VS2008 SP1 build 30729): 1\nC objects (VS2008 SP1 build 30729): 1\nASM objects (VS2008 SP1 build 30729): 3\nTotal imports: 316\nImports (VS2008 SP1 build 30729): 33\n211 (VS2012 UPD3 build 60610): 67\nResource objects (VS2012 UPD3 build 60610): 1\n151: 1\nLinker (VS2012 UPD3 build 60610): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n Ukash.com\n bitcoin.org\n cashu.com\n en.wikipedia.org\n http://bitcoin.org\n http://en.wikipedia.org\n http://en.wikipedia.org/wiki/RSA_%28algorithm%29\n https://www.cashu.com\n https://www.cashu.com/\n https://www.cashu.com/site/en/fundcashU\n https://www.moneypak.com\n https://www.moneypak.com/\n https://www.moneypak.com/StoreLocator.aspx\n https://www.ukash.com\n https://www.ukash.com/en-GB/\n https://www.ukash.com/en-GB/registration/\n https://www.ukash.com/en-GB/where-to-get/\n moneypak.com\n ukash.com\n wikipedia.org\n www.cashu.com\n www.moneypak.com\n www.ukash.com\n\nCryptographic algorithms detected in the binary:\n Uses known Mersenne Twister constants\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryW\n GetProcAddress\n Can access the registry:\n RegSetValueExW\n RegEnumKeyExW\n RegFlushKey\n RegCreateKeyExW\n RegCloseKey\n RegQueryValueExW\n RegQueryInfoKeyW\n RegDeleteKeyW\n RegDeleteValueW\n RegEnumValueW\n RegOpenKeyExW\n Possibly launches other programs:\n CreateProcessW\n Uses Microsoft's cryptographic API:\n CryptAcquireContextW\n CryptSetKeyParam\n CryptGetKeyParam\n CryptReleaseContext\n CryptImportKey\n CryptEncrypt\n CryptGenKey\n CryptDestroyKey\n CryptDecrypt\n CryptGetHashParam\n CryptCreateHash\n CryptDestroyHash\n CryptHashData\n CryptExportKey\n CryptImportPublicKeyInfo\n CryptStringToBinaryA\n CryptDecodeObjectEx\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Has Internet access capabilities:\n WinHttpConnect\n WinHttpCloseHandle\n WinHttpQueryHeaders\n WinHttpWriteData\n WinHttpOpenRequest\n WinHttpReadData\n WinHttpAddRequestHeaders\n WinHttpSendRequest\n WinHttpReceiveResponse\n WinHttpOpen\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Can take screenshots:\n GetDC\n CreateCompatibleDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Sep-07 14:57:57\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2013-Sep-07 14:57:57\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x0000FC00\nSizeOfInitializedData: 0x00045600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00001E00 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00011000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00057000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000FA90\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000FC00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.34258\n\n.rdata:\n VirtualSize: 0x000045E8\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00004600\n PointerToRawData: 0x00010000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.87195\n\n.data:\n VirtualSize: 0x00000F24\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00014600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.09609\n\n.rsrc:\n VirtualSize: 0x0003DF78\n VirtualAddress: 0x00017000\n SizeOfRawData: 0x0003E000\n PointerToRawData: 0x00014800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.96587\n\n.reloc:\n VirtualSize: 0x00001F3C\n VirtualAddress: 0x00055000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x00052800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.89254"},"Imports":{"raw":"msvcrt.dll: _except_handler3\n memcpy\n memmove\n _vsnprintf\n _vsnwprintf\n _purecall\n memset\nKERNEL32.dll: LoadLibraryW\n FreeLibrary\n GetProcAddress\n WideCharToMultiByte\n MultiByteToWideChar\n lstrcmpA\n GlobalLock\n GlobalAlloc\n GlobalUnlock\n GlobalFree\n CreateMutexW\n ReleaseMutex\n FindResourceExW\n LoadResource\n SizeofResource\n LockResource\n CreateProcessW\n SetFilePointerEx\n FindNextFileW\n SystemTimeToFileTime\n FileTimeToSystemTime\n FileTimeToLocalFileTime\n GetSystemTime\n GetDateFormatW\n GetTimeFormatW\n GetCurrentThreadId\n HeapReAlloc\n HeapAlloc\n HeapFree\n GetProcessHeap\n GetEnvironmentVariableW\n CopyFileExW\n GetUserDefaultUILanguage\n DeleteCriticalSection\n FindClose\n FindFirstFileW\n DeleteFileW\n GetFileTime\n SetLastError\n GetFileSizeEx\n FlushFileBuffers\n ReadFile\n WriteFile\n SetFileTime\n ResumeThread\n EnterCriticalSection\n LeaveCriticalSection\n InitializeCriticalSection\n QueryPerformanceCounter\n SetFileAttributesW\n CreateFileW\n GetFileAttributesW\n Sleep\n GetTickCount\n MoveFileExW\n ExpandEnvironmentStringsW\n GetVolumeInformationW\n GetDiskFreeSpaceExW\n WaitForMultipleObjects\n ResetEvent\n GetTempPathW\n GetLogicalDrives\n GetDriveTypeW\n LocalFree\n CloseHandle\n CreateEventW\n GetLastError\n GetHandleInformation\n SetThreadPriority\n GetModuleFileNameW\n GetCurrentThread\n GetModuleHandleW\n SetEvent\n GetComputerNameW\n WaitForSingleObject\n SetErrorMode\n GetCommandLineW\n ExitProcess\n CreateThread\nUSER32.dll: MessageBoxIndirectW\n InSendMessage\n ClientToScreen\n GetWindowLongW\n GetClassNameW\n GetCaretPos\n TrackPopupMenu\n AppendMenuW\n GetCursorPos\n CreatePopupMenu\n SetMenuDefaultItem\n DestroyMenu\n LoadIconW\n CloseClipboard\n EmptyClipboard\n OpenClipboard\n SetClipboardData\n SystemParametersInfoW\n ScrollWindowEx\n GetSystemMetrics\n UpdateWindow\n SetScrollInfo\n MessageBoxW\n EndPaint\n ScreenToClient\n GetWindowRect\n DrawTextW\n GetParent\n GetClientRect\n IsDialogMessageW\n DestroyWindow\n BeginPaint\n DrawFocusRect\n IntersectRect\n GetDlgItem\n SendMessageW\n GetDlgCtrlID\n SetWindowTextW\n MoveWindow\n GetDC\n ReleaseDC\n CharLowerW\n PostQuitMessage\n MsgWaitForMultipleObjects\n TranslateMessage\n PeekMessageW\n DispatchMessageW\n SetTimer\n PostMessageW\n SetFocus\n RegisterClassExW\n FlashWindowEx\n InvalidateRect\n GetWindowTextW\n MonitorFromWindow\n SetWindowPos\n ShowWindow\n GetForegroundWindow\n AdjustWindowRectEx\n IsWindowVisible\n GetMonitorInfoW\n DefWindowProcW\n DialogBoxParamW\n SetWindowLongW\n EndDialog\n CreateDialogParamW\n MonitorFromPoint\n UnregisterClassW\n SetForegroundWindow\n GetKeyState\n ReplyMessage\n GetScrollInfo\n CreateWindowExW\nADVAPI32.dll: CryptAcquireContextW\n RegSetValueExW\n RegEnumKeyExW\n RegFlushKey\n CryptSetKeyParam\n CryptGetKeyParam\n CryptReleaseContext\n CryptImportKey\n CryptEncrypt\n CryptGenKey\n CryptDestroyKey\n CryptDecrypt\n CryptGetHashParam\n CryptCreateHash\n CryptDestroyHash\n CryptHashData\n RegCreateKeyExW\n RegCloseKey\n CryptExportKey\n RegQueryValueExW\n RegQueryInfoKeyW\n RegDeleteKeyW\n RegDeleteValueW\n RegEnumValueW\n RegOpenKeyExW\nSHELL32.dll: SHGetFileInfoW\n SHGetFolderPathW\n ShellExecuteExW\n CommandLineToArgvW\nUxTheme.dll: SetWindowTheme\nGDI32.dll: GetDeviceCaps\n CreateSolidBrush\n GetObjectW\n CreateCompatibleDC\n SelectObject\n DeleteObject\n SetBkMode\n SetBkColor\n DeleteDC\n SetTextColor\n GetObjectA\n CreateFontIndirectW\nCOMCTL32.dll: InitCommonControlsEx\n #413\n #410\nSHLWAPI.dll: StrCmpW\n StrCmpNW\n StrCmpIW\n PathMatchSpecW\n PathRemoveBackslashW\n PathAddBackslashW\n #12\n PathFindFileNameW\n PathRemoveFileSpecW\n PathUnquoteSpacesW\n StrChrW\n PathQuoteSpacesW\nMSIMG32.dll: AlphaBlend\nWINHTTP.dll: WinHttpConnect\n WinHttpCloseHandle\n WinHttpQueryHeaders\n WinHttpWriteData\n WinHttpOpenRequest\n WinHttpReadData\n WinHttpAddRequestHeaders\n WinHttpSendRequest\n WinHttpReceiveResponse\n WinHttpOpen\ngdiplus.dll: GdipAlloc\n GdipDisposeImage\n GdipCreateHBITMAPFromBitmap\n GdipCloneImage\n GdiplusStartup\n GdipDeleteBrush\n GdipCreateBitmapFromStream\n GdipCreateFontFromLogfontA\n GdipSetStringFormatLineAlign\n GdipDeleteFont\n GdipDeleteGraphics\n GdipDrawImageRectI\n GdipSetStringFormatAlign\n GdipCreateSolidFill\n GdipDrawString\n GdipCreateFromHDC\n GdipSetStringFormatHotkeyPrefix\n GdipCreateStringFormat\n GdipDeleteStringFormat\n GdipCreateFontFromDC\n GdipGetImageHeight\n GdipGetImageWidth\n GdiplusShutdown\n GdipFree\n GdipCloneBrush\nole32.dll: CoInitializeEx\n CoUninitialize\n CoTaskMemFree\n StringFromGUID2\nCRYPT32.dll: CryptImportPublicKeyInfo\n CryptStringToBinaryA\n CryptDecodeObjectEx\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.09397\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.4059\n\n101:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 136\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.42447\n\n102:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.33711\n\n103:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 52\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83987\n\n104:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 116\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.41576\n\n105:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 108\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.46096\n\n101 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 201945\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9931\n Detected Filetype: PNG graphic file\n\n102 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 792\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.39007\n Detected Filetype: PNG graphic file\n\n103 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1499\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00093\n Detected Filetype: RTF Document\n\n2000:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 20488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98253\n Detected Filetype: PNG graphic file\n\n2002:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 10418\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96423\n Detected Filetype: PNG graphic file\n\n2003:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2305\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.27446\n Detected Filetype: PNG graphic file\n\n2004:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4162\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.92632\n Detected Filetype: PNG graphic file\n\n2010:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1229\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.11901\n Detected Filetype: RTF Document\n\n2012:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1248\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.0619\n Detected Filetype: RTF Document\n\n2013:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 786\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07183\n Detected Filetype: RTF Document\n\n2014:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1038\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.15607\n Detected Filetype: RTF Document\n\n101 (#3):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 34\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.21059\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07176\n\n\nRICH Header:\nXOR Key: 0x9B2CEDB7\nUnmarked objects: 0\nC++ objects (VS2008 SP1 build 30729): 1\nC objects (VS2008 SP1 build 30729): 1\nASM objects (VS2008 SP1 build 30729): 3\nTotal imports: 316\nImports (VS2008 SP1 build 30729): 33\n211 (VS2012 UPD3 build 60610): 67\nResource objects (VS2012 UPD3 build 60610): 1\n151: 1\nLinker (VS2012 UPD3 build 60610): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n Ukash.com\n bitcoin.org\n cashu.com\n en.wikipedia.org\n http://bitcoin.org\n http://en.wikipedia.org\n http://en.wikipedia.org/wiki/RSA_%28algorithm%29\n https://www.cashu.com\n https://www.cashu.com/\n https://www.cashu.com/site/en/fundcashU\n https://www.moneypak.com\n https://www.moneypak.com/\n https://www.moneypak.com/StoreLocator.aspx\n https://www.ukash.com\n https://www.ukash.com/en-GB/\n https://www.ukash.com/en-GB/registration/\n https://www.ukash.com/en-GB/where-to-get/\n moneypak.com\n ukash.com\n wikipedia.org\n www.cashu.com\n www.moneypak.com\n www.ukash.com\n\nCryptographic algorithms detected in the binary:\n Uses known Mersenne Twister constants\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryW\n GetProcAddress\n Can access the registry:\n RegSetValueExW\n RegEnumKeyExW\n RegFlushKey\n RegCreateKeyExW\n RegCloseKey\n RegQueryValueExW\n RegQueryInfoKeyW\n RegDeleteKeyW\n RegDeleteValueW\n RegEnumValueW\n RegOpenKeyExW\n Possibly launches other programs:\n CreateProcessW\n Uses Microsoft's cryptographic API:\n CryptAcquireContextW\n CryptSetKeyParam\n CryptGetKeyParam\n CryptReleaseContext\n CryptImportKey\n CryptEncrypt\n CryptGenKey\n CryptDestroyKey\n CryptDecrypt\n CryptGetHashParam\n CryptCreateHash\n CryptDestroyHash\n CryptHashData\n CryptExportKey\n CryptImportPublicKeyInfo\n CryptStringToBinaryA\n CryptDecodeObjectEx\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Has Internet access capabilities:\n WinHttpConnect\n WinHttpCloseHandle\n WinHttpQueryHeaders\n WinHttpWriteData\n WinHttpOpenRequest\n WinHttpReadData\n WinHttpAddRequestHeaders\n WinHttpSendRequest\n WinHttpReceiveResponse\n WinHttpOpen\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Can take screenshots:\n GetDC\n CreateCompatibleDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.09397\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.4059\n\n101:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 136\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.42447\n\n102:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.33711\n\n103:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 52\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83987\n\n104:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 116\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.41576\n\n105:\n Type: RT_DIALOG\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 108\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.46096\n\n101 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 201945\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9931\n Detected Filetype: PNG graphic file\n\n102 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 792\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.39007\n Detected Filetype: PNG graphic file\n\n103 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1499\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00093\n Detected Filetype: RTF Document\n\n2000:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 20488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98253\n Detected Filetype: PNG graphic file\n\n2002:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 10418\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96423\n Detected Filetype: PNG graphic file\n\n2003:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2305\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.27446\n Detected Filetype: PNG graphic file\n\n2004:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4162\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.92632\n Detected Filetype: PNG graphic file\n\n2010:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1229\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.11901\n Detected Filetype: RTF Document\n\n2012:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1248\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.0619\n Detected Filetype: RTF Document\n\n2013:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 786\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07183\n Detected Filetype: RTF Document\n\n2014:\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1038\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.15607\n Detected Filetype: RTF Document\n\n101 (#3):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 34\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.21059\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.07176\n\n\nRICH Header:\nXOR Key: 0x9B2CEDB7\nUnmarked objects: 0\nC++ objects (VS2008 SP1 build 30729): 1\nC objects (VS2008 SP1 build 30729): 1\nASM objects (VS2008 SP1 build 30729): 3\nTotal imports: 316\nImports (VS2008 SP1 build 30729): 33\n211 (VS2012 UPD3 build 60610): 67\nResource objects (VS2012 UPD3 build 60610): 1\n151: 1\nLinker (VS2012 UPD3 build 60610): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n Ukash.com\n bitcoin.org\n cashu.com\n en.wikipedia.org\n http://bitcoin.org\n http://en.wikipedia.org\n http://en.wikipedia.org/wiki/RSA_%28algorithm%29\n https://www.cashu.com\n https://www.cashu.com/\n https://www.cashu.com/site/en/fundcashU\n https://www.moneypak.com\n https://www.moneypak.com/\n https://www.moneypak.com/StoreLocator.aspx\n https://www.ukash.com\n https://www.ukash.com/en-GB/\n https://www.ukash.com/en-GB/registration/\n https://www.ukash.com/en-GB/where-to-get/\n moneypak.com\n ukash.com\n wikipedia.org\n www.cashu.com\n www.moneypak.com\n www.ukash.com\n\nCryptographic algorithms detected in the binary:\n Uses known Mersenne Twister constants\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryW\n GetProcAddress\n Can access the registry:\n RegSetValueExW\n RegEnumKeyExW\n RegFlushKey\n RegCreateKeyExW\n RegCloseKey\n RegQueryValueExW\n RegQueryInfoKeyW\n RegDeleteKeyW\n RegDeleteValueW\n RegEnumValueW\n RegOpenKeyExW\n Possibly launches other programs:\n CreateProcessW\n Uses Microsoft's cryptographic API:\n CryptAcquireContextW\n CryptSetKeyParam\n CryptGetKeyParam\n CryptReleaseContext\n CryptImportKey\n CryptEncrypt\n CryptGenKey\n CryptDestroyKey\n CryptDecrypt\n CryptGetHashParam\n CryptCreateHash\n CryptDestroyHash\n CryptHashData\n CryptExportKey\n CryptImportPublicKeyInfo\n CryptStringToBinaryA\n CryptDecodeObjectEx\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Has Internet access capabilities:\n WinHttpConnect\n WinHttpCloseHandle\n WinHttpQueryHeaders\n WinHttpWriteData\n WinHttpOpenRequest\n WinHttpReadData\n WinHttpAddRequestHeaders\n WinHttpSendRequest\n WinHttpReceiveResponse\n WinHttpOpen\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Can take screenshots:\n GetDC\n CreateCompatibleDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x9B2CEDB7\nUnmarked objects: 0\nC++ objects (VS2008 SP1 build 30729): 1\nC objects (VS2008 SP1 build 30729): 1\nASM objects (VS2008 SP1 build 30729): 3\nTotal imports: 316\nImports (VS2008 SP1 build 30729): 33\n211 (VS2012 UPD3 build 60610): 67\nResource objects (VS2012 UPD3 build 60610): 1\n151: 1\nLinker (VS2012 UPD3 build 60610): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n Ukash.com\n bitcoin.org\n cashu.com\n en.wikipedia.org\n http://bitcoin.org\n http://en.wikipedia.org\n http://en.wikipedia.org/wiki/RSA_%28algorithm%29\n https://www.cashu.com\n https://www.cashu.com/\n https://www.cashu.com/site/en/fundcashU\n https://www.moneypak.com\n https://www.moneypak.com/\n https://www.moneypak.com/StoreLocator.aspx\n https://www.ukash.com\n https://www.ukash.com/en-GB/\n https://www.ukash.com/en-GB/registration/\n https://www.ukash.com/en-GB/where-to-get/\n moneypak.com\n ukash.com\n wikipedia.org\n www.cashu.com\n www.moneypak.com\n www.ukash.com\n\nCryptographic algorithms detected in the binary:\n Uses known Mersenne Twister constants\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryW\n GetProcAddress\n Can access the registry:\n RegSetValueExW\n RegEnumKeyExW\n RegFlushKey\n RegCreateKeyExW\n RegCloseKey\n RegQueryValueExW\n RegQueryInfoKeyW\n RegDeleteKeyW\n RegDeleteValueW\n RegEnumValueW\n RegOpenKeyExW\n Possibly launches other programs:\n CreateProcessW\n Uses Microsoft's cryptographic API:\n CryptAcquireContextW\n CryptSetKeyParam\n CryptGetKeyParam\n CryptReleaseContext\n CryptImportKey\n CryptEncrypt\n CryptGenKey\n CryptDestroyKey\n CryptDecrypt\n CryptGetHashParam\n CryptCreateHash\n CryptDestroyHash\n CryptHashData\n CryptExportKey\n CryptImportPublicKeyInfo\n CryptStringToBinaryA\n CryptDecodeObjectEx\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Has Internet access capabilities:\n WinHttpConnect\n WinHttpCloseHandle\n WinHttpQueryHeaders\n WinHttpWriteData\n WinHttpOpenRequest\n WinHttpReadData\n WinHttpAddRequestHeaders\n WinHttpSendRequest\n WinHttpReceiveResponse\n WinHttpOpen\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Can take screenshots:\n GetDC\n CreateCompatibleDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/CryptoLocker_10Sep2013-019f46ccb6b079d0991fddbe54ea2e93.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_a1od69qb/output.txt"},"timestamp":"2026-07-09 23:41:13"} {"_id":{"$oid":"6a4fe6040108394cb24cdd06"},"sha256":"e9cfb6eb3a77cd6ea162cf4cb131b5f6ad2a679c0ba9757d718c2f9265a9668f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Win32.Unclassified-019f46cce97272f2a25235fe9f51e257.exe\nDate: 2026-07-09 23:48:44\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Win32.Unclassified-019f46cce97272f2a25235fe9f51e257.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2018-Feb-03 17:26:47\nComments: DesCloperTol\nCompanyName: CloperTolCompy\nFileDescription: CloperTol\nFileVersion: 0.0.1.3\nInternalName: sdddddddd.exe\nLegalCopyright: CloperTol\nOriginalFilename: sdddddddd.exe\nProductName: CloperToClope\nProductVersion: 0.0.1.3\nAssembly Version: 0.0.1.2\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2018-Feb-03 17:26:47\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x0005D800\nSizeOfInitializedData: 0x00000A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0005F7EE (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00060000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00064000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0005D7F4\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x0005D800\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99365\n\n.rsrc:\n VirtualSize: 0x00000700\n VirtualAddress: 0x00060000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0005DA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.23626\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00062000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0005E200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0980042\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.33038\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83321\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28356\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.1.3\n ProductVersion: 0.0.1.3\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: DesCloperTol\n CompanyName: CloperTolCompy\n FileDescription: CloperTol\n FileVersion (#2): 0.0.1.3\n InternalName: sdddddddd.exe\n LegalCopyright: CloperTol\n OriginalFilename: sdddddddd.exe\n ProductName: CloperToClope\n ProductVersion (#2): 0.0.1.3\n Assembly Version: 0.0.1.2\n\n\nMatching compiler(s):\n .NET executable -> Microsoft\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2018-Feb-03 17:26:47\nComments: DesCloperTol\nCompanyName: CloperTolCompy\nFileDescription: CloperTol\nFileVersion: 0.0.1.3\nInternalName: sdddddddd.exe\nLegalCopyright: CloperTol\nOriginalFilename: sdddddddd.exe\nProductName: CloperToClope\nProductVersion: 0.0.1.3\nAssembly Version: 0.0.1.2"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2018-Feb-03 17:26:47\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x0005D800\nSizeOfInitializedData: 0x00000A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0005F7EE (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00060000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00064000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0005D7F4\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x0005D800\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99365\n\n.rsrc:\n VirtualSize: 0x00000700\n VirtualAddress: 0x00060000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0005DA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.23626\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00062000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0005E200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0980042"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.33038\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83321\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28356\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.1.3\n ProductVersion: 0.0.1.3\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: DesCloperTol\n CompanyName: CloperTolCompy\n FileDescription: CloperTol\n FileVersion (#2): 0.0.1.3\n InternalName: sdddddddd.exe\n LegalCopyright: CloperTol\n OriginalFilename: sdddddddd.exe\n ProductName: CloperToClope\n ProductVersion (#2): 0.0.1.3\n Assembly Version: 0.0.1.2\n\n\nMatching compiler(s):\n .NET executable -> Microsoft\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.33038\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83321\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28356\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.1.3\n ProductVersion: 0.0.1.3\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: DesCloperTol\n CompanyName: CloperTolCompy\n FileDescription: CloperTol\n FileVersion (#2): 0.0.1.3\n InternalName: sdddddddd.exe\n LegalCopyright: CloperTol\n OriginalFilename: sdddddddd.exe\n ProductName: CloperToClope\n ProductVersion (#2): 0.0.1.3\n Assembly Version: 0.0.1.2\n\n\nMatching compiler(s):\n .NET executable -> Microsoft\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Win32.Unclassified-019f46cce97272f2a25235fe9f51e257.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_99z_uxss/output.txt"},"timestamp":"2026-07-09 23:48:44"} {"_id":{"$oid":"6a4fecc20108394cb24cdd08"},"sha256":"40050153dceec2c8fbb1912f8eeabe449d1e265f0c8198008be8b34e5403e731","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Trojan.Kovter-019f46cd0f817e919789e963b55061ca.exe\nDate: 2026-07-10 00:17:30\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Trojan.Kovter-019f46cd0f817e919789e963b55061ca.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2003-Oct-31 03:23:33\nDetected languages: Chinese - Hong Kong SAR\n Polish - Poland\nCompanyName: Tracker Software Products (Canada) Ltd.\nFileVersion: 2.5.0314.0000\nLegalCopyright: Copyright (C) 2001-2015 by Tracker Software Products (Canada) Ltd.\nLegalTrademarks: Tracker Software Products (Canada) Ltd.\nProductVersion: 2.5\nSpecialBuild: \nPrivateBuild: \nProductName: PDF-XChange Viewer\nComments: PDF-XChange Viewer\nFileDescription: PDF-XChange Viewer\nInternalName: PDF-XChange Viewer\nOriginalFilename: PDFXCview.exe\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 8\nTimeDateStamp: 2003-Oct-31 03:23:33\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_BYTES_REVERSED_LO\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00013000\nSizeOfInitializedData: 0x0005A600\nSizeOfUninitializedData: 0x0003C400\nAddressOfEntryPoint: 0x00003DBB (Section: .text\\x00\\x00\\x01)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00014000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00071BE4\nSizeOfHeaders: 0x00000400\nChecksum: 0x00070906\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text\\x00\\x00\\x01:\n VirtualSize: 0x00013000\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00012A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.26344\n\n.data:\n VirtualSize: 0x00004730\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00004800\n PointerToRawData: 0x00012E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.9608\n\n.rdata\\x00\\x01:\n VirtualSize: 0x0003C3EC\n VirtualAddress: 0x00019000\n SizeOfRawData: 0x0003C400\n PointerToRawData: 0x00017600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.95631\n\n.bss:\n VirtualSize: 0x00004000\n VirtualAddress: 0x00056000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00053A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x000027A4\n VirtualAddress: 0x0005A000\n SizeOfRawData: 0x00002800\n PointerToRawData: 0x00053A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.6323\n\n.CRT:\n VirtualSize: 0x00000300\n VirtualAddress: 0x0005D000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00056200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.51123\n\n.tls\\x00\\x00\\x00`:\n VirtualSize: 0x00000020\n VirtualAddress: 0x0005E000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00056600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.32022\n\n.rsrc:\n VirtualSize: 0x00012BE4\n VirtualAddress: 0x0005F000\n SizeOfRawData: 0x00012C00\n PointerToRawData: 0x00056800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.29276\n\n\nImports:\n--------\nVERSION.dll: GetFileVersionInfoW\n GetFileVersionInfoSizeW\n VerQueryValueA\n GetFileVersionInfoA\n GetFileVersionInfoSizeA\nOLEAUT32.dll: SystemTimeToVariantTime\n VariantTimeToSystemTime\nKERNEL32.dll: DeleteFileW\n CloseHandle\n GetFileType\n GetSystemInfo\n GetStringTypeW\n GetCommandLineA\n MoveFileA\n VirtualFree\n GetConsoleMode\n RemoveDirectoryW\n GetFileAttributesA\n SetLastError\n SizeofResource\n CreateProcessW\n Module32Next\n GetStartupInfoA\n InterlockedIncrement\n GetDriveTypeA\n CopyFileW\n TlsFree\n CopyFileExA\n SetErrorMode\n DeleteFileA\n RemoveDirectoryA\n CompareStringA\n FileTimeToSystemTime\n MapViewOfFile\n InterlockedCompareExchange\n HeapReAlloc\n FindFirstFileExW\n GetModuleHandleW\n QueryPerformanceFrequency\n GetLongPathNameW\n CopyFileExW\n SetHandleCount\n GetProcessTimes\n InitializeCriticalSection\n GetFileSize\n GetFileAttributesExW\n InterlockedExchange\n SetEnvironmentVariableA\n WriteConsoleW\n GetStdHandle\n IsDebuggerPresent\n FindClose\n LeaveCriticalSection\n SetFilePointer\n FindFirstChangeNotificationA\n MoveFileW\n FindResourceA\n GetFileAttributesW\n TzSpecificLocalTimeToSystemTime\n SetUnhandledExceptionFilter\n MoveFileExW\n GetTempPathW\n CreateDirectoryExA\n GetProcAddress\n GetEnvironmentStringsW\n EnterCriticalSection\n MoveFileWithProgressA\n LoadLibraryA\n FlushFileBuffers\n QueryPerformanceCounter\n LocalFree\n SetEndOfFile\n FreeEnvironmentStringsA\n WriteFile\n CreateFileA\n CopyFileA\n FindFirstFileExA\n CreateDirectoryA\n CreateThread\n FindFirstFileW\n LoadLibraryExA\n SearchPathA\n SetStdHandle\n GetModuleHandleA\n FreeEnvironmentStringsW\n TlsGetValue\n GetDateFormatW\n GlobalFree\n FindNextFileW\n Module32First\n VirtualQuery\n CreateDirectoryExW\n GetStringTypeA\n FindFirstFileA\n OpenEventA\n GetTimeFormatW\n DeleteCriticalSection\n FreeLibrary\n CreateEventA\n GetCPInfo\n MoveFileWithProgressW\n WaitForSingleObject\n SetFileAttributesW\n GetVersion\n GetSystemDirectoryA\n HeapAlloc\n GetCurrentProcess\n GetCurrentThreadId\n LoadLibraryW\n GetCurrentProcessId\n GetOEMCP\n GetVersionExA\n OutputDebugStringA\n TlsAlloc\n GetModuleFileNameW\n FindNextFileA\n ReleaseMutex\n FormatMessageA\n GetUserDefaultLCID\n ReadFile\n LockResource\n RtlUnwind\n GetConsoleCP\n SetFileAttributesA\n GetCurrentThread\n GetShortPathNameA\n ExitProcess\n IsValidCodePage\n DeviceIoControl\n SetThreadPriority\n CreateFileW\n TlsSetValue\n LoadResource\n RaiseException\n LCMapStringW\n HeapDestroy\n CompareStringW\n SystemTimeToTzSpecificLocalTime\n GetLocaleInfoA\n GetThreadPriority\n LCMapStringA\n GetProcessHeap\n GetTempPathA\n FindFirstChangeNotificationW\n GetShortPathNameW\n WaitForMultipleObjects\n ResetEvent\n DebugBreak\n HeapSize\n HeapFree\n SetEvent\n GetEnvironmentStringsA\n OpenMutexA\n InterlockedDecrement\n LoadLibraryExW\n GetTimeFormatA\n GetLastError\n GetLongPathNameA\n GetFileAttributesExA\n GetSystemDefaultLCID\n GetACP\n GetModuleFileNameA\n CreateFileMappingA\n CreateToolhelp32Snapshot\n MoveFileExA\n CreateMutexA\n HeapCreate\n GlobalAlloc\n CreateProcessA\n GetConsoleOutputCP\n Sleep\n UnmapViewOfFile\nGDI32.dll: CreateFontIndirectA\n SetBkMode\n GetKerningPairsA\n CreateCompatibleDC\n DeleteDC\n GetGlyphOutlineW\n DeleteObject\n TextOutW\n GetTextExtentPoint32W\n CreateDIBSection\n TextOutA\n GetGlyphOutlineA\n GetICMProfileA\n Rectangle\n BitBlt\n GetDeviceCaps\n GetTextExtentPoint32A\n CreatePen\n SelectObject\n ExtTextOutA\n GetStockObject\n ExtTextOutW\ncomdlg32.dll: GetSaveFileNameW\n GetOpenFileNameA\n GetSaveFileNameA\n GetOpenFileNameW\nADVAPI32.dll: CryptAcquireContextA\n ReportEventA\n RegSetValueExA\n CryptDeriveKey\n CryptDecrypt\n RegCreateKeyExW\n RegEnumKeyExA\n RegQueryValueExA\n RegOpenKeyExW\n RegisterEventSourceA\n CryptCreateHash\n CryptHashData\n RegSetValueExW\n RegCloseKey\n RegEnumValueA\n RegOpenKeyExA\n CryptReleaseContext\n RegEnumKeyExW\n DeregisterEventSource\n RegEnumValueW\n CryptEncrypt\n RegCreateKeyExA\n RegQueryValueExW\n CheckTokenMembership\nUSER32.dll: DefWindowProcA\n SendMessageA\n ReleaseCapture\n SetFocus\n GetWindowTextLengthA\n GetClientRect\n CallWindowProcA\n FlashWindowEx\n SetCursor\n EnumThreadWindows\n DefWindowProcW\n GetWindowLongA\n MessageBoxA\n GetWindowTextLengthW\n CallWindowProcW\n CreateWindowExA\n MsgWaitForMultipleObjects\n SetMenuItemInfoW\n IsDialogMessageA\n LoadCursorA\n EnableWindow\n SetWindowLongA\n GetMenuItemInfoW\n RegisterClassW\n UnhookWindowsHookEx\n GetAsyncKeyState\n CreateDialogParamA\n SystemParametersInfoA\n PostQuitMessage\n InsertMenuItemA\n SetWindowPos\n DialogBoxIndirectParamA\n GetDC\n GetDlgItem\n SetForegroundWindow\n LoadImageA\n GetActiveWindow\n EndPaint\n IsWindowVisible\n RedrawWindow\n DialogBoxParamW\n AdjustWindowRectEx\n AppendMenuA\n BeginPaint\n SetWindowLongW\n GetFocus\n GetWindowTextW\n ShowWindow\n IsIconic\n GetWindowRect\n SetDlgItemTextA\n SetWindowTextA\n SetDlgItemTextW\n GetDesktopWindow\n GetMenuItemInfoA\n RegisterClassA\n MessageBoxW\n InsertMenuItemW\n GetWindowLongW\n GetClassInfoA\n CreateDialogParamW\n DispatchMessageA\n ScreenToClient\n AppendMenuW\n GetSystemMetrics\n GetTopWindow\n GetWindowTextA\n SendMessageW\n SetCapture\n EndDialog\n SetWindowTextW\n SetClassLongA\n DialogBoxParamA\n CallNextHookEx\n PostMessageA\n PeekMessageA\n ReleaseDC\n SetParent\n SetWindowsHookExA\n FindWindowExA\n ClientToScreen\n TranslateAcceleratorA\n SetClassLongW\n MessageBeep\n GetClassNameA\n GetCursor\n UnregisterClassW\n TranslateMessage\n DestroyWindow\n CreateWindowExW\n SetActiveWindow\n SetMenuItemInfoA\n GetWindow\n MoveWindow\n GetParent\n IsWindow\n LoadIconA\n UnregisterClassA\n GetForegroundWindow\n GetMenu\nWS2_32.dll: gethostbyname\nurlmon.dll: FindMimeFromData\nCOMCTL32.dll: PropertySheetA\n CreatePropertySheetPageW\n InitCommonControlsEx\n PropertySheetW\n CreatePropertySheetPageA\nWINMM.dll: mciSendCommandA\nSHELL32.dll: ShellExecuteA\n ShellExecuteExA\n SHGetMalloc\n Shell_NotifyIconA\n SHBrowseForFolderA\n SHGetFileInfoA\n DragQueryFileA\n SHGetFileInfoW\n SHFileOperationA\n Shell_NotifyIconW\n SHFileOperationW\n SHGetPathFromIDListA\n ShellExecuteW\n SHGetPathFromIDListW\n SHGetSpecialFolderPathW\n DragQueryFileW\n ShellExecuteExW\n SHBrowseForFolderW\n SHGetSpecialFolderPathA\nWININET.dll: InternetGetConnectedState\n InternetSetOptionA\n InternetCloseHandle\n InternetOpenA\n HttpQueryInfoA\n InternetGetConnectedStateExA\n InternetErrorDlg\n HttpAddRequestHeadersA\n HttpSendRequestA\n InternetWriteFile\n HttpSendRequestExA\n HttpEndRequestA\n HttpOpenRequestA\n InternetReadFile\n InternetCrackUrlA\n InternetQueryOptionA\n InternetSetStatusCallbackA\n InternetConnectA\n\nResources:\n----------\n202:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 423\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.25457\n Detected Filetype: PNG graphic file\n\n311:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1035\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.72908\n Detected Filetype: PNG graphic file\n\n426:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2816\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86246\n Detected Filetype: PNG graphic file\n\n431:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2815\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86853\n Detected Filetype: PNG graphic file\n\n456:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2797\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86602\n Detected Filetype: PNG graphic file\n\n473:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2813\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86264\n Detected Filetype: PNG graphic file\n\n525:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2946\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.87192\n Detected Filetype: PNG graphic file\n\n250:\n Type: WAVE\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 5524\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.88623\n Detected Filetype: WAV Resource Interchange File Format\n Detected Filetype (#2): Windows animated cursor\n\n1:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.43283\n\n2:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.6442\n\n3:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.64245\n\n4:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.62052\n\n5:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.59177\n\n6:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50257\n\n7:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.86964\n\n8:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.41635\n\n281:\n Type: RT_BITMAP\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.98215\n\n36:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.57319\n\n37:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.50135\n\n38:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.50764\n\n41:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.89691\n\n42:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.85579\n\n43:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.69924\n\n44:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.01227\n\n45:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.13307\n\n46:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.55344\n\n47:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.46322\n\n48:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.47117\n\n203:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8865\n\n204:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 812\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.36543\n\n207:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2152\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50339\n\n212:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 442\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18583\n\n213:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 186\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05699\n\n214:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1536\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.30742\n\n215:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 106\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.88525\n\n220:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2042\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39007\n\n221:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50591\n\n222:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 294\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23137\n\n223:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 178\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02211\n\n9:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 84\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.37789\n\n2065:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.27446\n\n3585:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 42\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.960953\n\n3601:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.17387\n\n3603:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19961\n\n3604:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 636\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.14802\n\n3605:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 262\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99043\n\n3606:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 218\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.83557\n\n3713:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 198\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74093\n\n3825:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 504\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04777\n\n3826:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 174\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77295\n\n3838:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 68\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.92392\n\n206:\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 56\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.78928\n\n207 (#2):\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 32\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.47641\n\n208:\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2394\n\n208 (#2):\n Type: RT_GROUP_CURSOR\n Language: Chinese - Hong Kong SAR\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83876\n Detected Filetype: Cursor file\n\n209:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.91924\n Detected Filetype: Cursor file\n\n210:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n211:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n212 (#2):\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n231:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n232:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n251:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n128:\n Type: RT_GROUP_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.95098\n Detected Filetype: Icon file\n\n129:\n Type: RT_GROUP_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 62\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.79332\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1156\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46111\n\n1 (#3):\n Type: RT_MANIFEST\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.12107\n\n128 (#2):\n Type: UNKNOWN\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 28\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.85988\n\n\nVersion Info:\n-------------\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2.5.314.0\n ProductVersion: 2.5.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: Polish - Poland\n CompanyName: Tracker Software Products (Canada) Ltd.\n FileVersion (#2): 2.5.0314.0000\n LegalCopyright: Copyright (C) 2001-2015 by Tracker Software Products (Canada) Ltd.\n LegalTrademarks: Tracker Software Products (Canada) Ltd.\n ProductVersion (#2): 2.5\n SpecialBuild: \n PrivateBuild: \n ProductName: PDF-XChange Viewer\n Comments: PDF-XChange Viewer\n FileDescription: PDF-XChange Viewer\n InternalName: PDF-XChange Viewer\n OriginalFilename: PDFXCview.exe\n\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .text\\x00\\x00\\x01\n Unusual section name found: .rdata\\x00\\x01\n Unusual section name found: .tls\\x00\\x00\\x00`\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExA\n LoadLibraryW\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n Can access the registry:\n RegSetValueExA\n RegCreateKeyExW\n RegEnumKeyExA\n RegQueryValueExA\n RegOpenKeyExW\n RegSetValueExW\n RegCloseKey\n RegEnumValueA\n RegOpenKeyExA\n RegEnumKeyExW\n RegEnumValueW\n RegCreateKeyExA\n RegQueryValueExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessA\n ShellExecuteA\n ShellExecuteW\n Uses Microsoft's cryptographic API:\n CryptAcquireContextA\n CryptDeriveKey\n CryptDecrypt\n CryptCreateHash\n CryptHashData\n CryptReleaseContext\n CryptEncrypt\n Can create temporary files:\n GetTempPathW\n CreateFileA\n CreateFileW\n GetTempPathA\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n CallNextHookEx\n GetForegroundWindow\n Has Internet access capabilities:\n InternetGetConnectedState\n InternetSetOptionA\n InternetCloseHandle\n InternetOpenA\n InternetGetConnectedStateExA\n InternetErrorDlg\n InternetWriteFile\n InternetReadFile\n InternetCrackUrlA\n InternetQueryOptionA\n InternetSetStatusCallbackA\n InternetConnectA\n Leverages the raw socket API to access the Internet:\n gethostbyname\n Functions related to the privilege level:\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeA\n Can take screenshots:\n CreateCompatibleDC\n BitBlt\n GetDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 780 bytes of data starting at offset 0x69400.\n The overlay data has an entropy of 7.71969 and is possibly compressed or encrypted.\n\n\n\n[!] Error: directory 6 has a RVA of 0 but a non-null size.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2003-Oct-31 03:23:33\nDetected languages: Chinese - Hong Kong SAR\n Polish - Poland\nCompanyName: Tracker Software Products (Canada) Ltd.\nFileVersion: 2.5.0314.0000\nLegalCopyright: Copyright (C) 2001-2015 by Tracker Software Products (Canada) Ltd.\nLegalTrademarks: Tracker Software Products (Canada) Ltd.\nProductVersion: 2.5\nSpecialBuild: \nPrivateBuild: \nProductName: PDF-XChange Viewer\nComments: PDF-XChange Viewer\nFileDescription: PDF-XChange Viewer\nInternalName: PDF-XChange Viewer\nOriginalFilename: PDFXCview.exe"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 8\nTimeDateStamp: 2003-Oct-31 03:23:33\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_BYTES_REVERSED_LO\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00013000\nSizeOfInitializedData: 0x0005A600\nSizeOfUninitializedData: 0x0003C400\nAddressOfEntryPoint: 0x00003DBB (Section: .text\\x00\\x00\\x01)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00014000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00071BE4\nSizeOfHeaders: 0x00000400\nChecksum: 0x00070906\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text\\x00\\x00\\x01:\n VirtualSize: 0x00013000\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00012A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.26344\n\n.data:\n VirtualSize: 0x00004730\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00004800\n PointerToRawData: 0x00012E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.9608\n\n.rdata\\x00\\x01:\n VirtualSize: 0x0003C3EC\n VirtualAddress: 0x00019000\n SizeOfRawData: 0x0003C400\n PointerToRawData: 0x00017600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.95631\n\n.bss:\n VirtualSize: 0x00004000\n VirtualAddress: 0x00056000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00053A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x000027A4\n VirtualAddress: 0x0005A000\n SizeOfRawData: 0x00002800\n PointerToRawData: 0x00053A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.6323\n\n.CRT:\n VirtualSize: 0x00000300\n VirtualAddress: 0x0005D000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00056200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.51123\n\n.tls\\x00\\x00\\x00`:\n VirtualSize: 0x00000020\n VirtualAddress: 0x0005E000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00056600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.32022\n\n.rsrc:\n VirtualSize: 0x00012BE4\n VirtualAddress: 0x0005F000\n SizeOfRawData: 0x00012C00\n PointerToRawData: 0x00056800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.29276"},"Imports":{"raw":"VERSION.dll: GetFileVersionInfoW\n GetFileVersionInfoSizeW\n VerQueryValueA\n GetFileVersionInfoA\n GetFileVersionInfoSizeA\nOLEAUT32.dll: SystemTimeToVariantTime\n VariantTimeToSystemTime\nKERNEL32.dll: DeleteFileW\n CloseHandle\n GetFileType\n GetSystemInfo\n GetStringTypeW\n GetCommandLineA\n MoveFileA\n VirtualFree\n GetConsoleMode\n RemoveDirectoryW\n GetFileAttributesA\n SetLastError\n SizeofResource\n CreateProcessW\n Module32Next\n GetStartupInfoA\n InterlockedIncrement\n GetDriveTypeA\n CopyFileW\n TlsFree\n CopyFileExA\n SetErrorMode\n DeleteFileA\n RemoveDirectoryA\n CompareStringA\n FileTimeToSystemTime\n MapViewOfFile\n InterlockedCompareExchange\n HeapReAlloc\n FindFirstFileExW\n GetModuleHandleW\n QueryPerformanceFrequency\n GetLongPathNameW\n CopyFileExW\n SetHandleCount\n GetProcessTimes\n InitializeCriticalSection\n GetFileSize\n GetFileAttributesExW\n InterlockedExchange\n SetEnvironmentVariableA\n WriteConsoleW\n GetStdHandle\n IsDebuggerPresent\n FindClose\n LeaveCriticalSection\n SetFilePointer\n FindFirstChangeNotificationA\n MoveFileW\n FindResourceA\n GetFileAttributesW\n TzSpecificLocalTimeToSystemTime\n SetUnhandledExceptionFilter\n MoveFileExW\n GetTempPathW\n CreateDirectoryExA\n GetProcAddress\n GetEnvironmentStringsW\n EnterCriticalSection\n MoveFileWithProgressA\n LoadLibraryA\n FlushFileBuffers\n QueryPerformanceCounter\n LocalFree\n SetEndOfFile\n FreeEnvironmentStringsA\n WriteFile\n CreateFileA\n CopyFileA\n FindFirstFileExA\n CreateDirectoryA\n CreateThread\n FindFirstFileW\n LoadLibraryExA\n SearchPathA\n SetStdHandle\n GetModuleHandleA\n FreeEnvironmentStringsW\n TlsGetValue\n GetDateFormatW\n GlobalFree\n FindNextFileW\n Module32First\n VirtualQuery\n CreateDirectoryExW\n GetStringTypeA\n FindFirstFileA\n OpenEventA\n GetTimeFormatW\n DeleteCriticalSection\n FreeLibrary\n CreateEventA\n GetCPInfo\n MoveFileWithProgressW\n WaitForSingleObject\n SetFileAttributesW\n GetVersion\n GetSystemDirectoryA\n HeapAlloc\n GetCurrentProcess\n GetCurrentThreadId\n LoadLibraryW\n GetCurrentProcessId\n GetOEMCP\n GetVersionExA\n OutputDebugStringA\n TlsAlloc\n GetModuleFileNameW\n FindNextFileA\n ReleaseMutex\n FormatMessageA\n GetUserDefaultLCID\n ReadFile\n LockResource\n RtlUnwind\n GetConsoleCP\n SetFileAttributesA\n GetCurrentThread\n GetShortPathNameA\n ExitProcess\n IsValidCodePage\n DeviceIoControl\n SetThreadPriority\n CreateFileW\n TlsSetValue\n LoadResource\n RaiseException\n LCMapStringW\n HeapDestroy\n CompareStringW\n SystemTimeToTzSpecificLocalTime\n GetLocaleInfoA\n GetThreadPriority\n LCMapStringA\n GetProcessHeap\n GetTempPathA\n FindFirstChangeNotificationW\n GetShortPathNameW\n WaitForMultipleObjects\n ResetEvent\n DebugBreak\n HeapSize\n HeapFree\n SetEvent\n GetEnvironmentStringsA\n OpenMutexA\n InterlockedDecrement\n LoadLibraryExW\n GetTimeFormatA\n GetLastError\n GetLongPathNameA\n GetFileAttributesExA\n GetSystemDefaultLCID\n GetACP\n GetModuleFileNameA\n CreateFileMappingA\n CreateToolhelp32Snapshot\n MoveFileExA\n CreateMutexA\n HeapCreate\n GlobalAlloc\n CreateProcessA\n GetConsoleOutputCP\n Sleep\n UnmapViewOfFile\nGDI32.dll: CreateFontIndirectA\n SetBkMode\n GetKerningPairsA\n CreateCompatibleDC\n DeleteDC\n GetGlyphOutlineW\n DeleteObject\n TextOutW\n GetTextExtentPoint32W\n CreateDIBSection\n TextOutA\n GetGlyphOutlineA\n GetICMProfileA\n Rectangle\n BitBlt\n GetDeviceCaps\n GetTextExtentPoint32A\n CreatePen\n SelectObject\n ExtTextOutA\n GetStockObject\n ExtTextOutW\ncomdlg32.dll: GetSaveFileNameW\n GetOpenFileNameA\n GetSaveFileNameA\n GetOpenFileNameW\nADVAPI32.dll: CryptAcquireContextA\n ReportEventA\n RegSetValueExA\n CryptDeriveKey\n CryptDecrypt\n RegCreateKeyExW\n RegEnumKeyExA\n RegQueryValueExA\n RegOpenKeyExW\n RegisterEventSourceA\n CryptCreateHash\n CryptHashData\n RegSetValueExW\n RegCloseKey\n RegEnumValueA\n RegOpenKeyExA\n CryptReleaseContext\n RegEnumKeyExW\n DeregisterEventSource\n RegEnumValueW\n CryptEncrypt\n RegCreateKeyExA\n RegQueryValueExW\n CheckTokenMembership\nUSER32.dll: DefWindowProcA\n SendMessageA\n ReleaseCapture\n SetFocus\n GetWindowTextLengthA\n GetClientRect\n CallWindowProcA\n FlashWindowEx\n SetCursor\n EnumThreadWindows\n DefWindowProcW\n GetWindowLongA\n MessageBoxA\n GetWindowTextLengthW\n CallWindowProcW\n CreateWindowExA\n MsgWaitForMultipleObjects\n SetMenuItemInfoW\n IsDialogMessageA\n LoadCursorA\n EnableWindow\n SetWindowLongA\n GetMenuItemInfoW\n RegisterClassW\n UnhookWindowsHookEx\n GetAsyncKeyState\n CreateDialogParamA\n SystemParametersInfoA\n PostQuitMessage\n InsertMenuItemA\n SetWindowPos\n DialogBoxIndirectParamA\n GetDC\n GetDlgItem\n SetForegroundWindow\n LoadImageA\n GetActiveWindow\n EndPaint\n IsWindowVisible\n RedrawWindow\n DialogBoxParamW\n AdjustWindowRectEx\n AppendMenuA\n BeginPaint\n SetWindowLongW\n GetFocus\n GetWindowTextW\n ShowWindow\n IsIconic\n GetWindowRect\n SetDlgItemTextA\n SetWindowTextA\n SetDlgItemTextW\n GetDesktopWindow\n GetMenuItemInfoA\n RegisterClassA\n MessageBoxW\n InsertMenuItemW\n GetWindowLongW\n GetClassInfoA\n CreateDialogParamW\n DispatchMessageA\n ScreenToClient\n AppendMenuW\n GetSystemMetrics\n GetTopWindow\n GetWindowTextA\n SendMessageW\n SetCapture\n EndDialog\n SetWindowTextW\n SetClassLongA\n DialogBoxParamA\n CallNextHookEx\n PostMessageA\n PeekMessageA\n ReleaseDC\n SetParent\n SetWindowsHookExA\n FindWindowExA\n ClientToScreen\n TranslateAcceleratorA\n SetClassLongW\n MessageBeep\n GetClassNameA\n GetCursor\n UnregisterClassW\n TranslateMessage\n DestroyWindow\n CreateWindowExW\n SetActiveWindow\n SetMenuItemInfoA\n GetWindow\n MoveWindow\n GetParent\n IsWindow\n LoadIconA\n UnregisterClassA\n GetForegroundWindow\n GetMenu\nWS2_32.dll: gethostbyname\nurlmon.dll: FindMimeFromData\nCOMCTL32.dll: PropertySheetA\n CreatePropertySheetPageW\n InitCommonControlsEx\n PropertySheetW\n CreatePropertySheetPageA\nWINMM.dll: mciSendCommandA\nSHELL32.dll: ShellExecuteA\n ShellExecuteExA\n SHGetMalloc\n Shell_NotifyIconA\n SHBrowseForFolderA\n SHGetFileInfoA\n DragQueryFileA\n SHGetFileInfoW\n SHFileOperationA\n Shell_NotifyIconW\n SHFileOperationW\n SHGetPathFromIDListA\n ShellExecuteW\n SHGetPathFromIDListW\n SHGetSpecialFolderPathW\n DragQueryFileW\n ShellExecuteExW\n SHBrowseForFolderW\n SHGetSpecialFolderPathA\nWININET.dll: InternetGetConnectedState\n InternetSetOptionA\n InternetCloseHandle\n InternetOpenA\n HttpQueryInfoA\n InternetGetConnectedStateExA\n InternetErrorDlg\n HttpAddRequestHeadersA\n HttpSendRequestA\n InternetWriteFile\n HttpSendRequestExA\n HttpEndRequestA\n HttpOpenRequestA\n InternetReadFile\n InternetCrackUrlA\n InternetQueryOptionA\n InternetSetStatusCallbackA\n InternetConnectA\n\nResources:\n202:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 423\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.25457\n Detected Filetype: PNG graphic file\n\n311:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1035\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.72908\n Detected Filetype: PNG graphic file\n\n426:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2816\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86246\n Detected Filetype: PNG graphic file\n\n431:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2815\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86853\n Detected Filetype: PNG graphic file\n\n456:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2797\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86602\n Detected Filetype: PNG graphic file\n\n473:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2813\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86264\n Detected Filetype: PNG graphic file\n\n525:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2946\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.87192\n Detected Filetype: PNG graphic file\n\n250:\n Type: WAVE\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 5524\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.88623\n Detected Filetype: WAV Resource Interchange File Format\n Detected Filetype (#2): Windows animated cursor\n\n1:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.43283\n\n2:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.6442\n\n3:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.64245\n\n4:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.62052\n\n5:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.59177\n\n6:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50257\n\n7:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.86964\n\n8:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.41635\n\n281:\n Type: RT_BITMAP\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.98215\n\n36:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.57319\n\n37:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.50135\n\n38:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.50764\n\n41:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.89691\n\n42:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.85579\n\n43:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.69924\n\n44:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.01227\n\n45:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.13307\n\n46:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.55344\n\n47:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.46322\n\n48:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.47117\n\n203:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8865\n\n204:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 812\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.36543\n\n207:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2152\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50339\n\n212:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 442\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18583\n\n213:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 186\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05699\n\n214:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1536\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.30742\n\n215:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 106\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.88525\n\n220:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2042\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39007\n\n221:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50591\n\n222:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 294\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23137\n\n223:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 178\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02211\n\n9:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 84\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.37789\n\n2065:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.27446\n\n3585:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 42\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.960953\n\n3601:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.17387\n\n3603:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19961\n\n3604:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 636\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.14802\n\n3605:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 262\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99043\n\n3606:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 218\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.83557\n\n3713:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 198\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74093\n\n3825:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 504\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04777\n\n3826:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 174\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77295\n\n3838:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 68\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.92392\n\n206:\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 56\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.78928\n\n207 (#2):\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 32\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.47641\n\n208:\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2394\n\n208 (#2):\n Type: RT_GROUP_CURSOR\n Language: Chinese - Hong Kong SAR\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83876\n Detected Filetype: Cursor file\n\n209:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.91924\n Detected Filetype: Cursor file\n\n210:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n211:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n212 (#2):\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n231:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n232:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n251:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n128:\n Type: RT_GROUP_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.95098\n Detected Filetype: Icon file\n\n129:\n Type: RT_GROUP_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 62\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.79332\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1156\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46111\n\n1 (#3):\n Type: RT_MANIFEST\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.12107\n\n128 (#2):\n Type: UNKNOWN\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 28\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.85988\n\n\nVersion Info:\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2.5.314.0\n ProductVersion: 2.5.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: Polish - Poland\n CompanyName: Tracker Software Products (Canada) Ltd.\n FileVersion (#2): 2.5.0314.0000\n LegalCopyright: Copyright (C) 2001-2015 by Tracker Software Products (Canada) Ltd.\n LegalTrademarks: Tracker Software Products (Canada) Ltd.\n ProductVersion (#2): 2.5\n SpecialBuild: \n PrivateBuild: \n ProductName: PDF-XChange Viewer\n Comments: PDF-XChange Viewer\n FileDescription: PDF-XChange Viewer\n InternalName: PDF-XChange Viewer\n OriginalFilename: PDFXCview.exe\n\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .text\\x00\\x00\\x01\n Unusual section name found: .rdata\\x00\\x01\n Unusual section name found: .tls\\x00\\x00\\x00`\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExA\n LoadLibraryW\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n Can access the registry:\n RegSetValueExA\n RegCreateKeyExW\n RegEnumKeyExA\n RegQueryValueExA\n RegOpenKeyExW\n RegSetValueExW\n RegCloseKey\n RegEnumValueA\n RegOpenKeyExA\n RegEnumKeyExW\n RegEnumValueW\n RegCreateKeyExA\n RegQueryValueExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessA\n ShellExecuteA\n ShellExecuteW\n Uses Microsoft's cryptographic API:\n CryptAcquireContextA\n CryptDeriveKey\n CryptDecrypt\n CryptCreateHash\n CryptHashData\n CryptReleaseContext\n CryptEncrypt\n Can create temporary files:\n GetTempPathW\n CreateFileA\n CreateFileW\n GetTempPathA\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n CallNextHookEx\n GetForegroundWindow\n Has Internet access capabilities:\n InternetGetConnectedState\n InternetSetOptionA\n InternetCloseHandle\n InternetOpenA\n InternetGetConnectedStateExA\n InternetErrorDlg\n InternetWriteFile\n InternetReadFile\n InternetCrackUrlA\n InternetQueryOptionA\n InternetSetStatusCallbackA\n InternetConnectA\n Leverages the raw socket API to access the Internet:\n gethostbyname\n Functions related to the privilege level:\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeA\n Can take screenshots:\n CreateCompatibleDC\n BitBlt\n GetDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 780 bytes of data starting at offset 0x69400.\n The overlay data has an entropy of 7.71969 and is possibly compressed or encrypted.\n\n\n\n[!] Error: directory 6 has a RVA of 0 but a non-null size.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"202:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 423\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.25457\n Detected Filetype: PNG graphic file\n\n311:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1035\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.72908\n Detected Filetype: PNG graphic file\n\n426:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2816\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86246\n Detected Filetype: PNG graphic file\n\n431:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2815\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86853\n Detected Filetype: PNG graphic file\n\n456:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2797\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86602\n Detected Filetype: PNG graphic file\n\n473:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2813\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.86264\n Detected Filetype: PNG graphic file\n\n525:\n Type: PNG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2946\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.87192\n Detected Filetype: PNG graphic file\n\n250:\n Type: WAVE\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 5524\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.88623\n Detected Filetype: WAV Resource Interchange File Format\n Detected Filetype (#2): Windows animated cursor\n\n1:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.43283\n\n2:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.6442\n\n3:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.64245\n\n4:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.62052\n\n5:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.59177\n\n6:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50257\n\n7:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.86964\n\n8:\n Type: RT_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 308\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.41635\n\n281:\n Type: RT_BITMAP\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.98215\n\n36:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.57319\n\n37:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.50135\n\n38:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.50764\n\n41:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.89691\n\n42:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.85579\n\n43:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.69924\n\n44:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.01227\n\n45:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.13307\n\n46:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.55344\n\n47:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.46322\n\n48:\n Type: RT_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.47117\n\n203:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8865\n\n204:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 812\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.36543\n\n207:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2152\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50339\n\n212:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 442\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.18583\n\n213:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 186\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05699\n\n214:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1536\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.30742\n\n215:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 106\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.88525\n\n220:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2042\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39007\n\n221:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 2214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50591\n\n222:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 294\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23137\n\n223:\n Type: RT_DIALOG\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 178\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.02211\n\n9:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 84\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.37789\n\n2065:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.27446\n\n3585:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 42\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.960953\n\n3601:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.17387\n\n3603:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 808\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19961\n\n3604:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 636\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.14802\n\n3605:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 262\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99043\n\n3606:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 218\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.83557\n\n3713:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 198\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74093\n\n3825:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 504\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04777\n\n3826:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 174\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77295\n\n3838:\n Type: RT_STRING\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 68\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.92392\n\n206:\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 56\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.78928\n\n207 (#2):\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 32\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.47641\n\n208:\n Type: RT_ACCELERATOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2394\n\n208 (#2):\n Type: RT_GROUP_CURSOR\n Language: Chinese - Hong Kong SAR\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.83876\n Detected Filetype: Cursor file\n\n209:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.91924\n Detected Filetype: Cursor file\n\n210:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n211:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n212 (#2):\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n231:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n232:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n251:\n Type: RT_GROUP_CURSOR\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.01924\n Detected Filetype: Cursor file\n\n128:\n Type: RT_GROUP_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.95098\n Detected Filetype: Icon file\n\n129:\n Type: RT_GROUP_ICON\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 62\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.79332\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 1156\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46111\n\n1 (#3):\n Type: RT_MANIFEST\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.12107\n\n128 (#2):\n Type: UNKNOWN\n Language: Polish - Poland\n Codepage: UNKNOWN\n Size: 28\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.85988\n\n\nVersion Info:\nResource LangID: Polish - Poland\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 2.5.314.0\n ProductVersion: 2.5.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: Polish - Poland\n CompanyName: Tracker Software Products (Canada) Ltd.\n FileVersion (#2): 2.5.0314.0000\n LegalCopyright: Copyright (C) 2001-2015 by Tracker Software Products (Canada) Ltd.\n LegalTrademarks: Tracker Software Products (Canada) Ltd.\n ProductVersion (#2): 2.5\n SpecialBuild: \n PrivateBuild: \n ProductName: PDF-XChange Viewer\n Comments: PDF-XChange Viewer\n FileDescription: PDF-XChange Viewer\n InternalName: PDF-XChange Viewer\n OriginalFilename: PDFXCview.exe\n\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .text\\x00\\x00\\x01\n Unusual section name found: .rdata\\x00\\x01\n Unusual section name found: .tls\\x00\\x00\\x00`\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExA\n LoadLibraryW\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n Can access the registry:\n RegSetValueExA\n RegCreateKeyExW\n RegEnumKeyExA\n RegQueryValueExA\n RegOpenKeyExW\n RegSetValueExW\n RegCloseKey\n RegEnumValueA\n RegOpenKeyExA\n RegEnumKeyExW\n RegEnumValueW\n RegCreateKeyExA\n RegQueryValueExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessA\n ShellExecuteA\n ShellExecuteW\n Uses Microsoft's cryptographic API:\n CryptAcquireContextA\n CryptDeriveKey\n CryptDecrypt\n CryptCreateHash\n CryptHashData\n CryptReleaseContext\n CryptEncrypt\n Can create temporary files:\n GetTempPathW\n CreateFileA\n CreateFileW\n GetTempPathA\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n CallNextHookEx\n GetForegroundWindow\n Has Internet access capabilities:\n InternetGetConnectedState\n InternetSetOptionA\n InternetCloseHandle\n InternetOpenA\n InternetGetConnectedStateExA\n InternetErrorDlg\n InternetWriteFile\n InternetReadFile\n InternetCrackUrlA\n InternetQueryOptionA\n InternetSetStatusCallbackA\n InternetConnectA\n Leverages the raw socket API to access the Internet:\n gethostbyname\n Functions related to the privilege level:\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeA\n Can take screenshots:\n CreateCompatibleDC\n BitBlt\n GetDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 780 bytes of data starting at offset 0x69400.\n The overlay data has an entropy of 7.71969 and is possibly compressed or encrypted.\n\n\n\n[!] Error: directory 6 has a RVA of 0 but a non-null size.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Trojan.Kovter-019f46cd0f817e919789e963b55061ca.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_3q5q4tjl/output.txt"},"timestamp":"2026-07-10 00:17:30"} {"_id":{"$oid":"6a4fed6c0108394cb24cdd0b"},"sha256":"699ec052ecc898bdbdafea0027c4ab44c3d01ae011c17745dd2b7fbddaa077f3","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Win32.AgentTesla-019f46cd4ebf7711a1e74ba40b4703a4.exe\nDate: 2026-07-10 00:20:20\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Win32.AgentTesla-019f46cd4ebf7711a1e74ba40b4703a4.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2018-Jan-16 08:15:19\nComments: Comverse Technology Kopl\nCompanyName: Comverse Technology\nFileDescription: Comverse Technology\nFileVersion: 6.9.1.5\nInternalName: Po160118.exe\nLegalCopyright: (c) 2015Comverse Technology\nOriginalFilename: Po160118.exe\nProductName: Comverse Technology Cemp Kopl\nProductVersion: 6.9.1.5\nAssembly Version: 17.18.7.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2018-Jan-16 08:15:19\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x0006A400\nSizeOfInitializedData: 0x00006200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0006C2CE (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x0006E000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00076000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0006A2D4\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x0006A400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.97929\n\n.rsrc:\n VirtualSize: 0x00005E80\n VirtualAddress: 0x0006E000\n SizeOfRawData: 0x00006000\n PointerToRawData: 0x0006A600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.03304\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00074000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00070600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.60795\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99998\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.22429\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.53369\n Detected Filetype: Icon file\n\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 920\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45136\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.9.1.5\n ProductVersion: 6.9.1.5\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: Comverse Technology Kopl\n CompanyName: Comverse Technology\n FileDescription: Comverse Technology\n FileVersion (#2): 6.9.1.5\n InternalName: Po160118.exe\n LegalCopyright: (c) 2015Comverse Technology\n OriginalFilename: Po160118.exe\n ProductName: Comverse Technology Cemp Kopl\n ProductVersion (#2): 6.9.1.5\n Assembly Version: 17.18.7.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2018-Jan-16 08:15:19\nComments: Comverse Technology Kopl\nCompanyName: Comverse Technology\nFileDescription: Comverse Technology\nFileVersion: 6.9.1.5\nInternalName: Po160118.exe\nLegalCopyright: (c) 2015Comverse Technology\nOriginalFilename: Po160118.exe\nProductName: Comverse Technology Cemp Kopl\nProductVersion: 6.9.1.5\nAssembly Version: 17.18.7.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2018-Jan-16 08:15:19\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x0006A400\nSizeOfInitializedData: 0x00006200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0006C2CE (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x0006E000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00076000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0006A2D4\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x0006A400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.97929\n\n.rsrc:\n VirtualSize: 0x00005E80\n VirtualAddress: 0x0006E000\n SizeOfRawData: 0x00006000\n PointerToRawData: 0x0006A600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.03304\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00074000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00070600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.60795\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99998\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.22429\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.53369\n Detected Filetype: Icon file\n\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 920\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45136\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.9.1.5\n ProductVersion: 6.9.1.5\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: Comverse Technology Kopl\n CompanyName: Comverse Technology\n FileDescription: Comverse Technology\n FileVersion (#2): 6.9.1.5\n InternalName: Po160118.exe\n LegalCopyright: (c) 2015Comverse Technology\n OriginalFilename: Po160118.exe\n ProductName: Comverse Technology Cemp Kopl\n ProductVersion (#2): 6.9.1.5\n Assembly Version: 17.18.7.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.60795\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99998\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.22429\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 48\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.53369\n Detected Filetype: Icon file\n\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 920\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45136\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 6.9.1.5\n ProductVersion: 6.9.1.5\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: Comverse Technology Kopl\n CompanyName: Comverse Technology\n FileDescription: Comverse Technology\n FileVersion (#2): 6.9.1.5\n InternalName: Po160118.exe\n LegalCopyright: (c) 2015Comverse Technology\n OriginalFilename: Po160118.exe\n ProductName: Comverse Technology Cemp Kopl\n ProductVersion (#2): 6.9.1.5\n Assembly Version: 17.18.7.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Win32.AgentTesla-019f46cd4ebf7711a1e74ba40b4703a4.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_7ihwinvv/output.txt"},"timestamp":"2026-07-10 00:20:20"} {"_id":{"$oid":"6a4fef540108394cb24cdd0f"},"sha256":"e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Ransomware.Cerber-019f46cdc4917d52a23cef8be97f1622.exe\nDate: 2026-07-10 00:28:28\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Ransomware.Cerber-019f46cdc4917d52a23cef8be97f1622.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-May-24 20:48:34\nCompanyName: Elaborate Bytes AG\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2017-May-24 20:48:34\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 9.0\nSizeOfCode: 0x0004EE00\nSizeOfInitializedData: 0x00048000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0004F4E0 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00050000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 0.