��k�d6U;銐0�����GäSZ]��oM���R��,"�'�n�`���|k�C�K��� F���4�}\y�WRdh �1�ɻ[unӅ0�냎8YT^O`�!�ɻ'@����?} ����P�_�7�%�K�� ��8�B>�.��� �m<�V��6<w�\D���/�N�gK���a���5�D��P������U6�a\j~H��y��4��w-;���<v��I.-�=�zF[:����vK��$���s;�e�1d��&R�Ka-���FB2U�M�L+,���G�#cx�K��Y��mQ�8C0���My������V�`�m�����IQ����u�����oe6p4���&s""ٲ\]Url'��-Z�6��ژ��}��;K���<Gy,�m��1�igF�ه�:g;��T��U�WC������>�h�e[�Kp��~��Ȝ?���ѵ��W��2l��ND�������'�I|[b�I�#�0�2�����R)�W.��*L2�q++:傐�|1Tz�\�����A@��ʰfZk<�_4�Ҧ9c�n� ~>,F���\P�jU�����"BFʭyf[���ݒ�N���>x�j��y�T��sY��#2�X�u��z�`,r_���b�Q,[������nV�����97pg�j)[�W������Iۋ6��`����I<.Di�yAE���Y �ŌS�(Ѳ�������=�ܞ�+���).H�<B������N��ƽ�����-� ���=*D�(� �^ ��z��^^��'b�]�BUB�t��8��X�¥�M����C��Ʉ��9P|ެ'���J�2o��7�6�2��?��}��!H�$��O�c�L$�i[C�w�w|��(����K(����U�F t\="�Y��X���.���[�L n�<Ȼ*F�TM;I5Lg4��Mo�؇���)��7&�ڞ��.(q�k�+�W�l���KOTk���؊���qtq�w�����Y��.� *��Ņ*S��L�aȴoM�_�����uJ� 橓��F@��K���_b$M��#N��t}k1\J:[��,ܻ�F��%��ݞ*Y�z9F�!u4�<�.y�n'�z�3���uU��9s���g���2j+�_�ƐEU�+~M�v�gHPw;��=�`����"ȉhl�+��E*>�C.�� ��O��S�����~zߖ5_?��qZ�|����E ��8����S�;Z��]z�çV����,mp�w�Sd���~:(�>�`{+!^n����|��)���$hKI�Όș"/�ZǛ��5HM�̧KTi��w�v�.�E1�k�6��T�s�s�������R�[Y5����8��Հ��q.^�fUTe|J*��At)���j�M)Ikl�2ѥ���#o�<��6Fh�z� �f(�\w;���"\cf!�#�s�.x�2m�)��C��im��j�!�y�i#z ���*�������l�k�Xd��/������.D����w[Z���t��wTp�N"�'0��a@�����C��+�����48�<ˉ�u�a uw|h#��:����,y~�A:#�WD�c���ð{'D�31aH�� ����#l�E����S`2��T��6,گ��dE�Hz�}V*����cɪO�s�f���H�ĺ=�$F��y]7(�hB��{=ȷCɜ�,���j j �������Sm70���rMLY�6oS�����UP���F�m�n�,����,L����'���r"0~�@��w��̠7�����7�[�3߽R�a����4��y��Ÿ)��o�O8�� �P[(�������kv��O?[�}�wm�maCUʭ'W6͖I&#��ߨ@X�*�`�N���V�A��hUIu�0���((��iUo����g큷�A۹~�70/jp�9!��*��|�j�`f���j���dj�)��2(�UFF��ueݴ>�)�tRU�8����1P�(�Oyf%����%&|��� +���x��!���F͞�����ɉ��w�*Y���F�e�y;d0�¹`��7��֧����G9�%M�����t��U=��B'S��/5�;���3���BoWwL����h��T,M����kR�`��_���<�� �>8'�&��퉘�:�5�N���:D >u�$��2=+��zZ�D��α�n�/2� ��Φ�[I$�$�����j�O����s@"��ay�չ9�`3�����lL&.��T/�O���xF��{BT��b��@ہ�̜,s�i.^p��n��m�܇�G/���@xs"ƶ9��܄ڊ�i=�S _��U��7B�څ=�2 ]V ��/��!��Wu��}�?;��xD�IP�}F��|�Cim�������:}��g H�Υ���ޢ�OU�q`@e�̟�Y�0-i��6I%�7��Su�4��_��'�oVD#z��gJU�Wh6�� ��%%z�9.M'������+���`AL5]�3?��k��϶��N���`a�+3�Ѷ�*�F�1!��B����~X�λ1n13V�����D���C�{�EA� �~���F�'��S�mzO�#1�1�9�B[�f���^o|�qm�O�<d�Ac#?�Q��w�l��x��q�Q�]1�;�LS¹ g(��"��f9��L#P;M�a�8|�#$Ǵ�Mr2P�#x�6��u�*j�/�@Q5�t!+~�{���E�J{H�9r��x5�HUͭ�ikS�41��/q���B/��Ba�%~��8(�̫2�.�i�d���נ�͕�'��7W0B圞f3i���Y3�h��T�������ň,����u�ZזD�0�)�O���9����Wt1=��k��-��|P\`\������j[H;�1�P������ˠC�oK(�)��R�=t}n����'ܝN���ѭ�����[�k!X֘h#�� ��A�V��c��"ڀLl�������M������~|�L@����g��8[�ys�Zx� �*&�������� ���:A�͢��>��h�3�Cՙ�I+�k]MYkoF��J�#�ɖ�({�|�2y�m,�
Static task
static1
Behavioral task
behavioral1
Sample
Nova pasta/Principal_1.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral2
Sample
Nova pasta/ProcMon/Procmon64.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
Nova pasta/Process_Hacker_-_Undetected.exe
Resource
win10v2004-20230915-en
General
-
Target
Nova pasta.rar
-
Size
27.4MB
-
MD5
0a086979bbfe58cd2332c2148df08e4b
-
SHA1
e395a96defae5381e9a8f11297ff6039d983efb8
-
SHA256
c17ba0ff3357d47d521f3e819595f6857e80a75c57f019fe28d72737aa15ba03
-
SHA512
6250e147f4d0750ea51676f8e71285b658b4e5c16da0fa41b1f8c5f4db4bf754e76f0b3b24e08e2efd30683a5b89c4d7fa5a57ca00cf42a24d49e30b224417a1
-
SSDEEP
786432:K7jie1o3J0gJxW+YX+Sdjq4MXQfhlRmhvH:CR1XgJxfYX+SJq7wYV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nova pasta/Principal_1.exe
Files
-
Nova pasta.rar.rar
-
Nova pasta/Principal_1.exe.exe windows:6 windows x64
2c7e8cfe9eb247b417652b28f6159d32
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerSetConditionMask
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord45
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_stat64
Exports
Exports
Sections
.text Size: - Virtual size: 423KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ziM Size: - Virtual size: 12.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.5^0 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.)=p Size: 15.0MB - Virtual size: 15.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Nova pasta/ProcMon/Eula.txt
-
Nova pasta/ProcMon/Procmon.exe.exe windows:6 windows x86
166e1e85a7db932839e06e3ddf6769df
Code Sign
33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate
IssuerCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/03/2023, 18:43Not After14/03/2024, 18:43SubjectCN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0e:90:d2:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before08/07/2011, 20:59Not After08/07/2026, 21:09SubjectCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
b1:83:c5:99:db:dc:9e:e6:be:77:37:5c:a1:5b:a4:bf:e8:c5:fa:a9:de:d6:39:df:5a:cd:4c:25:a8:03:9a:1eSigner
Actual PE Digestb1:83:c5:99:db:dc:9e:e6:be:77:37:5c:a1:5b:a4:bf:e8:c5:fa:a9:de:d6:39:df:5a:cd:4c:25:a8:03:9a:1eDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getsockname
listen
recv
send
closesocket
gethostbyname
WSAGetLastError
ntohs
WSAStartup
htonl
inet_addr
inet_ntoa
bind
connect
accept
htons
socket
gethostbyaddr
WSASetLastError
getservbyname
getservbyport
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
comctl32
ImageList_SetBkColor
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_GetImageCount
ImageList_DrawIndirect
CreateStatusWindowW
ImageList_SetOverlayImage
InitCommonControlsEx
ImageList_Add
ImageList_Draw
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Create
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy
fltlib
FilterSendMessage
FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort
kernel32
GetCurrentProcess
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetFileSize
SetFilePointer
CreateFileMappingW
UnmapViewOfFile
LoadLibraryExA
GetFullPathNameW
GlobalMemoryStatusEx
FreeResource
Sleep
CreateThread
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
InitializeCriticalSection
DeleteCriticalSection
ExpandEnvironmentStringsW
GetCurrentDirectoryW
SetFileAttributesW
GetSystemDirectoryW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
GetSystemInfo
RaiseException
InitializeCriticalSectionEx
GlobalAddAtomW
EnumResourceNamesW
CompareStringW
GetLocaleInfoW
lstrcmpW
lstrcmpiW
MultiByteToWideChar
SetEndOfFile
TryEnterCriticalSection
MapViewOfFile
FileTimeToLocalFileTime
LocalFileTimeToFileTime
ReadFile
FormatMessageW
FileTimeToSystemTime
SystemTimeToFileTime
GetDateFormatW
GetTimeFormatW
GetNumberFormatW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapCreate
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventW
WaitForMultipleObjects
CreateSemaphoreW
SetThreadPriority
GetComputerNameA
GetFileAttributesExW
DecodePointer
GetCurrentProcessId
SetProcessShutdownParameters
GetComputerNameW
SetConsoleCtrlHandler
OpenThread
GetSystemDirectoryA
TrySubmitThreadpoolCallback
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
WideCharToMultiByte
GetStringTypeW
LCMapStringEx
OpenProcess
CreateProcessW
TerminateProcess
ExitProcess
WaitForSingleObject
GetLastError
GetEnvironmentVariableW
VerifyVersionInfoW
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
GetCPInfo
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetConsoleCP
ExitThread
FreeLibraryAndExitThread
CreateRemoteThreadEx
GetThreadId
ResumeThread
GetCurrentThread
