Create Interactive Tour
Windows
Analysis Report
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.UltraVNC.gen.27745.639.exe
Overview
General Information
| Sample Name: | SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.UltraVNC.gen.27745.639.exe |
| Analysis ID: | 1309615 |
| MD5: | eafba56f876c04229c33c88a0bd964fa |
| SHA1: | d34f886a895f190c8a2d1bf4e46cbf104358126c |
| SHA256: | 76c77a70b8ff02ec28049a28fdb538a5d663f548b48e9a449371edd4c414a15e |
| Tags: | exe |
 | |
Detection
| Score: | 26 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 80% |
Signatures
Multi AV Scanner detection for submitted file
Contains VNC / remote desktop functionality (version string found)
May use bcdedit to modify the Windows boot settings
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
PE file contains executable resources (Code or Archives)
Classification
- System is w10x64
SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.UltraVNC.gen.27745.639.exe (PID: 1408 cmdline: C:\Users\u ser\Deskto p\Securite Info.com.n ot-a-virus .HEUR.Remo teAdmin.Wi n32.UltraV NC.gen.277 45.639.exe MD5: EAFBA56F876C04229C33C88A0BD964FA)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
- • AV Detection
- • Compliance
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
- • Remote Access Functionality
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Virustotal: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File written: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Window detected: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00007FF69FF6456E | |
| Source: | Code function: | 0_2_00007FF69FF64A1A | |
| Source: | Code function: | 0_2_00007FF69FF64ECA | |
| Source: | Code function: | 0_2_00007FF69FF64F16 | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF6A00933A8 | |
Remote Access Functionality | |
|---|
| Source: | String found in binary or memory: | ||
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | 2 Command and Scripting Interpreter | 1 Bootkit | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 System Time Discovery | 1 Remote Desktop Protocol | Data from Local System | Exfiltration Over Other Network Medium | 1 Remote Access Software | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Bootkit | LSASS Memory | 1 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Junk Data | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | 1 Virtualization/Sandbox Evasion | Security Account Manager | 1 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Steganography | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | 1 Process Injection | NTDS | 2 Process Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | 2 File and Directory Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | Steganography | Cached Domain Credentials | 12 System Information Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
No bigger version
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 8% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
⊘No contacted domains info
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown |
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|
| IP |
|---|
| 127.0.0.1 |
| Joe Sandbox Version: | 38.0.0 Beryl |
| Analysis ID: | 1309615 |
| Start date and time: | 2023-09-17 17:38:12 +02:00 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 4m 38s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Number of analysed new started processes analysed: | 16 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample file name: | SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.UltraVNC.gen.27745.639.exe |
| Detection: | SUS |
| Classification: | sus26.troj.winEXE@1/1@0/1 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: | Failed |
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, a udiodg.exe, BackgroundTransfer Host.exe, WMIADAP.exe, backgro undTaskHost.exe, conhost.exe, svchost.exe - Excluded IPs from analysis (wh
itelisted): 204.79.197.200, 13 .107.21.200, 8.253.131.111, 8. 252.238.254, 8.252.64.254, 8.2 50.103.254, 8.253.45.248, 209. 197.3.8 - Excluded domains from analysis
(whitelisted): www.bing.com, fg.download.windowsupdate.com. c.footprint.net, dual-a-0001.a -msedge.net, www-bing-com.dual -a-0001.a-msedge.net, tse1.mm. bing.net, ctldl.windowsupdate. com, cds.d2s7q6s2.hwcdn.net, a rc.msn.com, www-www.bing.com.t rafficmanager.net, wu-bg-shim. trafficmanager.net - Execution Graph export aborted
for target SecuriteInfo.com.n ot-a-virus.HEUR.RemoteAdmin.Wi n32.UltraVNC.gen.27745.639.exe , PID 1408 because there are n o executed function - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtAllocateVirtualMemor y calls found.
