General

Malware Config

Signatures

Files

• Use_15151_As_Passw0rd.rar

  .rar

  Password: 15151

• Language/WinRar.exe

  .exe windows x64

  Password: 15151

  629fae0a56e3262e208711dda6ae6b1d

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-06-2017 00:00

  Not After

  01-06-2020 23:59

  Subject

  CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  30-05-2000 10:48

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-06-2017 00:00

  Not After

  01-06-2020 23:59

  Subject

  CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  30-05-2000 10:48

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  ca:05:77:9a:83:94:f1:c2:84:3b:d1:35:92:02:9e:08:73:69:34:94:e8:62:49:32:6d:ca:10:c8:55:9e:d9:9b

  Signer

  Actual PE Digest

  ca:05:77:9a:83:94:f1:c2:84:3b:d1:35:92:02:9e:08:73:69:34:94:e8:62:49:32:6d:ca:10:c8:55:9e:d9:9b

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

  01-03-2019 08:23

  Valid: true

  Chain 1

  CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  ed:14:78:6d:47:d9:55:27:5a:d1:dd:f1:22:3e:ed:fc:47:98:f7:f9

  Signer

  Actual PE Digest

  ed:14:78:6d:47:d9:55:27:5a:d1:dd:f1:22:3e:ed:fc:47:98:f7:f9

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

  01-03-2019 08:23

  Valid: true

  Chain 1

  CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetLastError

  SetLastError

  GetCurrentProcess

  DeviceIoControl

  SetFileTime

  CloseHandle

  CreateDirectoryW

  RemoveDirectoryW

  CreateFileW

  DeleteFileW

  CreateHardLinkW

  GetShortPathNameW

  GetLongPathNameW

  MoveFileW

  GetFileType

  GetStdHandle

  WriteFile

  ReadFile

  FlushFileBuffers

  SetEndOfFile

  SetFilePointer

  SetFileAttributesW

  GetFileAttributesW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetVersionExW