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x0009A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0004ED6E\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0004EE00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.09329\n\n.rdata:\n VirtualSize: 0x0003A87A\n VirtualAddress: 0x00050000\n SizeOfRawData: 0x0003AA00\n PointerToRawData: 0x0004F200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.34374\n\n.data:\n VirtualSize: 0x000011C0\n VirtualAddress: 0x0008B000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00089C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.97646\n\n.rsrc:\n VirtualSize: 0x0000C3A8\n VirtualAddress: 0x0008D000\n SizeOfRawData: 0x0000C400\n PointerToRawData: 0x0008AE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.55343\n\n\nImports:\n--------\nKERNEL32.dll: GetExitCodeProcess\n GetFileAttributesExW\n GetFileAttributesW\n GetFileSize\n GetFileType\n GetFullPathNameW\n GetLastError\n GetLocalTime\n GetLocaleInfoW\n GetModuleFileNameA\n GetModuleFileNameW\n GetModuleHandleA\n GetModuleHandleW\n GetPrivateProfileStringW\n GetProcAddress\n GetProcessHeap\n GetStartupInfoA\n GetStdHandle\n GetSystemTime\n GetSystemTimeAsFileTime\n GetTempFileNameW\n GetTempPathW\n GetThreadLocale\n GetTickCount\n GetTimeFormatW\n GetUserDefaultLCID\n GetVersion\n GetVersionExA\n GetVolumeInformationW\n GetWindowsDirectoryW\n Heap32ListFirst\n HeapAlloc\n HeapFree\n HeapReAlloc\n HeapSize\n InitializeCriticalSection\n InterlockedDecrement\n InterlockedIncrement\n IsSystemResumeAutomatic\n LeaveCriticalSection\n LoadLibraryA\n LoadLibraryW\n LocalFree\n MoveFileExA\n MoveFileExW\n MoveFileW\n MultiByteToWideChar\n GetEnvironmentVariableW\n QueryPerformanceCounter\n QueueUserAPC\n RaiseException\n ReadConsoleW\n ReadFile\n ReadProcessMemory\n RemoveDirectoryW\n ScrollConsoleScreenBufferW\n SearchPathW\n SetConsoleCtrlHandler\n SetConsoleCursorPosition\n SetConsoleMode\n SetConsoleTextAttribute\n SetConsoleTitleW\n SetCurrentDirectoryW\n SetEnvironmentVariableW\n SetErrorMode\n SetFileAttributesW\n SetFilePointer\n SetFileTime\n SetLastError\n SetLocalTime\n SetSystemTime\n SetThreadLocale\n SetUnhandledExceptionFilter\n SetVolumeLabelA\n SleepEx\n SwitchToThread\n SystemTimeToFileTime\n TerminateProcess\n TransmitCommChar\n UnhandledExceptionFilter\n VirtualAlloc\n VirtualFree\n VirtualFreeEx\n VirtualQuery\n WaitForSingleObject\n WideCharToMultiByte\n WriteConsoleW\n WriteFile\n WritePrivateProfileSectionA\n _hwrite\n lstrcmpW\n lstrcmpiW\n lstrcpyW\n lstrlenW\n GetEnvironmentStringsW\n GetDriveTypeW\n GetDiskFreeSpaceExW\n GetDateFormatW\n GetCurrentThreadId\n GetCurrentThread\n GetCurrentProcessId\n GetCurrentProcess\n GetCurrentDirectoryW\n GetConsoleTitleW\n GetConsoleScreenBufferInfo\n GetConsoleOutputCP\n GetConsoleMode\n GetCompressedFileSizeW\n GetCommandLineW\n GetCPInfo\n GetBinaryTypeW\n GetBinaryType\n FreeLibrary\n FormatMessageW\n FlushFileBuffers\n FlushConsoleInputBuffer\n FindNextFileW\n FindNextFileA\n FindFirstFileW\n FindFirstFileA\n FindClose\n FillConsoleOutputCharacterW\n FillConsoleOutputAttribute\n FileTimeToSystemTime\n FileTimeToLocalFileTime\n ExpandEnvironmentStringsW\n EraseTape\n EnterCriticalSection\n DuplicateHandle\n DeleteFileW\n DeleteFileA\n CreateThread\n CreateProcessW\n CreateFileW\n CreateFileA\n CreateDirectoryW\n CopyFileW\n CopyFileA\n ConvertDefaultLocale\n CompareFileTime\n CloseHandle\n OpenProcess\n AddAtomW\nUSER32.dll: DefWindowProcW\n DrawFocusRect\n CreateWindowStationA\n CreateMenu\n FillRect\n FindWindowW\n GetMenuCheckMarkDimensions\n GetProcessWindowStation\n GetSysColorBrush\n GetThreadDesktop\n GetUpdateRgn\n GetUserObjectInformationW\n InflateRect\n InsertMenuItemW\n IsIconic\n LockWindowUpdate\n MessageBeep\n MessageBoxW\n MonitorFromWindow\n OffsetRect\n PostMessageW\n RealGetWindowClass\n SendMessageW\n SetUserObjectInformationW\n ShowWindow\n ToUnicode\n WinHelpA\n LoadCursorW\n GetKBCodePage\n DefMDIChildProcW\n CloseWindowStation\nGDI32.dll: StartPage\n SetMiterLimit\n SetMapperFlags\n SetBitmapBits\n PtVisible\n OffsetClipRgn\n GetViewportOrgEx\n GetTextFaceW\n AddFontMemResourceEx\n AnimatePalette\n Arc\n BRUSHOBJ_pvAllocRbrush\n ColorMatchToTarget\n CopyEnhMetaFileA\n CreatePatternBrush\n DescribePixelFormat\n EngFreeModule\n EngTextOut\n EnumFontsW\n FillRgn\n GdiGetPageCount\n GetGlyphOutlineW\n GetMiterLimit\n GetOutlineTextMetricsA\nADVAPI32.dll: RegOpenKeyW\n SaferRecordEventLogEntry\n SaferIdentifyLevel\n SaferComputeTokenFromLevel\n SaferCloseLevel\n RevertToSelf\n RegSetValueW\n RegSetValueExW\n RegQueryValueW\n RegQueryValueExW\n CreateProcessAsUserW\n RegOpenKeyExW\n RegEnumKeyW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n LookupAccountSidW\n ImpersonateLoggedOnUser\n GetSecurityDescriptorOwner\n GetFileSecurityW\n FreeSid\nSHELL32.dll: ShellExecuteExW\n ShellExecuteA\n ShellAboutA\n SHIsFileAvailableOffline\n SHGetSettings\n CheckEscapesW\n DragQueryFile\n DragQueryFileAorW\n ExtractIconExW\n SHAppBarMessage\n SHBrowseForFolderA\n SHChangeNotify\n SHCreateProcessAsUserW\n SHEmptyRecycleBinA\n SHFileOperationA\n SHGetDataFromIDListA\n SHGetDiskFreeSpaceA\n SHGetMalloc\n WOWShellExecute\nSHLWAPI.dll: StrCmpNW\n StrStrIA\n StrStrIW\n StrCmpNA\n StrChrIA\nCOMCTL32.dll: ImageList_Create\nmsvcrt.dll: _XcptFilter\n __getmainargs\n __initenv\n __p__commode\n __p__fmode\n __set_app_type\n __setusermatherr\n _adjust_fdiv\n _c_exit\n _cexit\n _close\n _controlfp\n _dup\n _dup2\n _errno\n _except_handler3\n _exit\n _get_osfhandle\n _getch\n _initterm\n _iob\n _open_osfhandle\n _pclose\n _pipe\n _seh_longjmp_unwind\n _setjmp3\n _setmode\n _snwprintf\n _tell\n _ultoa\n _vsnwprintf\n _wcsicmp\n _wcslwr\n _wcsnicmp\n _wcsupr\n _wpopen\n _wtol\n calloc\n exit\n fflush\n fgets\n fprintf\n free\n iswalpha\n iswdigit\n iswspace\n iswxdigit\n longjmp\n malloc\n memmove\n printf\n qsort\n rand\n realloc\n setlocale\n srand\n swprintf\n swscanf\n time\n towlower\n towupper\n wcscat\n wcschr\n wcscmp\n wcscpy\n wcslen\n wcsncmp\n wcsncpy\n wcsrchr\n wcsspn\n wcsstr\n wcstol\n wcstoul\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.93769\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.4047\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.47389\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.44834\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.95477\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59201\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1544\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.917\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.71384\n\n1 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1795\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.25578\n\n101:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98296\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19472\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 7.9.15.8\n ProductVersion: 7.9.15.8\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Elaborate Bytes AG\n\n\nRICH Header:\n------------\nXOR Key: 0x07B11122\nUnmarked objects: 0\n19 (8078): 75\nImports (VS2012 build 50727 / VS2005 build 50727): 15\nTotal imports: 244\nC objects (VS2008 build 21022): 1\nUnmarked objects (#2): 3\nLinker (VS2008 build 21022): 1\nResource objects (VS2008 build 21022): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n http://schemas.microsoft.com\n http://schemas.microsoft.com/SMI/2005/WindowsSettings\n microsoft.com\n schemas.microsoft.com\n\n[ SUSPICIOUS ] The PE is packed or was manually edited.\n The number of imports reported in the RICH header is inconsistent.\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n FindWindowW\n Can access the registry:\n RegOpenKeyW\n RegSetValueW\n RegSetValueExW\n RegQueryValueW\n RegQueryValueExW\n RegOpenKeyExW\n RegEnumKeyW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n ShellExecuteA\n Can create temporary files:\n GetTempPathW\n CreateFileW\n CreateFileA\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Manipulates other processes:\n ReadProcessMemory\n OpenProcess\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-May-24 20:48:34\nCompanyName: Elaborate Bytes AG"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2017-May-24 20:48:34\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 9.0\nSizeOfCode: 0x0004EE00\nSizeOfInitializedData: 0x00048000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0004F4E0 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00050000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.0\nImageVersion: 0.0\nSubsystemVersion: 5.0\nWin32VersionValue: 0\nSizeOfImage: 0x0009A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0004ED6E\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0004EE00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.09329\n\n.rdata:\n VirtualSize: 0x0003A87A\n VirtualAddress: 0x00050000\n SizeOfRawData: 0x0003AA00\n PointerToRawData: 0x0004F200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.34374\n\n.data:\n VirtualSize: 0x000011C0\n VirtualAddress: 0x0008B000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00089C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.97646\n\n.rsrc:\n VirtualSize: 0x0000C3A8\n VirtualAddress: 0x0008D000\n SizeOfRawData: 0x0000C400\n PointerToRawData: 0x0008AE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.55343"},"Imports":{"raw":"KERNEL32.dll: GetExitCodeProcess\n GetFileAttributesExW\n GetFileAttributesW\n GetFileSize\n GetFileType\n GetFullPathNameW\n GetLastError\n GetLocalTime\n GetLocaleInfoW\n GetModuleFileNameA\n GetModuleFileNameW\n GetModuleHandleA\n GetModuleHandleW\n GetPrivateProfileStringW\n GetProcAddress\n GetProcessHeap\n GetStartupInfoA\n GetStdHandle\n GetSystemTime\n GetSystemTimeAsFileTime\n GetTempFileNameW\n GetTempPathW\n GetThreadLocale\n GetTickCount\n GetTimeFormatW\n GetUserDefaultLCID\n GetVersion\n GetVersionExA\n GetVolumeInformationW\n GetWindowsDirectoryW\n Heap32ListFirst\n HeapAlloc\n HeapFree\n HeapReAlloc\n HeapSize\n InitializeCriticalSection\n InterlockedDecrement\n InterlockedIncrement\n IsSystemResumeAutomatic\n LeaveCriticalSection\n LoadLibraryA\n LoadLibraryW\n LocalFree\n MoveFileExA\n MoveFileExW\n MoveFileW\n MultiByteToWideChar\n GetEnvironmentVariableW\n QueryPerformanceCounter\n QueueUserAPC\n RaiseException\n ReadConsoleW\n ReadFile\n ReadProcessMemory\n RemoveDirectoryW\n ScrollConsoleScreenBufferW\n SearchPathW\n SetConsoleCtrlHandler\n SetConsoleCursorPosition\n SetConsoleMode\n SetConsoleTextAttribute\n SetConsoleTitleW\n SetCurrentDirectoryW\n SetEnvironmentVariableW\n SetErrorMode\n SetFileAttributesW\n SetFilePointer\n SetFileTime\n SetLastError\n SetLocalTime\n SetSystemTime\n SetThreadLocale\n SetUnhandledExceptionFilter\n SetVolumeLabelA\n SleepEx\n SwitchToThread\n SystemTimeToFileTime\n TerminateProcess\n TransmitCommChar\n UnhandledExceptionFilter\n VirtualAlloc\n VirtualFree\n VirtualFreeEx\n VirtualQuery\n WaitForSingleObject\n WideCharToMultiByte\n WriteConsoleW\n WriteFile\n WritePrivateProfileSectionA\n _hwrite\n lstrcmpW\n lstrcmpiW\n lstrcpyW\n lstrlenW\n GetEnvironmentStringsW\n GetDriveTypeW\n GetDiskFreeSpaceExW\n GetDateFormatW\n GetCurrentThreadId\n GetCurrentThread\n GetCurrentProcessId\n GetCurrentProcess\n GetCurrentDirectoryW\n GetConsoleTitleW\n GetConsoleScreenBufferInfo\n GetConsoleOutputCP\n GetConsoleMode\n GetCompressedFileSizeW\n GetCommandLineW\n GetCPInfo\n GetBinaryTypeW\n GetBinaryType\n FreeLibrary\n FormatMessageW\n FlushFileBuffers\n FlushConsoleInputBuffer\n FindNextFileW\n FindNextFileA\n FindFirstFileW\n FindFirstFileA\n FindClose\n FillConsoleOutputCharacterW\n FillConsoleOutputAttribute\n FileTimeToSystemTime\n FileTimeToLocalFileTime\n ExpandEnvironmentStringsW\n EraseTape\n EnterCriticalSection\n DuplicateHandle\n DeleteFileW\n DeleteFileA\n CreateThread\n CreateProcessW\n CreateFileW\n CreateFileA\n CreateDirectoryW\n CopyFileW\n CopyFileA\n ConvertDefaultLocale\n CompareFileTime\n CloseHandle\n OpenProcess\n AddAtomW\nUSER32.dll: DefWindowProcW\n DrawFocusRect\n CreateWindowStationA\n CreateMenu\n FillRect\n FindWindowW\n GetMenuCheckMarkDimensions\n GetProcessWindowStation\n GetSysColorBrush\n GetThreadDesktop\n GetUpdateRgn\n GetUserObjectInformationW\n InflateRect\n InsertMenuItemW\n IsIconic\n LockWindowUpdate\n MessageBeep\n MessageBoxW\n MonitorFromWindow\n OffsetRect\n PostMessageW\n RealGetWindowClass\n SendMessageW\n SetUserObjectInformationW\n ShowWindow\n ToUnicode\n WinHelpA\n LoadCursorW\n GetKBCodePage\n DefMDIChildProcW\n CloseWindowStation\nGDI32.dll: StartPage\n SetMiterLimit\n SetMapperFlags\n SetBitmapBits\n PtVisible\n OffsetClipRgn\n GetViewportOrgEx\n GetTextFaceW\n AddFontMemResourceEx\n AnimatePalette\n Arc\n BRUSHOBJ_pvAllocRbrush\n ColorMatchToTarget\n CopyEnhMetaFileA\n CreatePatternBrush\n DescribePixelFormat\n EngFreeModule\n EngTextOut\n EnumFontsW\n FillRgn\n GdiGetPageCount\n GetGlyphOutlineW\n GetMiterLimit\n GetOutlineTextMetricsA\nADVAPI32.dll: RegOpenKeyW\n SaferRecordEventLogEntry\n SaferIdentifyLevel\n SaferComputeTokenFromLevel\n SaferCloseLevel\n RevertToSelf\n RegSetValueW\n RegSetValueExW\n RegQueryValueW\n RegQueryValueExW\n CreateProcessAsUserW\n RegOpenKeyExW\n RegEnumKeyW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n LookupAccountSidW\n ImpersonateLoggedOnUser\n GetSecurityDescriptorOwner\n GetFileSecurityW\n FreeSid\nSHELL32.dll: ShellExecuteExW\n ShellExecuteA\n ShellAboutA\n SHIsFileAvailableOffline\n SHGetSettings\n CheckEscapesW\n DragQueryFile\n DragQueryFileAorW\n ExtractIconExW\n SHAppBarMessage\n SHBrowseForFolderA\n SHChangeNotify\n SHCreateProcessAsUserW\n SHEmptyRecycleBinA\n SHFileOperationA\n SHGetDataFromIDListA\n SHGetDiskFreeSpaceA\n SHGetMalloc\n WOWShellExecute\nSHLWAPI.dll: StrCmpNW\n StrStrIA\n StrStrIW\n StrCmpNA\n StrChrIA\nCOMCTL32.dll: ImageList_Create\nmsvcrt.dll: _XcptFilter\n __getmainargs\n __initenv\n __p__commode\n __p__fmode\n __set_app_type\n __setusermatherr\n _adjust_fdiv\n _c_exit\n _cexit\n _close\n _controlfp\n _dup\n _dup2\n _errno\n _except_handler3\n _exit\n _get_osfhandle\n _getch\n _initterm\n _iob\n _open_osfhandle\n _pclose\n _pipe\n _seh_longjmp_unwind\n _setjmp3\n _setmode\n _snwprintf\n _tell\n _ultoa\n _vsnwprintf\n _wcsicmp\n _wcslwr\n _wcsnicmp\n _wcsupr\n _wpopen\n _wtol\n calloc\n exit\n fflush\n fgets\n fprintf\n free\n iswalpha\n iswdigit\n iswspace\n iswxdigit\n longjmp\n malloc\n memmove\n printf\n qsort\n rand\n realloc\n setlocale\n srand\n swprintf\n swscanf\n time\n towlower\n towupper\n wcscat\n wcschr\n wcscmp\n wcscpy\n wcslen\n wcsncmp\n wcsncpy\n wcsrchr\n wcsspn\n wcsstr\n wcstol\n wcstoul\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.93769\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.4047\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.47389\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.44834\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.95477\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59201\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1544\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.917\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.71384\n\n1 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1795\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.25578\n\n101:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98296\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19472\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 7.9.15.8\n ProductVersion: 7.9.15.8\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Elaborate Bytes AG\n\n\nRICH Header:\nXOR Key: 0x07B11122\nUnmarked objects: 0\n19 (8078): 75\nImports (VS2012 build 50727 / VS2005 build 50727): 15\nTotal imports: 244\nC objects (VS2008 build 21022): 1\nUnmarked objects (#2): 3\nLinker (VS2008 build 21022): 1\nResource objects (VS2008 build 21022): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n http://schemas.microsoft.com\n http://schemas.microsoft.com/SMI/2005/WindowsSettings\n microsoft.com\n schemas.microsoft.com\n\n[ SUSPICIOUS ] The PE is packed or was manually edited.\n The number of imports reported in the RICH header is inconsistent.\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n FindWindowW\n Can access the registry:\n RegOpenKeyW\n RegSetValueW\n RegSetValueExW\n RegQueryValueW\n RegQueryValueExW\n RegOpenKeyExW\n RegEnumKeyW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n ShellExecuteA\n Can create temporary files:\n GetTempPathW\n CreateFileW\n CreateFileA\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Manipulates other processes:\n ReadProcessMemory\n OpenProcess\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.93769\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.4047\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.47389\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.44834\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.95477\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59201\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1544\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.917\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.71384\n\n1 (#2):\n Type: RT_RCDATA\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 1795\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.25578\n\n101:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.98296\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.19472\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 7.9.15.8\n ProductVersion: 7.9.15.8\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n CompanyName: Elaborate Bytes AG\n\n\nRICH Header:\nXOR Key: 0x07B11122\nUnmarked objects: 0\n19 (8078): 75\nImports (VS2012 build 50727 / VS2005 build 50727): 15\nTotal imports: 244\nC objects (VS2008 build 21022): 1\nUnmarked objects (#2): 3\nLinker (VS2008 build 21022): 1\nResource objects (VS2008 build 21022): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n http://schemas.microsoft.com\n http://schemas.microsoft.com/SMI/2005/WindowsSettings\n microsoft.com\n schemas.microsoft.com\n\n[ SUSPICIOUS ] The PE is packed or was manually edited.\n The number of imports reported in the RICH header is inconsistent.\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n FindWindowW\n Can access the registry:\n RegOpenKeyW\n RegSetValueW\n RegSetValueExW\n RegQueryValueW\n RegQueryValueExW\n RegOpenKeyExW\n RegEnumKeyW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n ShellExecuteA\n Can create temporary files:\n GetTempPathW\n CreateFileW\n CreateFileA\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Manipulates other processes:\n ReadProcessMemory\n OpenProcess\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x07B11122\nUnmarked objects: 0\n19 (8078): 75\nImports (VS2012 build 50727 / VS2005 build 50727): 15\nTotal imports: 244\nC objects (VS2008 build 21022): 1\nUnmarked objects (#2): 3\nLinker (VS2008 build 21022): 1\nResource objects (VS2008 build 21022): 1"},"Interesting strings found in the binary":{"raw":"Contains domain names:\n http://schemas.microsoft.com\n http://schemas.microsoft.com/SMI/2005/WindowsSettings\n microsoft.com\n schemas.microsoft.com\n\n[ SUSPICIOUS ] The PE is packed or was manually edited.\n The number of imports reported in the RICH header is inconsistent.\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n FindWindowW\n Can access the registry:\n RegOpenKeyW\n RegSetValueW\n RegSetValueExW\n RegQueryValueW\n RegQueryValueExW\n RegOpenKeyExW\n RegEnumKeyW\n RegDeleteKeyW\n RegCreateKeyExW\n RegCloseKey\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n ShellExecuteA\n Can create temporary files:\n GetTempPathW\n CreateFileW\n CreateFileA\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Manipulates other processes:\n ReadProcessMemory\n OpenProcess\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/Ransomware.Cerber-019f46cdc4917d52a23cef8be97f1622.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_hbx5x4lc/output.txt"},"timestamp":"2026-07-10 00:28:28"} {"_id":{"$oid":"6a4ff7060108394cb24cdd12"},"sha256":"1c0ea462f0bbd7acfdf4c6daf3cb8ce09e1375b766fbd3ff89f40c0aa3f4fc96","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Win32.GravityRat-019f46cde34c7352bcaeb6bfad5b9c42.exe\nDate: 2026-07-10 01:01:18\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Win32.GravityRat-019f46cde34c7352bcaeb6bfad5b9c42.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-Dec-06 07:52:11\nDebug artifacts: C:\\Users\\The Invincible\\Desktop\\gx\\gx-current-program\\LSASS\\obj\\Release\\LSASS.pdb\nComments: \nCompanyName: \nFileDescription: LSASS\nFileVersion: 1.09.1201.10\nInternalName: LSASS.exe\nLegalCopyright: Copyright © 2017\nLegalTrademarks: \nOriginalFilename: LSASS.exe\nProductName: LSASS\nProductVersion: 1.09.1201.10\nAssembly Version: 1.9.1201.10\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2017-Dec-06 07:52:11\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x000A0A00\nSizeOfInitializedData: 0x00000800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000A1DC6 (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x000A4000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x000A8000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000A0904\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x000A0A00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.88888\n\n.rsrc:\n VirtualSize: 0x000005AC\n VirtualAddress: 0x000A4000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x000A0C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.15\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x000A6000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000A1200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39668\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.9.1201.10\n ProductVersion: 1.9.1201.10\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: LSASS\n FileVersion (#2): 1.09.1201.10\n InternalName: LSASS.exe\n LegalCopyright: Copyright © 2017\n LegalTrademarks: \n OriginalFilename: LSASS.exe\n ProductName: LSASS\n ProductVersion (#2): 1.09.1201.10\n Assembly Version: 1.9.1201.10\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2017-Dec-06 07:52:11\n Version: 0.0\n SizeofData: 284\n AddressOfRawData: 0x000A1C58\n PointerToRawData: 0x0009FE58\n Referenced File: C:\\Users\\The Invincible\\Desktop\\gx\\gx-current-program\\LSASS\\obj\\Release\\LSASS.pdb\n\n\nMatching compiler(s):\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n SchTask\n Looks for VMWare presence:\n 00:05:69\n 00:0C:29\n 00:50:56\n VMware\n vmware\n May have dropper capabilities:\n CurrentControlSet\\Services\n Accesses the WMI:\n root\\WMI\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n cone.msoftupdates.com\n cthree.msoftupdates.com\n ctwo.msoftupdates.com\n http://cone.msoftupdates.com\n http://cthree.msoftupdates.com\n http://ctwo.msoftupdates.com\n http://eone.msoftupdates.eu\n http://etwo.msoftupdates.eu\n msoftupdates.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-Dec-06 07:52:11\nDebug artifacts: C:\\Users\\The Invincible\\Desktop\\gx\\gx-current-program\\LSASS\\obj\\Release\\LSASS.pdb\nComments: \nCompanyName: \nFileDescription: LSASS\nFileVersion: 1.09.1201.10\nInternalName: LSASS.exe\nLegalCopyright: Copyright © 2017\nLegalTrademarks: \nOriginalFilename: LSASS.exe\nProductName: LSASS\nProductVersion: 1.09.1201.10\nAssembly Version: 1.9.1201.10"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2017-Dec-06 07:52:11\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x000A0A00\nSizeOfInitializedData: 0x00000800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000A1DC6 (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x000A4000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x000A8000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000A0904\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x000A0A00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.88888\n\n.rsrc:\n VirtualSize: 0x000005AC\n VirtualAddress: 0x000A4000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x000A0C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.15\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x000A6000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000A1200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39668\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.9.1201.10\n ProductVersion: 1.9.1201.10\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: LSASS\n FileVersion (#2): 1.09.1201.10\n InternalName: LSASS.exe\n LegalCopyright: Copyright © 2017\n LegalTrademarks: \n OriginalFilename: LSASS.exe\n ProductName: LSASS\n ProductVersion (#2): 1.09.1201.10\n Assembly Version: 1.9.1201.10\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2017-Dec-06 07:52:11\n Version: 0.0\n SizeofData: 284\n AddressOfRawData: 0x000A1C58\n PointerToRawData: 0x0009FE58\n Referenced File: C:\\Users\\The Invincible\\Desktop\\gx\\gx-current-program\\LSASS\\obj\\Release\\LSASS.pdb\n\n\nMatching compiler(s):\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n SchTask\n Looks for VMWare presence:\n 00:05:69\n 00:0C:29\n 00:50:56\n VMware\n vmware\n May have dropper capabilities:\n CurrentControlSet\\Services\n Accesses the WMI:\n root\\WMI\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n cone.msoftupdates.com\n cthree.msoftupdates.com\n ctwo.msoftupdates.com\n http://cone.msoftupdates.com\n http://cthree.msoftupdates.com\n http://ctwo.msoftupdates.com\n http://eone.msoftupdates.eu\n http://etwo.msoftupdates.eu\n msoftupdates.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39668\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.9.1201.10\n ProductVersion: 1.9.1201.10\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: LSASS\n FileVersion (#2): 1.09.1201.10\n InternalName: LSASS.exe\n LegalCopyright: Copyright © 2017\n LegalTrademarks: \n OriginalFilename: LSASS.exe\n ProductName: LSASS\n ProductVersion (#2): 1.09.1201.10\n Assembly Version: 1.9.1201.10"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2017-Dec-06 07:52:11\n Version: 0.0\n SizeofData: 284\n AddressOfRawData: 0x000A1C58\n PointerToRawData: 0x0009FE58\n Referenced File: C:\\Users\\The Invincible\\Desktop\\gx\\gx-current-program\\LSASS\\obj\\Release\\LSASS.pdb\n\n\nMatching compiler(s):\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n SchTask\n Looks for VMWare presence:\n 00:05:69\n 00:0C:29\n 00:50:56\n VMware\n vmware\n May have dropper capabilities:\n CurrentControlSet\\Services\n Accesses the WMI:\n root\\WMI\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n cone.msoftupdates.com\n cthree.msoftupdates.com\n ctwo.msoftupdates.com\n http://cone.msoftupdates.com\n http://cthree.msoftupdates.com\n http://ctwo.msoftupdates.com\n http://eone.msoftupdates.eu\n http://etwo.msoftupdates.eu\n msoftupdates.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Win32.GravityRat-019f46cde34c7352bcaeb6bfad5b9c42.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_cns4pv88/output.txt"},"timestamp":"2026-07-10 01:01:18"} {"_id":{"$oid":"6a4ff7fa0108394cb24cdd14"},"sha256":"653bc2b16b1624e045c1225810185e9aa3694dc378fe0095e2052b7f1e265d01","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Win32.WannaPeace-019f46ce0d7779f2805a33c6e5a59710.exe\nDate: 2026-07-10 01:05:22\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Win32.WannaPeace-019f46ce0d7779f2805a33c6e5a59710.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-Nov-24 12:12:11\nDebug artifacts: E:\\Users\\SCORPION\\Downloads\\privatelocker_version2\\PrivateLocker\\obj\\Debug\\RzW.pdb\nComments: \nCompanyName: \nFileDescription: RzW\nFileVersion: 1.0.0.0\nInternalName: RzW.exe\nLegalCopyright: Copyright © 2017\nLegalTrademarks: \nOriginalFilename: RzW.exe\nProductName: RzW\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2017-Nov-24 12:12:11\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x0009F400\nSizeOfInitializedData: 0x00005600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000A134E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x000A2000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x000AA000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0009F354\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x0009F400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.3648\n\n.rsrc:\n VirtualSize: 0x000052C4\n VirtualAddress: 0x000A2000\n SizeOfRawData: 0x00005400\n PointerToRawData: 0x0009F600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.61453\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x000A8000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000A4A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.24988\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.91924\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25975\n\n1 (#3):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3176\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00391\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: RzW\n FileVersion (#2): 1.0.0.0\n InternalName: RzW.exe\n LegalCopyright: Copyright © 2017\n LegalTrademarks: \n OriginalFilename: RzW.exe\n ProductName: RzW\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2017-Nov-24 12:12:11\n Version: 0.0\n SizeofData: 107\n AddressOfRawData: 0x000A1290\n PointerToRawData: 0x0009F490\n Referenced File: E:\\Users\\SCORPION\\Downloads\\privatelocker_version2\\PrivateLocker\\obj\\Debug\\RzW.pdb\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET DLL -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Accesses the WMI:\n root\\CIMV2\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n horacerta.com.br\n http://www.horacerta.com.br\n http://www.horacerta.com.br/\n https://pt.wikipedia.org\n https://pt.wikipedia.org/wiki/Bitcoin\n https://www.mercadobitcoin.com.br\n https://www.mercadobitcoin.com.br/\n mercadobitcoin.com.br\n pt.wikipedia.org\n wikipedia.org\n www.horacerta.com.br\n www.mercadobitcoin.com.br\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2017-Nov-24 12:12:11\nDebug artifacts: E:\\Users\\SCORPION\\Downloads\\privatelocker_version2\\PrivateLocker\\obj\\Debug\\RzW.pdb\nComments: \nCompanyName: \nFileDescription: RzW\nFileVersion: 1.0.0.0\nInternalName: RzW.exe\nLegalCopyright: Copyright © 2017\nLegalTrademarks: \nOriginalFilename: RzW.exe\nProductName: RzW\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2017-Nov-24 12:12:11\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x0009F400\nSizeOfInitializedData: 0x00005600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000A134E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x000A2000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x000AA000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0009F354\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x0009F400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.3648\n\n.rsrc:\n VirtualSize: 0x000052C4\n VirtualAddress: 0x000A2000\n SizeOfRawData: 0x00005400\n PointerToRawData: 0x0009F600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.61453\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x000A8000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000A4A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.24988\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.91924\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25975\n\n1 (#3):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3176\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00391\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: RzW\n FileVersion (#2): 1.0.0.0\n InternalName: RzW.exe\n LegalCopyright: Copyright © 2017\n LegalTrademarks: \n OriginalFilename: RzW.exe\n ProductName: RzW\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2017-Nov-24 12:12:11\n Version: 0.0\n SizeofData: 107\n AddressOfRawData: 0x000A1290\n PointerToRawData: 0x0009F490\n Referenced File: E:\\Users\\SCORPION\\Downloads\\privatelocker_version2\\PrivateLocker\\obj\\Debug\\RzW.pdb\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET DLL -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Accesses the WMI:\n root\\CIMV2\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n horacerta.com.br\n http://www.horacerta.com.br\n http://www.horacerta.com.br/\n https://pt.wikipedia.org\n https://pt.wikipedia.org/wiki/Bitcoin\n https://www.mercadobitcoin.com.br\n https://www.mercadobitcoin.com.br/\n mercadobitcoin.com.br\n pt.wikipedia.org\n wikipedia.org\n www.horacerta.com.br\n www.mercadobitcoin.com.br\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.24988\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.91924\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 748\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25975\n\n1 (#3):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3176\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00391\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: RzW\n FileVersion (#2): 1.0.0.0\n InternalName: RzW.exe\n LegalCopyright: Copyright © 2017\n LegalTrademarks: \n OriginalFilename: RzW.exe\n ProductName: RzW\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2017-Nov-24 12:12:11\n Version: 0.0\n SizeofData: 107\n AddressOfRawData: 0x000A1290\n PointerToRawData: 0x0009F490\n Referenced File: E:\\Users\\SCORPION\\Downloads\\privatelocker_version2\\PrivateLocker\\obj\\Debug\\RzW.pdb\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET DLL -> Microsoft\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Accesses the WMI:\n root\\CIMV2\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n horacerta.com.br\n http://www.horacerta.com.br\n http://www.horacerta.com.br/\n https://pt.wikipedia.org\n https://pt.wikipedia.org/wiki/Bitcoin\n https://www.mercadobitcoin.com.br\n https://www.mercadobitcoin.com.br/\n mercadobitcoin.com.br\n pt.wikipedia.org\n wikipedia.org\n www.horacerta.com.br\n www.mercadobitcoin.com.br\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Win32.WannaPeace-019f46ce0d7779f2805a33c6e5a59710.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_84242sxu/output.txt"},"timestamp":"2026-07-10 01:05:22"} {"_id":{"$oid":"6a4ff91f0108394cb24cdd18"},"sha256":"c7dc529d8aae76b4e797e4e9e3ea7cd69669e6c3bb3f94d80f1974d1b9f69378","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/CryptoLocker_20Nov2013-019f46ce41d271419d80e3344372fac8.exe\nDate: 2026-07-10 01:10:15\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/CryptoLocker_20Nov2013-019f46ce41d271419d80e3344372fac8.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Nov-19 13:24:00\nDetected languages: English - United States\nCompanyName: Bronto Software\nFileDescription: Success ato\nFileVersion: 3.1.120.927\nInternalName: temperatureSid.exe\nLegalCopyright: (c) Bronto Software\nOriginalFilename: temperatureSid.exe\nProductName: Success sing\nProductVersion: 3.1.120.927\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2013-Nov-19 13:24:00\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x0004C800\nSizeOfInitializedData: 0x000D1800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0003D786 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0004E000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00120000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0004C765\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0004C800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.94234\n\n.rdata:\n VirtualSize: 0x00038C7E\n VirtualAddress: 0x0004E000\n SizeOfRawData: 0x00038E00\n PointerToRawData: 0x0004CC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.28828\n\n.data:\n VirtualSize: 0x00065D94\n VirtualAddress: 0x00087000\n SizeOfRawData: 0x00016600\n PointerToRawData: 0x00085A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.50248\n\n.rsrc:\n VirtualSize: 0x00032BF8\n VirtualAddress: 0x000ED000\n SizeOfRawData: 0x00032C00\n PointerToRawData: 0x0009C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.81383\n\n\nImports:\n--------\nKERNEL32.dll: CreateFileA\n HeapAlloc\n HeapReAlloc\n HeapFree\n VirtualAlloc\n GetCommandLineA\n GetProcessHeap\n RaiseException\n RtlUnwind\n HeapSize\n ExitProcess\n TerminateProcess\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n SetFilePointer\n VirtualFree\n HeapDestroy\n HeapCreate\n GetStdHandle\n GetACP\n IsValidCodePage\n FreeEnvironmentStringsA\n GetEnvironmentStrings\n FreeEnvironmentStringsW\n GetEnvironmentStringsW\n SetHandleCount\n GetFileType\n QueryPerformanceCounter\n GetSystemTimeAsFileTime\n LCMapStringA\n LCMapStringW\n GetStringTypeA\n GetStringTypeW\n GetConsoleCP\n GetConsoleMode\n SetStdHandle\n WriteConsoleA\n GetConsoleOutputCP\n WriteConsoleW\n WriteFile\n GetOEMCP\n GetCPInfo\n GetLocaleInfoA\n GlobalAddAtomA\n GlobalFindAtomA\n GlobalDeleteAtom\n lstrcmpW\n GetVersionExA\n GetThreadLocale\n GlobalGetAtomNameA\n GlobalFlags\n lstrcmpA\n GetCurrentThreadId\n InterlockedIncrement\n InterlockedDecrement\n GetModuleHandleA\n TlsFree\n DeleteCriticalSection\n LocalReAlloc\n TlsSetValue\n TlsAlloc\n InitializeCriticalSection\n GlobalHandle\n GlobalReAlloc\n EnterCriticalSection\n TlsGetValue\n LeaveCriticalSection\n GetCurrentProcessId\n GetModuleFileNameA\n GlobalFree\n GlobalAlloc\n GlobalLock\n GlobalUnlock\n FormatMessageA\n SetLastError\n InterlockedExchange\n LoadLibraryA\n SizeofResource\n FreeLibrary\n FlushFileBuffers\n PrepareTape\n Sleep\n GetCurrentProcess\n GetVersion\n CompareStringA\n LockResource\n SetEvent\n GetProcAddress\n CloseHandle\n VirtualProtect\n lstrlenA\n DeleteFileA\n WideCharToMultiByte\n MultiByteToWideChar\n GetLastError\n FindResourceA\n LocalFree\n LocalAlloc\n CreateProcessA\n FindResourceExA\n GetStartupInfoA\n LoadResource\n IsDebuggerPresent\n GetTickCount\nUSER32.dll: SetForegroundWindow\n GetMenu\n PostMessageA\n CreateWindowExA\n GetClassInfoA\n RegisterClassA\n AdjustWindowRectEx\n CopyRect\n CallWindowProcA\n SetWindowLongA\n SetWindowPos\n SystemParametersInfoA\n IsIconic\n GetWindowPlacement\n SetMenuItemBitmaps\n GetMenuCheckMarkDimensions\n LoadBitmapA\n ModifyMenuA\n EnableMenuItem\n CheckMenuItem\n GetFocus\n ClientToScreen\n GetWindow\n GetDlgCtrlID\n GetClassNameA\n PtInRect\n GetWindowTextA\n SetWindowTextA\n UnregisterClassA\n SetWindowsHookExA\n GetKeyState\n LoadCursorA\n GetSystemMetrics\n GetDC\n GetSysColor\n UnhookWindowsHookEx\n GetWindowThreadProcessId\n SendMessageA\n GetParent\n GetLastActivePopup\n IsWindowEnabled\n EnableWindow\n MessageBoxA\n GetMenuState\n GetMenuItemID\n GetMenuItemCount\n GetSubMenu\n DrawTextA\n InflateRect\n GetWindowRect\n CreatePopupMenu\n GetForegroundWindow\n CallNextHookEx\n DispatchMessageA\n EnumWindows\n CreateDialogIndirectParamA\n SetParent\n GetSysColorBrush\n GetClientRect\n IntersectRect\n DefWindowProcA\n GetWindowLongA\n ExitWindowsEx\n DialogBoxIndirectParamA\n EndDeferWindowPos\n GetClassInfoExA\n ReleaseDC\n MapWindowPoints\n ValidateRect\n PostQuitMessage\n GrayStringA\n DrawTextExA\n TabbedTextOutA\n DestroyMenu\n RegisterWindowMessageA\n LoadIconA\n WinHelpA\n GetCapture\n GetClassLongA\n SetPropA\n GetPropA\n RemovePropA\n IsWindow\n GetDlgItem\n GetTopWindow\n DestroyWindow\n GetMessageTime\n PeekMessageA\n GetMessagePos\nGDI32.dll: ExtTextOutA\n SaveDC\n RestoreDC\n SetMapMode\n ScaleViewportExtEx\n PtVisible\n SelectObject\n SetViewportOrgEx\n SetWindowExtEx\n DeleteDC\n GetStockObject\n SetBkColor\n SetTextColor\n GetClipBox\n CreateBitmap\n DeleteObject\n GetDeviceCaps\n SetViewportExtEx\n ScaleWindowExtEx\n OffsetViewportOrgEx\n Escape\n TextOutA\n RectVisible\nWINSPOOL.DRV: ClosePrinter\n DocumentPropertiesA\n OpenPrinterA\nole32.dll: CoInitialize\n CoRevokeClassObject\n CoTaskMemAlloc\n CoUninitialize\n CoTaskMemFree\nOLEAUT32.dll: VariantClear\n OleLoadPicture\n OleCreatePictureIndirect\n OleCreateFontIndirect\n SysReAllocStringLen\n SysFreeString\n SysStringLen\n OleCreatePropertyFrame\n OleTranslateColor\n SysAllocStringLen\n SysReAllocString\n OleIconToCursor\n OleCreatePropertyFrameIndirect\n SysAllocString\n VariantChangeType\n VariantInit\nOLEACC.dll: LresultFromObject\n CreateStdAccessibleObject\n\nResources:\n----------\nBASE:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 406\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.84091\n\nMUCH:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 356\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.91618\n\nSEE:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 282\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89317\n\n66:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 205686\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.83065\n\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41163\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 3.1.120.927\n ProductVersion: 3.1.120.927\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Bronto Software\n FileDescription: Success ato\n FileVersion (#2): 3.1.120.927\n InternalName: temperatureSid.exe\n LegalCopyright: (c) Bronto Software\n OriginalFilename: temperatureSid.exe\n ProductName: Success sing\n ProductVersion (#2): 3.1.120.927\n\n\nLoad Configuration:\n-------------------\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00487950\nSEHandlerTable: 0x004840B0\nSEHandlerCount: 76\n\nRICH Header:\n------------\nXOR Key: 0x5AC71C99\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 6\nImports (VS2003 (.NET) build 4035): 23\nTotal imports: 489\nASM objects (VS2012 build 50727 / VS2005 build 50727): 25\nC objects (VS2012 build 50727 / VS2005 build 50727): 136\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 114\n114 (VS2012 build 50727 / VS2005 build 50727): 1\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 8.0\n MSVC++ v.8 (procedure 1 recognized - h)\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Possibly launches other programs:\n CreateProcessA\n Uses functions commonly found in keyloggers:\n GetForegroundWindow\n CallNextHookEx\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (76 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2013-Nov-19 13:24:00\nDetected languages: English - United States\nCompanyName: Bronto Software\nFileDescription: Success ato\nFileVersion: 3.1.120.927\nInternalName: temperatureSid.exe\nLegalCopyright: (c) Bronto Software\nOriginalFilename: temperatureSid.exe\nProductName: Success sing\nProductVersion: 3.1.120.927"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2013-Nov-19 13:24:00\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x0004C800\nSizeOfInitializedData: 0x000D1800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0003D786 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0004E000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00120000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0004C765\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0004C800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.94234\n\n.rdata:\n VirtualSize: 0x00038C7E\n VirtualAddress: 0x0004E000\n SizeOfRawData: 0x00038E00\n PointerToRawData: 0x0004CC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.28828\n\n.data:\n VirtualSize: 0x00065D94\n VirtualAddress: 0x00087000\n SizeOfRawData: 0x00016600\n PointerToRawData: 0x00085A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 6.50248\n\n.rsrc:\n VirtualSize: 0x00032BF8\n VirtualAddress: 0x000ED000\n SizeOfRawData: 0x00032C00\n PointerToRawData: 0x0009C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.81383"},"Imports":{"raw":"KERNEL32.dll: CreateFileA\n HeapAlloc\n HeapReAlloc\n HeapFree\n VirtualAlloc\n GetCommandLineA\n GetProcessHeap\n RaiseException\n RtlUnwind\n HeapSize\n ExitProcess\n TerminateProcess\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n SetFilePointer\n VirtualFree\n HeapDestroy\n HeapCreate\n GetStdHandle\n GetACP\n IsValidCodePage\n FreeEnvironmentStringsA\n GetEnvironmentStrings\n FreeEnvironmentStringsW\n GetEnvironmentStringsW\n SetHandleCount\n GetFileType\n QueryPerformanceCounter\n GetSystemTimeAsFileTime\n LCMapStringA\n LCMapStringW\n GetStringTypeA\n GetStringTypeW\n GetConsoleCP\n GetConsoleMode\n SetStdHandle\n WriteConsoleA\n GetConsoleOutputCP\n WriteConsoleW\n WriteFile\n GetOEMCP\n GetCPInfo\n GetLocaleInfoA\n GlobalAddAtomA\n GlobalFindAtomA\n GlobalDeleteAtom\n lstrcmpW\n GetVersionExA\n GetThreadLocale\n GlobalGetAtomNameA\n GlobalFlags\n lstrcmpA\n GetCurrentThreadId\n InterlockedIncrement\n InterlockedDecrement\n GetModuleHandleA\n TlsFree\n DeleteCriticalSection\n LocalReAlloc\n TlsSetValue\n TlsAlloc\n InitializeCriticalSection\n GlobalHandle\n GlobalReAlloc\n EnterCriticalSection\n TlsGetValue\n LeaveCriticalSection\n GetCurrentProcessId\n GetModuleFileNameA\n GlobalFree\n GlobalAlloc\n GlobalLock\n GlobalUnlock\n FormatMessageA\n SetLastError\n InterlockedExchange\n LoadLibraryA\n SizeofResource\n FreeLibrary\n FlushFileBuffers\n PrepareTape\n Sleep\n GetCurrentProcess\n GetVersion\n CompareStringA\n LockResource\n SetEvent\n GetProcAddress\n CloseHandle\n VirtualProtect\n lstrlenA\n DeleteFileA\n WideCharToMultiByte\n MultiByteToWideChar\n GetLastError\n FindResourceA\n LocalFree\n LocalAlloc\n CreateProcessA\n FindResourceExA\n GetStartupInfoA\n LoadResource\n IsDebuggerPresent\n GetTickCount\nUSER32.dll: SetForegroundWindow\n GetMenu\n PostMessageA\n CreateWindowExA\n GetClassInfoA\n RegisterClassA\n AdjustWindowRectEx\n CopyRect\n CallWindowProcA\n SetWindowLongA\n SetWindowPos\n SystemParametersInfoA\n IsIconic\n GetWindowPlacement\n SetMenuItemBitmaps\n GetMenuCheckMarkDimensions\n LoadBitmapA\n ModifyMenuA\n EnableMenuItem\n CheckMenuItem\n GetFocus\n ClientToScreen\n GetWindow\n GetDlgCtrlID\n GetClassNameA\n PtInRect\n GetWindowTextA\n SetWindowTextA\n UnregisterClassA\n SetWindowsHookExA\n GetKeyState\n LoadCursorA\n GetSystemMetrics\n GetDC\n GetSysColor\n UnhookWindowsHookEx\n GetWindowThreadProcessId\n SendMessageA\n GetParent\n GetLastActivePopup\n IsWindowEnabled\n EnableWindow\n MessageBoxA\n GetMenuState\n GetMenuItemID\n GetMenuItemCount\n GetSubMenu\n DrawTextA\n InflateRect\n GetWindowRect\n CreatePopupMenu\n GetForegroundWindow\n CallNextHookEx\n DispatchMessageA\n EnumWindows\n CreateDialogIndirectParamA\n SetParent\n GetSysColorBrush\n GetClientRect\n IntersectRect\n DefWindowProcA\n GetWindowLongA\n ExitWindowsEx\n DialogBoxIndirectParamA\n EndDeferWindowPos\n GetClassInfoExA\n ReleaseDC\n MapWindowPoints\n ValidateRect\n PostQuitMessage\n GrayStringA\n DrawTextExA\n TabbedTextOutA\n DestroyMenu\n RegisterWindowMessageA\n LoadIconA\n WinHelpA\n GetCapture\n GetClassLongA\n SetPropA\n GetPropA\n RemovePropA\n IsWindow\n GetDlgItem\n GetTopWindow\n DestroyWindow\n GetMessageTime\n PeekMessageA\n GetMessagePos\nGDI32.dll: ExtTextOutA\n SaveDC\n RestoreDC\n SetMapMode\n ScaleViewportExtEx\n PtVisible\n SelectObject\n SetViewportOrgEx\n SetWindowExtEx\n DeleteDC\n GetStockObject\n SetBkColor\n SetTextColor\n GetClipBox\n CreateBitmap\n DeleteObject\n GetDeviceCaps\n SetViewportExtEx\n ScaleWindowExtEx\n OffsetViewportOrgEx\n Escape\n TextOutA\n RectVisible\nWINSPOOL.DRV: ClosePrinter\n DocumentPropertiesA\n OpenPrinterA\nole32.dll: CoInitialize\n CoRevokeClassObject\n CoTaskMemAlloc\n CoUninitialize\n CoTaskMemFree\nOLEAUT32.dll: VariantClear\n OleLoadPicture\n OleCreatePictureIndirect\n OleCreateFontIndirect\n SysReAllocStringLen\n SysFreeString\n SysStringLen\n OleCreatePropertyFrame\n OleTranslateColor\n SysAllocStringLen\n SysReAllocString\n OleIconToCursor\n OleCreatePropertyFrameIndirect\n SysAllocString\n VariantChangeType\n VariantInit\nOLEACC.dll: LresultFromObject\n CreateStdAccessibleObject\n\nResources:\nBASE:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 406\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.84091\n\nMUCH:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 356\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.91618\n\nSEE:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 282\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89317\n\n66:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 205686\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.83065\n\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41163\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 3.1.120.927\n ProductVersion: 3.1.120.927\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Bronto Software\n FileDescription: Success ato\n FileVersion (#2): 3.1.120.927\n InternalName: temperatureSid.exe\n LegalCopyright: (c) Bronto Software\n OriginalFilename: temperatureSid.exe\n ProductName: Success sing\n ProductVersion (#2): 3.1.120.927\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00487950\nSEHandlerTable: 0x004840B0\nSEHandlerCount: 76\n\nRICH Header:\nXOR Key: 0x5AC71C99\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 6\nImports (VS2003 (.NET) build 4035): 23\nTotal imports: 489\nASM objects (VS2012 build 50727 / VS2005 build 50727): 25\nC objects (VS2012 build 50727 / VS2005 build 50727): 136\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 114\n114 (VS2012 build 50727 / VS2005 build 50727): 1\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 8.0\n MSVC++ v.8 (procedure 1 recognized - h)\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Possibly launches other programs:\n CreateProcessA\n Uses functions commonly found in keyloggers:\n GetForegroundWindow\n CallNextHookEx\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (76 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"BASE:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 406\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.84091\n\nMUCH:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 356\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.91618\n\nSEE:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 282\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89317\n\n66:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: UNKNOWN\n Size: 205686\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.83065\n\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41163\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 3.1.120.927\n ProductVersion: 3.1.120.927\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Bronto Software\n FileDescription: Success ato\n FileVersion (#2): 3.1.120.927\n InternalName: temperatureSid.exe\n LegalCopyright: (c) Bronto Software\n OriginalFilename: temperatureSid.exe\n ProductName: Success sing\n ProductVersion (#2): 3.1.120.927\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00487950\nSEHandlerTable: 0x004840B0\nSEHandlerCount: 76\n\nRICH Header:\nXOR Key: 0x5AC71C99\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 6\nImports (VS2003 (.NET) build 4035): 23\nTotal imports: 489\nASM objects (VS2012 build 50727 / VS2005 build 50727): 25\nC objects (VS2012 build 50727 / VS2005 build 50727): 136\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 114\n114 (VS2012 build 50727 / VS2005 build 50727): 1\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 8.0\n MSVC++ v.8 (procedure 1 recognized - h)\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Possibly launches other programs:\n CreateProcessA\n Uses functions commonly found in keyloggers:\n GetForegroundWindow\n CallNextHookEx\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (76 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{"raw":"Size: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x00487950\nSEHandlerTable: 0x004840B0\nSEHandlerCount: 76"},"RICH Header":{"raw":"XOR Key: 0x5AC71C99\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 6\nImports (VS2003 (.NET) build 4035): 23\nTotal imports: 489\nASM objects (VS2012 build 50727 / VS2005 build 50727): 25\nC objects (VS2012 build 50727 / VS2005 build 50727): 136\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 114\n114 (VS2012 build 50727 / VS2005 build 50727): 1\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 8.0\n MSVC++ v.8 (procedure 1 recognized - h)\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Possibly launches other programs:\n CreateProcessA\n Uses functions commonly found in keyloggers:\n GetForegroundWindow\n CallNextHookEx\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (76 registered handlers)\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/CryptoLocker_20Nov2013-019f46ce41d271419d80e3344372fac8.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_e9f6eqn4/output.txt"},"timestamp":"2026-07-10 01:10:15"} {"_id":{"$oid":"6a4ff9e60108394cb24cdd19"},"sha256":"dce2d575bef073079c658edfa872a15546b422ad2b74267d33b386dc7cc85b47","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_geu39gou/Win32.DarkTequila-019f46ceb07d75e385ced0a370039660.exe_dce2d575bef0/001_upx_unpacked.exe\nDate: 2026-07-10 01:13:34\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_geu39gou/Win32.DarkTequila-019f46ceb07d75e385ced0a370039660.exe_dce2d575bef0/001_upx_unpacked.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 1999-Dec-05 04:15:29\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000108\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 1999-Dec-05 04:15:29\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x0000B200\nSizeOfInitializedData: 0x000D0C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000A99E (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x000E0000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000B185\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000B200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.649\n\n.rdata:\n VirtualSize: 0x000CCBF4\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x000CCC00\n PointerToRawData: 0x0000B600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.99937\n\n.data:\n VirtualSize: 0x00001800\n VirtualAddress: 0x000DA000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x000D8200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.83334\n\n.rsrc:\n VirtualSize: 0x00000528\n VirtualAddress: 0x000DC000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x000D8800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.42504\n\n.reloc:\n VirtualSize: 0x00002162\n VirtualAddress: 0x000DD000\n SizeOfRawData: 0x00002200\n PointerToRawData: 0x000D8E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.8265\n\n\nImports:\n--------\nKERNEL32.DLL: InterlockedCompareExchange\n InterlockedExchange\n GetCurrentProcessId\n GetLastError\n Sleep\n GetModuleHandleA\n LoadLibraryA\n GetProcAddress\n GetCurrentProcess\n GetCurrentThreadId\n GetTickCount\n SetUnhandledExceptionFilter\n FreeLibrary\n QueryPerformanceCounter\n UnhandledExceptionFilter\n TerminateProcess\n GetStartupInfoA\n RtlUnwind\n OutputDebugStringA\n GetSystemTimeAsFileTime\nmsvcrt.dll: _stricmp\n strstr\n free\n realloc\n malloc\n ??1exception@@UAE@XZ\n ??0exception@@QAE@XZ\n ??0exception@@QAE@ABV0@@Z\n _beginthreadex\n _CxxThrowException\n _callnewh\n _ismbblead\n memset\n memcpy\n _unlock\n __dllonexit\n _lock\n _onexit\n ??1type_info@@UAE@XZ\n ?terminate@@YAXXZ\n __getmainargs\n _cexit\n _exit\n _XcptFilter\n _acmdln\n _initterm\n _amsg_exit\n __setusermatherr\n __p__commode\n __p__fmode\n __set_app_type\n isleadbyte\n _iob\n _snprintf\n _itoa\n wctomb\n _controlfp\n __badioinfo\n __pioinfo\n _fileno\n _lseeki64\n _write\n _isatty\n _strlwr\n _errno\n __CxxFrameHandler\n exit\n ?what@exception@@UBEPBDXZ\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.56279\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.44714\n\nIDI_MAIN_ICON:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 34\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.37086\n Detected Filetype: Icon file\n\n\nLoad Configuration:\n-------------------\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004DA00C\nSEHandlerTable: 0x004D9310\nSEHandlerCount: 9\n\nRICH Header:\n------------\nXOR Key: 0xB451C58C\nUnmarked objects: 0\n105 (2067): 2\nASM objects (VS2008 SP1 build 30729): 6\nImports (VS2008 SP1 build 30729): 2\nC objects (VS2008 SP1 build 30729): 69\nImports (VS2003 (.NET) build 4035): 9\nTotal imports: 129\nC++ objects (VS2008 SP1 build 30729): 19\n126 (VS2012 build 50727 / VS2005 build 50727): 1\n175 (VS2010 SP1 build 40219): 18\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Looks for VMWare presence:\n ba 58 56 00 00 ed 81 fb 68 58 4d 56 \n Looks for VirtualPC presence:\n 0f 3f 07 0b \n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (9 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 1999-Dec-05 04:15:29\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000108"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 1999-Dec-05 04:15:29\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x0000B200\nSizeOfInitializedData: 0x000D0C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000A99E (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x000E0000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000B185\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000B200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.649\n\n.rdata:\n VirtualSize: 0x000CCBF4\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x000CCC00\n PointerToRawData: 0x0000B600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.99937\n\n.data:\n VirtualSize: 0x00001800\n VirtualAddress: 0x000DA000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x000D8200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.83334\n\n.rsrc:\n VirtualSize: 0x00000528\n VirtualAddress: 0x000DC000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x000D8800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.42504\n\n.reloc:\n VirtualSize: 0x00002162\n VirtualAddress: 0x000DD000\n SizeOfRawData: 0x00002200\n PointerToRawData: 0x000D8E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.8265"},"Imports":{"raw":"KERNEL32.DLL: InterlockedCompareExchange\n InterlockedExchange\n GetCurrentProcessId\n GetLastError\n Sleep\n GetModuleHandleA\n LoadLibraryA\n GetProcAddress\n GetCurrentProcess\n GetCurrentThreadId\n GetTickCount\n SetUnhandledExceptionFilter\n FreeLibrary\n QueryPerformanceCounter\n UnhandledExceptionFilter\n TerminateProcess\n GetStartupInfoA\n RtlUnwind\n OutputDebugStringA\n GetSystemTimeAsFileTime\nmsvcrt.dll: _stricmp\n strstr\n free\n realloc\n malloc\n ??1exception@@UAE@XZ\n ??0exception@@QAE@XZ\n ??0exception@@QAE@ABV0@@Z\n _beginthreadex\n _CxxThrowException\n _callnewh\n _ismbblead\n memset\n memcpy\n _unlock\n __dllonexit\n _lock\n _onexit\n ??1type_info@@UAE@XZ\n ?terminate@@YAXXZ\n __getmainargs\n _cexit\n _exit\n _XcptFilter\n _acmdln\n _initterm\n _amsg_exit\n __setusermatherr\n __p__commode\n __p__fmode\n __set_app_type\n isleadbyte\n _iob\n _snprintf\n _itoa\n wctomb\n _controlfp\n __badioinfo\n __pioinfo\n _fileno\n _lseeki64\n _write\n _isatty\n _strlwr\n _errno\n __CxxFrameHandler\n exit\n ?what@exception@@UBEPBDXZ\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.56279\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.44714\n\nIDI_MAIN_ICON:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 34\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.37086\n Detected Filetype: Icon file\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004DA00C\nSEHandlerTable: 0x004D9310\nSEHandlerCount: 9\n\nRICH Header:\nXOR Key: 0xB451C58C\nUnmarked objects: 0\n105 (2067): 2\nASM objects (VS2008 SP1 build 30729): 6\nImports (VS2008 SP1 build 30729): 2\nC objects (VS2008 SP1 build 30729): 69\nImports (VS2003 (.NET) build 4035): 9\nTotal imports: 129\nC++ objects (VS2008 SP1 build 30729): 19\n126 (VS2012 build 50727 / VS2005 build 50727): 1\n175 (VS2010 SP1 build 40219): 18\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Looks for VMWare presence:\n ba 58 56 00 00 ed 81 fb 68 58 4d 56 \n Looks for VirtualPC presence:\n 0f 3f 07 0b \n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (9 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.56279\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.44714\n\nIDI_MAIN_ICON:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 34\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.37086\n Detected Filetype: Icon file\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004DA00C\nSEHandlerTable: 0x004D9310\nSEHandlerCount: 9\n\nRICH Header:\nXOR Key: 0xB451C58C\nUnmarked objects: 0\n105 (2067): 2\nASM objects (VS2008 SP1 build 30729): 6\nImports (VS2008 SP1 build 30729): 2\nC objects (VS2008 SP1 build 30729): 69\nImports (VS2003 (.NET) build 4035): 9\nTotal imports: 129\nC++ objects (VS2008 SP1 build 30729): 19\n126 (VS2012 build 50727 / VS2005 build 50727): 1\n175 (VS2010 SP1 build 40219): 18\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Looks for VMWare presence:\n ba 58 56 00 00 ed 81 fb 68 58 4d 56 \n Looks for VirtualPC presence:\n 0f 3f 07 0b \n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (9 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{"raw":"Size: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004DA00C\nSEHandlerTable: 0x004D9310\nSEHandlerCount: 9"},"RICH Header":{"raw":"XOR Key: 0xB451C58C\nUnmarked objects: 0\n105 (2067): 2\nASM objects (VS2008 SP1 build 30729): 6\nImports (VS2008 SP1 build 30729): 2\nC objects (VS2008 SP1 build 30729): 69\nImports (VS2003 (.NET) build 4035): 9\nTotal imports: 129\nC++ objects (VS2008 SP1 build 30729): 19\n126 (VS2012 build 50727 / VS2005 build 50727): 1\n175 (VS2010 SP1 build 40219): 18\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Looks for VMWare presence:\n ba 58 56 00 00 ed 81 fb 68 58 4d 56 \n Looks for VirtualPC presence:\n 0f 3f 07 0b \n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (9 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_geu39gou/Win32.DarkTequila-019f46ceb07d75e385ced0a370039660.exe_dce2d575bef0/001_upx_unpacked.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_he47beg3/output.txt"},"timestamp":"2026-07-10 01:13:34"} {"_id":{"$oid":"6a4fff080108394cb24cdd1e"},"sha256":"517ac5506a5488a1193686f66cb57ad3288c2258c510004edb2f361b674526cc","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Ransomware.Unnamed_0-019f46cf07d27c50852ca64be62892a7.exe\nDate: 2026-07-10 01:35:28\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Ransomware.Unnamed_0-019f46cf07d27c50852ca64be62892a7.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2018-Mar-31 08:48:55\nDetected languages: German - Germany\nFileDescription: \nFileVersion: 0.0.0.0\nInternalName: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\nLegalCopyright: \nOriginalFilename: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\nProductVersion: 0.0.0.0\nAssembly Version: 0.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2018-Mar-31 08:48:55\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x00014C00\nSizeOfInitializedData: 0x000CCC00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00016B4E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00018000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x000E8000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00014B54\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00014C00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 4.0367\n\n.rsrc:\n VirtualSize: 0x000CC810\n VirtualAddress: 0x00018000\n SizeOfRawData: 0x000CCA00\n PointerToRawData: 0x00014E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.99651\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x000E6000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000E1800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.50808\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.94375\n Detected Filetype: Icon file\n\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 684\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.37659\n\n138:\n Type: RT_HTML\n Language: German - Germany\n Codepage: Latin 1 / Western European\n Size: 831811\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99869\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n FileDescription: \n FileVersion (#2): 0.0.0.0\n InternalName: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\n LegalCopyright: \n OriginalFilename: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\n ProductVersion (#2): 0.0.0.0\n Assembly Version: 0.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 90.5978% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2018-Mar-31 08:48:55\nDetected languages: German - Germany\nFileDescription: \nFileVersion: 0.0.0.0\nInternalName: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\nLegalCopyright: \nOriginalFilename: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\nProductVersion: 0.0.0.0\nAssembly Version: 0.0.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2018-Mar-31 08:48:55\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x00014C00\nSizeOfInitializedData: 0x000CCC00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00016B4E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00018000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x000E8000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00014B54\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00014C00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 4.0367\n\n.rsrc:\n VirtualSize: 0x000CC810\n VirtualAddress: 0x00018000\n SizeOfRawData: 0x000CCA00\n PointerToRawData: 0x00014E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.99651\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x000E6000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000E1800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.50808\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.94375\n Detected Filetype: Icon file\n\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 684\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.37659\n\n138:\n Type: RT_HTML\n Language: German - Germany\n Codepage: Latin 1 / Western European\n Size: 831811\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99869\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n FileDescription: \n FileVersion (#2): 0.0.0.0\n InternalName: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\n LegalCopyright: \n OriginalFilename: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\n ProductVersion (#2): 0.0.0.0\n Assembly Version: 0.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 90.5978% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.50808\n\n32512:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 1.94375\n Detected Filetype: Icon file\n\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 684\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.37659\n\n138:\n Type: RT_HTML\n Language: German - Germany\n Codepage: Latin 1 / Western European\n Size: 831811\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99869\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n FileDescription: \n FileVersion (#2): 0.0.0.0\n InternalName: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\n LegalCopyright: \n OriginalFilename: Ea6dq8F1DhAt0XmH.MZVgFJNgR2Tj7eIu.exe\n ProductVersion (#2): 0.0.0.0\n Assembly Version: 0.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 90.5978% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Ransomware.Unnamed_0-019f46cf07d27c50852ca64be62892a7.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_qz3fjcr0/output.txt"},"timestamp":"2026-07-10 01:35:28"} {"_id":{"$oid":"6a5001530108394cb24cdd21"},"sha256":"2fd5b075ab9dffe8b421a4942ecdac322d8f0fceca597a644a6a9e631901e8bc","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Trojan.Dropper.Gen-019f46cf44ca7e83b22b70b6b91c7586.exe\nDate: 2026-07-10 01:45:15\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Trojan.Dropper.Gen-019f46cf44ca7e83b22b70b6b91c7586.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2009-Jun-18 21:33:23\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000C8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2009-Jun-18 21:33:23\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00005C00\nSizeOfInitializedData: 0x0001D400\nSizeOfUninitializedData: 0x00000400\nAddressOfEntryPoint: 0x00003121 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00007000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0004A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x001968CD\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00005A38\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00005C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.40345\n\n.rdata:\n VirtualSize: 0x00001190\n VirtualAddress: 0x00007000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00006000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.17961\n\n.data:\n VirtualSize: 0x0001AF58\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00007200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.61789\n\n.ndata:\n VirtualSize: 0x00025000\n VirtualAddress: 0x00024000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rsrc:\n VirtualSize: 0x000007D8\n VirtualAddress: 0x00049000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00007600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.42128\n\n\nImports:\n--------\nKERNEL32.dll: CompareFileTime\n SearchPathA\n GetShortPathNameA\n GetFullPathNameA\n MoveFileA\n SetCurrentDirectoryA\n GetFileAttributesA\n GetLastError\n CreateDirectoryA\n SetFileAttributesA\n Sleep\n GetTickCount\n GetFileSize\n GetModuleFileNameA\n GetCurrentProcess\n CopyFileA\n ExitProcess\n GetWindowsDirectoryA\n SetFileTime\n GetCommandLineA\n SetErrorMode\n LoadLibraryA\n lstrcpynA\n GetDiskFreeSpaceA\n GlobalUnlock\n GlobalLock\n CreateThread\n CreateProcessA\n RemoveDirectoryA\n CreateFileA\n GetTempFileNameA\n lstrlenA\n lstrcatA\n GetSystemDirectoryA\n GetVersion\n CloseHandle\n lstrcmpiA\n lstrcmpA\n ExpandEnvironmentStringsA\n GlobalFree\n GlobalAlloc\n WaitForSingleObject\n GetExitCodeProcess\n GetModuleHandleA\n LoadLibraryExA\n GetProcAddress\n FreeLibrary\n MultiByteToWideChar\n WritePrivateProfileStringA\n GetPrivateProfileStringA\n WriteFile\n ReadFile\n MulDiv\n SetFilePointer\n FindClose\n FindNextFileA\n FindFirstFileA\n DeleteFileA\n GetTempPathA\nUSER32.dll: EndDialog\n ScreenToClient\n GetWindowRect\n EnableMenuItem\n GetSystemMenu\n SetClassLongA\n IsWindowEnabled\n SetWindowPos\n GetSysColor\n GetWindowLongA\n SetCursor\n LoadCursorA\n CheckDlgButton\n GetMessagePos\n LoadBitmapA\n CallWindowProcA\n IsWindowVisible\n CloseClipboard\n SetClipboardData\n EmptyClipboard\n RegisterClassA\n TrackPopupMenu\n AppendMenuA\n CreatePopupMenu\n GetSystemMetrics\n SetDlgItemTextA\n GetDlgItemTextA\n MessageBoxIndirectA\n CharPrevA\n DispatchMessageA\n PeekMessageA\n DestroyWindow\n CreateDialogParamA\n SetTimer\n SetWindowTextA\n PostQuitMessage\n SetForegroundWindow\n wsprintfA\n SendMessageTimeoutA\n FindWindowExA\n SystemParametersInfoA\n CreateWindowExA\n GetClassInfoA\n DialogBoxParamA\n CharNextA\n OpenClipboard\n ExitWindowsEx\n IsWindow\n GetDlgItem\n SetWindowLongA\n LoadImageA\n GetDC\n EnableWindow\n InvalidateRect\n SendMessageA\n DefWindowProcA\n BeginPaint\n GetClientRect\n FillRect\n DrawTextA\n EndPaint\n ShowWindow\nGDI32.dll: SetBkColor\n GetDeviceCaps\n DeleteObject\n CreateBrushIndirect\n CreateFontIndirectA\n SetBkMode\n SetTextColor\n SelectObject\nSHELL32.dll: SHGetPathFromIDListA\n SHBrowseForFolderA\n SHGetFileInfoA\n ShellExecuteA\n SHFileOperationA\n SHGetSpecialFolderLocation\nADVAPI32.dll: RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\nCOMCTL32.dll: ImageList_AddMasked\n ImageList_Destroy\n #17\n ImageList_Create\nole32.dll: CoTaskMemFree\n OleInitialize\n OleUninitialize\n CoCreateInstance\nVERSION.dll: GetFileVersionInfoSizeA\n GetFileVersionInfoA\n VerQueryValueA\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50665\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 256\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.66174\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.16096\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 533\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10609\n\n\nRICH Header:\n------------\nXOR Key: 0xD1DD2975\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 155\nImports (VS2003 (.NET) build 4035): 17\nC objects (VS98 build 8168): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n nsis.sf.net\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExA\n GetProcAddress\n Can access the registry:\n RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: \\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE9\\x87\\x91\\xE5\\x88\\xA9\\xE5\\xAE\\x8F\\xE6\\x98\\x8C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2009-Jun-18 21:33:23\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000C8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2009-Jun-18 21:33:23\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00005C00\nSizeOfInitializedData: 0x0001D400\nSizeOfUninitializedData: 0x00000400\nAddressOfEntryPoint: 0x00003121 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00007000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0004A000\nSizeOfHeaders: 0x00000400\nChecksum: 0x001968CD\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00005A38\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00005C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.40345\n\n.rdata:\n VirtualSize: 0x00001190\n VirtualAddress: 0x00007000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00006000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.17961\n\n.data:\n VirtualSize: 0x0001AF58\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00007200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.61789\n\n.ndata:\n VirtualSize: 0x00025000\n VirtualAddress: 0x00024000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rsrc:\n VirtualSize: 0x000007D8\n VirtualAddress: 0x00049000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00007600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.42128"},"Imports":{"raw":"KERNEL32.dll: CompareFileTime\n SearchPathA\n GetShortPathNameA\n GetFullPathNameA\n MoveFileA\n SetCurrentDirectoryA\n GetFileAttributesA\n GetLastError\n CreateDirectoryA\n SetFileAttributesA\n Sleep\n GetTickCount\n GetFileSize\n GetModuleFileNameA\n GetCurrentProcess\n CopyFileA\n ExitProcess\n GetWindowsDirectoryA\n SetFileTime\n GetCommandLineA\n SetErrorMode\n LoadLibraryA\n lstrcpynA\n GetDiskFreeSpaceA\n GlobalUnlock\n GlobalLock\n CreateThread\n CreateProcessA\n RemoveDirectoryA\n CreateFileA\n GetTempFileNameA\n lstrlenA\n lstrcatA\n GetSystemDirectoryA\n GetVersion\n CloseHandle\n lstrcmpiA\n lstrcmpA\n ExpandEnvironmentStringsA\n GlobalFree\n GlobalAlloc\n WaitForSingleObject\n GetExitCodeProcess\n GetModuleHandleA\n LoadLibraryExA\n GetProcAddress\n FreeLibrary\n MultiByteToWideChar\n WritePrivateProfileStringA\n GetPrivateProfileStringA\n WriteFile\n ReadFile\n MulDiv\n SetFilePointer\n FindClose\n FindNextFileA\n FindFirstFileA\n DeleteFileA\n GetTempPathA\nUSER32.dll: EndDialog\n ScreenToClient\n GetWindowRect\n EnableMenuItem\n GetSystemMenu\n SetClassLongA\n IsWindowEnabled\n SetWindowPos\n GetSysColor\n GetWindowLongA\n SetCursor\n LoadCursorA\n CheckDlgButton\n GetMessagePos\n LoadBitmapA\n CallWindowProcA\n IsWindowVisible\n CloseClipboard\n SetClipboardData\n EmptyClipboard\n RegisterClassA\n TrackPopupMenu\n AppendMenuA\n CreatePopupMenu\n GetSystemMetrics\n SetDlgItemTextA\n GetDlgItemTextA\n MessageBoxIndirectA\n CharPrevA\n DispatchMessageA\n PeekMessageA\n DestroyWindow\n CreateDialogParamA\n SetTimer\n SetWindowTextA\n PostQuitMessage\n SetForegroundWindow\n wsprintfA\n SendMessageTimeoutA\n FindWindowExA\n SystemParametersInfoA\n CreateWindowExA\n GetClassInfoA\n DialogBoxParamA\n CharNextA\n OpenClipboard\n ExitWindowsEx\n IsWindow\n GetDlgItem\n SetWindowLongA\n LoadImageA\n GetDC\n EnableWindow\n InvalidateRect\n SendMessageA\n DefWindowProcA\n BeginPaint\n GetClientRect\n FillRect\n DrawTextA\n EndPaint\n ShowWindow\nGDI32.dll: SetBkColor\n GetDeviceCaps\n DeleteObject\n CreateBrushIndirect\n CreateFontIndirectA\n SetBkMode\n SetTextColor\n SelectObject\nSHELL32.dll: SHGetPathFromIDListA\n SHBrowseForFolderA\n SHGetFileInfoA\n ShellExecuteA\n SHFileOperationA\n SHGetSpecialFolderLocation\nADVAPI32.dll: RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\nCOMCTL32.dll: ImageList_AddMasked\n ImageList_Destroy\n #17\n ImageList_Create\nole32.dll: CoTaskMemFree\n OleInitialize\n OleUninitialize\n CoCreateInstance\nVERSION.dll: GetFileVersionInfoSizeA\n GetFileVersionInfoA\n VerQueryValueA\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50665\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 256\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.66174\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.16096\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 533\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10609\n\n\nRICH Header:\nXOR Key: 0xD1DD2975\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 155\nImports (VS2003 (.NET) build 4035): 17\nC objects (VS98 build 8168): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n nsis.sf.net\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExA\n GetProcAddress\n Can access the registry:\n RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: \\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE9\\x87\\x91\\xE5\\x88\\xA9\\xE5\\xAE\\x8F\\xE6\\x98\\x8C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.50665\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 256\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.66174\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.16096\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 533\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10609\n\n\nRICH Header:\nXOR Key: 0xD1DD2975\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 155\nImports (VS2003 (.NET) build 4035): 17\nC objects (VS98 build 8168): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n nsis.sf.net\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExA\n GetProcAddress\n Can access the registry:\n RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: \\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE9\\x87\\x91\\xE5\\x88\\xA9\\xE5\\xAE\\x8F\\xE6\\x98\\x8C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0xD1DD2975\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 155\nImports (VS2003 (.NET) build 4035): 17\nC objects (VS98 build 8168): 10\nResource objects (VS98 SP6 cvtres build 1736): 1"},"Interesting strings found in the binary":{"raw":"Contains domain names:\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n nsis.sf.net\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExA\n GetProcAddress\n Can access the registry:\n RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: \\xE5\\x8C\\x97\\xE4\\xBA\\xAC\\xE9\\x87\\x91\\xE5\\x88\\xA9\\xE5\\xAE\\x8F\\xE6\\x98\\x8C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\n Issuer: Thawte Code Signing CA - G2\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/Trojan.Dropper.Gen-019f46cf44ca7e83b22b70b6b91c7586.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_k4a4iw6x/output.txt"},"timestamp":"2026-07-10 01:45:15"} {"_id":{"$oid":"6a5002a40108394cb24cdd23"},"sha256":"d24d79011d003dc7a4cadbc1b7b3efb89947f9a84f814c6739a01c1c38e227b8","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Trojan.NSIS.Win32-019f46cf7cd476728ac181ce86697559.exe\nDate: 2026-07-10 01:50:52\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Trojan.NSIS.Win32-019f46cf7cd476728ac181ce86697559.