⊘No simulations
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.UltraVNC.gen.27745.639.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1407 |
| Entropy (8bit): | 5.135364793594814 |
| Encrypted: | false |
| SSDEEP: | 24:fJhFXNTxYgMaIUSlAdo9g9iWLseeZJI2/rCcXUOFarxbgc8Gy9AJu5U7gyzn:fJzr8LUUAdTkeeZW2/rCUUOoxMNR9i5z |
| MD5: | BDB8C36B2807B9D721C271417D925F09 |
| SHA1: | E6DD9833307357CEDF853E27ACED86E8A6C9CED3 |
| SHA-256: | 7979240101A8C6399A744855BA4DC97D426784659DF2281703F5BF9EFE389FB4 |
| SHA-512: | 6742763BCD2B3685D514801953D9324A3CA2D54FE26B2EE5CFB148A6940DA9B2A20BBBCCD3D804F79ED8080405AB87A6B1881443534035D072A1870BEC56B6CC |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.568545613343524 |
| TrID: |
|
| File name: | SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.UltraVNC.gen.27745.639.exe |
| File size: | 3'011'584 bytes |
| MD5: | eafba56f876c04229c33c88a0bd964fa |
| SHA1: | d34f886a895f190c8a2d1bf4e46cbf104358126c |
| SHA256: | 76c77a70b8ff02ec28049a28fdb538a5d663f548b48e9a449371edd4c414a15e |
| SHA512: | 80e3dc784a25d86a3a63032ab6f66e39484e3c480b4cc94dba2d63f0f9897ac1fcd86482f5c8b078639aba617e35d20c0938c6f58869f4bc4402bc8229d46b21 |
| SSDEEP: | 49152:AAOdl4d7NHNUb75uEEbOyYWHxL9X5zT/dRSAUA/J:Zl8DFWH1 |
| TLSH: | D9D55B16AA50989AD3A28474CD56CA76D7723C1D43F642F331E4BED73B3BA913A36301 |
| File Content Preview: | MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$...........Ad..Ad..Ad......Ld.......d......Sd..'.~.Nd......Rd......Md.......d......fd......Ld..Ad..Zd......@d..Ad..Tf......Zd.......d. |
 | |
| Icon Hash: | 499669d8d82916a8 |
| Entrypoint: | 0x140132ebc |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x643AC151 [Sat Apr 15 15:22:57 2023 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 310b1cc8abef97edfcabf0ed406947cf |
| Signature Valid: | |
| Signature Issuer: | |
| Signature Validation Error: | |
| Error Number: | |
| Not Before, Not After | |
| Subject Chain | |
| Version: | |
| Thumbprint MD5: | |
| Thumbprint SHA-1: | |
| Thumbprint SHA-256: | |
| Serial: |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007F1BB891FBE8h |
| dec eax |
| add esp, 28h |
| jmp 00007F1BB891F57Fh |
| int3 |
| int3 |
| dec eax |
| sub esp, 28h |
| dec ebp |
| mov eax, dword ptr [ecx+38h] |
| dec eax |
| mov ecx, edx |
| dec ecx |
| mov edx, ecx |
| call 00007F1BB891F712h |
| mov eax, 00000001h |
| dec eax |
| add esp, 28h |
| ret |
| int3 |
| int3 |
| int3 |
| inc eax |
| push ebx |
| inc ebp |
| mov ebx, dword ptr [eax] |
| dec eax |
| mov ebx, edx |
| inc ecx |
| and ebx, FFFFFFF8h |
| dec esp |
| mov ecx, ecx |
| inc ecx |
| test byte ptr [eax], 00000004h |
| dec esp |
| mov edx, ecx |
| je 00007F1BB891F715h |
| inc ecx |
| mov eax, dword ptr [eax+08h] |
| dec ebp |
| arpl word ptr [eax+04h], dx |
| neg eax |
| dec esp |
| add edx, ecx |
| dec eax |
| arpl ax, cx |
| dec esp |
| and edx, ecx |
| dec ecx |
| arpl bx, ax |
| dec edx |
| mov edx, dword ptr [eax+edx] |
| dec eax |
| mov eax, dword ptr [ebx+10h] |
| mov ecx, dword ptr [eax+08h] |
| dec eax |
| mov eax, dword ptr [ebx+08h] |
| test byte ptr [ecx+eax+03h], 0000000Fh |
| je 00007F1BB891F70Dh |
| movzx eax, byte ptr [ecx+eax+03h] |
| and eax, FFFFFFF0h |
| dec esp |
| add ecx, eax |
| dec esp |
| xor ecx, edx |
| dec ecx |
| mov ecx, ecx |
| pop ebx |
| jmp 00007F1BB891ED4Ah |
| int3 |
| dec eax |
| sub esp, 48h |
| dec eax |
| lea ecx, dword ptr [esp+20h] |
| call 00007F1BB891EA8Bh |
| dec eax |
| lea edx, dword ptr [000CF73Fh] |
| dec eax |
| lea ecx, dword ptr [esp+20h] |
| call 00007F1BB89219AAh |
| int3 |