  GetCurrentDirectoryW

  GetFullPathNameW

  FoldStringW

  GetModuleFileNameW

  GetModuleHandleW

  FindResourceW

  FreeLibrary

  GetProcAddress

  GetCurrentProcessId

  ExitProcess

  SetThreadExecutionState

  Sleep

  LoadLibraryW

  GetSystemDirectoryW

  CompareStringW

  AllocConsole

  FreeConsole

  AttachConsole

  WriteConsoleW

  GetProcessAffinityMask

  CreateThread

  SetThreadPriority

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  SetEvent

  ResetEvent

  ReleaseSemaphore

  WaitForSingleObject

  CreateEventW

  CreateSemaphoreW

  GetSystemTime

  SystemTimeToTzSpecificLocalTime

  TzSpecificLocalTimeToSystemTime

  SystemTimeToFileTime

  FileTimeToLocalFileTime

  LocalFileTimeToFileTime

  FileTimeToSystemTime

  GetCPInfo

  IsDBCSLeadByte

  MultiByteToWideChar

  WideCharToMultiByte

  GlobalAlloc

  GetTickCount

  LockResource

  GlobalLock

  GlobalUnlock

  GlobalFree

  LoadResource

  SizeofResource

  SetCurrentDirectoryW

  GetExitCodeProcess

  GetLocalTime

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingW

  OpenFileMappingW

  GetCommandLineW

  SetEnvironmentVariableW

  ExpandEnvironmentStringsW

  GetTempPathW

  MoveFileExW

  GetLocaleInfoW

  GetTimeFormatW

  GetDateFormatW

  GetNumberFormatW

  SetFilePointerEx

  GetConsoleMode

  GetConsoleCP

  HeapSize

  SetStdHandle

  GetProcessHeap

  FreeEnvironmentStringsW

  RaiseException

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  LoadLibraryExA

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlPcToFileHeader

  EncodePointer

  RtlUnwindEx

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  QueryPerformanceFrequency

  TerminateProcess

  GetModuleHandleExW

  GetModuleFileNameA

  GetACP

  HeapFree

  HeapAlloc

  HeapReAlloc

  GetStringTypeW

  LCMapStringW

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  gdiplus

  GdiplusShutdown

  GdiplusStartup

  GdipCreateHBITMAPFromBitmap

  GdipCreateBitmapFromStream

  GdipDisposeImage

  GdipCloneImage

  GdipFree

  GdipAlloc

  Sections

  .text

  Size: 203KB - Virtual size: 203KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 61KB - Virtual size: 60KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 136KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 208B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 152KB - Virtual size: 156KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Language/an.txt
• Language/ar.txt
• Language/az.txt
• Language/ba.txt
• Language/be.txt
• Language/bg.txt
• Language/bn.txt
• Language/ca.txt
• Language/co.txt
• Language/cs.txt
• Language/da.txt
• Language/de.txt
• Language/el.txt
• Language/eng.txt
• Language/es.txt
• Language/et.txt
• Language/eu.txt
• Language/ext.txt
• Language/fa.txt
• Language/fi.txt
• Language/fr.txt
• Language/fur.txt
• Language/fy.txt
• Language/ga.txt
• Language/gl.txt
• Language/gu.txt
• Language/he.pak
• Language/he.txt
• Language/hi.pak
• Language/hi.txt
• Language/hr.pak
• Language/hr.txt
• Language/hu.pak
• Language/hu.txt
• Language/hy.txt
• Language/id.txt
• Language/is.txt
• Language/it.txt
• Language/ja.txt
• Language/ka.txt
• Language/kaa.txt
• Language/kab.txt
• Language/kk.txt
• Language/ko.txt
• Language/ku-ckb.txt
• Language/ky.txt
• Language/lij.txt
• Language/lt.txt
• Language/mk.txt
• Language/mn.txt
• Language/mng.txt
• Language/mng2.txt
• Language/mr.txt
• Language/ne.txt
• Language/nl.txt
• Language/pa-in.txt
• Language/pl.txt
• Language/ps.txt
• Language/pt-br.txt
• Language/pt.txt
• Language/ro.txt
• Language/ru.txt
• Language/sa.txt
• Language/si.txt
• Language/sk.txt
• Language/sl.txt
• Language/sr-spc.txt
• Language/sr-spl.txt
• Language/sv.txt
• Language/sw.txt
• Language/ta.txt
• Language/tg.txt
• Language/th.txt
• Language/tk.txt
• Language/tr.txt
• Language/tt.txt
• Language/ug.txt
• Language/uk.txt
• Language/uz-cyrl.txt
• Language/uz.txt
• Language/va.txt
• Language/vi.txt
• Language/yo.txt
• Language/zh-cn.txt
• Language/zh-tw.txt
• Locals/am.pak
• Locals/ar.pak
• Locals/fi.pak
• Locals/fil.pak
• Locals/fr.pak
• Locals/gu.pak
• Locals/he.pak
• Locals/hi.pak
• Locals/hr.pak
• Locals/hu.pak
• Locals/id.pak
• Locals/lt.pak
• Locals/lv.pak
• Setup.exe

  .exe windows x86

  Password: 15151

  161839a78ef6f07a30d3f07895f6fe23

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrlenA

  LocalAlloc

  CheckRemoteDebuggerPresent

  CreateFileW

  GetProcAddress

  LoadLibraryA

  GetSystemTimeAsFileTime

  GetModuleHandleA

  CreateEventA

  GetModuleFileNameW

  TerminateProcess

  GetCurrentProcess

  CreateToolhelp32Snapshot

  Thread32First

  GetCurrentProcessId

  GetCurrentThreadId

  OpenThread

  Thread32Next

  CloseHandle

  SuspendThread

  ResumeThread

  WriteProcessMemory

  GetSystemInfo

  VirtualAlloc

  VirtualProtect

  VirtualFree

  GetProcessAffinityMask

  SetProcessAffinityMask

  GetCurrentThread

  SetThreadAffinityMask

  Sleep

  LoadLibraryA

  FreeLibrary

  GetTickCount

  SystemTimeToFileTime

  FileTimeToSystemTime

  GlobalFree

  LocalAlloc

  LocalFree

  GetProcAddress

  ExitProcess

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  GetModuleHandleW

  LoadResource

  MultiByteToWideChar

  FindResourceExW

  FindResourceExA

  WideCharToMultiByte

  GetThreadLocale

  GetUserDefaultLCID

  GetSystemDefaultLCID

  EnumResourceNamesA

  EnumResourceNamesW

  EnumResourceLanguagesA

  EnumResourceLanguagesW

  EnumResourceTypesA

  EnumResourceTypesW

  CreateFileW

  LoadLibraryW

  GetLastError

  FlushFileBuffers

  WriteConsoleW

  SetStdHandle

  IsProcessorFeaturePresent

  DecodePointer

  GetCommandLineA

  RaiseException

  HeapFree

  GetCPInfo

  InterlockedIncrement

  InterlockedDecrement

  GetACP

  GetOEMCP

  IsValidCodePage

  EncodePointer

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  HeapAlloc

  LCMapStringW

  GetStringTypeW

  SetHandleCount

  GetStdHandle

  InitializeCriticalSectionAndSpinCount

  GetFileType

  GetStartupInfoW

  GetModuleFileNameA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  HeapCreate