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2009-Jun-18 21:33:23\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000C8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2009-Jun-18 21:33:23\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00005C00\nSizeOfInitializedData: 0x0001D400\nSizeOfUninitializedData: 0x00000400\nAddressOfEntryPoint: 0x00003121 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00007000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00061000\nSizeOfHeaders: 0x00000400\nChecksum: 0x001B6685\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00005A38\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00005C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.40345\n\n.rdata:\n VirtualSize: 0x00001190\n VirtualAddress: 0x00007000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00006000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.17961\n\n.data:\n VirtualSize: 0x0001AF58\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00007200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.61789\n\n.ndata:\n VirtualSize: 0x00025000\n VirtualAddress: 0x00024000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rsrc:\n VirtualSize: 0x00017E40\n VirtualAddress: 0x00049000\n SizeOfRawData: 0x00018000\n PointerToRawData: 0x00007600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.66825\n\n\nImports:\n--------\nKERNEL32.dll: CompareFileTime\n SearchPathA\n GetShortPathNameA\n GetFullPathNameA\n MoveFileA\n SetCurrentDirectoryA\n GetFileAttributesA\n GetLastError\n CreateDirectoryA\n SetFileAttributesA\n Sleep\n GetTickCount\n GetFileSize\n GetModuleFileNameA\n GetCurrentProcess\n CopyFileA\n ExitProcess\n GetWindowsDirectoryA\n SetFileTime\n GetCommandLineA\n SetErrorMode\n LoadLibraryA\n lstrcpynA\n GetDiskFreeSpaceA\n GlobalUnlock\n GlobalLock\n CreateThread\n CreateProcessA\n RemoveDirectoryA\n CreateFileA\n GetTempFileNameA\n lstrlenA\n lstrcatA\n GetSystemDirectoryA\n GetVersion\n CloseHandle\n lstrcmpiA\n lstrcmpA\n ExpandEnvironmentStringsA\n GlobalFree\n GlobalAlloc\n WaitForSingleObject\n GetExitCodeProcess\n GetModuleHandleA\n LoadLibraryExA\n GetProcAddress\n FreeLibrary\n MultiByteToWideChar\n WritePrivateProfileStringA\n GetPrivateProfileStringA\n WriteFile\n ReadFile\n MulDiv\n SetFilePointer\n FindClose\n FindNextFileA\n FindFirstFileA\n DeleteFileA\n GetTempPathA\nUSER32.dll: EndDialog\n ScreenToClient\n GetWindowRect\n EnableMenuItem\n GetSystemMenu\n SetClassLongA\n IsWindowEnabled\n SetWindowPos\n GetSysColor\n GetWindowLongA\n SetCursor\n LoadCursorA\n CheckDlgButton\n GetMessagePos\n LoadBitmapA\n CallWindowProcA\n IsWindowVisible\n CloseClipboard\n SetClipboardData\n EmptyClipboard\n RegisterClassA\n TrackPopupMenu\n AppendMenuA\n CreatePopupMenu\n GetSystemMetrics\n SetDlgItemTextA\n GetDlgItemTextA\n MessageBoxIndirectA\n CharPrevA\n DispatchMessageA\n PeekMessageA\n DestroyWindow\n CreateDialogParamA\n SetTimer\n SetWindowTextA\n PostQuitMessage\n SetForegroundWindow\n wsprintfA\n SendMessageTimeoutA\n FindWindowExA\n SystemParametersInfoA\n CreateWindowExA\n GetClassInfoA\n DialogBoxParamA\n CharNextA\n OpenClipboard\n ExitWindowsEx\n IsWindow\n GetDlgItem\n SetWindowLongA\n LoadImageA\n GetDC\n EnableWindow\n InvalidateRect\n SendMessageA\n DefWindowProcA\n BeginPaint\n GetClientRect\n FillRect\n DrawTextA\n EndPaint\n ShowWindow\nGDI32.dll: SetBkColor\n GetDeviceCaps\n DeleteObject\n CreateBrushIndirect\n CreateFontIndirectA\n SetBkMode\n SetTextColor\n SelectObject\nSHELL32.dll: SHGetPathFromIDListA\n SHBrowseForFolderA\n SHGetFileInfoA\n ShellExecuteA\n SHFileOperationA\n SHGetSpecialFolderLocation\nADVAPI32.dll: RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\nCOMCTL32.dll: ImageList_AddMasked\n ImageList_Destroy\n #17\n ImageList_Create\nole32.dll: CoTaskMemFree\n OleInitialize\n OleUninitialize\n CoCreateInstance\nVERSION.dll: GetFileVersionInfoSizeA\n GetFileVersionInfoA\n VerQueryValueA\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 76115\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98586\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.56867\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.70944\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.82892\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88674\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.83961\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.87092\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34124\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 494\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68733\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 218\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9304\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77918\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 533\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10609\n\n\nRICH Header:\n------------\nXOR Key: 0xD1DD2975\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 155\nImports (VS2003 (.NET) build 4035): 17\nC objects (VS98 build 8168): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n aia.ws.symantec.com\n crl.thawte.com\n crl.ws.symantec.com\n cs-g2-crl.thawte.com\n g2-crl.thawte.com\n http://crl.thawte.com\n http://crl.thawte.com/ThawtePCA.crl0\n http://crl.thawte.com/ThawtePremiumServerCA.crl0\n http://crl.thawte.com/ThawteTimestampingCA.crl0\n http://cs-g2-crl.thawte.com\n http://cs-g2-crl.thawte.com/ThawteCSG2.crl0\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n http://ocsp.thawte.com0\n http://ts-aia.ws.symantec.com\n http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\n http://ts-crl.ws.symantec.com\n http://ts-crl.ws.symantec.com/tss-ca-g2.crl0\n http://ts-ocsp.ws.symantec.com07\n https://www.thawte.com\n https://www.thawte.com/cps0\n nsis.sf.net\n symantec.com\n thawte.com\n ts-aia.ws.symantec.com\n ts-crl.ws.symantec.com\n ws.symantec.com\n www.thawte.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExA\n GetProcAddress\n Can access the registry:\n RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[*] Warning: The WIN_CERTIFICATE appears to be invalid.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2009-Jun-18 21:33:23\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000C8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2009-Jun-18 21:33:23\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00005C00\nSizeOfInitializedData: 0x0001D400\nSizeOfUninitializedData: 0x00000400\nAddressOfEntryPoint: 0x00003121 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00007000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00061000\nSizeOfHeaders: 0x00000400\nChecksum: 0x001B6685\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00005A38\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00005C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.40345\n\n.rdata:\n VirtualSize: 0x00001190\n VirtualAddress: 0x00007000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00006000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.17961\n\n.data:\n VirtualSize: 0x0001AF58\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00007200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.61789\n\n.ndata:\n VirtualSize: 0x00025000\n VirtualAddress: 0x00024000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rsrc:\n VirtualSize: 0x00017E40\n VirtualAddress: 0x00049000\n SizeOfRawData: 0x00018000\n PointerToRawData: 0x00007600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.66825"},"Imports":{"raw":"KERNEL32.dll: CompareFileTime\n SearchPathA\n GetShortPathNameA\n GetFullPathNameA\n MoveFileA\n SetCurrentDirectoryA\n GetFileAttributesA\n GetLastError\n CreateDirectoryA\n SetFileAttributesA\n Sleep\n GetTickCount\n GetFileSize\n GetModuleFileNameA\n GetCurrentProcess\n CopyFileA\n ExitProcess\n GetWindowsDirectoryA\n SetFileTime\n GetCommandLineA\n SetErrorMode\n LoadLibraryA\n lstrcpynA\n GetDiskFreeSpaceA\n GlobalUnlock\n GlobalLock\n CreateThread\n CreateProcessA\n RemoveDirectoryA\n CreateFileA\n GetTempFileNameA\n lstrlenA\n lstrcatA\n GetSystemDirectoryA\n GetVersion\n CloseHandle\n lstrcmpiA\n lstrcmpA\n ExpandEnvironmentStringsA\n GlobalFree\n GlobalAlloc\n WaitForSingleObject\n GetExitCodeProcess\n GetModuleHandleA\n LoadLibraryExA\n GetProcAddress\n FreeLibrary\n MultiByteToWideChar\n WritePrivateProfileStringA\n GetPrivateProfileStringA\n WriteFile\n ReadFile\n MulDiv\n SetFilePointer\n FindClose\n FindNextFileA\n FindFirstFileA\n DeleteFileA\n GetTempPathA\nUSER32.dll: EndDialog\n ScreenToClient\n GetWindowRect\n EnableMenuItem\n GetSystemMenu\n SetClassLongA\n IsWindowEnabled\n SetWindowPos\n GetSysColor\n GetWindowLongA\n SetCursor\n LoadCursorA\n CheckDlgButton\n GetMessagePos\n LoadBitmapA\n CallWindowProcA\n IsWindowVisible\n CloseClipboard\n SetClipboardData\n EmptyClipboard\n RegisterClassA\n TrackPopupMenu\n AppendMenuA\n CreatePopupMenu\n GetSystemMetrics\n SetDlgItemTextA\n GetDlgItemTextA\n MessageBoxIndirectA\n CharPrevA\n DispatchMessageA\n PeekMessageA\n DestroyWindow\n CreateDialogParamA\n SetTimer\n SetWindowTextA\n PostQuitMessage\n SetForegroundWindow\n wsprintfA\n SendMessageTimeoutA\n FindWindowExA\n SystemParametersInfoA\n CreateWindowExA\n GetClassInfoA\n DialogBoxParamA\n CharNextA\n OpenClipboard\n ExitWindowsEx\n IsWindow\n GetDlgItem\n SetWindowLongA\n LoadImageA\n GetDC\n EnableWindow\n InvalidateRect\n SendMessageA\n DefWindowProcA\n BeginPaint\n GetClientRect\n FillRect\n DrawTextA\n EndPaint\n ShowWindow\nGDI32.dll: SetBkColor\n GetDeviceCaps\n DeleteObject\n CreateBrushIndirect\n CreateFontIndirectA\n SetBkMode\n SetTextColor\n SelectObject\nSHELL32.dll: SHGetPathFromIDListA\n SHBrowseForFolderA\n SHGetFileInfoA\n ShellExecuteA\n SHFileOperationA\n SHGetSpecialFolderLocation\nADVAPI32.dll: RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\nCOMCTL32.dll: ImageList_AddMasked\n ImageList_Destroy\n #17\n ImageList_Create\nole32.dll: CoTaskMemFree\n OleInitialize\n OleUninitialize\n CoCreateInstance\nVERSION.dll: GetFileVersionInfoSizeA\n GetFileVersionInfoA\n VerQueryValueA\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 76115\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98586\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.56867\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.70944\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.82892\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88674\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.83961\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.87092\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34124\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 494\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68733\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 218\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9304\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77918\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 533\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10609\n\n\nRICH Header:\nXOR Key: 0xD1DD2975\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 155\nImports (VS2003 (.NET) build 4035): 17\nC objects (VS98 build 8168): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n aia.ws.symantec.com\n crl.thawte.com\n crl.ws.symantec.com\n cs-g2-crl.thawte.com\n g2-crl.thawte.com\n http://crl.thawte.com\n http://crl.thawte.com/ThawtePCA.crl0\n http://crl.thawte.com/ThawtePremiumServerCA.crl0\n http://crl.thawte.com/ThawteTimestampingCA.crl0\n http://cs-g2-crl.thawte.com\n http://cs-g2-crl.thawte.com/ThawteCSG2.crl0\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n http://ocsp.thawte.com0\n http://ts-aia.ws.symantec.com\n http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\n http://ts-crl.ws.symantec.com\n http://ts-crl.ws.symantec.com/tss-ca-g2.crl0\n http://ts-ocsp.ws.symantec.com07\n https://www.thawte.com\n https://www.thawte.com/cps0\n nsis.sf.net\n symantec.com\n thawte.com\n ts-aia.ws.symantec.com\n ts-crl.ws.symantec.com\n ws.symantec.com\n www.thawte.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExA\n GetProcAddress\n Can access the registry:\n RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[*] Warning: The WIN_CERTIFICATE appears to be invalid.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 76115\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98586\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.56867\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.70944\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.82892\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88674\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.83961\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.87092\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34124\n\n105:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 494\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68733\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 218\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9304\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.77918\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 533\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10609\n\n\nRICH Header:\nXOR Key: 0xD1DD2975\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 155\nImports (VS2003 (.NET) build 4035): 17\nC objects (VS98 build 8168): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nInteresting strings found in the binary:\n Contains domain names:\n aia.ws.symantec.com\n crl.thawte.com\n crl.ws.symantec.com\n cs-g2-crl.thawte.com\n g2-crl.thawte.com\n http://crl.thawte.com\n http://crl.thawte.com/ThawtePCA.crl0\n http://crl.thawte.com/ThawtePremiumServerCA.crl0\n http://crl.thawte.com/ThawteTimestampingCA.crl0\n http://cs-g2-crl.thawte.com\n http://cs-g2-crl.thawte.com/ThawteCSG2.crl0\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n http://ocsp.thawte.com0\n http://ts-aia.ws.symantec.com\n http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\n http://ts-crl.ws.symantec.com\n http://ts-crl.ws.symantec.com/tss-ca-g2.crl0\n http://ts-ocsp.ws.symantec.com07\n https://www.thawte.com\n https://www.thawte.com/cps0\n nsis.sf.net\n symantec.com\n thawte.com\n ts-aia.ws.symantec.com\n ts-crl.ws.symantec.com\n ws.symantec.com\n www.thawte.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExA\n GetProcAddress\n Can access the registry:\n RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[*] Warning: The WIN_CERTIFICATE appears to be invalid.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0xD1DD2975\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 155\nImports (VS2003 (.NET) build 4035): 17\nC objects (VS98 build 8168): 10\nResource objects (VS98 SP6 cvtres build 1736): 1"},"Interesting strings found in the binary":{"raw":"Contains domain names:\n aia.ws.symantec.com\n crl.thawte.com\n crl.ws.symantec.com\n cs-g2-crl.thawte.com\n g2-crl.thawte.com\n http://crl.thawte.com\n http://crl.thawte.com/ThawtePCA.crl0\n http://crl.thawte.com/ThawtePremiumServerCA.crl0\n http://crl.thawte.com/ThawteTimestampingCA.crl0\n http://cs-g2-crl.thawte.com\n http://cs-g2-crl.thawte.com/ThawteCSG2.crl0\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n http://ocsp.thawte.com0\n http://ts-aia.ws.symantec.com\n http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\n http://ts-crl.ws.symantec.com\n http://ts-crl.ws.symantec.com/tss-ca-g2.crl0\n http://ts-ocsp.ws.symantec.com07\n https://www.thawte.com\n https://www.thawte.com/cps0\n nsis.sf.net\n symantec.com\n thawte.com\n ts-aia.ws.symantec.com\n ts-crl.ws.symantec.com\n ws.symantec.com\n www.thawte.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n LoadLibraryExA\n GetProcAddress\n Can access the registry:\n RegQueryValueExA\n RegSetValueExA\n RegEnumKeyA\n RegEnumValueA\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCloseKey\n RegCreateKeyExA\n Possibly launches other programs:\n CreateProcessA\n ShellExecuteA\n Can create temporary files:\n CreateFileA\n GetTempPathA\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[*] Warning: The WIN_CERTIFICATE appears to be invalid.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/Trojan.NSIS.Win32-019f46cf7cd476728ac181ce86697559.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_hgloag0y/output.txt"},"timestamp":"2026-07-10 01:50:52"} {"_id":{"$oid":"6a500a1c0108394cb24cdd26"},"sha256":"2ecc525177ed52c74ddaaacd47ad513450e85c01f2616bf179be5b576164bf63","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_decoded_zfgt72mj/resource_32DCAPI.DLL_105.bin\nDate: 2026-07-10 02:22:44\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_decoded_zfgt72mj/resource_32DCAPI.DLL_105.bin\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Jul-09 06:41:51\nDetected languages: English - United States\nFileDescription: DiskCryptor api\nFileVersion: 1.1.846.118\nLegalCopyright: http://diskcryptor.net/\nOriginalFilename: dcapi.dll\nProductName: DiskCryptor\nProductVersion: 1.1\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2014-Jul-09 06:41:51\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x0001C600\nSizeOfInitializedData: 0x00012C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000DA7B (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0001E000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00032000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0001C5EB\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0001C600\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.64452\n\n.rdata:\n VirtualSize: 0x00007B2F\n VirtualAddress: 0x0001E000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x0001CA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.56431\n\n.data:\n VirtualSize: 0x0000088C\n VirtualAddress: 0x00026000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00024600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.11548\n\n.rsrc:\n VirtualSize: 0x00008DC0\n VirtualAddress: 0x00027000\n SizeOfRawData: 0x00008E00\n PointerToRawData: 0x00024C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.13509\n\n.reloc:\n VirtualSize: 0x000016DA\n VirtualAddress: 0x00030000\n SizeOfRawData: 0x00001800\n PointerToRawData: 0x0002DA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.88392\n\n\nImports:\n--------\nUSER32.dll: GetWindowRect\n GetLastActivePopup\n GetFocus\n CallNextHookEx\n GetWindowInfo\n GetClientRect\n EnumWindows\n GetQueueStatus\n GetCapture\n GetKBCodePage\n GetOpenClipboardWindow\n GetGUIThreadInfo\n GetCursorInfo\n GetInputState\n GetWindowTextW\n GetDesktopWindow\n GetCaretPos\n GetActiveWindow\n GetCursor\n SetWindowsHookExW\n GetClipboardOwner\n GetMessageTime\n GetWindowThreadProcessId\n GetShellWindow\n GetForegroundWindow\nADVAPI32.dll: CryptReleaseContext\n CryptAcquireContextW\n AdjustTokenPrivileges\n CheckTokenMembership\n FreeSid\n AllocateAndInitializeSid\n LookupPrivilegeValueW\n OpenProcessToken\n RegSetValueExW\n RegCloseKey\n RegFlushKey\n RegDeleteValueW\n RegOpenKeyW\n RegQueryValueExW\n RegCreateKeyW\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CloseServiceHandle\n CreateServiceW\n CryptGenRandom\nPSAPI.DLL: GetProcessMemoryInfo\nmsvcrt.dll: _amsg_exit\n _initterm\n _XcptFilter\n memcpy\n memset\n wcsncpy\n malloc\n calloc\n free\n _vsnwprintf\n wcsrchr\n memmove\n wcschr\n isprint\n tolower\n isspace\n _snwprintf\n mbstowcs\n floor\n _except_handler3\nKERNEL32.dll: FindFirstVolumeW\n FindNextVolumeW\n CopyFileW\n GetFileAttributesW\n DeleteVolumeMountPointW\n TlsSetValue\n FindVolumeClose\n DeviceIoControl\n TlsFree\n TlsAlloc\n LockResource\n SizeofResource\n LoadResource\n FindResourceW\n TlsGetValue\n CreateMutexW\n DeleteFileW\n CloseHandle\n VirtualAlloc\n GetLastError\n VirtualFree\n WriteFile\n ReadFile\n CreateFileW\n GetSystemDirectoryW\n GetModuleFileNameW\n GetVersion\n GetSystemTimeAsFileTime\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n TerminateProcess\n InterlockedCompareExchange\n Sleep\n InterlockedExchange\n RtlUnwind\n GetThreadTimes\n GetCurrentProcessId\n GetCurrentThreadId\n GetOEMCP\n GlobalMemoryStatusEx\n GetProcessTimes\n GetProcessHeap\n GetCurrentThread\n GetTickCount\n QueryPerformanceCounter\n GetModuleHandleA\n VirtualLock\n GetProcAddress\n VirtualUnlock\n GetVersionExW\n LoadLibraryW\n GetCurrentProcess\n FreeLibrary\n VirtualQuery\n SetEndOfFile\n SetFilePointer\n GetFileSize\n FindNextFileW\n FindClose\n FindFirstFileW\n GlobalAddAtomW\n GetFileSizeEx\n\nExports:\n--------\ndc_add_keyfiles:\n Ordinal: 1\n Address: 0x0001CA00\n\ndc_add_password:\n Ordinal: 2\n Address: 0x0001B510\n\ndc_backup_header:\n Ordinal: 3\n Address: 0x0001ADB0\n\ndc_benchmark:\n Ordinal: 4\n Address: 0x0001A490\n\ndc_change_password:\n Ordinal: 5\n Address: 0x0001B030\n\ndc_dec_step:\n Ordinal: 6\n Address: 0x0001A6D0\n\ndc_device_control:\n Ordinal: 7\n Address: 0x0001AB90\n\ndc_disk_close:\n Ordinal: 8\n Address: 0x00016F90\n\ndc_disk_open:\n Ordinal: 9\n Address: 0x00016FB0\n\ndc_disk_read:\n Ordinal: 10\n Address: 0x00016E90\n\ndc_disk_write:\n Ordinal: 11\n Address: 0x00016D60\n\ndc_done_format:\n Ordinal: 12\n Address: 0x0001A400\n\ndc_dsk_get_size:\n Ordinal: 13\n Address: 0x000178B0\n\ndc_enc_step:\n Ordinal: 14\n Address: 0x0001A760\n\ndc_encrypt_iso_image:\n Ordinal: 15\n Address: 0x0001D010\n\ndc_extract_rsrc:\n Ordinal: 16\n Address: 0x0001C110\n\ndc_first_volume:\n Ordinal: 17\n Address: 0x0001B9B0\n\ndc_format_byte_size:\n Ordinal: 18\n Address: 0x00016B70\n\ndc_format_fs:\n Ordinal: 19\n Address: 0x000174D0\n\ndc_format_step:\n Ordinal: 20\n Address: 0x0001A630\n\ndc_get_boot_device:\n Ordinal: 21\n Address: 0x0001A970\n\ndc_get_boot_disk:\n Ordinal: 22\n Address: 0x000185B0\n\ndc_get_bsod:\n Ordinal: 23\n Address: 0x0001A3D0\n\ndc_get_cipher_name:\n Ordinal: 24\n Address: 0x00016B60\n\ndc_get_device_status:\n Ordinal: 25\n Address: 0x0001A4D0\n\ndc_get_drive_info:\n Ordinal: 26\n Address: 0x00017A20\n\ndc_get_hw_name:\n Ordinal: 27\n Address: 0x0001BF50\n\ndc_get_mbr_config:\n Ordinal: 28\n Address: 0x00018AE0\n\ndc_get_version:\n Ordinal: 29\n Address: 0x0001B890\n\ndc_install_driver:\n Ordinal: 30\n Address: 0x0001A2F0\n\ndc_is_driver_installed:\n Ordinal: 31\n Address: 0x00019D90\n\ndc_is_driver_works:\n Ordinal: 32\n Address: 0x0001A2B0\n\ndc_is_old_runned:\n Ordinal: 33\n Address: 0x0001AC10\n\ndc_load_config:\n Ordinal: 34\n Address: 0x00019CA0\n\ndc_make_iso:\n Ordinal: 35\n Address: 0x00018700\n\ndc_make_pxe:\n Ordinal: 36\n Address: 0x00018650\n\ndc_mbr_config_by_partition:\n Ordinal: 37\n Address: 0x000191D0\n\ndc_mount_all:\n Ordinal: 38\n Address: 0x0001B620\n\ndc_mount_volume:\n Ordinal: 39\n Address: 0x0001B750\n\ndc_next_volume:\n Ordinal: 40\n Address: 0x0001B910\n\ndc_open_device:\n Ordinal: 41\n Address: 0x0001AC40\n\ndc_remove_driver:\n Ordinal: 42\n Address: 0x00019E20\n\ndc_restore_header:\n Ordinal: 43\n Address: 0x0001AC80\n\ndc_save_config:\n Ordinal: 44\n Address: 0x00019BC0\n\ndc_set_boot:\n Ordinal: 45\n Address: 0x000193A0\n\ndc_set_mbr:\n Ordinal: 46\n Address: 0x00018D00\n\ndc_set_mbr_config:\n Ordinal: 47\n Address: 0x00018A60\n\ndc_start_decrypt:\n Ordinal: 48\n Address: 0x0001B160\n\ndc_start_encrypt:\n Ordinal: 49\n Address: 0x0001B3D0\n\ndc_start_format:\n Ordinal: 50\n Address: 0x0001AEF0\n\ndc_start_re_encrypt:\n Ordinal: 51\n Address: 0x0001B290\n\ndc_sync_enc_state:\n Ordinal: 52\n Address: 0x0001A5A0\n\ndc_unmount_all:\n Ordinal: 53\n Address: 0x0001BA30\n\ndc_unmount_volume:\n Ordinal: 54\n Address: 0x0001A800\n\ndc_unset_mbr:\n Ordinal: 55\n Address: 0x00018A00\n\ndc_update_boot:\n Ordinal: 56\n Address: 0x00019050\n\ndc_update_driver:\n Ordinal: 57\n Address: 0x0001A170\n\nenable_privilege:\n Ordinal: 58\n Address: 0x00017410\n\nis_admin:\n Ordinal: 59\n Address: 0x00017370\n\nis_win_vista:\n Ordinal: 60\n Address: 0x00016D10\n\nis_wow64:\n Ordinal: 61\n Address: 0x00017220\n\nload_file:\n Ordinal: 62\n Address: 0x00017270\n\nrnd_init:\n Ordinal: 63\n Address: 0x0001C690\n\nrnd_reseed_now:\n Ordinal: 64\n Address: 0x0001C480\n\nsave_file:\n Ordinal: 65\n Address: 0x00017310\n\nsecure_alloc:\n Ordinal: 66\n Address: 0x00017600\n\nsecure_free:\n Ordinal: 67\n Address: 0x00017540\n\n\nResources:\n----------\n139:\n Type: EXEFILE\n Language: English - United States\n Codepage: UNKNOWN\n Size: 512\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.29007\n\n140:\n Type: EXEFILE\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19653\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.24497\n\n141:\n Type: EXEFILE\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15253\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.08193\n\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 592\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40294\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.846.118\n ProductVersion: 1.1.846.118\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n FileDescription: DiskCryptor api\n FileVersion (#2): 1.1.846.118\n LegalCopyright: http://diskcryptor.net/\n OriginalFilename: dcapi.dll\n ProductName: DiskCryptor\n ProductVersion (#2): 1.1\n\n\nLoad Configuration:\n-------------------\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x10026000\nSEHandlerTable: 0x10024840\nSEHandlerCount: 3\n\nRICH Header:\n------------\nXOR Key: 0xB0E42203\nUnmarked objects: 0\nASM objects (VS2008 SP1 build 30729): 9\nC++ objects (VS2008 SP1 build 30729): 13\nC objects (VS2008 SP1 build 30729): 60\nUnmarked objects (#2): 6\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 170\n126 (VS2012 build 50727 / VS2005 build 50727): 1\n174 (VS2010 SP1 build 40219): 17\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentControlSet\\Services\n Contains domain names:\n diskcryptor.net\n http://diskcryptor.net\n yandex.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to SHA256\n Uses constants related to SHA512\n Uses constants related to Twofish\n Microsoft's Cryptography API\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Can access the registry:\n RegSetValueExW\n RegCloseKey\n RegFlushKey\n RegDeleteValueW\n RegOpenKeyW\n RegQueryValueExW\n RegCreateKeyW\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n CryptAcquireContextW\n CryptGenRandom\n Uses functions commonly found in keyloggers:\n CallNextHookEx\n GetForegroundWindow\n Functions related to the privilege level:\n AdjustTokenPrivileges\n CheckTokenMembership\n OpenProcessToken\n Interacts with services:\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CreateServiceW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2014-Jul-09 06:41:51\nDetected languages: English - United States\nFileDescription: DiskCryptor api\nFileVersion: 1.1.846.118\nLegalCopyright: http://diskcryptor.net/\nOriginalFilename: dcapi.dll\nProductName: DiskCryptor\nProductVersion: 1.1"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2014-Jul-09 06:41:51\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 10.0\nSizeOfCode: 0x0001C600\nSizeOfInitializedData: 0x00012C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000DA7B (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0001E000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x00032000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0001C5EB\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0001C600\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.64452\n\n.rdata:\n VirtualSize: 0x00007B2F\n VirtualAddress: 0x0001E000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x0001CA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.56431\n\n.data:\n VirtualSize: 0x0000088C\n VirtualAddress: 0x00026000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00024600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.11548\n\n.rsrc:\n VirtualSize: 0x00008DC0\n VirtualAddress: 0x00027000\n SizeOfRawData: 0x00008E00\n PointerToRawData: 0x00024C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.13509\n\n.reloc:\n VirtualSize: 0x000016DA\n VirtualAddress: 0x00030000\n SizeOfRawData: 0x00001800\n PointerToRawData: 0x0002DA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.88392"},"Imports":{"raw":"USER32.dll: GetWindowRect\n GetLastActivePopup\n GetFocus\n CallNextHookEx\n GetWindowInfo\n GetClientRect\n EnumWindows\n GetQueueStatus\n GetCapture\n GetKBCodePage\n GetOpenClipboardWindow\n GetGUIThreadInfo\n GetCursorInfo\n GetInputState\n GetWindowTextW\n GetDesktopWindow\n GetCaretPos\n GetActiveWindow\n GetCursor\n SetWindowsHookExW\n GetClipboardOwner\n GetMessageTime\n GetWindowThreadProcessId\n GetShellWindow\n GetForegroundWindow\nADVAPI32.dll: CryptReleaseContext\n CryptAcquireContextW\n AdjustTokenPrivileges\n CheckTokenMembership\n FreeSid\n AllocateAndInitializeSid\n LookupPrivilegeValueW\n OpenProcessToken\n RegSetValueExW\n RegCloseKey\n RegFlushKey\n RegDeleteValueW\n RegOpenKeyW\n RegQueryValueExW\n RegCreateKeyW\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CloseServiceHandle\n CreateServiceW\n CryptGenRandom\nPSAPI.DLL: GetProcessMemoryInfo\nmsvcrt.dll: _amsg_exit\n _initterm\n _XcptFilter\n memcpy\n memset\n wcsncpy\n malloc\n calloc\n free\n _vsnwprintf\n wcsrchr\n memmove\n wcschr\n isprint\n tolower\n isspace\n _snwprintf\n mbstowcs\n floor\n _except_handler3\nKERNEL32.dll: FindFirstVolumeW\n FindNextVolumeW\n CopyFileW\n GetFileAttributesW\n DeleteVolumeMountPointW\n TlsSetValue\n FindVolumeClose\n DeviceIoControl\n TlsFree\n TlsAlloc\n LockResource\n SizeofResource\n LoadResource\n FindResourceW\n TlsGetValue\n CreateMutexW\n DeleteFileW\n CloseHandle\n VirtualAlloc\n GetLastError\n VirtualFree\n WriteFile\n ReadFile\n CreateFileW\n GetSystemDirectoryW\n GetModuleFileNameW\n GetVersion\n GetSystemTimeAsFileTime\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n TerminateProcess\n InterlockedCompareExchange\n Sleep\n InterlockedExchange\n RtlUnwind\n GetThreadTimes\n GetCurrentProcessId\n GetCurrentThreadId\n GetOEMCP\n GlobalMemoryStatusEx\n GetProcessTimes\n GetProcessHeap\n GetCurrentThread\n GetTickCount\n QueryPerformanceCounter\n GetModuleHandleA\n VirtualLock\n GetProcAddress\n VirtualUnlock\n GetVersionExW\n LoadLibraryW\n GetCurrentProcess\n FreeLibrary\n VirtualQuery\n SetEndOfFile\n SetFilePointer\n GetFileSize\n FindNextFileW\n FindClose\n FindFirstFileW\n GlobalAddAtomW\n GetFileSizeEx"},"Exports":{"raw":"dc_add_keyfiles:\n Ordinal: 1\n Address: 0x0001CA00\n\ndc_add_password:\n Ordinal: 2\n Address: 0x0001B510\n\ndc_backup_header:\n Ordinal: 3\n Address: 0x0001ADB0\n\ndc_benchmark:\n Ordinal: 4\n Address: 0x0001A490\n\ndc_change_password:\n Ordinal: 5\n Address: 0x0001B030\n\ndc_dec_step:\n Ordinal: 6\n Address: 0x0001A6D0\n\ndc_device_control:\n Ordinal: 7\n Address: 0x0001AB90\n\ndc_disk_close:\n Ordinal: 8\n Address: 0x00016F90\n\ndc_disk_open:\n Ordinal: 9\n Address: 0x00016FB0\n\ndc_disk_read:\n Ordinal: 10\n Address: 0x00016E90\n\ndc_disk_write:\n Ordinal: 11\n Address: 0x00016D60\n\ndc_done_format:\n Ordinal: 12\n Address: 0x0001A400\n\ndc_dsk_get_size:\n Ordinal: 13\n Address: 0x000178B0\n\ndc_enc_step:\n Ordinal: 14\n Address: 0x0001A760\n\ndc_encrypt_iso_image:\n Ordinal: 15\n Address: 0x0001D010\n\ndc_extract_rsrc:\n Ordinal: 16\n Address: 0x0001C110\n\ndc_first_volume:\n Ordinal: 17\n Address: 0x0001B9B0\n\ndc_format_byte_size:\n Ordinal: 18\n Address: 0x00016B70\n\ndc_format_fs:\n Ordinal: 19\n Address: 0x000174D0\n\ndc_format_step:\n Ordinal: 20\n Address: 0x0001A630\n\ndc_get_boot_device:\n Ordinal: 21\n Address: 0x0001A970\n\ndc_get_boot_disk:\n Ordinal: 22\n Address: 0x000185B0\n\ndc_get_bsod:\n Ordinal: 23\n Address: 0x0001A3D0\n\ndc_get_cipher_name:\n Ordinal: 24\n Address: 0x00016B60\n\ndc_get_device_status:\n Ordinal: 25\n Address: 0x0001A4D0\n\ndc_get_drive_info:\n Ordinal: 26\n Address: 0x00017A20\n\ndc_get_hw_name:\n Ordinal: 27\n Address: 0x0001BF50\n\ndc_get_mbr_config:\n Ordinal: 28\n Address: 0x00018AE0\n\ndc_get_version:\n Ordinal: 29\n Address: 0x0001B890\n\ndc_install_driver:\n Ordinal: 30\n Address: 0x0001A2F0\n\ndc_is_driver_installed:\n Ordinal: 31\n Address: 0x00019D90\n\ndc_is_driver_works:\n Ordinal: 32\n Address: 0x0001A2B0\n\ndc_is_old_runned:\n Ordinal: 33\n Address: 0x0001AC10\n\ndc_load_config:\n Ordinal: 34\n Address: 0x00019CA0\n\ndc_make_iso:\n Ordinal: 35\n Address: 0x00018700\n\ndc_make_pxe:\n Ordinal: 36\n Address: 0x00018650\n\ndc_mbr_config_by_partition:\n Ordinal: 37\n Address: 0x000191D0\n\ndc_mount_all:\n Ordinal: 38\n Address: 0x0001B620\n\ndc_mount_volume:\n Ordinal: 39\n Address: 0x0001B750\n\ndc_next_volume:\n Ordinal: 40\n Address: 0x0001B910\n\ndc_open_device:\n Ordinal: 41\n Address: 0x0001AC40\n\ndc_remove_driver:\n Ordinal: 42\n Address: 0x00019E20\n\ndc_restore_header:\n Ordinal: 43\n Address: 0x0001AC80\n\ndc_save_config:\n Ordinal: 44\n Address: 0x00019BC0\n\ndc_set_boot:\n Ordinal: 45\n Address: 0x000193A0\n\ndc_set_mbr:\n Ordinal: 46\n Address: 0x00018D00\n\ndc_set_mbr_config:\n Ordinal: 47\n Address: 0x00018A60\n\ndc_start_decrypt:\n Ordinal: 48\n Address: 0x0001B160\n\ndc_start_encrypt:\n Ordinal: 49\n Address: 0x0001B3D0\n\ndc_start_format:\n Ordinal: 50\n Address: 0x0001AEF0\n\ndc_start_re_encrypt:\n Ordinal: 51\n Address: 0x0001B290\n\ndc_sync_enc_state:\n Ordinal: 52\n Address: 0x0001A5A0\n\ndc_unmount_all:\n Ordinal: 53\n Address: 0x0001BA30\n\ndc_unmount_volume:\n Ordinal: 54\n Address: 0x0001A800\n\ndc_unset_mbr:\n Ordinal: 55\n Address: 0x00018A00\n\ndc_update_boot:\n Ordinal: 56\n Address: 0x00019050\n\ndc_update_driver:\n Ordinal: 57\n Address: 0x0001A170\n\nenable_privilege:\n Ordinal: 58\n Address: 0x00017410\n\nis_admin:\n Ordinal: 59\n Address: 0x00017370\n\nis_win_vista:\n Ordinal: 60\n Address: 0x00016D10\n\nis_wow64:\n Ordinal: 61\n Address: 0x00017220\n\nload_file:\n Ordinal: 62\n Address: 0x00017270\n\nrnd_init:\n Ordinal: 63\n Address: 0x0001C690\n\nrnd_reseed_now:\n Ordinal: 64\n Address: 0x0001C480\n\nsave_file:\n Ordinal: 65\n Address: 0x00017310\n\nsecure_alloc:\n Ordinal: 66\n Address: 0x00017600\n\nsecure_free:\n Ordinal: 67\n Address: 0x00017540"},"Resources":{"raw":"139:\n Type: EXEFILE\n Language: English - United States\n Codepage: UNKNOWN\n Size: 512\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.29007\n\n140:\n Type: EXEFILE\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19653\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.24497\n\n141:\n Type: EXEFILE\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15253\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.08193\n\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 592\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.40294\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.1.846.118\n ProductVersion: 1.1.846.118\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n FileDescription: DiskCryptor api\n FileVersion (#2): 1.1.846.118\n LegalCopyright: http://diskcryptor.net/\n OriginalFilename: dcapi.dll\n ProductName: DiskCryptor\n ProductVersion (#2): 1.1\n\n\nLoad Configuration:\nSize: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x10026000\nSEHandlerTable: 0x10024840\nSEHandlerCount: 3\n\nRICH Header:\nXOR Key: 0xB0E42203\nUnmarked objects: 0\nASM objects (VS2008 SP1 build 30729): 9\nC++ objects (VS2008 SP1 build 30729): 13\nC objects (VS2008 SP1 build 30729): 60\nUnmarked objects (#2): 6\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 170\n126 (VS2012 build 50727 / VS2005 build 50727): 1\n174 (VS2010 SP1 build 40219): 17\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentControlSet\\Services\n Contains domain names:\n diskcryptor.net\n http://diskcryptor.net\n yandex.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to SHA256\n Uses constants related to SHA512\n Uses constants related to Twofish\n Microsoft's Cryptography API\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Can access the registry:\n RegSetValueExW\n RegCloseKey\n RegFlushKey\n RegDeleteValueW\n RegOpenKeyW\n RegQueryValueExW\n RegCreateKeyW\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n CryptAcquireContextW\n CryptGenRandom\n Uses functions commonly found in keyloggers:\n CallNextHookEx\n GetForegroundWindow\n Functions related to the privilege level:\n AdjustTokenPrivileges\n CheckTokenMembership\n OpenProcessToken\n Interacts with services:\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CreateServiceW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{"raw":"Size: 72\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x10026000\nSEHandlerTable: 0x10024840\nSEHandlerCount: 3"},"RICH Header":{"raw":"XOR Key: 0xB0E42203\nUnmarked objects: 0\nASM objects (VS2008 SP1 build 30729): 9\nC++ objects (VS2008 SP1 build 30729): 13\nC objects (VS2008 SP1 build 30729): 60\nUnmarked objects (#2): 6\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 170\n126 (VS2012 build 50727 / VS2005 build 50727): 1\n174 (VS2010 SP1 build 40219): 17\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentControlSet\\Services\n Contains domain names:\n diskcryptor.net\n http://diskcryptor.net\n yandex.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to SHA256\n Uses constants related to SHA512\n Uses constants related to Twofish\n Microsoft's Cryptography API\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Can access the registry:\n RegSetValueExW\n RegCloseKey\n RegFlushKey\n RegDeleteValueW\n RegOpenKeyW\n RegQueryValueExW\n RegCreateKeyW\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n CryptAcquireContextW\n CryptGenRandom\n Uses functions commonly found in keyloggers:\n CallNextHookEx\n GetForegroundWindow\n Functions related to the privilege level:\n AdjustTokenPrivileges\n CheckTokenMembership\n OpenProcessToken\n Interacts with services:\n OpenServiceW\n OpenSCManagerW\n DeleteService\n CreateServiceW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_decoded_zfgt72mj/resource_32DCAPI.DLL_105.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_zhsc4te1/output.txt"},"timestamp":"2026-07-10 02:22:44"} {"_id":{"$oid":"6a5a28f9b3bed57e0e73785f"},"sha256":"5a3938aa0350f3bf94c8f12cab8b9b0555648c20176fe9166a91240c4b27fa18","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack__04moop6/5a3938aa0350f3bf94c8f12cab8b9b0555648c20176fe9166a91240c4b27fa18-019f7022407d7281a4bab6097b364784.msi_5a3938aa0350/001_binwalk_ntuser.exe\nDate: 2026-07-17 18:37:05\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack__04moop6/5a3938aa0350f3bf94c8f12cab8b9b0555648c20176fe9166a91240c4b27fa18-019f7022407d7281a4bab6097b364784.msi_5a3938aa0350/001_binwalk_ntuser.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2026-Jul-15 08:38:40\nDetected languages: English - United States\nTLS Callbacks: 1 callback(s) detected.\nDebug artifacts: Embedded COFF debugging symbols\nFileDescription: Nvidia shim initialization dll, version 566.24. nvidia frame buffer capture library, version. nvidia display properties extension.\nInternalName: iocheck\nOriginalFilename: iocheck\nCompanyName: Mobo, mano AG\nLegalCopyright: Copyright © 2084 Mobo, mano AG\nProductName: iocheck\nFileVersion: 49.22.57.76\nProductVersion: 49.22.57\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2026-Jul-15 08:38:40\nPointerToSymbolTable: 0x001F0000\nNumberOfSymbols: 8006\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00153000\nSizeOfInitializedData: 0x00025000\nSizeOfUninitializedData: 0x00161000\nAddressOfEntryPoint: 0x002B38C0 (Section: UPX1)\nBaseOfCode: 0x00162000\nBaseOfData: 0x002B5000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x002DA000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\nUPX0:\n VirtualSize: 0x00161000\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\nUPX1:\n VirtualSize: 0x00153000\n VirtualAddress: 0x00162000\n SizeOfRawData: 0x00152600\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.9998\n\n.rsrc:\n VirtualSize: 0x00025000\n VirtualAddress: 0x002B5000\n SizeOfRawData: 0x00024E00\n PointerToRawData: 0x00152800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.9058\n\n\nImports:\n--------\napi-ms-win-core-synch-l1-2-0.dll: WaitOnAddress\nbcryptprimitives.dll: ProcessPrng\nKERNEL32.DLL: LoadLibraryA\n GetProcAddress\n VirtualProtect\nmsvcrt.dll: free\nntdll.dll: NtOpenFile\nUSERENV.dll: GetUserProfileDirectoryW\nWS2_32.dll: bind\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 625\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.5942\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 948\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.77298\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1387\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.83647\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2573\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91695\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4337\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95254\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16940\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98202\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 100356\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99445\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 700\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.73804\n\n9:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1161\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.82947\n\n10:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1886\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91817\n\n11:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 3570\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94908\n\n12:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 6106\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96799\n\n13:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 24379\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99191\n\n14:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 111447\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99826\n\n14902:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.683\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 948\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45505\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 424\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.8947\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 49.22.57.76\n ProductVersion: 49.22.57.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_APP\n Language: English - United States\n FileDescription: Nvidia shim initialization dll, version 566.24. nvidia frame buffer capture library, version. nvidia display properties extension.\n InternalName: iocheck\n OriginalFilename: iocheck\n CompanyName: Mobo, mano AG\n LegalCopyright: Copyright © 2084 Mobo, mano AG\n ProductName: iocheck\n FileVersion (#2): 49.22.57.76\n ProductVersion (#2): 49.22.57\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x102B44F8\nEndAddressOfRawData: 0x102B44FC\nAddressOfIndex: 0x101E31EC\nAddressOfCallbacks: 0x102B44FC\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x102B44C0\n\n[ SUSPICIOUS ] The PE is packed with UPX\n Unusual section name found: UPX0\n Section UPX0 is both writable and executable.\n Unusual section name found: UPX1\n Section UPX1 is both writable and executable.\n The PE only has 9 import(s).\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Leverages the raw socket API to access the Internet:\n bind\n\nThe PE's resources present abnormal characteristics.\n Resource 8 is possibly compressed or encrypted.\n Resource 9 is possibly compressed or encrypted.\n Resource 10 is possibly compressed or encrypted.\n Resource 11 is possibly compressed or encrypted.\n Resource 12 is possibly compressed or encrypted.\n Resource 13 is possibly compressed or encrypted.\n Resource 14 is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ MALICIOUS ] The program tries to mislead users about its origins.\n The PE pretends to be from Nvidia but is not signed!\n\n\n\n[!] Error: Could not read a COFF symbol.\n[!] Error: Could not read the exported DLL name.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2026-Jul-15 08:38:40\nDetected languages: English - United States\nTLS Callbacks: 1 callback(s) detected.\nDebug artifacts: Embedded COFF debugging symbols\nFileDescription: Nvidia shim initialization dll, version 566.24. nvidia frame buffer capture library, version. nvidia display properties extension.\nInternalName: iocheck\nOriginalFilename: iocheck\nCompanyName: Mobo, mano AG\nLegalCopyright: Copyright © 2084 Mobo, mano AG\nProductName: iocheck\nFileVersion: 49.22.57.76\nProductVersion: 49.22.57"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2026-Jul-15 08:38:40\nPointerToSymbolTable: 0x001F0000\nNumberOfSymbols: 8006\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00153000\nSizeOfInitializedData: 0x00025000\nSizeOfUninitializedData: 0x00161000\nAddressOfEntryPoint: 0x002B38C0 (Section: UPX1)\nBaseOfCode: 0x00162000\nBaseOfData: 0x002B5000\nImageBase: 0x10000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x002DA000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":"UPX0:\n VirtualSize: 0x00161000\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\nUPX1:\n VirtualSize: 0x00153000\n VirtualAddress: 0x00162000\n SizeOfRawData: 0x00152600\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.9998\n\n.rsrc:\n VirtualSize: 0x00025000\n VirtualAddress: 0x002B5000\n SizeOfRawData: 0x00024E00\n PointerToRawData: 0x00152800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.9058"},"Imports":{"raw":"api-ms-win-core-synch-l1-2-0.dll: WaitOnAddress\nbcryptprimitives.dll: ProcessPrng\nKERNEL32.DLL: LoadLibraryA\n GetProcAddress\n VirtualProtect\nmsvcrt.dll: free\nntdll.dll: NtOpenFile\nUSERENV.dll: GetUserProfileDirectoryW\nWS2_32.dll: bind\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 625\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.5942\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 948\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.77298\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1387\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.83647\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2573\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91695\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4337\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95254\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16940\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98202\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 100356\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99445\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 700\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.73804\n\n9:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1161\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.82947\n\n10:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1886\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91817\n\n11:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 3570\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94908\n\n12:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 6106\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96799\n\n13:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 24379\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99191\n\n14:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 111447\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99826\n\n14902:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.683\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 948\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45505\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 424\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.8947\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 49.22.57.76\n ProductVersion: 49.22.57.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_APP\n Language: English - United States\n FileDescription: Nvidia shim initialization dll, version 566.24. nvidia frame buffer capture library, version. nvidia display properties extension.\n InternalName: iocheck\n OriginalFilename: iocheck\n CompanyName: Mobo, mano AG\n LegalCopyright: Copyright © 2084 Mobo, mano AG\n ProductName: iocheck\n FileVersion (#2): 49.22.57.76\n ProductVersion (#2): 49.22.57\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x102B44F8\nEndAddressOfRawData: 0x102B44FC\nAddressOfIndex: 0x101E31EC\nAddressOfCallbacks: 0x102B44FC\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x102B44C0\n\n[ SUSPICIOUS ] The PE is packed with UPX\n Unusual section name found: UPX0\n Section UPX0 is both writable and executable.\n Unusual section name found: UPX1\n Section UPX1 is both writable and executable.\n The PE only has 9 import(s).\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Leverages the raw socket API to access the Internet:\n bind\n\nThe PE's resources present abnormal characteristics.\n Resource 8 is possibly compressed or encrypted.\n Resource 9 is possibly compressed or encrypted.\n Resource 10 is possibly compressed or encrypted.\n Resource 11 is possibly compressed or encrypted.\n Resource 12 is possibly compressed or encrypted.\n Resource 13 is possibly compressed or encrypted.\n Resource 14 is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ MALICIOUS ] The program tries to mislead users about its origins.\n The PE pretends to be from Nvidia but is not signed!\n\n\n\n[!] Error: Could not read a COFF symbol.\n[!] Error: Could not read the exported DLL name.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 625\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.5942\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 948\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.77298\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1387\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.83647\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2573\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91695\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4337\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95254\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16940\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.98202\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 100356\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99445\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 700\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.73804\n\n9:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1161\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.82947\n\n10:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1886\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91817\n\n11:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 3570\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94908\n\n12:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 6106\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.96799\n\n13:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 24379\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99191\n\n14:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 111447\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99826\n\n14902:\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 104\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.683\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 948\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.45505\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 424\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.8947\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 49.22.57.76\n ProductVersion: 49.22.57.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_APP\n Language: English - United States\n FileDescription: Nvidia shim initialization dll, version 566.24. nvidia frame buffer capture library, version. nvidia display properties extension.\n InternalName: iocheck\n OriginalFilename: iocheck\n CompanyName: Mobo, mano AG\n LegalCopyright: Copyright © 2084 Mobo, mano AG\n ProductName: iocheck\n FileVersion (#2): 49.22.57.76\n ProductVersion (#2): 49.22.57\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x102B44F8\nEndAddressOfRawData: 0x102B44FC\nAddressOfIndex: 0x101E31EC\nAddressOfCallbacks: 0x102B44FC\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x102B44C0\n\n[ SUSPICIOUS ] The PE is packed with UPX\n Unusual section name found: UPX0\n Section UPX0 is both writable and executable.\n Unusual section name found: UPX1\n Section UPX1 is both writable and executable.\n The PE only has 9 import(s).\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Leverages the raw socket API to access the Internet:\n bind\n\nThe PE's resources present abnormal characteristics.\n Resource 8 is possibly compressed or encrypted.\n Resource 9 is possibly compressed or encrypted.\n Resource 10 is possibly compressed or encrypted.\n Resource 11 is possibly compressed or encrypted.\n Resource 12 is possibly compressed or encrypted.\n Resource 13 is possibly compressed or encrypted.\n Resource 14 is possibly compressed or encrypted.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ MALICIOUS ] The program tries to mislead users about its origins.\n The PE pretends to be from Nvidia but is not signed!\n\n\n\n[!] Error: Could not read a COFF symbol.\n[!] Error: Could not read the exported DLL name.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack__04moop6/5a3938aa0350f3bf94c8f12cab8b9b0555648c20176fe9166a91240c4b27fa18-019f7022407d7281a4bab6097b364784.msi_5a3938aa0350/001_binwalk_ntuser.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_phh1ll78/output.txt"},"timestamp":"2026-07-17 18:37:05"} {"_id":{"$oid":"6a5a297eb3bed57e0e737862"},"sha256":"7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada-019f703240a17f91b79fc68a59c3e397.exe\nDate: 2026-07-17 20:08:40\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada-019f703240a17f91b79fc68a59c3e397.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2022-Nov-19 19:40:09\nDetected languages: English - United States\nDebug artifacts: C:\\Users\\ACER\\source\\repos\\salinewin\\Release\\salinewin.pdb\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000100\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 6\nTimeDateStamp: 2022-Nov-19 19:40:09\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0000EA00\nSizeOfInitializedData: 0x00038A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00003402 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00010000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x0004C000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000E8B8\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000EA00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.55386\n\n.rdata:\n VirtualSize: 0x0000E688\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x0000E800\n PointerToRawData: 0x0000EE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.42581\n\n.data:\n VirtualSize: 0x000011B8\n VirtualAddress: 0x0001F000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0001D600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.01493\n\n.gfids:\n VirtualSize: 0x000000AC\n VirtualAddress: 0x00021000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0001DE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.42969\n\n.rsrc:\n VirtualSize: 0x00027C00\n VirtualAddress: 0x00022000\n SizeOfRawData: 0x00027C00\n PointerToRawData: 0x0001E000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.07144\n\n.reloc:\n VirtualSize: 0x00001110\n VirtualAddress: 0x0004A000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00045C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.48464\n\n\nImports:\n--------\nKERNEL32.dll: DecodePointer\n WriteConsoleW\n SetFilePointerEx\n GetConsoleMode\n GetConsoleCP\n HeapReAlloc\n HeapSize\n GetProcessHeap\n GetStringTypeW\n GetFileType\n ExitProcess\n GetProcAddress\n CreateThread\n LoadLibraryW\n CloseHandle\n TerminateThread\n Sleep\n CreateFileW\n WriteFile\n FlushFileBuffers\n SetStdHandle\n LCMapStringW\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n InitializeSListHead\n IsDebuggerPresent\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetStartupInfoW\n IsProcessorFeaturePresent\n GetModuleHandleW\n GetCurrentProcess\n TerminateProcess\n RtlUnwind\n GetLastError\n SetLastError\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n FreeLibrary\n LoadLibraryExW\n GetStdHandle\n GetModuleFileNameA\n MultiByteToWideChar\n WideCharToMultiByte\n GetModuleHandleExW\n GetCommandLineA\n GetCommandLineW\n GetACP\n HeapFree\n HeapAlloc\n WaitForSingleObject\n GetExitCodeProcess\n CreateProcessA\n GetFileAttributesExW\n FindClose\n FindFirstFileExA\n FindNextFileA\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n SetEnvironmentVariableA\n CompareStringW\n RaiseException\nUSER32.dll: GetCursorPos\n ReleaseDC\n SetCursorPos\n InvalidateRect\n GetDesktopWindow\n SendMessageTimeoutW\n GetDC\n MessageBoxW\n EnumChildWindows\n GetSystemMetrics\n DrawIcon\n LoadIconW\nGDI32.dll: SelectObject\n CreateDIBSection\n CreateCompatibleDC\n PolyBezier\n DeleteDC\n CreatePen\n Ellipse\n DeleteObject\n CreateSolidBrush\n BitBlt\nWINMM.dll: waveOutOpen\n waveOutClose\n waveOutUnprepareHeader\n waveOutWrite\n waveOutPrepareHeader\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.40094\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.3014\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.19753\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21674\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99933\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 21640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.09892\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.10022\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.9102\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.06388\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 392\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.89623\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 83\n AddressOfRawData: 0x0001D67C\n PointerToRawData: 0x0001C47C\n Referenced File: C:\\Users\\ACER\\source\\repos\\salinewin\\Release\\salinewin.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x0001D6D0\n PointerToRawData: 0x0001C4D0\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 696\n AddressOfRawData: 0x0001D6E4\n PointerToRawData: 0x0001C4E4\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n\n\nLoad Configuration:\n-------------------\nSize: 92\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x0041F014\nSEHandlerTable: 0x0041D670\nSEHandlerCount: 3\n\nRICH Header:\n------------\nXOR Key: 0x181C3C34\nUnmarked objects: 0\n241 (40116): 12\n243 (40116): 131\n242 (40116): 25\nASM objects (24237): 17\nC++ objects (24237): 29\nC objects (24237): 18\nImports (VS2008 SP1 build 30729): 9\nTotal imports: 120\nC++ objects (LTCG) (24245): 1\nResource objects (24245): 1\n151: 1\nLinker (24245): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n LoadLibraryExW\n Possibly launches other programs:\n CreateProcessA\n Can take screenshots:\n GetDC\n CreateCompatibleDC\n BitBlt\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2022-Nov-19 19:40:09\nDetected languages: English - United States\nDebug artifacts: C:\\Users\\ACER\\source\\repos\\salinewin\\Release\\salinewin.pdb"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000100"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 6\nTimeDateStamp: 2022-Nov-19 19:40:09\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0000EA00\nSizeOfInitializedData: 0x00038A00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00003402 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00010000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x0004C000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000E8B8\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000EA00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.55386\n\n.rdata:\n VirtualSize: 0x0000E688\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x0000E800\n PointerToRawData: 0x0000EE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.42581\n\n.data:\n VirtualSize: 0x000011B8\n VirtualAddress: 0x0001F000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0001D600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.01493\n\n.gfids:\n VirtualSize: 0x000000AC\n VirtualAddress: 0x00021000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0001DE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.42969\n\n.rsrc:\n VirtualSize: 0x00027C00\n VirtualAddress: 0x00022000\n SizeOfRawData: 0x00027C00\n PointerToRawData: 0x0001E000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.07144\n\n.reloc:\n VirtualSize: 0x00001110\n VirtualAddress: 0x0004A000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00045C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.48464"},"Imports":{"raw":"KERNEL32.dll: DecodePointer\n WriteConsoleW\n SetFilePointerEx\n GetConsoleMode\n GetConsoleCP\n HeapReAlloc\n HeapSize\n GetProcessHeap\n GetStringTypeW\n GetFileType\n ExitProcess\n GetProcAddress\n CreateThread\n LoadLibraryW\n CloseHandle\n TerminateThread\n Sleep\n CreateFileW\n WriteFile\n FlushFileBuffers\n SetStdHandle\n LCMapStringW\n QueryPerformanceCounter\n GetCurrentProcessId\n GetCurrentThreadId\n GetSystemTimeAsFileTime\n InitializeSListHead\n IsDebuggerPresent\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetStartupInfoW\n IsProcessorFeaturePresent\n GetModuleHandleW\n GetCurrentProcess\n TerminateProcess\n RtlUnwind\n GetLastError\n SetLastError\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n FreeLibrary\n LoadLibraryExW\n GetStdHandle\n GetModuleFileNameA\n MultiByteToWideChar\n WideCharToMultiByte\n GetModuleHandleExW\n GetCommandLineA\n GetCommandLineW\n GetACP\n HeapFree\n HeapAlloc\n WaitForSingleObject\n GetExitCodeProcess\n CreateProcessA\n GetFileAttributesExW\n FindClose\n FindFirstFileExA\n FindNextFileA\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n SetEnvironmentVariableA\n CompareStringW\n RaiseException\nUSER32.dll: GetCursorPos\n ReleaseDC\n SetCursorPos\n InvalidateRect\n GetDesktopWindow\n SendMessageTimeoutW\n GetDC\n MessageBoxW\n EnumChildWindows\n GetSystemMetrics\n DrawIcon\n LoadIconW\nGDI32.dll: SelectObject\n CreateDIBSection\n CreateCompatibleDC\n PolyBezier\n DeleteDC\n CreatePen\n Ellipse\n DeleteObject\n CreateSolidBrush\n BitBlt\nWINMM.dll: waveOutOpen\n waveOutClose\n waveOutUnprepareHeader\n waveOutWrite\n waveOutPrepareHeader\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.40094\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.3014\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.19753\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21674\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99933\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 21640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.09892\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.10022\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.9102\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.06388\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 392\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.89623\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 83\n AddressOfRawData: 0x0001D67C\n PointerToRawData: 0x0001C47C\n Referenced File: C:\\Users\\ACER\\source\\repos\\salinewin\\Release\\salinewin.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x0001D6D0\n PointerToRawData: 0x0001C4D0\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 696\n AddressOfRawData: 0x0001D6E4\n PointerToRawData: 0x0001C4E4\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n\n\nLoad Configuration:\nSize: 92\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x0041F014\nSEHandlerTable: 0x0041D670\nSEHandlerCount: 3\n\nRICH Header:\nXOR Key: 0x181C3C34\nUnmarked objects: 0\n241 (40116): 12\n243 (40116): 131\n242 (40116): 25\nASM objects (24237): 17\nC++ objects (24237): 29\nC objects (24237): 18\nImports (VS2008 SP1 build 30729): 9\nTotal imports: 120\nC++ objects (LTCG) (24245): 1\nResource objects (24245): 1\n151: 1\nLinker (24245): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n LoadLibraryExW\n Possibly launches other programs:\n CreateProcessA\n Can take screenshots:\n GetDC\n CreateCompatibleDC\n BitBlt\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.40094\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.3014\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.19753\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21674\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.99933\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 21640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.09892\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.10022\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.9102\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.06388\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 392\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.89623"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 83\n AddressOfRawData: 0x0001D67C\n PointerToRawData: 0x0001C47C\n Referenced File: C:\\Users\\ACER\\source\\repos\\salinewin\\Release\\salinewin.pdb\n\nIMAGE_DEBUG_TYPE_VC_FEATURE:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 20\n AddressOfRawData: 0x0001D6D0\n PointerToRawData: 0x0001C4D0\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 696\n AddressOfRawData: 0x0001D6E4\n PointerToRawData: 0x0001C4E4\n\nIMAGE_DEBUG_TYPE_ILTCG:\n Characteristics: 0\n TimeDateStamp: 2022-Nov-19 19:40:09\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x00000000"},"Load Configuration":{"raw":"Size: 92\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x0041F014\nSEHandlerTable: 0x0041D670\nSEHandlerCount: 3"},"RICH Header":{"raw":"XOR Key: 0x181C3C34\nUnmarked objects: 0\n241 (40116): 12\n243 (40116): 131\n242 (40116): 25\nASM objects (24237): 17\nC++ objects (24237): 29\nC objects (24237): 18\nImports (VS2008 SP1 build 30729): 9\nTotal imports: 120\nC++ objects (LTCG) (24245): 1\nResource objects (24245): 1\n151: 1\nLinker (24245): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Miscellaneous malware strings:\n cmd.exe\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n LoadLibraryExW\n Possibly launches other programs:\n CreateProcessA\n Can take screenshots:\n GetDC\n CreateCompatibleDC\n BitBlt\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (3 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada-019f703240a17f91b79fc68a59c3e397.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_4qibshuu/output.txt"},"timestamp":"2026-07-17 20:08:40"} {"_id":{"$oid":"6a5a2b7bb3bed57e0e737865"},"sha256":"40b2b086397a96608915013652e16e3dd9437e71763925dd8324656138648e46","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/com.google.Chrome-019f703016587100a4a695a71555c2ee.exe\nDate: 2026-07-17 18:47:47\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/com.google.Chrome-019f703016587100a4a695a71555c2ee.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-Jan-18 13:31:55\nComments: \nCompanyName: Amazon.com\nFileDescription: SAC tool\nFileVersion: 1.0.0.0\nInternalName: SAC tool.exe\nLegalCopyright: Copyright © Amazon.com 2024\nLegalTrademarks: \nOriginalFilename: SAC tool.exe\nProductName: SAC tool\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2024-Jan-18 13:31:55\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00008200\nSizeOfInitializedData: 0x00000800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000A11A (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x0000C000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00010000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00016CD3\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00008120\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00008200\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.12193\n\n.rsrc:\n VirtualSize: 0x00000598\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00008400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.38028\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00008A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0815394\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 836\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27744\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 436\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.94168\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: Amazon.com\n FileDescription: SAC tool\n FileVersion (#2): 1.0.0.0\n InternalName: SAC tool.exe\n LegalCopyright: Copyright © Amazon.com 2024\n LegalTrademarks: \n OriginalFilename: SAC tool.exe\n ProductName: SAC tool\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\nInteresting strings found in the binary:\n Contains domain names:\n Amazon.com\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: \\xE6\\x9D\\xAD\\xE5\\xB7\\x9E\\xE6\\x80\\x9D\\xE7\\xBB\\xB4\\xE5\\xAE\\x87\\xE5\\xAE\\x99\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\n Issuer: Certum Extended Validation Code Signing 2021 CA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-Jan-18 13:31:55\nComments: \nCompanyName: Amazon.com\nFileDescription: SAC tool\nFileVersion: 1.0.0.0\nInternalName: SAC tool.exe\nLegalCopyright: Copyright © Amazon.com 2024\nLegalTrademarks: \nOriginalFilename: SAC tool.exe\nProductName: SAC tool\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2024-Jan-18 13:31:55\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00008200\nSizeOfInitializedData: 0x00000800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000A11A (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x0000C000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00010000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00016CD3\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00008120\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00008200\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.12193\n\n.rsrc:\n VirtualSize: 0x00000598\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00008400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.38028\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00008A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0815394"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 836\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27744\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 436\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.94168\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: Amazon.com\n FileDescription: SAC tool\n FileVersion (#2): 1.0.0.0\n InternalName: SAC tool.exe\n LegalCopyright: Copyright © Amazon.com 2024\n LegalTrademarks: \n OriginalFilename: SAC tool.exe\n ProductName: SAC tool\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\nInteresting strings found in the binary:\n Contains domain names:\n Amazon.com\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: \\xE6\\x9D\\xAD\\xE5\\xB7\\x9E\\xE6\\x80\\x9D\\xE7\\xBB\\xB4\\xE5\\xAE\\x87\\xE5\\xAE\\x99\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\n Issuer: Certum Extended Validation Code Signing 2021 CA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 836\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27744\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 436\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.94168\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: Amazon.com\n FileDescription: SAC tool\n FileVersion (#2): 1.0.0.0\n InternalName: SAC tool.exe\n LegalCopyright: Copyright © Amazon.com 2024\n LegalTrademarks: \n OriginalFilename: SAC tool.exe\n ProductName: SAC tool\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n .NET executable -> Microsoft\n\nInteresting strings found in the binary:\n Contains domain names:\n Amazon.com\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: \\xE6\\x9D\\xAD\\xE5\\xB7\\x9E\\xE6\\x80\\x9D\\xE7\\xBB\\xB4\\xE5\\xAE\\x87\\xE5\\xAE\\x99\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\n Issuer: Certum Extended Validation Code Signing 2021 CA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{"raw":"Contains domain names:\n Amazon.com\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: \\xE6\\x9D\\xAD\\xE5\\xB7\\x9E\\xE6\\x80\\x9D\\xE7\\xBB\\xB4\\xE5\\xAE\\x87\\xE5\\xAE\\x99\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8\n Issuer: Certum Extended Validation Code Signing 2021 CA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/com.google.Chrome-019f703016587100a4a695a71555c2ee.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_d56rhy_y/output.txt"},"timestamp":"2026-07-17 18:47:47"} {"_id":{"$oid":"6a5a3a1bb3bed57e0e737869"},"sha256":"33d74b754a992eedc1eb2a0758fd6dfe0e29208b72147fb5c613d66640de086e","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_decoded_tczw9d13/zlib_offset_0x58c18_6.bin\nDate: 2026-07-17 19:50:11\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_decoded_tczw9d13/zlib_offset_0x58c18_6.bin\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2034-Mar-11 17:01:05\nDetected languages: English - United States\nDebug artifacts: D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\\\vcruntime140.amd64.pdb\nCompanyName: Microsoft Corporation\nFileDescription: Microsoft® C Runtime Library\nFileVersion: 14.42.34226.3\nInternalName: vcruntime140.dll\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: vcruntime140.dll\nProductName: Microsoft® Visual Studio®\nProductVersion: 14.42.34226.3\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 8\nTimeDateStamp: 2034-Mar-11 17:01:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00012400\nSizeOfInitializedData: 0x00006400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000000F690 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: A.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0001E000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00021582\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00011290\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00011400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.47088\n\nfothk:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00011800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0159202\n\n.rdata:\n VirtualSize: 0x0000438C\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00004400\n PointerToRawData: 0x00012800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.67773\n\n.data:\n VirtualSize: 0x000009A0\n VirtualAddress: 0x00019000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00016C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.54017\n\n.pdata:\n VirtualSize: 0x00000BDC\n VirtualAddress: 0x0001A000\n SizeOfRawData: 0x00000C00\n PointerToRawData: 0x00017000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.84705\n\n_RDATA:\n VirtualSize: 0x000001F8\n VirtualAddress: 0x0001B000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00017C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.04989\n\n.rsrc:\n VirtualSize: 0x000003D0\n VirtualAddress: 0x0001C000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00017E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.22893\n\n.reloc:\n VirtualSize: 0x000002E0\n VirtualAddress: 0x0001D000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00018200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.81812\n\n\nImports:\n--------\napi-ms-win-crt-runtime-l1-1-0.dll: terminate\n abort\napi-ms-win-crt-heap-l1-1-0.dll: calloc\n malloc\n free\napi-ms-win-crt-string-l1-1-0.dll: strcpy_s\n strncmp\n wcsncmp\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vsprintf\n __stdio_common_vsprintf_s\napi-ms-win-crt-convert-l1-1-0.dll: atol\nKERNEL32.dll: SetLastError\n IsProcessorFeaturePresent\n TerminateProcess\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlCaptureContext\n GetSystemTimeAsFileTime\n GetCurrentThreadId\n GetCurrentProcessId\n QueryPerformanceCounter\n RtlLookupFunctionEntry\n RtlUnwindEx\n RtlUnwind\n GetModuleHandleW\n EncodePointer\n RaiseException\n RtlPcToFileHeader\n InterlockedPushEntrySList\n InterlockedFlushSList\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n GetLastError\n LoadLibraryExW\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n FreeLibrary\n GetProcAddress\n GetModuleFileNameW\n\nExports:\n--------\n_CreateFrameInfo:\n Ordinal: 1\n Address: 0x0000F3D0\n\n_CxxThrowException:\n Ordinal: 2\n Address: 0x000051D0\n\n_FindAndUnlinkFrame:\n Ordinal: 3\n Address: 0x0000F410\n\n_IsExceptionObjectToBeDestroyed:\n Ordinal: 4\n Address: 0x00001080\n\n_SetWinRTOutOfMemoryExceptionCallback:\n Ordinal: 5\n Address: 0x000010B0\n\n__AdjustPointer:\n Ordinal: 6\n Address: 0x000010C0\n\n__BuildCatchObject:\n Ordinal: 7\n Address: 0x00004270\n\n__BuildCatchObjectHelper:\n Ordinal: 8\n Address: 0x00004280\n\n__C_specific_handler:\n Ordinal: 9\n Address: 0x0000E720\n\n__C_specific_handler_noexcept:\n Ordinal: 10\n Address: 0x0000E4D0\n\n__CxxDetectRethrow:\n Ordinal: 11\n Address: 0x000042A0\n\n__CxxExceptionFilter:\n Ordinal: 12\n Address: 0x000042F0\n\n__CxxFrameHandler:\n Ordinal: 13\n Address: 0x0000F4C0\n\n__CxxFrameHandler2:\n Ordinal: 14\n Address: 0x0000F4C0\n\n__CxxFrameHandler3:\n Ordinal: 15\n Address: 0x0000F4D0\n\n__CxxQueryExceptionSize:\n Ordinal: 16\n Address: 0x000044E0\n\n__CxxRegisterExceptionObject:\n Ordinal: 17\n Address: 0x000044F0\n\n__CxxUnregisterExceptionObject:\n Ordinal: 18\n Address: 0x000045A0\n\n__DestructExceptionObject:\n Ordinal: 19\n Address: 0x00001000\n\n__FrameUnwindFilter:\n Ordinal: 20\n Address: 0x000010F0\n\n__GetPlatformExceptionInfo:\n Ordinal: 21\n Address: 0x00001160\n\n__NLG_Dispatch2:\n Ordinal: 22\n Address: 0x0000F850\n\n__NLG_Return2:\n Ordinal: 23\n Address: 0x0000F860\n\n__RTCastToVoid:\n Ordinal: 24\n Address: 0x00004CB0\n\n__RTDynamicCast:\n Ordinal: 25\n Address: 0x00004D10\n\n__RTtypeid:\n Ordinal: 26\n Address: 0x00004E80\n\n__TypeMatch:\n Ordinal: 27\n Address: 0x00004290\n\n__current_exception:\n Ordinal: 28\n Address: 0x000011C0\n\n__current_exception_context:\n Ordinal: 29\n Address: 0x000011E0\n\n__intrinsic_setjmp:\n Ordinal: 30\n Address: 0x000110D0\n\n__intrinsic_setjmpex:\n Ordinal: 31\n Address: 0x00011170\n\n__processing_throw:\n Ordinal: 32\n Address: 0x00001200\n\n__report_gsfailure:\n Ordinal: 33\n Address: 0x00010E40\n\n__std_exception_copy:\n Ordinal: 34\n Address: 0x00004F30\n\n__std_exception_destroy:\n Ordinal: 35\n Address: 0x00004FC0\n\n__std_terminate:\n Ordinal: 36\n Address: 0x00001220\n\n__std_type_info_compare:\n Ordinal: 37\n Address: 0x00005010\n\n__std_type_info_destroy_list:\n Ordinal: 38\n Address: 0x00005040\n\n__std_type_info_hash:\n Ordinal: 39\n Address: 0x00005070\n\n__std_type_info_name:\n Ordinal: 40\n Address: 0x000050B0\n\n__telemetry_main_invoke_trigger:\n Ordinal: 41\n Address: 0x00005A00\n\n__telemetry_main_return_trigger:\n Ordinal: 42\n Address: 0x00005A00\n\n__unDName:\n Ordinal: 43\n Address: 0x0000DB30\n\n__unDNameEx:\n Ordinal: 44\n Address: 0x0000DB60\n\n__uncaught_exception:\n Ordinal: 45\n Address: 0x00005280\n\n__uncaught_exceptions:\n Ordinal: 46\n Address: 0x000052A0\n\n__vcrt_GetModuleFileNameW:\n Ordinal: 47\n Address: 0x00005990\n\n__vcrt_GetModuleHandleW:\n Ordinal: 48\n Address: 0x000059A0\n\n__vcrt_InitializeCriticalSectionEx:\n Ordinal: 49\n Address: 0x00005920\n\n__vcrt_LoadLibraryExW:\n Ordinal: 50\n Address: 0x000059B0\n\n_get_purecall_handler:\n Ordinal: 51\n Address: 0x000059C0\n\n_get_unexpected:\n Ordinal: 52\n Address: 0x000052C0\n\n_is_exception_typeof:\n Ordinal: 53\n Address: 0x00001230\n\n_local_unwind:\n Ordinal: 54\n Address: 0x0000DDB0\n\n_purecall:\n Ordinal: 55\n Address: 0x000059D0\n\n_set_purecall_handler:\n Ordinal: 56\n Address: 0x000059F0\n\n_set_se_translator:\n Ordinal: 57\n Address: 0x00005340\n\nlongjmp:\n Ordinal: 58\n Address: 0x0000DD80\n\nmemchr:\n Ordinal: 59\n Address: 0x00011250\n\nmemcmp:\n Ordinal: 60\n Address: 0x000112F0\n\nmemcpy:\n Ordinal: 61\n Address: 0x00013010\n\nmemmove:\n Ordinal: 62\n Address: 0x000113F0\n\nmemset:\n Ordinal: 63\n Address: 0x00011A90\n\nset_unexpected:\n Ordinal: 64\n Address: 0x000052F0\n\nstrchr:\n Ordinal: 65\n Address: 0x0000DDE0\n\nstrrchr:\n Ordinal: 66\n Address: 0x0000DE60\n\nstrstr:\n Ordinal: 67\n Address: 0x0000DFA0\n\nunexpected:\n Ordinal: 68\n Address: 0x00005320\n\nwcschr:\n Ordinal: 69\n Address: 0x0000E190\n\nwcsrchr:\n Ordinal: 70\n Address: 0x0000E210\n\nwcsstr:\n Ordinal: 71\n Address: 0x0000E2C0\n\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 876\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49051\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 14.42.34226.3\n ProductVersion: 14.42.34226.3\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Microsoft® C Runtime Library\n FileVersion (#2): 14.42.34226.3\n InternalName: vcruntime140.dll\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: vcruntime140.dll\n ProductName: Microsoft® Visual Studio®\n ProductVersion (#2): 14.42.34226.3\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 91\n AddressOfRawData: 0x000166C4\n PointerToRawData: 0x00014EC4\n Referenced File: D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\\\vcruntime140.amd64.pdb\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 560\n AddressOfRawData: 0x00016720\n PointerToRawData: 0x00014F20\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 36\n AddressOfRawData: 0x00016978\n PointerToRawData: 0x00015178\n\nUNKNOWN (#2):\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 4\n AddressOfRawData: 0x0001699C\n PointerToRawData: 0x0001519C\n\n\nLoad Configuration:\n-------------------\nSize: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180019040\nGuardCFCheckFunctionPointer: 0x0000000180014198\nGuardCFDispatchFunctionPointer: 0x0000000000000000\nGuardCFFunctionTable: 0x0000000000000000\nGuardCFFunctionCount: 0x0000000000000000\nGuardFlags: (EMPTY)\nCodeIntegrity.Flags: 0x0000\nCodeIntegrity.Catalog: 0x0000\nCodeIntegrity.CatalogOffset: 0x00000000\nCodeIntegrity.Reserved: 0x00000000\nGuardAddressTakenIatEntryTable: 0x0000000000000000\nGuardAddressTakenIatEntryCount: 0\nGuardLongJumpTargetTable: 0x0000000000000000\nGuardLongJumpTargetCount: 0\n\nRICH Header:\n------------\nXOR Key: 0xE3805C18\nUnmarked objects: 0\nImports (30795): 2\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 45\nUnmarked objects (#2): 1\nC objects (33923): 16\nC++ objects (33923): 31\nASM objects (33923): 21\nExports (33923): 1\nResource objects (33923): 1\nLinker (33923): 1\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: fothk\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: enabled\n\nThe PE is digitally signed.\n Signer: Microsoft Windows Software Compatibility Publisher\n Issuer: Microsoft Windows Third Party Component CA 2013\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2034-Mar-11 17:01:05\nDetected languages: English - United States\nDebug artifacts: D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\\\vcruntime140.amd64.pdb\nCompanyName: Microsoft Corporation\nFileDescription: Microsoft® C Runtime Library\nFileVersion: 14.42.34226.3\nInternalName: vcruntime140.dll\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: vcruntime140.dll\nProductName: Microsoft® Visual Studio®\nProductVersion: 14.42.34226.3"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 8\nTimeDateStamp: 2034-Mar-11 17:01:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00012400\nSizeOfInitializedData: 0x00006400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000000F690 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: A.