| dec eax |
| sub esp, 48h |
| dec eax |
| lea ecx, dword ptr [esp+20h] |
| call 00007F1BB880166Bh |
| dec eax |
| lea edx, dword ptr [000CFA27h] |
| dec eax |
| lea ecx, dword ptr [eax+eax+00h] |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x202b00 | 0x4dc | .rdata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x202fdc | 0x118 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x2b2000 | 0xcabb4 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x2a5000 | 0xbb98 | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x2dcc00 | 0x27c8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x37d000 | 0x1240 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x1eb7a0 | 0x54 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x1eb980 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x1eb800 | 0x138 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x17a000 | 0xfa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x178a20 | 0x178c00 | False | 0.4302862682481752 | data | 6.547312417626284 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x17a000 | 0x8c2da | 0x8c400 | False | 0.23794180314171123 | data | 5.3447528842875185 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x207000 | 0x9d550 | 0x2200 | False | 0.20323988970588236 | DOS executable (block device driver \322f\324\377\3772) | 3.0315124359800243 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x2a5000 | 0xbb98 | 0xbc00 | False | 0.4939328457446808 | data | 6.225012673580742 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| _RDATA | 0x2b1000 | 0xf4 | 0x200 | False | 0.296875 | data | 2.416915977417612 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x2b2000 | 0xcabb4 | 0xcac00 | False | 0.3262537569358816 | data | 5.944617712006417 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x37d000 | 0x1240 | 0x1400 | False | 0.3951171875 | data | 5.258512641319918 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| AFX_DIALOG_LAYOUT | 0x2b31ec | 0x2 | data | English | United States | 5.0 |
| AFX_DIALOG_LAYOUT | 0x2b31f0 | 0x2 | data | English | United States | 5.0 |
| AFX_DIALOG_LAYOUT | 0x2b31f4 | 0x2 | data | English | United States | 5.0 |
| AFX_DIALOG_LAYOUT | 0x2b31f8 | 0x2 | data | English | United States | 5.0 |
| AFX_DIALOG_LAYOUT | 0x2b31fc | 0x2 | data | English | United States | 5.0 |
| AFX_DIALOG_LAYOUT | 0x2b3200 | 0x2 | data | English | United States | 5.0 |
| JAVAARCHIVE | 0x2b3204 | 0x120ed | Zip archive data, at least v2.0 to extract, compression method=deflate | English | United States | 0.9881836003515176 |
| JAVAARCHIVE | 0x2c52f4 | 0x120bf | Zip archive data, at least v2.0 to extract, compression method=deflate | Dutch | Belgium | 0.9881897752945792 |
| RT_CURSOR | 0x2d73b4 | 0x134 | data | English | United States | 0.3961038961038961 |
| RT_CURSOR | 0x2d74e8 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2d761c | 0xcac | data | English | United States | 0.016029593094944512 |
| RT_CURSOR | 0x2d82c8 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2d83fc | 0xcac | data | English | United States | 0.07860665844636251 |
| RT_CURSOR | 0x2d90a8 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2d91dc | 0xcac | data | English | United States | 0.07860665844636251 |
| RT_CURSOR | 0x2d9e88 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2d9fbc | 0xcac | data | English | United States | 0.06966707768187423 |
| RT_CURSOR | 0x2dac68 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2dad9c | 0xcac | data | English | United States | 0.07644882860665844 |