  HeapDestroy

  QueryPerformanceCounter

  HeapSize

  WriteFile

  RtlUnwind

  SetFilePointer

  GetConsoleCP

  GetConsoleMode

  HeapReAlloc

  VirtualQuery

  LocalAlloc

  LocalFree

  GetModuleFileNameW

  ExitProcess

  LoadLibraryA

  GetModuleHandleA

  GetProcAddress

  user32

  DestroyWindow

  CharUpperBuffW

  gdi32

  GetObjectW

  ole32

  CoDecodeProxy

  CoInitialize

  Exports

  Exports

  ��E�[��5/�疪�gT�ϒ�M M'O�������!�x��������%��.�GJ�g��19s�����hFB/$�7񝊰� Ƃ"�A��������?PO�k�D���j��zj)w_�YCQG��u*@��b),����<t��_I�2��g��hZ��2�ԑ ��;D/��ѐ�^�<�D�.jjC��, �=��H�?� i~Jc3�?�7�^#��j�t1����8�O��u�7��ND���o�[X ��>Y*��A�V�J��l��
  /�����CN�E����� [�����E�dJ�(�\Rr��Q��n��o\����H.��ؗ�t�)a+���T�y��"l������aRb�*�����@7�P5����\��#R�-748��ӪT�y�V�B��1*f�]�$����2q ��o ����^!?�/h�24 �Cq��ި��b����A��J=ZC(H>��]}���Q�*�5��؍� P�c����苈�-�_��Nno{E~��كG��jA�@�Z�DB&�yI�T7F�Nƃ�¸�� �>� N,����EG�����.�ɑ��ˀ��/������#���4����'�(se� ��Tr�� �>E$1��;<���?�q�ǿ��2����jp���`��(�E����x�y����9S�i�ӯ�;h`o���e ���Ъ�"�������3!T& ;����`&^C&X�4��=��;\k| �[���sʛ3꾪��� ,SOȍ�k��;��2�v�^L+�� d��B�V?~�� �f�B�ڢ�?rh!az��(HT1 ���5���R��8�ނ��pi⫁?��t�w�Y�m��
  g\��'��+��E%���5�T�n�()Fl*��9������\�g��<�de7����^�"���1���2� <�opEDx��%��sm���b���a��`"�;l�&�Y�g6�TJ~����I�p�4���(:2az/`'��6�343���4v�=7=m��[�,S�dR�r���3Y�j�N@y�~��g�$q�2���WH����o�%SI�('�.[P`��u���)�"]�Yꃃ¢U`�=8hz|���Jv"8�,��|�;��ӂV����h�X��ڪ���I�S��[#��Ŭ��6�K�ک�꾗�%�|l�b6����r����V�jd��.����%��r#���F�����V�d��A��SDe�2�:���w��w��A�c�E�?���'�yu%AHwL�G�!2�)��b7��;a��;���C�����
  #E�fj�Qd㺆3��n�����#��.w�(����7�yPqW����lD�&�����m ����r�|�{��vV��3�N0����4��C�A�!-�Hor���L �2!%��{B��ۡ�^Q|��Qhۦ�<DeF��Y?H�� ��J��|A�����U/:�z�SfI]o�g������[�����=Gsm�f��Akz���,y��޴�_/��0��?e!��c�������Q�k��xd��M���Ħ5�M�]�P�P伂�=<>��;�Ep���~��E���q����^tD6\��GԛW����I&�tU��8�Y�I��0<c6ت}r���0�A?���@��?ۥ`Gh�o٢N�=��MRCr���7��M�J\O,"�������s��R�ec+�K!�+o �á��7fԈVk��yf�Y�$#�S<4X'�����LY�Q��<v�>�h��8<$C�����hp{э2��P����4�����6E��U�f�$ ���\V�l��sJ�*���14���-a���>X����m���`�������I���;+���h�����
  ��U[|�+�mѝ� � ���!���ŷHu^z_~�X7*Uk�o�ͺ?q�f.���~uE�ȔBĠQ�_zb�*9P)�g`� 8��W��Jj]hN3��J�E�f�������W��ߴ��v���v.[{�&N�Y������."K�_�m�o�1�
  :���u�����ݑY/d!ӻ=��������=jt��e8�����Th�i-or3M� ��+]m츳�T �B���X�\��[X��Yy��2��\��iP �|C:�,��0P�@oB���Ni�OrE�=�-�Y�M����:��ss���p�$ �Ю�Tz �J���3>��9�nڷ���c�˼��H��;o#� �G���/���e�'5�ƙ���3� ̥cp�����Eڕ��{�C%a�9ʧ�ޙ{��s?w����[���
  iB-Ҧ,��}�3ֽ^E����'��wƞ)}\5�4|�޹ޚ�k_�-@�e5�D1�����%�JmT�nSh�M�ZM�=iQ� �����u�c���[��G��� �;�)>S�C�ѧ���F���f��p�� �P�;���>�v:�Aɀ1��;�}6|o���I7��f�3Qv�Y1lWXGٷ�*��W��������TT+��]����0����(��o�Q�?��9��ܴ]p~�������Q�3g���-��Wz��,0�iR�}d��j�X� J����av�?Ɐ��>�w���;թK. ��)�3��m��o�G�f���z���&��pB��|姺��I������?K˰���O>��K%H/�������^��ۣ��ayW��kr>%� ���Y4#���iRTt�9��Bt&��^je-5%����k 1Uj���4���U���>s�U�-����Z-���U,�� �JИ�w�Mu�������f�Ca���R�M�9aږ,��&]�� m�r>Y�7u+������1�^Z�E�l^{�^ X��;�
  d9K�Ҝr�1o����2ե��%AXW> ٺ����<�.U���hd�qX�+fi����v�҂�ߤ�Py$-��`�j�c�2u��k�H�7P��Wm N�G�D!�(�~Fk������Ro4��Zc�r%E�%��)G�Hx�9�b-���������uJ� ������Vk���N/M�W~�����(�q7��-n[Z��.�-T/��rbb�Oj����.�TQN@M�/3m
  � v�넦ͅ