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0001E000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00021582\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00011290\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00011400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.47088\n\nfothk:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00011800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0159202\n\n.rdata:\n VirtualSize: 0x0000438C\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00004400\n PointerToRawData: 0x00012800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.67773\n\n.data:\n VirtualSize: 0x000009A0\n VirtualAddress: 0x00019000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00016C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.54017\n\n.pdata:\n VirtualSize: 0x00000BDC\n VirtualAddress: 0x0001A000\n SizeOfRawData: 0x00000C00\n PointerToRawData: 0x00017000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.84705\n\n_RDATA:\n VirtualSize: 0x000001F8\n VirtualAddress: 0x0001B000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00017C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.04989\n\n.rsrc:\n VirtualSize: 0x000003D0\n VirtualAddress: 0x0001C000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00017E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.22893\n\n.reloc:\n VirtualSize: 0x000002E0\n VirtualAddress: 0x0001D000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00018200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.81812"},"Imports":{"raw":"api-ms-win-crt-runtime-l1-1-0.dll: terminate\n abort\napi-ms-win-crt-heap-l1-1-0.dll: calloc\n malloc\n free\napi-ms-win-crt-string-l1-1-0.dll: strcpy_s\n strncmp\n wcsncmp\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vsprintf\n __stdio_common_vsprintf_s\napi-ms-win-crt-convert-l1-1-0.dll: atol\nKERNEL32.dll: SetLastError\n IsProcessorFeaturePresent\n TerminateProcess\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlCaptureContext\n GetSystemTimeAsFileTime\n GetCurrentThreadId\n GetCurrentProcessId\n QueryPerformanceCounter\n RtlLookupFunctionEntry\n RtlUnwindEx\n RtlUnwind\n GetModuleHandleW\n EncodePointer\n RaiseException\n RtlPcToFileHeader\n InterlockedPushEntrySList\n InterlockedFlushSList\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n GetLastError\n LoadLibraryExW\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n FreeLibrary\n GetProcAddress\n GetModuleFileNameW"},"Exports":{"raw":"_CreateFrameInfo:\n Ordinal: 1\n Address: 0x0000F3D0\n\n_CxxThrowException:\n Ordinal: 2\n Address: 0x000051D0\n\n_FindAndUnlinkFrame:\n Ordinal: 3\n Address: 0x0000F410\n\n_IsExceptionObjectToBeDestroyed:\n Ordinal: 4\n Address: 0x00001080\n\n_SetWinRTOutOfMemoryExceptionCallback:\n Ordinal: 5\n Address: 0x000010B0\n\n__AdjustPointer:\n Ordinal: 6\n Address: 0x000010C0\n\n__BuildCatchObject:\n Ordinal: 7\n Address: 0x00004270\n\n__BuildCatchObjectHelper:\n Ordinal: 8\n Address: 0x00004280\n\n__C_specific_handler:\n Ordinal: 9\n Address: 0x0000E720\n\n__C_specific_handler_noexcept:\n Ordinal: 10\n Address: 0x0000E4D0\n\n__CxxDetectRethrow:\n Ordinal: 11\n Address: 0x000042A0\n\n__CxxExceptionFilter:\n Ordinal: 12\n Address: 0x000042F0\n\n__CxxFrameHandler:\n Ordinal: 13\n Address: 0x0000F4C0\n\n__CxxFrameHandler2:\n Ordinal: 14\n Address: 0x0000F4C0\n\n__CxxFrameHandler3:\n Ordinal: 15\n Address: 0x0000F4D0\n\n__CxxQueryExceptionSize:\n Ordinal: 16\n Address: 0x000044E0\n\n__CxxRegisterExceptionObject:\n Ordinal: 17\n Address: 0x000044F0\n\n__CxxUnregisterExceptionObject:\n Ordinal: 18\n Address: 0x000045A0\n\n__DestructExceptionObject:\n Ordinal: 19\n Address: 0x00001000\n\n__FrameUnwindFilter:\n Ordinal: 20\n Address: 0x000010F0\n\n__GetPlatformExceptionInfo:\n Ordinal: 21\n Address: 0x00001160\n\n__NLG_Dispatch2:\n Ordinal: 22\n Address: 0x0000F850\n\n__NLG_Return2:\n Ordinal: 23\n Address: 0x0000F860\n\n__RTCastToVoid:\n Ordinal: 24\n Address: 0x00004CB0\n\n__RTDynamicCast:\n Ordinal: 25\n Address: 0x00004D10\n\n__RTtypeid:\n Ordinal: 26\n Address: 0x00004E80\n\n__TypeMatch:\n Ordinal: 27\n Address: 0x00004290\n\n__current_exception:\n Ordinal: 28\n Address: 0x000011C0\n\n__current_exception_context:\n Ordinal: 29\n Address: 0x000011E0\n\n__intrinsic_setjmp:\n Ordinal: 30\n Address: 0x000110D0\n\n__intrinsic_setjmpex:\n Ordinal: 31\n Address: 0x00011170\n\n__processing_throw:\n Ordinal: 32\n Address: 0x00001200\n\n__report_gsfailure:\n Ordinal: 33\n Address: 0x00010E40\n\n__std_exception_copy:\n Ordinal: 34\n Address: 0x00004F30\n\n__std_exception_destroy:\n Ordinal: 35\n Address: 0x00004FC0\n\n__std_terminate:\n Ordinal: 36\n Address: 0x00001220\n\n__std_type_info_compare:\n Ordinal: 37\n Address: 0x00005010\n\n__std_type_info_destroy_list:\n Ordinal: 38\n Address: 0x00005040\n\n__std_type_info_hash:\n Ordinal: 39\n Address: 0x00005070\n\n__std_type_info_name:\n Ordinal: 40\n Address: 0x000050B0\n\n__telemetry_main_invoke_trigger:\n Ordinal: 41\n Address: 0x00005A00\n\n__telemetry_main_return_trigger:\n Ordinal: 42\n Address: 0x00005A00\n\n__unDName:\n Ordinal: 43\n Address: 0x0000DB30\n\n__unDNameEx:\n Ordinal: 44\n Address: 0x0000DB60\n\n__uncaught_exception:\n Ordinal: 45\n Address: 0x00005280\n\n__uncaught_exceptions:\n Ordinal: 46\n Address: 0x000052A0\n\n__vcrt_GetModuleFileNameW:\n Ordinal: 47\n Address: 0x00005990\n\n__vcrt_GetModuleHandleW:\n Ordinal: 48\n Address: 0x000059A0\n\n__vcrt_InitializeCriticalSectionEx:\n Ordinal: 49\n Address: 0x00005920\n\n__vcrt_LoadLibraryExW:\n Ordinal: 50\n Address: 0x000059B0\n\n_get_purecall_handler:\n Ordinal: 51\n Address: 0x000059C0\n\n_get_unexpected:\n Ordinal: 52\n Address: 0x000052C0\n\n_is_exception_typeof:\n Ordinal: 53\n Address: 0x00001230\n\n_local_unwind:\n Ordinal: 54\n Address: 0x0000DDB0\n\n_purecall:\n Ordinal: 55\n Address: 0x000059D0\n\n_set_purecall_handler:\n Ordinal: 56\n Address: 0x000059F0\n\n_set_se_translator:\n Ordinal: 57\n Address: 0x00005340\n\nlongjmp:\n Ordinal: 58\n Address: 0x0000DD80\n\nmemchr:\n Ordinal: 59\n Address: 0x00011250\n\nmemcmp:\n Ordinal: 60\n Address: 0x000112F0\n\nmemcpy:\n Ordinal: 61\n Address: 0x00013010\n\nmemmove:\n Ordinal: 62\n Address: 0x000113F0\n\nmemset:\n Ordinal: 63\n Address: 0x00011A90\n\nset_unexpected:\n Ordinal: 64\n Address: 0x000052F0\n\nstrchr:\n Ordinal: 65\n Address: 0x0000DDE0\n\nstrrchr:\n Ordinal: 66\n Address: 0x0000DE60\n\nstrstr:\n Ordinal: 67\n Address: 0x0000DFA0\n\nunexpected:\n Ordinal: 68\n Address: 0x00005320\n\nwcschr:\n Ordinal: 69\n Address: 0x0000E190\n\nwcsrchr:\n Ordinal: 70\n Address: 0x0000E210\n\nwcsstr:\n Ordinal: 71\n Address: 0x0000E2C0"},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 876\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49051\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 14.42.34226.3\n ProductVersion: 14.42.34226.3\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Microsoft® C Runtime Library\n FileVersion (#2): 14.42.34226.3\n InternalName: vcruntime140.dll\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: vcruntime140.dll\n ProductName: Microsoft® Visual Studio®\n ProductVersion (#2): 14.42.34226.3"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 91\n AddressOfRawData: 0x000166C4\n PointerToRawData: 0x00014EC4\n Referenced File: D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\\\vcruntime140.amd64.pdb\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 560\n AddressOfRawData: 0x00016720\n PointerToRawData: 0x00014F20\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 36\n AddressOfRawData: 0x00016978\n PointerToRawData: 0x00015178\n\nUNKNOWN (#2):\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 4\n AddressOfRawData: 0x0001699C\n PointerToRawData: 0x0001519C"},"Load Configuration":{"raw":"Size: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180019040\nGuardCFCheckFunctionPointer: 0x0000000180014198\nGuardCFDispatchFunctionPointer: 0x0000000000000000\nGuardCFFunctionTable: 0x0000000000000000\nGuardCFFunctionCount: 0x0000000000000000\nGuardFlags: (EMPTY)\nCodeIntegrity.Flags: 0x0000\nCodeIntegrity.Catalog: 0x0000\nCodeIntegrity.CatalogOffset: 0x00000000\nCodeIntegrity.Reserved: 0x00000000\nGuardAddressTakenIatEntryTable: 0x0000000000000000\nGuardAddressTakenIatEntryCount: 0\nGuardLongJumpTargetTable: 0x0000000000000000\nGuardLongJumpTargetCount: 0"},"RICH Header":{"raw":"XOR Key: 0xE3805C18\nUnmarked objects: 0\nImports (30795): 2\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 45\nUnmarked objects (#2): 1\nC objects (33923): 16\nC++ objects (33923): 31\nASM objects (33923): 21\nExports (33923): 1\nResource objects (33923): 1\nLinker (33923): 1\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: fothk\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: enabled\n\nThe PE is digitally signed.\n Signer: Microsoft Windows Software Compatibility Publisher\n Issuer: Microsoft Windows Third Party Component CA 2013\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_decoded_tczw9d13/zlib_offset_0x58c18_6.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_yzd9ms6p/output.txt"},"timestamp":"2026-07-17 19:50:11"} {"_id":{"$oid":"6a5a3d91b3bed57e0e73786b"},"sha256":"93759d6cfbfdd0d5018f197461a25ac2361bc57c6d8eea5e3ee044bb146f071a","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/93759d6cfbfdd0d5018f197461a25ac2361bc57c6d8eea5e3ee044bb146f071a-019f7031eea97001b5694560606f6706.exe\nDate: 2026-07-17 20:04:57\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/93759d6cfbfdd0d5018f197461a25ac2361bc57c6d8eea5e3ee044bb146f071a-019f7031eea97001b5694560606f6706.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2089-Aug-19 18:58:16\nComments: \nCompanyName: \nFileDescription: Phantom\nFileVersion: 1.0.0.0\nInternalName: stub.exe\nLegalCopyright: Copyright © Old phantom 2022\nLegalTrademarks: \nOriginalFilename: stub.exe\nProductName: Phantom\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 2\nTimeDateStamp: 2089-Aug-19 18:58:16\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 48.0\nSizeOfCode: 0x00706800\nSizeOfInitializedData: 0x00001200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000000000 (Section: ?)\nBaseOfCode: 0x00002000\nImageBase: 0x0000000000400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0070C000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000400000\nSizeofStackCommit: 0x0000000000004000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000002000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x007067E4\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00706800\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.98639\n\n.rsrc:\n VirtualSize: 0x000011FC\n VirtualAddress: 0x0070A000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00706A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.07133\n\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25318\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3643\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.01396\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: Phantom\n FileVersion (#2): 1.0.0.0\n InternalName: stub.exe\n LegalCopyright: Copyright © Old phantom 2022\n LegalTrademarks: \n OriginalFilename: stub.exe\n ProductName: Phantom\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nDebug Info:\n-----------\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 1970-Jan-01 00:00:00\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x007069E4\n\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n Tries to detect virtualized environments:\n HARDWARE\\Description\\System\n Looks for VMWare presence:\n VMware\n vmicheartbeat\n vmicshutdown\n vmicvss\n May have dropper capabilities:\n CurrentVersion\\Run\n Accesses the WMI:\n root\\CIMV2\n root\\Security\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n Battle.net\n costura.system.net\n example.com\n https://t.me\n https://www.phantomsoftwares.site\n https://www.phantomsoftwares.site/home\n https://www.phantomsoftwares.site/logo/phantom_discord.png\n system.net\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 0 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2089-Aug-19 18:58:16\nComments: \nCompanyName: \nFileDescription: Phantom\nFileVersion: 1.0.0.0\nInternalName: stub.exe\nLegalCopyright: Copyright © Old phantom 2022\nLegalTrademarks: \nOriginalFilename: stub.exe\nProductName: Phantom\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 2\nTimeDateStamp: 2089-Aug-19 18:58:16\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 48.0\nSizeOfCode: 0x00706800\nSizeOfInitializedData: 0x00001200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000000000 (Section: ?)\nBaseOfCode: 0x00002000\nImageBase: 0x0000000000400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0070C000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000400000\nSizeofStackCommit: 0x0000000000004000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000002000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x007067E4\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00706800\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.98639\n\n.rsrc:\n VirtualSize: 0x000011FC\n VirtualAddress: 0x0070A000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00706A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.07133\n\n\nResources:\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25318\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3643\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.01396\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: Phantom\n FileVersion (#2): 1.0.0.0\n InternalName: stub.exe\n LegalCopyright: Copyright © Old phantom 2022\n LegalTrademarks: \n OriginalFilename: stub.exe\n ProductName: Phantom\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nDebug Info:\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 1970-Jan-01 00:00:00\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x007069E4\n\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n Tries to detect virtualized environments:\n HARDWARE\\Description\\System\n Looks for VMWare presence:\n VMware\n vmicheartbeat\n vmicshutdown\n vmicvss\n May have dropper capabilities:\n CurrentVersion\\Run\n Accesses the WMI:\n root\\CIMV2\n root\\Security\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n Battle.net\n costura.system.net\n example.com\n https://t.me\n https://www.phantomsoftwares.site\n https://www.phantomsoftwares.site/home\n https://www.phantomsoftwares.site/logo/phantom_discord.png\n system.net\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 0 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Imports":{},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25318\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 3643\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.01396\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: Phantom\n FileVersion (#2): 1.0.0.0\n InternalName: stub.exe\n LegalCopyright: Copyright © Old phantom 2022\n LegalTrademarks: \n OriginalFilename: stub.exe\n ProductName: Phantom\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0"},"Debug Info":{"raw":"UNKNOWN:\n Characteristics: 0\n TimeDateStamp: 1970-Jan-01 00:00:00\n Version: 0.0\n SizeofData: 0\n AddressOfRawData: 0x00000000\n PointerToRawData: 0x007069E4\n\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n Tries to detect virtualized environments:\n HARDWARE\\Description\\System\n Looks for VMWare presence:\n VMware\n vmicheartbeat\n vmicshutdown\n vmicvss\n May have dropper capabilities:\n CurrentVersion\\Run\n Accesses the WMI:\n root\\CIMV2\n root\\Security\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n Battle.net\n costura.system.net\n example.com\n https://t.me\n https://www.phantomsoftwares.site\n https://www.phantomsoftwares.site/home\n https://www.phantomsoftwares.site/logo/phantom_discord.png\n system.net\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 0 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/93759d6cfbfdd0d5018f197461a25ac2361bc57c6d8eea5e3ee044bb146f071a-019f7031eea97001b5694560606f6706.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_cbqm3ntq/output.txt"},"timestamp":"2026-07-17 20:04:57"} {"_id":{"$oid":"6a5a401db3bed57e0e73786d"},"sha256":"54c8c1fa5c44506bb1feb7c8657ef6b761b0e1d1e4a8dbe2b52eea5a89296562","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/54c8c1fa5c44506bb1feb7c8657ef6b761b0e1d1e4a8dbe2b52eea5a89296562-019f7057928a7bc29354572b9a052788.exe\nDate: 2026-07-17 20:15:49\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/54c8c1fa5c44506bb1feb7c8657ef6b761b0e1d1e4a8dbe2b52eea5a89296562-019f7057928a7bc29354572b9a052788.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 1970-Jan-01 00:00:00\nDetected languages: English - United States\nDebug artifacts: Embedded COFF debugging symbols\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x008B\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 9\nTimeDateStamp: 1970-Jan-01 00:00:00\nPointerToSymbolTable: 0x00270A00\nNumberOfSymbols: 2965\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 3.0\nSizeOfCode: 0x00107E00\nSizeOfInitializedData: 0x00011200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000075880 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.1\nImageVersion: 1.0\nSubsystemVersion: 6.1\nWin32VersionValue: 0\nSizeOfImage: 0x002E5000\nSizeOfHeaders: 0x00000600\nChecksum: 0x0029A816\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000200000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00107D71\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00107E00\n PointerToRawData: 0x00000600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.16796\n\n.rdata:\n VirtualSize: 0x0014C460\n VirtualAddress: 0x00109000\n SizeOfRawData: 0x0014C600\n PointerToRawData: 0x00108400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.0189\n\n.data:\n VirtualSize: 0x0005A688\n VirtualAddress: 0x00256000\n SizeOfRawData: 0x00011200\n PointerToRawData: 0x00254A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.2051\n\n.pdata:\n VirtualSize: 0x00005AFC\n VirtualAddress: 0x002B1000\n SizeOfRawData: 0x00005C00\n PointerToRawData: 0x00265C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.26472\n\n.xdata:\n VirtualSize: 0x000000B4\n VirtualAddress: 0x002B7000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0026B800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.78321\n\n.idata:\n VirtualSize: 0x0000053E\n VirtualAddress: 0x002B8000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0026BA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.00932\n\n.reloc:\n VirtualSize: 0x000048F4\n VirtualAddress: 0x002B9000\n SizeOfRawData: 0x00004A00\n PointerToRawData: 0x0026C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.42535\n\n.symtab:\n VirtualSize: 0x00021479\n VirtualAddress: 0x002BE000\n SizeOfRawData: 0x00021600\n PointerToRawData: 0x00270A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.12414\n\n.rsrc:\n VirtualSize: 0x000048DC\n VirtualAddress: 0x002E0000\n SizeOfRawData: 0x00004A00\n PointerToRawData: 0x00292000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.83511\n\n\nImports:\n--------\nkernel32.dll: WriteFile\n WriteConsoleW\n WerSetFlags\n WerGetFlags\n WaitForMultipleObjects\n WaitForSingleObject\n VirtualQuery\n VirtualFree\n VirtualAlloc\n TlsAlloc\n SwitchToThread\n SuspendThread\n SetWaitableTimer\n SetProcessPriorityBoost\n SetEvent\n SetErrorMode\n SetConsoleCtrlHandler\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n ResumeThread\n RaiseFailFastException\n PostQueuedCompletionStatus\n LoadLibraryW\n LoadLibraryExW\n SetThreadContext\n GetThreadContext\n GetSystemInfo\n GetSystemDirectoryA\n GetStdHandle\n GetQueuedCompletionStatusEx\n GetProcessAffinityMask\n GetProcAddress\n GetErrorMode\n GetEnvironmentStringsW\n GetCurrentThreadId\n GetConsoleMode\n FreeEnvironmentStringsW\n ExitProcess\n DuplicateHandle\n CreateWaitableTimerExW\n CreateThread\n CreateIoCompletionPort\n CreateEventA\n CloseHandle\n AddVectoredExceptionHandler\n AddVectoredContinueHandler\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 557\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.44772\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1115\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.8011\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1611\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.82659\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2176\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.87352\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.90749\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 8479\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91569\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50265\n Detected Filetype: Icon file\n\n\n[ SUSPICIOUS ] PEiD Signature:\n HQR data file\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .xdata\n Unusual section name found: .symtab\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryW\n LoadLibraryExW\n GetProcAddress\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: ceo.me\n Issuer: ceo.me\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 1970-Jan-01 00:00:00\nDetected languages: English - United States\nDebug artifacts: Embedded COFF debugging symbols"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x008B\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 9\nTimeDateStamp: 1970-Jan-01 00:00:00\nPointerToSymbolTable: 0x00270A00\nNumberOfSymbols: 2965\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 3.0\nSizeOfCode: 0x00107E00\nSizeOfInitializedData: 0x00011200\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000075880 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.1\nImageVersion: 1.0\nSubsystemVersion: 6.1\nWin32VersionValue: 0\nSizeOfImage: 0x002E5000\nSizeOfHeaders: 0x00000600\nChecksum: 0x0029A816\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000200000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00107D71\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00107E00\n PointerToRawData: 0x00000600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.16796\n\n.rdata:\n VirtualSize: 0x0014C460\n VirtualAddress: 0x00109000\n SizeOfRawData: 0x0014C600\n PointerToRawData: 0x00108400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.0189\n\n.data:\n VirtualSize: 0x0005A688\n VirtualAddress: 0x00256000\n SizeOfRawData: 0x00011200\n PointerToRawData: 0x00254A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.2051\n\n.pdata:\n VirtualSize: 0x00005AFC\n VirtualAddress: 0x002B1000\n SizeOfRawData: 0x00005C00\n PointerToRawData: 0x00265C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.26472\n\n.xdata:\n VirtualSize: 0x000000B4\n VirtualAddress: 0x002B7000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0026B800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 1.78321\n\n.idata:\n VirtualSize: 0x0000053E\n VirtualAddress: 0x002B8000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x0026BA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.00932\n\n.reloc:\n VirtualSize: 0x000048F4\n VirtualAddress: 0x002B9000\n SizeOfRawData: 0x00004A00\n PointerToRawData: 0x0026C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.42535\n\n.symtab:\n VirtualSize: 0x00021479\n VirtualAddress: 0x002BE000\n SizeOfRawData: 0x00021600\n PointerToRawData: 0x00270A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 5.12414\n\n.rsrc:\n VirtualSize: 0x000048DC\n VirtualAddress: 0x002E0000\n SizeOfRawData: 0x00004A00\n PointerToRawData: 0x00292000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.83511"},"Imports":{"raw":"kernel32.dll: WriteFile\n WriteConsoleW\n WerSetFlags\n WerGetFlags\n WaitForMultipleObjects\n WaitForSingleObject\n VirtualQuery\n VirtualFree\n VirtualAlloc\n TlsAlloc\n SwitchToThread\n SuspendThread\n SetWaitableTimer\n SetProcessPriorityBoost\n SetEvent\n SetErrorMode\n SetConsoleCtrlHandler\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n ResumeThread\n RaiseFailFastException\n PostQueuedCompletionStatus\n LoadLibraryW\n LoadLibraryExW\n SetThreadContext\n GetThreadContext\n GetSystemInfo\n GetSystemDirectoryA\n GetStdHandle\n GetQueuedCompletionStatusEx\n GetProcessAffinityMask\n GetProcAddress\n GetErrorMode\n GetEnvironmentStringsW\n GetCurrentThreadId\n GetConsoleMode\n FreeEnvironmentStringsW\n ExitProcess\n DuplicateHandle\n CreateWaitableTimerExW\n CreateThread\n CreateIoCompletionPort\n CreateEventA\n CloseHandle\n AddVectoredExceptionHandler\n AddVectoredContinueHandler\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 557\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.44772\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1115\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.8011\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1611\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.82659\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2176\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.87352\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.90749\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 8479\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91569\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50265\n Detected Filetype: Icon file\n\n\n[ SUSPICIOUS ] PEiD Signature:\n HQR data file\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .xdata\n Unusual section name found: .symtab\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryW\n LoadLibraryExW\n GetProcAddress\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: ceo.me\n Issuer: ceo.me\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 557\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.44772\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1115\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.8011\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1611\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.82659\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2176\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.87352\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4214\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.90749\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 8479\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.91569\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50265\n Detected Filetype: Icon file\n\n\n[ SUSPICIOUS ] PEiD Signature:\n HQR data file\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: .xdata\n Unusual section name found: .symtab\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n [!] The program may be hiding some of its imports:\n LoadLibraryW\n LoadLibraryExW\n GetProcAddress\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: ceo.me\n Issuer: ceo.me\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/54c8c1fa5c44506bb1feb7c8657ef6b761b0e1d1e4a8dbe2b52eea5a89296562-019f7057928a7bc29354572b9a052788.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_v1gk8nlt/output.txt"},"timestamp":"2026-07-17 20:15:49"} {"_id":{"$oid":"6a5a419ab3bed57e0e737870"},"sha256":"ccdc3e99b62d1b0b4b86a74896c1c1a45ee9a43bba9264fad162eb0116c49033","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/ccdc3e99b62d1b0b4b86a74896c1c1a45ee9a43bba9264fad162eb0116c49033-019f7059ab947ff1b8cbf407d223a0d8.exe\nDate: 2026-07-17 20:22:10\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/ccdc3e99b62d1b0b4b86a74896c1c1a45ee9a43bba9264fad162eb0116c49033-019f7059ab947ff1b8cbf407d223a0d8.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jul-16 22:11:35\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000108\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2026-Jul-16 22:11:35\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 2.0\nSizeOfCode: 0x000D9A00\nSizeOfInitializedData: 0x000D5C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000D62C0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x001F4000\nSizeOfHeaders: 0x00000400\nChecksum: 0x001BEBA3\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000180000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000D9998\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x000D9A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.60169\n\n.rdata:\n VirtualSize: 0x000C8688\n VirtualAddress: 0x000DB000\n SizeOfRawData: 0x000C8800\n PointerToRawData: 0x000D9E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.43007\n\n.data:\n VirtualSize: 0x000418D0\n VirtualAddress: 0x001A4000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x001A2600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.26899\n\n.pdata:\n VirtualSize: 0x0000B718\n VirtualAddress: 0x001E6000\n SizeOfRawData: 0x0000B800\n PointerToRawData: 0x001A3800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.02734\n\n.rsrc:\n VirtualSize: 0x00000244\n VirtualAddress: 0x001F2000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x001AF000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.99156\n\n.reloc:\n VirtualSize: 0x000004A4\n VirtualAddress: 0x001F3000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x001AF400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.72399\n\n\nImports:\n--------\nADVAPI32.dll: DeregisterEventSource\n RegCloseKey\n RegCreateKeyExW\n RegSetValueExW\n RegisterEventSourceW\n ReportEventW\n OpenProcessToken\n AdjustTokenPrivileges\n LookupPrivilegeValueW\nbcrypt.dll: BCryptGenRandom\nKERNEL32.dll: EncodePointer\n FlsFree\n CloseHandle\n CreateDirectoryW\n CreateEventExW\n CreateFileW\n CreateProcessW\n CreateThread\n DuplicateHandle\n FindClose\n FindFirstFileW\n FindNextFileW\n FormatMessageW\n FreeLibrary\n GetCPInfo\n GetConsoleOutputCP\n GetCurrentProcess\n GetCurrentProcessorNumberEx\n GetCurrentThread\n GetEnvironmentVariableW\n GetFileAttributesW\n GetFileSize\n GetLastError\n GetModuleFileNameW\n GetModuleHandleA\n GetProcAddress\n GetStdHandle\n GetSystemDirectoryW\n GetThreadPriority\n GetTickCount64\n IsDebuggerPresent\n LoadLibraryA\n LoadLibraryExW\n LocalAlloc\n LocalFree\n MultiByteToWideChar\n QueryPerformanceCounter\n QueryPerformanceFrequency\n RaiseFailFastException\n ReadFile\n ResumeThread\n SetEvent\n SetLastError\n SetThreadErrorMode\n SetThreadPriority\n Sleep\n VirtualAlloc\n VirtualFree\n WaitForMultipleObjectsEx\n WaitForSingleObject\n WideCharToMultiByte\n WriteFile\n FlushProcessWriteBuffers\n WaitForSingleObjectEx\n AddVectoredExceptionHandler\n GetModuleHandleW\n RtlVirtualUnwind\n RtlCaptureContext\n RtlRestoreContext\n VerSetConditionMask\n FlsAlloc\n FlsGetValue\n FlsSetValue\n CreateEventW\n SwitchToThread\n GetCurrentThreadId\n SuspendThread\n GetThreadContext\n SetThreadContext\n FlushInstructionCache\n VirtualProtect\n CreateMemoryResourceNotification\n QueryInformationJobObject\n GetModuleHandleExW\n GetProcessAffinityMask\n VerifyVersionInfoW\n InitializeContext\n GetEnabledXStateFeatures\n LocateXStateFeature\n SetXStateFeaturesMask\n VirtualQuery\n GetSystemTimeAsFileTime\n DeleteCriticalSection\n EnterCriticalSection\n InitializeCriticalSectionEx\n LeaveCriticalSection\n ResetEvent\n SleepEx\n DebugBreak\n InitializeCriticalSection\n GetCurrentProcessId\n GlobalMemoryStatusEx\n GetSystemInfo\n GetLogicalProcessorInformation\n GetLogicalProcessorInformationEx\n GetLargePageMinimum\n VirtualUnlock\n VirtualAllocExNuma\n IsProcessInJob\n GetNumaHighestNodeNumber\n GetProcessGroupAffinity\n K32GetProcessMemoryInfo\n RaiseException\n RtlPcToFileHeader\n RtlUnwindEx\n SetUnhandledExceptionFilter\n InitializeSListHead\nole32.dll: CoInitializeEx\n CoGetApartmentType\n CoWaitForMultipleHandles\n CoTaskMemFree\n CoUninitialize\napi-ms-win-crt-math-l1-1-0.dll: __setusermatherr\n ceil\napi-ms-win-crt-string-l1-1-0.dll: _stricmp\n strlen\n strcpy_s\n strcmp\napi-ms-win-crt-convert-l1-1-0.dll: strtoull\nVCRUNTIME140.dll: _purecall\n memcpy\n memset\n memmove\napi-ms-win-crt-runtime-l1-1-0.dll: _seh_filter_exe\n _set_app_type\n _crt_atexit\n terminate\n _configure_wide_argv\n _initialize_wide_environment\n _get_initial_wide_environment\n _initterm\n _initterm_e\n exit\n _exit\n _register_onexit_function\n __p___argc\n __p___wargv\n _cexit\n _c_exit\n _register_thread_local_exe_atexit_callback\n abort\n _initialize_onexit_table\napi-ms-win-crt-stdio-l1-1-0.dll: _set_fmode\n __p__commode\napi-ms-win-crt-locale-l1-1-0.dll: _configthreadlocale\napi-ms-win-crt-heap-l1-1-0.dll: _callnewh\n _set_new_mode\n calloc\n free\n malloc\n\nResources:\n----------\n1:\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x000000014018A1E0\nEndAddressOfRawData: 0x000000014018A2F8\nAddressOfIndex: 0x00000001401AFF5C\nAddressOfCallbacks: 0x00000001400DB610\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_16BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\n-------------------\nSize: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x00000001401A4EC0\n\nInteresting strings found in the binary:\n Contains domain names:\n https://aka.ms\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to RC5 or RC6\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n Can access the registry:\n RegCloseKey\n RegCreateKeyExW\n RegSetValueExW\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jul-16 22:11:35"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000108"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2026-Jul-16 22:11:35\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 2.0\nSizeOfCode: 0x000D9A00\nSizeOfInitializedData: 0x000D5C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000D62C0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x001F4000\nSizeOfHeaders: 0x00000400\nChecksum: 0x001BEBA3\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000180000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000D9998\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x000D9A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.60169\n\n.rdata:\n VirtualSize: 0x000C8688\n VirtualAddress: 0x000DB000\n SizeOfRawData: 0x000C8800\n PointerToRawData: 0x000D9E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.43007\n\n.data:\n VirtualSize: 0x000418D0\n VirtualAddress: 0x001A4000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x001A2600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.26899\n\n.pdata:\n VirtualSize: 0x0000B718\n VirtualAddress: 0x001E6000\n SizeOfRawData: 0x0000B800\n PointerToRawData: 0x001A3800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.02734\n\n.rsrc:\n VirtualSize: 0x00000244\n VirtualAddress: 0x001F2000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x001AF000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.99156\n\n.reloc:\n VirtualSize: 0x000004A4\n VirtualAddress: 0x001F3000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x001AF400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.72399"},"Imports":{"raw":"ADVAPI32.dll: DeregisterEventSource\n RegCloseKey\n RegCreateKeyExW\n RegSetValueExW\n RegisterEventSourceW\n ReportEventW\n OpenProcessToken\n AdjustTokenPrivileges\n LookupPrivilegeValueW\nbcrypt.dll: BCryptGenRandom\nKERNEL32.dll: EncodePointer\n FlsFree\n CloseHandle\n CreateDirectoryW\n CreateEventExW\n CreateFileW\n CreateProcessW\n CreateThread\n DuplicateHandle\n FindClose\n FindFirstFileW\n FindNextFileW\n FormatMessageW\n FreeLibrary\n GetCPInfo\n GetConsoleOutputCP\n GetCurrentProcess\n GetCurrentProcessorNumberEx\n GetCurrentThread\n GetEnvironmentVariableW\n GetFileAttributesW\n GetFileSize\n GetLastError\n GetModuleFileNameW\n GetModuleHandleA\n GetProcAddress\n GetStdHandle\n GetSystemDirectoryW\n GetThreadPriority\n GetTickCount64\n IsDebuggerPresent\n LoadLibraryA\n LoadLibraryExW\n LocalAlloc\n LocalFree\n MultiByteToWideChar\n QueryPerformanceCounter\n QueryPerformanceFrequency\n RaiseFailFastException\n ReadFile\n ResumeThread\n SetEvent\n SetLastError\n SetThreadErrorMode\n SetThreadPriority\n Sleep\n VirtualAlloc\n VirtualFree\n WaitForMultipleObjectsEx\n WaitForSingleObject\n WideCharToMultiByte\n WriteFile\n FlushProcessWriteBuffers\n WaitForSingleObjectEx\n AddVectoredExceptionHandler\n GetModuleHandleW\n RtlVirtualUnwind\n RtlCaptureContext\n RtlRestoreContext\n VerSetConditionMask\n FlsAlloc\n FlsGetValue\n FlsSetValue\n CreateEventW\n SwitchToThread\n GetCurrentThreadId\n SuspendThread\n GetThreadContext\n SetThreadContext\n FlushInstructionCache\n VirtualProtect\n CreateMemoryResourceNotification\n QueryInformationJobObject\n GetModuleHandleExW\n GetProcessAffinityMask\n VerifyVersionInfoW\n InitializeContext\n GetEnabledXStateFeatures\n LocateXStateFeature\n SetXStateFeaturesMask\n VirtualQuery\n GetSystemTimeAsFileTime\n DeleteCriticalSection\n EnterCriticalSection\n InitializeCriticalSectionEx\n LeaveCriticalSection\n ResetEvent\n SleepEx\n DebugBreak\n InitializeCriticalSection\n GetCurrentProcessId\n GlobalMemoryStatusEx\n GetSystemInfo\n GetLogicalProcessorInformation\n GetLogicalProcessorInformationEx\n GetLargePageMinimum\n VirtualUnlock\n VirtualAllocExNuma\n IsProcessInJob\n GetNumaHighestNodeNumber\n GetProcessGroupAffinity\n K32GetProcessMemoryInfo\n RaiseException\n RtlPcToFileHeader\n RtlUnwindEx\n SetUnhandledExceptionFilter\n InitializeSListHead\nole32.dll: CoInitializeEx\n CoGetApartmentType\n CoWaitForMultipleHandles\n CoTaskMemFree\n CoUninitialize\napi-ms-win-crt-math-l1-1-0.dll: __setusermatherr\n ceil\napi-ms-win-crt-string-l1-1-0.dll: _stricmp\n strlen\n strcpy_s\n strcmp\napi-ms-win-crt-convert-l1-1-0.dll: strtoull\nVCRUNTIME140.dll: _purecall\n memcpy\n memset\n memmove\napi-ms-win-crt-runtime-l1-1-0.dll: _seh_filter_exe\n _set_app_type\n _crt_atexit\n terminate\n _configure_wide_argv\n _initialize_wide_environment\n _get_initial_wide_environment\n _initterm\n _initterm_e\n exit\n _exit\n _register_onexit_function\n __p___argc\n __p___wargv\n _cexit\n _c_exit\n _register_thread_local_exe_atexit_callback\n abort\n _initialize_onexit_table\napi-ms-win-crt-stdio-l1-1-0.dll: _set_fmode\n __p__commode\napi-ms-win-crt-locale-l1-1-0.dll: _configthreadlocale\napi-ms-win-crt-heap-l1-1-0.dll: _callnewh\n _set_new_mode\n calloc\n free\n malloc\n\nResources:\n1:\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x000000014018A1E0\nEndAddressOfRawData: 0x000000014018A2F8\nAddressOfIndex: 0x00000001401AFF5C\nAddressOfCallbacks: 0x00000001400DB610\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_16BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\nSize: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x00000001401A4EC0\n\nInteresting strings found in the binary:\n Contains domain names:\n https://aka.ms\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to RC5 or RC6\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n Can access the registry:\n RegCloseKey\n RegCreateKeyExW\n RegSetValueExW\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x000000014018A1E0\nEndAddressOfRawData: 0x000000014018A2F8\nAddressOfIndex: 0x00000001401AFF5C\nAddressOfCallbacks: 0x00000001400DB610\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_16BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\nSize: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x00000001401A4EC0\n\nInteresting strings found in the binary:\n Contains domain names:\n https://aka.ms\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to RC5 or RC6\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n Can access the registry:\n RegCloseKey\n RegCreateKeyExW\n RegSetValueExW\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{"raw":"Size: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x00000001401A4EC0\n\nInteresting strings found in the binary:\n Contains domain names:\n https://aka.ms\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to RC5 or RC6\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n Can access the registry:\n RegCloseKey\n RegCreateKeyExW\n RegSetValueExW\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"RICH Header":{},"Interesting strings found in the binary":{"raw":"Contains domain names:\n https://aka.ms\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to RC5 or RC6\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryA\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n SwitchToThread\n Can access the registry:\n RegCloseKey\n RegCreateKeyExW\n RegSetValueExW\n Possibly launches other programs:\n CreateProcessW\n Memory manipulation functions often used by packers:\n VirtualAlloc\n VirtualProtect\n Functions related to the privilege level:\n OpenProcessToken\n AdjustTokenPrivileges\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"file_path":"/home/apogean/projects/malware/windows/all_runs/ccdc3e99b62d1b0b4b86a74896c1c1a45ee9a43bba9264fad162eb0116c49033-019f7059ab947ff1b8cbf407d223a0d8.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_m_oxapux/output.txt"},"timestamp":"2026-07-17 20:22:10"} {"_id":{"$oid":"6a5b46a2b3bed57e0e737874"},"sha256":"282ed357bde9bd0910eae7c7f373f2657989dd67adb44efd713f8d35eac003a3","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Lf4hTq89oy-019f748179807fa0927ba9e5bbce012a.exe\nDate: 2026-07-18 14:55:54\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Lf4hTq89oy-019f748179807fa0927ba9e5bbce012a.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-May-05 03:46:59\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000120\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 10\nTimeDateStamp: 2026-May-05 03:46:59\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x00250C00\nSizeOfInitializedData: 0x0015F800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00802268 (Section: .boot)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00252000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00A95000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0044B96C\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n :\n VirtualSize: 0x00250B64\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00123604\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.98802\n\n (#2):\n VirtualSize: 0x00078410\n VirtualAddress: 0x00252000\n SizeOfRawData: 0x00025C58\n PointerToRawData: 0x00123C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.97041\n\n (#3):\n VirtualSize: 0x000CC940\n VirtualAddress: 0x002CB000\n SizeOfRawData: 0x00055E08\n PointerToRawData: 0x00149A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.98687\n\n (#4):\n VirtualSize: 0x00000080\n VirtualAddress: 0x00398000\n SizeOfRawData: 0x00000006\n PointerToRawData: 0x0019FA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.58496\n\n (#5):\n VirtualSize: 0x0001A554\n VirtualAddress: 0x00399000\n SizeOfRawData: 0x00010342\n PointerToRawData: 0x0019FC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 7.976\n\n.imports:\n VirtualSize: 0x00001000\n VirtualAddress: 0x003B4000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x001B0000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.95658\n\n.tls:\n VirtualSize: 0x00001000\n VirtualAddress: 0x003B5000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x001B0400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.315443\n\n.themida:\n VirtualSize: 0x0044C000\n VirtualAddress: 0x003B6000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x001B0600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.boot:\n VirtualSize: 0x00291800\n VirtualAddress: 0x00802000\n SizeOfRawData: 0x00291800\n PointerToRawData: 0x001B0600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.95354\n\n.reloc:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00A94000\n SizeOfRawData: 0x00000010\n PointerToRawData: 0x00441E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n Entropy: 2.6494\n\n\nImports:\n--------\nkernel32.dll: GetModuleHandleA\nUSER32.dll: SendMessageA\nGDI32.dll: GetCurrentObject\nADVAPI32.dll: CryptReleaseContext\nSHELL32.dll: CommandLineToArgvW\nole32.dll: CoInitializeSecurity\nOLEAUT32.dll: SafeArrayDestroy\nSHLWAPI.dll: PathFindFileNameW\nCRYPT32.dll: CertOpenStore\nWS2_32.dll: setsockopt\nbcrypt.dll: BCryptGenRandom\nUSERENV.dll: DestroyEnvironmentBlock\nktmw32.dll: RollbackTransaction\nRstrtMgr.DLL: RmStartSession\nSecur32.dll: GetUserNameExW\ncredui.dll: CredUIPromptForWindowsCredentialsW\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x007B5000\nEndAddressOfRawData: 0x007B5030\nAddressOfIndex: 0x007B5030\nAddressOfCallbacks: 0x007B5038\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_8BYTES\nCallbacks: (EMPTY)\n\nRICH Header:\n------------\nXOR Key: 0x171B4E0F\nUnmarked objects: 0\nASM objects (33145): 19\nC++ objects (33145): 207\n253 (28518): 7\nC++ objects (30034): 105\nC objects (30034): 24\nASM objects (30034): 31\nUnmarked objects (#2): 44\nC++ objects (30154): 104\nC objects (30154): 170\nC objects (33145): 31\nC objects (CVTCIL) (33145): 2\nImports (33145): 37\nTotal imports: 569\nC++ objects (LTCG) (30154): 378\nLinker (30154): 1\n\n[ SUSPICIOUS ] PEiD Signature:\n PeStubOEP v1.x\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .imports\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n Leverages the raw socket API to access the Internet:\n setsockopt\n Interacts with the certificate store:\n CertOpenStore\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-May-05 03:46:59"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000120"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 10\nTimeDateStamp: 2026-May-05 03:46:59\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x00250C00\nSizeOfInitializedData: 0x0015F800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00802268 (Section: .boot)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00252000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00A95000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0044B96C\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":":\n VirtualSize: 0x00250B64\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00123604\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.98802\n\n (#2):\n VirtualSize: 0x00078410\n VirtualAddress: 0x00252000\n SizeOfRawData: 0x00025C58\n PointerToRawData: 0x00123C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.97041\n\n (#3):\n VirtualSize: 0x000CC940\n VirtualAddress: 0x002CB000\n SizeOfRawData: 0x00055E08\n PointerToRawData: 0x00149A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.98687\n\n (#4):\n VirtualSize: 0x00000080\n VirtualAddress: 0x00398000\n SizeOfRawData: 0x00000006\n PointerToRawData: 0x0019FA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.58496\n\n (#5):\n VirtualSize: 0x0001A554\n VirtualAddress: 0x00399000\n SizeOfRawData: 0x00010342\n PointerToRawData: 0x0019FC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 7.976\n\n.imports:\n VirtualSize: 0x00001000\n VirtualAddress: 0x003B4000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x001B0000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.95658\n\n.tls:\n VirtualSize: 0x00001000\n VirtualAddress: 0x003B5000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x001B0400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.315443\n\n.themida:\n VirtualSize: 0x0044C000\n VirtualAddress: 0x003B6000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x001B0600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.boot:\n VirtualSize: 0x00291800\n VirtualAddress: 0x00802000\n SizeOfRawData: 0x00291800\n PointerToRawData: 0x001B0600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.95354\n\n.reloc:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00A94000\n SizeOfRawData: 0x00000010\n PointerToRawData: 0x00441E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n Entropy: 2.6494"},"Imports":{"raw":"kernel32.dll: GetModuleHandleA\nUSER32.dll: SendMessageA\nGDI32.dll: GetCurrentObject\nADVAPI32.dll: CryptReleaseContext\nSHELL32.dll: CommandLineToArgvW\nole32.dll: CoInitializeSecurity\nOLEAUT32.dll: SafeArrayDestroy\nSHLWAPI.dll: PathFindFileNameW\nCRYPT32.dll: CertOpenStore\nWS2_32.dll: setsockopt\nbcrypt.dll: BCryptGenRandom\nUSERENV.dll: DestroyEnvironmentBlock\nktmw32.dll: RollbackTransaction\nRstrtMgr.DLL: RmStartSession\nSecur32.dll: GetUserNameExW\ncredui.dll: CredUIPromptForWindowsCredentialsW\n\nTLS Callbacks:\nStartAddressOfRawData: 0x007B5000\nEndAddressOfRawData: 0x007B5030\nAddressOfIndex: 0x007B5030\nAddressOfCallbacks: 0x007B5038\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_8BYTES\nCallbacks: (EMPTY)\n\nRICH Header:\nXOR Key: 0x171B4E0F\nUnmarked objects: 0\nASM objects (33145): 19\nC++ objects (33145): 207\n253 (28518): 7\nC++ objects (30034): 105\nC objects (30034): 24\nASM objects (30034): 31\nUnmarked objects (#2): 44\nC++ objects (30154): 104\nC objects (30154): 170\nC objects (33145): 31\nC objects (CVTCIL) (33145): 2\nImports (33145): 37\nTotal imports: 569\nC++ objects (LTCG) (30154): 378\nLinker (30154): 1\n\n[ SUSPICIOUS ] PEiD Signature:\n PeStubOEP v1.x\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .imports\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n Leverages the raw socket API to access the Internet:\n setsockopt\n Interacts with the certificate store:\n CertOpenStore\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x171B4E0F\nUnmarked objects: 0\nASM objects (33145): 19\nC++ objects (33145): 207\n253 (28518): 7\nC++ objects (30034): 105\nC objects (30034): 24\nASM objects (30034): 31\nUnmarked objects (#2): 44\nC++ objects (30154): 104\nC objects (30154): 170\nC objects (33145): 31\nC objects (CVTCIL) (33145): 2\nImports (33145): 37\nTotal imports: 569\nC++ objects (LTCG) (30154): 378\nLinker (30154): 1\n\n[ SUSPICIOUS ] PEiD Signature:\n PeStubOEP v1.x\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .imports\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Microsoft's cryptographic API:\n CryptReleaseContext\n Leverages the raw socket API to access the Internet:\n setsockopt\n Interacts with the certificate store:\n CertOpenStore\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Lf4hTq89oy-019f748179807fa0927ba9e5bbce012a.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_87cv59vu/output.txt"},"timestamp":"2026-07-18 14:55:54"} {"_id":{"$oid":"6a5b542fb3bed57e0e737878"},"sha256":"59325c2ad72a1cea4c72822ff917f128909ad0d149d404585fcfcf8b46368c69","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/ZKm9GeoUlo-019f74acd1537701bc8d0496bbb37230.exe\nDate: 2026-07-18 15:53:43\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/ZKm9GeoUlo-019f74acd1537701bc8d0496bbb37230.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jul-02 10:44:55\nDetected languages: English - United States\nCompanyName: Google Inc.\nFileTitle: chrome.exe\nFileDescription: Google Chrome\nFileVersion: 80,8,3537,410\nLegalCopyright: Copyright 2017 Google Inc. All rights reserved.\nLegalTrademark: \nProductName: Google Chrome\nProductVersion: 80,8,3537,410\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0078\ne_cp: 0x0001\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0x0000\ne_ss: 0x0000\ne_sp: 0x0000\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000078\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 14\nTimeDateStamp: 2026-Jul-02 10:44:55\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00011000\nSizeOfInitializedData: 0x00700C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000C94210 (Section: .boot)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00F98000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0086E08A\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n :\n VirtualSize: 0x00010F66\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00006F5C\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.95673\n\n (#2):\n VirtualSize: 0x00002A9C\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00001342\n PointerToRawData: 0x00007400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.92933\n\n (#3):\n VirtualSize: 0x006FEE10\n VirtualAddress: 0x00015000\n SizeOfRawData: 0x005501BA\n PointerToRawData: 0x00008800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.86493\n\n (#4):\n VirtualSize: 0x00000198\n VirtualAddress: 0x00714000\n SizeOfRawData: 0x0000010A\n PointerToRawData: 0x00558A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.85258\n\n (#5):\n VirtualSize: 0x00000010\n VirtualAddress: 0x00715000\n SizeOfRawData: 0x00000010\n PointerToRawData: 0x00558C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4\n\n (#6):\n VirtualSize: 0x00000010\n VirtualAddress: 0x00716000\n SizeOfRawData: 0x00000006\n PointerToRawData: 0x00558E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.58496\n\n (#7):\n VirtualSize: 0x00000350\n VirtualAddress: 0x00717000\n SizeOfRawData: 0x0000016F\n PointerToRawData: 0x00559000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.25272\n\n (#8):\n VirtualSize: 0x00000078\n VirtualAddress: 0x00718000\n SizeOfRawData: 0x00000069\n PointerToRawData: 0x00559200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.06159\n\n.imports:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00719000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00559400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.27377\n\n.tls:\n VirtualSize: 0x00001000\n VirtualAddress: 0x0071A000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00559600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.333346\n\n.rsrc:\n VirtualSize: 0x00001000\n VirtualAddress: 0x0071B000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00559800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.86738\n\n.themida:\n VirtualSize: 0x00578000\n VirtualAddress: 0x0071C000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00559C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.boot:\n VirtualSize: 0x00302800\n VirtualAddress: 0x00C94000\n SizeOfRawData: 0x00302800\n PointerToRawData: 0x00559C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.96441\n\n.reloc:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00F97000\n SizeOfRawData: 0x00000010\n PointerToRawData: 0x0085C400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n Entropy: 2.54879\n\n\nImports:\n--------\nkernel32.dll: GetModuleHandleA\nmsvcrt.dll: __C_specific_handler\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46053\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 80.8.3537.410\n ProductVersion: 80.8.3537.410\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n CompanyName: Google Inc.\n FileTitle: chrome.exe\n FileDescription: Google Chrome\n FileVersion (#2): 80,8,3537,410\n LegalCopyright: Copyright 2017 Google Inc. All rights reserved.\n LegalTrademark: \n ProductName: Google Chrome\n ProductVersion (#2): 80,8,3537,410\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x000000014071A000\nEndAddressOfRawData: 0x000000014071A008\nAddressOfIndex: 0x000000014071A008\nAddressOfCallbacks: 0x000000014071A010\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_8BYTES\nCallbacks: (EMPTY)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n Contains domain names:\n cacerts.digicert.com\n crl3.digicert.com\n crl4.digicert.com\n digicert.com\n http://cacerts.digicert.com\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E\n http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C\n http://crl3.digicert.com\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\n http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0\n http://crl3.digicert.com/DigiCertTrustedRootG4.crl0\n http://crl4.digicert.com\n http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\n http://ocsp.digicert.com0\n http://ocsp.digicert.com0A\n http://ocsp.digicert.com0C\n http://ocsp.digicert.com0X\n http://ocsp.digicert.com0\\\n http://www.digicert.com\n http://www.digicert.com/CPS0\n www.digicert.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA256\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .imports\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n The PE only has 2 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 18824 bytes of data starting at offset 0x85c410.\n\n[ MALICIOUS ] The program tries to mislead users about its origins.\n The PE pretends to be from Google but is not signed!\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jul-02 10:44:55\nDetected languages: English - United States\nCompanyName: Google Inc.\nFileTitle: chrome.exe\nFileDescription: Google Chrome\nFileVersion: 80,8,3537,410\nLegalCopyright: Copyright 2017 Google Inc. All rights reserved.\nLegalTrademark: \nProductName: Google Chrome\nProductVersion: 80,8,3537,410"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0078\ne_cp: 0x0001\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0x0000\ne_ss: 0x0000\ne_sp: 0x0000\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000078"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 14\nTimeDateStamp: 2026-Jul-02 10:44:55\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00011000\nSizeOfInitializedData: 0x00700C00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000C94210 (Section: .boot)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00F98000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0086E08A\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":":\n VirtualSize: 0x00010F66\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00006F5C\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.95673\n\n (#2):\n VirtualSize: 0x00002A9C\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00001342\n PointerToRawData: 0x00007400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.92933\n\n (#3):\n VirtualSize: 0x006FEE10\n VirtualAddress: 0x00015000\n SizeOfRawData: 0x005501BA\n PointerToRawData: 0x00008800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.86493\n\n (#4):\n VirtualSize: 0x00000198\n VirtualAddress: 0x00714000\n SizeOfRawData: 0x0000010A\n PointerToRawData: 0x00558A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.85258\n\n (#5):\n VirtualSize: 0x00000010\n VirtualAddress: 0x00715000\n SizeOfRawData: 0x00000010\n PointerToRawData: 0x00558C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4\n\n (#6):\n VirtualSize: 0x00000010\n VirtualAddress: 0x00716000\n SizeOfRawData: 0x00000006\n PointerToRawData: 0x00558E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.58496\n\n (#7):\n VirtualSize: 0x00000350\n VirtualAddress: 0x00717000\n SizeOfRawData: 0x0000016F\n PointerToRawData: 0x00559000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.25272\n\n (#8):\n VirtualSize: 0x00000078\n VirtualAddress: 0x00718000\n SizeOfRawData: 0x00000069\n PointerToRawData: 0x00559200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.06159\n\n.imports:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00719000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00559400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.27377\n\n.tls:\n VirtualSize: 0x00001000\n VirtualAddress: 0x0071A000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00559600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.333346\n\n.rsrc:\n VirtualSize: 0x00001000\n VirtualAddress: 0x0071B000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00559800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.86738\n\n.themida:\n VirtualSize: 0x00578000\n VirtualAddress: 0x0071C000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00559C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.boot:\n VirtualSize: 0x00302800\n VirtualAddress: 0x00C94000\n SizeOfRawData: 0x00302800\n PointerToRawData: 0x00559C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.96441\n\n.reloc:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00F97000\n SizeOfRawData: 0x00000010\n PointerToRawData: 0x0085C400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n Entropy: 2.54879"},"Imports":{"raw":"kernel32.dll: GetModuleHandleA\nmsvcrt.dll: __C_specific_handler\n\nResources:\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46053\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 80.8.3537.410\n ProductVersion: 80.8.3537.410\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n CompanyName: Google Inc.\n FileTitle: chrome.exe\n FileDescription: Google Chrome\n FileVersion (#2): 80,8,3537,410\n LegalCopyright: Copyright 2017 Google Inc. All rights reserved.\n LegalTrademark: \n ProductName: Google Chrome\n ProductVersion (#2): 80,8,3537,410\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x000000014071A000\nEndAddressOfRawData: 0x000000014071A008\nAddressOfIndex: 0x000000014071A008\nAddressOfCallbacks: 0x000000014071A010\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_8BYTES\nCallbacks: (EMPTY)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n Contains domain names:\n cacerts.digicert.com\n crl3.digicert.com\n crl4.digicert.com\n digicert.com\n http://cacerts.digicert.com\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E\n http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C\n http://crl3.digicert.com\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\n http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0\n http://crl3.digicert.com/DigiCertTrustedRootG4.crl0\n http://crl4.digicert.com\n http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\n http://ocsp.digicert.com0\n http://ocsp.digicert.com0A\n http://ocsp.digicert.com0C\n http://ocsp.digicert.com0X\n http://ocsp.digicert.com0\\\n http://www.digicert.com\n http://www.digicert.com/CPS0\n www.digicert.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA256\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .imports\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n The PE only has 2 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 18824 bytes of data starting at offset 0x85c410.\n\n[ MALICIOUS ] The program tries to mislead users about its origins.\n The PE pretends to be from Google but is not signed!\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46053\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 80.8.3537.410\n ProductVersion: 80.8.3537.410\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n CompanyName: Google Inc.\n FileTitle: chrome.exe\n FileDescription: Google Chrome\n FileVersion (#2): 80,8,3537,410\n LegalCopyright: Copyright 2017 Google Inc. All rights reserved.\n LegalTrademark: \n ProductName: Google Chrome\n ProductVersion (#2): 80,8,3537,410\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x000000014071A000\nEndAddressOfRawData: 0x000000014071A008\nAddressOfIndex: 0x000000014071A008\nAddressOfCallbacks: 0x000000014071A010\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_8BYTES\nCallbacks: (EMPTY)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to internet browsers:\n chrome.exe\n Contains domain names:\n cacerts.digicert.com\n crl3.digicert.com\n crl4.digicert.com\n digicert.com\n http://cacerts.digicert.com\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E\n http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C\n http://crl3.digicert.com\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\n http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0\n http://crl3.digicert.com/DigiCertTrustedRootG4.crl0\n http://crl4.digicert.com\n http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\n http://ocsp.digicert.com0\n http://ocsp.digicert.com0A\n http://ocsp.digicert.com0C\n http://ocsp.digicert.com0X\n http://ocsp.digicert.com0\\\n http://www.digicert.com\n http://www.digicert.com/CPS0\n www.digicert.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA256\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .imports\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n The PE only has 2 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 18824 bytes of data starting at offset 0x85c410.\n\n[ MALICIOUS ] The program tries to mislead users about its origins.\n The PE pretends to be from Google but is not signed!\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/ZKm9GeoUlo-019f74acd1537701bc8d0496bbb37230.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_5ncad9tj/output.txt"},"timestamp":"2026-07-18 15:53:43"} {"_id":{"$oid":"6a5b5b7bb3bed57e0e73787a"},"sha256":"7df9619f4ebfbfae75755efb99f044815ecfb17a8077fe90b300da86fc9e49e7","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/7df9619f4ebfbfae75755efb99f044815ecfb17a8077fe90b300da86fc9e49e7-019f74dbae8879318617d1e4bee46564.xlsx\nDate: 2026-07-18 16:24:51\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/7df9619f4ebfbfae75755efb99f044815ecfb17a8077fe90b300da86fc9e49e7-019f74dbae8879318617d1e4bee46564.xlsx!\nDetected file type(s):\n\tExcel Document\n\tOLE Compound File\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/7df9619f4ebfbfae75755efb99f044815ecfb17a8077fe90b300da86fc9e49e7-019f74dbae8879318617d1e4bee46564.xlsx"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_4epsazqd/output.txt"},"timestamp":"2026-07-18 16:24:51"} {"_id":{"$oid":"6a5b5d41b3bed57e0e73787d"},"sha256":"3fc1ee3e8ba9718c4c2de7ad73bf362911ea5463f380c189edff62e853b78af1","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_jcsj47pf/3fc1ee3e8ba9718c4c2de7ad73bf362911ea5463f380c189edff62e853b78af1-019f74e3de2e79e089a2e5cab71c00d8.elf_3fc1ee3e8ba9/001_upx_unpacked.elf\nDate: 2026-07-18 16:32:25\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /tmp/sdm_unpack_jcsj47pf/3fc1ee3e8ba9718c4c2de7ad73bf362911ea5463f380c189edff62e853b78af1-019f74e3de2e79e089a2e5cab71c00d8.elf_3fc1ee3e8ba9/001_upx_unpacked.elf!\nDetected file type(s):\n\tExecutable and Linking Format executable file (Linux/Unix)\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_jcsj47pf/3fc1ee3e8ba9718c4c2de7ad73bf362911ea5463f380c189edff62e853b78af1-019f74e3de2e79e089a2e5cab71c00d8.elf_3fc1ee3e8ba9/001_upx_unpacked.elf"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_y8w8sr6l/output.txt"},"timestamp":"2026-07-18 16:32:25"} {"_id":{"$oid":"6a5b5fa2b3bed57e0e737881"},"sha256":"840626f21fed3a7ef96f53a7ee2ebc04599ab21d937edba74b9988cd8358f26d","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/840626f21fed3a7ef96f53a7ee2ebc04599ab21d937edba74b9988cd8358f26d-019f74ebd14b77e2a64292ae7a02cd7c.elf\nDate: 2026-07-18 16:42:34\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/840626f21fed3a7ef96f53a7ee2ebc04599ab21d937edba74b9988cd8358f26d-019f74ebd14b77e2a64292ae7a02cd7c.elf!\nDetected file type(s):\n\tExecutable and Linking Format executable file (Linux/Unix)\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/840626f21fed3a7ef96f53a7ee2ebc04599ab21d937edba74b9988cd8358f26d-019f74ebd14b77e2a64292ae7a02cd7c.elf"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_mk5nb4uk/output.txt"},"timestamp":"2026-07-18 16:42:34"} {"_id":{"$oid":"6a5b61efb3bed57e0e737884"},"sha256":"24af760d399116385ac44f329e586a1e67e8a7c1d4f873b06863bb4bf5e4395e","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/24af760d399116385ac44f329e586a1e67e8a7c1d4f873b06863bb4bf5e4395e-019f74f594637e13bdce05055be7ec2c.elf\nDate: 2026-07-18 16:52:23\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/24af760d399116385ac44f329e586a1e67e8a7c1d4f873b06863bb4bf5e4395e-019f74f594637e13bdce05055be7ec2c.elf!\nDetected file type(s):\n\tExecutable and Linking Format executable file (Linux/Unix)\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/24af760d399116385ac44f329e586a1e67e8a7c1d4f873b06863bb4bf5e4395e-019f74f594637e13bdce05055be7ec2c.elf"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_d23v4zx6/output.txt"},"timestamp":"2026-07-18 16:52:23"} {"_id":{"$oid":"6a5b6c96b3bed57e0e737886"},"sha256":"f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_lte3smut/test-019f74f969c67b708ae412d024c8c189.msi_f36047d7ce10/002_binwalk_F_Exe1.exe\nDate: 2026-07-18 17:37:50\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_lte3smut/test-019f74f969c67b708ae412d024c8c189.msi_f36047d7ce10/002_binwalk_F_Exe1.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Apr-19 20:38:47\nDetected languages: English - United States\nCompanyName: Microsoft Corporation\nFileDescription: Store Installer\nFileVersion: 22602.213.1.0\nInternalName: Store Installer\nLegalCopyright: ? Microsoft Corporation. All rights reserved.\nOriginalFilename: StoreInstaller.exe\nProductName: Store Installer\nProductVersion: 22602.213.1.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000D8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2026-Apr-19 20:38:47\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00006A00\nSizeOfInitializedData: 0x0002D200\nSizeOfUninitializedData: 0x00000800\nAddressOfEntryPoint: 0x0000358D (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00008000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00058000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00006940\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00006A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.49222\n\n.rdata:\n VirtualSize: 0x00001464\n VirtualAddress: 0x00008000\n SizeOfRawData: 0x00001600\n PointerToRawData: 0x00006E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.97094\n\n.data:\n VirtualSize: 0x0002A818\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00008400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.17187\n\n.ndata:\n VirtualSize: 0x00011000\n VirtualAddress: 0x00035000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rsrc:\n VirtualSize: 0x00011B60\n VirtualAddress: 0x00046000\n SizeOfRawData: 0x00011C00\n PointerToRawData: 0x00008A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.94924\n\n\nImports:\n--------\nADVAPI32.dll: RegEnumValueW\n RegEnumKeyW\n RegQueryValueExW\n RegSetValueExW\n RegCloseKey\n RegDeleteValueW\n RegDeleteKeyW\n AdjustTokenPrivileges\n LookupPrivilegeValueW\n OpenProcessToken\n RegOpenKeyExW\n RegCreateKeyExW\nSHELL32.dll: SHGetPathFromIDListW\n SHBrowseForFolderW\n SHGetFileInfoW\n SHFileOperationW\n ShellExecuteExW\nole32.dll: CoCreateInstance\n OleUninitialize\n OleInitialize\n IIDFromString\n CoTaskMemFree\nCOMCTL32.dll: ImageList_Destroy\n #17\n ImageList_AddMasked\n ImageList_Create\nUSER32.dll: MessageBoxIndirectW\n GetDlgItemTextW\n SetDlgItemTextW\n CreatePopupMenu\n AppendMenuW\n TrackPopupMenu\n OpenClipboard\n EmptyClipboard\n SetClipboardData\n CloseClipboard\n IsWindowVisible\n CallWindowProcW\n GetMessagePos\n CheckDlgButton\n LoadCursorW\n SetCursor\n GetSysColor\n SetWindowPos\n GetWindowLongW\n IsWindowEnabled\n SetClassLongW\n GetSystemMenu\n EnableMenuItem\n GetWindowRect\n ScreenToClient\n EndDialog\n RegisterClassW\n SystemParametersInfoW\n CharPrevW\n GetClassInfoW\n DialogBoxParamW\n CharNextW\n ExitWindowsEx\n DestroyWindow\n CreateDialogParamW\n SetTimer\n SetWindowTextW\n PostQuitMessage\n SetForegroundWindow\n ShowWindow\n wsprintfW\n SendMessageTimeoutW\n FindWindowExW\n IsWindow\n GetDlgItem\n SetWindowLongW\n LoadImageW\n GetDC\n ReleaseDC\n EnableWindow\n InvalidateRect\n SendMessageW\n DefWindowProcW\n BeginPaint\n GetClientRect\n FillRect\n DrawTextW\n EndPaint\n CharNextA\n wsprintfA\n DispatchMessageW\n CreateWindowExW\n PeekMessageW\n GetSystemMetrics\nGDI32.dll: GetDeviceCaps\n SetBkColor\n SelectObject\n DeleteObject\n CreateBrushIndirect\n CreateFontIndirectW\n SetBkMode\n SetTextColor\nKERNEL32.dll: lstrcmpiA\n CreateFileW\n GetTempFileNameW\n RemoveDirectoryW\n CreateProcessW\n CreateDirectoryW\n CreateThread\n GlobalLock\n GlobalUnlock\n GetDiskFreeSpaceW\n WideCharToMultiByte\n lstrcpynW\n lstrlenW\n SetErrorMode\n GetVersionExW\n GetCommandLineW\n GetTempPathW\n GetWindowsDirectoryW\n SetEnvironmentVariableW\n WriteFile\n ExitProcess\n GetCurrentProcess\n GetModuleFileNameW\n GetLastError\n GetFileSize\n GetTickCount\n Sleep\n SetFileAttributesW\n GetFileAttributesW\n SetCurrentDirectoryW\n MoveFileW\n GetFullPathNameW\n GetShortPathNameW\n SearchPathW\n CompareFileTime\n SetFileTime\n CloseHandle\n lstrcmpiW\n lstrcmpW\n ExpandEnvironmentStringsW\n GlobalFree\n GlobalAlloc\n GetModuleHandleW\n LoadLibraryExW\n FreeLibrary\n WritePrivateProfileStringW\n GetPrivateProfileStringW\n lstrlenA\n MultiByteToWideChar\n ReadFile\n SetFilePointer\n FindClose\n FindNextFileW\n FindFirstFileW\n DeleteFileW\n MulDiv\n lstrcpyA\n MoveFileExW\n lstrcatW\n GetSystemDirectoryW\n GetProcAddress\n GetModuleHandleA\n GetExitCodeProcess\n WaitForSingleObject\n CopyFileW\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 54759\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99126\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4963\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94256\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3229\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.92937\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2522\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.89211\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1681\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.80893\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.76178\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 918\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.68659\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 665\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.51668\n Detected Filetype: PNG graphic file\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00469\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 828\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.3639\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 841\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.2878\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 22602.213.1.0\n ProductVersion: 22602.213.1.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Store Installer\n FileVersion (#2): 22602.213.1.0\n InternalName: Store Installer\n LegalCopyright: ? Microsoft Corporation. All rights reserved.\n OriginalFilename: StoreInstaller.exe\n ProductName: Store Installer\n ProductVersion (#2): 22602.213.1.0\n\n\nRICH Header:\n------------\nXOR Key: 0xD24E50E9\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 163\nImports (VS2003 (.NET) build 4035): 15\n48 (9044): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 8.0\n MASM/TASM - sig1(h)\n MSVC++ v.8 (procedure 1 recognized - h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n Rundll32.exe\n regsvr32.exe\n sc.exe\n Contains references to internet browsers:\n Chrome.exe\n chrome.exe\n iexplore.exe\n Contains references to security software:\n qqpcrtp.exe\n qqpctray.exe\n Tries to detect virtualized environments:\n HARDWARE\\DESCRIPTION\\System\n Looks for VMWare presence:\n 00-50-56\n May have dropper capabilities:\n %TEMP%\n CurrentControlSet\\Services\n CurrentControlSet\\services\n Accesses the WMI:\n ROOT\\CIMV2\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n .sogou.com\n .sohu.com\n .soso.com\n .vip.wpscdn.cn\n 1-roaming.wps.cn\n 1.kss.ksyun.com\n 1.vip.wpscdn.cn\n 1.wpscdn.cn\n 2-aia.verisign.com\n 2-crl.verisign.com\n 2.wpscdn.cn\n 2009-2-aia.verisign.com\n 2009-2-crl.verisign.com\n 2c-precise.ksord.com\n 3.wpscdn.cn\n Device.wps.cn\n Sogou.com\n abroadad.cache.wpscdn.com\n acc.sogou.com\n account.wps.cn\n account.wps.com\n act.u.wps.cn\n act.wps.cn\n act.wpscdn.cn\n activate-jp.wps.com\n activity.wps.com\n adm.wps.cn\n admin-vip.wps.cn\n adobe.com\n ag.kdocs.cn\n ag.wps.cn\n agents.wps.cn\n ai-bus.kdocs.cn\n ai-bus.wps.cn\n ai-eu.wps.com\n ai-generator-dimension.wpscdn.cn\n ai-in.wps.com\n ai-jp.wps.com\n ai-kae.wps.cn\n ai-ru.wps.com\n ai-sg.wps.com\n ai-us.wps.com\n ai.jimo.wps.cn\n ai.kingsoft.com\n ai.wps.cn\n ai.wps.com\n ai.wpscdn.cn\n aia.verisign.com\n aibeautify.wps.com\n aiblacktech.wps.cn\n aidocs.local.wps.cn\n aidocs.wps.cn\n aippt.wps.cn\n aitest.wps.cn\n aiwrite.wps.cn\n android.wps.cn\n api-b.wps.cn\n api-eu.wps.com\n api-filesys.wps.cn\n api-in.wps.com\n api-jp.wps.com\n api-push.wps.cn\n api-ru.wps.com\n api-sg.wps.com\n api-us.wps.com\n api-web-param-us.wps.com\n api-xctrl.wps.cn\n api.ai.kingsoft.com\n api.kas.wps.cn\n api.kdocs.cn\n api.modou.wps.cn\n api.papocket.com\n api.vas.wpscdn.cn\n api.wps.cn\n api.wps.com\n api.wpscdn.cn\n api6-client.ksord.com\n api6.ksord.com\n app.wpscdn.cn\n apph.wpsmail.net\n b.wps.cn\n baidu.com\n bbs.wps.cn\n beijing.ksyun.com\n beijing.ksyuncs.com\n bigsearch.ksord.com\n biz.wps.cn\n bj-overseas.ag.wps.cn\n bj.ag.kdocs.cn\n bus.kdocs.cn\n bus.wps.cn\n c.wps.cn\n cacerts.digicert.com\n cache.docer.com\n cache.wps.cn\n cache.wpscdn.cn\n cache.wpscdn.com\n caiji-web.docer.wps.cn\n calendar.wps.com\n ccrpc.wps.cn\n cdb.wps.cn\n cdn-docer.ks3-cn-beijing.ksyuncs.com\n cfgver.skin.wps.cn\n chn.docer.com\n chuangkit.com\n cl-act.u.wps.cn\n client.ks3-cn-beijing.ksyuncs.com\n client.ksord.com\n clientweb.docer.wps.cn\n cloud-doc.wps.cn\n cloud.u.wps.cn\n clouddoc.wps.cn\n cloudform-waas.wps.cn\n cloudnotify.wps.cn\n cn-beijing.ksyun.com\n cn-beijing.ksyuncs.com\n cnt.wps.cn\n co.wps.cn\n collect-debug.ksord.com\n conf.psvr.wps.cn\n contact.wps.cn\n coop-contact.wps.cn\n copilot-api-b.wps.cn\n copilot-api.wps.cn\n copilot-login-b.wps.cn\n copilot-login.wps.cn\n cp.wps.cn\n crl.microsoft.com\n crl.verisign.com\n crl3.digicert.com\n crl4.digicert.com\n csc3-2009-2-aia.verisign.com\n csc3-2009-2-crl.verisign.com\n cunzheng.wps.cn\n d.wps.cn\n dapi.wps.cn\n dbs.wps.cn\n dcapi-eu.wps.com\n dcapi-jp.wps.com\n dcapi-ru.wps.com\n dcapi-sg.wps.com\n dcapi-us.wps.com\n dcapi.wps.cn\n dcapi.wps.com\n dcapi2.wps.cn\n dcapi3.wps.cn\n dcapii18n.wps.com\n dce-gateway.docer.wps.cn\n debug.ksord.com\n dev-test.wps.cn\n dev.wps.cn\n deviceapi.wps.cn\n diffpack.wps.cn\n digicert.com\n dimension.wpscdn.cn\n discuss.wps.cn\n dl.op.wpscdn.cn\n dl.vas.wpscdn.cn\n dl.wps.md.wpscdn.cn\n doc-discuss.wps.cn\n doc.wps.cn\n docer-api.kdocs.cn\n docer-api.wps.cn\n docer-api.wps.com\n docer-api.wpscdn.cn\n docer-files.wpscdn.cn\n docer-kdocs.wps.cn\n docer-ks3.wpscdn.cn\n docer.com\n docer.kdocs.cn\n docer.ks3-cn-beijing.ksyuncs.com\n docer.wps.cn\n docer.wpscdn.cn\n docerad.wps.cn\n docerserver.wps.cn\n docs-dapi.wps.cn\n docs.wps.cn\n docs.wps.com\n docteamapi.wps.cn\n download.iciba.com\n downloader.wps.cn\n dpr.wps.cn\n drive.kdocs.cn\n drive.wps.cn\n drive.wps.com\n dw-collect-debug.ksord.com\n dw-online.ksosoft.com\n dw.ksosoft.com\n dwz.wps.cn\n dynamicedu.wps.cn\n easy.wps.cn\n edu.wps.cn\n education-web.docer.wps.cn\n email.wps.cn\n emergency.wps.cn\n emergency.wpscdn.cn\n et.local.wps.cn\n et.local.wps.com\n eu-account.wps.com\n eu-calendar.wps.com\n eu-drive.wps.com\n eu-plus.wps.com\n eu-plussvr.wps.com\n eu-securitydoc.wps.com\n eu-store.wps.com\n eu-tiance.wps.com\n eu-work.wps.com\n eu.docs.wps.com\n eu.wps.com\n event.user.info\n event.wps.com\n ewb.wps.cn\n example.com\n f.kdocs.cn\n f.wps.cn\n face-api.wps.cn\n fe-static.wpscdn.cn\n feed-gw.wps.cn\n feedback-office.wps.com\n feedback.wps.cn\n feedback.wps.com\n ff.wps.com\n file.cache.docer.com\n fileoperate.wps.cn\n files.wpscdn.cn\n filesys.wps.cn\n flow.wps.cn\n flowvip.wps.cn\n fonts.cache.wps.cn\n fonts.wps.cn\n fy.iciba.com\n gateway.docer.wps.cn\n gen.wps.cn\n generator-dimension.wpscdn.cn\n get.sogou.com\n get.wps.cn\n global-volc.wpscdn.cn\n global-volc.wpscdn.com\n global.local.wps.cn\n global.local.wps.com\n global.wps.com\n go.wps.cn\n gw.wps.cn\n h5.mini.wps.cn\n hamlet.ksord.com\n hao.wps.cn\n hd.wps.cn\n help.wps.com\n helpdesk.wps.cn\n hetong.wps.cn\n home.wps.cn\n honeycomb-adm.wps.cn\n honeycomb-emergency.wps.cn\n honeycomb-emergency.wpscdn.cn\n honeycomb-openapi-dev-test.wps.cn\n honeycomb-plugins-1.wpscdn.cn\n honeycomb-plugins-2.wpscdn.cn\n honeycomb-plugins-3.wpscdn.cn\n honeycomb-plugins.wps.cn\n honeycomb-plugins.wpscdn.cn\n honeycomb-sr-public.wpscdn.cn\n honeycomb.wps.cn\n honeycomb.wpscdn.cn\n hoplink.wps.cn\n hr.wpscdn.cn\n http://cacerts.digicert.com\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E\n http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_\n http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C\n http://crl.microsoft.com\n http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0\n http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z\n http://crl.verisign.com\n http://crl.verisign.com/ThawteTimestampingCA.crl0\n http://crl.verisign.com/pca3.crl0\n http://crl.verisign.com/tss-ca.crl0\n http://crl3.digicert.com\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O\n http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\n http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0\n http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0\n http://crl3.digicert.com/DigiCertTrustedRootG4.crl0\n http://crl3.digicert.com/sha2-assured-cs-g1.crl05\n http://crl4.digicert.com\n http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\n http://crl4.digicert.com/sha2-assured-cs-g1.crl0K\n http://csc3-2009-2-aia.verisign.com\n http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0\n http://csc3-2009-2-crl.verisign.com\n http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0D\n http://ime.sogou.com\n http://ime.sogou.com/up.gif\n http://ime.sogou.com/version.txt\n http://logo.verisign.com\n http://logo.verisign.com/vslogo.gif0\n http://ns.adobe.com\n http://ns.adobe.com/exif/1.0/\n http://ns.adobe.com/photoshop/1.0/\n http://ns.adobe.com/tiff/1.0/\n http://ns.adobe.com/xap/1.0/\n http://ns.adobe.com/xap/1.0/mm/\n http://ns.adobe.com/xap/1.0/sType/ResourceEvent#\n http://ns.adobe.com/xap/1.0/sType/ResourceRef#\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n http://ocsp.digicert.com0\n http://ocsp.digicert.com0A\n http://ocsp.digicert.com0C\n http://ocsp.digicert.com0N\n http://ocsp.digicert.com0X\n http://ocsp.digicert.com0\\\n http://ocsp.verisign.com0\n http://ocsp.verisign.com01\n http://ocsp.verisign.com0?