| RT_CURSOR | 0x2dba48 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2dbb7c | 0xcac | data | English | United States | 0.07644882860665844 |
| RT_CURSOR | 0x2dc828 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2dc95c | 0xcac | data | English | United States | 0.07706535141800247 |
| RT_CURSOR | 0x2dd608 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2dd73c | 0xcac | data | English | United States | 0.07274969173859433 |
| RT_CURSOR | 0x2de3e8 | 0x134 | Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001" | English | United States | 0.13636363636363635 |
| RT_CURSOR | 0x2de51c | 0xcac | data | English | United States | 0.0752157829839704 |
| RT_BITMAP | 0x2df1c8 | 0x3028 | Device independent bitmap graphic, 64 x 64 x 24, image size 12288, resolution 2835 x 2835 px/m | Dutch | Belgium | 0.004299156391953277 |
| RT_BITMAP | 0x2e21f0 | 0x328 | Device independent bitmap graphic, 16 x 16 x 24, image size 0, resolution 3779 x 3779 px/m | English | United States | 0.11386138613861387 |
| RT_BITMAP | 0x2e2518 | 0x328 | Device independent bitmap graphic, 16 x 16 x 24, image size 0, resolution 3779 x 3779 px/m | English | United States | 0.1150990099009901 |
| RT_BITMAP | 0x2e2840 | 0x328 | Device independent bitmap graphic, 16 x 16 x 24, image size 0, resolution 3779 x 3779 px/m | English | United States | 0.11262376237623763 |
| RT_BITMAP | 0x2e2b68 | 0x39c | Device independent bitmap graphic, 17 x 17 x 24, image size 0, resolution 3780 x 3780 px/m | Dutch | Belgium | 0.724025974025974 |
| RT_BITMAP | 0x2e2f04 | 0x39c | Device independent bitmap graphic, 17 x 17 x 24, image size 0, resolution 3780 x 3780 px/m | 0.7207792207792207 | ||
| RT_ICON | 0x2e32a0 | 0x1b8e | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | 0.9167848029486816 | ||
| RT_ICON | 0x2e4e30 | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 0 | 0.299390243902439 | ||
| RT_ICON | 0x2e5498 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | 0.478494623655914 | ||
| RT_ICON | 0x2e5780 | 0x1e8 | Device independent bitmap graphic, 24 x 48 x 4, image size 0 | 0.48155737704918034 | ||
| RT_ICON | 0x2e5968 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | 0.597972972972973 | ||
| RT_ICON | 0x2e5a90 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | Dutch | Belgium | 0.6095415778251599 |
| RT_ICON | 0x2e6938 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | Dutch | Belgium | 0.7540613718411552 |
| RT_ICON | 0x2e71e0 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | Dutch | Belgium | 0.7292626728110599 |
| RT_ICON | 0x2e78a8 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | Dutch | Belgium | 0.5267341040462428 |
| RT_ICON | 0x2e7e10 | 0x42028 | Device independent bitmap graphic, 256 x 512 x 32, image size 270336 | Dutch | Belgium | 0.13207533213007072 |
| RT_ICON | 0x329e38 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | Dutch | Belgium | 0.5340248962655602 |
| RT_ICON | 0x32c3e0 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | Dutch | Belgium | 0.649859287054409 |
| RT_ICON | 0x32d488 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | Dutch | Belgium | 0.7213114754098361 |
| RT_ICON | 0x32de10 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | Dutch | Belgium | 0.8147163120567376 |
| RT_ICON | 0x32e278 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | Dutch | Belgium | 0.6010127931769723 |
| RT_ICON | 0x32f120 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | Dutch | Belgium | 0.759927797833935 |
| RT_ICON | 0x32f9c8 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | Dutch | Belgium | 0.7695852534562212 |