  Sections

  .text

  Size: - Virtual size: 94KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .A+<

  Size: - Virtual size: 4.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .7}N

  Size: 1024B - Virtual size: 896B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .O)r

  Size: 6.7MB - Virtual size: 6.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 306KB - Virtual size: 305KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• en-US/AutoWorkplaceN.dll.mui

  .dll windows x86

  Password: 15151

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .rsrc

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• en-US/avicap32.dll.mui

  .dll windows x86

  Password: 15151

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .rsrc

  Size: 7KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• fonts/8514sys.fon
• fonts/dosapp.fon
• fonts/smalle.fon
• fonts/symbol.ttf
• fonts/trebucbd.ttf
• fonts/trebucbi.ttf
• fonts/verdana.ttf
• fonts/verdanab.ttf
• resources.pak
• vcomp140.dll

  .dll windows x64

  Password: 15151

  b0dceb96b51d2648c4e665c9ec09b163

  
  

  Code Sign

  33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-12-2020 21:31

  Not After

  02-12-2021 21:31

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  6a:4d:9a:15:91:5d:9b:49:c6:84:93:9f:70:a4:88:da:bc:33:e6:9b:eb:78:5a:02:74:0d:26:6e:d7:b5:21:23

  Signer

  Actual PE Digest

  6a:4d:9a:15:91:5d:9b:49:c6:84:93:9f:70:a4:88:da:bc:33:e6:9b:eb:78:5a:02:74:0d:26:6e:d7:b5:21:23

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  20-02-2023 17:39

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  FormatMessageW

  OutputDebugStringW

  LocalAlloc

  LocalFree

  GetConsoleWindow

  GetConsoleScreenBufferInfo

  WriteConsoleW

  WideCharToMultiByte

  WriteFile

  GetLastError

  GetCurrentThreadId

  HeapFree

  GetProcessHeap

  UnhandledExceptionFilter

  CloseHandle

  WaitForSingleObjectEx

  SetEvent

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  HeapAlloc

  TryEnterCriticalSection

  QueryPerformanceCounter

  InitializeCriticalSectionAndSpinCount

  GetTickCount

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  Sleep

  SwitchToThread

  ExitProcess

  GetStdHandle

  CreateThread

  QueueUserWorkItem

  CreateEventW

  LoadLibraryExW

  FreeLibrary

  GetProcAddress

  VirtualAlloc

  GetModuleHandleW

  VirtualProtect

  VirtualFree

  GetNativeSystemInfo

  QueryPerformanceFrequency

  GetSystemTimeAdjustment

  GetEnvironmentVariableW

  lstrlenW

  lstrcmpiW

  GetStringTypeExW

  ResetEvent

  GetCurrentProcess

  EncodePointer

  DecodePointer

  GetUserDefaultUILanguage

  FindFirstFileW

  FindNextFileW

  FindClose

  GetModuleFileNameW

  FindResourceExW

  LoadResource

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  RtlUnwindEx

  SetLastError

  IsDebuggerPresent

  GetModuleHandleExW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  MultiByteToWideChar