\n http://p3pping.sogou.com\n http://ping.acc.sogou.com\n http://ping.acc.sogou.com/sogoupydic.gif?h\n http://pinyin.sogou.com\n http://pinyin.sogou.com/0\n http://purl.org\n http://schemas.openxmlformats.org\n http://schemas.openxmlformats.org/drawingml/2006/diagram\n http://schemas.openxmlformats.org/drawingml/2006/main\n http://schemas.openxmlformats.org/officeDocument/2006/relationships\n http://sogou.com\n http://sohu.com\n http://soso.com\n http://tb.sogou.com\n http://tb.sogou.com/\n http://wps.cn\n http://www.baidu.com\n http://www.baidu.com/robots.txt\n http://www.digicert.com\n http://www.digicert.com/CPS0\n http://www.microsoft.com\n http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0\n http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0\n http://www.microsoft.com/pkiops/Docs/Repository.htm0\n http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0\n http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010\n http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a\n http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010\n http://www.microsoft.com/pkiops/docs/primarycps.htm0\n http://www.w3.org\n http://www.w3.org/1999/02/22-rdf-syntax-ns#\n http://www.w3.org/1999/xlink\n http://www.w3.org/2000/svg\n http://www.w3.org/2001/XMLSchema-instance\n https.ydstatic.com\n https://curl.se\n https://docer.com\n https://fe-static.wpscdn.cn\n https://fe-static.wpscdn.cn/apm_sdk_proxy/client-wps-pc.entry.v2.min.js'\n https://fe-static.wpscdn.cn/apm_sdk_proxy/client-wps-pc.entry.v2.min.js?appId\n https://get.sogou.com\n https://get.sogou.com/q\n https://honeycomb-plugins.wps.cn\n https://honeycomb-plugins.wpscdn.cn\n https://ime.sogou.com\n https://ime.sogou.com/pyup.gif?\n https://js1.pcfg.cache.wpscdn.cn\n https://js1.pcfg.cache.wpscdn.cn/wps_statics/wps_web_apm/client-wps-pc.entry.v1.min.js\n https://kdocs.cn\n https://learning.u.wpscdn.cn\n https://learning.u.wpscdn.cn/config/json/academy/cloud_edu_url_default2\n https://personal-ai-bus.wps.cn\n https://qwps.com\n https://shared-https.ydstatic.com\n https://shared-https.ydstatic.com/images/favicon.ico\n https://wps.cn\n https://wps.com\n https://wpsplus.com\n https://www.digicert.com\n https://www.digicert.com/CPS0\n https://www.microsoft.com\n https://www.verisign.com\n https://www.verisign.com/cps0\n https://www.verisign.com/rpa\n https://www.verisign.com/rpa0\n hw.wdl.cache.wpscdn.cn\n hwc-bj-overseas.ag.wps.cn\n i.wps.cn\n i18n.wps.cn\n ic-proofread.wps.cn\n icdcapi.wps.cn\n iciba.com\n idle.wpscdn.cn\n ifanyi.iciba.com\n imapi.docer.wpscdn.cn\n ime.sogou.com\n img.qwps.cn\n img1.mini.cache.wps.cn\n img1.pcfg.cache.wpscdn.cn\n img1.template.cache.wps.cn\n img2.fonts.cache.wps.cn\n img7.file.cache.docer.com\n in-account.wps.com\n in-calendar.wps.com\n in-drive.wps.com\n in-plus.wps.com\n in-plussvr.wps.com\n in-securitydoc.wps.com\n in-store.wps.com\n in-tiance.wps.com\n in-work.wps.com\n in.docs.wps.com\n in.wps.com\n info.kingsoftstore.com\n insp.wps.cn\n intl-ippt.wps.com\n ios.wps.cn\n iospush.wps.cn\n ippt.wps.cn\n ippt.wps.com\n jimo.wps.cn\n jp-account.wps.com\n jp-calendar.wps.com\n jp-drive.wps.com\n jp-plus.wps.com\n jp-plussvr.wps.com\n jp-securitydoc.wps.com\n jp-store.wps.com\n jp-tiance.wps.com\n jp-work.wps.com\n jp.docs.wps.com\n jp.wps.com\n js1.pcfg.cache.wpscdn.cn\n jump.wps.cn\n kad.www.wps.cn\n kae.wps.cn\n kas.wps.cn\n kbee.wps.cn\n kblog.wps.cn\n kdocs-vas.wpscdn.cn\n kdocs.cn\n kdocs.wps.cn\n kflow-idle.wpscdn.cn\n kflow-rt.wps.cn\n kflow.wps.cn\n kflow.wpscdn.cn\n kingsoft.com\n kingsoftstore.com\n klogin.wps.cn\n km.kdocs.cn\n kmsg.wps.cn\n knobo.wps.cn\n kos.wps.cn\n kot-pictures.wps.cn\n kpay-ff.wps.com\n kpay-jp.wps.com\n kpay-mb.wps.com\n kpay-ru.wps.com\n kpay-sg.wps.com\n kpay-us.wps.com\n kpay.wps.com\n kps.wps.cn\n ks3-cn-beijing.ksyun.com\n ks3-cn-beijing.ksyuncs.com\n ks3.wpscdn.cn\n ksc-bj.ag.kdocs.cn\n ksgec-test.wps.com\n ksgec.wps.com\n ksoepproofread.wps.cn\n ksoproofread.wps.cn\n ksopushapi.wps.cn\n ksord.com\n ksosoft.com\n kss.ksyun.com\n kstatus.wps.cn\n ksyun.com\n ksyuncs.com\n kuc.wps.cn\n kup.wps.cn\n kvas-api.wps.cn\n learning.u.wpscdn.cn\n library-wps.lnep.net\n lingxi.wps.cn\n linux.wps.cn\n llm-api.kas.wps.cn\n local.wps.cn\n local.wps.com\n localhost.wbridge.wps.cn\n login-b.wps.cn\n login.psvr.wps.cn\n login.wps.cn\n login.wpscdn.cn\n logintcp.wps.cn\n logintcpnv.wps.cn\n logo.verisign.com\n mac.wps.cn\n mac.wps.com\n mac.wpscdn.cn\n mb.wps.com\n md.wpscdn.cn\n meeting.kdocs.cn\n meeting.wps.cn\n meeting.wps.com\n meihua-service.ks3-cn-beijing.ksyun.com\n memtest86.com\n micro.api.wps.com\n microsoft.com\n mini.cache.wps.cn\n mini.wps.cn\n mission.u.wps.cn\n mo.wps.cn\n moapi.wps..cn\n moapi.wps.cn\n mob.wps.cn\n mobapp-api.wps.cn\n modou.wps.cn\n modouks.wps.cn\n moni-wps.chuangkit.com\n movip.wps.com\n msg.psvr.wps.cn\n msgcenter.wps.cn\n msgpush.wps.cn\n ncre.u.wps.cn\n newdoc.docer.wps.cn\n note-api.wps.cn\n note.wps.cn\n notebox.wps.cn\n notice.wps.cn\n ns.adobe.com\n nsis.sf.net\n o.wpsgo.com\n office.wps.com\n official-package.wpscdn.cn\n ok.kdocs.cn\n ones.wps.cn\n online.ksosoft.com\n op.wpscdn.cn\n open-mob.wps.cn\n open-mobapp-api.wps.cn\n open.docer.wps.cn\n open.wps.cn\n openapi-dev-test.wps.cn\n openapi.wps.cn\n openapp.wpscdn.cn\n openapptest.wpscdn.cn\n openssl.org\n openxmlformats.org\n overseas.ag.wps.cn\n ovs-shopwindow-server-ff.wps.com\n ovs-shopwindow-server-jp.wps.com\n ovs-shopwindow-server-mb.wps.com\n ovs-shopwindow-server-ru.wps.com\n ovs-shopwindow-server-sg.wps.com\n ovs-shopwindow-server-us.wps.com\n ovs-shopwindow-server.wps.com\n p.kdocs.cn\n p3p.sogou.com\n p3pping.sogou.com\n pacakge.cache.wpscdn.cn\n package.mac.wpscdn.cn\n package.wpscdn.cn\n pan.wps.cn\n papocket.com\n param-us.wps.com\n params.wps.com\n pay.wps.cn\n pbtest.wps.cn\n pc-diffpack.wps.cn\n pc-hamlet.ksord.com\n pc-plugin-1.wpscdn.cn\n pc-plugin-2.wpscdn.cn\n pc-plugin-3.wpscdn.cn\n pc-plugin-personal.wpscdn.cn\n pc-plugin-plg.wpscdn.cn\n pc-plugin-v3.wpscdn.cn\n pc-plugin.wpscdn.cn\n pc-serv.wps.com\n pc.ksord.com\n pc.uid.ksosoft.com\n pc.wps.cn\n pcdiffpack.psvr.wps.cn\n pcfg.cache.wpscdn.cn\n pcfg.cache.wpscdn.com\n pcfg.wps.cn\n pcv-test.wps.cn\n pcv.wps.cn\n pdf.wps.cn\n pdf.wps.com\n pdf2word.wps.cn\n pdf2wordbackup1.wps.cn\n pdfbackup1.wps.cn\n pendant.docer.wps.cn\n permits-ff.wps.com\n permits-jp.wps.com\n permits-mb.wps.com\n permits-ru.wps.com\n permits-sg.wps.com\n permits-us.wps.com\n permits.wps.com\n personal-act.wps.cn\n personal-act.wpscdn.cn\n personal-ai-bus.kdocs.cn\n personal-ai-bus.wps.cn\n personal-bus.wps.cn\n personal-volc.wpscdn.cn\n personal-volc.wpscdn.com\n personal-web.kdocs.cn\n personal-web.wps.cn\n personal.local.wps.cn\n personal.local.wps.com\n personal.wpscdn.cn\n phapi.wps.cn\n pictures.wps.cn\n ping.acc.sogou.com\n pinyin.sogou.com\n platform.wps.cn\n plg.cache.wpscdn.cn\n plg.wpscdn.cn\n plugin-1.wpscdn.cn\n plugin-2.wpscdn.cn\n plugin-3.wpscdn.cn\n plugin-personal.wpscdn.cn\n plugin-plg.wpscdn.cn\n plugin-v3.wpscdn.cn\n plugin.wpscdn.cn\n plugins-1.wpscdn.cn\n plugins-2.wpscdn.cn\n plugins-3.wpscdn.cn\n plugins.wps.cn\n plugins.wpscdn.cn\n plus.wps.cn\n plus.wps.com\n plussvr.wps.cn\n plussvr.wps.com\n pocket.wps.cn\n point.wps.cn\n precise.ksord.com\n print.wps.cn\n printer.wps.cn\n privacy.wps.cn\n processon.com\n prod.cache.wpscdn.com\n proofread.wps.cn\n psu.wps.cn\n psvr.wps.cn\n pub-api.kdocs.cn\n pub-api.wps.cn\n pub.wpscdn.cn\n public.wpscdn.cn\n push.psvr.wps.cn\n push.wps.cn\n qa.wps.cn\n qdyn.kingsoftstore.com\n qing.wps.cn\n qingcenter.wps.cn\n qingqiu.wps.cn\n qn.cache.wpscdn.cn\n qpush.wps.cn\n qr.wps.cn\n rec.ksord.com\n remote.wps.cn\n remote.wps.com\n res-honeycomb.wpscdn.cn\n resume-web.docer.wps.cn\n rili.wps.cn\n roaming.wps.cn\n rt.wps.cn\n ru-account.wps.com\n ru-calendar.wps.com\n ru-drive.wps.com\n ru-plus.wps.com\n ru-plussvr.wps.com\n ru-securitydoc.wps.com\n ru-store.wps.com\n ru-tiance.wps.com\n ru-work.wps.com\n ru.docs.wps.com\n ru.wps.com\n rubik.wps.cn\n s.wps.cn\n s.wps.com\n s1.vip.wpscdn.cn\n s2.vip.wpscdn.cn\n s3.vip.wpscdn.cn\n s4.vip.wpscdn.cn\n s5.vip.wpscdn.cn\n s6.vip.wpscdn.cn\n schemas.openxmlformats.org\n sdk.ai.wpscdn.cn\n securitydoc.wps.cn\n securitydoc.wps.com\n serv.wps.com\n server-ff.wps.com\n server-jp.wps.com\n server-mb.wps.com\n server-ru.wps.com\n server-sg.wps.com\n server-us.wps.com\n server.wps.com\n service.ks3-cn-beijing.ksyun.com\n seti-ai.wps.com\n seti.jimo.wps.cn\n seti.wps.cn\n sg-account.wps.com\n sg-calendar.wps.com\n sg-drive.wps.com\n sg-plus.wps.com\n sg-plussvr.wps.com\n sg-securitydoc.wps.com\n sg-store.wps.com\n sg-tiance.wps.com\n sg-work.wps.com\n sg.docs.wps.com\n sg.wps.com\n shared-https.ydstatic.com\n sharefolder.wps.cn\n shopwindow-server-ff.wps.com\n shopwindow-server-jp.wps.com\n shopwindow-server-mb.wps.com\n shopwindow-server-ru.wps.com\n shopwindow-server-sg.wps.com\n shopwindow-server-us.wps.com\n shopwindow-server.wps.com\n shuc-pc-hamlet.ksord.com\n shuc-pc.ksord.com\n skin.docer.wps.cn\n skin.wps.cn\n so.wps.cn\n softbus-Device.wps.cn\n sogou.com\n spa.wps.cn\n sr-public.wpscdn.cn\n ssssssssssssssshuc-pc-hamlet.ksord.com\n st.wps.cn\n static.ai.wpscdn.cn\n static.wpscdn.cn\n store.wps.cn\n store.wps.com\n storechain-gen.wps.cn\n suji.wps.cn\n svc.modou.wps.cn\n switch.pcfg.cache.wpscdn.cn\n t.wpscdn.cn\n tastenew.wps.cn\n tb.sogou.com\n template-test.wps.com\n template.cache.wps.cn\n template.wps.com\n test.wps.cn\n test.wps.com\n tiance.wps.cn\n tiance.wps.com\n time.windows.com\n tj.psvr.wps.cn\n todo.wps.cn\n tools.docer.wps.cn\n topscan.com\n transferhelper.wps.cn\n translate.iciba.com\n translate.wps.com\n translation.psvr.wps.cn\n tv.wps.cn\n tvpxy.wps.cn\n u.wps.cn\n u.wpscdn.cn\n uc.wps.com\n udesk.cn\n uf-api6-client.ksord.com\n uf-api6.ksord.com\n uf-bigsearch.ksord.com\n uid.ksosoft.com\n update-dev.wps.cn\n update.kingsoftstore.com\n update.wps.cn\n update.wpscdn.cn\n updatepro.wps.cn\n us-account.wps.com\n us-calendar.wps.com\n us-drive.wps.com\n us-plus.wps.com\n us-plussvr.wps.com\n us-securitydoc.wps.com\n us-store.wps.com\n us-tiance.wps.com\n us-work.wps.com\n us.docs.wps.com\n us.wps.com\n ut.psvr.wps.cn\n v3.wpscdn.cn\n vaf.wps.cn\n vas.wps.cn\n vas.wpscdn.cn\n vas2c-spa.wps.cn\n vas2t-api.wps.cn\n vas2t-spa.wps.cn\n vasapi.wps.cn\n vasdc.wps.cn\n vasvip-pub.wpscdn.cn\n verisign.com\n vip-rec.ksord.com\n vip.wps.cn\n vip.wps.com\n vip.wpscdn.cn\n vipapi.wps.cn\n volc.wpscdn.cn\n volc.wpscdn.com\n waas.wps.cn\n wbridge.wps.cn\n wdl.cache.wpscdn.cn\n wdl1.cache.wps.cn\n wdl1.file.cache.docer.com\n wdl1.pcfg.cache.wpscdn.com\n web-param-us.wps.com\n web.docer.wps.cn\n web.kdocs.cn\n web.wps.cn\n web1.file.cache.docer.com\n website-prod.cache.wpscdn.com\n wiki.kdocs.cn\n wiki.wps.cn\n windows.com\n woa.wps.cn\n work.wps.cn\n work.wps.com\n wppai-client.ks3-cn-beijing.ksyuncs.com\n wps-cdn-docer.ks3-cn-beijing.ksyuncs.com\n wps-ncre.u.wps.cn\n wps-translate.wps.com\n wps.chuangkit.com\n wps.kingsoft.com\n wps.kss.ksyun.com\n wps.lnep.net\n wps.md.wpscdn.cn\n wps.processon.com\n wps.udesk.cn\n wpscdn.cn\n wpscdn.com\n wpsgo.com\n wpsmail.net\n wpsplus.com\n wpsthumb.processon.com\n wwo.wps.cn\n www.baidu.com\n www.digicert.com\n www.iciba.com\n www.kdocs.cn\n www.kingsoft.com\n www.ksyun.com\n www.memtest86.com\n www.microsoft.com\n www.processon.com\n www.sogou.com\n www.topscan.com\n www.verisign.com\n www.w3.org\n www.wps.cn\n www.wps.com\n xctrl.wps.cn\n xz.wps.cn\n ydstatic.com\n youraddr.com\n yun.qwps.cn\n yun.wps.cn\n yun.wpscdn.cn\n yunbiz.wps.cn\n yunbizcdn.wpscdn.cn\n zt.wps.cn\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to MD5\n Uses constants related to SHA1\n Uses constants related to SHA256\n Uses constants related to SHA512\n Uses constants related to AES\n Uses constants related to Blowfish\n Uses known Diffie-Helman primes\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n Can access the registry:\n RegEnumValueW\n RegEnumKeyW\n RegQueryValueExW\n RegSetValueExW\n RegCloseKey\n RegDeleteValueW\n RegDeleteKeyW\n RegOpenKeyExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 44540380 bytes of data starting at offset 0x1a600.\n The overlay data has an entropy of 7.06906 and is possibly compressed or encrypted.\n Overlay data amounts for 99.758% of the executable.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Apr-19 20:38:47\nDetected languages: English - United States\nCompanyName: Microsoft Corporation\nFileDescription: Store Installer\nFileVersion: 22602.213.1.0\nInternalName: Store Installer\nLegalCopyright: ? Microsoft Corporation. All rights reserved.\nOriginalFilename: StoreInstaller.exe\nProductName: Store Installer\nProductVersion: 22602.213.1.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000D8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2026-Apr-19 20:38:47\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00006A00\nSizeOfInitializedData: 0x0002D200\nSizeOfUninitializedData: 0x00000800\nAddressOfEntryPoint: 0x0000358D (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00008000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 6.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00058000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00006940\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00006A00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.49222\n\n.rdata:\n VirtualSize: 0x00001464\n VirtualAddress: 0x00008000\n SizeOfRawData: 0x00001600\n PointerToRawData: 0x00006E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.97094\n\n.data:\n VirtualSize: 0x0002A818\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00008400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.17187\n\n.ndata:\n VirtualSize: 0x00011000\n VirtualAddress: 0x00035000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.rsrc:\n VirtualSize: 0x00011B60\n VirtualAddress: 0x00046000\n SizeOfRawData: 0x00011C00\n PointerToRawData: 0x00008A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.94924"},"Imports":{"raw":"ADVAPI32.dll: RegEnumValueW\n RegEnumKeyW\n RegQueryValueExW\n RegSetValueExW\n RegCloseKey\n RegDeleteValueW\n RegDeleteKeyW\n AdjustTokenPrivileges\n LookupPrivilegeValueW\n OpenProcessToken\n RegOpenKeyExW\n RegCreateKeyExW\nSHELL32.dll: SHGetPathFromIDListW\n SHBrowseForFolderW\n SHGetFileInfoW\n SHFileOperationW\n ShellExecuteExW\nole32.dll: CoCreateInstance\n OleUninitialize\n OleInitialize\n IIDFromString\n CoTaskMemFree\nCOMCTL32.dll: ImageList_Destroy\n #17\n ImageList_AddMasked\n ImageList_Create\nUSER32.dll: MessageBoxIndirectW\n GetDlgItemTextW\n SetDlgItemTextW\n CreatePopupMenu\n AppendMenuW\n TrackPopupMenu\n OpenClipboard\n EmptyClipboard\n SetClipboardData\n CloseClipboard\n IsWindowVisible\n CallWindowProcW\n GetMessagePos\n CheckDlgButton\n LoadCursorW\n SetCursor\n GetSysColor\n SetWindowPos\n GetWindowLongW\n IsWindowEnabled\n SetClassLongW\n GetSystemMenu\n EnableMenuItem\n GetWindowRect\n ScreenToClient\n EndDialog\n RegisterClassW\n SystemParametersInfoW\n CharPrevW\n GetClassInfoW\n DialogBoxParamW\n CharNextW\n ExitWindowsEx\n DestroyWindow\n CreateDialogParamW\n SetTimer\n SetWindowTextW\n PostQuitMessage\n SetForegroundWindow\n ShowWindow\n wsprintfW\n SendMessageTimeoutW\n FindWindowExW\n IsWindow\n GetDlgItem\n SetWindowLongW\n LoadImageW\n GetDC\n ReleaseDC\n EnableWindow\n InvalidateRect\n SendMessageW\n DefWindowProcW\n BeginPaint\n GetClientRect\n FillRect\n DrawTextW\n EndPaint\n CharNextA\n wsprintfA\n DispatchMessageW\n CreateWindowExW\n PeekMessageW\n GetSystemMetrics\nGDI32.dll: GetDeviceCaps\n SetBkColor\n SelectObject\n DeleteObject\n CreateBrushIndirect\n CreateFontIndirectW\n SetBkMode\n SetTextColor\nKERNEL32.dll: lstrcmpiA\n CreateFileW\n GetTempFileNameW\n RemoveDirectoryW\n CreateProcessW\n CreateDirectoryW\n CreateThread\n GlobalLock\n GlobalUnlock\n GetDiskFreeSpaceW\n WideCharToMultiByte\n lstrcpynW\n lstrlenW\n SetErrorMode\n GetVersionExW\n GetCommandLineW\n GetTempPathW\n GetWindowsDirectoryW\n SetEnvironmentVariableW\n WriteFile\n ExitProcess\n GetCurrentProcess\n GetModuleFileNameW\n GetLastError\n GetFileSize\n GetTickCount\n Sleep\n SetFileAttributesW\n GetFileAttributesW\n SetCurrentDirectoryW\n MoveFileW\n GetFullPathNameW\n GetShortPathNameW\n SearchPathW\n CompareFileTime\n SetFileTime\n CloseHandle\n lstrcmpiW\n lstrcmpW\n ExpandEnvironmentStringsW\n GlobalFree\n GlobalAlloc\n GetModuleHandleW\n LoadLibraryExW\n FreeLibrary\n WritePrivateProfileStringW\n GetPrivateProfileStringW\n lstrlenA\n MultiByteToWideChar\n ReadFile\n SetFilePointer\n FindClose\n FindNextFileW\n FindFirstFileW\n DeleteFileW\n MulDiv\n lstrcpyA\n MoveFileExW\n lstrcatW\n GetSystemDirectoryW\n GetProcAddress\n GetModuleHandleA\n GetExitCodeProcess\n WaitForSingleObject\n CopyFileW\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 54759\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99126\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4963\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94256\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3229\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.92937\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2522\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.89211\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1681\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.80893\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.76178\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 918\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.68659\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 665\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.51668\n Detected Filetype: PNG graphic file\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00469\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 828\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.3639\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 841\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.2878\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 22602.213.1.0\n ProductVersion: 22602.213.1.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Store Installer\n FileVersion (#2): 22602.213.1.0\n InternalName: Store Installer\n LegalCopyright: ? Microsoft Corporation. All rights reserved.\n OriginalFilename: StoreInstaller.exe\n ProductName: Store Installer\n ProductVersion (#2): 22602.213.1.0\n\n\nRICH Header:\nXOR Key: 0xD24E50E9\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 163\nImports (VS2003 (.NET) build 4035): 15\n48 (9044): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 8.0\n MASM/TASM - sig1(h)\n MSVC++ v.8 (procedure 1 recognized - h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n Rundll32.exe\n regsvr32.exe\n sc.exe\n Contains references to internet browsers:\n Chrome.exe\n chrome.exe\n iexplore.exe\n Contains references to security software:\n qqpcrtp.exe\n qqpctray.exe\n Tries to detect virtualized environments:\n HARDWARE\\DESCRIPTION\\System\n Looks for VMWare presence:\n 00-50-56\n May have dropper capabilities:\n %TEMP%\n CurrentControlSet\\Services\n CurrentControlSet\\services\n Accesses the WMI:\n ROOT\\CIMV2\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n .sogou.com\n .sohu.com\n .soso.com\n .vip.wpscdn.cn\n 1-roaming.wps.cn\n 1.kss.ksyun.com\n 1.vip.wpscdn.cn\n 1.wpscdn.cn\n 2-aia.verisign.com\n 2-crl.verisign.com\n 2.wpscdn.cn\n 2009-2-aia.verisign.com\n 2009-2-crl.verisign.com\n 2c-precise.ksord.com\n 3.wpscdn.cn\n Device.wps.cn\n Sogou.com\n abroadad.cache.wpscdn.com\n acc.sogou.com\n account.wps.cn\n account.wps.com\n act.u.wps.cn\n act.wps.cn\n act.wpscdn.cn\n activate-jp.wps.com\n activity.wps.com\n adm.wps.cn\n admin-vip.wps.cn\n adobe.com\n ag.kdocs.cn\n ag.wps.cn\n agents.wps.cn\n ai-bus.kdocs.cn\n ai-bus.wps.cn\n ai-eu.wps.com\n ai-generator-dimension.wpscdn.cn\n ai-in.wps.com\n ai-jp.wps.com\n ai-kae.wps.cn\n ai-ru.wps.com\n ai-sg.wps.com\n ai-us.wps.com\n ai.jimo.wps.cn\n ai.kingsoft.com\n ai.wps.cn\n ai.wps.com\n ai.wpscdn.cn\n aia.verisign.com\n aibeautify.wps.com\n aiblacktech.wps.cn\n aidocs.local.wps.cn\n aidocs.wps.cn\n aippt.wps.cn\n aitest.wps.cn\n aiwrite.wps.cn\n android.wps.cn\n api-b.wps.cn\n api-eu.wps.com\n api-filesys.wps.cn\n api-in.wps.com\n api-jp.wps.com\n api-push.wps.cn\n api-ru.wps.com\n api-sg.wps.com\n api-us.wps.com\n api-web-param-us.wps.com\n api-xctrl.wps.cn\n api.ai.kingsoft.com\n api.kas.wps.cn\n api.kdocs.cn\n api.modou.wps.cn\n api.papocket.com\n api.vas.wpscdn.cn\n api.wps.cn\n api.wps.com\n api.wpscdn.cn\n api6-client.ksord.com\n api6.ksord.com\n app.wpscdn.cn\n apph.wpsmail.net\n b.wps.cn\n baidu.com\n bbs.wps.cn\n beijing.ksyun.com\n beijing.ksyuncs.com\n bigsearch.ksord.com\n biz.wps.cn\n bj-overseas.ag.wps.cn\n bj.ag.kdocs.cn\n bus.kdocs.cn\n bus.wps.cn\n c.wps.cn\n cacerts.digicert.com\n cache.docer.com\n cache.wps.cn\n cache.wpscdn.cn\n cache.wpscdn.com\n caiji-web.docer.wps.cn\n calendar.wps.com\n ccrpc.wps.cn\n cdb.wps.cn\n cdn-docer.ks3-cn-beijing.ksyuncs.com\n cfgver.skin.wps.cn\n chn.docer.com\n chuangkit.com\n cl-act.u.wps.cn\n client.ks3-cn-beijing.ksyuncs.com\n client.ksord.com\n clientweb.docer.wps.cn\n cloud-doc.wps.cn\n cloud.u.wps.cn\n clouddoc.wps.cn\n cloudform-waas.wps.cn\n cloudnotify.wps.cn\n cn-beijing.ksyun.com\n cn-beijing.ksyuncs.com\n cnt.wps.cn\n co.wps.cn\n collect-debug.ksord.com\n conf.psvr.wps.cn\n contact.wps.cn\n coop-contact.wps.cn\n copilot-api-b.wps.cn\n copilot-api.wps.cn\n copilot-login-b.wps.cn\n copilot-login.wps.cn\n cp.wps.cn\n crl.microsoft.com\n crl.verisign.com\n crl3.digicert.com\n crl4.digicert.com\n csc3-2009-2-aia.verisign.com\n csc3-2009-2-crl.verisign.com\n cunzheng.wps.cn\n d.wps.cn\n dapi.wps.cn\n dbs.wps.cn\n dcapi-eu.wps.com\n dcapi-jp.wps.com\n dcapi-ru.wps.com\n dcapi-sg.wps.com\n dcapi-us.wps.com\n dcapi.wps.cn\n dcapi.wps.com\n dcapi2.wps.cn\n dcapi3.wps.cn\n dcapii18n.wps.com\n dce-gateway.docer.wps.cn\n debug.ksord.com\n dev-test.wps.cn\n dev.wps.cn\n deviceapi.wps.cn\n diffpack.wps.cn\n digicert.com\n dimension.wpscdn.cn\n discuss.wps.cn\n dl.op.wpscdn.cn\n dl.vas.wpscdn.cn\n dl.wps.md.wpscdn.cn\n doc-discuss.wps.cn\n doc.wps.cn\n docer-api.kdocs.cn\n docer-api.wps.cn\n docer-api.wps.com\n docer-api.wpscdn.cn\n docer-files.wpscdn.cn\n docer-kdocs.wps.cn\n docer-ks3.wpscdn.cn\n docer.com\n docer.kdocs.cn\n docer.ks3-cn-beijing.ksyuncs.com\n docer.wps.cn\n docer.wpscdn.cn\n docerad.wps.cn\n docerserver.wps.cn\n docs-dapi.wps.cn\n docs.wps.cn\n docs.wps.com\n docteamapi.wps.cn\n download.iciba.com\n downloader.wps.cn\n dpr.wps.cn\n drive.kdocs.cn\n drive.wps.cn\n drive.wps.com\n dw-collect-debug.ksord.com\n dw-online.ksosoft.com\n dw.ksosoft.com\n dwz.wps.cn\n dynamicedu.wps.cn\n easy.wps.cn\n edu.wps.cn\n education-web.docer.wps.cn\n email.wps.cn\n emergency.wps.cn\n emergency.wpscdn.cn\n et.local.wps.cn\n et.local.wps.com\n eu-account.wps.com\n eu-calendar.wps.com\n eu-drive.wps.com\n eu-plus.wps.com\n eu-plussvr.wps.com\n eu-securitydoc.wps.com\n eu-store.wps.com\n eu-tiance.wps.com\n eu-work.wps.com\n eu.docs.wps.com\n eu.wps.com\n event.user.info\n event.wps.com\n ewb.wps.cn\n example.com\n f.kdocs.cn\n f.wps.cn\n face-api.wps.cn\n fe-static.wpscdn.cn\n feed-gw.wps.cn\n feedback-office.wps.com\n feedback.wps.cn\n feedback.wps.com\n ff.wps.com\n file.cache.docer.com\n fileoperate.wps.cn\n files.wpscdn.cn\n filesys.wps.cn\n flow.wps.cn\n flowvip.wps.cn\n fonts.cache.wps.cn\n fonts.wps.cn\n fy.iciba.com\n gateway.docer.wps.cn\n gen.wps.cn\n generator-dimension.wpscdn.cn\n get.sogou.com\n get.wps.cn\n global-volc.wpscdn.cn\n global-volc.wpscdn.com\n global.local.wps.cn\n global.local.wps.com\n global.wps.com\n go.wps.cn\n gw.wps.cn\n h5.mini.wps.cn\n hamlet.ksord.com\n hao.wps.cn\n hd.wps.cn\n help.wps.com\n helpdesk.wps.cn\n hetong.wps.cn\n home.wps.cn\n honeycomb-adm.wps.cn\n honeycomb-emergency.wps.cn\n honeycomb-emergency.wpscdn.cn\n honeycomb-openapi-dev-test.wps.cn\n honeycomb-plugins-1.wpscdn.cn\n honeycomb-plugins-2.wpscdn.cn\n honeycomb-plugins-3.wpscdn.cn\n honeycomb-plugins.wps.cn\n honeycomb-plugins.wpscdn.cn\n honeycomb-sr-public.wpscdn.cn\n honeycomb.wps.cn\n honeycomb.wpscdn.cn\n hoplink.wps.cn\n hr.wpscdn.cn\n http://cacerts.digicert.com\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E\n http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_\n http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C\n http://crl.microsoft.com\n http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0\n http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z\n http://crl.verisign.com\n http://crl.verisign.com/ThawteTimestampingCA.crl0\n http://crl.verisign.com/pca3.crl0\n http://crl.verisign.com/tss-ca.crl0\n http://crl3.digicert.com\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O\n http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\n http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0\n http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0\n http://crl3.digicert.com/DigiCertTrustedRootG4.crl0\n http://crl3.digicert.com/sha2-assured-cs-g1.crl05\n http://crl4.digicert.com\n http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\n http://crl4.digicert.com/sha2-assured-cs-g1.crl0K\n http://csc3-2009-2-aia.verisign.com\n http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0\n http://csc3-2009-2-crl.verisign.com\n http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0D\n http://ime.sogou.com\n http://ime.sogou.com/up.gif\n http://ime.sogou.com/version.txt\n http://logo.verisign.com\n http://logo.verisign.com/vslogo.gif0\n http://ns.adobe.com\n http://ns.adobe.com/exif/1.0/\n http://ns.adobe.com/photoshop/1.0/\n http://ns.adobe.com/tiff/1.0/\n http://ns.adobe.com/xap/1.0/\n http://ns.adobe.com/xap/1.0/mm/\n http://ns.adobe.com/xap/1.0/sType/ResourceEvent#\n http://ns.adobe.com/xap/1.0/sType/ResourceRef#\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n http://ocsp.digicert.com0\n http://ocsp.digicert.com0A\n http://ocsp.digicert.com0C\n http://ocsp.digicert.com0N\n http://ocsp.digicert.com0X\n http://ocsp.digicert.com0\\\n http://ocsp.verisign.com0\n http://ocsp.verisign.com01\n http://ocsp.verisign.com0?\n http://p3pping.sogou.com\n http://ping.acc.sogou.com\n http://ping.acc.sogou.com/sogoupydic.gif?h\n http://pinyin.sogou.com\n http://pinyin.sogou.com/0\n http://purl.org\n http://schemas.openxmlformats.org\n http://schemas.openxmlformats.org/drawingml/2006/diagram\n http://schemas.openxmlformats.org/drawingml/2006/main\n http://schemas.openxmlformats.org/officeDocument/2006/relationships\n http://sogou.com\n http://sohu.com\n http://soso.com\n http://tb.sogou.com\n http://tb.sogou.com/\n http://wps.cn\n http://www.baidu.com\n http://www.baidu.com/robots.txt\n http://www.digicert.com\n http://www.digicert.com/CPS0\n http://www.microsoft.com\n http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0\n http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0\n http://www.microsoft.com/pkiops/Docs/Repository.htm0\n http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0\n http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010\n http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a\n http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010\n http://www.microsoft.com/pkiops/docs/primarycps.htm0\n http://www.w3.org\n http://www.w3.org/1999/02/22-rdf-syntax-ns#\n http://www.w3.org/1999/xlink\n http://www.w3.org/2000/svg\n http://www.w3.org/2001/XMLSchema-instance\n https.ydstatic.com\n https://curl.se\n https://docer.com\n https://fe-static.wpscdn.cn\n https://fe-static.wpscdn.cn/apm_sdk_proxy/client-wps-pc.entry.v2.min.js'\n https://fe-static.wpscdn.cn/apm_sdk_proxy/client-wps-pc.entry.v2.min.js?appId\n https://get.sogou.com\n https://get.sogou.com/q\n https://honeycomb-plugins.wps.cn\n https://honeycomb-plugins.wpscdn.cn\n https://ime.sogou.com\n https://ime.sogou.com/pyup.gif?\n https://js1.pcfg.cache.wpscdn.cn\n https://js1.pcfg.cache.wpscdn.cn/wps_statics/wps_web_apm/client-wps-pc.entry.v1.min.js\n https://kdocs.cn\n https://learning.u.wpscdn.cn\n https://learning.u.wpscdn.cn/config/json/academy/cloud_edu_url_default2\n https://personal-ai-bus.wps.cn\n https://qwps.com\n https://shared-https.ydstatic.com\n https://shared-https.ydstatic.com/images/favicon.ico\n https://wps.cn\n https://wps.com\n https://wpsplus.com\n https://www.digicert.com\n https://www.digicert.com/CPS0\n https://www.microsoft.com\n https://www.verisign.com\n https://www.verisign.com/cps0\n https://www.verisign.com/rpa\n https://www.verisign.com/rpa0\n hw.wdl.cache.wpscdn.cn\n hwc-bj-overseas.ag.wps.cn\n i.wps.cn\n i18n.wps.cn\n ic-proofread.wps.cn\n icdcapi.wps.cn\n iciba.com\n idle.wpscdn.cn\n ifanyi.iciba.com\n imapi.docer.wpscdn.cn\n ime.sogou.com\n img.qwps.cn\n img1.mini.cache.wps.cn\n img1.pcfg.cache.wpscdn.cn\n img1.template.cache.wps.cn\n img2.fonts.cache.wps.cn\n img7.file.cache.docer.com\n in-account.wps.com\n in-calendar.wps.com\n in-drive.wps.com\n in-plus.wps.com\n in-plussvr.wps.com\n in-securitydoc.wps.com\n in-store.wps.com\n in-tiance.wps.com\n in-work.wps.com\n in.docs.wps.com\n in.wps.com\n info.kingsoftstore.com\n insp.wps.cn\n intl-ippt.wps.com\n ios.wps.cn\n iospush.wps.cn\n ippt.wps.cn\n ippt.wps.com\n jimo.wps.cn\n jp-account.wps.com\n jp-calendar.wps.com\n jp-drive.wps.com\n jp-plus.wps.com\n jp-plussvr.wps.com\n jp-securitydoc.wps.com\n jp-store.wps.com\n jp-tiance.wps.com\n jp-work.wps.com\n jp.docs.wps.com\n jp.wps.com\n js1.pcfg.cache.wpscdn.cn\n jump.wps.cn\n kad.www.wps.cn\n kae.wps.cn\n kas.wps.cn\n kbee.wps.cn\n kblog.wps.cn\n kdocs-vas.wpscdn.cn\n kdocs.cn\n kdocs.wps.cn\n kflow-idle.wpscdn.cn\n kflow-rt.wps.cn\n kflow.wps.cn\n kflow.wpscdn.cn\n kingsoft.com\n kingsoftstore.com\n klogin.wps.cn\n km.kdocs.cn\n kmsg.wps.cn\n knobo.wps.cn\n kos.wps.cn\n kot-pictures.wps.cn\n kpay-ff.wps.com\n kpay-jp.wps.com\n kpay-mb.wps.com\n kpay-ru.wps.com\n kpay-sg.wps.com\n kpay-us.wps.com\n kpay.wps.com\n kps.wps.cn\n ks3-cn-beijing.ksyun.com\n ks3-cn-beijing.ksyuncs.com\n ks3.wpscdn.cn\n ksc-bj.ag.kdocs.cn\n ksgec-test.wps.com\n ksgec.wps.com\n ksoepproofread.wps.cn\n ksoproofread.wps.cn\n ksopushapi.wps.cn\n ksord.com\n ksosoft.com\n kss.ksyun.com\n kstatus.wps.cn\n ksyun.com\n ksyuncs.com\n kuc.wps.cn\n kup.wps.cn\n kvas-api.wps.cn\n learning.u.wpscdn.cn\n library-wps.lnep.net\n lingxi.wps.cn\n linux.wps.cn\n llm-api.kas.wps.cn\n local.wps.cn\n local.wps.com\n localhost.wbridge.wps.cn\n login-b.wps.cn\n login.psvr.wps.cn\n login.wps.cn\n login.wpscdn.cn\n logintcp.wps.cn\n logintcpnv.wps.cn\n logo.verisign.com\n mac.wps.cn\n mac.wps.com\n mac.wpscdn.cn\n mb.wps.com\n md.wpscdn.cn\n meeting.kdocs.cn\n meeting.wps.cn\n meeting.wps.com\n meihua-service.ks3-cn-beijing.ksyun.com\n memtest86.com\n micro.api.wps.com\n microsoft.com\n mini.cache.wps.cn\n mini.wps.cn\n mission.u.wps.cn\n mo.wps.cn\n moapi.wps..cn\n moapi.wps.cn\n mob.wps.cn\n mobapp-api.wps.cn\n modou.wps.cn\n modouks.wps.cn\n moni-wps.chuangkit.com\n movip.wps.com\n msg.psvr.wps.cn\n msgcenter.wps.cn\n msgpush.wps.cn\n ncre.u.wps.cn\n newdoc.docer.wps.cn\n note-api.wps.cn\n note.wps.cn\n notebox.wps.cn\n notice.wps.cn\n ns.adobe.com\n nsis.sf.net\n o.wpsgo.com\n office.wps.com\n official-package.wpscdn.cn\n ok.kdocs.cn\n ones.wps.cn\n online.ksosoft.com\n op.wpscdn.cn\n open-mob.wps.cn\n open-mobapp-api.wps.cn\n open.docer.wps.cn\n open.wps.cn\n openapi-dev-test.wps.cn\n openapi.wps.cn\n openapp.wpscdn.cn\n openapptest.wpscdn.cn\n openssl.org\n openxmlformats.org\n overseas.ag.wps.cn\n ovs-shopwindow-server-ff.wps.com\n ovs-shopwindow-server-jp.wps.com\n ovs-shopwindow-server-mb.wps.com\n ovs-shopwindow-server-ru.wps.com\n ovs-shopwindow-server-sg.wps.com\n ovs-shopwindow-server-us.wps.com\n ovs-shopwindow-server.wps.com\n p.kdocs.cn\n p3p.sogou.com\n p3pping.sogou.com\n pacakge.cache.wpscdn.cn\n package.mac.wpscdn.cn\n package.wpscdn.cn\n pan.wps.cn\n papocket.com\n param-us.wps.com\n params.wps.com\n pay.wps.cn\n pbtest.wps.cn\n pc-diffpack.wps.cn\n pc-hamlet.ksord.com\n pc-plugin-1.wpscdn.cn\n pc-plugin-2.wpscdn.cn\n pc-plugin-3.wpscdn.cn\n pc-plugin-personal.wpscdn.cn\n pc-plugin-plg.wpscdn.cn\n pc-plugin-v3.wpscdn.cn\n pc-plugin.wpscdn.cn\n pc-serv.wps.com\n pc.ksord.com\n pc.uid.ksosoft.com\n pc.wps.cn\n pcdiffpack.psvr.wps.cn\n pcfg.cache.wpscdn.cn\n pcfg.cache.wpscdn.com\n pcfg.wps.cn\n pcv-test.wps.cn\n pcv.wps.cn\n pdf.wps.cn\n pdf.wps.com\n pdf2word.wps.cn\n pdf2wordbackup1.wps.cn\n pdfbackup1.wps.cn\n pendant.docer.wps.cn\n permits-ff.wps.com\n permits-jp.wps.com\n permits-mb.wps.com\n permits-ru.wps.com\n permits-sg.wps.com\n permits-us.wps.com\n permits.wps.com\n personal-act.wps.cn\n personal-act.wpscdn.cn\n personal-ai-bus.kdocs.cn\n personal-ai-bus.wps.cn\n personal-bus.wps.cn\n personal-volc.wpscdn.cn\n personal-volc.wpscdn.com\n personal-web.kdocs.cn\n personal-web.wps.cn\n personal.local.wps.cn\n personal.local.wps.com\n personal.wpscdn.cn\n phapi.wps.cn\n pictures.wps.cn\n ping.acc.sogou.com\n pinyin.sogou.com\n platform.wps.cn\n plg.cache.wpscdn.cn\n plg.wpscdn.cn\n plugin-1.wpscdn.cn\n plugin-2.wpscdn.cn\n plugin-3.wpscdn.cn\n plugin-personal.wpscdn.cn\n plugin-plg.wpscdn.cn\n plugin-v3.wpscdn.cn\n plugin.wpscdn.cn\n plugins-1.wpscdn.cn\n plugins-2.wpscdn.cn\n plugins-3.wpscdn.cn\n plugins.wps.cn\n plugins.wpscdn.cn\n plus.wps.cn\n plus.wps.com\n plussvr.wps.cn\n plussvr.wps.com\n pocket.wps.cn\n point.wps.cn\n precise.ksord.com\n print.wps.cn\n printer.wps.cn\n privacy.wps.cn\n processon.com\n prod.cache.wpscdn.com\n proofread.wps.cn\n psu.wps.cn\n psvr.wps.cn\n pub-api.kdocs.cn\n pub-api.wps.cn\n pub.wpscdn.cn\n public.wpscdn.cn\n push.psvr.wps.cn\n push.wps.cn\n qa.wps.cn\n qdyn.kingsoftstore.com\n qing.wps.cn\n qingcenter.wps.cn\n qingqiu.wps.cn\n qn.cache.wpscdn.cn\n qpush.wps.cn\n qr.wps.cn\n rec.ksord.com\n remote.wps.cn\n remote.wps.com\n res-honeycomb.wpscdn.cn\n resume-web.docer.wps.cn\n rili.wps.cn\n roaming.wps.cn\n rt.wps.cn\n ru-account.wps.com\n ru-calendar.wps.com\n ru-drive.wps.com\n ru-plus.wps.com\n ru-plussvr.wps.com\n ru-securitydoc.wps.com\n ru-store.wps.com\n ru-tiance.wps.com\n ru-work.wps.com\n ru.docs.wps.com\n ru.wps.com\n rubik.wps.cn\n s.wps.cn\n s.wps.com\n s1.vip.wpscdn.cn\n s2.vip.wpscdn.cn\n s3.vip.wpscdn.cn\n s4.vip.wpscdn.cn\n s5.vip.wpscdn.cn\n s6.vip.wpscdn.cn\n schemas.openxmlformats.org\n sdk.ai.wpscdn.cn\n securitydoc.wps.cn\n securitydoc.wps.com\n serv.wps.com\n server-ff.wps.com\n server-jp.wps.com\n server-mb.wps.com\n server-ru.wps.com\n server-sg.wps.com\n server-us.wps.com\n server.wps.com\n service.ks3-cn-beijing.ksyun.com\n seti-ai.wps.com\n seti.jimo.wps.cn\n seti.wps.cn\n sg-account.wps.com\n sg-calendar.wps.com\n sg-drive.wps.com\n sg-plus.wps.com\n sg-plussvr.wps.com\n sg-securitydoc.wps.com\n sg-store.wps.com\n sg-tiance.wps.com\n sg-work.wps.com\n sg.docs.wps.com\n sg.wps.com\n shared-https.ydstatic.com\n sharefolder.wps.cn\n shopwindow-server-ff.wps.com\n shopwindow-server-jp.wps.com\n shopwindow-server-mb.wps.com\n shopwindow-server-ru.wps.com\n shopwindow-server-sg.wps.com\n shopwindow-server-us.wps.com\n shopwindow-server.wps.com\n shuc-pc-hamlet.ksord.com\n shuc-pc.ksord.com\n skin.docer.wps.cn\n skin.wps.cn\n so.wps.cn\n softbus-Device.wps.cn\n sogou.com\n spa.wps.cn\n sr-public.wpscdn.cn\n ssssssssssssssshuc-pc-hamlet.ksord.com\n st.wps.cn\n static.ai.wpscdn.cn\n static.wpscdn.cn\n store.wps.cn\n store.wps.com\n storechain-gen.wps.cn\n suji.wps.cn\n svc.modou.wps.cn\n switch.pcfg.cache.wpscdn.cn\n t.wpscdn.cn\n tastenew.wps.cn\n tb.sogou.com\n template-test.wps.com\n template.cache.wps.cn\n template.wps.com\n test.wps.cn\n test.wps.com\n tiance.wps.cn\n tiance.wps.com\n time.windows.com\n tj.psvr.wps.cn\n todo.wps.cn\n tools.docer.wps.cn\n topscan.com\n transferhelper.wps.cn\n translate.iciba.com\n translate.wps.com\n translation.psvr.wps.cn\n tv.wps.cn\n tvpxy.wps.cn\n u.wps.cn\n u.wpscdn.cn\n uc.wps.com\n udesk.cn\n uf-api6-client.ksord.com\n uf-api6.ksord.com\n uf-bigsearch.ksord.com\n uid.ksosoft.com\n update-dev.wps.cn\n update.kingsoftstore.com\n update.wps.cn\n update.wpscdn.cn\n updatepro.wps.cn\n us-account.wps.com\n us-calendar.wps.com\n us-drive.wps.com\n us-plus.wps.com\n us-plussvr.wps.com\n us-securitydoc.wps.com\n us-store.wps.com\n us-tiance.wps.com\n us-work.wps.com\n us.docs.wps.com\n us.wps.com\n ut.psvr.wps.cn\n v3.wpscdn.cn\n vaf.wps.cn\n vas.wps.cn\n vas.wpscdn.cn\n vas2c-spa.wps.cn\n vas2t-api.wps.cn\n vas2t-spa.wps.cn\n vasapi.wps.cn\n vasdc.wps.cn\n vasvip-pub.wpscdn.cn\n verisign.com\n vip-rec.ksord.com\n vip.wps.cn\n vip.wps.com\n vip.wpscdn.cn\n vipapi.wps.cn\n volc.wpscdn.cn\n volc.wpscdn.com\n waas.wps.cn\n wbridge.wps.cn\n wdl.cache.wpscdn.cn\n wdl1.cache.wps.cn\n wdl1.file.cache.docer.com\n wdl1.pcfg.cache.wpscdn.com\n web-param-us.wps.com\n web.docer.wps.cn\n web.kdocs.cn\n web.wps.cn\n web1.file.cache.docer.com\n website-prod.cache.wpscdn.com\n wiki.kdocs.cn\n wiki.wps.cn\n windows.com\n woa.wps.cn\n work.wps.cn\n work.wps.com\n wppai-client.ks3-cn-beijing.ksyuncs.com\n wps-cdn-docer.ks3-cn-beijing.ksyuncs.com\n wps-ncre.u.wps.cn\n wps-translate.wps.com\n wps.chuangkit.com\n wps.kingsoft.com\n wps.kss.ksyun.com\n wps.lnep.net\n wps.md.wpscdn.cn\n wps.processon.com\n wps.udesk.cn\n wpscdn.cn\n wpscdn.com\n wpsgo.com\n wpsmail.net\n wpsplus.com\n wpsthumb.processon.com\n wwo.wps.cn\n www.baidu.com\n www.digicert.com\n www.iciba.com\n www.kdocs.cn\n www.kingsoft.com\n www.ksyun.com\n www.memtest86.com\n www.microsoft.com\n www.processon.com\n www.sogou.com\n www.topscan.com\n www.verisign.com\n www.w3.org\n www.wps.cn\n www.wps.com\n xctrl.wps.cn\n xz.wps.cn\n ydstatic.com\n youraddr.com\n yun.qwps.cn\n yun.wps.cn\n yun.wpscdn.cn\n yunbiz.wps.cn\n yunbizcdn.wpscdn.cn\n zt.wps.cn\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to MD5\n Uses constants related to SHA1\n Uses constants related to SHA256\n Uses constants related to SHA512\n Uses constants related to AES\n Uses constants related to Blowfish\n Uses known Diffie-Helman primes\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n Can access the registry:\n RegEnumValueW\n RegEnumKeyW\n RegQueryValueExW\n RegSetValueExW\n RegCloseKey\n RegDeleteValueW\n RegDeleteKeyW\n RegOpenKeyExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 44540380 bytes of data starting at offset 0x1a600.\n The overlay data has an entropy of 7.06906 and is possibly compressed or encrypted.\n Overlay data amounts for 99.758% of the executable.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 54759\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.99126\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4963\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94256\n Detected Filetype: PNG graphic file\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3229\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.92937\n Detected Filetype: PNG graphic file\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2522\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.89211\n Detected Filetype: PNG graphic file\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1681\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.80893\n Detected Filetype: PNG graphic file\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.76178\n Detected Filetype: PNG graphic file\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 918\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.68659\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 665\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.51668\n Detected Filetype: PNG graphic file\n\n111:\n Type: RT_DIALOG\n Language: English - United States\n Codepage: UNKNOWN\n Size: 96\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.48825\n\n103:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 118\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.00469\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 828\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.3639\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 841\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.2878\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00000000\n FileVersion: 22602.213.1.0\n ProductVersion: 22602.213.1.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Store Installer\n FileVersion (#2): 22602.213.1.0\n InternalName: Store Installer\n LegalCopyright: ? Microsoft Corporation. All rights reserved.\n OriginalFilename: StoreInstaller.exe\n ProductName: Store Installer\n ProductVersion (#2): 22602.213.1.0\n\n\nRICH Header:\nXOR Key: 0xD24E50E9\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 163\nImports (VS2003 (.NET) build 4035): 15\n48 (9044): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 8.0\n MASM/TASM - sig1(h)\n MSVC++ v.8 (procedure 1 recognized - h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n Rundll32.exe\n regsvr32.exe\n sc.exe\n Contains references to internet browsers:\n Chrome.exe\n chrome.exe\n iexplore.exe\n Contains references to security software:\n qqpcrtp.exe\n qqpctray.exe\n Tries to detect virtualized environments:\n HARDWARE\\DESCRIPTION\\System\n Looks for VMWare presence:\n 00-50-56\n May have dropper capabilities:\n %TEMP%\n CurrentControlSet\\Services\n CurrentControlSet\\services\n Accesses the WMI:\n ROOT\\CIMV2\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n .sogou.com\n .sohu.com\n .soso.com\n .vip.wpscdn.cn\n 1-roaming.wps.cn\n 1.kss.ksyun.com\n 1.vip.wpscdn.cn\n 1.wpscdn.cn\n 2-aia.verisign.com\n 2-crl.verisign.com\n 2.wpscdn.cn\n 2009-2-aia.verisign.com\n 2009-2-crl.verisign.com\n 2c-precise.ksord.com\n 3.wpscdn.cn\n Device.wps.cn\n Sogou.com\n abroadad.cache.wpscdn.com\n acc.sogou.com\n account.wps.cn\n account.wps.com\n act.u.wps.cn\n act.wps.cn\n act.wpscdn.cn\n activate-jp.wps.com\n activity.wps.com\n adm.wps.cn\n admin-vip.wps.cn\n adobe.com\n ag.kdocs.cn\n ag.wps.cn\n agents.wps.cn\n ai-bus.kdocs.cn\n ai-bus.wps.cn\n ai-eu.wps.com\n ai-generator-dimension.wpscdn.cn\n ai-in.wps.com\n ai-jp.wps.com\n ai-kae.wps.cn\n ai-ru.wps.com\n ai-sg.wps.com\n ai-us.wps.com\n ai.jimo.wps.cn\n ai.kingsoft.com\n ai.wps.cn\n ai.wps.com\n ai.wpscdn.cn\n aia.verisign.com\n aibeautify.wps.com\n aiblacktech.wps.cn\n aidocs.local.wps.cn\n aidocs.wps.cn\n aippt.wps.cn\n aitest.wps.cn\n aiwrite.wps.cn\n android.wps.cn\n api-b.wps.cn\n api-eu.wps.com\n api-filesys.wps.cn\n api-in.wps.com\n api-jp.wps.com\n api-push.wps.cn\n api-ru.wps.com\n api-sg.wps.com\n api-us.wps.com\n api-web-param-us.wps.com\n api-xctrl.wps.cn\n api.ai.kingsoft.com\n api.kas.wps.cn\n api.kdocs.cn\n api.modou.wps.cn\n api.papocket.com\n api.vas.wpscdn.cn\n api.wps.cn\n api.wps.com\n api.wpscdn.cn\n api6-client.ksord.com\n api6.ksord.com\n app.wpscdn.cn\n apph.wpsmail.net\n b.wps.cn\n baidu.com\n bbs.wps.cn\n beijing.ksyun.com\n beijing.ksyuncs.com\n bigsearch.ksord.com\n biz.wps.cn\n bj-overseas.ag.wps.cn\n bj.ag.kdocs.cn\n bus.kdocs.cn\n bus.wps.cn\n c.wps.cn\n cacerts.digicert.com\n cache.docer.com\n cache.wps.cn\n cache.wpscdn.cn\n cache.wpscdn.com\n caiji-web.docer.wps.cn\n calendar.wps.com\n ccrpc.wps.cn\n cdb.wps.cn\n cdn-docer.ks3-cn-beijing.ksyuncs.com\n cfgver.skin.wps.cn\n chn.docer.com\n chuangkit.com\n cl-act.u.wps.cn\n client.ks3-cn-beijing.ksyuncs.com\n client.ksord.com\n clientweb.docer.wps.cn\n cloud-doc.wps.cn\n cloud.u.wps.cn\n clouddoc.wps.cn\n cloudform-waas.wps.cn\n cloudnotify.wps.cn\n cn-beijing.ksyun.com\n cn-beijing.ksyuncs.com\n cnt.wps.cn\n co.wps.cn\n collect-debug.ksord.com\n conf.psvr.wps.cn\n contact.wps.cn\n coop-contact.wps.cn\n copilot-api-b.wps.cn\n copilot-api.wps.cn\n copilot-login-b.wps.cn\n copilot-login.wps.cn\n cp.wps.cn\n crl.microsoft.com\n crl.verisign.com\n crl3.digicert.com\n crl4.digicert.com\n csc3-2009-2-aia.verisign.com\n csc3-2009-2-crl.verisign.com\n cunzheng.wps.cn\n d.wps.cn\n dapi.wps.cn\n dbs.wps.cn\n dcapi-eu.wps.com\n dcapi-jp.wps.com\n dcapi-ru.wps.com\n dcapi-sg.wps.com\n dcapi-us.wps.com\n dcapi.wps.cn\n dcapi.wps.com\n dcapi2.wps.cn\n dcapi3.wps.cn\n dcapii18n.wps.com\n dce-gateway.docer.wps.cn\n debug.ksord.com\n dev-test.wps.cn\n dev.wps.cn\n deviceapi.wps.cn\n diffpack.wps.cn\n digicert.com\n dimension.wpscdn.cn\n discuss.wps.cn\n dl.op.wpscdn.cn\n dl.vas.wpscdn.cn\n dl.wps.md.wpscdn.cn\n doc-discuss.wps.cn\n doc.wps.cn\n docer-api.kdocs.cn\n docer-api.wps.cn\n docer-api.wps.com\n docer-api.wpscdn.cn\n docer-files.wpscdn.cn\n docer-kdocs.wps.cn\n docer-ks3.wpscdn.cn\n docer.com\n docer.kdocs.cn\n docer.ks3-cn-beijing.ksyuncs.com\n docer.wps.cn\n docer.wpscdn.cn\n docerad.wps.cn\n docerserver.wps.cn\n docs-dapi.wps.cn\n docs.wps.cn\n docs.wps.com\n docteamapi.wps.cn\n download.iciba.com\n downloader.wps.cn\n dpr.wps.cn\n drive.kdocs.cn\n drive.wps.cn\n drive.wps.com\n dw-collect-debug.ksord.com\n dw-online.ksosoft.com\n dw.ksosoft.com\n dwz.wps.cn\n dynamicedu.wps.cn\n easy.wps.cn\n edu.wps.cn\n education-web.docer.wps.cn\n email.wps.cn\n emergency.wps.cn\n emergency.wpscdn.cn\n et.local.wps.cn\n et.local.wps.com\n eu-account.wps.com\n eu-calendar.wps.com\n eu-drive.wps.com\n eu-plus.wps.com\n eu-plussvr.wps.com\n eu-securitydoc.wps.com\n eu-store.wps.com\n eu-tiance.wps.com\n eu-work.wps.com\n eu.docs.wps.com\n eu.wps.com\n event.user.info\n event.wps.com\n ewb.wps.cn\n example.com\n f.kdocs.cn\n f.wps.cn\n face-api.wps.cn\n fe-static.wpscdn.cn\n feed-gw.wps.cn\n feedback-office.wps.com\n feedback.wps.cn\n feedback.wps.com\n ff.wps.com\n file.cache.docer.com\n fileoperate.wps.cn\n files.wpscdn.cn\n filesys.wps.cn\n flow.wps.cn\n flowvip.wps.cn\n fonts.cache.wps.cn\n fonts.wps.cn\n fy.iciba.com\n gateway.docer.wps.cn\n gen.wps.cn\n generator-dimension.wpscdn.cn\n get.sogou.com\n get.wps.cn\n global-volc.wpscdn.cn\n global-volc.wpscdn.com\n global.local.wps.cn\n global.local.wps.com\n global.wps.com\n go.wps.cn\n gw.wps.cn\n h5.mini.wps.cn\n hamlet.ksord.com\n hao.wps.cn\n hd.wps.cn\n help.wps.com\n helpdesk.wps.cn\n hetong.wps.cn\n home.wps.cn\n honeycomb-adm.wps.cn\n honeycomb-emergency.wps.cn\n honeycomb-emergency.wpscdn.cn\n honeycomb-openapi-dev-test.wps.cn\n honeycomb-plugins-1.wpscdn.cn\n honeycomb-plugins-2.wpscdn.cn\n honeycomb-plugins-3.wpscdn.cn\n honeycomb-plugins.wps.cn\n honeycomb-plugins.wpscdn.cn\n honeycomb-sr-public.wpscdn.cn\n honeycomb.wps.cn\n honeycomb.wpscdn.cn\n hoplink.wps.cn\n hr.wpscdn.cn\n http://cacerts.digicert.com\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E\n http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_\n http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C\n http://crl.microsoft.com\n http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0\n http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z\n http://crl.verisign.com\n http://crl.verisign.com/ThawteTimestampingCA.crl0\n http://crl.verisign.com/pca3.crl0\n http://crl.verisign.com/tss-ca.crl0\n http://crl3.digicert.com\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O\n http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\n http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0\n http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0\n http://crl3.digicert.com/DigiCertTrustedRootG4.crl0\n http://crl3.digicert.com/sha2-assured-cs-g1.crl05\n http://crl4.digicert.com\n http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\n http://crl4.digicert.com/sha2-assured-cs-g1.crl0K\n http://csc3-2009-2-aia.verisign.com\n http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0\n http://csc3-2009-2-crl.verisign.com\n http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0D\n http://ime.sogou.com\n http://ime.sogou.com/up.gif\n http://ime.sogou.com/version.txt\n http://logo.verisign.com\n http://logo.verisign.com/vslogo.gif0\n http://ns.adobe.com\n http://ns.adobe.com/exif/1.0/\n http://ns.adobe.com/photoshop/1.0/\n http://ns.adobe.com/tiff/1.0/\n http://ns.adobe.com/xap/1.0/\n http://ns.adobe.com/xap/1.0/mm/\n http://ns.adobe.com/xap/1.0/sType/ResourceEvent#\n http://ns.adobe.com/xap/1.0/sType/ResourceRef#\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n http://ocsp.digicert.com0\n http://ocsp.digicert.com0A\n http://ocsp.digicert.com0C\n http://ocsp.digicert.com0N\n http://ocsp.digicert.com0X\n http://ocsp.digicert.com0\\\n http://ocsp.verisign.com0\n http://ocsp.verisign.com01\n http://ocsp.verisign.com0?\n http://p3pping.sogou.com\n http://ping.acc.sogou.com\n http://ping.acc.sogou.com/sogoupydic.gif?h\n http://pinyin.sogou.com\n http://pinyin.sogou.com/0\n http://purl.org\n http://schemas.openxmlformats.org\n http://schemas.openxmlformats.org/drawingml/2006/diagram\n http://schemas.openxmlformats.org/drawingml/2006/main\n http://schemas.openxmlformats.org/officeDocument/2006/relationships\n http://sogou.com\n http://sohu.com\n http://soso.com\n http://tb.sogou.com\n http://tb.sogou.com/\n http://wps.cn\n http://www.baidu.com\n http://www.baidu.com/robots.txt\n http://www.digicert.com\n http://www.digicert.com/CPS0\n http://www.microsoft.com\n http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0\n http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0\n http://www.microsoft.com/pkiops/Docs/Repository.htm0\n http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0\n http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010\n http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a\n http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010\n http://www.microsoft.com/pkiops/docs/primarycps.htm0\n http://www.w3.org\n http://www.w3.org/1999/02/22-rdf-syntax-ns#\n http://www.w3.org/1999/xlink\n http://www.w3.org/2000/svg\n http://www.w3.org/2001/XMLSchema-instance\n https.ydstatic.com\n https://curl.se\n https://docer.com\n https://fe-static.wpscdn.cn\n https://fe-static.wpscdn.cn/apm_sdk_proxy/client-wps-pc.entry.v2.min.js'\n https://fe-static.wpscdn.cn/apm_sdk_proxy/client-wps-pc.entry.v2.min.js?appId\n https://get.sogou.com\n https://get.sogou.com/q\n https://honeycomb-plugins.wps.cn\n https://honeycomb-plugins.wpscdn.cn\n https://ime.sogou.com\n https://ime.sogou.com/pyup.gif?\n https://js1.pcfg.cache.wpscdn.cn\n https://js1.pcfg.cache.wpscdn.cn/wps_statics/wps_web_apm/client-wps-pc.entry.v1.min.js\n https://kdocs.cn\n https://learning.u.wpscdn.cn\n https://learning.u.wpscdn.cn/config/json/academy/cloud_edu_url_default2\n https://personal-ai-bus.wps.cn\n https://qwps.com\n https://shared-https.ydstatic.com\n https://shared-https.ydstatic.com/images/favicon.ico\n https://wps.cn\n https://wps.com\n https://wpsplus.com\n https://www.digicert.com\n https://www.digicert.com/CPS0\n https://www.microsoft.com\n https://www.verisign.com\n https://www.verisign.com/cps0\n https://www.verisign.com/rpa\n https://www.verisign.com/rpa0\n hw.wdl.cache.wpscdn.cn\n hwc-bj-overseas.ag.wps.cn\n i.wps.cn\n i18n.wps.cn\n ic-proofread.wps.cn\n icdcapi.wps.cn\n iciba.com\n idle.wpscdn.cn\n ifanyi.iciba.com\n imapi.docer.wpscdn.cn\n ime.sogou.com\n img.qwps.cn\n img1.mini.cache.wps.cn\n img1.pcfg.cache.wpscdn.cn\n img1.template.cache.wps.cn\n img2.fonts.cache.wps.cn\n img7.file.cache.docer.com\n in-account.wps.com\n in-calendar.wps.com\n in-drive.wps.com\n in-plus.wps.com\n in-plussvr.wps.com\n in-securitydoc.wps.com\n in-store.wps.com\n in-tiance.wps.com\n in-work.wps.com\n in.docs.wps.com\n in.wps.com\n info.kingsoftstore.com\n insp.wps.cn\n intl-ippt.wps.com\n ios.wps.cn\n iospush.wps.cn\n ippt.wps.cn\n ippt.wps.com\n jimo.wps.cn\n jp-account.wps.com\n jp-calendar.wps.com\n jp-drive.wps.com\n jp-plus.wps.com\n jp-plussvr.wps.com\n jp-securitydoc.wps.com\n jp-store.wps.com\n jp-tiance.wps.com\n jp-work.wps.com\n jp.docs.wps.com\n jp.wps.com\n js1.pcfg.cache.wpscdn.cn\n jump.wps.cn\n kad.www.wps.cn\n kae.wps.cn\n kas.wps.cn\n kbee.wps.cn\n kblog.wps.cn\n kdocs-vas.wpscdn.cn\n kdocs.cn\n kdocs.wps.cn\n kflow-idle.wpscdn.cn\n kflow-rt.wps.cn\n kflow.wps.cn\n kflow.wpscdn.cn\n kingsoft.com\n kingsoftstore.com\n klogin.wps.cn\n km.kdocs.cn\n kmsg.wps.cn\n knobo.wps.cn\n kos.wps.cn\n kot-pictures.wps.cn\n kpay-ff.wps.com\n kpay-jp.wps.com\n kpay-mb.wps.com\n kpay-ru.wps.com\n kpay-sg.wps.com\n kpay-us.wps.com\n kpay.wps.com\n kps.wps.cn\n ks3-cn-beijing.ksyun.com\n ks3-cn-beijing.ksyuncs.com\n ks3.wpscdn.cn\n ksc-bj.ag.kdocs.cn\n ksgec-test.wps.com\n ksgec.wps.com\n ksoepproofread.wps.cn\n ksoproofread.wps.cn\n ksopushapi.wps.cn\n ksord.com\n ksosoft.com\n kss.ksyun.com\n kstatus.wps.cn\n ksyun.com\n ksyuncs.com\n kuc.wps.cn\n kup.wps.cn\n kvas-api.wps.cn\n learning.u.wpscdn.cn\n library-wps.lnep.net\n lingxi.wps.cn\n linux.wps.cn\n llm-api.kas.wps.cn\n local.wps.cn\n local.wps.com\n localhost.wbridge.wps.cn\n login-b.wps.cn\n login.psvr.wps.cn\n login.wps.cn\n login.wpscdn.cn\n logintcp.wps.cn\n logintcpnv.wps.cn\n logo.verisign.com\n mac.wps.cn\n mac.wps.com\n mac.wpscdn.cn\n mb.wps.com\n md.wpscdn.cn\n meeting.kdocs.cn\n meeting.wps.cn\n meeting.wps.com\n meihua-service.ks3-cn-beijing.ksyun.com\n memtest86.com\n micro.api.wps.com\n microsoft.com\n mini.cache.wps.cn\n mini.wps.cn\n mission.u.wps.cn\n mo.wps.cn\n moapi.wps..cn\n moapi.wps.cn\n mob.wps.cn\n mobapp-api.wps.cn\n modou.wps.cn\n modouks.wps.cn\n moni-wps.chuangkit.com\n movip.wps.com\n msg.psvr.wps.cn\n msgcenter.wps.cn\n msgpush.wps.cn\n ncre.u.wps.cn\n newdoc.docer.wps.cn\n note-api.wps.cn\n note.wps.cn\n notebox.wps.cn\n notice.wps.cn\n ns.adobe.com\n nsis.sf.net\n o.wpsgo.com\n office.wps.com\n official-package.wpscdn.cn\n ok.kdocs.cn\n ones.wps.cn\n online.ksosoft.com\n op.wpscdn.cn\n open-mob.wps.cn\n open-mobapp-api.wps.cn\n open.docer.wps.cn\n open.wps.cn\n openapi-dev-test.wps.cn\n openapi.wps.cn\n openapp.wpscdn.cn\n openapptest.wpscdn.cn\n openssl.org\n openxmlformats.org\n overseas.ag.wps.cn\n ovs-shopwindow-server-ff.wps.com\n ovs-shopwindow-server-jp.wps.com\n ovs-shopwindow-server-mb.wps.com\n ovs-shopwindow-server-ru.wps.com\n ovs-shopwindow-server-sg.wps.com\n ovs-shopwindow-server-us.wps.com\n ovs-shopwindow-server.wps.com\n p.kdocs.cn\n p3p.sogou.com\n p3pping.sogou.com\n pacakge.cache.wpscdn.cn\n package.mac.wpscdn.cn\n package.wpscdn.cn\n pan.wps.cn\n papocket.com\n param-us.wps.com\n params.wps.com\n pay.wps.cn\n pbtest.wps.cn\n pc-diffpack.wps.cn\n pc-hamlet.ksord.com\n pc-plugin-1.wpscdn.cn\n pc-plugin-2.wpscdn.cn\n pc-plugin-3.wpscdn.cn\n pc-plugin-personal.wpscdn.cn\n pc-plugin-plg.wpscdn.cn\n pc-plugin-v3.wpscdn.cn\n pc-plugin.wpscdn.cn\n pc-serv.wps.com\n pc.ksord.com\n pc.uid.ksosoft.com\n pc.wps.cn\n pcdiffpack.psvr.wps.cn\n pcfg.cache.wpscdn.cn\n pcfg.cache.wpscdn.com\n pcfg.wps.cn\n pcv-test.wps.cn\n pcv.wps.cn\n pdf.wps.cn\n pdf.wps.com\n pdf2word.wps.cn\n pdf2wordbackup1.wps.cn\n pdfbackup1.wps.cn\n pendant.docer.wps.cn\n permits-ff.wps.com\n permits-jp.wps.com\n permits-mb.wps.com\n permits-ru.wps.com\n permits-sg.wps.com\n permits-us.wps.com\n permits.wps.com\n personal-act.wps.cn\n personal-act.wpscdn.cn\n personal-ai-bus.kdocs.cn\n personal-ai-bus.wps.cn\n personal-bus.wps.cn\n personal-volc.wpscdn.cn\n personal-volc.wpscdn.com\n personal-web.kdocs.cn\n personal-web.wps.cn\n personal.local.wps.cn\n personal.local.wps.com\n personal.wpscdn.cn\n phapi.wps.cn\n pictures.wps.cn\n ping.acc.sogou.com\n pinyin.sogou.com\n platform.wps.cn\n plg.cache.wpscdn.cn\n plg.wpscdn.cn\n plugin-1.wpscdn.cn\n plugin-2.wpscdn.cn\n plugin-3.wpscdn.cn\n plugin-personal.wpscdn.cn\n plugin-plg.wpscdn.cn\n plugin-v3.wpscdn.cn\n plugin.wpscdn.cn\n plugins-1.wpscdn.cn\n plugins-2.wpscdn.cn\n plugins-3.wpscdn.cn\n plugins.wps.cn\n plugins.wpscdn.cn\n plus.wps.cn\n plus.wps.com\n plussvr.wps.cn\n plussvr.wps.com\n pocket.wps.cn\n point.wps.cn\n precise.ksord.com\n print.wps.cn\n printer.wps.cn\n privacy.wps.cn\n processon.com\n prod.cache.wpscdn.com\n proofread.wps.cn\n psu.wps.cn\n psvr.wps.cn\n pub-api.kdocs.cn\n pub-api.wps.cn\n pub.wpscdn.cn\n public.wpscdn.cn\n push.psvr.wps.cn\n push.wps.cn\n qa.wps.cn\n qdyn.kingsoftstore.com\n qing.wps.cn\n qingcenter.wps.cn\n qingqiu.wps.cn\n qn.cache.wpscdn.cn\n qpush.wps.cn\n qr.wps.cn\n rec.ksord.com\n remote.wps.cn\n remote.wps.com\n res-honeycomb.wpscdn.cn\n resume-web.docer.wps.cn\n rili.wps.cn\n roaming.wps.cn\n rt.wps.cn\n ru-account.wps.com\n ru-calendar.wps.com\n ru-drive.wps.com\n ru-plus.wps.com\n ru-plussvr.wps.com\n ru-securitydoc.wps.com\n ru-store.wps.com\n ru-tiance.wps.com\n ru-work.wps.com\n ru.docs.wps.com\n ru.wps.com\n rubik.wps.cn\n s.wps.cn\n s.wps.com\n s1.vip.wpscdn.cn\n s2.vip.wpscdn.cn\n s3.vip.wpscdn.cn\n s4.vip.wpscdn.cn\n s5.vip.wpscdn.cn\n s6.vip.wpscdn.cn\n schemas.openxmlformats.org\n sdk.ai.wpscdn.cn\n securitydoc.wps.cn\n securitydoc.wps.com\n serv.wps.com\n server-ff.wps.com\n server-jp.wps.com\n server-mb.wps.com\n server-ru.wps.com\n server-sg.wps.com\n server-us.wps.com\n server.wps.com\n service.ks3-cn-beijing.ksyun.com\n seti-ai.wps.com\n seti.jimo.wps.cn\n seti.wps.cn\n sg-account.wps.com\n sg-calendar.wps.com\n sg-drive.wps.com\n sg-plus.wps.com\n sg-plussvr.wps.com\n sg-securitydoc.wps.com\n sg-store.wps.com\n sg-tiance.wps.com\n sg-work.wps.com\n sg.docs.wps.com\n sg.wps.com\n shared-https.ydstatic.com\n sharefolder.wps.cn\n shopwindow-server-ff.wps.com\n shopwindow-server-jp.wps.com\n shopwindow-server-mb.wps.com\n shopwindow-server-ru.wps.com\n shopwindow-server-sg.wps.com\n shopwindow-server-us.wps.com\n shopwindow-server.wps.com\n shuc-pc-hamlet.ksord.com\n shuc-pc.ksord.com\n skin.docer.wps.cn\n skin.wps.cn\n so.wps.cn\n softbus-Device.wps.cn\n sogou.com\n spa.wps.cn\n sr-public.wpscdn.cn\n ssssssssssssssshuc-pc-hamlet.ksord.com\n st.wps.cn\n static.ai.wpscdn.cn\n static.wpscdn.cn\n store.wps.cn\n store.wps.com\n storechain-gen.wps.cn\n suji.wps.cn\n svc.modou.wps.cn\n switch.pcfg.cache.wpscdn.cn\n t.wpscdn.cn\n tastenew.wps.cn\n tb.sogou.com\n template-test.wps.com\n template.cache.wps.cn\n template.wps.com\n test.wps.cn\n test.wps.com\n tiance.wps.cn\n tiance.wps.com\n time.windows.com\n tj.psvr.wps.cn\n todo.wps.cn\n tools.docer.wps.cn\n topscan.com\n transferhelper.wps.cn\n translate.iciba.com\n translate.wps.com\n translation.psvr.wps.cn\n tv.wps.cn\n tvpxy.wps.cn\n u.wps.cn\n u.wpscdn.cn\n uc.wps.com\n udesk.cn\n uf-api6-client.ksord.com\n uf-api6.ksord.com\n uf-bigsearch.ksord.com\n uid.ksosoft.com\n update-dev.wps.cn\n update.kingsoftstore.com\n update.wps.cn\n update.wpscdn.cn\n updatepro.wps.cn\n us-account.wps.com\n us-calendar.wps.com\n us-drive.wps.com\n us-plus.wps.com\n us-plussvr.wps.com\n us-securitydoc.wps.com\n us-store.wps.com\n us-tiance.wps.com\n us-work.wps.com\n us.docs.wps.com\n us.wps.com\n ut.psvr.wps.cn\n v3.wpscdn.cn\n vaf.wps.cn\n vas.wps.cn\n vas.wpscdn.cn\n vas2c-spa.wps.cn\n vas2t-api.wps.cn\n vas2t-spa.wps.cn\n vasapi.wps.cn\n vasdc.wps.cn\n vasvip-pub.wpscdn.cn\n verisign.com\n vip-rec.ksord.com\n vip.wps.cn\n vip.wps.com\n vip.wpscdn.cn\n vipapi.wps.cn\n volc.wpscdn.cn\n volc.wpscdn.com\n waas.wps.cn\n wbridge.wps.cn\n wdl.cache.wpscdn.cn\n wdl1.cache.wps.cn\n wdl1.file.cache.docer.com\n wdl1.pcfg.cache.wpscdn.com\n web-param-us.wps.com\n web.docer.wps.cn\n web.kdocs.cn\n web.wps.cn\n web1.file.cache.docer.com\n website-prod.cache.wpscdn.com\n wiki.kdocs.cn\n wiki.wps.cn\n windows.com\n woa.wps.cn\n work.wps.cn\n work.wps.com\n wppai-client.ks3-cn-beijing.ksyuncs.com\n wps-cdn-docer.ks3-cn-beijing.ksyuncs.com\n wps-ncre.u.wps.cn\n wps-translate.wps.com\n wps.chuangkit.com\n wps.kingsoft.com\n wps.kss.ksyun.com\n wps.lnep.net\n wps.md.wpscdn.cn\n wps.processon.com\n wps.udesk.cn\n wpscdn.cn\n wpscdn.com\n wpsgo.com\n wpsmail.net\n wpsplus.com\n wpsthumb.processon.com\n wwo.wps.cn\n www.baidu.com\n www.digicert.com\n www.iciba.com\n www.kdocs.cn\n www.kingsoft.com\n www.ksyun.com\n www.memtest86.com\n www.microsoft.com\n www.processon.com\n www.sogou.com\n www.topscan.com\n www.verisign.com\n www.w3.org\n www.wps.cn\n www.wps.com\n xctrl.wps.cn\n xz.wps.cn\n ydstatic.com\n youraddr.com\n yun.qwps.cn\n yun.wps.cn\n yun.wpscdn.cn\n yunbiz.wps.cn\n yunbizcdn.wpscdn.cn\n zt.wps.cn\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to MD5\n Uses constants related to SHA1\n Uses constants related to SHA256\n Uses constants related to SHA512\n Uses constants related to AES\n Uses constants related to Blowfish\n Uses known Diffie-Helman primes\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n Can access the registry:\n RegEnumValueW\n RegEnumKeyW\n RegQueryValueExW\n RegSetValueExW\n RegCloseKey\n RegDeleteValueW\n RegDeleteKeyW\n RegOpenKeyExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 44540380 bytes of data starting at offset 0x1a600.\n The overlay data has an entropy of 7.06906 and is possibly compressed or encrypted.\n Overlay data amounts for 99.758% of the executable.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0xD24E50E9\nUnmarked objects: 0\nC objects (VS2003 (.NET) build 4035): 2\nTotal imports: 163\nImports (VS2003 (.NET) build 4035): 15\n48 (9044): 10\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++ v6.0 DLL\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 8.0\n MASM/TASM - sig1(h)\n MSVC++ v.8 (procedure 1 recognized - h)\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n Rundll32.exe\n regsvr32.exe\n sc.exe\n Contains references to internet browsers:\n Chrome.exe\n chrome.exe\n iexplore.exe\n Contains references to security software:\n qqpcrtp.exe\n qqpctray.exe\n Tries to detect virtualized environments:\n HARDWARE\\DESCRIPTION\\System\n Looks for VMWare presence:\n 00-50-56\n May have dropper capabilities:\n %TEMP%\n CurrentControlSet\\Services\n CurrentControlSet\\services\n Accesses the WMI:\n ROOT\\CIMV2\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n .sogou.com\n .sohu.com\n .soso.com\n .vip.wpscdn.cn\n 1-roaming.wps.cn\n 1.kss.ksyun.com\n 1.vip.wpscdn.cn\n 1.wpscdn.cn\n 2-aia.verisign.com\n 2-crl.verisign.com\n 2.wpscdn.cn\n 2009-2-aia.verisign.com\n 2009-2-crl.verisign.com\n 2c-precise.ksord.com\n 3.wpscdn.cn\n Device.wps.cn\n Sogou.com\n abroadad.cache.wpscdn.com\n acc.sogou.com\n account.wps.cn\n account.wps.com\n act.u.wps.cn\n act.wps.cn\n act.wpscdn.cn\n activate-jp.wps.com\n activity.wps.com\n adm.wps.cn\n admin-vip.wps.cn\n adobe.com\n ag.kdocs.cn\n ag.wps.cn\n agents.wps.cn\n ai-bus.kdocs.cn\n ai-bus.wps.cn\n ai-eu.wps.com\n ai-generator-dimension.wpscdn.cn\n ai-in.wps.com\n ai-jp.wps.com\n ai-kae.wps.cn\n ai-ru.wps.com\n ai-sg.wps.com\n ai-us.wps.com\n ai.jimo.wps.cn\n ai.kingsoft.com\n ai.wps.cn\n ai.wps.com\n ai.wpscdn.cn\n aia.verisign.com\n aibeautify.wps.com\n aiblacktech.wps.cn\n aidocs.local.wps.cn\n aidocs.wps.cn\n aippt.wps.cn\n aitest.wps.cn\n aiwrite.wps.cn\n android.wps.cn\n api-b.wps.cn\n api-eu.wps.com\n api-filesys.wps.cn\n api-in.wps.com\n api-jp.wps.com\n api-push.wps.cn\n api-ru.wps.com\n api-sg.wps.com\n api-us.wps.com\n api-web-param-us.wps.com\n api-xctrl.wps.cn\n api.ai.kingsoft.com\n api.kas.wps.cn\n api.kdocs.cn\n api.modou.wps.cn\n api.papocket.com\n api.vas.wpscdn.cn\n api.wps.cn\n api.wps.com\n api.wpscdn.cn\n api6-client.ksord.com\n api6.ksord.com\n app.wpscdn.cn\n apph.wpsmail.net\n b.wps.cn\n baidu.com\n bbs.wps.cn\n beijing.ksyun.com\n beijing.ksyuncs.com\n bigsearch.ksord.com\n biz.wps.cn\n bj-overseas.ag.wps.cn\n bj.ag.kdocs.cn\n bus.kdocs.cn\n bus.wps.cn\n c.wps.cn\n cacerts.digicert.com\n cache.docer.com\n cache.wps.cn\n cache.wpscdn.cn\n cache.wpscdn.com\n caiji-web.docer.wps.cn\n calendar.wps.com\n ccrpc.wps.cn\n cdb.wps.cn\n cdn-docer.ks3-cn-beijing.ksyuncs.com\n cfgver.skin.wps.cn\n chn.docer.com\n chuangkit.com\n cl-act.u.wps.cn\n client.ks3-cn-beijing.ksyuncs.com\n client.ksord.com\n clientweb.docer.wps.cn\n cloud-doc.wps.cn\n cloud.u.wps.cn\n clouddoc.wps.cn\n cloudform-waas.wps.cn\n cloudnotify.wps.cn\n cn-beijing.ksyun.com\n cn-beijing.ksyuncs.com\n cnt.wps.cn\n co.wps.cn\n collect-debug.ksord.com\n conf.psvr.wps.cn\n contact.wps.cn\n coop-contact.wps.cn\n copilot-api-b.wps.cn\n copilot-api.wps.cn\n copilot-login-b.wps.cn\n copilot-login.wps.cn\n cp.wps.cn\n crl.microsoft.com\n crl.verisign.com\n crl3.digicert.com\n crl4.digicert.com\n csc3-2009-2-aia.verisign.com\n csc3-2009-2-crl.verisign.com\n cunzheng.wps.cn\n d.wps.cn\n dapi.wps.cn\n dbs.wps.cn\n dcapi-eu.wps.com\n dcapi-jp.wps.com\n dcapi-ru.wps.com\n dcapi-sg.wps.com\n dcapi-us.wps.com\n dcapi.wps.cn\n dcapi.wps.com\n dcapi2.wps.cn\n dcapi3.wps.cn\n dcapii18n.wps.com\n dce-gateway.docer.wps.cn\n debug.ksord.com\n dev-test.wps.cn\n dev.wps.cn\n deviceapi.wps.cn\n diffpack.wps.cn\n digicert.com\n dimension.wpscdn.cn\n discuss.wps.cn\n dl.op.wpscdn.cn\n dl.vas.wpscdn.cn\n dl.wps.md.wpscdn.cn\n doc-discuss.wps.cn\n doc.wps.cn\n docer-api.kdocs.cn\n docer-api.wps.cn\n docer-api.wps.com\n docer-api.wpscdn.cn\n docer-files.wpscdn.cn\n docer-kdocs.wps.cn\n docer-ks3.wpscdn.cn\n docer.com\n docer.kdocs.cn\n docer.ks3-cn-beijing.ksyuncs.com\n docer.wps.cn\n docer.wpscdn.cn\n docerad.wps.cn\n docerserver.wps.cn\n docs-dapi.wps.cn\n docs.wps.cn\n docs.wps.com\n docteamapi.wps.cn\n download.iciba.com\n downloader.wps.cn\n dpr.wps.cn\n drive.kdocs.cn\n drive.wps.cn\n drive.wps.com\n dw-collect-debug.ksord.com\n dw-online.ksosoft.com\n dw.ksosoft.com\n dwz.wps.cn\n dynamicedu.wps.cn\n easy.wps.cn\n edu.wps.cn\n education-web.docer.wps.cn\n email.wps.cn\n emergency.wps.cn\n emergency.wpscdn.cn\n et.local.wps.cn\n et.local.wps.com\n eu-account.wps.com\n eu-calendar.wps.com\n eu-drive.wps.com\n eu-plus.wps.com\n eu-plussvr.wps.com\n eu-securitydoc.wps.com\n eu-store.wps.com\n eu-tiance.wps.com\n eu-work.wps.com\n eu.docs.wps.com\n eu.wps.com\n event.user.info\n event.wps.com\n ewb.wps.cn\n example.com\n f.kdocs.cn\n f.wps.cn\n face-api.wps.cn\n fe-static.wpscdn.cn\n feed-gw.wps.cn\n feedback-office.wps.com\n feedback.wps.cn\n feedback.wps.com\n ff.wps.com\n file.cache.docer.com\n fileoperate.wps.cn\n files.wpscdn.cn\n filesys.wps.cn\n flow.wps.cn\n flowvip.wps.cn\n fonts.cache.wps.cn\n fonts.wps.cn\n fy.iciba.com\n gateway.docer.wps.cn\n gen.wps.cn\n generator-dimension.wpscdn.cn\n get.sogou.com\n get.wps.cn\n global-volc.wpscdn.cn\n global-volc.wpscdn.com\n global.local.wps.cn\n global.local.wps.com\n global.wps.com\n go.wps.cn\n gw.wps.cn\n h5.mini.wps.cn\n hamlet.ksord.com\n hao.wps.cn\n hd.wps.cn\n help.wps.com\n helpdesk.wps.cn\n hetong.wps.cn\n home.wps.cn\n honeycomb-adm.wps.cn\n honeycomb-emergency.wps.cn\n honeycomb-emergency.wpscdn.cn\n honeycomb-openapi-dev-test.wps.cn\n honeycomb-plugins-1.wpscdn.cn\n honeycomb-plugins-2.wpscdn.cn\n honeycomb-plugins-3.wpscdn.cn\n honeycomb-plugins.wps.cn\n honeycomb-plugins.wpscdn.cn\n honeycomb-sr-public.wpscdn.cn\n honeycomb.wps.cn\n honeycomb.wpscdn.cn\n hoplink.wps.cn\n hr.wpscdn.cn\n http://cacerts.digicert.com\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0\n http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E\n http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0\n http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_\n http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C\n http://crl.microsoft.com\n http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0\n http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z\n http://crl.verisign.com\n http://crl.verisign.com/ThawteTimestampingCA.crl0\n http://crl.verisign.com/pca3.crl0\n http://crl.verisign.com/tss-ca.crl0\n http://crl3.digicert.com\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O\n http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\n http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0\n http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0\n http://crl3.digicert.com/DigiCertTrustedRootG4.crl0\n http://crl3.digicert.com/sha2-assured-cs-g1.crl05\n http://crl4.digicert.com\n http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0\n http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\n http://crl4.digicert.com/sha2-assured-cs-g1.crl0K\n http://csc3-2009-2-aia.verisign.com\n http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0\n http://csc3-2009-2-crl.verisign.com\n http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0D\n http://ime.sogou.com\n http://ime.sogou.com/up.gif\n http://ime.sogou.com/version.txt\n http://logo.verisign.com\n http://logo.verisign.com/vslogo.gif0\n http://ns.adobe.com\n http://ns.adobe.com/exif/1.0/\n http://ns.adobe.com/photoshop/1.0/\n http://ns.adobe.com/tiff/1.0/\n http://ns.adobe.com/xap/1.0/\n http://ns.adobe.com/xap/1.0/mm/\n http://ns.adobe.com/xap/1.0/sType/ResourceEvent#\n http://ns.adobe.com/xap/1.0/sType/ResourceRef#\n http://nsis.sf.net\n http://nsis.sf.net/NSIS_Error\n http://ocsp.digicert.com0\n http://ocsp.digicert.com0A\n http://ocsp.digicert.com0C\n http://ocsp.digicert.com0N\n http://ocsp.digicert.com0X\n http://ocsp.digicert.com0\\\n http://ocsp.verisign.com0\n http://ocsp.verisign.com01\n http://ocsp.verisign.com0?\n http://p3pping.sogou.com\n http://ping.acc.sogou.com\n http://ping.acc.sogou.com/sogoupydic.gif?h\n http://pinyin.sogou.com\n http://pinyin.sogou.com/0\n http://purl.org\n http://schemas.openxmlformats.org\n http://schemas.openxmlformats.org/drawingml/2006/diagram\n http://schemas.openxmlformats.org/drawingml/2006/main\n http://schemas.openxmlformats.org/officeDocument/2006/relationships\n http://sogou.com\n http://sohu.com\n http://soso.com\n http://tb.sogou.com\n http://tb.sogou.com/\n http://wps.cn\n http://www.baidu.com\n http://www.baidu.com/robots.txt\n http://www.digicert.com\n http://www.digicert.com/CPS0\n http://www.microsoft.com\n http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0\n http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0\n http://www.microsoft.com/pkiops/Docs/Repository.htm0\n http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0\n http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010\n http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a\n http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010\n http://www.microsoft.com/pkiops/docs/primarycps.htm0\n http://www.w3.org\n http://www.w3.org/1999/02/22-rdf-syntax-ns#\n http://www.w3.org/1999/xlink\n http://www.w3.org/2000/svg\n http://www.w3.org/2001/XMLSchema-instance\n https.ydstatic.com\n https://curl.se\n https://docer.com\n https://fe-static.wpscdn.cn\n https://fe-static.wpscdn.cn/apm_sdk_proxy/client-wps-pc.entry.v2.min.js'\n https://fe-static.wpscdn.cn/apm_sdk_proxy/client-wps-pc.entry.v2.min.js?appId\n https://get.sogou.com\n https://get.sogou.com/q\n https://honeycomb-plugins.wps.cn\n https://honeycomb-plugins.wpscdn.cn\n https://ime.sogou.com\n https://ime.sogou.com/pyup.gif?\n https://js1.pcfg.cache.wpscdn.cn\n https://js1.pcfg.cache.wpscdn.cn/wps_statics/wps_web_apm/client-wps-pc.entry.v1.min.js\n https://kdocs.cn\n https://learning.u.wpscdn.cn\n https://learning.u.wpscdn.cn/config/json/academy/cloud_edu_url_default2\n https://personal-ai-bus.wps.cn\n https://qwps.com\n https://shared-https.ydstatic.com\n https://shared-https.ydstatic.com/images/favicon.ico\n https://wps.cn\n https://wps.com\n https://wpsplus.com\n https://www.digicert.com\n https://www.digicert.com/CPS0\n https://www.microsoft.com\n https://www.verisign.com\n https://www.verisign.com/cps0\n https://www.verisign.com/rpa\n https://www.verisign.com/rpa0\n hw.wdl.cache.wpscdn.cn\n hwc-bj-overseas.ag.wps.cn\n i.wps.cn\n i18n.wps.cn\n ic-proofread.wps.cn\n icdcapi.wps.cn\n iciba.com\n idle.wpscdn.cn\n ifanyi.iciba.com\n imapi.docer.wpscdn.cn\n ime.sogou.com\n img.qwps.cn\n img1.mini.cache.wps.cn\n img1.pcfg.cache.wpscdn.cn\n img1.template.cache.wps.cn\n img2.fonts.cache.wps.cn\n img7.file.cache.docer.com\n in-account.wps.com\n in-calendar.wps.com\n in-drive.wps.com\n in-plus.wps.com\n in-plussvr.wps.com\n in-securitydoc.wps.com\n in-store.wps.com\n in-tiance.wps.com\n in-work.wps.com\n in.docs.wps.com\n in.wps.com\n info.kingsoftstore.com\n insp.wps.cn\n intl-ippt.wps.com\n ios.wps.cn\n iospush.wps.cn\n ippt.wps.cn\n ippt.wps.com\n jimo.wps.cn\n jp-account.wps.com\n jp-calendar.wps.com\n jp-drive.wps.com\n jp-plus.wps.com\n jp-plussvr.wps.com\n jp-securitydoc.wps.com\n jp-store.wps.com\n jp-tiance.wps.com\n jp-work.wps.com\n jp.docs.wps.com\n jp.wps.com\n js1.pcfg.cache.wpscdn.cn\n jump.wps.cn\n kad.www.wps.cn\n kae.wps.cn\n kas.wps.cn\n kbee.wps.cn\n kblog.wps.cn\n kdocs-vas.wpscdn.cn\n kdocs.cn\n kdocs.wps.cn\n kflow-idle.wpscdn.cn\n kflow-rt.wps.cn\n kflow.wps.cn\n kflow.wpscdn.cn\n kingsoft.com\n kingsoftstore.com\n klogin.wps.cn\n km.kdocs.cn\n kmsg.wps.cn\n knobo.wps.cn\n kos.wps.cn\n kot-pictures.wps.cn\n kpay-ff.wps.com\n kpay-jp.wps.com\n kpay-mb.wps.com\n kpay-ru.wps.com\n kpay-sg.wps.com\n kpay-us.wps.com\n kpay.wps.com\n kps.wps.cn\n ks3-cn-beijing.ksyun.com\n ks3-cn-beijing.ksyuncs.com\n ks3.wpscdn.cn\n ksc-bj.ag.kdocs.cn\n ksgec-test.wps.com\n ksgec.wps.com\n ksoepproofread.wps.cn\n ksoproofread.wps.cn\n ksopushapi.wps.cn\n ksord.com\n ksosoft.com\n kss.ksyun.com\n kstatus.wps.cn\n ksyun.com\n ksyuncs.com\n kuc.wps.cn\n kup.wps.cn\n kvas-api.wps.cn\n learning.u.wpscdn.cn\n library-wps.lnep.net\n lingxi.wps.cn\n linux.wps.cn\n llm-api.kas.wps.cn\n local.wps.cn\n local.wps.com\n localhost.wbridge.wps.cn\n login-b.wps.cn\n login.psvr.wps.cn\n login.wps.cn\n login.wpscdn.cn\n logintcp.wps.cn\n logintcpnv.wps.cn\n logo.verisign.com\n mac.wps.cn\n mac.wps.com\n mac.wpscdn.cn\n mb.wps.com\n md.wpscdn.cn\n meeting.kdocs.cn\n meeting.wps.cn\n meeting.wps.com\n meihua-service.ks3-cn-beijing.ksyun.com\n memtest86.com\n micro.api.wps.com\n microsoft.com\n mini.cache.wps.cn\n mini.wps.cn\n mission.u.wps.cn\n mo.wps.cn\n moapi.wps..cn\n moapi.wps.cn\n mob.wps.cn\n mobapp-api.wps.cn\n modou.wps.cn\n modouks.wps.cn\n moni-wps.chuangkit.com\n movip.wps.com\n msg.psvr.wps.cn\n msgcenter.wps.cn\n msgpush.wps.cn\n ncre.u.wps.cn\n newdoc.docer.wps.cn\n note-api.wps.cn\n note.wps.cn\n notebox.wps.cn\n notice.wps.cn\n ns.adobe.com\n nsis.sf.net\n o.wpsgo.com\n office.wps.com\n official-package.wpscdn.cn\n ok.kdocs.cn\n ones.wps.cn\n online.ksosoft.com\n op.wpscdn.cn\n open-mob.wps.cn\n open-mobapp-api.wps.cn\n open.docer.wps.cn\n open.wps.cn\n openapi-dev-test.wps.cn\n openapi.wps.cn\n openapp.wpscdn.cn\n openapptest.wpscdn.cn\n openssl.org\n openxmlformats.org\n overseas.ag.wps.cn\n ovs-shopwindow-server-ff.wps.com\n ovs-shopwindow-server-jp.wps.com\n ovs-shopwindow-server-mb.wps.com\n ovs-shopwindow-server-ru.wps.com\n ovs-shopwindow-server-sg.wps.com\n ovs-shopwindow-server-us.wps.com\n ovs-shopwindow-server.wps.com\n p.kdocs.cn\n p3p.sogou.com\n p3pping.sogou.com\n pacakge.cache.wpscdn.cn\n package.mac.wpscdn.cn\n package.wpscdn.cn\n pan.wps.cn\n papocket.com\n param-us.wps.com\n params.wps.com\n pay.wps.cn\n pbtest.wps.cn\n pc-diffpack.wps.cn\n pc-hamlet.ksord.com\n pc-plugin-1.wpscdn.cn\n pc-plugin-2.wpscdn.cn\n pc-plugin-3.wpscdn.cn\n pc-plugin-personal.wpscdn.cn\n pc-plugin-plg.wpscdn.cn\n pc-plugin-v3.wpscdn.cn\n pc-plugin.wpscdn.cn\n pc-serv.wps.com\n pc.ksord.com\n pc.uid.ksosoft.com\n pc.wps.cn\n pcdiffpack.psvr.wps.cn\n pcfg.cache.wpscdn.cn\n pcfg.cache.wpscdn.com\n pcfg.wps.cn\n pcv-test.wps.cn\n pcv.wps.cn\n pdf.wps.cn\n pdf.wps.com\n pdf2word.wps.cn\n pdf2wordbackup1.wps.cn\n pdfbackup1.wps.cn\n pendant.docer.wps.cn\n permits-ff.wps.com\n permits-jp.wps.com\n permits-mb.wps.com\n permits-ru.wps.com\n permits-sg.wps.com\n permits-us.wps.com\n permits.wps.com\n personal-act.wps.cn\n personal-act.wpscdn.cn\n personal-ai-bus.kdocs.cn\n personal-ai-bus.wps.cn\n personal-bus.wps.cn\n personal-volc.wpscdn.cn\n personal-volc.wpscdn.com\n personal-web.kdocs.cn\n personal-web.wps.cn\n personal.local.wps.cn\n personal.local.wps.com\n personal.wpscdn.cn\n phapi.wps.cn\n pictures.wps.cn\n ping.acc.sogou.com\n pinyin.sogou.com\n platform.wps.cn\n plg.cache.wpscdn.cn\n plg.wpscdn.cn\n plugin-1.wpscdn.cn\n plugin-2.wpscdn.cn\n plugin-3.wpscdn.cn\n plugin-personal.wpscdn.cn\n plugin-plg.wpscdn.cn\n plugin-v3.wpscdn.cn\n plugin.wpscdn.cn\n plugins-1.wpscdn.cn\n plugins-2.wpscdn.cn\n plugins-3.wpscdn.cn\n plugins.wps.cn\n plugins.wpscdn.cn\n plus.wps.cn\n plus.wps.com\n plussvr.wps.cn\n plussvr.wps.com\n pocket.wps.cn\n point.wps.cn\n precise.ksord.com\n print.wps.cn\n printer.wps.cn\n privacy.wps.cn\n processon.com\n prod.cache.wpscdn.com\n proofread.wps.cn\n psu.wps.cn\n psvr.wps.cn\n pub-api.kdocs.cn\n pub-api.wps.cn\n pub.wpscdn.cn\n public.wpscdn.cn\n push.psvr.wps.cn\n push.wps.cn\n qa.wps.cn\n qdyn.kingsoftstore.com\n qing.wps.cn\n qingcenter.wps.cn\n qingqiu.wps.cn\n qn.cache.wpscdn.cn\n qpush.wps.cn\n qr.wps.cn\n rec.ksord.com\n remote.wps.cn\n remote.wps.com\n res-honeycomb.wpscdn.cn\n resume-web.docer.wps.cn\n rili.wps.cn\n roaming.wps.cn\n rt.wps.cn\n ru-account.wps.com\n ru-calendar.wps.com\n ru-drive.wps.com\n ru-plus.wps.com\n ru-plussvr.wps.com\n ru-securitydoc.wps.com\n ru-store.wps.com\n ru-tiance.wps.com\n ru-work.wps.com\n ru.docs.wps.com\n ru.wps.com\n rubik.wps.cn\n s.wps.cn\n s.wps.com\n s1.vip.wpscdn.cn\n s2.vip.wpscdn.cn\n s3.vip.wpscdn.cn\n s4.vip.wpscdn.cn\n s5.vip.wpscdn.cn\n s6.vip.wpscdn.cn\n schemas.openxmlformats.org\n sdk.ai.wpscdn.cn\n securitydoc.wps.cn\n securitydoc.wps.com\n serv.wps.com\n server-ff.wps.com\n server-jp.wps.com\n server-mb.wps.com\n server-ru.wps.com\n server-sg.wps.com\n server-us.wps.com\n server.wps.com\n service.ks3-cn-beijing.ksyun.com\n seti-ai.wps.com\n seti.jimo.wps.cn\n seti.wps.cn\n sg-account.wps.com\n sg-calendar.wps.com\n sg-drive.wps.com\n sg-plus.wps.com\n sg-plussvr.wps.com\n sg-securitydoc.wps.com\n sg-store.wps.com\n sg-tiance.wps.com\n sg-work.wps.com\n sg.docs.wps.com\n sg.wps.com\n shared-https.ydstatic.com\n sharefolder.wps.cn\n shopwindow-server-ff.wps.com\n shopwindow-server-jp.wps.com\n shopwindow-server-mb.wps.com\n shopwindow-server-ru.wps.com\n shopwindow-server-sg.wps.com\n shopwindow-server-us.wps.com\n shopwindow-server.wps.com\n shuc-pc-hamlet.ksord.com\n shuc-pc.ksord.com\n skin.docer.wps.cn\n skin.wps.cn\n so.wps.cn\n softbus-Device.wps.cn\n sogou.com\n spa.wps.cn\n sr-public.wpscdn.cn\n ssssssssssssssshuc-pc-hamlet.ksord.com\n st.wps.cn\n static.ai.wpscdn.cn\n static.wpscdn.cn\n store.wps.cn\n store.wps.com\n storechain-gen.wps.cn\n suji.wps.cn\n svc.modou.wps.cn\n switch.pcfg.cache.wpscdn.cn\n t.wpscdn.cn\n tastenew.wps.cn\n tb.sogou.com\n template-test.wps.com\n template.cache.wps.cn\n template.wps.com\n test.wps.cn\n test.wps.com\n tiance.wps.cn\n tiance.wps.com\n time.windows.com\n tj.psvr.wps.cn\n todo.wps.cn\n tools.docer.wps.cn\n topscan.com\n transferhelper.wps.cn\n translate.iciba.com\n translate.wps.com\n translation.psvr.wps.cn\n tv.wps.cn\n tvpxy.wps.cn\n u.wps.cn\n u.wpscdn.cn\n uc.wps.com\n udesk.cn\n uf-api6-client.ksord.com\n uf-api6.ksord.com\n uf-bigsearch.ksord.com\n uid.ksosoft.com\n update-dev.wps.cn\n update.kingsoftstore.com\n update.wps.cn\n update.wpscdn.cn\n updatepro.wps.cn\n us-account.wps.com\n us-calendar.wps.com\n us-drive.wps.com\n us-plus.wps.com\n us-plussvr.wps.com\n us-securitydoc.wps.com\n us-store.wps.com\n us-tiance.wps.com\n us-work.wps.com\n us.docs.wps.com\n us.wps.com\n ut.psvr.wps.cn\n v3.wpscdn.cn\n vaf.wps.cn\n vas.wps.cn\n vas.wpscdn.cn\n vas2c-spa.wps.cn\n vas2t-api.wps.cn\n vas2t-spa.wps.cn\n vasapi.wps.cn\n vasdc.wps.cn\n vasvip-pub.wpscdn.cn\n verisign.com\n vip-rec.ksord.com\n vip.wps.cn\n vip.wps.com\n vip.wpscdn.cn\n vipapi.wps.cn\n volc.wpscdn.cn\n volc.wpscdn.com\n waas.wps.cn\n wbridge.wps.cn\n wdl.cache.wpscdn.cn\n wdl1.cache.wps.cn\n wdl1.file.cache.docer.com\n wdl1.pcfg.cache.wpscdn.com\n web-param-us.wps.com\n web.docer.wps.cn\n web.kdocs.cn\n web.wps.cn\n web1.file.cache.docer.com\n website-prod.cache.wpscdn.com\n wiki.kdocs.cn\n wiki.wps.cn\n windows.com\n woa.wps.cn\n work.wps.cn\n work.wps.com\n wppai-client.ks3-cn-beijing.ksyuncs.com\n wps-cdn-docer.ks3-cn-beijing.ksyuncs.com\n wps-ncre.u.wps.cn\n wps-translate.wps.com\n wps.chuangkit.com\n wps.kingsoft.com\n wps.kss.ksyun.com\n wps.lnep.net\n wps.md.wpscdn.cn\n wps.processon.com\n wps.udesk.cn\n wpscdn.cn\n wpscdn.com\n wpsgo.com\n wpsmail.net\n wpsplus.com\n wpsthumb.processon.com\n wwo.wps.cn\n www.baidu.com\n www.digicert.com\n www.iciba.com\n www.kdocs.cn\n www.kingsoft.com\n www.ksyun.com\n www.memtest86.com\n www.microsoft.com\n www.processon.com\n www.sogou.com\n www.topscan.com\n www.verisign.com\n www.w3.org\n www.wps.cn\n www.wps.com\n xctrl.wps.cn\n xz.wps.cn\n ydstatic.com\n youraddr.com\n yun.qwps.cn\n yun.wps.cn\n yun.wpscdn.cn\n yunbiz.wps.cn\n yunbizcdn.wpscdn.cn\n zt.wps.cn\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to MD5\n Uses constants related to SHA1\n Uses constants related to SHA256\n Uses constants related to SHA512\n Uses constants related to AES\n Uses constants related to Blowfish\n Uses known Diffie-Helman primes\n\n[ SUSPICIOUS ] The PE is an NSIS installer\n Unusual section name found: .ndata\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n Can access the registry:\n RegEnumValueW\n RegEnumKeyW\n RegQueryValueExW\n RegSetValueExW\n RegCloseKey\n RegDeleteValueW\n RegDeleteKeyW\n RegOpenKeyExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n Can shut the system down or lock the screen:\n ExitWindowsEx\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 44540380 bytes of data starting at offset 0x1a600.