| RT_ICON | 0x330090 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | Dutch | Belgium | 0.5397398843930635 |
| RT_ICON | 0x3305f8 | 0x42028 | Device independent bitmap graphic, 256 x 512 x 32, image size 270336 | Dutch | Belgium | 0.13159082167056246 |
| RT_ICON | 0x372620 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | Dutch | Belgium | 0.5381742738589211 |
| RT_ICON | 0x374bc8 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | Dutch | Belgium | 0.6515009380863039 |
| RT_ICON | 0x375c70 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | Dutch | Belgium | 0.7295081967213115 |
| RT_ICON | 0x3765f8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | Dutch | Belgium | 0.8138297872340425 |
| RT_MENU | 0x376a60 | 0x296 | Matlab v4 mat-file (little endian) &, numeric, rows 7602320, columns 6357106, imaginary | English | United States | 0.44108761329305135 |
| RT_MENU | 0x376cf8 | 0x68 | Matlab v4 mat-file (little endian) &, numeric, rows 7602320, columns 6357106, imaginary | English | United States | 0.8173076923076923 |
| RT_DIALOG | 0x376d60 | 0x2b4 | data | English | United States | 0.49710982658959535 |
| RT_DIALOG | 0x377014 | 0x608 | data | English | United States | 0.4378238341968912 |
| RT_DIALOG | 0x37761c | 0x636 | data | English | United States | 0.39119496855345914 |
| RT_DIALOG | 0x377c54 | 0x194 | data | English | United States | 0.5767326732673267 |
| RT_DIALOG | 0x377de8 | 0x26a | data | English | United States | 0.4854368932038835 |
| RT_DIALOG | 0x378054 | 0x174 | data | English | United States | 0.5860215053763441 |
| RT_DIALOG | 0x3781c8 | 0x22c | data | English | United States | 0.48381294964028776 |
| RT_DIALOG | 0x3783f4 | 0x532 | data | Dutch | Belgium | 0.37819548872180453 |
| RT_DIALOG | 0x378928 | 0x19ae | data | English | United States | 0.33799817462731974 |
| RT_DIALOG | 0x37a2d8 | 0x28a | data | English | United States | 0.44153846153846155 |
| RT_STRING | 0x37a564 | 0x174 | data | English | United States | 0.5080645161290323 |
| RT_STRING | 0x37a6d8 | 0x2a2 | Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0 | English | United States | 0.35756676557863504 |
| RT_STRING | 0x37a97c | 0x8d6 | data | English | United States | 0.268788682581786 |
| RT_STRING | 0x37b254 | 0x8c4 | data | English | United States | 0.3270944741532977 |
| RT_STRING | 0x37bb18 | 0x6fc | data | English | United States | 0.3529082774049217 |
| RT_GROUP_CURSOR | 0x37c214 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 1.0 |
| RT_GROUP_CURSOR | 0x37c238 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 1.0 |
| RT_GROUP_CURSOR | 0x37c25c | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 1.0 |
| RT_GROUP_CURSOR | 0x37c280 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 0.9411764705882353 |
| RT_GROUP_CURSOR | 0x37c2a4 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 1.0 |
| RT_GROUP_CURSOR | 0x37c2c8 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 1.0 |
| RT_GROUP_CURSOR | 0x37c2ec | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 1.0 |
| RT_GROUP_CURSOR | 0x37c310 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 1.0 |
| RT_GROUP_CURSOR | 0x37c334 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | English | United States | 1.0 |
| RT_GROUP_CURSOR | 0x37c358 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States | 1.25 |
| RT_GROUP_ICON | 0x37c36c | 0x4c | data | 0.75 | ||
| RT_GROUP_ICON | 0x37c3b8 | 0x84 | data | Dutch | Belgium | 0.6818181818181818 |
| RT_GROUP_ICON | 0x37c43c | 0x84 | data | Dutch | Belgium | 0.6742424242424242 |