  LCMapStringW

  SetFilePointerEx

  GetStringTypeW

  SetStdHandle

  FlushFileBuffers

  GetConsoleOutputCP

  GetConsoleMode

  RaiseException

  CreateFileW

  RtlPcToFileHeader

  Exports

  Exports

  C2VectParallel

  _vcomp_atomic_add_i1

  _vcomp_atomic_add_i2

  _vcomp_atomic_add_i4

  _vcomp_atomic_add_i8

  _vcomp_atomic_add_r4

  _vcomp_atomic_add_r8

  _vcomp_atomic_and_i1

  _vcomp_atomic_and_i2

  _vcomp_atomic_and_i4

  _vcomp_atomic_and_i8

  _vcomp_atomic_div_i1

  _vcomp_atomic_div_i2

  _vcomp_atomic_div_i4

  _vcomp_atomic_div_i8

  _vcomp_atomic_div_r4

  _vcomp_atomic_div_r8

  _vcomp_atomic_div_ui1

  _vcomp_atomic_div_ui2

  _vcomp_atomic_div_ui4

  _vcomp_atomic_div_ui8

  _vcomp_atomic_mul_i1

  _vcomp_atomic_mul_i2

  _vcomp_atomic_mul_i4

  _vcomp_atomic_mul_i8

  _vcomp_atomic_mul_r4

  _vcomp_atomic_mul_r8

  _vcomp_atomic_or_i1

  _vcomp_atomic_or_i2

  _vcomp_atomic_or_i4

  _vcomp_atomic_or_i8

  _vcomp_atomic_shl_i1

  _vcomp_atomic_shl_i2

  _vcomp_atomic_shl_i4

  _vcomp_atomic_shl_i8

  _vcomp_atomic_shr_i1

  _vcomp_atomic_shr_i2

  _vcomp_atomic_shr_i4

  _vcomp_atomic_shr_i8

  _vcomp_atomic_shr_ui1

  _vcomp_atomic_shr_ui2

  _vcomp_atomic_shr_ui4

  _vcomp_atomic_shr_ui8

  _vcomp_atomic_sub_i1

  _vcomp_atomic_sub_i2

  _vcomp_atomic_sub_i4

  _vcomp_atomic_sub_i8

  _vcomp_atomic_sub_r4

  _vcomp_atomic_sub_r8

  _vcomp_atomic_xor_i1

  _vcomp_atomic_xor_i2

  _vcomp_atomic_xor_i4

  _vcomp_atomic_xor_i8

  _vcomp_barrier

  _vcomp_copyprivate_broadcast

  _vcomp_copyprivate_receive

  _vcomp_enter_critsect

  _vcomp_flush

  _vcomp_for_dynamic_init

  _vcomp_for_dynamic_init_i8

  _vcomp_for_dynamic_next

  _vcomp_for_dynamic_next_i8

  _vcomp_for_static_end

  _vcomp_for_static_init

  _vcomp_for_static_init_i8

  _vcomp_for_static_simple_init

  _vcomp_for_static_simple_init_i8

  _vcomp_fork

  _vcomp_get_thread_num

  _vcomp_leave_critsect

  _vcomp_master_barrier

  _vcomp_master_begin

  _vcomp_master_end

  _vcomp_ordered_begin

  _vcomp_ordered_end

  _vcomp_ordered_loop_end

  _vcomp_reduction_i1

  _vcomp_reduction_i2

  _vcomp_reduction_i4

  _vcomp_reduction_i8

  _vcomp_reduction_r4

  _vcomp_reduction_r8

  _vcomp_reduction_u1

  _vcomp_reduction_u2

  _vcomp_reduction_u4

  _vcomp_reduction_u8

  _vcomp_sections_init

  _vcomp_sections_next

  _vcomp_set_num_threads

  _vcomp_single_begin

  _vcomp_single_end

  omp_destroy_lock

  omp_destroy_nest_lock

  omp_get_dynamic

  omp_get_max_threads

  omp_get_nested

  omp_get_num_procs

  omp_get_num_threads

  omp_get_thread_num

  omp_get_wtick

  omp_get_wtime

  omp_in_parallel

  omp_init_lock

  omp_init_nest_lock

  omp_set_dynamic

  omp_set_lock

  omp_set_nest_lock

  omp_set_nested

  omp_set_num_threads

  omp_test_lock

  omp_test_nest_lock

  omp_unset_lock

  omp_unset_nest_lock

  Sections

  .text

  Size: 101KB - Virtual size: 100KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 49KB - Virtual size: 49KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• vcruntime140.dll

  .dll windows x64

  Password: 15151

  44c3854843f7a3fccdf8ddbbea66f302

  
  

  Code Sign