\n The overlay data has an entropy of 7.06906 and is possibly compressed or encrypted.\n Overlay data amounts for 99.758% of the executable.\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_lte3smut/test-019f74f969c67b708ae412d024c8c189.msi_f36047d7ce10/002_binwalk_F_Exe1.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_p9w881iz/output.txt"},"timestamp":"2026-07-18 17:37:50"} {"_id":{"$oid":"6a5c6cd0b3bed57e0e73788c"},"sha256":"5fc07750ace241e22a7d63a5d5aff50815e975aa0084c285ccc7c514c58c09df","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/5fc07750ace241e22a7d63a5d5aff50815e975aa0084c285ccc7c514c58c09df-019f78fe518c72709650852969b4a5c3.exe\nDate: 2026-07-19 11:51:04\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/5fc07750ace241e22a7d63a5d5aff50815e975aa0084c285ccc7c514c58c09df-019f78fe518c72709650852969b4a5c3.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2017-May-11 12:20:57\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2017-May-11 12:20:57\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 10.0\nSizeOfCode: 0x00007C00\nSizeOfInitializedData: 0x00505800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000015EC (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.2\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x00513000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0051CBC1\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00007B78\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.32469\n\n.rdata:\n VirtualSize: 0x00002BC8\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00002C00\n PointerToRawData: 0x00008000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.70494\n\n.data:\n VirtualSize: 0x00003660\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00001400\n PointerToRawData: 0x0000AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.82277\n\n.pdata:\n VirtualSize: 0x0000078C\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0000C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.24944\n\n.rsrc:\n VirtualSize: 0x00500200\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00500200\n PointerToRawData: 0x0000C800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.22289\n\n.reloc:\n VirtualSize: 0x00000CA8\n VirtualAddress: 0x00512000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x0050CA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0\n\n\nImports:\n--------\nKERNEL32.dll: CloseHandle\n WriteFile\n CreateFileA\n SizeofResource\n LockResource\n LoadResource\n FindResourceA\n CreateProcessA\n GetCurrentThreadId\n FlsSetValue\n GetCommandLineA\n DecodePointer\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n IsDebuggerPresent\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n RtlCaptureContext\n EncodePointer\n TerminateProcess\n GetCurrentProcess\n RtlUnwindEx\n FlsGetValue\n FlsFree\n SetLastError\n GetLastError\n FlsAlloc\n HeapFree\n Sleep\n GetProcAddress\n GetModuleHandleW\n ExitProcess\n SetHandleCount\n GetStdHandle\n InitializeCriticalSectionAndSpinCount\n GetFileType\n GetStartupInfoW\n DeleteCriticalSection\n GetModuleFileNameA\n FreeEnvironmentStringsW\n WideCharToMultiByte\n GetEnvironmentStringsW\n HeapSetInformation\n GetVersion\n HeapCreate\n HeapDestroy\n QueryPerformanceCounter\n GetTickCount\n GetCurrentProcessId\n GetSystemTimeAsFileTime\n SetFilePointer\n GetConsoleCP\n GetConsoleMode\n EnterCriticalSection\n LeaveCriticalSection\n GetCPInfo\n GetACP\n GetOEMCP\n IsValidCodePage\n HeapAlloc\n HeapReAlloc\n LoadLibraryW\n GetModuleFileNameW\n SetStdHandle\n WriteConsoleW\n MultiByteToWideChar\n LCMapStringW\n GetStringTypeW\n HeapSize\n CreateFileW\n FlushFileBuffers\n\nExports:\n--------\nPlayGame:\n Ordinal: 1\n Address: 0x000011A4\n\n\nResources:\n----------\n101:\n Type: W\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 5242880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.22329\n\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n\nRICH Header:\n------------\nXOR Key: 0x4425342F\nUnmarked objects: 0\nC objects (VS2010 SP1 build 40219): 83\nASM objects (VS2010 SP1 build 40219): 9\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 80\nC++ objects (VS2010 SP1 build 40219): 23\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.9629% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2017-May-11 12:20:57\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2017-May-11 12:20:57\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 10.0\nSizeOfCode: 0x00007C00\nSizeOfInitializedData: 0x00505800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000015EC (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.2\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x00513000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0051CBC1\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00007B78\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.32469\n\n.rdata:\n VirtualSize: 0x00002BC8\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00002C00\n PointerToRawData: 0x00008000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.70494\n\n.data:\n VirtualSize: 0x00003660\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00001400\n PointerToRawData: 0x0000AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.82277\n\n.pdata:\n VirtualSize: 0x0000078C\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0000C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.24944\n\n.rsrc:\n VirtualSize: 0x00500200\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00500200\n PointerToRawData: 0x0000C800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.22289\n\n.reloc:\n VirtualSize: 0x00000CA8\n VirtualAddress: 0x00512000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x0050CA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0"},"Imports":{"raw":"KERNEL32.dll: CloseHandle\n WriteFile\n CreateFileA\n SizeofResource\n LockResource\n LoadResource\n FindResourceA\n CreateProcessA\n GetCurrentThreadId\n FlsSetValue\n GetCommandLineA\n DecodePointer\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n IsDebuggerPresent\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n RtlCaptureContext\n EncodePointer\n TerminateProcess\n GetCurrentProcess\n RtlUnwindEx\n FlsGetValue\n FlsFree\n SetLastError\n GetLastError\n FlsAlloc\n HeapFree\n Sleep\n GetProcAddress\n GetModuleHandleW\n ExitProcess\n SetHandleCount\n GetStdHandle\n InitializeCriticalSectionAndSpinCount\n GetFileType\n GetStartupInfoW\n DeleteCriticalSection\n GetModuleFileNameA\n FreeEnvironmentStringsW\n WideCharToMultiByte\n GetEnvironmentStringsW\n HeapSetInformation\n GetVersion\n HeapCreate\n HeapDestroy\n QueryPerformanceCounter\n GetTickCount\n GetCurrentProcessId\n GetSystemTimeAsFileTime\n SetFilePointer\n GetConsoleCP\n GetConsoleMode\n EnterCriticalSection\n LeaveCriticalSection\n GetCPInfo\n GetACP\n GetOEMCP\n IsValidCodePage\n HeapAlloc\n HeapReAlloc\n LoadLibraryW\n GetModuleFileNameW\n SetStdHandle\n WriteConsoleW\n MultiByteToWideChar\n LCMapStringW\n GetStringTypeW\n HeapSize\n CreateFileW\n FlushFileBuffers"},"Exports":{"raw":"PlayGame:\n Ordinal: 1\n Address: 0x000011A4"},"Resources":{"raw":"101:\n Type: W\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 5242880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.22329\n\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n\nRICH Header:\nXOR Key: 0x4425342F\nUnmarked objects: 0\nC objects (VS2010 SP1 build 40219): 83\nASM objects (VS2010 SP1 build 40219): 9\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 80\nC++ objects (VS2010 SP1 build 40219): 23\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.9629% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x4425342F\nUnmarked objects: 0\nC objects (VS2010 SP1 build 40219): 83\nASM objects (VS2010 SP1 build 40219): 9\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 80\nC++ objects (VS2010 SP1 build 40219): 23\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses constants related to AES\n\n[ MALICIOUS ] This program may be a ransomware.\n Contains a valid Bitcoin address:\n 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn\n 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw\n 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.9629% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/5fc07750ace241e22a7d63a5d5aff50815e975aa0084c285ccc7c514c58c09df-019f78fe518c72709650852969b4a5c3.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_23kt2qhu/output.txt"},"timestamp":"2026-07-19 11:51:04"} {"_id":{"$oid":"6a5c76bdb3bed57e0e73788f"},"sha256":"19ee106f5490826e09271022d24b27a0586a48c5c9db4a55a63320bafcbb8342","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/19ee106f5490826e09271022d24b27a0586a48c5c9db4a55a63320bafcbb8342-019f7901f0467b93b982cba84d4dbea2.exe\nDate: 2026-07-19 12:33:25\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/19ee106f5490826e09271022d24b27a0586a48c5c9db4a55a63320bafcbb8342-019f7901f0467b93b982cba84d4dbea2.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2026-Jul-19 03:34:54\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 7\nTimeDateStamp: 2026-Jul-19 03:34:54\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 2.0\nSizeOfCode: 0x00025E00\nSizeOfInitializedData: 0x00008800\nSizeOfUninitializedData: 0x00054A00\nAddressOfEntryPoint: 0x0000000000024650 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000000400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x00087000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0003155D\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000200000\nSizeofStackCommit: 0x0000000000100000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00025C70\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00025E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.32829\n\n.data:\n VirtualSize: 0x00001FC0\n VirtualAddress: 0x00027000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x00026200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.bss:\n VirtualSize: 0x00000008\n VirtualAddress: 0x00029000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00028200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.rdata:\n VirtualSize: 0x00005460\n VirtualAddress: 0x0002A000\n SizeOfRawData: 0x00005600\n PointerToRawData: 0x00028400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.43503\n\n.bss (#2):\n VirtualSize: 0x00054940\n VirtualAddress: 0x00030000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00000A4C\n VirtualAddress: 0x00085000\n SizeOfRawData: 0x00000C00\n PointerToRawData: 0x0002DA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.00865\n\n.reloc:\n VirtualSize: 0x0000024C\n VirtualAddress: 0x00086000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x0002E600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.69126\n\n\nImports:\n--------\nKERNEL32.dll: Beep\n CompareStringW\n CopyFileA\n CreateDirectoryA\n CreateMutexA\n CreateRemoteThread\n DisconnectNamedPipe\n EncodePointer\n FileTimeToLocalFileTime\n FlushFileBuffers\n FormatMessageA\n GetACP\n GetCPInfo\n GetCommandLineW\n GetConsoleMode\n GetCurrentProcess\n GetCurrentThreadId\n GetDriveTypeA\n GetLocaleInfoW\n GetLogicalDrives\n GetModuleFileNameA\n GetModuleHandleA\n GetOEMCP\n GetProcAddress\n GetProcessId\n GetStartupInfoW\n GetSystemTimeAsFileTime\n GetUserDefaultLangID\n GlobalAlloc\n HeapSize\n InitializeCriticalSectionAndSpinCount\n IsValidCodePage\n OpenMutexA\n SetConsoleCP\n SetConsoleMode\n SetConsoleOutputCP\n SetCurrentDirectoryA\n SetThreadPriority\n Sleep\n SystemTimeToFileTime\n TlsFree\n TryEnterCriticalSection\n UnhandledExceptionFilter\n VirtualAllocEx\n VirtualFreeEx\n VirtualProtectEx\n WaitForSingleObject\n WriteProcessMemory\n lstrcatW\n lstrcmpW\n lstrcpyW\nUSER32.dll: CharUpperA\n DefWindowProcA\n DefWindowProcW\n EnumWindows\n GetCursorPos\n GetShellWindow\n GetWindowTextLengthA\n IsWindowVisible\n LoadStringW\n MessageBoxW\n ReleaseDC\n SendMessageA\n SetWindowLongA\n SystemParametersInfoA\n UpdateWindow\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n Code injection capabilities:\n CreateRemoteThread\n VirtualAllocEx\n WriteProcessMemory\n Memory manipulation functions often used by packers:\n VirtualAllocEx\n VirtualProtectEx\n Enumerates local disk drives:\n GetDriveTypeA\n Manipulates other processes:\n WriteProcessMemory\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2026-Jul-19 03:34:54"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 7\nTimeDateStamp: 2026-Jul-19 03:34:54\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 2.0\nSizeOfCode: 0x00025E00\nSizeOfInitializedData: 0x00008800\nSizeOfUninitializedData: 0x00054A00\nAddressOfEntryPoint: 0x0000000000024650 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000000400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x00087000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0003155D\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000200000\nSizeofStackCommit: 0x0000000000100000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00025C70\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00025E00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.32829\n\n.data:\n VirtualSize: 0x00001FC0\n VirtualAddress: 0x00027000\n SizeOfRawData: 0x00002000\n PointerToRawData: 0x00026200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.bss:\n VirtualSize: 0x00000008\n VirtualAddress: 0x00029000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00028200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.rdata:\n VirtualSize: 0x00005460\n VirtualAddress: 0x0002A000\n SizeOfRawData: 0x00005600\n PointerToRawData: 0x00028400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.43503\n\n.bss (#2):\n VirtualSize: 0x00054940\n VirtualAddress: 0x00030000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x00000A4C\n VirtualAddress: 0x00085000\n SizeOfRawData: 0x00000C00\n PointerToRawData: 0x0002DA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.00865\n\n.reloc:\n VirtualSize: 0x0000024C\n VirtualAddress: 0x00086000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x0002E600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.69126"},"Imports":{"raw":"KERNEL32.dll: Beep\n CompareStringW\n CopyFileA\n CreateDirectoryA\n CreateMutexA\n CreateRemoteThread\n DisconnectNamedPipe\n EncodePointer\n FileTimeToLocalFileTime\n FlushFileBuffers\n FormatMessageA\n GetACP\n GetCPInfo\n GetCommandLineW\n GetConsoleMode\n GetCurrentProcess\n GetCurrentThreadId\n GetDriveTypeA\n GetLocaleInfoW\n GetLogicalDrives\n GetModuleFileNameA\n GetModuleHandleA\n GetOEMCP\n GetProcAddress\n GetProcessId\n GetStartupInfoW\n GetSystemTimeAsFileTime\n GetUserDefaultLangID\n GlobalAlloc\n HeapSize\n InitializeCriticalSectionAndSpinCount\n IsValidCodePage\n OpenMutexA\n SetConsoleCP\n SetConsoleMode\n SetConsoleOutputCP\n SetCurrentDirectoryA\n SetThreadPriority\n Sleep\n SystemTimeToFileTime\n TlsFree\n TryEnterCriticalSection\n UnhandledExceptionFilter\n VirtualAllocEx\n VirtualFreeEx\n VirtualProtectEx\n WaitForSingleObject\n WriteProcessMemory\n lstrcatW\n lstrcmpW\n lstrcpyW\nUSER32.dll: CharUpperA\n DefWindowProcA\n DefWindowProcW\n EnumWindows\n GetCursorPos\n GetShellWindow\n GetWindowTextLengthA\n IsWindowVisible\n LoadStringW\n MessageBoxW\n ReleaseDC\n SendMessageA\n SetWindowLongA\n SystemParametersInfoA\n UpdateWindow\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n Code injection capabilities:\n CreateRemoteThread\n VirtualAllocEx\n WriteProcessMemory\n Memory manipulation functions often used by packers:\n VirtualAllocEx\n VirtualProtectEx\n Enumerates local disk drives:\n GetDriveTypeA\n Manipulates other processes:\n WriteProcessMemory\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/19ee106f5490826e09271022d24b27a0586a48c5c9db4a55a63320bafcbb8342-019f7901f0467b93b982cba84d4dbea2.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_1pqs0496/output.txt"},"timestamp":"2026-07-19 12:33:25"} {"_id":{"$oid":"6a5c86acb3bed57e0e737894"},"sha256":"0aac658075b7d9e81419d0beaa3db796569bc14fd57512f4479fb36e9cc4c1a2","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/xworm-019f796a6dc57a41964b0c138810f68b.exe\nDate: 2026-07-19 13:41:24\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/xworm-019f796a6dc57a41964b0c138810f68b.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jul-01 15:49:05\nFileDescription: \nFileVersion: 0.0.0.0\nInternalName: meccha-camouflageV3.exe\nLegalCopyright: \nOriginalFilename: meccha-camouflageV3.exe\nProductVersion: 0.0.0.0\nAssembly Version: 0.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2026-Jul-01 15:49:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x00012400\nSizeOfInitializedData: 0x0003A000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0001421E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00016000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00052000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00012224\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00012400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.02784\n\n.rsrc:\n VirtualSize: 0x00039D32\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x00039E00\n PointerToRawData: 0x00012600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.18606\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00050000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0004C400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.27038\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.99037\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.64816\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.28948\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10154\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 21640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00466\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.90013\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.79682\n\n9:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 73182\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97758\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.5818\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21676\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n FileDescription: \n FileVersion (#2): 0.0.0.0\n InternalName: meccha-camouflageV3.exe\n LegalCopyright: \n OriginalFilename: meccha-camouflageV3.exe\n ProductVersion (#2): 0.0.0.0\n Assembly Version: 0.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n\n[ SUSPICIOUS ] PEiD Signature:\n UPolyX V0.1 -> Delikon\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n schtask\n Contains references to security software:\n rshell.exe\n Looks for VMWare presence:\n vmware\n Looks for Sandboxie presence:\n SbieDll.dll\n May have dropper capabilities:\n CurrentVersion\\Run\n Accesses the WMI:\n root\\Security\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n http://ip-api.com\n ip-api.com\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 75.491% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jul-01 15:49:05\nFileDescription: \nFileVersion: 0.0.0.0\nInternalName: meccha-camouflageV3.exe\nLegalCopyright: \nOriginalFilename: meccha-camouflageV3.exe\nProductVersion: 0.0.0.0\nAssembly Version: 0.0.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2026-Jul-01 15:49:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 11.0\nSizeOfCode: 0x00012400\nSizeOfInitializedData: 0x0003A000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0001421E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x00016000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00052000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00012224\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00012400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.02784\n\n.rsrc:\n VirtualSize: 0x00039D32\n VirtualAddress: 0x00016000\n SizeOfRawData: 0x00039E00\n PointerToRawData: 0x00012600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.18606\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00050000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0004C400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.27038\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.99037\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.64816\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.28948\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10154\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 21640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00466\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.90013\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.79682\n\n9:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 73182\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97758\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.5818\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21676\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n FileDescription: \n FileVersion (#2): 0.0.0.0\n InternalName: meccha-camouflageV3.exe\n LegalCopyright: \n OriginalFilename: meccha-camouflageV3.exe\n ProductVersion (#2): 0.0.0.0\n Assembly Version: 0.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n\n[ SUSPICIOUS ] PEiD Signature:\n UPolyX V0.1 -> Delikon\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n schtask\n Contains references to security software:\n rshell.exe\n Looks for VMWare presence:\n vmware\n Looks for Sandboxie presence:\n SbieDll.dll\n May have dropper capabilities:\n CurrentVersion\\Run\n Accesses the WMI:\n root\\Security\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n http://ip-api.com\n ip-api.com\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 75.491% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 6.27038\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.99037\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.64816\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.28948\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.10154\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 21640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00466\n\n7:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.90013\n\n8:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.79682\n\n9:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 73182\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.97758\n Detected Filetype: PNG graphic file\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 132\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.5818\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21676\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.0.0.0\n ProductVersion: 0.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n FileDescription: \n FileVersion (#2): 0.0.0.0\n InternalName: meccha-camouflageV3.exe\n LegalCopyright: \n OriginalFilename: meccha-camouflageV3.exe\n ProductVersion (#2): 0.0.0.0\n Assembly Version: 0.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n\n[ SUSPICIOUS ] PEiD Signature:\n UPolyX V0.1 -> Delikon\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n schtask\n Contains references to security software:\n rshell.exe\n Looks for VMWare presence:\n vmware\n Looks for Sandboxie presence:\n SbieDll.dll\n May have dropper capabilities:\n CurrentVersion\\Run\n Accesses the WMI:\n root\\Security\n Miscellaneous malware strings:\n cmd.exe\n Contains domain names:\n http://ip-api.com\n ip-api.com\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 75.491% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/xworm-019f796a6dc57a41964b0c138810f68b.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_wzo3vjt0/output.txt"},"timestamp":"2026-07-19 13:41:24"} {"_id":{"$oid":"6a5c8a05b3bed57e0e737897"},"sha256":"64fa25e0e80a527b9caec41f68d96f696ca41467ab4e5edefc1bf1795ee3ffad","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack__vcavu9t/wanna_cry-019f7976bdb175e2a6a998210b4d3667.exe_64fa25e0e80a/002_overlay_carved_pe_0.exe\nDate: 2026-07-19 13:55:41\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack__vcavu9t/wanna_cry-019f7976bdb175e2a6a998210b4d3667.exe_64fa25e0e80a/002_overlay_carved_pe_0.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2010-Nov-20 09:03:08\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2010-Nov-20 09:03:08\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00009000\nSizeOfInitializedData: 0x00383000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00009A16 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000A000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0066B000\nSizeOfHeaders: 0x00001000\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00008BCA\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00009000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.13448\n\n.rdata:\n VirtualSize: 0x00000998\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x0000A000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.50362\n\n.data:\n VirtualSize: 0x0030489C\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00027000\n PointerToRawData: 0x0000B000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.rsrc:\n VirtualSize: 0x0035A454\n VirtualAddress: 0x00310000\n SizeOfRawData: 0x0035B000\n PointerToRawData: 0x00032000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0\n\n\nImports:\n--------\nKERNEL32.dll: WaitForSingleObject\n InterlockedIncrement\n GetCurrentThreadId\n GetCurrentThread\n ReadFile\n GetFileSize\n CreateFileA\n MoveFileExA\n SizeofResource\n TerminateThread\n LoadResource\n FindResourceA\n GetProcAddress\n GetModuleHandleW\n ExitProcess\n GetModuleFileNameA\n LocalFree\n LocalAlloc\n CloseHandle\n InterlockedDecrement\n EnterCriticalSection\n LeaveCriticalSection\n InitializeCriticalSection\n GlobalAlloc\n GlobalFree\n QueryPerformanceFrequency\n QueryPerformanceCounter\n GetTickCount\n LockResource\n Sleep\n GetStartupInfoA\n GetModuleHandleA\nADVAPI32.dll: StartServiceCtrlDispatcherA\n RegisterServiceCtrlHandlerA\n ChangeServiceConfig2A\n SetServiceStatus\n OpenSCManagerA\n CreateServiceA\n CloseServiceHandle\n StartServiceA\n CryptGenRandom\n CryptAcquireContextA\n OpenServiceA\nWS2_32.dll: closesocket\n recv\n send\n htonl\n ntohl\n WSAStartup\n inet_ntoa\n ioctlsocket\n select\n htons\n socket\n connect\n inet_addr\nMSVCP60.dll: ??1_Lockit@std@@QAE@XZ\n ??0_Lockit@std@@QAE@XZ\niphlpapi.dll: GetAdaptersInfo\n GetPerAdapterInfo\nWININET.dll: InternetOpenA\n InternetOpenUrlA\n InternetCloseHandle\nMSVCRT.dll: __set_app_type\n _stricmp\n __p__fmode\n __p__commode\n _except_handler3\n __setusermatherr\n _initterm\n __getmainargs\n _acmdln\n _adjust_fdiv\n _controlfp\n exit\n _XcptFilter\n _exit\n _onexit\n __dllonexit\n free\n ??2@YAPAXI@Z\n _ftol\n sprintf\n _endthreadex\n strncpy\n rand\n _beginthreadex\n __CxxFrameHandler\n srand\n time\n __p___argc\n\nRICH Header:\n------------\nXOR Key: 0xC33D5D11\nUnmarked objects: 0\n12 (7291): 1\n14 (7299): 4\nC objects (8047): 11\nC++ objects (8047): 1\nLinker (8047): 4\nImports (VS2003 (.NET) build 4035): 11\nTotal imports: 91\nC++ objects (VS98 SP6 build 8804): 1\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Microsoft's cryptographic API:\n CryptGenRandom\n CryptAcquireContextA\n Has Internet access capabilities:\n InternetOpenA\n InternetOpenUrlA\n InternetCloseHandle\n Leverages the raw socket API to access the Internet:\n closesocket\n recv\n send\n htonl\n ntohl\n WSAStartup\n inet_ntoa\n ioctlsocket\n select\n htons\n socket\n connect\n inet_addr\n Interacts with services:\n OpenSCManagerA\n CreateServiceA\n OpenServiceA\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: Could not read an IMAGE_RESOURCE_DIRECTORY.\n[*] Warning: Section .data is larger than the executable!\n[*] Warning: Section .rsrc is larger than the executable!\n[*] Warning: Section .data is larger than the executable!\n[*] Warning: Section .rsrc is larger than the executable!\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2010-Nov-20 09:03:08"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F8"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2010-Nov-20 09:03:08\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 6.0\nSizeOfCode: 0x00009000\nSizeOfInitializedData: 0x00383000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00009A16 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0000A000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00001000\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x0066B000\nSizeOfHeaders: 0x00001000\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00008BCA\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00009000\n PointerToRawData: 0x00001000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.13448\n\n.rdata:\n VirtualSize: 0x00000998\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x0000A000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.50362\n\n.data:\n VirtualSize: 0x0030489C\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00027000\n PointerToRawData: 0x0000B000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0\n\n.rsrc:\n VirtualSize: 0x0035A454\n VirtualAddress: 0x00310000\n SizeOfRawData: 0x0035B000\n PointerToRawData: 0x00032000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 0"},"Imports":{"raw":"KERNEL32.dll: WaitForSingleObject\n InterlockedIncrement\n GetCurrentThreadId\n GetCurrentThread\n ReadFile\n GetFileSize\n CreateFileA\n MoveFileExA\n SizeofResource\n TerminateThread\n LoadResource\n FindResourceA\n GetProcAddress\n GetModuleHandleW\n ExitProcess\n GetModuleFileNameA\n LocalFree\n LocalAlloc\n CloseHandle\n InterlockedDecrement\n EnterCriticalSection\n LeaveCriticalSection\n InitializeCriticalSection\n GlobalAlloc\n GlobalFree\n QueryPerformanceFrequency\n QueryPerformanceCounter\n GetTickCount\n LockResource\n Sleep\n GetStartupInfoA\n GetModuleHandleA\nADVAPI32.dll: StartServiceCtrlDispatcherA\n RegisterServiceCtrlHandlerA\n ChangeServiceConfig2A\n SetServiceStatus\n OpenSCManagerA\n CreateServiceA\n CloseServiceHandle\n StartServiceA\n CryptGenRandom\n CryptAcquireContextA\n OpenServiceA\nWS2_32.dll: closesocket\n recv\n send\n htonl\n ntohl\n WSAStartup\n inet_ntoa\n ioctlsocket\n select\n htons\n socket\n connect\n inet_addr\nMSVCP60.dll: ??1_Lockit@std@@QAE@XZ\n ??0_Lockit@std@@QAE@XZ\niphlpapi.dll: GetAdaptersInfo\n GetPerAdapterInfo\nWININET.dll: InternetOpenA\n InternetOpenUrlA\n InternetCloseHandle\nMSVCRT.dll: __set_app_type\n _stricmp\n __p__fmode\n __p__commode\n _except_handler3\n __setusermatherr\n _initterm\n __getmainargs\n _acmdln\n _adjust_fdiv\n _controlfp\n exit\n _XcptFilter\n _exit\n _onexit\n __dllonexit\n free\n ??2@YAPAXI@Z\n _ftol\n sprintf\n _endthreadex\n strncpy\n rand\n _beginthreadex\n __CxxFrameHandler\n srand\n time\n __p___argc\n\nRICH Header:\nXOR Key: 0xC33D5D11\nUnmarked objects: 0\n12 (7291): 1\n14 (7299): 4\nC objects (8047): 11\nC++ objects (8047): 1\nLinker (8047): 4\nImports (VS2003 (.NET) build 4035): 11\nTotal imports: 91\nC++ objects (VS98 SP6 build 8804): 1\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Microsoft's cryptographic API:\n CryptGenRandom\n CryptAcquireContextA\n Has Internet access capabilities:\n InternetOpenA\n InternetOpenUrlA\n InternetCloseHandle\n Leverages the raw socket API to access the Internet:\n closesocket\n recv\n send\n htonl\n ntohl\n WSAStartup\n inet_ntoa\n ioctlsocket\n select\n htons\n socket\n connect\n inet_addr\n Interacts with services:\n OpenSCManagerA\n CreateServiceA\n OpenServiceA\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: Could not read an IMAGE_RESOURCE_DIRECTORY.\n[*] Warning: Section .data is larger than the executable!\n[*] Warning: Section .rsrc is larger than the executable!\n[*] Warning: Section .data is larger than the executable!\n[*] Warning: Section .rsrc is larger than the executable!\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0xC33D5D11\nUnmarked objects: 0\n12 (7291): 1\n14 (7299): 4\nC objects (8047): 11\nC++ objects (8047): 1\nLinker (8047): 4\nImports (VS2003 (.NET) build 4035): 11\nTotal imports: 91\nC++ objects (VS98 SP6 build 8804): 1\nResource objects (VS98 SP6 cvtres build 1736): 1\n\nMatching compiler(s):\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n Microsoft Visual C++ v5.0/v6.0 (MFC)\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Uses Microsoft's cryptographic API:\n CryptGenRandom\n CryptAcquireContextA\n Has Internet access capabilities:\n InternetOpenA\n InternetOpenUrlA\n InternetCloseHandle\n Leverages the raw socket API to access the Internet:\n closesocket\n recv\n send\n htonl\n ntohl\n WSAStartup\n inet_ntoa\n ioctlsocket\n select\n htons\n socket\n connect\n inet_addr\n Interacts with services:\n OpenSCManagerA\n CreateServiceA\n OpenServiceA\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: Could not read an IMAGE_RESOURCE_DIRECTORY.\n[*] Warning: Section .data is larger than the executable!\n[*] Warning: Section .rsrc is larger than the executable!\n[*] Warning: Section .data is larger than the executable!\n[*] Warning: Section .rsrc is larger than the executable!\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack__vcavu9t/wanna_cry-019f7976bdb175e2a6a998210b4d3667.exe_64fa25e0e80a/002_overlay_carved_pe_0.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_60k9ydqd/output.txt"},"timestamp":"2026-07-19 13:55:41"} {"_id":{"$oid":"6a5c8bbab3bed57e0e737899"},"sha256":"bd20fcc313adbb44d82a033fbae527bc2b522b93ed80ba88ec0094644005df81","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/fmb2-019f79da89167641b8df1ca79ac80532.bat\nDate: 2026-07-19 15:40:49\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/fmb2-019f79da89167641b8df1ca79ac80532.bat!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/fmb2-019f79da89167641b8df1ca79ac80532.bat"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_0f6qmnlx/output.txt"},"timestamp":"2026-07-19 15:40:49"} {"_id":{"$oid":"6a5c8f2db3bed57e0e7378a6"},"sha256":"ce4aed382f325fb8c3d31091b7ab08a14975db08457b46b6b44f2a41c347fc9c","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_8tldmoj6/vi-019f798ddabc77d2976e0d64376b880d.exe_ce4aed382f32/001_upx_unpacked.exe\nDate: 2026-07-19 14:17:41\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_8tldmoj6/vi-019f798ddabc77d2976e0d64376b880d.exe_ce4aed382f32/001_upx_unpacked.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jun-05 01:19:13\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000280\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 4\nTimeDateStamp: 2026-Jun-05 01:19:13\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00100E00\nSizeOfInitializedData: 0x00122000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000E3DEC (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x00000001A0000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00226000\nSizeOfHeaders: 0x00000600\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000040000\nSizeofStackCommit: 0x0000000000002000\nSizeofHeapReserve: 0x0000000000001000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00100DBF\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00100E00\n PointerToRawData: 0x00000600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.69182\n\n.rdata:\n VirtualSize: 0x00006064\n VirtualAddress: 0x00102000\n SizeOfRawData: 0x00006200\n PointerToRawData: 0x00101400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.80606\n\n.data:\n VirtualSize: 0x0011BAC0\n VirtualAddress: 0x00109000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00107600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.923005\n\n.reloc:\n VirtualSize: 0x00000014\n VirtualAddress: 0x00225000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00108800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.242002\n\n\nRICH Header:\n------------\nXOR Key: 0x3AE25EA4\nUnmarked objects: 0\nASM objects (30148): 1\nC objects (30148): 46\nC++ objects (30148): 91\nImports (30148): 1\nResource objects (30148): 1\n\n[ MALICIOUS ] The file headers were tampered with.\n The PE only has 0 import(s).\n The RICH header checksum is invalid.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jun-05 01:19:13"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000280"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 4\nTimeDateStamp: 2026-Jun-05 01:19:13\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00100E00\nSizeOfInitializedData: 0x00122000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000E3DEC (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x00000001A0000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00226000\nSizeOfHeaders: 0x00000600\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000040000\nSizeofStackCommit: 0x0000000000002000\nSizeofHeapReserve: 0x0000000000001000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00100DBF\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00100E00\n PointerToRawData: 0x00000600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 5.69182\n\n.rdata:\n VirtualSize: 0x00006064\n VirtualAddress: 0x00102000\n SizeOfRawData: 0x00006200\n PointerToRawData: 0x00101400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.80606\n\n.data:\n VirtualSize: 0x0011BAC0\n VirtualAddress: 0x00109000\n SizeOfRawData: 0x00001200\n PointerToRawData: 0x00107600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.923005\n\n.reloc:\n VirtualSize: 0x00000014\n VirtualAddress: 0x00225000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00108800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.242002\n\n\nRICH Header:\nXOR Key: 0x3AE25EA4\nUnmarked objects: 0\nASM objects (30148): 1\nC objects (30148): 46\nC++ objects (30148): 91"},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x3AE25EA4\nUnmarked objects: 0\nASM objects (30148): 1\nC objects (30148): 46\nC++ objects (30148): 91\nImports (30148): 1\nResource objects (30148): 1\n\n[ MALICIOUS ] The file headers were tampered with.\n The PE only has 0 import(s).\n The RICH header checksum is invalid.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_8tldmoj6/vi-019f798ddabc77d2976e0d64376b880d.exe_ce4aed382f32/001_upx_unpacked.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_hhzsot4n/output.txt"},"timestamp":"2026-07-19 14:17:41"} {"_id":{"$oid":"6a5c9252b3bed57e0e7378ac"},"sha256":"e7030756a6f7f4544a8496221b89883f473043e213f4145b07bfb55612cb0615","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/snk-019f799aaf6079e0aff9b0c897be1de8.bat\nDate: 2026-07-19 14:31:06\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/snk-019f799aaf6079e0aff9b0c897be1de8.bat!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/snk-019f799aaf6079e0aff9b0c897be1de8.bat"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_uq9ufpno/output.txt"},"timestamp":"2026-07-19 14:31:06"} {"_id":{"$oid":"6a5c9628b3bed57e0e7378c5"},"sha256":"1e969173c001e524b7ef3a22c0fcb1cc834104c18b64beea1d0a8de14be52087","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/rmc-019f79a977897ed39488dd68cf203445.vbs\nDate: 2026-07-19 14:47:28\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/rmc-019f79a977897ed39488dd68cf203445.vbs!\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/rmc-019f79a977897ed39488dd68cf203445.vbs"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_6pm8c1cb/output.txt"},"timestamp":"2026-07-19 14:47:28"} {"_id":{"$oid":"6a5c9b4db3bed57e0e7378ce"},"sha256":"c9b4047be7c4b7190533db32c67b85fe51c1692cca1d36944ad2f4d554b9320a","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/rp-019f79b8d2487453a40ae1cad2b6caa4.exe\nDate: 2026-07-19 15:09:25\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/rp-019f79b8d2487453a40ae1cad2b6caa4.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-May-08 10:22:34\nDetected languages: English - Canada\n English - United States\n Russian - Russia\nCompanyName: Microsoft Corporation\nFileDescription: CrossDeviceSettingsHost.exe\nFileVersion: 0.24032.58.0\nInternalName: CrossDeviceComponentStub.App\nLegalCopyright: Microsoft Corporation. All rights reserved.\nOriginalFilename: CrossDeviceSettingsHost.exe\nProductName: CrossDeviceSettingsHost.exe\nProductVersion: 0.24032.58.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000120\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 12\nTimeDateStamp: 2024-May-08 10:22:34\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0015BC00\nSizeOfInitializedData: 0x00042E00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00506058 (Section: .boot)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0015D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00676000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0021DF29\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n :\n VirtualSize: 0x0015BAE8\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00080000\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99959\n\n (#2):\n VirtualSize: 0x00027E32\n VirtualAddress: 0x0015D000\n SizeOfRawData: 0x0000C600\n PointerToRawData: 0x00080400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.99523\n\n (#3):\n VirtualSize: 0x00004930\n VirtualAddress: 0x00185000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0008CA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.51641\n\n (#4):\n VirtualSize: 0x0000C8C0\n VirtualAddress: 0x0018A000\n SizeOfRawData: 0x00007200\n PointerToRawData: 0x0008D200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.98105\n\n (#5):\n VirtualSize: 0x00009858\n VirtualAddress: 0x00197000\n SizeOfRawData: 0x00004C00\n PointerToRawData: 0x00094400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 7.97524\n\n.vm_sec:\n VirtualSize: 0x00004000\n VirtualAddress: 0x001A1000\n SizeOfRawData: 0x00004000\n PointerToRawData: 0x00099000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.98213\n\n.idata:\n VirtualSize: 0x00001000\n VirtualAddress: 0x001A5000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x0009D000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.40587\n\n.tls:\n VirtualSize: 0x00001000\n VirtualAddress: 0x001A6000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0009D400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.181202\n\n.rsrc:\n VirtualSize: 0x0000CA00\n VirtualAddress: 0x001A7000\n SizeOfRawData: 0x0000CA00\n PointerToRawData: 0x0009D600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.55701\n\n.themida:\n VirtualSize: 0x00352000\n VirtualAddress: 0x001B4000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x000AA000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.boot:\n VirtualSize: 0x0016E400\n VirtualAddress: 0x00506000\n SizeOfRawData: 0x0016E400\n PointerToRawData: 0x000AA000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.95269\n\n.reloc:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00675000\n SizeOfRawData: 0x00000010\n PointerToRawData: 0x00218400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n Entropy: 2.4746\n\n\nImports:\n--------\nkernel32.dll: GetModuleHandleA\nUSER32.dll: wsprintfA\nGDI32.dll: CreateCompatibleBitmap\nADVAPI32.dll: RegQueryValueExA\nSHELL32.dll: ShellExecuteA\nole32.dll: CoInitialize\nWS2_32.dll: WSAStartup\nCRYPT32.dll: CryptUnprotectData\nSHLWAPI.dll: PathFindExtensionA\ngdiplus.dll: GdipGetImageEncoders\nSETUPAPI.dll: SetupDiEnumDeviceInfo\nntdll.dll: RtlUnicodeStringToAnsiString\nRstrtMgr.DLL: RmStartSession\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50871\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74447\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76105\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.67749\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.06535\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21323\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41104\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0994\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 19285\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9482\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04381\n\n11:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.254\n\n12:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.48673\n\n13:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.744\n\n123:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 188\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.06903\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 920\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43191\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\n-------------\nResource LangID: Russian - Russia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.24032.58.0\n ProductVersion: 0.24032.58.0\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n FileType: VFT_APP\n Language: English - Canada\n CompanyName: Microsoft Corporation\n FileDescription: CrossDeviceSettingsHost.exe\n FileVersion (#2): 0.24032.58.0\n InternalName: CrossDeviceComponentStub.App\n LegalCopyright: Microsoft Corporation. All rights reserved.\n OriginalFilename: CrossDeviceSettingsHost.exe\n ProductName: CrossDeviceSettingsHost.exe\n ProductVersion (#2): 0.24032.58.0\n\n\nRICH Header:\n------------\nXOR Key: 0xB773F82E\nUnmarked objects: 0\nASM objects (30795): 11\nC++ objects (30795): 192\nC++ objects (CVTCIL) (30795): 1\n253 (33218): 4\nC objects (33218): 19\nASM objects (33218): 26\nC++ objects (33218): 91\nC objects (30795): 24\nC objects (CVTCIL) (30795): 1\nImports (30795): 27\nTotal imports: 288\nC++ objects (LTCG) (33523): 28\nResource objects (33523): 1\n151: 1\nLinker (33523): 1\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .vm_sec\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Can access the registry:\n RegQueryValueExA\n Possibly launches other programs:\n ShellExecuteA\n Uses Microsoft's cryptographic API:\n CryptUnprotectData\n Leverages the raw socket API to access the Internet:\n WSAStartup\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\n\n\n[*] Warning: Could not read the name of the DLL to be delay-loaded!\n[!] Error: Could not reach the TLS callback table.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2024-May-08 10:22:34\nDetected languages: English - Canada\n English - United States\n Russian - Russia\nCompanyName: Microsoft Corporation\nFileDescription: CrossDeviceSettingsHost.exe\nFileVersion: 0.24032.58.0\nInternalName: CrossDeviceComponentStub.App\nLegalCopyright: Microsoft Corporation. All rights reserved.\nOriginalFilename: CrossDeviceSettingsHost.exe\nProductName: CrossDeviceSettingsHost.exe\nProductVersion: 0.24032.58.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000120"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 12\nTimeDateStamp: 2024-May-08 10:22:34\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0015BC00\nSizeOfInitializedData: 0x00042E00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00506058 (Section: .boot)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0015D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00676000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0021DF29\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":":\n VirtualSize: 0x0015BAE8\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00080000\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99959\n\n (#2):\n VirtualSize: 0x00027E32\n VirtualAddress: 0x0015D000\n SizeOfRawData: 0x0000C600\n PointerToRawData: 0x00080400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.99523\n\n (#3):\n VirtualSize: 0x00004930\n VirtualAddress: 0x00185000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0008CA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 7.51641\n\n (#4):\n VirtualSize: 0x0000C8C0\n VirtualAddress: 0x0018A000\n SizeOfRawData: 0x00007200\n PointerToRawData: 0x0008D200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 7.98105\n\n (#5):\n VirtualSize: 0x00009858\n VirtualAddress: 0x00197000\n SizeOfRawData: 0x00004C00\n PointerToRawData: 0x00094400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 7.97524\n\n.vm_sec:\n VirtualSize: 0x00004000\n VirtualAddress: 0x001A1000\n SizeOfRawData: 0x00004000\n PointerToRawData: 0x00099000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.98213\n\n.idata:\n VirtualSize: 0x00001000\n VirtualAddress: 0x001A5000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x0009D000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.40587\n\n.tls:\n VirtualSize: 0x00001000\n VirtualAddress: 0x001A6000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0009D400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.181202\n\n.rsrc:\n VirtualSize: 0x0000CA00\n VirtualAddress: 0x001A7000\n SizeOfRawData: 0x0000CA00\n PointerToRawData: 0x0009D600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.55701\n\n.themida:\n VirtualSize: 0x00352000\n VirtualAddress: 0x001B4000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x000AA000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.boot:\n VirtualSize: 0x0016E400\n VirtualAddress: 0x00506000\n SizeOfRawData: 0x0016E400\n PointerToRawData: 0x000AA000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.95269\n\n.reloc:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00675000\n SizeOfRawData: 0x00000010\n PointerToRawData: 0x00218400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_MEM_READ\n Entropy: 2.4746"},"Imports":{"raw":"kernel32.dll: GetModuleHandleA\nUSER32.dll: wsprintfA\nGDI32.dll: CreateCompatibleBitmap\nADVAPI32.dll: RegQueryValueExA\nSHELL32.dll: ShellExecuteA\nole32.dll: CoInitialize\nWS2_32.dll: WSAStartup\nCRYPT32.dll: CryptUnprotectData\nSHLWAPI.dll: PathFindExtensionA\ngdiplus.dll: GdipGetImageEncoders\nSETUPAPI.dll: SetupDiEnumDeviceInfo\nntdll.dll: RtlUnicodeStringToAnsiString\nRstrtMgr.DLL: RmStartSession\n\nResources:\n1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50871\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74447\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76105\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.67749\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.06535\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21323\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41104\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0994\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 19285\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9482\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04381\n\n11:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.254\n\n12:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.48673\n\n13:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.744\n\n123:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 188\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.06903\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 920\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43191\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\nResource LangID: Russian - Russia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.24032.58.0\n ProductVersion: 0.24032.58.0\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n FileType: VFT_APP\n Language: English - Canada\n CompanyName: Microsoft Corporation\n FileDescription: CrossDeviceSettingsHost.exe\n FileVersion (#2): 0.24032.58.0\n InternalName: CrossDeviceComponentStub.App\n LegalCopyright: Microsoft Corporation. All rights reserved.\n OriginalFilename: CrossDeviceSettingsHost.exe\n ProductName: CrossDeviceSettingsHost.exe\n ProductVersion (#2): 0.24032.58.0\n\n\nRICH Header:\nXOR Key: 0xB773F82E\nUnmarked objects: 0\nASM objects (30795): 11\nC++ objects (30795): 192\nC++ objects (CVTCIL) (30795): 1\n253 (33218): 4\nC objects (33218): 19\nASM objects (33218): 26\nC++ objects (33218): 91\nC objects (30795): 24\nC objects (CVTCIL) (30795): 1\nImports (30795): 27\nTotal imports: 288\nC++ objects (LTCG) (33523): 28\nResource objects (33523): 1\n151: 1\nLinker (33523): 1\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .vm_sec\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Can access the registry:\n RegQueryValueExA\n Possibly launches other programs:\n ShellExecuteA\n Uses Microsoft's cryptographic API:\n CryptUnprotectData\n Leverages the raw socket API to access the Internet:\n WSAStartup\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\n\n\n[*] Warning: Could not read the name of the DLL to be delay-loaded!\n[!] Error: Could not reach the TLS callback table.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.50871\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74447\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76105\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.67749\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.06535\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.21323\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.41104\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.0994\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 19285\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.9482\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.04381\n\n11:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.254\n\n12:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.48673\n\n13:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.744\n\n123:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 188\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.06903\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 920\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.43191\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 381\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.91161\n\n\nVersion Info:\nResource LangID: Russian - Russia\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 0.24032.58.0\n ProductVersion: 0.24032.58.0\n FileFlags: VS_FF_SPECIALBUILD\n FileOs: VOS_NT\n VOS_NT_WINDOWS32\n VOS_WINCE\n FileType: VFT_APP\n Language: English - Canada\n CompanyName: Microsoft Corporation\n FileDescription: CrossDeviceSettingsHost.exe\n FileVersion (#2): 0.24032.58.0\n InternalName: CrossDeviceComponentStub.App\n LegalCopyright: Microsoft Corporation. All rights reserved.\n OriginalFilename: CrossDeviceSettingsHost.exe\n ProductName: CrossDeviceSettingsHost.exe\n ProductVersion (#2): 0.24032.58.0\n\n\nRICH Header:\nXOR Key: 0xB773F82E\nUnmarked objects: 0\nASM objects (30795): 11\nC++ objects (30795): 192\nC++ objects (CVTCIL) (30795): 1\n253 (33218): 4\nC objects (33218): 19\nASM objects (33218): 26\nC++ objects (33218): 91\nC objects (30795): 24\nC objects (CVTCIL) (30795): 1\nImports (30795): 27\nTotal imports: 288\nC++ objects (LTCG) (33523): 28\nResource objects (33523): 1\n151: 1\nLinker (33523): 1\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .vm_sec\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Can access the registry:\n RegQueryValueExA\n Possibly launches other programs:\n ShellExecuteA\n Uses Microsoft's cryptographic API:\n CryptUnprotectData\n Leverages the raw socket API to access the Internet:\n WSAStartup\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\n\n\n[*] Warning: Could not read the name of the DLL to be delay-loaded!\n[!] Error: Could not reach the TLS callback table.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0xB773F82E\nUnmarked objects: 0\nASM objects (30795): 11\nC++ objects (30795): 192\nC++ objects (CVTCIL) (30795): 1\n253 (33218): 4\nC objects (33218): 19\nASM objects (33218): 26\nC++ objects (33218): 91\nC objects (30795): 24\nC objects (CVTCIL) (30795): 1\nImports (30795): 27\nTotal imports: 288\nC++ objects (LTCG) (33523): 28\nResource objects (33523): 1\n151: 1\nLinker (33523): 1\n\nLibraries used to perform cryptographic operations:\n Microsoft's Cryptography API\n\n[ SUSPICIOUS ] This PE is packed with Themida\n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: \n Unusual section name found: .vm_sec\n Unusual section name found: .themida\n Section .themida is both writable and executable.\n Unusual section name found: .boot\n\n[ SUSPICIOUS ] The PE contains functions most legitimate programs don't use.\n Can access the registry:\n RegQueryValueExA\n Possibly launches other programs:\n ShellExecuteA\n Uses Microsoft's cryptographic API:\n CryptUnprotectData\n Leverages the raw socket API to access the Internet:\n WSAStartup\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\n\n\n[*] Warning: Could not read the name of the DLL to be delay-loaded!\n[!] Error: Could not reach the TLS callback table.\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/rp-019f79b8d2487453a40ae1cad2b6caa4.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_u9p5x2cb/output.txt"},"timestamp":"2026-07-19 15:09:25"} {"_id":{"$oid":"6a5ca37bb3bed57e0e7378e0"},"sha256":"72e3fb64a103033837ee52ff73f5c00b2a8536b363431cd1308e7ce00f26908a","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/rdls-019f79da669c71719879d09c9105a912.exe\nDate: 2026-07-19 15:44:19\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/rdls-019f79da669c71719879d09c9105a912.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2094-Apr-25 21:49:20\nComments: \nCompanyName: \nFileDescription: ReactionGrid\nFileVersion: 1.0.0.0\nInternalName: VPkU.exe\nLegalCopyright: Copyright © 2026\nLegalTrademarks: \nOriginalFilename: VPkU.exe\nProductName: ReactionGrid\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2094-Apr-25 21:49:20\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x000D9400\nSizeOfInitializedData: 0x0005B000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000DB33E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x000DC000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0013A000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000D9344\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x000D9400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.8166\n\n.rsrc:\n VirtualSize: 0x0005ACB8\n VirtualAddress: 0x000DC000\n SizeOfRawData: 0x0005AE00\n PointerToRawData: 0x000D9600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.17452\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00138000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00134400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 270376\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.00378\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.12836\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8795\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34924\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.21156\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.62765\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.34144\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27618\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: ReactionGrid\n FileVersion (#2): 1.0.0.0\n InternalName: VPkU.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: VPkU.exe\n ProductName: ReactionGrid\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n Microsoft Visual C++ 8.0\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2094-Apr-25 21:49:20\nComments: \nCompanyName: \nFileDescription: ReactionGrid\nFileVersion: 1.0.0.0\nInternalName: VPkU.exe\nLegalCopyright: Copyright © 2026\nLegalTrademarks: \nOriginalFilename: VPkU.exe\nProductName: ReactionGrid\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2094-Apr-25 21:49:20\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x000D9400\nSizeOfInitializedData: 0x0005B000\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000DB33E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x000DC000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0013A000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000D9344\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x000D9400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.8166\n\n.rsrc:\n VirtualSize: 0x0005ACB8\n VirtualAddress: 0x000DC000\n SizeOfRawData: 0x0005AE00\n PointerToRawData: 0x000D9600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.17452\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x00138000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00134400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 270376\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.00378\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.12836\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8795\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34924\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.21156\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.62765\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.34144\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27618\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: ReactionGrid\n FileVersion (#2): 1.0.0.0\n InternalName: VPkU.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: VPkU.exe\n ProductName: ReactionGrid\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n Microsoft Visual C++ 8.0\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 270376\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.00378\n\n2:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.12836\n\n3:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.8795\n\n4:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34924\n\n5:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.21156\n\n6:\n Type: RT_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.62765\n\n1 (#2):\n Type: RT_GROUP_ICON\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 90\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.34144\n Detected Filetype: Icon file\n\n1 (#3):\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 796\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27618\n\n1 (#4):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: Latin 1 / Western European\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: ReactionGrid\n FileVersion (#2): 1.0.0.0\n InternalName: VPkU.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: VPkU.exe\n ProductName: ReactionGrid\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n Microsoft Visual C++ 8.0\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/rdls-019f79da669c71719879d09c9105a912.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_ewmiudvj/output.txt"},"timestamp":"2026-07-19 15:44:19"} {"_id":{"$oid":"6a5caa43b3bed57e0e7378f5"},"sha256":"0ab215f9653788c3943cbf7f60470cc02f351e192b34ef673c1fccdc6e3eda0d","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_decoded_b3mhwr_g/zlib_offset_0x184bd5_7.bin\nDate: 2026-07-19 16:13:15\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_decoded_b3mhwr_g/zlib_offset_0x184bd5_7.bin\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2017-Oct-11 02:10:42\nDetected languages: English - United States\nDebug artifacts: vcruntime140.amd64.pdb\nCompanyName: Microsoft Corporation\nFileDescription: Microsoft® C Runtime Library\nFileVersion: 14.12.25810.0 built by: VCTOOLSREL\nInternalName: vcruntime140.dll\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: vcruntime140.dll\nProductName: Microsoft® Visual Studio® 2017\nProductVersion: 14.12.25810.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2017-Oct-11 02:10:42\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x0000CE00\nSizeOfInitializedData: 0x00005400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000000C5D0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: A.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00016000\nSizeOfHeaders: 0x00000400\nChecksum: 0x000259DD\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0000CC24\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000CE00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.36813\n\n.rdata:\n VirtualSize: 0x000036B8\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00003800\n PointerToRawData: 0x0000D200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.64186\n\n.data:\n VirtualSize: 0x00000930\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00010A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.37175\n\n.pdata:\n VirtualSize: 0x00000828\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00010E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.9477\n\n.rsrc:\n VirtualSize: 0x00000408\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00011800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.46389\n\n.reloc:\n VirtualSize: 0x00000170\n VirtualAddress: 0x00015000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00011E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.15556\n\n\nImports:\n--------\napi-ms-win-crt-runtime-l1-1-0.dll: abort\n terminate\napi-ms-win-crt-string-l1-1-0.dll: wcsncmp\n strcpy_s\napi-ms-win-crt-heap-l1-1-0.dll: _free_base\n _malloc_base\n malloc\n free\n _calloc_base\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vsprintf_s\napi-ms-win-crt-convert-l1-1-0.dll: atol\nKERNEL32.dll: SetLastError\n IsProcessorFeaturePresent\n TerminateProcess\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlCaptureContext\n GetSystemTimeAsFileTime\n GetCurrentThreadId\n GetCurrentProcessId\n QueryPerformanceCounter\n RtlLookupFunctionEntry\n GetModuleHandleW\n GetModuleFileNameW\n LoadLibraryExW\n RtlUnwindEx\n EncodePointer\n RaiseException\n RtlPcToFileHeader\n InterlockedFlushSList\n InterlockedPushEntrySList\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n TlsGetValue\n GetLastError\n TlsSetValue\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n GetProcAddress\n FreeLibrary\n TlsFree\n\nExports:\n--------\n_CreateFrameInfo:\n Ordinal: 1\n Address: 0x0000C170\n\n_CxxThrowException:\n Ordinal: 2\n Address: 0x00004620\n\n_FindAndUnlinkFrame:\n Ordinal: 3\n Address: 0x0000C1D0\n\n_IsExceptionObjectToBeDestroyed:\n Ordinal: 4\n Address: 0x00001B60\n\n_SetWinRTOutOfMemoryExceptionCallback:\n Ordinal: 5\n Address: 0x00001AB0\n\n__AdjustPointer:\n Ordinal: 6\n Address: 0x000017F0\n\n__BuildCatchObject:\n Ordinal: 7\n Address: 0x00003270\n\n__BuildCatchObjectHelper:\n Ordinal: 8\n Address: 0x00003040\n\n__C_specific_handler:\n Ordinal: 9\n Address: 0x0000C680\n\n__C_specific_handler_noexcept:\n Ordinal: 10\n Address: 0x0000C380\n\n__CxxDetectRethrow:\n Ordinal: 11\n Address: 0x000038E0\n\n__CxxExceptionFilter:\n Ordinal: 12\n Address: 0x00003550\n\n__CxxFrameHandler:\n Ordinal: 13\n Address: 0x0000BFC0\n\n__CxxFrameHandler2:\n Ordinal: 14\n Address: 0x0000BFC0\n\n__CxxFrameHandler3:\n Ordinal: 15\n Address: 0x0000BF20\n\n__CxxQueryExceptionSize:\n Ordinal: 16\n Address: 0x00003B20\n\n__CxxRegisterExceptionObject:\n Ordinal: 17\n Address: 0x000037D0\n\n__CxxUnregisterExceptionObject:\n Ordinal: 18\n Address: 0x00003930\n\n__DestructExceptionObject:\n Ordinal: 19\n Address: 0x00001AD0\n\n__FrameUnwindFilter:\n Ordinal: 20\n Address: 0x00001A40\n\n__GetPlatformExceptionInfo:\n Ordinal: 21\n Address: 0x00001820\n\n__NLG_Dispatch2:\n Ordinal: 22\n Address: 0x0000C660\n\n__NLG_Return2:\n Ordinal: 23\n Address: 0x0000C670\n\n__RTCastToVoid:\n Ordinal: 24\n Address: 0x00003B80\n\n__RTDynamicCast:\n Ordinal: 25\n Address: 0x00003D20\n\n__RTtypeid:\n Ordinal: 26\n Address: 0x00003C70\n\n__TypeMatch:\n Ordinal: 27\n Address: 0x000028B0\n\n__current_exception:\n Ordinal: 28\n Address: 0x000019E0\n\n__current_exception_context:\n Ordinal: 29\n Address: 0x00001A00\n\n__intrinsic_setjmp:\n Ordinal: 30\n Address: 0x0000D750\n\n__intrinsic_setjmpex:\n Ordinal: 31\n Address: 0x0000D810\n\n__processing_throw:\n Ordinal: 32\n Address: 0x00001A20\n\n__report_gsfailure:\n Ordinal: 33\n Address: 0x0000D450\n\n__std_exception_copy:\n Ordinal: 34\n Address: 0x00004380\n\n__std_exception_destroy:\n Ordinal: 35\n Address: 0x00004410\n\n__std_terminate:\n Ordinal: 36\n Address: 0x00001AC0\n\n__std_type_info_compare:\n Ordinal: 37\n Address: 0x00004440\n\n__std_type_info_destroy_list:\n Ordinal: 38\n Address: 0x000045F0\n\n__std_type_info_hash:\n Ordinal: 39\n Address: 0x00004470\n\n__std_type_info_name:\n Ordinal: 40\n Address: 0x000044B0\n\n__telemetry_main_invoke_trigger:\n Ordinal: 41\n Address: 0x00001000\n\n__telemetry_main_return_trigger:\n Ordinal: 42\n Address: 0x00001000\n\n__unDName:\n Ordinal: 43\n Address: 0x00004E10\n\n__unDNameEx:\n Ordinal: 44\n Address: 0x00004F60\n\n__uncaught_exception:\n Ordinal: 45\n Address: 0x00001930\n\n__uncaught_exceptions:\n Ordinal: 46\n Address: 0x00001890\n\n__vcrt_GetModuleFileNameW:\n Ordinal: 47\n Address: 0x00004CF0\n\n__vcrt_GetModuleHandleW:\n Ordinal: 48\n Address: 0x00004D00\n\n__vcrt_InitializeCriticalSectionEx:\n Ordinal: 49\n Address: 0x00004C70\n\n__vcrt_LoadLibraryExW:\n Ordinal: 50\n Address: 0x00004D10\n\n_get_purecall_handler:\n Ordinal: 51\n Address: 0x00004DA0\n\n_get_unexpected:\n Ordinal: 52\n Address: 0x00004700\n\n_is_exception_typeof:\n Ordinal: 53\n Address: 0x00001BA0\n\n_local_unwind:\n Ordinal: 54\n Address: 0x0000C610\n\n_purecall:\n Ordinal: 55\n Address: 0x00004D20\n\n_set_purecall_handler:\n Ordinal: 56\n Address: 0x00004D60\n\n_set_se_translator:\n Ordinal: 57\n Address: 0x000047B0\n\nlongjmp:\n Ordinal: 58\n Address: 0x00001040\n\nmemchr:\n Ordinal: 59\n Address: 0x0000C8F0\n\nmemcmp:\n Ordinal: 60\n Address: 0x0000C970\n\nmemcpy:\n Ordinal: 61\n Address: 0x0000CA50\n\nmemmove:\n Ordinal: 62\n Address: 0x0000CA50\n\nmemset:\n Ordinal: 63\n Address: 0x0000CEB0\n\nset_unexpected:\n Ordinal: 64\n Address: 0x00004730\n\nstrchr:\n Ordinal: 65\n Address: 0x00001090\n\nstrrchr:\n Ordinal: 66\n Address: 0x00001120\n\nstrstr:\n Ordinal: 67\n Address: 0x00001270\n\nunexpected:\n Ordinal: 68\n Address: 0x00004770\n\nwcschr:\n Ordinal: 69\n Address: 0x00001470\n\nwcsrchr:\n Ordinal: 70\n Address: 0x00001510\n\nwcsstr:\n Ordinal: 71\n Address: 0x000015D0\n\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 932\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4971\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 14.12.25810.0\n ProductVersion: 14.12.25810.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Microsoft® C Runtime Library\n FileVersion (#2): 14.12.25810.0 built by: VCTOOLSREL\n InternalName: vcruntime140.dll\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: vcruntime140.dll\n ProductName: Microsoft® Visual Studio® 2017\n ProductVersion (#2): 14.12.25810.0\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2017-Oct-11 02:10:42\n Version: 0.0\n SizeofData: 47\n AddressOfRawData: 0x0000FD20\n PointerToRawData: 0x0000EF20\n Referenced File: vcruntime140.amd64.pdb\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2017-Oct-11 02:10:42\n Version: 0.0\n SizeofData: 432\n AddressOfRawData: 0x0000FD50\n PointerToRawData: 0x0000EF50\n\n\nLoad Configuration:\n-------------------\nSize: 256\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180012010\nGuardCFCheckFunctionPointer: 0x000000018000E190\nGuardCFDispatchFunctionPointer: 0x0000000000000000\nGuardCFFunctionTable: 0x0000000000000000\nGuardCFFunctionCount: 0x0000000000000000\nGuardFlags: (EMPTY)\nCodeIntegrity.Flags: 0x0000\nCodeIntegrity.Catalog: 0x0000\nCodeIntegrity.CatalogOffset: 0x00000000\nCodeIntegrity.Reserved: 0x00000000\nGuardAddressTakenIatEntryTable: 0x0000000000000000\nGuardAddressTakenIatEntryCount: 0\nGuardLongJumpTargetTable: 0x0000000000000000\nGuardLongJumpTargetCount: 0\n\nRICH Header:\n------------\nXOR Key: 0x44AE78B5\nUnmarked objects: 0\n239 (40116): 2\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 44\nC++ objects (25805): 3\nC objects (25805): 10\nASM objects (25805): 13\nC objects (LTCG) (25805): 31\nExports (25805): 1\nResource objects (25805): 1\nLinker (25805): 1\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: enabled\n\nThe PE is digitally signed.\n Signer: Microsoft Corporation\n Issuer: Microsoft Code Signing PCA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2017-Oct-11 02:10:42\nDetected languages: English - United States\nDebug artifacts: vcruntime140.amd64.pdb\nCompanyName: Microsoft Corporation\nFileDescription: Microsoft® C Runtime Library\nFileVersion: 14.12.25810.0 built by: VCTOOLSREL\nInternalName: vcruntime140.dll\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: vcruntime140.dll\nProductName: Microsoft® Visual Studio® 2017\nProductVersion: 14.12.25810.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2017-Oct-11 02:10:42\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x0000CE00\nSizeOfInitializedData: 0x00005400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000000C5D0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: A.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00016000\nSizeOfHeaders: 0x00000400\nChecksum: 0x000259DD\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0000CC24\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0000CE00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.36813\n\n.rdata:\n VirtualSize: 0x000036B8\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00003800\n PointerToRawData: 0x0000D200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.64186\n\n.data:\n VirtualSize: 0x00000930\n VirtualAddress: 0x00012000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00010A00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.37175\n\n.pdata:\n VirtualSize: 0x00000828\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00010E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.9477\n\n.rsrc:\n VirtualSize: 0x00000408\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00011800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.46389\n\n.reloc:\n VirtualSize: 0x00000170\n VirtualAddress: 0x00015000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00011E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 4.15556"},"Imports":{"raw":"api-ms-win-crt-runtime-l1-1-0.dll: abort\n terminate\napi-ms-win-crt-string-l1-1-0.dll: wcsncmp\n strcpy_s\napi-ms-win-crt-heap-l1-1-0.dll: _free_base\n _malloc_base\n malloc\n free\n _calloc_base\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vsprintf_s\napi-ms-win-crt-convert-l1-1-0.dll: atol\nKERNEL32.dll: SetLastError\n IsProcessorFeaturePresent\n TerminateProcess\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlCaptureContext\n GetSystemTimeAsFileTime\n GetCurrentThreadId\n GetCurrentProcessId\n QueryPerformanceCounter\n RtlLookupFunctionEntry\n GetModuleHandleW\n GetModuleFileNameW\n LoadLibraryExW\n RtlUnwindEx\n EncodePointer\n RaiseException\n RtlPcToFileHeader\n InterlockedFlushSList\n InterlockedPushEntrySList\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n TlsGetValue\n GetLastError\n TlsSetValue\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n GetProcAddress\n FreeLibrary\n TlsFree"},"Exports":{"raw":"_CreateFrameInfo:\n Ordinal: 1\n Address: 0x0000C170\n\n_CxxThrowException:\n Ordinal: 2\n Address: 0x00004620\n\n_FindAndUnlinkFrame:\n Ordinal: 3\n Address: 0x0000C1D0\n\n_IsExceptionObjectToBeDestroyed:\n Ordinal: 4\n Address: 0x00001B60\n\n_SetWinRTOutOfMemoryExceptionCallback:\n Ordinal: 5\n Address: 0x00001AB0\n\n__AdjustPointer:\n Ordinal: 6\n Address: 0x000017F0\n\n__BuildCatchObject:\n Ordinal: 7\n Address: 0x00003270\n\n__BuildCatchObjectHelper:\n Ordinal: 8\n Address: 0x00003040\n\n__C_specific_handler:\n Ordinal: 9\n Address: 0x0000C680\n\n__C_specific_handler_noexcept:\n Ordinal: 10\n Address: 0x0000C380\n\n__CxxDetectRethrow:\n Ordinal: 11\n Address: 0x000038E0\n\n__CxxExceptionFilter:\n Ordinal: 12\n Address: 0x00003550\n\n__CxxFrameHandler:\n Ordinal: 13\n Address: 0x0000BFC0\n\n__CxxFrameHandler2:\n Ordinal: 14\n Address: 0x0000BFC0\n\n__CxxFrameHandler3:\n Ordinal: 15\n Address: 0x0000BF20\n\n__CxxQueryExceptionSize:\n Ordinal: 16\n Address: 0x00003B20\n\n__CxxRegisterExceptionObject:\n Ordinal: 17\n Address: 0x000037D0\n\n__CxxUnregisterExceptionObject:\n Ordinal: 18\n Address: 0x00003930\n\n__DestructExceptionObject:\n Ordinal: 19\n Address: 0x00001AD0\n\n__FrameUnwindFilter:\n Ordinal: 20\n Address: 0x00001A40\n\n__GetPlatformExceptionInfo:\n Ordinal: 21\n Address: 0x00001820\n\n__NLG_Dispatch2:\n Ordinal: 22\n Address: 0x0000C660\n\n__NLG_Return2:\n Ordinal: 23\n Address: 0x0000C670\n\n__RTCastToVoid:\n Ordinal: 24\n Address: 0x00003B80\n\n__RTDynamicCast:\n Ordinal: 25\n Address: 0x00003D20\n\n__RTtypeid:\n Ordinal: 26\n Address: 0x00003C70\n\n__TypeMatch:\n Ordinal: 27\n Address: 0x000028B0\n\n__current_exception:\n Ordinal: 28\n Address: 0x000019E0\n\n__current_exception_context:\n Ordinal: 29\n Address: 0x00001A00\n\n__intrinsic_setjmp:\n Ordinal: 30\n Address: 0x0000D750\n\n__intrinsic_setjmpex:\n Ordinal: 31\n Address: 0x0000D810\n\n__processing_throw:\n Ordinal: 32\n Address: 0x00001A20\n\n__report_gsfailure:\n Ordinal: 33\n Address: 0x0000D450\n\n__std_exception_copy:\n Ordinal: 34\n Address: 0x00004380\n\n__std_exception_destroy:\n Ordinal: 35\n Address: 0x00004410\n\n__std_terminate:\n Ordinal: 36\n Address: 0x00001AC0\n\n__std_type_info_compare:\n Ordinal: 37\n Address: 0x00004440\n\n__std_type_info_destroy_list:\n Ordinal: 38\n Address: 0x000045F0\n\n__std_type_info_hash:\n Ordinal: 39\n Address: 0x00004470\n\n__std_type_info_name:\n Ordinal: 40\n Address: 0x000044B0\n\n__telemetry_main_invoke_trigger:\n Ordinal: 41\n Address: 0x00001000\n\n__telemetry_main_return_trigger:\n Ordinal: 42\n Address: 0x00001000\n\n__unDName:\n Ordinal: 43\n Address: 0x00004E10\n\n__unDNameEx:\n Ordinal: 44\n Address: 0x00004F60\n\n__uncaught_exception:\n Ordinal: 45\n Address: 0x00001930\n\n__uncaught_exceptions:\n Ordinal: 46\n Address: 0x00001890\n\n__vcrt_GetModuleFileNameW:\n Ordinal: 47\n Address: 0x00004CF0\n\n__vcrt_GetModuleHandleW:\n Ordinal: 48\n Address: 0x00004D00\n\n__vcrt_InitializeCriticalSectionEx:\n Ordinal: 49\n Address: 0x00004C70\n\n__vcrt_LoadLibraryExW:\n Ordinal: 50\n Address: 0x00004D10\n\n_get_purecall_handler:\n Ordinal: 51\n Address: 0x00004DA0\n\n_get_unexpected:\n Ordinal: 52\n Address: 0x00004700\n\n_is_exception_typeof:\n Ordinal: 53\n Address: 0x00001BA0\n\n_local_unwind:\n Ordinal: 54\n Address: 0x0000C610\n\n_purecall:\n Ordinal: 55\n Address: 0x00004D20\n\n_set_purecall_handler:\n Ordinal: 56\n Address: 0x00004D60\n\n_set_se_translator:\n Ordinal: 57\n Address: 0x000047B0\n\nlongjmp:\n Ordinal: 58\n Address: 0x00001040\n\nmemchr:\n Ordinal: 59\n Address: 0x0000C8F0\n\nmemcmp:\n Ordinal: 60\n Address: 0x0000C970\n\nmemcpy:\n Ordinal: 61\n Address: 0x0000CA50\n\nmemmove:\n Ordinal: 62\n Address: 0x0000CA50\n\nmemset:\n Ordinal: 63\n Address: 0x0000CEB0\n\nset_unexpected:\n Ordinal: 64\n Address: 0x00004730\n\nstrchr:\n Ordinal: 65\n Address: 0x00001090\n\nstrrchr:\n Ordinal: 66\n Address: 0x00001120\n\nstrstr:\n Ordinal: 67\n Address: 0x00001270\n\nunexpected:\n Ordinal: 68\n Address: 0x00004770\n\nwcschr:\n Ordinal: 69\n Address: 0x00001470\n\nwcsrchr:\n Ordinal: 70\n Address: 0x00001510\n\nwcsstr:\n Ordinal: 71\n Address: 0x000015D0"},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 932\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.4971\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 14.12.25810.0\n ProductVersion: 14.12.25810.