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
VerSetConditionMask
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileAttributesW
GlobalLock
GlobalUnlock
GlobalAlloc
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleW
GetFileType
GetCommandLineW
GetStdHandle
LoadLibraryExW
GetVersionExW
SetLastError
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
SetCurrentDirectoryW
InitializeSListHead
LCMapStringW
user32
GetKeyState
GetUpdateRect
GetUpdateRgn
ScrollWindowEx
IntersectRect
GetClassLongW
EqualRect
FlashWindowEx
LoadStringA
DrawEdge
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessagePos
PostQuitMessage
GetWindowPlacement
SetWindowPlacement
CheckRadioButton
CharLowerW
LoadAcceleratorsW
CreatePopupMenu
RemoveMenu
InsertMenuItemW
SetRectEmpty
ChildWindowFromPoint
FindWindowExW
FindWindowW
SetForegroundWindow
IsIconic
WaitForInputIdle
CreateIconFromResourceEx
GetDlgItemInt
GetActiveWindow
RegisterWindowMessageW
GetAsyncKeyState
SetWindowTextA
EnumChildWindows
UnionRect
GetPropW
SetPropW
DrawFrameControl
CheckMenuRadioItem
SetRect
WindowFromPoint
ClientToScreen
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
DeleteMenu
AppendMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
DestroyMenu
LoadMenuW
GetCapture
SetFocus
GetDlgCtrlID
SetDlgItemInt
CreateDialogParamW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetClassInfoExW
RegisterClassExW
UnregisterClassW
UnregisterHotKey
RegisterHotKey
TrackMouseEvent
MonitorFromPoint
IsDialogMessageW
MapWindowPoints
GetCursor
GetCursorPos
GetFocus
LoadStringW
LoadIconW
MessageBeep
SetActiveWindow
GetDesktopWindow
DialogBoxParamW
LoadImageW
GetWindow
MessageBoxW
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextW
DestroyWindow
IsWindow
GetWindowRect
SetDlgItemTextW
GetAncestor
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetScrollInfo
DrawIconEx
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
GetParent
SetClassLongW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
CopyRect
FrameRect
FillRect
DrawFocusRect
ScreenToClient
GetClientRect
GetForegroundWindow
SetMenuItemInfoW
SetMenuInfo
GetMenuInfo
ModifyMenuW
InsertMenuW
CheckMenuItem
GetMenuStringW
SetMenu
GetMenu
TranslateAcceleratorW
CharNextW
GetWindowTextLengthW
GetWindowTextW
ShowScrollBar
SetScrollPos
RedrawWindow
ValidateRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
DrawTextW
TrackPopupMenuEx
GetSystemMetrics
IsWindowEnabled
KillTimer
SetTimer
ReleaseCapture
SetCapture
IsZoomed
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
IsChild
CreateWindowExW
CallWindowProcW
IsMenu
GetIconInfo
GetWindowThreadProcessId
DefWindowProcW
PostMessageW
GetSysColor
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SendMessageW
SetScrollInfo
gdi32
RestoreDC
SetBrushOrgEx
SetPixel
PatBlt
SaveDC
SetROP2
GetPixel
ExcludeClipRect
CreatePatternBrush
CreateBitmap
SelectClipRgn
RectInRegion
GetBkMode
CreateRectRgnIndirect
SetBkMode
CreateRectRgn
GdiFlush
GetCurrentObject
CreateFontW
GetObjectW
GetBitmapBits
GetBkColor
CreateDIBSection
SetViewportOrgEx
Polyline
Polygon
ExtTextOutW
TextOutW
MoveToEx
GetTextMetricsW
SetMapMode
GetDeviceCaps
SetTextColor
SetBkColor
SelectObject
Rectangle
LineTo
GetTextExtentPoint32W
GetStockObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateSolidBrush
EndPage
StartPage
EndDoc
StartDocW
SetTextAlign
comdlg32
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
PrintDlgW
FindTextW
advapi32
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
ConvertStringSidToSidW
ConvertSidToStringSidW
RegSetValueW
RegEnumKeyW
LookupAccountSidW
MapGenericMask