| RT_VERSION | 0x37c4c0 | 0x36c | data | English | United States | 0.4417808219178082 |
| RT_MANIFEST | 0x37c82c | 0x387 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.40420819490586934 |
| DLL | Import |
|---|---|
| WS2_32.dll | setsockopt, getsockopt, WSAGetLastError, gethostbyname, inet_ntoa, htons, htonl, WSACleanup, __WSAFDIsSet, accept, bind, WSAIoctl, closesocket, select, shutdown, listen, WSAStartup, getpeername, inet_addr, getsockname, send, socket, connect, recv, ntohl, WSASendTo, gethostname |
| VERSION.dll | GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA |
| USERENV.dll | ExpandEnvironmentStringsForUserA, DestroyEnvironmentBlock, CreateEnvironmentBlock |
| KERNEL32.dll | WritePrivateProfileStringA, GetPrivateProfileStructA, GetPrivateProfileIntA, GetPrivateProfileStringA, WritePrivateProfileSectionA, CreateFileMappingA, Sleep, CreateThread, MulDiv, VerSetConditionMask, VerifyVersionInfoW, ReadFile, WriteFile, OutputDebugStringA, WaitForMultipleObjects, GetEnvironmentVariableA, WaitForSingleObject, CreateFileW, GetSystemDirectoryW, SetCurrentDirectoryA, lstrcatW, LoadLibraryW, SetFileAttributesA, CreateEventA, WaitNamedPipeW, GetExitCodeProcess, ResumeThread, ResetEvent, CompareFileTime, CreateFileA, GetFileSize, GetFileTime, GetStdHandle, WriteConsoleA, FreeConsole, FormatMessageA, AllocConsole, GetExitCodeThread, MoveFileA, GetDriveTypeA, SetFileTime, SetErrorMode, SetFilePointer, SetEndOfFile, GetFileAttributesA, MoveFileExA, FileTimeToSystemTime, GetLogicalDriveStringsA, SystemTimeToFileTime, CreateDirectoryA, GetSystemTime, FlushFileBuffers, TerminateProcess, VirtualAllocEx, ReadProcessMemory, SetThreadExecutionState, VirtualFreeEx, TerminateThread, SizeofResource, FindResourceA, LockResource, LoadResource, CreateMutexA, ReleaseMutex, GlobalGetAtomNameA, GlobalDeleteAtom, GetModuleHandleW, SetProcessShutdownParameters, WinExec, WritePrivateProfileStructA, HeapReAlloc, RaiseException, FreeLibraryAndExitThread, ExitThread, GetFullPathNameW, GetCurrentDirectoryW, SetCurrentDirectoryW, SetEnvironmentVariableW, GetCPInfo, SetStdHandle, SetFilePointerEx, ReadConsoleW, GetTimeZoneInformation, GetConsoleMode, GetConsoleOutputCP, GetModuleHandleExW, ExitProcess, SystemTimeToTzSpecificLocalTime, PeekNamedPipe, GetFileInformationByHandle, GetDriveTypeW, LoadLibraryExW, RtlUnwind, EncodePointer, RtlPcToFileHeader, RtlUnwindEx, OutputDebugStringW, InitializeSListHead, QueryPerformanceCounter, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, CreateSemaphoreA, TlsFree, TlsGetValue, TlsAlloc, GetCurrentThread, DuplicateHandle, SetThreadPriority, ReleaseSemaphore, TlsSetValue, InitializeConditionVariable, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableCS, SwitchToThread, GetFileType, lstrcatA, lstrcmpiA, lstrcpynA, DosDateTimeToFileTime, GetLocalTime, FileTimeToLocalFileTime, SetVolumeLabelA, LocalFileTimeToFileTime, GetVersion, GetLocaleInfoA, GetFullPathNameA, lstrcpyA, CompareStringW, LCMapStringW, GetLocaleInfoW, OpenProcess, FlsAlloc, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, DecodePointer, GetModuleFileNameW, GetStringTypeW, CreateDirectoryW, GetFileSizeEx, DeleteFileW, GetCurrentProcessId, WTSGetActiveConsoleSessionId, Process32FirstW, Process32Next, Process32NextW, GlobalAddAtomA, ProcessIdToSessionId, CreateToolhelp32Snapshot, Process32First, GetComputerNameA, GetSystemInfo, GetSystemDirectoryA, MapViewOfFile, OpenFileMappingA, UnmapViewOfFile, DeleteFileA, GetTempPathA, FindClose, FindNextFileA, FindFirstFileA, GetProcessTimes, GetSystemTimeAsFileTime, DeleteCriticalSection, GetModuleHandleA, InitializeCriticalSection, LeaveCriticalSection, GetCurrentProcess, EnterCriticalSection, CloseHandle, GetVersionExA, SetEvent, GetLastError, GetCurrentThreadId, OpenEventA, GetModuleFileNameA, GetTickCount, FreeLibrary, GetProcessHeap, GetProcAddress, HeapAlloc, InitializeCriticalSectionAndSpinCount, LoadLibraryA, lstrlenA, SetLastError, HeapFree, GlobalUnlock, WideCharToMultiByte, GlobalLock, GlobalFree, GetFileAttributesExW, GlobalAlloc, GlobalSize, MultiByteToWideChar, SetFileAttributesW, MoveFileExW, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, RemoveDirectoryW, HeapSize, WriteConsoleW, FlsGetValue, FlsSetValue, FlsFree, OpenThread, QueryPerformanceFrequency, LocalFree, SetThreadAffinityMask, InitializeCriticalSectionEx, GetVolumeInformationA |
| USER32.dll | GetSubMenu, SetMenuDefaultItem, DestroyMenu, TrackPopupMenuEx, RemoveMenu, EnableMenuItem, EnableWindow, GetWindow, VkKeyScanA, IsWindow, GetAsyncKeyState, MapVirtualKeyA, ToAscii, SendInput, SetClipboardViewer, GetClipboardOwner, WaitMessage, PostThreadMessageA, ChangeClipboardChain, SendNotifyMessageA, PeekMessageA, IsWindowVisible, LoadMenuA, GetIconInfo, GetClassNameA, WindowFromPoint, ChangeWindowMessageFilter, EnumDesktopWindows, SetRect, DrawIconEx, DestroyIcon, GetKeyboardState, mouse_event, PtInRect, MessageBeep, FlashWindow, EnumDisplaySettingsExA, EnumDisplayDevicesA, ChangeDisplaySettingsExA, GetKeyState, keybd_event, EnumDisplaySettingsA, EnumWindows, GetWindowLongA, SetWindowLongA, RedrawWindow, SetDlgItemInt, CheckDlgButton, GetDlgItemInt, IntersectRect, GetWindowRect, LoadStringA, ScreenToClient, GetScrollInfo, IsDlgButtonChecked, FillRect, MoveWindow, SetFocus, SendDlgItemMessageA, GetCursorPos, ExitWindowsEx, LockWorkStation, DrawIcon, SetLayeredWindowAttributes, UpdateWindow, InvalidateRect, GetMessageA, LoadImageA, DispatchMessageA, LoadCursorA, DestroyWindow, SetWindowPos, DrawTextA, SetWindowDisplayAffinity, AdjustWindowRect, DefWindowProcA, IsRectEmpty, CreateWindowExA, TranslateMessage, LoadIconA, GetClientRect, PostQuitMessage, RegisterClassExA, BeginPaint, EndPaint, wsprintfA, SystemParametersInfoA, GetWindowThreadProcessId, GetUserObjectInformationA, PostMessageA, RegisterWindowMessageA, FindWindowExA, OpenDesktopA, MessageBoxA, GetProcessWindowStation, FindWindowA, GetSystemMetrics, EndDialog, DialogBoxParamA, ShowWindow, GetDlgItemTextA, SetTimer, SetDlgItemTextA, SendMessageA, GetDlgItem, GetWindowLongPtrA, KillTimer, SetWindowLongPtrA, SetForegroundWindow, SetThreadDesktop, GetThreadDesktop, CloseDesktop, GetForegroundWindow, OpenInputDesktop, GetDesktopWindow, GetDC, ReleaseDC, OpenClipboard, CloseClipboard, EmptyClipboard, GetClipboardData, SetClipboardData, IsClipboardFormatAvailable, RegisterClipboardFormatA, GetTopWindow, OemToCharA, CharToOemA, wvsprintfA, SetWindowTextA |
| GDI32.dll | GetBitmapBits, SetDIBColorTable, GdiFlush, RealizePalette, SelectPalette, SetBkColor, CreateFontIndirectA, GetObjectA, ExtEscape, GetSystemPaletteEntries, DeleteObject, DeleteDC, GetPixel, GetDeviceCaps, GetDIBits, CreateCompatibleDC, CreateDIBSection, SelectObject, CreateCompatibleBitmap, BitBlt, CreateFontA, CreateDCA, CreateSolidBrush, Rectangle, CreatePen, SetBkMode, SetTextColor, GetClipBox, GetStockObject, StretchBlt, PatBlt, GetRgnBox, CombineRgn, PtInRegion, GetRegionData, CreateRectRgn, OffsetRgn, CreatePalette, SetRectRgn |