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Microsoft® C Runtime Library\n FileVersion (#2): 14.12.25810.0 built by: VCTOOLSREL\n InternalName: vcruntime140.dll\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: vcruntime140.dll\n ProductName: Microsoft® Visual Studio® 2017\n ProductVersion (#2): 14.12.25810.0"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2017-Oct-11 02:10:42\n Version: 0.0\n SizeofData: 47\n AddressOfRawData: 0x0000FD20\n PointerToRawData: 0x0000EF20\n Referenced File: vcruntime140.amd64.pdb\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2017-Oct-11 02:10:42\n Version: 0.0\n SizeofData: 432\n AddressOfRawData: 0x0000FD50\n PointerToRawData: 0x0000EF50"},"Load Configuration":{"raw":"Size: 256\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180012010\nGuardCFCheckFunctionPointer: 0x000000018000E190\nGuardCFDispatchFunctionPointer: 0x0000000000000000\nGuardCFFunctionTable: 0x0000000000000000\nGuardCFFunctionCount: 0x0000000000000000\nGuardFlags: (EMPTY)\nCodeIntegrity.Flags: 0x0000\nCodeIntegrity.Catalog: 0x0000\nCodeIntegrity.CatalogOffset: 0x00000000\nCodeIntegrity.Reserved: 0x00000000\nGuardAddressTakenIatEntryTable: 0x0000000000000000\nGuardAddressTakenIatEntryCount: 0\nGuardLongJumpTargetTable: 0x0000000000000000\nGuardLongJumpTargetCount: 0"},"RICH Header":{"raw":"XOR Key: 0x44AE78B5\nUnmarked objects: 0\n239 (40116): 2\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 44\nC++ objects (25805): 3\nC objects (25805): 10\nASM objects (25805): 13\nC objects (LTCG) (25805): 31\nExports (25805): 1\nResource objects (25805): 1\nLinker (25805): 1\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: enabled\n\nThe PE is digitally signed.\n Signer: Microsoft Corporation\n Issuer: Microsoft Code Signing PCA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_decoded_b3mhwr_g/zlib_offset_0x184bd5_7.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_9efw58l2/output.txt"},"timestamp":"2026-07-19 16:13:15"} {"_id":{"$oid":"6a5cae60b3bed57e0e7378f8"},"sha256":"e632a474347f7e231beff070ce83413f9062dfc361fcdab25e0a3fb67a0326fc","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/at-019f7a056e6c71f0acf04abd83f619e7.exe\nDate: 2026-07-19 16:30:48\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/at-019f7a056e6c71f0acf04abd83f619e7.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2052-Jun-18 10:14:14\nComments: \nCompanyName: \nFileDescription: WaterCycle\nFileVersion: 1.0.0.0\nInternalName: vBlW.exe\nLegalCopyright: Copyright © 2026\nLegalTrademarks: \nOriginalFilename: vBlW.exe\nProductName: WaterCycle\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2052-Jun-18 10:14:14\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x000F3A00\nSizeOfInitializedData: 0x00000800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000F583E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x000F6000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x000FA000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 15\n\nSections:\n---------\n.text:\n VirtualSize: 0x000F3844\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x000F3A00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.88764\n\n.rsrc:\n VirtualSize: 0x000005A0\n VirtualAddress: 0x000F6000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x000F3C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.06223\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x000F8000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000F4200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191\n\n\nImports:\n--------\nmscoree.dll: _CorExeMain\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26328\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: WaterCycle\n FileVersion (#2): 1.0.0.0\n InternalName: vBlW.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: vBlW.exe\n ProductName: WaterCycle\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n\nCryptographic algorithms detected in the binary:\n Uses constants related to MD5\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2052-Jun-18 10:14:14\nComments: \nCompanyName: \nFileDescription: WaterCycle\nFileVersion: 1.0.0.0\nInternalName: vBlW.exe\nLegalCopyright: Copyright © 2026\nLegalTrademarks: \nOriginalFilename: vBlW.exe\nProductName: WaterCycle\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 3\nTimeDateStamp: 2052-Jun-18 10:14:14\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 48.0\nSizeOfCode: 0x000F3A00\nSizeOfInitializedData: 0x00000800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000F583E (Section: .text)\nBaseOfCode: 0x00002000\nBaseOfData: 0x000F6000\nImageBase: 0x00400000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x000FA000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 15"},"Sections":{"raw":".text:\n VirtualSize: 0x000F3844\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x000F3A00\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.88764\n\n.rsrc:\n VirtualSize: 0x000005A0\n VirtualAddress: 0x000F6000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x000F3C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.06223\n\n.reloc:\n VirtualSize: 0x0000000C\n VirtualAddress: 0x000F8000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x000F4200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0.10191"},"Imports":{"raw":"mscoree.dll: _CorExeMain\n\nResources:\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26328\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: WaterCycle\n FileVersion (#2): 1.0.0.0\n InternalName: vBlW.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: vBlW.exe\n ProductName: WaterCycle\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n\nCryptographic algorithms detected in the binary:\n Uses constants related to MD5\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26328\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: WaterCycle\n FileVersion (#2): 1.0.0.0\n InternalName: vBlW.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: vBlW.exe\n ProductName: WaterCycle\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\nMatching compiler(s):\n Microsoft Visual C# v7.0 / Basic .NET\n\nCryptographic algorithms detected in the binary:\n Uses constants related to MD5\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/at-019f7a056e6c71f0acf04abd83f619e7.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_l3gos2cl/output.txt"},"timestamp":"2026-07-19 16:30:48"} {"_id":{"$oid":"6a5d2971b3bed57e0e73790e"},"sha256":"db8ce34cefcc83edd0e245844f35373828004706eb41f952ad0c2522e10e4b9c","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_unpack_9adg1u7w/db8ce34cefcc83edd0e245844f35373828004706eb41f952ad0c2522e10e4b9c-019f7bbf31657dc2a579e1bfd6e021be.exe_db8ce34cefcc/006_binwalk_AutoIt3.exe.exe\nDate: 2026-07-20 01:39:20\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_unpack_9adg1u7w/db8ce34cefcc83edd0e245844f35373828004706eb41f952ad0c2522e10e4b9c-019f7bbf31657dc2a579e1bfd6e021be.exe_db8ce34cefcc/006_binwalk_AutoIt3.exe.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2022-Sep-19 18:34:17\nDetected languages: English - United Kingdom\n English - United States\nCompanyName: AutoIt Team\nComments: http://www.autoitscript.com/autoit3/\nFileDescription: AutoIt v3 Script\nFileVersion: 3, 3, 16, 1\nInternalName: AutoIt3.exe\nLegalCopyright: © 1999-2022 Jonathan Bennett & AutoIt Team\nOriginalFilename: AutoIt3.exe\nProductName: AutoIt v3 Script\nProductVersion: 3, 3, 16, 1\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000118\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2022-Sep-19 18:34:17\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0009B600\nSizeOfInitializedData: 0x0004BE00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00020907 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0009D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x000EB000\nSizeOfHeaders: 0x00000400\nChecksum: 0x000F4CC7\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00400000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00400000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x0009B47C\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0009B600\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.67207\n\n.rdata:\n VirtualSize: 0x0002FBA2\n VirtualAddress: 0x0009D000\n SizeOfRawData: 0x0002FC00\n PointerToRawData: 0x0009BA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.69248\n\n.data:\n VirtualSize: 0x0000706C\n VirtualAddress: 0x000CD000\n SizeOfRawData: 0x00004800\n PointerToRawData: 0x000CB600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.580691\n\n.rsrc:\n VirtualSize: 0x0000D750\n VirtualAddress: 0x000D5000\n SizeOfRawData: 0x0000D800\n PointerToRawData: 0x000CFE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.92606\n\n.reloc:\n VirtualSize: 0x00007650\n VirtualAddress: 0x000E3000\n SizeOfRawData: 0x00007800\n PointerToRawData: 0x000DD600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.76786\n\n\nImports:\n--------\nWSOCK32.dll: gethostbyname\n recv\n send\n socket\n inet_ntoa\n setsockopt\n ntohs\n WSACleanup\n WSAStartup\n sendto\n htons\n __WSAFDIsSet\n select\n accept\n listen\n bind\n inet_addr\n ioctlsocket\n recvfrom\n WSAGetLastError\n closesocket\n gethostname\n connect\nVERSION.dll: GetFileVersionInfoW\n VerQueryValueW\n GetFileVersionInfoSizeW\nWINMM.dll: timeGetTime\n waveOutSetVolume\n mciSendStringW\nCOMCTL32.dll: ImageList_ReplaceIcon\n ImageList_Destroy\n ImageList_Remove\n ImageList_SetDragCursorImage\n ImageList_BeginDrag\n ImageList_DragEnter\n ImageList_DragLeave\n ImageList_EndDrag\n ImageList_DragMove\n InitCommonControlsEx\n ImageList_Create\nMPR.dll: WNetGetConnectionW\n WNetCancelConnection2W\n WNetUseConnectionW\n WNetAddConnection2W\nWININET.dll: HttpOpenRequestW\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n HttpQueryInfoW\n InternetQueryOptionW\n InternetConnectW\n HttpSendRequestW\n FtpOpenFileW\n FtpGetFileSize\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\nPSAPI.DLL: GetProcessMemoryInfo\nIPHLPAPI.DLL: IcmpSendEcho\n IcmpCloseHandle\n IcmpCreateFile\nUSERENV.dll: DestroyEnvironmentBlock\n LoadUserProfileW\n CreateEnvironmentBlock\n UnloadUserProfile\nUxTheme.dll: IsThemeActive\nKERNEL32.dll: DuplicateHandle\n CreateThread\n WaitForSingleObject\n HeapAlloc\n GetProcessHeap\n HeapFree\n Sleep\n GetCurrentThreadId\n MultiByteToWideChar\n MulDiv\n GetVersionExW\n IsWow64Process\n GetSystemInfo\n FreeLibrary\n LoadLibraryA\n GetProcAddress\n SetErrorMode\n GetModuleFileNameW\n WideCharToMultiByte\n lstrcpyW\n lstrlenW\n GetModuleHandleW\n QueryPerformanceCounter\n VirtualFreeEx\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n ReadProcessMemory\n CreateFileW\n SetFilePointerEx\n SetEndOfFile\n ReadFile\n WriteFile\n FlushFileBuffers\n TerminateProcess\n CreateToolhelp32Snapshot\n Process32FirstW\n Process32NextW\n SetFileTime\n GetFileAttributesW\n FindFirstFileW\n FindClose\n GetLongPathNameW\n GetShortPathNameW\n DeleteFileW\n IsDebuggerPresent\n CopyFileExW\n MoveFileW\n CreateDirectoryW\n RemoveDirectoryW\n SetSystemPowerState\n QueryPerformanceFrequency\n LoadResource\n LockResource\n SizeofResource\n OutputDebugStringW\n GetTempPathW\n GetTempFileNameW\n DeviceIoControl\n LoadLibraryW\n GetLocalTime\n CompareStringW\n GetCurrentThread\n EnterCriticalSection\n LeaveCriticalSection\n GetStdHandle\n CreatePipe\n InterlockedExchange\n TerminateThread\n LoadLibraryExW\n FindResourceExW\n CopyFileW\n VirtualFree\n FormatMessageW\n GetExitCodeProcess\n GetPrivateProfileStringW\n WritePrivateProfileStringW\n GetPrivateProfileSectionW\n WritePrivateProfileSectionW\n GetPrivateProfileSectionNamesW\n FileTimeToLocalFileTime\n FileTimeToSystemTime\n SystemTimeToFileTime\n LocalFileTimeToFileTime\n GetDriveTypeW\n GetDiskFreeSpaceExW\n GetDiskFreeSpaceW\n GetVolumeInformationW\n SetVolumeLabelW\n CreateHardLinkW\n SetFileAttributesW\n CreateEventW\n SetEvent\n GetEnvironmentVariableW\n SetEnvironmentVariableW\n GlobalLock\n GlobalUnlock\n GlobalAlloc\n GetFileSize\n GlobalFree\n GlobalMemoryStatusEx\n Beep\n GetSystemDirectoryW\n HeapReAlloc\n HeapSize\n GetComputerNameW\n GetWindowsDirectoryW\n GetCurrentProcessId\n GetProcessIoCounters\n CreateProcessW\n GetProcessId\n SetPriorityClass\n VirtualAlloc\n GetCurrentDirectoryW\n lstrcmpiW\n DecodePointer\n GetLastError\n RaiseException\n InitializeCriticalSectionAndSpinCount\n DeleteCriticalSection\n InterlockedDecrement\n InterlockedIncrement\n ResetEvent\n WaitForSingleObjectEx\n IsProcessorFeaturePresent\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n CloseHandle\n GetFullPathNameW\n GetStartupInfoW\n GetSystemTimeAsFileTime\n InitializeSListHead\n RtlUnwind\n SetLastError\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n EncodePointer\n ExitProcess\n GetModuleHandleExW\n ExitThread\n ResumeThread\n FreeLibraryAndExitThread\n GetACP\n GetDateFormatW\n GetTimeFormatW\n LCMapStringW\n GetStringTypeW\n GetFileType\n SetStdHandle\n GetConsoleCP\n GetConsoleMode\n ReadConsoleW\n GetTimeZoneInformation\n FindFirstFileExW\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetCommandLineW\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n SetEnvironmentVariableA\n SetCurrentDirectoryW\n FindNextFileW\n WriteConsoleW\nUSER32.dll: ClientToScreen\n GetKeyboardLayoutNameW\n IsCharAlphaW\n IsCharAlphaNumericW\n IsCharLowerW\n IsCharUpperW\n GetMenuStringW\n GetSubMenu\n GetCaretPos\n IsZoomed\n GetMonitorInfoW\n SetLayeredWindowAttributes\n FlashWindow\n GetClassLongW\n TranslateAcceleratorW\n IsDialogMessageW\n GetSysColor\n InflateRect\n DrawFocusRect\n DrawTextW\n FrameRect\n DrawFrameControl\n FillRect\n PtInRect\n DestroyAcceleratorTable\n CreateAcceleratorTableW\n SetCursor\n GetWindowDC\n GetSystemMetrics\n GetActiveWindow\n CharNextW\n wsprintfW\n RedrawWindow\n DrawMenuBar\n DestroyMenu\n SetMenu\n GetWindowTextLengthW\n CreateMenu\n IsDlgButtonChecked\n DefDlgProcW\n CallWindowProcW\n ReleaseCapture\n SetCapture\n GetInputState\n UnregisterHotKey\n CharLowerBuffW\n MonitorFromPoint\n MonitorFromRect\n LoadImageW\n mouse_event\n ExitWindowsEx\n SetActiveWindow\n FindWindowExW\n EnumThreadWindows\n SetMenuDefaultItem\n InsertMenuItemW\n IsMenu\n TrackPopupMenuEx\n RegisterHotKey\n DeleteMenu\n CheckMenuRadioItem\n GetMenuItemID\n GetMenuItemCount\n SetMenuItemInfoW\n GetMenuItemInfoW\n SetForegroundWindow\n IsIconic\n FindWindowW\n SystemParametersInfoW\n keybd_event\n DispatchMessageW\n GetAsyncKeyState\n SetKeyboardState\n GetKeyboardState\n GetKeyState\n VkKeyScanW\n LoadStringW\n DialogBoxParamW\n MessageBeep\n EndDialog\n SendDlgItemMessageW\n GetDlgItem\n SetWindowTextW\n CopyRect\n ReleaseDC\n GetDC\n EndPaint\n BeginPaint\n GetClientRect\n GetMenu\n DestroyWindow\n EnumWindows\n GetDesktopWindow\n IsWindow\n IsWindowEnabled\n IsWindowVisible\n EnableWindow\n InvalidateRect\n GetWindowLongW\n GetWindowThreadProcessId\n AttachThreadInput\n GetFocus\n GetWindowTextW\n ScreenToClient\n EnumChildWindows\n CharUpperBuffW\n GetClassNameW\n GetParent\n GetDlgCtrlID\n MapVirtualKeyW\n PostMessageW\n GetWindowRect\n SetUserObjectSecurity\n CloseDesktop\n CloseWindowStation\n OpenDesktopW\n SetProcessWindowStation\n GetProcessWindowStation\n GetCursorInfo\n SetWindowPos\n CopyImage\n AdjustWindowRectEx\n SetRect\n SetClipboardData\n EmptyClipboard\n CountClipboardFormats\n CloseClipboard\n GetClipboardData\n IsClipboardFormatAvailable\n OpenClipboard\n BlockInput\n GetMessageW\n GetCursorPos\n LockWindowUpdate\n OpenWindowStationW\n GetUserObjectSecurity\n MessageBoxW\n DefWindowProcW\n MoveWindow\n SetFocus\n PostQuitMessage\n KillTimer\n CreatePopupMenu\n RegisterWindowMessageW\n SetTimer\n ShowWindow\n RegisterClassExW\n LoadIconW\n LoadCursorW\n GetSysColorBrush\n GetForegroundWindow\n MessageBoxA\n DestroyIcon\n SetWindowLongW\n CreateWindowExW\n SendMessageW\n TranslateMessage\n SendInput\n PeekMessageW\n SendMessageTimeoutW\nGDI32.dll: EndPath\n DeleteObject\n GetTextExtentPoint32W\n ExtCreatePen\n StrokeAndFillPath\n GetDeviceCaps\n SetPixel\n CloseFigure\n LineTo\n AngleArc\n MoveToEx\n Ellipse\n CreateCompatibleBitmap\n CreateCompatibleDC\n PolyDraw\n BeginPath\n Rectangle\n SetViewportOrgEx\n GetObjectW\n SetBkMode\n RoundRect\n SetBkColor\n CreatePen\n SelectObject\n StretchBlt\n CreateSolidBrush\n SetTextColor\n CreateFontW\n GetTextFaceW\n GetStockObject\n CreateDCW\n GetPixel\n DeleteDC\n GetDIBits\n StrokePath\nCOMDLG32.dll: GetSaveFileNameW\n GetOpenFileNameW\nADVAPI32.dll: GetAce\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegConnectRegistryW\n InitializeSecurityDescriptor\n InitializeAcl\n AdjustTokenPrivileges\n OpenThreadToken\n OpenProcessToken\n LookupPrivilegeValueW\n DuplicateTokenEx\n CreateProcessAsUserW\n CreateProcessWithLogonW\n GetLengthSid\n CopySid\n LogonUserW\n AllocateAndInitializeSid\n CheckTokenMembership\n FreeSid\n GetTokenInformation\n RegCreateKeyExW\n GetSecurityDescriptorDacl\n GetAclInformation\n GetUserNameW\n AddAce\n SetSecurityDescriptorDacl\n InitiateSystemShutdownExW\nSHELL32.dll: DragFinish\n DragQueryPoint\n ShellExecuteExW\n DragQueryFileW\n SHEmptyRecycleBinW\n SHGetPathFromIDListW\n SHBrowseForFolderW\n SHCreateShellItem\n SHGetDesktopFolder\n SHGetSpecialFolderLocation\n SHGetFolderPathW\n SHFileOperationW\n ExtractIconExW\n Shell_NotifyIconW\n ShellExecuteW\nole32.dll: CoTaskMemAlloc\n CoTaskMemFree\n CLSIDFromString\n ProgIDFromCLSID\n CLSIDFromProgID\n OleSetMenuDescriptor\n MkParseDisplayName\n OleSetContainedObject\n CoCreateInstance\n IIDFromString\n StringFromGUID2\n CreateStreamOnHGlobal\n OleInitialize\n OleUninitialize\n CoInitialize\n CoUninitialize\n GetRunningObjectTable\n CoGetInstanceFromFile\n CoGetObject\n CoInitializeSecurity\n CoCreateInstanceEx\n CoSetProxyBlanket\nOLEAUT32.dll: CreateStdDispatch\n CreateDispTypeInfo\n UnRegisterTypeLib\n UnRegisterTypeLibForUser\n RegisterTypeLibForUser\n RegisterTypeLib\n LoadTypeLibEx\n VariantCopyInd\n SysReAllocString\n SysFreeString\n VariantChangeType\n SafeArrayDestroyData\n SafeArrayUnaccessData\n SafeArrayAccessData\n SafeArrayAllocData\n SafeArrayAllocDescriptorEx\n SafeArrayCreateVector\n SysStringLen\n QueryPathOfRegTypeLib\n SysAllocString\n VariantInit\n VariantClear\n DispCallFunc\n VariantTimeToSystemTime\n VarR8FromDec\n SafeArrayGetVartype\n SafeArrayDestroyDescriptor\n VariantCopy\n OleLoadPicture\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.72194\n\n2:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88834\n\n3:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27904\n\n4:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46186\n\n5:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.3496\n\n6:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.31773\n\n7:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 16193\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95102\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46038\n\n9:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.71915\n\n10:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21322\n\n11:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.25499\n\n12:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05883\n\n13:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.66371\n\n166:\n Type: RT_MENU\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 80\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68292\n\n1000:\n Type: RT_DIALOG\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 252\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.03986\n\n7 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1428\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34702\n\n8 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1674\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2804\n\n9 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28849\n\n10 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1532\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28373\n\n11 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26322\n\n12 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25812\n\n313:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 344\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08572\n\n99:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 146\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90294\n Detected Filetype: Icon file\n\n162:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n164:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n169:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.47788\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1068\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.33361\n\n\nVersion Info:\n-------------\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 3.3.16.1\n ProductVersion: 3.3.16.1\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: English - United Kingdom\n CompanyName: AutoIt Team\n Comments: http://www.autoitscript.com/autoit3/\n FileDescription: AutoIt v3 Script\n FileVersion (#2): 3, 3, 16, 1\n InternalName: AutoIt3.exe\n LegalCopyright: © 1999-2022 Jonathan Bennett & AutoIt Team\n OriginalFilename: AutoIt3.exe\n ProductName: AutoIt v3 Script\n ProductVersion (#2): 3, 3, 16, 1\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Sep-19 18:34:17\n Version: 0.0\n SizeofData: 1116\n AddressOfRawData: 0x000C9220\n PointerToRawData: 0x000C7C20\n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x004C969C\nEndAddressOfRawData: 0x004C96A4\nAddressOfIndex: 0x004D1740\nAddressOfCallbacks: 0x0049D8F8\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\n-------------------\nSize: 160\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004CD014\nSEHandlerTable: 0x00000000\nSEHandlerCount: 0\n\nRICH Header:\n------------\nXOR Key: 0x68C0A7EC\nUnmarked objects: 0\n241 (40116): 35\n243 (40116): 157\n242 (40116): 35\n199 (41118): 1\nC++ objects (VS 2015/2017 runtime 26706): 45\nC objects (VS 2015/2017 runtime 26706): 18\nASM objects (VS 2015/2017 runtime 26706): 21\nC objects (VS2008 SP1 build 30729): 9\nImports (VS2008 SP1 build 30729): 37\nTotal imports: 553\nC++ objects (POGO O) (27045): 81\nASM objects (27045): 1\nResource objects (27045): 1\n151: 2\nLinker (27045): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Is an AutoIT compiled script:\n AutoIt Error\n reserved for AutoIt internal use\n Contains domain names:\n autoitscript.com\n http://www.autoitscript.com\n http://www.autoitscript.com/autoit3/\n www.autoitscript.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses known Mersenne Twister constants\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryW\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n FindWindowW\n Code injection capabilities:\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n VirtualAlloc\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n RegisterHotKey\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n CreateProcessWithLogonW\n ShellExecuteW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n AttachThreadInput\n MapVirtualKeyW\n GetForegroundWindow\n Has Internet access capabilities:\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n InternetQueryOptionW\n InternetConnectW\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n DuplicateTokenEx\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n GetVolumeInformationW\n Manipulates other processes:\n OpenProcess\n WriteProcessMemory\n ReadProcessMemory\n Process32FirstW\n Process32NextW\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n Reads the contents of the clipboard:\n GetClipboardData\n Can shut the system down or lock the screen:\n ExitWindowsEx\n InitiateSystemShutdownExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: AutoIt Consulting Ltd\n Issuer: GlobalSign CodeSigning CA - SHA256 - G3\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2022-Sep-19 18:34:17\nDetected languages: English - United Kingdom\n English - United States\nCompanyName: AutoIt Team\nComments: http://www.autoitscript.com/autoit3/\nFileDescription: AutoIt v3 Script\nFileVersion: 3, 3, 16, 1\nInternalName: AutoIt3.exe\nLegalCopyright: © 1999-2022 Jonathan Bennett & AutoIt Team\nOriginalFilename: AutoIt3.exe\nProductName: AutoIt v3 Script\nProductVersion: 3, 3, 16, 1"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000118"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 5\nTimeDateStamp: 2022-Sep-19 18:34:17\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 14.0\nSizeOfCode: 0x0009B600\nSizeOfInitializedData: 0x0004BE00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00020907 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x0009D000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.1\nImageVersion: 0.0\nSubsystemVersion: 5.1\nWin32VersionValue: 0\nSizeOfImage: 0x000EB000\nSizeOfHeaders: 0x00000400\nChecksum: 0x000F4CC7\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x00400000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00400000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x0009B47C\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x0009B600\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.67207\n\n.rdata:\n VirtualSize: 0x0002FBA2\n VirtualAddress: 0x0009D000\n SizeOfRawData: 0x0002FC00\n PointerToRawData: 0x0009BA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.69248\n\n.data:\n VirtualSize: 0x0000706C\n VirtualAddress: 0x000CD000\n SizeOfRawData: 0x00004800\n PointerToRawData: 0x000CB600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.580691\n\n.rsrc:\n VirtualSize: 0x0000D750\n VirtualAddress: 0x000D5000\n SizeOfRawData: 0x0000D800\n PointerToRawData: 0x000CFE00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.92606\n\n.reloc:\n VirtualSize: 0x00007650\n VirtualAddress: 0x000E3000\n SizeOfRawData: 0x00007800\n PointerToRawData: 0x000DD600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 6.76786"},"Imports":{"raw":"WSOCK32.dll: gethostbyname\n recv\n send\n socket\n inet_ntoa\n setsockopt\n ntohs\n WSACleanup\n WSAStartup\n sendto\n htons\n __WSAFDIsSet\n select\n accept\n listen\n bind\n inet_addr\n ioctlsocket\n recvfrom\n WSAGetLastError\n closesocket\n gethostname\n connect\nVERSION.dll: GetFileVersionInfoW\n VerQueryValueW\n GetFileVersionInfoSizeW\nWINMM.dll: timeGetTime\n waveOutSetVolume\n mciSendStringW\nCOMCTL32.dll: ImageList_ReplaceIcon\n ImageList_Destroy\n ImageList_Remove\n ImageList_SetDragCursorImage\n ImageList_BeginDrag\n ImageList_DragEnter\n ImageList_DragLeave\n ImageList_EndDrag\n ImageList_DragMove\n InitCommonControlsEx\n ImageList_Create\nMPR.dll: WNetGetConnectionW\n WNetCancelConnection2W\n WNetUseConnectionW\n WNetAddConnection2W\nWININET.dll: HttpOpenRequestW\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n HttpQueryInfoW\n InternetQueryOptionW\n InternetConnectW\n HttpSendRequestW\n FtpOpenFileW\n FtpGetFileSize\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\nPSAPI.DLL: GetProcessMemoryInfo\nIPHLPAPI.DLL: IcmpSendEcho\n IcmpCloseHandle\n IcmpCreateFile\nUSERENV.dll: DestroyEnvironmentBlock\n LoadUserProfileW\n CreateEnvironmentBlock\n UnloadUserProfile\nUxTheme.dll: IsThemeActive\nKERNEL32.dll: DuplicateHandle\n CreateThread\n WaitForSingleObject\n HeapAlloc\n GetProcessHeap\n HeapFree\n Sleep\n GetCurrentThreadId\n MultiByteToWideChar\n MulDiv\n GetVersionExW\n IsWow64Process\n GetSystemInfo\n FreeLibrary\n LoadLibraryA\n GetProcAddress\n SetErrorMode\n GetModuleFileNameW\n WideCharToMultiByte\n lstrcpyW\n lstrlenW\n GetModuleHandleW\n QueryPerformanceCounter\n VirtualFreeEx\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n ReadProcessMemory\n CreateFileW\n SetFilePointerEx\n SetEndOfFile\n ReadFile\n WriteFile\n FlushFileBuffers\n TerminateProcess\n CreateToolhelp32Snapshot\n Process32FirstW\n Process32NextW\n SetFileTime\n GetFileAttributesW\n FindFirstFileW\n FindClose\n GetLongPathNameW\n GetShortPathNameW\n DeleteFileW\n IsDebuggerPresent\n CopyFileExW\n MoveFileW\n CreateDirectoryW\n RemoveDirectoryW\n SetSystemPowerState\n QueryPerformanceFrequency\n LoadResource\n LockResource\n SizeofResource\n OutputDebugStringW\n GetTempPathW\n GetTempFileNameW\n DeviceIoControl\n LoadLibraryW\n GetLocalTime\n CompareStringW\n GetCurrentThread\n EnterCriticalSection\n LeaveCriticalSection\n GetStdHandle\n CreatePipe\n InterlockedExchange\n TerminateThread\n LoadLibraryExW\n FindResourceExW\n CopyFileW\n VirtualFree\n FormatMessageW\n GetExitCodeProcess\n GetPrivateProfileStringW\n WritePrivateProfileStringW\n GetPrivateProfileSectionW\n WritePrivateProfileSectionW\n GetPrivateProfileSectionNamesW\n FileTimeToLocalFileTime\n FileTimeToSystemTime\n SystemTimeToFileTime\n LocalFileTimeToFileTime\n GetDriveTypeW\n GetDiskFreeSpaceExW\n GetDiskFreeSpaceW\n GetVolumeInformationW\n SetVolumeLabelW\n CreateHardLinkW\n SetFileAttributesW\n CreateEventW\n SetEvent\n GetEnvironmentVariableW\n SetEnvironmentVariableW\n GlobalLock\n GlobalUnlock\n GlobalAlloc\n GetFileSize\n GlobalFree\n GlobalMemoryStatusEx\n Beep\n GetSystemDirectoryW\n HeapReAlloc\n HeapSize\n GetComputerNameW\n GetWindowsDirectoryW\n GetCurrentProcessId\n GetProcessIoCounters\n CreateProcessW\n GetProcessId\n SetPriorityClass\n VirtualAlloc\n GetCurrentDirectoryW\n lstrcmpiW\n DecodePointer\n GetLastError\n RaiseException\n InitializeCriticalSectionAndSpinCount\n DeleteCriticalSection\n InterlockedDecrement\n InterlockedIncrement\n ResetEvent\n WaitForSingleObjectEx\n IsProcessorFeaturePresent\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n GetCurrentProcess\n CloseHandle\n GetFullPathNameW\n GetStartupInfoW\n GetSystemTimeAsFileTime\n InitializeSListHead\n RtlUnwind\n SetLastError\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n EncodePointer\n ExitProcess\n GetModuleHandleExW\n ExitThread\n ResumeThread\n FreeLibraryAndExitThread\n GetACP\n GetDateFormatW\n GetTimeFormatW\n LCMapStringW\n GetStringTypeW\n GetFileType\n SetStdHandle\n GetConsoleCP\n GetConsoleMode\n ReadConsoleW\n GetTimeZoneInformation\n FindFirstFileExW\n IsValidCodePage\n GetOEMCP\n GetCPInfo\n GetCommandLineA\n GetCommandLineW\n GetEnvironmentStringsW\n FreeEnvironmentStringsW\n SetEnvironmentVariableA\n SetCurrentDirectoryW\n FindNextFileW\n WriteConsoleW\nUSER32.dll: ClientToScreen\n GetKeyboardLayoutNameW\n IsCharAlphaW\n IsCharAlphaNumericW\n IsCharLowerW\n IsCharUpperW\n GetMenuStringW\n GetSubMenu\n GetCaretPos\n IsZoomed\n GetMonitorInfoW\n SetLayeredWindowAttributes\n FlashWindow\n GetClassLongW\n TranslateAcceleratorW\n IsDialogMessageW\n GetSysColor\n InflateRect\n DrawFocusRect\n DrawTextW\n FrameRect\n DrawFrameControl\n FillRect\n PtInRect\n DestroyAcceleratorTable\n CreateAcceleratorTableW\n SetCursor\n GetWindowDC\n GetSystemMetrics\n GetActiveWindow\n CharNextW\n wsprintfW\n RedrawWindow\n DrawMenuBar\n DestroyMenu\n SetMenu\n GetWindowTextLengthW\n CreateMenu\n IsDlgButtonChecked\n DefDlgProcW\n CallWindowProcW\n ReleaseCapture\n SetCapture\n GetInputState\n UnregisterHotKey\n CharLowerBuffW\n MonitorFromPoint\n MonitorFromRect\n LoadImageW\n mouse_event\n ExitWindowsEx\n SetActiveWindow\n FindWindowExW\n EnumThreadWindows\n SetMenuDefaultItem\n InsertMenuItemW\n IsMenu\n TrackPopupMenuEx\n RegisterHotKey\n DeleteMenu\n CheckMenuRadioItem\n GetMenuItemID\n GetMenuItemCount\n SetMenuItemInfoW\n GetMenuItemInfoW\n SetForegroundWindow\n IsIconic\n FindWindowW\n SystemParametersInfoW\n keybd_event\n DispatchMessageW\n GetAsyncKeyState\n SetKeyboardState\n GetKeyboardState\n GetKeyState\n VkKeyScanW\n LoadStringW\n DialogBoxParamW\n MessageBeep\n EndDialog\n SendDlgItemMessageW\n GetDlgItem\n SetWindowTextW\n CopyRect\n ReleaseDC\n GetDC\n EndPaint\n BeginPaint\n GetClientRect\n GetMenu\n DestroyWindow\n EnumWindows\n GetDesktopWindow\n IsWindow\n IsWindowEnabled\n IsWindowVisible\n EnableWindow\n InvalidateRect\n GetWindowLongW\n GetWindowThreadProcessId\n AttachThreadInput\n GetFocus\n GetWindowTextW\n ScreenToClient\n EnumChildWindows\n CharUpperBuffW\n GetClassNameW\n GetParent\n GetDlgCtrlID\n MapVirtualKeyW\n PostMessageW\n GetWindowRect\n SetUserObjectSecurity\n CloseDesktop\n CloseWindowStation\n OpenDesktopW\n SetProcessWindowStation\n GetProcessWindowStation\n GetCursorInfo\n SetWindowPos\n CopyImage\n AdjustWindowRectEx\n SetRect\n SetClipboardData\n EmptyClipboard\n CountClipboardFormats\n CloseClipboard\n GetClipboardData\n IsClipboardFormatAvailable\n OpenClipboard\n BlockInput\n GetMessageW\n GetCursorPos\n LockWindowUpdate\n OpenWindowStationW\n GetUserObjectSecurity\n MessageBoxW\n DefWindowProcW\n MoveWindow\n SetFocus\n PostQuitMessage\n KillTimer\n CreatePopupMenu\n RegisterWindowMessageW\n SetTimer\n ShowWindow\n RegisterClassExW\n LoadIconW\n LoadCursorW\n GetSysColorBrush\n GetForegroundWindow\n MessageBoxA\n DestroyIcon\n SetWindowLongW\n CreateWindowExW\n SendMessageW\n TranslateMessage\n SendInput\n PeekMessageW\n SendMessageTimeoutW\nGDI32.dll: EndPath\n DeleteObject\n GetTextExtentPoint32W\n ExtCreatePen\n StrokeAndFillPath\n GetDeviceCaps\n SetPixel\n CloseFigure\n LineTo\n AngleArc\n MoveToEx\n Ellipse\n CreateCompatibleBitmap\n CreateCompatibleDC\n PolyDraw\n BeginPath\n Rectangle\n SetViewportOrgEx\n GetObjectW\n SetBkMode\n RoundRect\n SetBkColor\n CreatePen\n SelectObject\n StretchBlt\n CreateSolidBrush\n SetTextColor\n CreateFontW\n GetTextFaceW\n GetStockObject\n CreateDCW\n GetPixel\n DeleteDC\n GetDIBits\n StrokePath\nCOMDLG32.dll: GetSaveFileNameW\n GetOpenFileNameW\nADVAPI32.dll: GetAce\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegConnectRegistryW\n InitializeSecurityDescriptor\n InitializeAcl\n AdjustTokenPrivileges\n OpenThreadToken\n OpenProcessToken\n LookupPrivilegeValueW\n DuplicateTokenEx\n CreateProcessAsUserW\n CreateProcessWithLogonW\n GetLengthSid\n CopySid\n LogonUserW\n AllocateAndInitializeSid\n CheckTokenMembership\n FreeSid\n GetTokenInformation\n RegCreateKeyExW\n GetSecurityDescriptorDacl\n GetAclInformation\n GetUserNameW\n AddAce\n SetSecurityDescriptorDacl\n InitiateSystemShutdownExW\nSHELL32.dll: DragFinish\n DragQueryPoint\n ShellExecuteExW\n DragQueryFileW\n SHEmptyRecycleBinW\n SHGetPathFromIDListW\n SHBrowseForFolderW\n SHCreateShellItem\n SHGetDesktopFolder\n SHGetSpecialFolderLocation\n SHGetFolderPathW\n SHFileOperationW\n ExtractIconExW\n Shell_NotifyIconW\n ShellExecuteW\nole32.dll: CoTaskMemAlloc\n CoTaskMemFree\n CLSIDFromString\n ProgIDFromCLSID\n CLSIDFromProgID\n OleSetMenuDescriptor\n MkParseDisplayName\n OleSetContainedObject\n CoCreateInstance\n IIDFromString\n StringFromGUID2\n CreateStreamOnHGlobal\n OleInitialize\n OleUninitialize\n CoInitialize\n CoUninitialize\n GetRunningObjectTable\n CoGetInstanceFromFile\n CoGetObject\n CoInitializeSecurity\n CoCreateInstanceEx\n CoSetProxyBlanket\nOLEAUT32.dll: CreateStdDispatch\n CreateDispTypeInfo\n UnRegisterTypeLib\n UnRegisterTypeLibForUser\n RegisterTypeLibForUser\n RegisterTypeLib\n LoadTypeLibEx\n VariantCopyInd\n SysReAllocString\n SysFreeString\n VariantChangeType\n SafeArrayDestroyData\n SafeArrayUnaccessData\n SafeArrayAccessData\n SafeArrayAllocData\n SafeArrayAllocDescriptorEx\n SafeArrayCreateVector\n SysStringLen\n QueryPathOfRegTypeLib\n SysAllocString\n VariantInit\n VariantClear\n DispCallFunc\n VariantTimeToSystemTime\n VarR8FromDec\n SafeArrayGetVartype\n SafeArrayDestroyDescriptor\n VariantCopy\n OleLoadPicture\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.72194\n\n2:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88834\n\n3:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27904\n\n4:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46186\n\n5:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.3496\n\n6:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.31773\n\n7:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 16193\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95102\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46038\n\n9:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.71915\n\n10:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21322\n\n11:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.25499\n\n12:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05883\n\n13:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.66371\n\n166:\n Type: RT_MENU\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 80\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68292\n\n1000:\n Type: RT_DIALOG\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 252\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.03986\n\n7 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1428\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34702\n\n8 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1674\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2804\n\n9 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28849\n\n10 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1532\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28373\n\n11 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26322\n\n12 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25812\n\n313:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 344\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08572\n\n99:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 146\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90294\n Detected Filetype: Icon file\n\n162:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n164:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n169:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.47788\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1068\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.33361\n\n\nVersion Info:\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 3.3.16.1\n ProductVersion: 3.3.16.1\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: English - United Kingdom\n CompanyName: AutoIt Team\n Comments: http://www.autoitscript.com/autoit3/\n FileDescription: AutoIt v3 Script\n FileVersion (#2): 3, 3, 16, 1\n InternalName: AutoIt3.exe\n LegalCopyright: © 1999-2022 Jonathan Bennett & AutoIt Team\n OriginalFilename: AutoIt3.exe\n ProductName: AutoIt v3 Script\n ProductVersion (#2): 3, 3, 16, 1\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Sep-19 18:34:17\n Version: 0.0\n SizeofData: 1116\n AddressOfRawData: 0x000C9220\n PointerToRawData: 0x000C7C20\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x004C969C\nEndAddressOfRawData: 0x004C96A4\nAddressOfIndex: 0x004D1740\nAddressOfCallbacks: 0x0049D8F8\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)\n\nLoad Configuration:\nSize: 160\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004CD014\nSEHandlerTable: 0x00000000\nSEHandlerCount: 0\n\nRICH Header:\nXOR Key: 0x68C0A7EC\nUnmarked objects: 0\n241 (40116): 35\n243 (40116): 157\n242 (40116): 35\n199 (41118): 1\nC++ objects (VS 2015/2017 runtime 26706): 45\nC objects (VS 2015/2017 runtime 26706): 18\nASM objects (VS 2015/2017 runtime 26706): 21\nC objects (VS2008 SP1 build 30729): 9\nImports (VS2008 SP1 build 30729): 37\nTotal imports: 553\nC++ objects (POGO O) (27045): 81\nASM objects (27045): 1\nResource objects (27045): 1\n151: 2\nLinker (27045): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Is an AutoIT compiled script:\n AutoIt Error\n reserved for AutoIt internal use\n Contains domain names:\n autoitscript.com\n http://www.autoitscript.com\n http://www.autoitscript.com/autoit3/\n www.autoitscript.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses known Mersenne Twister constants\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryW\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n FindWindowW\n Code injection capabilities:\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n VirtualAlloc\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n RegisterHotKey\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n CreateProcessWithLogonW\n ShellExecuteW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n AttachThreadInput\n MapVirtualKeyW\n GetForegroundWindow\n Has Internet access capabilities:\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n InternetQueryOptionW\n InternetConnectW\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n DuplicateTokenEx\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n GetVolumeInformationW\n Manipulates other processes:\n OpenProcess\n WriteProcessMemory\n ReadProcessMemory\n Process32FirstW\n Process32NextW\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n Reads the contents of the clipboard:\n GetClipboardData\n Can shut the system down or lock the screen:\n ExitWindowsEx\n InitiateSystemShutdownExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: AutoIt Consulting Ltd\n Issuer: GlobalSign CodeSigning CA - SHA256 - G3\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.72194\n\n2:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88834\n\n3:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.27904\n\n4:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46186\n\n5:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.3496\n\n6:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.31773\n\n7:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 16193\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.95102\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.46038\n\n9:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.71915\n\n10:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.21322\n\n11:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.25499\n\n12:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.05883\n\n13:\n Type: RT_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.66371\n\n166:\n Type: RT_MENU\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 80\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.68292\n\n1000:\n Type: RT_DIALOG\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 252\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.03986\n\n7 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1428\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.34702\n\n8 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1674\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.2804\n\n9 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1168\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28849\n\n10 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1532\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.28373\n\n11 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1628\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.26322\n\n12 (#2):\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 1126\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.25812\n\n313:\n Type: RT_STRING\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 344\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.08572\n\n99:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 146\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.90294\n Detected Filetype: Icon file\n\n162:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n164:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n169:\n Type: RT_GROUP_ICON\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 20\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.02322\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United Kingdom\n Codepage: UNKNOWN\n Size: 880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.47788\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1068\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.33361\n\n\nVersion Info:\nResource LangID: English - United Kingdom\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 3.3.16.1\n ProductVersion: 3.3.16.1\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: English - United Kingdom\n CompanyName: AutoIt Team\n Comments: http://www.autoitscript.com/autoit3/\n FileDescription: AutoIt v3 Script\n FileVersion (#2): 3, 3, 16, 1\n InternalName: AutoIt3.exe\n LegalCopyright: © 1999-2022 Jonathan Bennett & AutoIt Team\n OriginalFilename: AutoIt3.exe\n ProductName: AutoIt v3 Script\n ProductVersion (#2): 3, 3, 16, 1"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2022-Sep-19 18:34:17\n Version: 0.0\n SizeofData: 1116\n AddressOfRawData: 0x000C9220\n PointerToRawData: 0x000C7C20\n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x004C969C\nEndAddressOfRawData: 0x004C96A4\nAddressOfIndex: 0x004D1740\nAddressOfCallbacks: 0x0049D8F8\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_ALIGN_4BYTES\nCallbacks: (EMPTY)"},"Load Configuration":{"raw":"Size: 160\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x00000000\nDeCommitTotalFreeThreshold: 0x00000000\nLockPrefixTable: 0x00000000\nMaximumAllocationSize: 0x00000000\nVirtualMemoryThreshold: 0x00000000\nProcessAffinityMask: 0x00000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x00000000\nSecurityCookie: 0x004CD014\nSEHandlerTable: 0x00000000\nSEHandlerCount: 0"},"RICH Header":{"raw":"XOR Key: 0x68C0A7EC\nUnmarked objects: 0\n241 (40116): 35\n243 (40116): 157\n242 (40116): 35\n199 (41118): 1\nC++ objects (VS 2015/2017 runtime 26706): 45\nC objects (VS 2015/2017 runtime 26706): 18\nASM objects (VS 2015/2017 runtime 26706): 21\nC objects (VS2008 SP1 build 30729): 9\nImports (VS2008 SP1 build 30729): 37\nTotal imports: 553\nC++ objects (POGO O) (27045): 81\nASM objects (27045): 1\nResource objects (27045): 1\n151: 2\nLinker (27045): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Is an AutoIT compiled script:\n AutoIt Error\n reserved for AutoIt internal use\n Contains domain names:\n autoitscript.com\n http://www.autoitscript.com\n http://www.autoitscript.com/autoit3/\n www.autoitscript.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to CRC32\n Uses known Mersenne Twister constants\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n LoadLibraryW\n LoadLibraryExW\n Functions which can be used for anti-debugging purposes:\n CreateToolhelp32Snapshot\n FindWindowW\n Code injection capabilities:\n OpenProcess\n VirtualAllocEx\n WriteProcessMemory\n VirtualAlloc\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n RegisterHotKey\n RegEnumValueW\n RegDeleteValueW\n RegDeleteKeyW\n RegEnumKeyExW\n RegSetValueExW\n RegOpenKeyExW\n RegCloseKey\n RegQueryValueExW\n RegCreateKeyExW\n Possibly launches other programs:\n CreateProcessW\n CreateProcessAsUserW\n CreateProcessWithLogonW\n ShellExecuteW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Uses functions commonly found in keyloggers:\n GetAsyncKeyState\n AttachThreadInput\n MapVirtualKeyW\n GetForegroundWindow\n Has Internet access capabilities:\n InternetCloseHandle\n InternetOpenW\n InternetSetOptionW\n InternetCrackUrlW\n InternetQueryOptionW\n InternetConnectW\n InternetOpenUrlW\n InternetReadFile\n InternetQueryDataAvailable\n Functions related to the privilege level:\n AdjustTokenPrivileges\n OpenProcessToken\n DuplicateTokenEx\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n GetVolumeInformationW\n Manipulates other processes:\n OpenProcess\n WriteProcessMemory\n ReadProcessMemory\n Process32FirstW\n Process32NextW\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n Reads the contents of the clipboard:\n GetClipboardData\n Can shut the system down or lock the screen:\n ExitWindowsEx\n InitiateSystemShutdownExW\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: AutoIt Consulting Ltd\n Issuer: GlobalSign CodeSigning CA - SHA256 - G3\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_unpack_9adg1u7w/db8ce34cefcc83edd0e245844f35373828004706eb41f952ad0c2522e10e4b9c-019f7bbf31657dc2a579e1bfd6e021be.exe_db8ce34cefcc/006_binwalk_AutoIt3.exe.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_mo3ns6y0/output.txt"},"timestamp":"2026-07-20 01:39:21"} {"_id":{"$oid":"6a5e02a9b3bed57e0e737922"},"sha256":"7132a14099e6824598c5899dea19a4b8f4d89683bb01774b402674da1d4fee2f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/7132a14099e6824598c5899dea19a4b8f4d89683bb01774b402674da1d4fee2f-019f7f40e152738285f788f229f71fb9.exe\nDate: 2026-07-20 17:00:43\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/7132a14099e6824598c5899dea19a4b8f4d89683bb01774b402674da1d4fee2f-019f7f40e152738285f788f229f71fb9.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2017-May-11 12:20:57\nDetected languages: English - United States\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2017-May-11 12:20:57\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 10.0\nSizeOfCode: 0x00007C00\nSizeOfInitializedData: 0x00505800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000015EC (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.2\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x00513000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0051CBC1\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00007B78\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.32469\n\n.rdata:\n VirtualSize: 0x00002BC8\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00002C00\n PointerToRawData: 0x00008000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.70484\n\n.data:\n VirtualSize: 0x00003660\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00001400\n PointerToRawData: 0x0000AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.82277\n\n.pdata:\n VirtualSize: 0x0000078C\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0000C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.24944\n\n.rsrc:\n VirtualSize: 0x00500200\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00500200\n PointerToRawData: 0x0000C800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.75718\n\n.reloc:\n VirtualSize: 0x00000CA8\n VirtualAddress: 0x00512000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x0050CA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0\n\n\nImports:\n--------\nKERNEL32.dll: CloseHandle\n WriteFile\n CreateFileA\n SizeofResource\n LockResource\n LoadResource\n FindResourceA\n CreateProcessA\n GetCurrentThreadId\n FlsSetValue\n GetCommandLineA\n DecodePointer\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n IsDebuggerPresent\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n RtlCaptureContext\n EncodePointer\n TerminateProcess\n GetCurrentProcess\n RtlUnwindEx\n FlsGetValue\n FlsFree\n SetLastError\n GetLastError\n FlsAlloc\n HeapFree\n Sleep\n GetProcAddress\n GetModuleHandleW\n ExitProcess\n SetHandleCount\n GetStdHandle\n InitializeCriticalSectionAndSpinCount\n GetFileType\n GetStartupInfoW\n DeleteCriticalSection\n GetModuleFileNameA\n FreeEnvironmentStringsW\n WideCharToMultiByte\n GetEnvironmentStringsW\n HeapSetInformation\n GetVersion\n HeapCreate\n HeapDestroy\n QueryPerformanceCounter\n GetTickCount\n GetCurrentProcessId\n GetSystemTimeAsFileTime\n SetFilePointer\n GetConsoleCP\n GetConsoleMode\n EnterCriticalSection\n LeaveCriticalSection\n GetCPInfo\n GetACP\n GetOEMCP\n IsValidCodePage\n HeapAlloc\n HeapReAlloc\n LoadLibraryW\n GetModuleFileNameW\n SetStdHandle\n WriteConsoleW\n MultiByteToWideChar\n LCMapStringW\n GetStringTypeW\n HeapSize\n CreateFileW\n FlushFileBuffers\n\nExports:\n--------\nPlayGame:\n Ordinal: 1\n Address: 0x000011A4\n\n\nResources:\n----------\n101:\n Type: W\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 5242880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.75733\n\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n\nRICH Header:\n------------\nXOR Key: 0x4425342F\nUnmarked objects: 0\nC objects (VS2010 SP1 build 40219): 83\nASM objects (VS2010 SP1 build 40219): 9\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 80\nC++ objects (VS2010 SP1 build 40219): 23\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to SHA256\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.9629% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2017-May-11 12:20:57\nDetected languages: English - United States"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2017-May-11 12:20:57\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 10.0\nSizeOfCode: 0x00007C00\nSizeOfInitializedData: 0x00505800\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000000015EC (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 5.2\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x00513000\nSizeOfHeaders: 0x00000400\nChecksum: 0x0051CBC1\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00007B78\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007C00\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.32469\n\n.rdata:\n VirtualSize: 0x00002BC8\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00002C00\n PointerToRawData: 0x00008000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.70484\n\n.data:\n VirtualSize: 0x00003660\n VirtualAddress: 0x0000C000\n SizeOfRawData: 0x00001400\n PointerToRawData: 0x0000AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 1.82277\n\n.pdata:\n VirtualSize: 0x0000078C\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x0000C000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.24944\n\n.rsrc:\n VirtualSize: 0x00500200\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00500200\n PointerToRawData: 0x0000C800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 2.75718\n\n.reloc:\n VirtualSize: 0x00000CA8\n VirtualAddress: 0x00512000\n SizeOfRawData: 0x00000E00\n PointerToRawData: 0x0050CA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 0"},"Imports":{"raw":"KERNEL32.dll: CloseHandle\n WriteFile\n CreateFileA\n SizeofResource\n LockResource\n LoadResource\n FindResourceA\n CreateProcessA\n GetCurrentThreadId\n FlsSetValue\n GetCommandLineA\n DecodePointer\n UnhandledExceptionFilter\n SetUnhandledExceptionFilter\n IsDebuggerPresent\n RtlVirtualUnwind\n RtlLookupFunctionEntry\n RtlCaptureContext\n EncodePointer\n TerminateProcess\n GetCurrentProcess\n RtlUnwindEx\n FlsGetValue\n FlsFree\n SetLastError\n GetLastError\n FlsAlloc\n HeapFree\n Sleep\n GetProcAddress\n GetModuleHandleW\n ExitProcess\n SetHandleCount\n GetStdHandle\n InitializeCriticalSectionAndSpinCount\n GetFileType\n GetStartupInfoW\n DeleteCriticalSection\n GetModuleFileNameA\n FreeEnvironmentStringsW\n WideCharToMultiByte\n GetEnvironmentStringsW\n HeapSetInformation\n GetVersion\n HeapCreate\n HeapDestroy\n QueryPerformanceCounter\n GetTickCount\n GetCurrentProcessId\n GetSystemTimeAsFileTime\n SetFilePointer\n GetConsoleCP\n GetConsoleMode\n EnterCriticalSection\n LeaveCriticalSection\n GetCPInfo\n GetACP\n GetOEMCP\n IsValidCodePage\n HeapAlloc\n HeapReAlloc\n LoadLibraryW\n GetModuleFileNameW\n SetStdHandle\n WriteConsoleW\n MultiByteToWideChar\n LCMapStringW\n GetStringTypeW\n HeapSize\n CreateFileW\n FlushFileBuffers"},"Exports":{"raw":"PlayGame:\n Ordinal: 1\n Address: 0x000011A4"},"Resources":{"raw":"101:\n Type: W\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 5242880\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.75733\n\n2:\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 346\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0\n\n\nRICH Header:\nXOR Key: 0x4425342F\nUnmarked objects: 0\nC objects (VS2010 SP1 build 40219): 83\nASM objects (VS2010 SP1 build 40219): 9\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 80\nC++ objects (VS2010 SP1 build 40219): 23\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to SHA256\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.9629% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x4425342F\nUnmarked objects: 0\nC objects (VS2010 SP1 build 40219): 83\nASM objects (VS2010 SP1 build 40219): 9\nImports (VS2008 SP1 build 30729): 3\nTotal imports: 80\nC++ objects (VS2010 SP1 build 40219): 23\nExports (VS2010 SP1 build 40219): 1\nResource objects (VS2010 SP1 build 40219): 1\nLinker (VS2010 SP1 build 40219): 1\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 DLL (Debug)\n Microsoft Visual C++ 6.0 DLL\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains another PE executable:\n This program cannot be run in DOS mode.\n Contains domain names:\n http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com\n\nCryptographic algorithms detected in the binary:\n Uses constants related to SHA1\n Uses constants related to SHA256\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryW\n Possibly launches other programs:\n CreateProcessA\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 98.9629% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/7132a14099e6824598c5899dea19a4b8f4d89683bb01774b402674da1d4fee2f-019f7f40e152738285f788f229f71fb9.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_yjwb5bpf/output.txt"},"timestamp":"2026-07-20 17:00:43"} {"_id":{"$oid":"6a5e0637b3bed57e0e737933"},"sha256":"f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/everything-019f7f42fecc7c41a55dd70b4a72446e.exe\nDate: 2026-07-20 16:57:51\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/everything-019f7f42fecc7c41a55dd70b4a72446e.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jan-23 02:55:08\nDetected languages: English - United States\nDebug artifacts: c:\\dev\\Everything-1.4\\x64\\Release\\Everything.pdb\nCompanyName: voidtools\nFileDescription: Everything\nFileVersion: 1.4.1.1032\nInternalName: Everything\nLegalCopyright: Copyright © 2026 voidtools\nOriginalFilename: Everything.exe\nProductName: Everything\nProductVersion: 1.4.1.1032\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2026-Jan-23 02:55:08\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 8.0\nSizeOfCode: 0x001B0200\nSizeOfInitializedData: 0x00077E00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000001AB2E0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x0022E000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00237F64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x001B014E\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x001B0200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.46224\n\n.rdata:\n VirtualSize: 0x0004BF68\n VirtualAddress: 0x001B2000\n SizeOfRawData: 0x0004C000\n PointerToRawData: 0x001B0600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.78689\n\n.data:\n VirtualSize: 0x000136C8\n VirtualAddress: 0x001FE000\n SizeOfRawData: 0x00011E00\n PointerToRawData: 0x001FC600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.73412\n\n.pdata:\n VirtualSize: 0x0000CBD0\n VirtualAddress: 0x00212000\n SizeOfRawData: 0x0000CC00\n PointerToRawData: 0x0020E400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.16175\n\n.rsrc:\n VirtualSize: 0x0000A1E4\n VirtualAddress: 0x0021F000\n SizeOfRawData: 0x0000A200\n PointerToRawData: 0x0021B000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.58914\n\n.reloc:\n VirtualSize: 0x000031EE\n VirtualAddress: 0x0022A000\n SizeOfRawData: 0x00003200\n PointerToRawData: 0x00225200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.94612\n\n\nImports:\n--------\nCOMCTL32.dll: ImageList_GetIconSize\n ImageList_DrawEx\n _TrackMouseEvent\n InitCommonControlsEx\nWS2_32.dll: WSAGetLastError\n WSACleanup\n closesocket\n send\n recv\n connect\n WSAAsyncSelect\n setsockopt\n socket\n WSAStartup\n shutdown\n listen\n bind\n getpeername\n ntohs\n getsockname\n accept\n inet_addr\n gethostbyname\n htons\nSHLWAPI.dll: SHRegGetUSValueW\n PathIsRootW\n PathCombineW\n PathRemoveFileSpecW\nKERNEL32.dll: FileTimeToSystemTime\n GetSystemTime\n FreeResource\n LockResource\n LoadResource\n SizeofResource\n FindResourceW\n GetSystemDefaultLangID\n CopyFileW\n TerminateProcess\n OpenProcess\n CreateMutexW\n SetLastError\n GetStartupInfoW\n HeapAlloc\n GetProcessHeap\n HeapFree\n VirtualAlloc\n VirtualFree\n QueryDosDeviceW\n SetErrorMode\n DeleteFileW\n RemoveDirectoryW\n MoveFileW\n MoveFileExW\n CreateDirectoryW\n GetFileAttributesW\n GlobalFree\n GlobalUnlock\n GlobalLock\n GlobalAlloc\n GetComputerNameW\n GetVolumeInformationW\n GetDiskFreeSpaceW\n GetFullPathNameW\n GetFileSize\n FindFirstFileW\n FindNextFileW\n GetDriveTypeW\n GetThreadPriority\n CreateEventW\n GetProcAddress\n FreeLibrary\n LoadLibraryExW\n SetFilePointer\n GetWindowsDirectoryW\n GetCurrentDirectoryW\n GetFileAttributesExW\n LocalFileTimeToFileTime\n SystemTimeToFileTime\n FileTimeToLocalFileTime\n SystemTimeToTzSpecificLocalTime\n __C_specific_handler\n WaitForMultipleObjects\n GetSystemDirectoryW\n ExpandEnvironmentStringsW\n GetSystemInfo\n GetVersionExA\n LocalFree\n LocalAlloc\n ConnectNamedPipe\n CreateNamedPipeW\n GetTimeZoneInformation\n MulDiv\n LoadLibraryA\n GetTimeFormatW\n GetNumberFormatW\n GetDateFormatW\n MultiByteToWideChar\n HeapCreate\n HeapSetInformation\n GetModuleFileNameA\n FlsAlloc\n TlsSetValue\n FlsFree\n TlsFree\n FlsSetValue\n FlsGetValue\n GetModuleHandleA\n RtlCaptureContext\n RtlLookupFunctionEntry\n RtlVirtualUnwind\n IsDebuggerPresent\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n GetCurrentProcess\n GetStartupInfoA\n GetCommandLineA\n CreateThread\n ExitThread\n GetTempPathW\n CreateFileW\n FreeConsole\n AllocConsole\n SetStdHandle\n SetConsoleScreenBufferSize\n ExitProcess\n QueryPerformanceFrequency\n QueryPerformanceCounter\n WriteFile\n FlushFileBuffers\n GetStdHandle\n GetFileType\n GetConsoleScreenBufferInfo\n SetConsoleTextAttribute\n WriteConsoleW\n GetLocaleInfoW\n GetCalendarInfoW\n DeviceIoControl\n GetOverlappedResult\n ResetEvent\n Sleep\n FindNextChangeNotification\n FindFirstChangeNotificationW\n GetFileInformationByHandle\n GetLocalTime\n FindCloseChangeNotification\n FindClose\n GetSystemTimeAsFileTime\n GetCurrentThread\n SetThreadPriority\n InitializeCriticalSection\n WaitForSingleObject\n DeleteCriticalSection\n EnterCriticalSection\n GetTickCount\n LeaveCriticalSection\n SetEvent\n GetCommandLineW\n GetCurrentThreadId\n GetModuleHandleW\n ReadFile\n GetLastError\n CloseHandle\n WideCharToMultiByte\n GetCPInfo\n GetACP\n GetOEMCP\n IsValidCodePage\n FreeEnvironmentStringsA\n GetEnvironmentStrings\n FreeEnvironmentStringsW\n GetEnvironmentStringsW\n SetHandleCount\n GetCurrentProcessId\n HeapReAlloc\n LCMapStringA\n LCMapStringW\n GetStringTypeA\n GetStringTypeW\n GetLocaleInfoA\n HeapSize\n GetModuleFileNameW\nUSER32.dll: IsWindowVisible\n SetCursor\n SetCapture\n ChangeClipboardChain\n DrawEdge\n DrawFrameControl\n EqualRect\n GetSubMenu\n GetMenu\n SetClipboardViewer\n EnumWindows\n ActivateKeyboardLayout\n LoadIconW\n IsDlgButtonChecked\n SetScrollInfo\n UpdateWindow\n ScrollWindowEx\n SetDlgItemInt\n GetMenuState\n RemoveMenu\n GetMenuItemID\n GetMenuDefaultItem\n EnableMenuItem\n AdjustWindowRect\n GetSysColorBrush\n OffsetRect\n InvalidateRgn\n MessageBeep\n SetCursorPos\n GetDlgItemInt\n GetDlgCtrlID\n SendDlgItemMessageW\n GetDesktopWindow\n ValidateRect\n CharLowerW\n CharUpperW\n CreateIconIndirect\n PostQuitMessage\n GetLastActivePopup\n IsClipboardFormatAvailable\n GetForegroundWindow\n AttachThreadInput\n SetActiveWindow\n BringWindowToTop\n EnumChildWindows\n CheckDlgButton\n GetMenuItemInfoW\n GetKeyboardLayoutList\n LoadCursorW\n CreateDialogIndirectParamW\n InvalidateRect\n ClientToScreen\n ScreenToClient\n ShowWindow\n IsIconic\n GetWindowPlacement\n IsZoomed\n GetWindowTextLengthW\n GetWindowTextW\n GetParent\n CopyRect\n EmptyClipboard\n SetClipboardData\n GetWindowLongPtrW\n SetWindowLongPtrW\n SetFocus\n PtInRect\n FindWindowW\n InsertMenuW\n SetDlgItemTextW\n SetForegroundWindow\n BeginPaint\n EndPaint\n OpenClipboard\n GetClipboardData\n CloseClipboard\n FillRect\n CreateWindowExW\n GetClassInfoExW\n RegisterClassExW\n IsWindowEnabled\n GetAsyncKeyState\n GetClientRect\n GetCapture\n OpenIcon\n ReleaseCapture\n GetFocus\n GetNextDlgTabItem\n EnableWindow\n SetWindowPos\n SetWindowTextW\n SetWindowLongW\n MessageBoxW\n DialogBoxIndirectParamW\n DrawTextW\n GetMenuItemCount\n CreatePopupMenu\n AppendMenuW\n DeleteMenu\n SetMenuItemInfoW\n GetWindowLongW\n AdjustWindowRectEx\n CallWindowProcW\n GetDlgItem\n GetWindowRect\n MapWindowPoints\n IntersectRect\n GetMonitorInfoW\n SystemParametersInfoW\n GetDC\n ReleaseDC\n SetWindowsHookExW\n PeekMessageW\n WaitMessage\n SetMenu\n RegisterClipboardFormatW\n RedrawWindow\n GetMessagePos\n RegisterWindowMessageA\n ReplyMessage\n GetCursorPos\n CreateMenu\n SetMenuDefaultItem\n TrackPopupMenu\n DestroyMenu\n KillTimer\n GetDoubleClickTime\n RegisterHotKey\n GetKeyState\n UnregisterHotKey\n PostThreadMessageW\n GetSysColor\n EndDialog\n PostMessageW\n DestroyIcon\n SetTimer\n DestroyWindow\n DefWindowProcW\n SendMessageTimeoutW\n GetWindowThreadProcessId\n IsWindow\n GetKeyNameTextW\n MapVirtualKeyExW\n GetKeyboardLayout\n LoadImageW\n UnhookWindowsHookEx\n CallNextHookEx\n GetClassNameW\n SendMessageW\n GetMessageW\n TranslateMessage\n DispatchMessageW\n GetSystemMetrics\n GetScrollInfo\nGDI32.dll: SetStretchBltMode\n GetDeviceCaps\n GetDIBits\n SelectClipRgn\n TextOutW\n GetTextAlign\n SetTextAlign\n CreateCompatibleBitmap\n OffsetClipRgn\n OffsetRgn\n CombineRgn\n GetDCOrgEx\n GetRandomRgn\n EnumFontFamiliesExW\n CreateCompatibleDC\n BitBlt\n StretchDIBits\n GetRegionData\n ExtCreateRegion\n GetObjectW\n CreateFontIndirectW\n GetStockObject\n GetNearestColor\n CreateSolidBrush\n CreateRectRgn\n CreateDIBSection\n GetCurrentObject\n ExcludeClipRect\n RectVisible\n GetTextExtentExPointW\n GetTextExtentPoint32W\n DeleteDC\n SetBkMode\n CreateBitmapIndirect\n CreatePatternBrush\n SetBrushOrgEx\n SetBkColor\n SetTextColor\n PatBlt\n SelectObject\n GetTextMetricsW\n StretchBlt\n DeleteObject\ncomdlg32.dll: GetOpenFileNameW\n GetSaveFileNameW\n ChooseColorW\n CommDlgExtendedError\nADVAPI32.dll: RegisterServiceCtrlHandlerW\n StartServiceCtrlDispatcherW\n DeleteService\n CloseServiceHandle\n RegOpenKeyA\n RegQueryValueW\n InitializeSecurityDescriptor\n SetSecurityDescriptorDacl\n QueryServiceConfigW\n RegDeleteValueW\n RegSetValueExW\n RegQueryValueExW\n RegCreateKeyExW\n RegOpenKeyExW\n RegEnumKeyW\n RegCloseKey\n RegDeleteKeyW\n GetUserNameW\n RegisterEventSourceW\n ReportEventW\n DeregisterEventSource\n CreateServiceW\n StartServiceW\n OpenSCManagerW\n OpenServiceW\n ControlService\n SetServiceStatus\nSHELL32.dll: DragFinish\n DragAcceptFiles\n Shell_NotifyIconW\n SHBrowseForFolderW\n SHGetFileInfoW\n DragQueryFileW\n SHGetSpecialFolderLocation\n #16\n SHFileOperationW\n ShellExecuteExW\n SHGetDesktopFolder\n SHGetPathFromIDListW\n SHChangeNotify\n DragQueryPoint\nole32.dll: CoTaskMemFree\n OleUninitialize\n OleInitialize\n CoCreateInstance\n CoInitializeEx\n CoUninitialize\n CLSIDFromString\n CreateStreamOnHGlobal\n CoTaskMemAlloc\n RevokeDragDrop\n DoDragDrop\n RegisterDragDrop\n ReleaseStgMedium\n CreateBindCtx\n\nResources:\n----------\n102:\n Type: RT_BITMAP\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4382\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39894\n\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74128\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89581\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05678\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88565\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.1189\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.23531\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4117\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.73188\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.3313\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.80421\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94934\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.372\n\n103:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1597\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.93847\n\n104:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 708\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.50761\n Detected Filetype: GIF graphic file\n\n105:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 131\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.71536\n Detected Filetype: GIF graphic file\n\n106:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 125\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.20191\n Detected Filetype: GIF graphic file\n\n107:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 819\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.696866\n Detected Filetype: GIF graphic file\n\n108:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 822\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.718125\n Detected Filetype: GIF graphic file\n\n109:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 145\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.64828\n Detected Filetype: GIF graphic file\n\n110:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1150\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59283\n Detected Filetype: Icon file\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 160\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94725\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 728\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.36161\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 939\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.09871\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.4.1.1032\n ProductVersion: 1.4.1.1032\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: English - United States\n CompanyName: voidtools\n FileDescription: Everything\n FileVersion (#2): 1.4.1.1032\n InternalName: Everything\n LegalCopyright: Copyright © 2026 voidtools\n OriginalFilename: Everything.exe\n ProductName: Everything\n ProductVersion (#2): 1.4.1.1032\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2026-Jan-23 02:55:08\n Version: 0.0\n SizeofData: 73\n AddressOfRawData: 0x001EC488\n PointerToRawData: 0x001EAA88\n Referenced File: c:\\dev\\Everything-1.4\\x64\\Release\\Everything.pdb\n\n\nRICH Header:\n------------\nXOR Key: 0x758F4DEB\nUnmarked objects: 0\nASM objects (VS2012 build 50727 / VS2005 build 50727): 6\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 26\nC objects (40310): 8\nImports (40310): 21\nTotal imports: 450\nC objects (VS2012 build 50727 / VS2005 build 50727): 183\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n http://www.voidtools.com\n http://www.voidtools.com/everything/beta-update.ini\n http://www.voidtools.com/everything/update.ini\n http://www.w3.org\n http://www.w3.org/TR/html4/loose.dtd\n https://www.voidtools.com\n https://www.voidtools.com/\n https://www.voidtools.com/donate/\n https://www.voidtools.com/downloads/\n https://www.voidtools.com/downloads/#language\n https://www.voidtools.com/support/everything/\n https://www.voidtools.com/update/\n voidtools.com\n www.voidtools.com\n www.w3.org\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryExW\n LoadLibraryA\n Functions which can be used for anti-debugging purposes:\n FindWindowW\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n SHRegGetUSValueW\n RegisterHotKey\n RegOpenKeyA\n RegQueryValueW\n RegDeleteValueW\n RegSetValueExW\n RegQueryValueExW\n RegCreateKeyExW\n RegOpenKeyExW\n RegEnumKeyW\n RegCloseKey\n RegDeleteKeyW\n Can create temporary files:\n GetTempPathW\n CreateFileW\n Uses functions commonly found in keyloggers:\n GetForegroundWindow\n AttachThreadInput\n GetAsyncKeyState\n CallNextHookEx\n Leverages the raw socket API to access the Internet:\n WSAGetLastError\n WSACleanup\n closesocket\n send\n recv\n connect\n WSAAsyncSelect\n setsockopt\n socket\n WSAStartup\n shutdown\n listen\n bind\n getpeername\n ntohs\n getsockname\n accept\n inet_addr\n gethostbyname\n htons\n Interacts with services:\n DeleteService\n QueryServiceConfigW\n CreateServiceW\n OpenSCManagerW\n OpenServiceW\n ControlService\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Manipulates other processes:\n OpenProcess\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n BitBlt\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: voidtools PTY LTD\n Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jan-23 02:55:08\nDetected languages: English - United States\nDebug artifacts: c:\\dev\\Everything-1.4\\x64\\Release\\Everything.pdb\nCompanyName: voidtools\nFileDescription: Everything\nFileVersion: 1.4.1.1032\nInternalName: Everything\nLegalCopyright: Copyright © 2026 voidtools\nOriginalFilename: Everything.exe\nProductName: Everything\nProductVersion: 1.4.1.1032"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000E0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 6\nTimeDateStamp: 2026-Jan-23 02:55:08\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 8.0\nSizeOfCode: 0x001B0200\nSizeOfInitializedData: 0x00077E00\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x00000000001AB2E0 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 5.2\nWin32VersionValue: 0\nSizeOfImage: 0x0022E000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00237F64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x001B014E\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x001B0200\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.46224\n\n.rdata:\n VirtualSize: 0x0004BF68\n VirtualAddress: 0x001B2000\n SizeOfRawData: 0x0004C000\n PointerToRawData: 0x001B0600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.78689\n\n.data:\n VirtualSize: 0x000136C8\n VirtualAddress: 0x001FE000\n SizeOfRawData: 0x00011E00\n PointerToRawData: 0x001FC600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 5.73412\n\n.pdata:\n VirtualSize: 0x0000CBD0\n VirtualAddress: 0x00212000\n SizeOfRawData: 0x0000CC00\n PointerToRawData: 0x0020E400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 6.16175\n\n.rsrc:\n VirtualSize: 0x0000A1E4\n VirtualAddress: 0x0021F000\n SizeOfRawData: 0x0000A200\n PointerToRawData: 0x0021B000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.58914\n\n.reloc:\n VirtualSize: 0x000031EE\n VirtualAddress: 0x0022A000\n SizeOfRawData: 0x00003200\n PointerToRawData: 0x00225200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.94612"},"Imports":{"raw":"COMCTL32.dll: ImageList_GetIconSize\n ImageList_DrawEx\n _TrackMouseEvent\n InitCommonControlsEx\nWS2_32.dll: WSAGetLastError\n WSACleanup\n closesocket\n send\n recv\n connect\n WSAAsyncSelect\n setsockopt\n socket\n WSAStartup\n shutdown\n listen\n bind\n getpeername\n ntohs\n getsockname\n accept\n inet_addr\n gethostbyname\n htons\nSHLWAPI.dll: SHRegGetUSValueW\n PathIsRootW\n PathCombineW\n PathRemoveFileSpecW\nKERNEL32.dll: FileTimeToSystemTime\n GetSystemTime\n FreeResource\n LockResource\n LoadResource\n SizeofResource\n FindResourceW\n GetSystemDefaultLangID\n CopyFileW\n TerminateProcess\n OpenProcess\n CreateMutexW\n SetLastError\n GetStartupInfoW\n HeapAlloc\n GetProcessHeap\n HeapFree\n VirtualAlloc\n VirtualFree\n QueryDosDeviceW\n SetErrorMode\n DeleteFileW\n RemoveDirectoryW\n MoveFileW\n MoveFileExW\n CreateDirectoryW\n GetFileAttributesW\n GlobalFree\n GlobalUnlock\n GlobalLock\n GlobalAlloc\n GetComputerNameW\n GetVolumeInformationW\n GetDiskFreeSpaceW\n GetFullPathNameW\n GetFileSize\n FindFirstFileW\n FindNextFileW\n GetDriveTypeW\n GetThreadPriority\n CreateEventW\n GetProcAddress\n FreeLibrary\n LoadLibraryExW\n SetFilePointer\n GetWindowsDirectoryW\n GetCurrentDirectoryW\n GetFileAttributesExW\n LocalFileTimeToFileTime\n SystemTimeToFileTime\n FileTimeToLocalFileTime\n SystemTimeToTzSpecificLocalTime\n __C_specific_handler\n WaitForMultipleObjects\n GetSystemDirectoryW\n ExpandEnvironmentStringsW\n GetSystemInfo\n GetVersionExA\n LocalFree\n LocalAlloc\n ConnectNamedPipe\n CreateNamedPipeW\n GetTimeZoneInformation\n MulDiv\n LoadLibraryA\n GetTimeFormatW\n GetNumberFormatW\n GetDateFormatW\n MultiByteToWideChar\n HeapCreate\n HeapSetInformation\n GetModuleFileNameA\n FlsAlloc\n TlsSetValue\n FlsFree\n TlsFree\n FlsSetValue\n FlsGetValue\n GetModuleHandleA\n RtlCaptureContext\n RtlLookupFunctionEntry\n RtlVirtualUnwind\n IsDebuggerPresent\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n GetCurrentProcess\n GetStartupInfoA\n GetCommandLineA\n CreateThread\n ExitThread\n GetTempPathW\n CreateFileW\n FreeConsole\n AllocConsole\n SetStdHandle\n SetConsoleScreenBufferSize\n ExitProcess\n QueryPerformanceFrequency\n QueryPerformanceCounter\n WriteFile\n FlushFileBuffers\n GetStdHandle\n GetFileType\n GetConsoleScreenBufferInfo\n SetConsoleTextAttribute\n WriteConsoleW\n GetLocaleInfoW\n GetCalendarInfoW\n DeviceIoControl\n GetOverlappedResult\n ResetEvent\n Sleep\n FindNextChangeNotification\n FindFirstChangeNotificationW\n GetFileInformationByHandle\n GetLocalTime\n FindCloseChangeNotification\n FindClose\n GetSystemTimeAsFileTime\n GetCurrentThread\n SetThreadPriority\n InitializeCriticalSection\n WaitForSingleObject\n DeleteCriticalSection\n EnterCriticalSection\n GetTickCount\n LeaveCriticalSection\n SetEvent\n GetCommandLineW\n GetCurrentThreadId\n GetModuleHandleW\n ReadFile\n GetLastError\n CloseHandle\n WideCharToMultiByte\n GetCPInfo\n GetACP\n GetOEMCP\n IsValidCodePage\n FreeEnvironmentStringsA\n GetEnvironmentStrings\n FreeEnvironmentStringsW\n GetEnvironmentStringsW\n SetHandleCount\n GetCurrentProcessId\n HeapReAlloc\n LCMapStringA\n LCMapStringW\n GetStringTypeA\n GetStringTypeW\n GetLocaleInfoA\n HeapSize\n GetModuleFileNameW\nUSER32.dll: IsWindowVisible\n SetCursor\n SetCapture\n ChangeClipboardChain\n DrawEdge\n DrawFrameControl\n EqualRect\n GetSubMenu\n GetMenu\n SetClipboardViewer\n EnumWindows\n ActivateKeyboardLayout\n LoadIconW\n IsDlgButtonChecked\n SetScrollInfo\n UpdateWindow\n ScrollWindowEx\n SetDlgItemInt\n GetMenuState\n RemoveMenu\n GetMenuItemID\n GetMenuDefaultItem\n EnableMenuItem\n AdjustWindowRect\n GetSysColorBrush\n OffsetRect\n InvalidateRgn\n MessageBeep\n SetCursorPos\n GetDlgItemInt\n GetDlgCtrlID\n SendDlgItemMessageW\n GetDesktopWindow\n ValidateRect\n CharLowerW\n CharUpperW\n CreateIconIndirect\n PostQuitMessage\n GetLastActivePopup\n IsClipboardFormatAvailable\n GetForegroundWindow\n AttachThreadInput\n SetActiveWindow\n BringWindowToTop\n EnumChildWindows\n CheckDlgButton\n GetMenuItemInfoW\n GetKeyboardLayoutList\n LoadCursorW\n CreateDialogIndirectParamW\n InvalidateRect\n ClientToScreen\n ScreenToClient\n ShowWindow\n IsIconic\n GetWindowPlacement\n IsZoomed\n GetWindowTextLengthW\n GetWindowTextW\n GetParent\n CopyRect\n EmptyClipboard\n SetClipboardData\n GetWindowLongPtrW\n SetWindowLongPtrW\n SetFocus\n PtInRect\n FindWindowW\n InsertMenuW\n SetDlgItemTextW\n SetForegroundWindow\n BeginPaint\n EndPaint\n OpenClipboard\n GetClipboardData\n CloseClipboard\n FillRect\n CreateWindowExW\n GetClassInfoExW\n RegisterClassExW\n IsWindowEnabled\n GetAsyncKeyState\n GetClientRect\n GetCapture\n OpenIcon\n ReleaseCapture\n GetFocus\n GetNextDlgTabItem\n EnableWindow\n SetWindowPos\n SetWindowTextW\n SetWindowLongW\n MessageBoxW\n DialogBoxIndirectParamW\n DrawTextW\n GetMenuItemCount\n CreatePopupMenu\n AppendMenuW\n DeleteMenu\n SetMenuItemInfoW\n GetWindowLongW\n AdjustWindowRectEx\n CallWindowProcW\n GetDlgItem\n GetWindowRect\n MapWindowPoints\n IntersectRect\n GetMonitorInfoW\n SystemParametersInfoW\n GetDC\n ReleaseDC\n SetWindowsHookExW\n PeekMessageW\n WaitMessage\n SetMenu\n RegisterClipboardFormatW\n RedrawWindow\n GetMessagePos\n RegisterWindowMessageA\n ReplyMessage\n GetCursorPos\n CreateMenu\n SetMenuDefaultItem\n TrackPopupMenu\n DestroyMenu\n KillTimer\n GetDoubleClickTime\n RegisterHotKey\n GetKeyState\n UnregisterHotKey\n PostThreadMessageW\n GetSysColor\n EndDialog\n PostMessageW\n DestroyIcon\n SetTimer\n DestroyWindow\n DefWindowProcW\n SendMessageTimeoutW\n GetWindowThreadProcessId\n IsWindow\n GetKeyNameTextW\n MapVirtualKeyExW\n GetKeyboardLayout\n LoadImageW\n UnhookWindowsHookEx\n CallNextHookEx\n GetClassNameW\n SendMessageW\n GetMessageW\n TranslateMessage\n DispatchMessageW\n GetSystemMetrics\n GetScrollInfo\nGDI32.dll: SetStretchBltMode\n GetDeviceCaps\n GetDIBits\n SelectClipRgn\n TextOutW\n GetTextAlign\n SetTextAlign\n CreateCompatibleBitmap\n OffsetClipRgn\n OffsetRgn\n CombineRgn\n GetDCOrgEx\n GetRandomRgn\n EnumFontFamiliesExW\n CreateCompatibleDC\n BitBlt\n StretchDIBits\n GetRegionData\n ExtCreateRegion\n GetObjectW\n CreateFontIndirectW\n GetStockObject\n GetNearestColor\n CreateSolidBrush\n CreateRectRgn\n CreateDIBSection\n GetCurrentObject\n ExcludeClipRect\n RectVisible\n GetTextExtentExPointW\n GetTextExtentPoint32W\n DeleteDC\n SetBkMode\n CreateBitmapIndirect\n CreatePatternBrush\n SetBrushOrgEx\n SetBkColor\n SetTextColor\n PatBlt\n SelectObject\n GetTextMetricsW\n StretchBlt\n DeleteObject\ncomdlg32.dll: GetOpenFileNameW\n GetSaveFileNameW\n ChooseColorW\n CommDlgExtendedError\nADVAPI32.dll: RegisterServiceCtrlHandlerW\n StartServiceCtrlDispatcherW\n DeleteService\n CloseServiceHandle\n RegOpenKeyA\n RegQueryValueW\n InitializeSecurityDescriptor\n SetSecurityDescriptorDacl\n QueryServiceConfigW\n RegDeleteValueW\n RegSetValueExW\n RegQueryValueExW\n RegCreateKeyExW\n RegOpenKeyExW\n RegEnumKeyW\n RegCloseKey\n RegDeleteKeyW\n GetUserNameW\n RegisterEventSourceW\n ReportEventW\n DeregisterEventSource\n CreateServiceW\n StartServiceW\n OpenSCManagerW\n OpenServiceW\n ControlService\n SetServiceStatus\nSHELL32.dll: DragFinish\n DragAcceptFiles\n Shell_NotifyIconW\n SHBrowseForFolderW\n SHGetFileInfoW\n DragQueryFileW\n SHGetSpecialFolderLocation\n #16\n SHFileOperationW\n ShellExecuteExW\n SHGetDesktopFolder\n SHGetPathFromIDListW\n SHChangeNotify\n DragQueryPoint\nole32.dll: CoTaskMemFree\n OleUninitialize\n OleInitialize\n CoCreateInstance\n CoInitializeEx\n CoUninitialize\n CLSIDFromString\n CreateStreamOnHGlobal\n CoTaskMemAlloc\n RevokeDragDrop\n DoDragDrop\n RegisterDragDrop\n ReleaseStgMedium\n