  33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-12-2020 21:31

  Not After

  02-12-2021 21:31

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  f7:83:e8:fe:9b:12:41:fc:30:39:3a:38:a0:12:16:d8:7c:73:43:56:72:48:ca:1e:25:f6:f1:cb:95:e8:ff:06

  Signer

  Actual PE Digest

  f7:83:e8:fe:9b:12:41:fc:30:39:3a:38:a0:12:16:d8:7c:73:43:56:72:48:ca:1e:25:f6:f1:cb:95:e8:ff:06

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  20-02-2023 17:39

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  api-ms-win-crt-runtime-l1-1-0

  terminate

  abort

  api-ms-win-crt-heap-l1-1-0

  calloc

  malloc

  free

  api-ms-win-crt-string-l1-1-0

  strcpy_s

  strncmp

  wcsncmp

  api-ms-win-crt-stdio-l1-1-0

  __stdio_common_vsprintf_s

  api-ms-win-crt-convert-l1-1-0

  atol

  kernel32

  SetLastError

  IsProcessorFeaturePresent

  TerminateProcess

  GetCurrentProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlCaptureContext

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  RtlLookupFunctionEntry

  RtlUnwindEx

  GetModuleHandleW

  RtlUnwind

  EncodePointer

  RaiseException

  RtlPcToFileHeader

  InterlockedPushEntrySList

  InterlockedFlushSList

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  GetLastError

  LoadLibraryExW

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  GetModuleFileNameW

  Exports

  Exports

  _CreateFrameInfo

  _CxxThrowException

  _FindAndUnlinkFrame

  _IsExceptionObjectToBeDestroyed

  _SetWinRTOutOfMemoryExceptionCallback

  __AdjustPointer

  __BuildCatchObject

  __BuildCatchObjectHelper

  __C_specific_handler

  __C_specific_handler_noexcept

  __CxxDetectRethrow

  __CxxExceptionFilter

  __CxxFrameHandler

  __CxxFrameHandler2

  __CxxFrameHandler3

  __CxxQueryExceptionSize

  __CxxRegisterExceptionObject

  __CxxUnregisterExceptionObject

  __DestructExceptionObject

  __FrameUnwindFilter

  __GetPlatformExceptionInfo

  __NLG_Dispatch2

  __NLG_Return2

  __RTCastToVoid

  __RTDynamicCast

  __RTtypeid

  __TypeMatch

  __current_exception

  __current_exception_context

  __intrinsic_setjmp

  __intrinsic_setjmpex

  __processing_throw

  __report_gsfailure

  __std_exception_copy

  __std_exception_destroy

  __std_terminate

  __std_type_info_compare

  __std_type_info_destroy_list

  __std_type_info_hash

  __std_type_info_name

  __telemetry_main_invoke_trigger

  __telemetry_main_return_trigger

  __unDName

  __unDNameEx

  __uncaught_exception

  __uncaught_exceptions

  __vcrt_GetModuleFileNameW

  __vcrt_GetModuleHandleW

  __vcrt_InitializeCriticalSectionEx

  __vcrt_LoadLibraryExW

  _get_purecall_handler

  _get_unexpected

  _is_exception_typeof

  _local_unwind

  _purecall

  _set_purecall_handler

  _set_se_translator

  longjmp

  memchr

  memcmp

  memcpy

  memmove

  memset

  set_unexpected

  strchr

  strrchr

  strstr

  unexpected

  wcschr

  wcsrchr

  wcsstr

  Sections

  .text

  Size: 62KB - Virtual size: 62KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1016B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 416B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• win-api.config

  .xml