| ADVAPI32.dll | SetSecurityInfo, RegCreateKeyA, GetSecurityDescriptorSacl, SetSecurityDescriptorDacl, ConvertStringSecurityDescriptorToSecurityDescriptorA, SetSecurityDescriptorSacl, InitializeSecurityDescriptor, CreateServiceA, GetSecurityDescriptorLength, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorControl, GetSecurityDescriptorOwner, IsValidSid, IsValidSecurityDescriptor, GetKernelObjectSecurity, SetKernelObjectSecurity, IsValidAcl, AdjustTokenPrivileges, StartServiceCtrlDispatcherA, QueryServiceStatus, RegDeleteKeyA, SetTokenInformation, LookupPrivilegeValueA, SetServiceStatus, RegisterServiceCtrlHandlerA, DeleteService, DuplicateTokenEx, ImpersonateLoggedOnUser, EqualSid, AllocateAndInitializeSid, FreeSid, OpenProcessToken, RevertToSelf, CloseServiceHandle, OpenSCManagerA, GetUserNameA, LookupAccountSidA, OpenServiceA, GetTokenInformation, CreateProcessAsUserA, RegCloseKey, RegQueryValueExA, RegCreateKeyExA, RegSetValueExA, RegOpenKeyExA, RegDeleteValueA |
| SHELL32.dll | ShellExecuteA, SHGetMalloc, Shell_NotifyIconA, SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHFileOperationA, ShellExecuteExA |
| ole32.dll | CoInitialize, CoCreateInstance, CoUninitialize |
| SHLWAPI.dll | PathStripPathA |
| IMM32.dll | ImmGetDefaultIMEWnd |
| dwmapi.dll | DwmIsCompositionEnabled |
| IPHLPAPI.DLL | GetAdaptersInfo |
| Name | Ordinal | Address |
|---|---|---|
| adler32 | 1 | 0x1400d3270 |
| adler32_combine | 2 | 0x1400d3360 |
| adler32_z | 3 | 0x1400d3030 |
| compress | 4 | 0x1400d3490 |
| compress2 | 5 | 0x1400d3370 |
| compressBound | 6 | 0x1400d34b0 |
| crc32 | 7 | 0x1400cc320 |
| crc32_combine | 8 | 0x1400cc6b0 |
| crc32_final | 9 | 0x1400cc820 |
| crc32_init | 10 | 0x1400cc7b0 |
| crc32_update | 11 | 0x1400cc7f0 |
| crc32_z | 12 | 0x1400cc260 |
| deflate | 13 | 0x1400cfe30 |
| deflateBound | 14 | 0x1400cfc50 |
| deflateCopy | 15 | 0x1400d0ab0 |
| deflateEnd | 16 | 0x1400d09a0 |
| deflateGetDictionary | 17 | 0x1400cf4e0 |
| deflateInit2_ | 18 | 0x1400ceec0 |
| deflateInit_ | 19 | 0x1400cee80 |
| deflateParams | 20 | 0x1400cfa00 |
| deflatePending | 21 | 0x1400cf870 |
| deflatePrime | 22 | 0x1400cf8f0 |
| deflateReset | 23 | 0x1400cf720 |
| deflateResetKeep | 24 | 0x1400cf5b0 |
| deflateSetDictionary | 25 | 0x1400cf210 |
| deflateSetHeader | 26 | 0x1400cf810 |
| deflateTune | 27 | 0x1400cfbd0 |
| get_crc_table | 28 | 0x1400cc250 |
| inflate | 29 | 0x1400ccdc0 |
| inflateCodesUsed | 30 | 0x1400cedb0 |
| inflateCopy | 31 | 0x1400ceab0 |
| inflateEnd | 32 | 0x1400ce5d0 |
| inflateGetDictionary | 33 | 0x1400ce650 |
| inflateGetHeader | 34 | 0x1400ce7e0 |
| inflateInit2_ | 35 | 0x1400ccb20 |
| inflateInit_ | 36 | 0x1400ccc20 |
| inflateMark | 37 | 0x1400ced30 |
| inflatePrime | 38 | 0x1400ccc30 |
| inflateReset | 39 | 0x1400cc9c0 |
| inflateReset2 | 40 | 0x1400cca10 |
| inflateResetKeep | 41 | 0x1400cc910 |
| inflateSetDictionary | 42 | 0x1400ce700 |
| inflateSync | 43 | 0x1400ce8a0 |
| inflateSyncPoint | 44 | 0x1400cea60 |
| inflateUndermine | 45 | 0x1400cec90 |
| inflateValidate | 46 | 0x1400cece0 |
| uncompress | 47 | 0x1400d3010 |
| uncompress2 | 48 | 0x1400d2e70 |
| zError | 49 | 0x1400d3b90 |
| zlibCompileFlags | 50 | 0x1400d3b80 |
| zlibVersion | 51 | 0x1400d3b70 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
| Dutch | Belgium |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 17:39:05 |
| Start date: | 17/09/2023 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.UltraVNC.gen.27745.639.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff69ff60000 |
| File size: | 3'011'584 bytes |
| MD5 hash: | EAFBA56F876C04229C33C88A0BD964FA |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
⊘No disassembly