CreateBindCtx\n\nResources:\n102:\n Type: RT_BITMAP\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4382\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39894\n\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74128\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89581\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05678\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88565\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.1189\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.23531\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4117\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.73188\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.3313\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.80421\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94934\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.372\n\n103:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1597\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.93847\n\n104:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 708\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.50761\n Detected Filetype: GIF graphic file\n\n105:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 131\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.71536\n Detected Filetype: GIF graphic file\n\n106:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 125\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.20191\n Detected Filetype: GIF graphic file\n\n107:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 819\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.696866\n Detected Filetype: GIF graphic file\n\n108:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 822\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.718125\n Detected Filetype: GIF graphic file\n\n109:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 145\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.64828\n Detected Filetype: GIF graphic file\n\n110:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1150\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59283\n Detected Filetype: Icon file\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 160\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94725\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 728\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.36161\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 939\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.09871\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.4.1.1032\n ProductVersion: 1.4.1.1032\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: English - United States\n CompanyName: voidtools\n FileDescription: Everything\n FileVersion (#2): 1.4.1.1032\n InternalName: Everything\n LegalCopyright: Copyright © 2026 voidtools\n OriginalFilename: Everything.exe\n ProductName: Everything\n ProductVersion (#2): 1.4.1.1032\n\n\nDebug Info:\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2026-Jan-23 02:55:08\n Version: 0.0\n SizeofData: 73\n AddressOfRawData: 0x001EC488\n PointerToRawData: 0x001EAA88\n Referenced File: c:\\dev\\Everything-1.4\\x64\\Release\\Everything.pdb\n\n\nRICH Header:\nXOR Key: 0x758F4DEB\nUnmarked objects: 0\nASM objects (VS2012 build 50727 / VS2005 build 50727): 6\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 26\nC objects (40310): 8\nImports (40310): 21\nTotal imports: 450\nC objects (VS2012 build 50727 / VS2005 build 50727): 183\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n http://www.voidtools.com\n http://www.voidtools.com/everything/beta-update.ini\n http://www.voidtools.com/everything/update.ini\n http://www.w3.org\n http://www.w3.org/TR/html4/loose.dtd\n https://www.voidtools.com\n https://www.voidtools.com/\n https://www.voidtools.com/donate/\n https://www.voidtools.com/downloads/\n https://www.voidtools.com/downloads/#language\n https://www.voidtools.com/support/everything/\n https://www.voidtools.com/update/\n voidtools.com\n www.voidtools.com\n www.w3.org\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryExW\n LoadLibraryA\n Functions which can be used for anti-debugging purposes:\n FindWindowW\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n SHRegGetUSValueW\n RegisterHotKey\n RegOpenKeyA\n RegQueryValueW\n RegDeleteValueW\n RegSetValueExW\n RegQueryValueExW\n RegCreateKeyExW\n RegOpenKeyExW\n RegEnumKeyW\n RegCloseKey\n RegDeleteKeyW\n Can create temporary files:\n GetTempPathW\n CreateFileW\n Uses functions commonly found in keyloggers:\n GetForegroundWindow\n AttachThreadInput\n GetAsyncKeyState\n CallNextHookEx\n Leverages the raw socket API to access the Internet:\n WSAGetLastError\n WSACleanup\n closesocket\n send\n recv\n connect\n WSAAsyncSelect\n setsockopt\n socket\n WSAStartup\n shutdown\n listen\n bind\n getpeername\n ntohs\n getsockname\n accept\n inet_addr\n gethostbyname\n htons\n Interacts with services:\n DeleteService\n QueryServiceConfigW\n CreateServiceW\n OpenSCManagerW\n OpenServiceW\n ControlService\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Manipulates other processes:\n OpenProcess\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n BitBlt\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: voidtools PTY LTD\n Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"102:\n Type: RT_BITMAP\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4382\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.39894\n\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 744\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.74128\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 488\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.89581\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 296\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.05678\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.88565\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.1189\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.23531\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4117\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.73188\n Detected Filetype: PNG graphic file\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.3313\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.80421\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94934\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.372\n\n103:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1597\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.93847\n\n104:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 708\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.50761\n Detected Filetype: GIF graphic file\n\n105:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 131\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.71536\n Detected Filetype: GIF graphic file\n\n106:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 125\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.20191\n Detected Filetype: GIF graphic file\n\n107:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 819\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.696866\n Detected Filetype: GIF graphic file\n\n108:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 822\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 0.718125\n Detected Filetype: GIF graphic file\n\n109:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 145\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.64828\n Detected Filetype: GIF graphic file\n\n110:\n Type: RT_RCDATA\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 1150\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.59283\n Detected Filetype: Icon file\n\n101:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 160\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.94725\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 728\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.36161\n\n1 (#3):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 939\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.09871\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.4.1.1032\n ProductVersion: 1.4.1.1032\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_UNKNOWN\n Language: English - United States\n CompanyName: voidtools\n FileDescription: Everything\n FileVersion (#2): 1.4.1.1032\n InternalName: Everything\n LegalCopyright: Copyright © 2026 voidtools\n OriginalFilename: Everything.exe\n ProductName: Everything\n ProductVersion (#2): 1.4.1.1032"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2026-Jan-23 02:55:08\n Version: 0.0\n SizeofData: 73\n AddressOfRawData: 0x001EC488\n PointerToRawData: 0x001EAA88\n Referenced File: c:\\dev\\Everything-1.4\\x64\\Release\\Everything.pdb\n\n\nRICH Header:\nXOR Key: 0x758F4DEB\nUnmarked objects: 0\nASM objects (VS2012 build 50727 / VS2005 build 50727): 6\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 26\nC objects (40310): 8\nImports (40310): 21\nTotal imports: 450\nC objects (VS2012 build 50727 / VS2005 build 50727): 183\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n http://www.voidtools.com\n http://www.voidtools.com/everything/beta-update.ini\n http://www.voidtools.com/everything/update.ini\n http://www.w3.org\n http://www.w3.org/TR/html4/loose.dtd\n https://www.voidtools.com\n https://www.voidtools.com/\n https://www.voidtools.com/donate/\n https://www.voidtools.com/downloads/\n https://www.voidtools.com/downloads/#language\n https://www.voidtools.com/support/everything/\n https://www.voidtools.com/update/\n voidtools.com\n www.voidtools.com\n www.w3.org\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryExW\n LoadLibraryA\n Functions which can be used for anti-debugging purposes:\n FindWindowW\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n SHRegGetUSValueW\n RegisterHotKey\n RegOpenKeyA\n RegQueryValueW\n RegDeleteValueW\n RegSetValueExW\n RegQueryValueExW\n RegCreateKeyExW\n RegOpenKeyExW\n RegEnumKeyW\n RegCloseKey\n RegDeleteKeyW\n Can create temporary files:\n GetTempPathW\n CreateFileW\n Uses functions commonly found in keyloggers:\n GetForegroundWindow\n AttachThreadInput\n GetAsyncKeyState\n CallNextHookEx\n Leverages the raw socket API to access the Internet:\n WSAGetLastError\n WSACleanup\n closesocket\n send\n recv\n connect\n WSAAsyncSelect\n setsockopt\n socket\n WSAStartup\n shutdown\n listen\n bind\n getpeername\n ntohs\n getsockname\n accept\n inet_addr\n gethostbyname\n htons\n Interacts with services:\n DeleteService\n QueryServiceConfigW\n CreateServiceW\n OpenSCManagerW\n OpenServiceW\n ControlService\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Manipulates other processes:\n OpenProcess\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n BitBlt\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: voidtools PTY LTD\n Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Load Configuration":{},"RICH Header":{"raw":"XOR Key: 0x758F4DEB\nUnmarked objects: 0\nASM objects (VS2012 build 50727 / VS2005 build 50727): 6\nC++ objects (VS2012 build 50727 / VS2005 build 50727): 26\nC objects (40310): 8\nImports (40310): 21\nTotal imports: 450\nC objects (VS2012 build 50727 / VS2005 build 50727): 183\nResource objects (VS2012 build 50727 / VS2005 build 50727): 1\nLinker (VS2012 build 50727 / VS2005 build 50727): 1\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n May have dropper capabilities:\n CurrentVersion\\Run\n Contains domain names:\n http://www.voidtools.com\n http://www.voidtools.com/everything/beta-update.ini\n http://www.voidtools.com/everything/update.ini\n http://www.w3.org\n http://www.w3.org/TR/html4/loose.dtd\n https://www.voidtools.com\n https://www.voidtools.com/\n https://www.voidtools.com/donate/\n https://www.voidtools.com/downloads/\n https://www.voidtools.com/downloads/#language\n https://www.voidtools.com/support/everything/\n https://www.voidtools.com/update/\n voidtools.com\n www.voidtools.com\n www.w3.org\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n GetProcAddress\n LoadLibraryExW\n LoadLibraryA\n Functions which can be used for anti-debugging purposes:\n FindWindowW\n Code injection capabilities (PowerLoader):\n FindWindowW\n GetWindowLongW\n Can access the registry:\n SHRegGetUSValueW\n RegisterHotKey\n RegOpenKeyA\n RegQueryValueW\n RegDeleteValueW\n RegSetValueExW\n RegQueryValueExW\n RegCreateKeyExW\n RegOpenKeyExW\n RegEnumKeyW\n RegCloseKey\n RegDeleteKeyW\n Can create temporary files:\n GetTempPathW\n CreateFileW\n Uses functions commonly found in keyloggers:\n GetForegroundWindow\n AttachThreadInput\n GetAsyncKeyState\n CallNextHookEx\n Leverages the raw socket API to access the Internet:\n WSAGetLastError\n WSACleanup\n closesocket\n send\n recv\n connect\n WSAAsyncSelect\n setsockopt\n socket\n WSAStartup\n shutdown\n listen\n bind\n getpeername\n ntohs\n getsockname\n accept\n inet_addr\n gethostbyname\n htons\n Interacts with services:\n DeleteService\n QueryServiceConfigW\n CreateServiceW\n OpenSCManagerW\n OpenServiceW\n ControlService\n Enumerates local disk drives:\n GetVolumeInformationW\n GetDriveTypeW\n Manipulates other processes:\n OpenProcess\n Can take screenshots:\n FindWindowW\n GetDC\n CreateCompatibleDC\n BitBlt\n Reads the contents of the clipboard:\n GetClipboardData\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: voidtools PTY LTD\n Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/everything-019f7f42fecc7c41a55dd70b4a72446e.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_9pqd2t5v/output.txt"},"timestamp":"2026-07-20 16:57:51"} {"_id":{"$oid":"6a5e3f8eb3bed57e0e737944"},"sha256":"03e40798b193db7de556657be34522abb0a4bb6f74b2e71bb4b4af44dab6aa40","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /tmp/sdm_decoded__bdwq3xd/zlib_offset_0x59454_5.bin\nDate: 2026-07-20 21:02:30\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/tmp/sdm_decoded__bdwq3xd/zlib_offset_0x59454_5.bin\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2034-Mar-11 17:01:05\nDetected languages: English - United States\nDebug artifacts: D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\\\vcruntime140.amd64.pdb\nCompanyName: Microsoft Corporation\nFileDescription: Microsoft® C Runtime Library\nFileVersion: 14.42.34226.3\nInternalName: vcruntime140.dll\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: vcruntime140.dll\nProductName: Microsoft® Visual Studio®\nProductVersion: 14.42.34226.3\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F0\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 8\nTimeDateStamp: 2034-Mar-11 17:01:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00012400\nSizeOfInitializedData: 0x00006400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000000F690 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: A.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0001E000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00021582\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00011290\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00011400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.47088\n\nfothk:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00011800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0159202\n\n.rdata:\n VirtualSize: 0x0000438C\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00004400\n PointerToRawData: 0x00012800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.67773\n\n.data:\n VirtualSize: 0x000009A0\n VirtualAddress: 0x00019000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00016C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.54017\n\n.pdata:\n VirtualSize: 0x00000BDC\n VirtualAddress: 0x0001A000\n SizeOfRawData: 0x00000C00\n PointerToRawData: 0x00017000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.84705\n\n_RDATA:\n VirtualSize: 0x000001F8\n VirtualAddress: 0x0001B000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00017C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.04989\n\n.rsrc:\n VirtualSize: 0x000003D0\n VirtualAddress: 0x0001C000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00017E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.22893\n\n.reloc:\n VirtualSize: 0x000002E0\n VirtualAddress: 0x0001D000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00018200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.81812\n\n\nImports:\n--------\napi-ms-win-crt-runtime-l1-1-0.dll: terminate\n abort\napi-ms-win-crt-heap-l1-1-0.dll: calloc\n malloc\n free\napi-ms-win-crt-string-l1-1-0.dll: strcpy_s\n strncmp\n wcsncmp\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vsprintf\n __stdio_common_vsprintf_s\napi-ms-win-crt-convert-l1-1-0.dll: atol\nKERNEL32.dll: SetLastError\n IsProcessorFeaturePresent\n TerminateProcess\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlCaptureContext\n GetSystemTimeAsFileTime\n GetCurrentThreadId\n GetCurrentProcessId\n QueryPerformanceCounter\n RtlLookupFunctionEntry\n RtlUnwindEx\n RtlUnwind\n GetModuleHandleW\n EncodePointer\n RaiseException\n RtlPcToFileHeader\n InterlockedPushEntrySList\n InterlockedFlushSList\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n GetLastError\n LoadLibraryExW\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n FreeLibrary\n GetProcAddress\n GetModuleFileNameW\n\nExports:\n--------\n_CreateFrameInfo:\n Ordinal: 1\n Address: 0x0000F3D0\n\n_CxxThrowException:\n Ordinal: 2\n Address: 0x000051D0\n\n_FindAndUnlinkFrame:\n Ordinal: 3\n Address: 0x0000F410\n\n_IsExceptionObjectToBeDestroyed:\n Ordinal: 4\n Address: 0x00001080\n\n_SetWinRTOutOfMemoryExceptionCallback:\n Ordinal: 5\n Address: 0x000010B0\n\n__AdjustPointer:\n Ordinal: 6\n Address: 0x000010C0\n\n__BuildCatchObject:\n Ordinal: 7\n Address: 0x00004270\n\n__BuildCatchObjectHelper:\n Ordinal: 8\n Address: 0x00004280\n\n__C_specific_handler:\n Ordinal: 9\n Address: 0x0000E720\n\n__C_specific_handler_noexcept:\n Ordinal: 10\n Address: 0x0000E4D0\n\n__CxxDetectRethrow:\n Ordinal: 11\n Address: 0x000042A0\n\n__CxxExceptionFilter:\n Ordinal: 12\n Address: 0x000042F0\n\n__CxxFrameHandler:\n Ordinal: 13\n Address: 0x0000F4C0\n\n__CxxFrameHandler2:\n Ordinal: 14\n Address: 0x0000F4C0\n\n__CxxFrameHandler3:\n Ordinal: 15\n Address: 0x0000F4D0\n\n__CxxQueryExceptionSize:\n Ordinal: 16\n Address: 0x000044E0\n\n__CxxRegisterExceptionObject:\n Ordinal: 17\n Address: 0x000044F0\n\n__CxxUnregisterExceptionObject:\n Ordinal: 18\n Address: 0x000045A0\n\n__DestructExceptionObject:\n Ordinal: 19\n Address: 0x00001000\n\n__FrameUnwindFilter:\n Ordinal: 20\n Address: 0x000010F0\n\n__GetPlatformExceptionInfo:\n Ordinal: 21\n Address: 0x00001160\n\n__NLG_Dispatch2:\n Ordinal: 22\n Address: 0x0000F850\n\n__NLG_Return2:\n Ordinal: 23\n Address: 0x0000F860\n\n__RTCastToVoid:\n Ordinal: 24\n Address: 0x00004CB0\n\n__RTDynamicCast:\n Ordinal: 25\n Address: 0x00004D10\n\n__RTtypeid:\n Ordinal: 26\n Address: 0x00004E80\n\n__TypeMatch:\n Ordinal: 27\n Address: 0x00004290\n\n__current_exception:\n Ordinal: 28\n Address: 0x000011C0\n\n__current_exception_context:\n Ordinal: 29\n Address: 0x000011E0\n\n__intrinsic_setjmp:\n Ordinal: 30\n Address: 0x000110D0\n\n__intrinsic_setjmpex:\n Ordinal: 31\n Address: 0x00011170\n\n__processing_throw:\n Ordinal: 32\n Address: 0x00001200\n\n__report_gsfailure:\n Ordinal: 33\n Address: 0x00010E40\n\n__std_exception_copy:\n Ordinal: 34\n Address: 0x00004F30\n\n__std_exception_destroy:\n Ordinal: 35\n Address: 0x00004FC0\n\n__std_terminate:\n Ordinal: 36\n Address: 0x00001220\n\n__std_type_info_compare:\n Ordinal: 37\n Address: 0x00005010\n\n__std_type_info_destroy_list:\n Ordinal: 38\n Address: 0x00005040\n\n__std_type_info_hash:\n Ordinal: 39\n Address: 0x00005070\n\n__std_type_info_name:\n Ordinal: 40\n Address: 0x000050B0\n\n__telemetry_main_invoke_trigger:\n Ordinal: 41\n Address: 0x00005A00\n\n__telemetry_main_return_trigger:\n Ordinal: 42\n Address: 0x00005A00\n\n__unDName:\n Ordinal: 43\n Address: 0x0000DB30\n\n__unDNameEx:\n Ordinal: 44\n Address: 0x0000DB60\n\n__uncaught_exception:\n Ordinal: 45\n Address: 0x00005280\n\n__uncaught_exceptions:\n Ordinal: 46\n Address: 0x000052A0\n\n__vcrt_GetModuleFileNameW:\n Ordinal: 47\n Address: 0x00005990\n\n__vcrt_GetModuleHandleW:\n Ordinal: 48\n Address: 0x000059A0\n\n__vcrt_InitializeCriticalSectionEx:\n Ordinal: 49\n Address: 0x00005920\n\n__vcrt_LoadLibraryExW:\n Ordinal: 50\n Address: 0x000059B0\n\n_get_purecall_handler:\n Ordinal: 51\n Address: 0x000059C0\n\n_get_unexpected:\n Ordinal: 52\n Address: 0x000052C0\n\n_is_exception_typeof:\n Ordinal: 53\n Address: 0x00001230\n\n_local_unwind:\n Ordinal: 54\n Address: 0x0000DDB0\n\n_purecall:\n Ordinal: 55\n Address: 0x000059D0\n\n_set_purecall_handler:\n Ordinal: 56\n Address: 0x000059F0\n\n_set_se_translator:\n Ordinal: 57\n Address: 0x00005340\n\nlongjmp:\n Ordinal: 58\n Address: 0x0000DD80\n\nmemchr:\n Ordinal: 59\n Address: 0x00011250\n\nmemcmp:\n Ordinal: 60\n Address: 0x000112F0\n\nmemcpy:\n Ordinal: 61\n Address: 0x00013010\n\nmemmove:\n Ordinal: 62\n Address: 0x000113F0\n\nmemset:\n Ordinal: 63\n Address: 0x00011A90\n\nset_unexpected:\n Ordinal: 64\n Address: 0x000052F0\n\nstrchr:\n Ordinal: 65\n Address: 0x0000DDE0\n\nstrrchr:\n Ordinal: 66\n Address: 0x0000DE60\n\nstrstr:\n Ordinal: 67\n Address: 0x0000DFA0\n\nunexpected:\n Ordinal: 68\n Address: 0x00005320\n\nwcschr:\n Ordinal: 69\n Address: 0x0000E190\n\nwcsrchr:\n Ordinal: 70\n Address: 0x0000E210\n\nwcsstr:\n Ordinal: 71\n Address: 0x0000E2C0\n\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 876\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49051\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 14.42.34226.3\n ProductVersion: 14.42.34226.3\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Microsoft® C Runtime Library\n FileVersion (#2): 14.42.34226.3\n InternalName: vcruntime140.dll\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: vcruntime140.dll\n ProductName: Microsoft® Visual Studio®\n ProductVersion (#2): 14.42.34226.3\n\n\nDebug Info:\n-----------\nIMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 91\n AddressOfRawData: 0x000166C4\n PointerToRawData: 0x00014EC4\n Referenced File: D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\\\vcruntime140.amd64.pdb\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 560\n AddressOfRawData: 0x00016720\n PointerToRawData: 0x00014F20\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 36\n AddressOfRawData: 0x00016978\n PointerToRawData: 0x00015178\n\nUNKNOWN (#2):\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 4\n AddressOfRawData: 0x0001699C\n PointerToRawData: 0x0001519C\n\n\nLoad Configuration:\n-------------------\nSize: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180019040\nGuardCFCheckFunctionPointer: 0x0000000180014198\nGuardCFDispatchFunctionPointer: 0x0000000000000000\nGuardCFFunctionTable: 0x0000000000000000\nGuardCFFunctionCount: 0x0000000000000000\nGuardFlags: (EMPTY)\nCodeIntegrity.Flags: 0x0000\nCodeIntegrity.Catalog: 0x0000\nCodeIntegrity.CatalogOffset: 0x00000000\nCodeIntegrity.Reserved: 0x00000000\nGuardAddressTakenIatEntryTable: 0x0000000000000000\nGuardAddressTakenIatEntryCount: 0\nGuardLongJumpTargetTable: 0x0000000000000000\nGuardLongJumpTargetCount: 0\n\nRICH Header:\n------------\nXOR Key: 0xE3805C18\nUnmarked objects: 0\nImports (30795): 2\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 45\nUnmarked objects (#2): 1\nC objects (33923): 16\nC++ objects (33923): 31\nASM objects (33923): 21\nExports (33923): 1\nResource objects (33923): 1\nLinker (33923): 1\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: fothk\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: enabled\n\nThe PE is digitally signed.\n Signer: Microsoft Windows Software Compatibility Publisher\n Issuer: Microsoft Windows Third Party Component CA 2013\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nCompilation Date: 2034-Mar-11 17:01:05\nDetected languages: English - United States\nDebug artifacts: D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\\\vcruntime140.amd64.pdb\nCompanyName: Microsoft Corporation\nFileDescription: Microsoft® C Runtime Library\nFileVersion: 14.42.34226.3\nInternalName: vcruntime140.dll\nLegalCopyright: © Microsoft Corporation. All rights reserved.\nOriginalFilename: vcruntime140.dll\nProductName: Microsoft® Visual Studio®\nProductVersion: 14.42.34226.3"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x000000F0"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 8\nTimeDateStamp: 2034-Mar-11 17:01:05\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_DLL\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 14.0\nSizeOfCode: 0x00012400\nSizeOfInitializedData: 0x00006400\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000000000000F690 (Section: .text)\nBaseOfCode: 0x00001000\nImageBase: 0x0000000180000000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 6.0\nImageVersion: A.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x0001E000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00021582\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\nSizeofStackReserve: 0x0000000000100000\nSizeofStackCommit: 0x0000000000001000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00011290\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00011400\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.47088\n\nfothk:\n VirtualSize: 0x00001000\n VirtualAddress: 0x00013000\n SizeOfRawData: 0x00001000\n PointerToRawData: 0x00011800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 0.0159202\n\n.rdata:\n VirtualSize: 0x0000438C\n VirtualAddress: 0x00014000\n SizeOfRawData: 0x00004400\n PointerToRawData: 0x00012800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.67773\n\n.data:\n VirtualSize: 0x000009A0\n VirtualAddress: 0x00019000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00016C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 2.54017\n\n.pdata:\n VirtualSize: 0x00000BDC\n VirtualAddress: 0x0001A000\n SizeOfRawData: 0x00000C00\n PointerToRawData: 0x00017000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.84705\n\n_RDATA:\n VirtualSize: 0x000001F8\n VirtualAddress: 0x0001B000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00017C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.04989\n\n.rsrc:\n VirtualSize: 0x000003D0\n VirtualAddress: 0x0001C000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00017E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 3.22893\n\n.reloc:\n VirtualSize: 0x000002E0\n VirtualAddress: 0x0001D000\n SizeOfRawData: 0x00000400\n PointerToRawData: 0x00018200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_DISCARDABLE\n IMAGE_SCN_MEM_READ\n Entropy: 3.81812"},"Imports":{"raw":"api-ms-win-crt-runtime-l1-1-0.dll: terminate\n abort\napi-ms-win-crt-heap-l1-1-0.dll: calloc\n malloc\n free\napi-ms-win-crt-string-l1-1-0.dll: strcpy_s\n strncmp\n wcsncmp\napi-ms-win-crt-stdio-l1-1-0.dll: __stdio_common_vsprintf\n __stdio_common_vsprintf_s\napi-ms-win-crt-convert-l1-1-0.dll: atol\nKERNEL32.dll: SetLastError\n IsProcessorFeaturePresent\n TerminateProcess\n GetCurrentProcess\n SetUnhandledExceptionFilter\n UnhandledExceptionFilter\n RtlVirtualUnwind\n RtlCaptureContext\n GetSystemTimeAsFileTime\n GetCurrentThreadId\n GetCurrentProcessId\n QueryPerformanceCounter\n RtlLookupFunctionEntry\n RtlUnwindEx\n RtlUnwind\n GetModuleHandleW\n EncodePointer\n RaiseException\n RtlPcToFileHeader\n InterlockedPushEntrySList\n InterlockedFlushSList\n EnterCriticalSection\n LeaveCriticalSection\n DeleteCriticalSection\n GetLastError\n LoadLibraryExW\n InitializeCriticalSectionAndSpinCount\n TlsAlloc\n TlsGetValue\n TlsSetValue\n TlsFree\n FreeLibrary\n GetProcAddress\n GetModuleFileNameW"},"Exports":{"raw":"_CreateFrameInfo:\n Ordinal: 1\n Address: 0x0000F3D0\n\n_CxxThrowException:\n Ordinal: 2\n Address: 0x000051D0\n\n_FindAndUnlinkFrame:\n Ordinal: 3\n Address: 0x0000F410\n\n_IsExceptionObjectToBeDestroyed:\n Ordinal: 4\n Address: 0x00001080\n\n_SetWinRTOutOfMemoryExceptionCallback:\n Ordinal: 5\n Address: 0x000010B0\n\n__AdjustPointer:\n Ordinal: 6\n Address: 0x000010C0\n\n__BuildCatchObject:\n Ordinal: 7\n Address: 0x00004270\n\n__BuildCatchObjectHelper:\n Ordinal: 8\n Address: 0x00004280\n\n__C_specific_handler:\n Ordinal: 9\n Address: 0x0000E720\n\n__C_specific_handler_noexcept:\n Ordinal: 10\n Address: 0x0000E4D0\n\n__CxxDetectRethrow:\n Ordinal: 11\n Address: 0x000042A0\n\n__CxxExceptionFilter:\n Ordinal: 12\n Address: 0x000042F0\n\n__CxxFrameHandler:\n Ordinal: 13\n Address: 0x0000F4C0\n\n__CxxFrameHandler2:\n Ordinal: 14\n Address: 0x0000F4C0\n\n__CxxFrameHandler3:\n Ordinal: 15\n Address: 0x0000F4D0\n\n__CxxQueryExceptionSize:\n Ordinal: 16\n Address: 0x000044E0\n\n__CxxRegisterExceptionObject:\n Ordinal: 17\n Address: 0x000044F0\n\n__CxxUnregisterExceptionObject:\n Ordinal: 18\n Address: 0x000045A0\n\n__DestructExceptionObject:\n Ordinal: 19\n Address: 0x00001000\n\n__FrameUnwindFilter:\n Ordinal: 20\n Address: 0x000010F0\n\n__GetPlatformExceptionInfo:\n Ordinal: 21\n Address: 0x00001160\n\n__NLG_Dispatch2:\n Ordinal: 22\n Address: 0x0000F850\n\n__NLG_Return2:\n Ordinal: 23\n Address: 0x0000F860\n\n__RTCastToVoid:\n Ordinal: 24\n Address: 0x00004CB0\n\n__RTDynamicCast:\n Ordinal: 25\n Address: 0x00004D10\n\n__RTtypeid:\n Ordinal: 26\n Address: 0x00004E80\n\n__TypeMatch:\n Ordinal: 27\n Address: 0x00004290\n\n__current_exception:\n Ordinal: 28\n Address: 0x000011C0\n\n__current_exception_context:\n Ordinal: 29\n Address: 0x000011E0\n\n__intrinsic_setjmp:\n Ordinal: 30\n Address: 0x000110D0\n\n__intrinsic_setjmpex:\n Ordinal: 31\n Address: 0x00011170\n\n__processing_throw:\n Ordinal: 32\n Address: 0x00001200\n\n__report_gsfailure:\n Ordinal: 33\n Address: 0x00010E40\n\n__std_exception_copy:\n Ordinal: 34\n Address: 0x00004F30\n\n__std_exception_destroy:\n Ordinal: 35\n Address: 0x00004FC0\n\n__std_terminate:\n Ordinal: 36\n Address: 0x00001220\n\n__std_type_info_compare:\n Ordinal: 37\n Address: 0x00005010\n\n__std_type_info_destroy_list:\n Ordinal: 38\n Address: 0x00005040\n\n__std_type_info_hash:\n Ordinal: 39\n Address: 0x00005070\n\n__std_type_info_name:\n Ordinal: 40\n Address: 0x000050B0\n\n__telemetry_main_invoke_trigger:\n Ordinal: 41\n Address: 0x00005A00\n\n__telemetry_main_return_trigger:\n Ordinal: 42\n Address: 0x00005A00\n\n__unDName:\n Ordinal: 43\n Address: 0x0000DB30\n\n__unDNameEx:\n Ordinal: 44\n Address: 0x0000DB60\n\n__uncaught_exception:\n Ordinal: 45\n Address: 0x00005280\n\n__uncaught_exceptions:\n Ordinal: 46\n Address: 0x000052A0\n\n__vcrt_GetModuleFileNameW:\n Ordinal: 47\n Address: 0x00005990\n\n__vcrt_GetModuleHandleW:\n Ordinal: 48\n Address: 0x000059A0\n\n__vcrt_InitializeCriticalSectionEx:\n Ordinal: 49\n Address: 0x00005920\n\n__vcrt_LoadLibraryExW:\n Ordinal: 50\n Address: 0x000059B0\n\n_get_purecall_handler:\n Ordinal: 51\n Address: 0x000059C0\n\n_get_unexpected:\n Ordinal: 52\n Address: 0x000052C0\n\n_is_exception_typeof:\n Ordinal: 53\n Address: 0x00001230\n\n_local_unwind:\n Ordinal: 54\n Address: 0x0000DDB0\n\n_purecall:\n Ordinal: 55\n Address: 0x000059D0\n\n_set_purecall_handler:\n Ordinal: 56\n Address: 0x000059F0\n\n_set_se_translator:\n Ordinal: 57\n Address: 0x00005340\n\nlongjmp:\n Ordinal: 58\n Address: 0x0000DD80\n\nmemchr:\n Ordinal: 59\n Address: 0x00011250\n\nmemcmp:\n Ordinal: 60\n Address: 0x000112F0\n\nmemcpy:\n Ordinal: 61\n Address: 0x00013010\n\nmemmove:\n Ordinal: 62\n Address: 0x000113F0\n\nmemset:\n Ordinal: 63\n Address: 0x00011A90\n\nset_unexpected:\n Ordinal: 64\n Address: 0x000052F0\n\nstrchr:\n Ordinal: 65\n Address: 0x0000DDE0\n\nstrrchr:\n Ordinal: 66\n Address: 0x0000DE60\n\nstrstr:\n Ordinal: 67\n Address: 0x0000DFA0\n\nunexpected:\n Ordinal: 68\n Address: 0x00005320\n\nwcschr:\n Ordinal: 69\n Address: 0x0000E190\n\nwcsrchr:\n Ordinal: 70\n Address: 0x0000E210\n\nwcsstr:\n Ordinal: 71\n Address: 0x0000E2C0"},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 876\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.49051\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 14.42.34226.3\n ProductVersion: 14.42.34226.3\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_DLL\n Language: English - United States\n CompanyName: Microsoft Corporation\n FileDescription: Microsoft® C Runtime Library\n FileVersion (#2): 14.42.34226.3\n InternalName: vcruntime140.dll\n LegalCopyright: © Microsoft Corporation. All rights reserved.\n OriginalFilename: vcruntime140.dll\n ProductName: Microsoft® Visual Studio®\n ProductVersion (#2): 14.42.34226.3"},"Debug Info":{"raw":"IMAGE_DEBUG_TYPE_CODEVIEW:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 91\n AddressOfRawData: 0x000166C4\n PointerToRawData: 0x00014EC4\n Referenced File: D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\\\vcruntime140.amd64.pdb\n\nIMAGE_DEBUG_TYPE_POGO:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 560\n AddressOfRawData: 0x00016720\n PointerToRawData: 0x00014F20\n\nUNKNOWN:\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 36\n AddressOfRawData: 0x00016978\n PointerToRawData: 0x00015178\n\nUNKNOWN (#2):\n Characteristics: 0\n TimeDateStamp: 2034-Mar-11 17:01:05\n Version: 0.0\n SizeofData: 4\n AddressOfRawData: 0x0001699C\n PointerToRawData: 0x0001519C"},"Load Configuration":{"raw":"Size: 320\nTimeDateStamp: 1970-Jan-01 00:00:00\nVersion: 0.0\nGlobalFlagsClear: (EMPTY)\nGlobalFlagsSet: (EMPTY)\nCriticalSectionDefaultTimeout: 0\nDeCommitFreeBlockThreshold: 0x0000000000000000\nDeCommitTotalFreeThreshold: 0x0000000000000000\nLockPrefixTable: 0x0000000000000000\nMaximumAllocationSize: 0x0000000000000000\nVirtualMemoryThreshold: 0x0000000000000000\nProcessAffinityMask: 0x0000000000000000\nProcessHeapFlags: (EMPTY)\nCSDVersion: 0\nReserved1: 0x0000\nEditList: 0x0000000000000000\nSecurityCookie: 0x0000000180019040\nGuardCFCheckFunctionPointer: 0x0000000180014198\nGuardCFDispatchFunctionPointer: 0x0000000000000000\nGuardCFFunctionTable: 0x0000000000000000\nGuardCFFunctionCount: 0x0000000000000000\nGuardFlags: (EMPTY)\nCodeIntegrity.Flags: 0x0000\nCodeIntegrity.Catalog: 0x0000\nCodeIntegrity.CatalogOffset: 0x00000000\nCodeIntegrity.Reserved: 0x00000000\nGuardAddressTakenIatEntryTable: 0x0000000000000000\nGuardAddressTakenIatEntryCount: 0\nGuardLongJumpTargetTable: 0x0000000000000000\nGuardLongJumpTargetCount: 0"},"RICH Header":{"raw":"XOR Key: 0xE3805C18\nUnmarked objects: 0\nImports (30795): 2\nImports (VS2008 SP1 build 30729): 11\nTotal imports: 45\nUnmarked objects (#2): 1\nC objects (33923): 16\nC++ objects (33923): 31\nASM objects (33923): 21\nExports (33923): 1\nResource objects (33923): 1\nLinker (33923): 1\n\n[ SUSPICIOUS ] The PE is possibly packed.\n Unusual section name found: fothk\n\nThe PE contains common functions which appear in legitimate applications.\n [!] The program may be hiding some of its imports:\n LoadLibraryExW\n GetProcAddress\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: enabled\n SafeSEH: enabled (0 registered handlers)\n ASLR: enabled\n DEP: enabled\n CFG: enabled\n\nThe PE is digitally signed.\n Signer: Microsoft Windows Software Compatibility Publisher\n Issuer: Microsoft Windows Third Party Component CA 2013\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Interesting strings found in the binary":{},"file_path":"/tmp/sdm_decoded__bdwq3xd/zlib_offset_0x59454_5.bin"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_w_ako4zk/output.txt"},"timestamp":"2026-07-20 21:02:30"} {"_id":{"$oid":"6a5f647e39c3725e311ebc01"},"sha256":"ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f-019f84747f8b7b32a1cccc7839305ec1.exe\nDate: 2026-07-21 17:52:22\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f-019f84747f8b7b32a1cccc7839305ec1.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jul-20 12:45:04\nComments: \nCompanyName: \nFileDescription: Seismograph\nFileVersion: 1.0.0.0\nInternalName: ncXc.exe\nLegalCopyright: Copyright © 2026\nLegalTrademarks: \nOriginalFilename: ncXc.exe\nProductName: Seismograph\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 2\nTimeDateStamp: 2026-Jul-20 12:45:04\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE\n\nImage Optional Header:\n----------------------\nMagic: PE32+\nLinkerVersion: 48.0\nSizeOfCode: 0x00B7D400\nSizeOfInitializedData: 0x00000600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000000000 (Section: ?)\nBaseOfCode: 0x00002000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00B82000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000400000\nSizeofStackCommit: 0x0000000000004000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000002000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00B7D330\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00B7D400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99819\n\n.rsrc:\n VirtualSize: 0x000005A4\n VirtualAddress: 0x00B80000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00B7D600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.05759\n\n\nResources:\n----------\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.24887\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\n-------------\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: Seismograph\n FileVersion (#2): 1.0.0.0\n InternalName: ncXc.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: ncXc.exe\n ProductName: Seismograph\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 0 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 12050944 bytes of data starting at offset 0xb7dc00.\n\n\n\n[*] Warning: Raw bytes from section .text could not be obtained.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_AMD64\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2026-Jul-20 12:45:04\nComments: \nCompanyName: \nFileDescription: Seismograph\nFileVersion: 1.0.0.0\nInternalName: ncXc.exe\nLegalCopyright: Copyright © 2026\nLegalTrademarks: \nOriginalFilename: ncXc.exe\nProductName: Seismograph\nProductVersion: 1.0.0.0\nAssembly Version: 1.0.0.0"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_AMD64\nNumberofSections: 2\nTimeDateStamp: 2026-Jul-20 12:45:04\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00F0\nCharacteristics: IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LARGE_ADDRESS_AWARE"},"Image Optional Header":{"raw":"Magic: PE32+\nLinkerVersion: 48.0\nSizeOfCode: 0x00B7D400\nSizeOfInitializedData: 0x00000600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x0000000000000000 (Section: ?)\nBaseOfCode: 0x00002000\nImageBase: 0x0000000140000000\nSectionAlignment: 0x00002000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 6.0\nWin32VersionValue: 0\nSizeOfImage: 0x00B82000\nSizeOfHeaders: 0x00000200\nChecksum: 0x00000000\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nDllCharacteristics: IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\nSizeofStackReserve: 0x0000000000400000\nSizeofStackCommit: 0x0000000000004000\nSizeofHeapReserve: 0x0000000000100000\nSizeofHeapCommit: 0x0000000000002000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00B7D330\n VirtualAddress: 0x00002000\n SizeOfRawData: 0x00B7D400\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 7.99819\n\n.rsrc:\n VirtualSize: 0x000005A4\n VirtualAddress: 0x00B80000\n SizeOfRawData: 0x00000600\n PointerToRawData: 0x00B7D600\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.05759\n\n\nResources:\n1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.24887\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: Seismograph\n FileVersion (#2): 1.0.0.0\n InternalName: ncXc.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: ncXc.exe\n ProductName: Seismograph\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 0 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 12050944 bytes of data starting at offset 0xb7dc00.\n\n\n\n[*] Warning: Raw bytes from section .text could not be obtained.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Imports":{},"Exports":{},"Resources":{"raw":"1:\n Type: RT_VERSION\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 788\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.24887\n\n1 (#2):\n Type: RT_MANIFEST\n Language: UNKNOWN\n Codepage: UNKNOWN\n Size: 490\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.00112\n\n\nVersion Info:\nResource LangID: UNKNOWN\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: VOS_DOS_WINDOWS32\n VOS_NT_WINDOWS32\n VOS__WINDOWS32\n FileType: VFT_APP\n Language: UNKNOWN\n Comments: \n CompanyName: \n FileDescription: Seismograph\n FileVersion (#2): 1.0.0.0\n InternalName: ncXc.exe\n LegalCopyright: Copyright © 2026\n LegalTrademarks: \n OriginalFilename: ncXc.exe\n ProductName: Seismograph\n ProductVersion (#2): 1.0.0.0\n Assembly Version: 1.0.0.0\n\n\n[ SUSPICIOUS ] The PE is possibly packed.\n The PE only has 0 import(s).\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: enabled\n DEP: enabled\n CFG: disabled\n\n[ SUSPICIOUS ] The file contains overlay data.\n 12050944 bytes of data starting at offset 0xb7dc00.\n\n\n\n[*] Warning: Raw bytes from section .text could not be obtained.\n[*] Warning: Yara callback received an unhandled message (6).\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f-019f84747f8b7b32a1cccc7839305ec1.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_o754u7n8/output.txt"},"timestamp":"2026-07-21 17:52:22"} {"_id":{"$oid":"6a5f8ef639c3725e311ebc0b"},"sha256":"115a0313cc91d6bd04289153206752ba9576f08418583e826b546240940731ad","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/DriverPack-Notifier-019f8543e9bb7843ad162075fdd8babb.exe\nDate: 2026-07-21 20:53:34\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/DriverPack-Notifier-019f8543e9bb7843ad162075fdd8babb.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2012-Dec-30 08:50:02\nDetected languages: English - United States\n Russian - Russia\n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0060\ne_cp: 0x0001\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000060\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2012-Dec-30 08:50:02\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00016200\nSizeOfInitializedData: 0x00038600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000168BF (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00018000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00054000\nSizeOfHeaders: 0x00000200\nChecksum: 0x000500FF\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x000161C0\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00016200\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.64192\n\n.rdata:\n VirtualSize: 0x000037A0\n VirtualAddress: 0x00018000\n SizeOfRawData: 0x00003800\n PointerToRawData: 0x00016400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.65212\n\n.data:\n VirtualSize: 0x00002B2C\n VirtualAddress: 0x0001C000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00019C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.99468\n\n.rsrc:\n VirtualSize: 0x000345C6\n VirtualAddress: 0x0001F000\n SizeOfRawData: 0x00034600\n PointerToRawData: 0x0001A400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.28475\n\n\nImports:\n--------\nCOMCTL32.dll: #17\nSHELL32.dll: SHGetSpecialFolderPathW\n ShellExecuteW\n SHGetMalloc\n SHGetPathFromIDListW\n SHBrowseForFolderW\n SHGetFileInfoW\n ShellExecuteExW\nGDI32.dll: CreateCompatibleDC\n CreateFontIndirectW\n DeleteObject\n DeleteDC\n GetCurrentObject\n StretchBlt\n GetDeviceCaps\n CreateCompatibleBitmap\n SelectObject\n SetStretchBltMode\n GetObjectW\nADVAPI32.dll: FreeSid\n AllocateAndInitializeSid\n CheckTokenMembership\nUSER32.dll: GetMenu\n SetWindowPos\n GetWindowDC\n ReleaseDC\n CopyImage\n GetKeyState\n GetWindowRect\n ScreenToClient\n GetWindowLongW\n SetTimer\n GetMessageW\n DispatchMessageW\n KillTimer\n DestroyWindow\n EndDialog\n SendMessageW\n wsprintfW\n GetClassNameA\n GetWindowTextW\n GetWindowTextLengthW\n GetSysColor\n wsprintfA\n SetWindowTextW\n CreateWindowExW\n GetDlgItem\n GetClientRect\n SetWindowLongW\n UnhookWindowsHookEx\n SetFocus\n GetSystemMetrics\n SystemParametersInfoW\n ShowWindow\n DrawTextW\n GetDC\n ClientToScreen\n GetWindow\n DialogBoxIndirectParamW\n DrawIconEx\n CallWindowProcW\n DefWindowProcW\n CallNextHookEx\n PtInRect\n SetWindowsHookExW\n LoadImageW\n LoadIconW\n MessageBeep\n EnableWindow\n IsWindow\n EnableMenuItem\n GetSystemMenu\n wvsprintfW\n CharUpperW\n MessageBoxA\n GetParent\nole32.dll: CreateStreamOnHGlobal\n CoCreateInstance\n CoInitialize\nOLEAUT32.dll: SysAllocString\n VariantClear\n OleLoadPicture\nKERNEL32.dll: SetFileTime\n SetEndOfFile\n EnterCriticalSection\n DeleteCriticalSection\n GetModuleHandleA\n LeaveCriticalSection\n WaitForMultipleObjects\n ReadFile\n SetFilePointer\n GetFileSize\n FormatMessageW\n lstrcpyW\n LocalFree\n IsBadReadPtr\n GetSystemDirectoryW\n GetCurrentThreadId\n SuspendThread\n TerminateThread\n InitializeCriticalSection\n ResetEvent\n SetEvent\n CreateEventW\n GetVersionExW\n GetModuleFileNameW\n GetCurrentProcess\n SetProcessWorkingSetSize\n SetCurrentDirectoryW\n GetDriveTypeW\n CreateFileW\n GetCommandLineW\n GetStartupInfoW\n CreateProcessW\n CreateJobObjectW\n ResumeThread\n AssignProcessToJobObject\n CreateIoCompletionPort\n SetInformationJobObject\n GetQueuedCompletionStatus\n GetExitCodeProcess\n CloseHandle\n SetEnvironmentVariableW\n GetTempPathW\n GetSystemTimeAsFileTime\n lstrlenW\n CompareFileTime\n SetThreadLocale\n FindFirstFileW\n DeleteFileW\n FindNextFileW\n FindClose\n RemoveDirectoryW\n ExpandEnvironmentStringsW\n WideCharToMultiByte\n VirtualAlloc\n GlobalMemoryStatusEx\n lstrcmpW\n GetEnvironmentVariableW\n lstrcmpiW\n lstrlenA\n GetLocaleInfoW\n MultiByteToWideChar\n GetUserDefaultUILanguage\n GetSystemDefaultUILanguage\n GetSystemDefaultLCID\n lstrcmpiA\n GlobalAlloc\n GlobalFree\n MulDiv\n FindResourceExA\n SizeofResource\n LoadResource\n LockResource\n LoadLibraryA\n ExitProcess\n lstrcatW\n GetDiskFreeSpaceExW\n SetFileAttributesW\n SetLastError\n Sleep\n GetExitCodeThread\n WaitForSingleObject\n CreateThread\n GetLastError\n SystemTimeToFileTime\n GetLocalTime\n GetFileAttributesW\n CreateDirectoryW\n WriteFile\n GetStdHandle\n VirtualFree\n GetModuleHandleW\n GetProcAddress\n GetStartupInfoA\nMSVCRT.dll: ??3@YAXPAX@Z\n ??2@YAPAXI@Z\n memcmp\n free\n memcpy\n _controlfp\n _except_handler3\n __set_app_type\n __p__fmode\n __p__commode\n _adjust_fdiv\n __setusermatherr\n _initterm\n __getmainargs\n _acmdln\n exit\n _XcptFilter\n _exit\n ??1type_info@@UAE@XZ\n _onexit\n __dllonexit\n _CxxThrowException\n _beginthreadex\n _EH_prolog\n ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z\n memset\n _wcsnicmp\n strncmp\n wcsncmp\n malloc\n memmove\n _wtol\n _purecall\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\n101:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: Latin 1 / Western European\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 838\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.23138\n\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Possibly launches other programs:\n ShellExecuteW\n CreateProcessW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Functions related to the privilege level:\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n Can take screenshots:\n CreateCompatibleDC\n GetDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Kuzyakov Artur Vyacheslavovich IP\n Issuer: Symantec Class 3 SHA256 Code Signing CA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 2012-Dec-30 08:50:02\nDetected languages: English - United States\n Russian - Russia"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0060\ne_cp: 0x0001\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000060"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 4\nTimeDateStamp: 2012-Dec-30 08:50:02\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 8.0\nSizeOfCode: 0x00016200\nSizeOfInitializedData: 0x00038600\nSizeOfUninitializedData: 0x00000000\nAddressOfEntryPoint: 0x000168BF (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00018000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 0.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00054000\nSizeOfHeaders: 0x00000200\nChecksum: 0x000500FF\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00100000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x000161C0\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00016200\n PointerToRawData: 0x00000200\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_CODE\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.64192\n\n.rdata:\n VirtualSize: 0x000037A0\n VirtualAddress: 0x00018000\n SizeOfRawData: 0x00003800\n PointerToRawData: 0x00016400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 5.65212\n\n.data:\n VirtualSize: 0x00002B2C\n VirtualAddress: 0x0001C000\n SizeOfRawData: 0x00000800\n PointerToRawData: 0x00019C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 3.99468\n\n.rsrc:\n VirtualSize: 0x000345C6\n VirtualAddress: 0x0001F000\n SizeOfRawData: 0x00034600\n PointerToRawData: 0x0001A400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.28475"},"Imports":{"raw":"COMCTL32.dll: #17\nSHELL32.dll: SHGetSpecialFolderPathW\n ShellExecuteW\n SHGetMalloc\n SHGetPathFromIDListW\n SHBrowseForFolderW\n SHGetFileInfoW\n ShellExecuteExW\nGDI32.dll: CreateCompatibleDC\n CreateFontIndirectW\n DeleteObject\n DeleteDC\n GetCurrentObject\n StretchBlt\n GetDeviceCaps\n CreateCompatibleBitmap\n SelectObject\n SetStretchBltMode\n GetObjectW\nADVAPI32.dll: FreeSid\n AllocateAndInitializeSid\n CheckTokenMembership\nUSER32.dll: GetMenu\n SetWindowPos\n GetWindowDC\n ReleaseDC\n CopyImage\n GetKeyState\n GetWindowRect\n ScreenToClient\n GetWindowLongW\n SetTimer\n GetMessageW\n DispatchMessageW\n KillTimer\n DestroyWindow\n EndDialog\n SendMessageW\n wsprintfW\n GetClassNameA\n GetWindowTextW\n GetWindowTextLengthW\n GetSysColor\n wsprintfA\n SetWindowTextW\n CreateWindowExW\n GetDlgItem\n GetClientRect\n SetWindowLongW\n UnhookWindowsHookEx\n SetFocus\n GetSystemMetrics\n SystemParametersInfoW\n ShowWindow\n DrawTextW\n GetDC\n ClientToScreen\n GetWindow\n DialogBoxIndirectParamW\n DrawIconEx\n CallWindowProcW\n DefWindowProcW\n CallNextHookEx\n PtInRect\n SetWindowsHookExW\n LoadImageW\n LoadIconW\n MessageBeep\n EnableWindow\n IsWindow\n EnableMenuItem\n GetSystemMenu\n wvsprintfW\n CharUpperW\n MessageBoxA\n GetParent\nole32.dll: CreateStreamOnHGlobal\n CoCreateInstance\n CoInitialize\nOLEAUT32.dll: SysAllocString\n VariantClear\n OleLoadPicture\nKERNEL32.dll: SetFileTime\n SetEndOfFile\n EnterCriticalSection\n DeleteCriticalSection\n GetModuleHandleA\n LeaveCriticalSection\n WaitForMultipleObjects\n ReadFile\n SetFilePointer\n GetFileSize\n FormatMessageW\n lstrcpyW\n LocalFree\n IsBadReadPtr\n GetSystemDirectoryW\n GetCurrentThreadId\n SuspendThread\n TerminateThread\n InitializeCriticalSection\n ResetEvent\n SetEvent\n CreateEventW\n GetVersionExW\n GetModuleFileNameW\n GetCurrentProcess\n SetProcessWorkingSetSize\n SetCurrentDirectoryW\n GetDriveTypeW\n CreateFileW\n GetCommandLineW\n GetStartupInfoW\n CreateProcessW\n CreateJobObjectW\n ResumeThread\n AssignProcessToJobObject\n CreateIoCompletionPort\n SetInformationJobObject\n GetQueuedCompletionStatus\n GetExitCodeProcess\n CloseHandle\n SetEnvironmentVariableW\n GetTempPathW\n GetSystemTimeAsFileTime\n lstrlenW\n CompareFileTime\n SetThreadLocale\n FindFirstFileW\n DeleteFileW\n FindNextFileW\n FindClose\n RemoveDirectoryW\n ExpandEnvironmentStringsW\n WideCharToMultiByte\n VirtualAlloc\n GlobalMemoryStatusEx\n lstrcmpW\n GetEnvironmentVariableW\n lstrcmpiW\n lstrlenA\n GetLocaleInfoW\n MultiByteToWideChar\n GetUserDefaultUILanguage\n GetSystemDefaultUILanguage\n GetSystemDefaultLCID\n lstrcmpiA\n GlobalAlloc\n GlobalFree\n MulDiv\n FindResourceExA\n SizeofResource\n LoadResource\n LockResource\n LoadLibraryA\n ExitProcess\n lstrcatW\n GetDiskFreeSpaceExW\n SetFileAttributesW\n SetLastError\n Sleep\n GetExitCodeThread\n WaitForSingleObject\n CreateThread\n GetLastError\n SystemTimeToFileTime\n GetLocalTime\n GetFileAttributesW\n CreateDirectoryW\n WriteFile\n GetStdHandle\n VirtualFree\n GetModuleHandleW\n GetProcAddress\n GetStartupInfoA\nMSVCRT.dll: ??3@YAXPAX@Z\n ??2@YAPAXI@Z\n memcmp\n free\n memcpy\n _controlfp\n _except_handler3\n __set_app_type\n __p__fmode\n __p__commode\n _adjust_fdiv\n __setusermatherr\n _initterm\n __getmainargs\n _acmdln\n exit\n _XcptFilter\n _exit\n ??1type_info@@UAE@XZ\n _onexit\n __dllonexit\n _CxxThrowException\n _beginthreadex\n _EH_prolog\n ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z\n memset\n _wcsnicmp\n strncmp\n wcsncmp\n malloc\n memmove\n _wtol\n _purecall\n\nResources:\n1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\n101:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: Latin 1 / Western European\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 838\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.23138\n\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Possibly launches other programs:\n ShellExecuteW\n CreateProcessW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Functions related to the privilege level:\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n Can take screenshots:\n CreateCompatibleDC\n GetDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Kuzyakov Artur Vyacheslavovich IP\n Issuer: Symantec Class 3 SHA256 Code Signing CA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: Russian - Russia\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\n101:\n Type: RT_GROUP_ICON\n Language: Russian - Russia\n Codepage: Latin 1 / Western European\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_MANIFEST\n Language: English - United States\n Codepage: Latin 1 / Western European\n Size: 838\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.23138\n\n\nMatching compiler(s):\n Microsoft Visual C++ 6.0 - 8.0\n Microsoft Visual C++\n Microsoft Visual C++ v6.0\n\n[ MALICIOUS ] The PE contains functions mostly used by malware.\n [!] The program may be hiding some of its imports:\n LoadLibraryA\n GetProcAddress\n Possibly launches other programs:\n ShellExecuteW\n CreateProcessW\n Can create temporary files:\n CreateFileW\n GetTempPathW\n Functions related to the privilege level:\n CheckTokenMembership\n Enumerates local disk drives:\n GetDriveTypeW\n Can take screenshots:\n CreateCompatibleDC\n GetDC\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\nThe PE is digitally signed.\n Signer: Kuzyakov Artur Vyacheslavovich IP\n Issuer: Symantec Class 3 SHA256 Code Signing CA\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/DriverPack-Notifier-019f8543e9bb7843ad162075fdd8babb.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_1l3w8s3s/output.txt"},"timestamp":"2026-07-21 20:53:34"} {"_id":{"$oid":"6a5f9e3c39c3725e311ebc0f"},"sha256":"0659388dba26d26eada6d82ed38f22fb2b0a264d1cc4667cce7f4523c72d59be","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/DriverPackNotifier-019f85807f6c7773b42d4974124ffe3f.exe\nDate: 2026-07-21 23:09:13\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/DriverPackNotifier-019f85807f6c7773b42d4974124ffe3f.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 1970-Jan-01 00:00:00\nDetected languages: English - United States\nTLS Callbacks: 2 callback(s) detected.\nFileDescription: Software and Drivers\nFileVersion: 1.0\nInternalName: DPS\nOriginalFilename: DriverPackSolution.exe\nProductName: DriverPack Solution\nProductVersion: \n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 9\nTimeDateStamp: 1970-Jan-01 00:00:00\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00007800\nSizeOfInitializedData: 0x0003EE00\nSizeOfUninitializedData: 0x00000C00\nAddressOfEntryPoint: 0x000012C0 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00009000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00046000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00048800\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00007644\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.26844\n\n.data:\n VirtualSize: 0x00000028\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.299041\n\n.rdata:\n VirtualSize: 0x00000A00\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00007E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.974\n\n.eh_fram:\n VirtualSize: 0x000015AC\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00001600\n PointerToRawData: 0x00008800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.84187\n\n.bss:\n VirtualSize: 0x00000A30\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x0000088C\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00009E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.34037\n\n.CRT:\n VirtualSize: 0x00000018\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000A800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.114463\n\n.tls:\n VirtualSize: 0x00000020\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.195869\n\n.rsrc:\n VirtualSize: 0x000344D0\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00034600\n PointerToRawData: 0x0000AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.25974\n\n\nImports:\n--------\nKERNEL32.dll: DeleteCriticalSection\n EnterCriticalSection\n ExitProcess\n FindClose\n FindFirstFileA\n FindNextFileA\n GetCommandLineA\n GetCommandLineW\n GetLastError\n GetModuleFileNameW\n GetModuleHandleA\n GetModuleHandleW\n GetProcAddress\n GetWindowsDirectoryW\n InitializeCriticalSection\n InterlockedExchange\n IsDBCSLeadByteEx\n LeaveCriticalSection\n MultiByteToWideChar\n SetCurrentDirectoryW\n SetEnvironmentVariableW\n SetUnhandledExceptionFilter\n Sleep\n TlsGetValue\n VirtualProtect\n VirtualQuery\n WideCharToMultiByte\nmsvcrt.dll: _strdup\n _stricoll\nmsvcrt.dll (#2): _strdup\n _stricoll\nSHELL32.DLL: CommandLineToArgvW\n ShellExecuteW\nSHLWAPI.DLL: PathRemoveFileSpecW\nUSER32.dll: wsprintfW\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\nID:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 584\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15558\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n FileDescription: Software and Drivers\n FileVersion (#2): 1.0\n InternalName: DPS\n OriginalFilename: DriverPackSolution.exe\n ProductName: DriverPack Solution\n ProductVersion (#2): \n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x00410001\nEndAddressOfRawData: 0x0041001C\nAddressOfIndex: 0x0040D038\nAddressOfCallbacks: 0x0040F004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x004018E0\n 0x00401890\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n mshta.exe\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n ShellExecuteW\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 82.4791% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 1970-Jan-01 00:00:00\nDetected languages: English - United States\nTLS Callbacks: 2 callback(s) detected.\nFileDescription: Software and Drivers\nFileVersion: 1.0\nInternalName: DPS\nOriginalFilename: DriverPackSolution.exe\nProductName: DriverPack Solution\nProductVersion:"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 9\nTimeDateStamp: 1970-Jan-01 00:00:00\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00007800\nSizeOfInitializedData: 0x0003EE00\nSizeOfUninitializedData: 0x00000C00\nAddressOfEntryPoint: 0x000012C0 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00009000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00046000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00048800\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00007644\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.26844\n\n.data:\n VirtualSize: 0x00000028\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.299041\n\n.rdata:\n VirtualSize: 0x00000A00\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00007E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.974\n\n.eh_fram:\n VirtualSize: 0x000015AC\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00001600\n PointerToRawData: 0x00008800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.84187\n\n.bss:\n VirtualSize: 0x00000A30\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x0000088C\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00009E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.34037\n\n.CRT:\n VirtualSize: 0x00000018\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000A800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.114463\n\n.tls:\n VirtualSize: 0x00000020\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.195869\n\n.rsrc:\n VirtualSize: 0x000344D0\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00034600\n PointerToRawData: 0x0000AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.25974"},"Imports":{"raw":"KERNEL32.dll: DeleteCriticalSection\n EnterCriticalSection\n ExitProcess\n FindClose\n FindFirstFileA\n FindNextFileA\n GetCommandLineA\n GetCommandLineW\n GetLastError\n GetModuleFileNameW\n GetModuleHandleA\n GetModuleHandleW\n GetProcAddress\n GetWindowsDirectoryW\n InitializeCriticalSection\n InterlockedExchange\n IsDBCSLeadByteEx\n LeaveCriticalSection\n MultiByteToWideChar\n SetCurrentDirectoryW\n SetEnvironmentVariableW\n SetUnhandledExceptionFilter\n Sleep\n TlsGetValue\n VirtualProtect\n VirtualQuery\n WideCharToMultiByte\nmsvcrt.dll: _strdup\n _stricoll\nmsvcrt.dll (#2): _strdup\n _stricoll\nSHELL32.DLL: CommandLineToArgvW\n ShellExecuteW\nSHLWAPI.DLL: PathRemoveFileSpecW\nUSER32.dll: wsprintfW\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\nID:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 584\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15558\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n FileDescription: Software and Drivers\n FileVersion (#2): 1.0\n InternalName: DPS\n OriginalFilename: DriverPackSolution.exe\n ProductName: DriverPack Solution\n ProductVersion (#2): \n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x00410001\nEndAddressOfRawData: 0x0041001C\nAddressOfIndex: 0x0040D038\nAddressOfCallbacks: 0x0040F004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x004018E0\n 0x00401890\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n mshta.exe\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n ShellExecuteW\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 82.4791% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\nID:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 584\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.15558\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n FileDescription: Software and Drivers\n FileVersion (#2): 1.0\n InternalName: DPS\n OriginalFilename: DriverPackSolution.exe\n ProductName: DriverPack Solution\n ProductVersion (#2): \n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x00410001\nEndAddressOfRawData: 0x0041001C\nAddressOfIndex: 0x0040D038\nAddressOfCallbacks: 0x0040F004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x004018E0\n 0x00401890\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n mshta.exe\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n ShellExecuteW\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 82.4791% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/DriverPackNotifier-019f85807f6c7773b42d4974124ffe3f.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_1g9chb91/output.txt"},"timestamp":"2026-07-21 23:09:13"} {"_id":{"$oid":"6a5fb37339c3725e311ebc13"},"sha256":"0585547fd8fb93a98ff616249edfa78f28e2d0a57c56a8453d39c418935bf79a","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/DOC-LJS1XI-019f85d42d0971a38a84f6406b9c77d2.lnk\nDate: 2026-07-21 23:29:15\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/DOC-LJS1XI-019f85d42d0971a38a84f6406b9c77d2.lnk!\nDetected file type(s):\n\tWindows shortcut file\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/DOC-LJS1XI-019f85d42d0971a38a84f6406b9c77d2.lnk"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_3qp7kgpw/output.txt"},"timestamp":"2026-07-21 23:29:15"} {"_id":{"$oid":"6a5fb86439c3725e311ebc2d"},"sha256":"18ae5af757dc585b6bd461caaf7af264eeceb59983cf64f7312a9a6eec900396","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Uninstall-019f85e6d6d07050b6e6f285f14ed08a.exe\nDate: 2026-07-21 23:50:20\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n-------------------------------------------------------------------------------\n/home/apogean/projects/malware/windows/all_runs/Uninstall-019f85e6d6d07050b6e6f285f14ed08a.exe\n-------------------------------------------------------------------------------\n\nSummary:\n--------\nArchitecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 1970-Jan-01 00:00:00\nDetected languages: English - United States\nTLS Callbacks: 2 callback(s) detected.\nFileDescription: Installs and updates drivers\nFileVersion: 1.0\nInternalName: DPS\nOriginalFilename: DriverPackSolution.exe\nProductName: DriverPack Solution\nProductVersion: \n\nDOS Header:\n-----------\ne_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080\n\nPE Header:\n----------\nSignature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 9\nTimeDateStamp: 1970-Jan-01 00:00:00\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED\n\nImage Optional Header:\n----------------------\nMagic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00007800\nSizeOfInitializedData: 0x0003EE00\nSizeOfUninitializedData: 0x00000C00\nAddressOfEntryPoint: 0x000012C0 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00009000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00046000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00048BAD\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16\n\nSections:\n---------\n.text:\n VirtualSize: 0x00007644\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.26844\n\n.data:\n VirtualSize: 0x00000028\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.299041\n\n.rdata:\n VirtualSize: 0x00000A00\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00007E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.974\n\n.eh_fram:\n VirtualSize: 0x000015AC\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00001600\n PointerToRawData: 0x00008800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.84187\n\n.bss:\n VirtualSize: 0x00000A30\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x0000088C\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00009E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.34037\n\n.CRT:\n VirtualSize: 0x00000018\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000A800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.114463\n\n.tls:\n VirtualSize: 0x00000020\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.195869\n\n.rsrc:\n VirtualSize: 0x000344E0\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00034600\n PointerToRawData: 0x0000AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.26008\n\n\nImports:\n--------\nKERNEL32.dll: DeleteCriticalSection\n EnterCriticalSection\n ExitProcess\n FindClose\n FindFirstFileA\n FindNextFileA\n GetCommandLineA\n GetCommandLineW\n GetLastError\n GetModuleFileNameW\n GetModuleHandleA\n GetModuleHandleW\n GetProcAddress\n GetWindowsDirectoryW\n InitializeCriticalSection\n InterlockedExchange\n IsDBCSLeadByteEx\n LeaveCriticalSection\n MultiByteToWideChar\n SetCurrentDirectoryW\n SetEnvironmentVariableW\n SetUnhandledExceptionFilter\n Sleep\n TlsGetValue\n VirtualProtect\n VirtualQuery\n WideCharToMultiByte\nmsvcrt.dll: _strdup\n _stricoll\nmsvcrt.dll (#2): _strdup\n _stricoll\nSHELL32.DLL: CommandLineToArgvW\n ShellExecuteW\nSHLWAPI.DLL: PathRemoveFileSpecW\nUSER32.dll: wsprintfW\n\nResources:\n----------\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\nID:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 600\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1714\n\n\nVersion Info:\n-------------\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n FileDescription: Installs and updates drivers\n FileVersion (#2): 1.0\n InternalName: DPS\n OriginalFilename: DriverPackSolution.exe\n ProductName: DriverPack Solution\n ProductVersion (#2): \n\n\nTLS Callbacks:\n--------------\nStartAddressOfRawData: 0x00410001\nEndAddressOfRawData: 0x0041001C\nAddressOfIndex: 0x0040D038\nAddressOfCallbacks: 0x0040F004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x004018E0\n 0x00401890\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n mshta.exe\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n ShellExecuteW\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 82.4853% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information.\n","json_output":{"Summary":{"raw":"Architecture: IMAGE_FILE_MACHINE_I386\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nCompilation Date: 1970-Jan-01 00:00:00\nDetected languages: English - United States\nTLS Callbacks: 2 callback(s) detected.\nFileDescription: Installs and updates drivers\nFileVersion: 1.0\nInternalName: DPS\nOriginalFilename: DriverPackSolution.exe\nProductName: DriverPack Solution\nProductVersion:"},"DOS Header":{"raw":"e_magic: MZ\ne_cblp: 0x0090\ne_cp: 0x0003\ne_crlc: 0x0000\ne_cparhdr: 0x0004\ne_minalloc: 0x0000\ne_maxalloc: 0xFFFF\ne_ss: 0x0000\ne_sp: 0x00B8\ne_csum: 0x0000\ne_ip: 0x0000\ne_cs: 0x0000\ne_ovno: 0x0000\ne_oemid: 0x0000\ne_oeminfo: 0x0000\ne_lfanew: 0x00000080"},"PE Header":{"raw":"Signature: PE\nMachine: IMAGE_FILE_MACHINE_I386\nNumberofSections: 9\nTimeDateStamp: 1970-Jan-01 00:00:00\nPointerToSymbolTable: 0x00000000\nNumberOfSymbols: 0\nSizeOfOptionalHeader: 0x00E0\nCharacteristics: IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_DEBUG_STRIPPED\n IMAGE_FILE_EXECUTABLE_IMAGE\n IMAGE_FILE_LINE_NUMS_STRIPPED\n IMAGE_FILE_LOCAL_SYMS_STRIPPED\n IMAGE_FILE_RELOCS_STRIPPED"},"Image Optional Header":{"raw":"Magic: PE32\nLinkerVersion: 2.0\nSizeOfCode: 0x00007800\nSizeOfInitializedData: 0x0003EE00\nSizeOfUninitializedData: 0x00000C00\nAddressOfEntryPoint: 0x000012C0 (Section: .text)\nBaseOfCode: 0x00001000\nBaseOfData: 0x00009000\nImageBase: 0x00400000\nSectionAlignment: 0x00001000\nFileAlignment: 0x00000200\nOperatingSystemVersion: 4.0\nImageVersion: 1.0\nSubsystemVersion: 4.0\nWin32VersionValue: 0\nSizeOfImage: 0x00046000\nSizeOfHeaders: 0x00000400\nChecksum: 0x00048BAD\nSubsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI\nSizeofStackReserve: 0x00200000\nSizeofStackCommit: 0x00001000\nSizeofHeapReserve: 0x00100000\nSizeofHeapCommit: 0x00001000\nLoaderFlags: 0x00000000\nNumberOfRvaAndSizes: 16"},"Sections":{"raw":".text:\n VirtualSize: 0x00007644\n VirtualAddress: 0x00001000\n SizeOfRawData: 0x00007800\n PointerToRawData: 0x00000400\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_CODE\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_EXECUTE\n IMAGE_SCN_MEM_READ\n Entropy: 6.26844\n\n.data:\n VirtualSize: 0x00000028\n VirtualAddress: 0x00009000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x00007C00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.299041\n\n.rdata:\n VirtualSize: 0x00000A00\n VirtualAddress: 0x0000A000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00007E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.974\n\n.eh_fram:\n VirtualSize: 0x000015AC\n VirtualAddress: 0x0000B000\n SizeOfRawData: 0x00001600\n PointerToRawData: 0x00008800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n Entropy: 4.84187\n\n.bss:\n VirtualSize: 0x00000A30\n VirtualAddress: 0x0000D000\n SizeOfRawData: 0x00000000\n PointerToRawData: 0x00000000\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_2048BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_8BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_UNINITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n\n.idata:\n VirtualSize: 0x0000088C\n VirtualAddress: 0x0000E000\n SizeOfRawData: 0x00000A00\n PointerToRawData: 0x00009E00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.34037\n\n.CRT:\n VirtualSize: 0x00000018\n VirtualAddress: 0x0000F000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000A800\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.114463\n\n.tls:\n VirtualSize: 0x00000020\n VirtualAddress: 0x00010000\n SizeOfRawData: 0x00000200\n PointerToRawData: 0x0000AA00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 0.195869\n\n.rsrc:\n VirtualSize: 0x000344E0\n VirtualAddress: 0x00011000\n SizeOfRawData: 0x00034600\n PointerToRawData: 0x0000AC00\n PointerToRelocations: 0x00000000\n PointerToLineNumbers: 0x00000000\n NumberOfLineNumbers: 0\n NumberOfRelocations: 0\n Characteristics: IMAGE_SCN_ALIGN_1024BYTES\n IMAGE_SCN_ALIGN_16BYTES\n IMAGE_SCN_ALIGN_1BYTES\n IMAGE_SCN_ALIGN_256BYTES\n IMAGE_SCN_ALIGN_2BYTES\n IMAGE_SCN_ALIGN_32BYTES\n IMAGE_SCN_ALIGN_4096BYTES\n IMAGE_SCN_ALIGN_4BYTES\n IMAGE_SCN_ALIGN_512BYTES\n IMAGE_SCN_ALIGN_64BYTES\n IMAGE_SCN_ALIGN_8192BYTES\n IMAGE_SCN_ALIGN_MASK\n IMAGE_SCN_CNT_INITIALIZED_DATA\n IMAGE_SCN_MEM_READ\n IMAGE_SCN_MEM_WRITE\n Entropy: 4.26008"},"Imports":{"raw":"KERNEL32.dll: DeleteCriticalSection\n EnterCriticalSection\n ExitProcess\n FindClose\n FindFirstFileA\n FindNextFileA\n GetCommandLineA\n GetCommandLineW\n GetLastError\n GetModuleFileNameW\n GetModuleHandleA\n GetModuleHandleW\n GetProcAddress\n GetWindowsDirectoryW\n InitializeCriticalSection\n InterlockedExchange\n IsDBCSLeadByteEx\n LeaveCriticalSection\n MultiByteToWideChar\n SetCurrentDirectoryW\n SetEnvironmentVariableW\n SetUnhandledExceptionFilter\n Sleep\n TlsGetValue\n VirtualProtect\n VirtualQuery\n WideCharToMultiByte\nmsvcrt.dll: _strdup\n _stricoll\nmsvcrt.dll (#2): _strdup\n _stricoll\nSHELL32.DLL: CommandLineToArgvW\n ShellExecuteW\nSHLWAPI.DLL: PathRemoveFileSpecW\nUSER32.dll: wsprintfW\n\nResources:\n1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\nID:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 600\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1714\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n FileDescription: Installs and updates drivers\n FileVersion (#2): 1.0\n InternalName: DPS\n OriginalFilename: DriverPackSolution.exe\n ProductName: DriverPack Solution\n ProductVersion (#2): \n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x00410001\nEndAddressOfRawData: 0x0041001C\nAddressOfIndex: 0x0040D038\nAddressOfCallbacks: 0x0040F004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x004018E0\n 0x00401890\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n mshta.exe\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n ShellExecuteW\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 82.4853% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Exports":{},"Resources":{"raw":"1:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11662\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94836\n Detected Filetype: PNG graphic file\n\n2:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 19496\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.9356\n\n3:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 11432\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23783\n\n4:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 5672\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.5842\n\n5:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 3752\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.08499\n\n6:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2216\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.47772\n\n7:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1736\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.59548\n\n8:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1384\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.67063\n\n9:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 15006\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 7.94023\n Detected Filetype: PNG graphic file\n\n10:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 67624\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.61384\n\n11:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 38056\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.76386\n\n12:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 16936\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 2.99654\n\n13:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 9640\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.23473\n\n14:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 4264\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.83963\n\n15:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 2440\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 4.14323\n\n16:\n Type: RT_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 1128\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 5.14101\n\nID:\n Type: RT_GROUP_ICON\n Language: English - United States\n Codepage: UNKNOWN\n Size: 230\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.16102\n Detected Filetype: Icon file\n\n1 (#2):\n Type: RT_VERSION\n Language: English - United States\n Codepage: UNKNOWN\n Size: 600\n TimeDateStamp: 1980-Jan-01 00:00:00\n Entropy: 3.1714\n\n\nVersion Info:\nResource LangID: English - United States\nVS_VERSION_INFO:\n Signature: 0xFEEF04BD\n StructVersion: 0x00010000\n FileVersion: 1.0.0.0\n ProductVersion: 1.0.0.0\n FileFlags: (EMPTY)\n FileOs: (EMPTY)\n FileType: VFT_UNKNOWN\n Language: English - United States\n FileDescription: Installs and updates drivers\n FileVersion (#2): 1.0\n InternalName: DPS\n OriginalFilename: DriverPackSolution.exe\n ProductName: DriverPack Solution\n ProductVersion (#2): \n\n\nTLS Callbacks:\nStartAddressOfRawData: 0x00410001\nEndAddressOfRawData: 0x0041001C\nAddressOfIndex: 0x0040D038\nAddressOfCallbacks: 0x0040F004\nSizeOfZeroFill: 0x00000000\nCharacteristics: IMAGE_SCN_TYPE_REG\nCallbacks: 0x004018E0\n 0x00401890\n\n[ SUSPICIOUS ] Strings found in the binary may indicate undesirable behavior:\n Contains references to system / monitoring tools:\n mshta.exe\n\nThe PE contains common functions which appear in legitimate applications.\n Possibly launches other programs:\n ShellExecuteW\n\n[ SUSPICIOUS ] The PE is possibly a dropper.\n Resources amount for 82.4853% of the executable.\n\nThe following exploit mitigation techniques have been detected\n Stack Canary: disabled\n SafeSEH: disabled\n ASLR: disabled\n DEP: disabled\n CFG: disabled\n\n\n\n[!] Error: [plugin_virustotal] VirusTotal API access denied. Please verify that your API key is valid.\n[!] Error: [Yara compiler] yara_rules/clamav.yara (999960) : syntax error, unexpected '{', expecting text string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (1089890) : syntax error, unexpected string identifier, expecting '}'\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2064551) : unreferenced string \"$a7\"\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2510733) : invalid hex string \"$a0\": uneven number of digits in hex string\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2597376) : invalid hex string \"$a5\": syntax error\n[!] Error: [Yara compiler] yara_rules/clamav.yara (2983072) : invalid hex string \"$a0\": invalid character in hex string\n[!] Error: Could not compile yara rules (6 error(s)).\n[!] Error: ClamAV rules haven't been generated yet!\n[!] Error: Please run yara_rules/update_clamav_signatures.py to create them, and refer to the documentation for additional information."},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Uninstall-019f85e6d6d07050b6e6f285f14ed08a.exe"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_fmn5dely/output.txt"},"timestamp":"2026-07-21 23:50:20"} {"_id":{"$oid":"6a5fbe8339c3725e311ebc35"},"sha256":"e5f7f85644ce467afc6fc446a366a4e14aea9f5eff7540258cef64b18f07a0b4","analysis_data":{"success":true,"output":"\n================================================================================\nMANALYZE ANALYSIS REPORT\n================================================================================\nFile: /home/apogean/projects/malware/windows/all_runs/Analysis_Proc_Report_Gem-019f85ff392573b394ca114653712a64.pdf\nDate: 2026-07-22 00:16:27\nExit Code: 0\n================================================================================\n\n* Manalyze 0.9 *\n\n\n[!] Error: DOS Header is invalid (wrong magic).\n[!] Error: Could not parse /home/apogean/projects/malware/windows/all_runs/Analysis_Proc_Report_Gem-019f85ff392573b394ca114653712a64.pdf!\nDetected file type(s):\n\tPDF Document\n\n","json_output":{"Summary":{},"DOS Header":{},"PE Header":{},"Image Optional Header":{},"Sections":{},"Imports":{},"Exports":{},"Resources":{},"Debug Info":{},"Load Configuration":{},"RICH Header":{},"Interesting strings found in the binary":{},"file_path":"/home/apogean/projects/malware/windows/all_runs/Analysis_Proc_Report_Gem-019f85ff392573b394ca114653712a64.pdf"},"exit_code":0,"output_file":"/tmp/sdm_manalyze_icmrkv_2/output.txt"},"timestamp":"2026-07-22 00:16:27"}