GetTokenInformation
GetLengthSid
FreeSid
EqualSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegCreateKeyW
RegOpenKeyExW
RegOpenKeyW
RegCloseKey
shell32
SHGetSpecialFolderLocation
ShellExecuteW
SHGetPathFromIDListW
CommandLineToArgvW
SHChangeNotify
SHBrowseForFolderW
ExtractIconExW
SHGetMalloc
DragQueryFileW
ShellExecuteExW
SHGetFileInfoW
ole32
CoTaskMemFree
RegisterDragDrop
ReleaseStgMedium
CoTaskMemRealloc
OleUninitialize
CreateBindCtx
OleInitialize
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
oleaut32
SysFreeString
SysStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen
VarUI4FromStr
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayGetElement
shlwapi
SHAutoComplete
uxtheme
IsAppThemed
SetWindowTheme
IsThemeActive
dwmapi
DwmSetWindowAttribute
DwmDefWindowProc
ntdll
RtlGetVersion
Sections
.text Size: 867KB - Virtual size: 867KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 243KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Nova pasta/ProcMon/Procmon64.exe.exe windows:6 windows x64
381cf317942d96a51decedde64f16383
Code Sign
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4eCertificate
IssuerCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/03/2023, 18:43Not After14/03/2024, 18:43SubjectCN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0e:90:d2:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before08/07/2011, 20:59Not After08/07/2026, 21:09SubjectCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
09:01:98:91:5e:5b:6c:eb:79:53:b0:2f:b2:7a:0a:d0:01:36:fc:62:2b:6d:4d:28:2e:26:47:41:0f:89:db:7fSigner
Actual PE Digest09:01:98:91:5e:5b:6c:eb:79:53:b0:2f:b2:7a:0a:d0:01:36:fc:62:2b:6d:4d:28:2e:26:47:41:0f:89:db:7fDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
recv
listen
getsockname
send
socket
connect
WSAGetLastError
ntohs
WSAStartup
htonl
inet_addr
inet_ntoa
gethostbyaddr
getservbyport
getservbyname
closesocket
htons
bind
accept
gethostbyname
WSASetLastError
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
comctl32
ImageList_SetBkColor
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_GetImageCount
ImageList_DrawIndirect
CreateStatusWindowW
ImageList_SetOverlayImage
InitCommonControlsEx
ImageList_Add
ImageList_Draw
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Create
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy
fltlib
FilterSendMessage
FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort
kernel32
IsWow64Process
GetCurrentProcess
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetFileSize
SetFilePointer
CreateFileMappingW
UnmapViewOfFile
LoadLibraryExA
GetFullPathNameW
GlobalMemoryStatusEx
FreeResource
Sleep
CreateThread
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
InitializeCriticalSection
DeleteCriticalSection
ExpandEnvironmentStringsW
GetCurrentDirectoryW
SetFileAttributesW
GetSystemDirectoryW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
GetSystemInfo
RaiseException
InitializeCriticalSectionEx
GlobalAddAtomW
EnumResourceNamesW
SetCurrentDirectoryW
CompareStringW
GetLocaleInfoW
lstrcmpiW
MultiByteToWideChar
SetEndOfFile
TryEnterCriticalSection
MapViewOfFile
FileTimeToLocalFileTime
LocalFileTimeToFileTime
ReadFile
FormatMessageW
FileTimeToSystemTime
SystemTimeToFileTime
GetDateFormatW
GetTimeFormatW
GetNumberFormatW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapCreate
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventW
WaitForMultipleObjects
CreateSemaphoreW
SetThreadPriority
GetComputerNameA
GetFileAttributesExW
DecodePointer
GetCurrentProcessId
SetProcessShutdownParameters
GetComputerNameW
SetConsoleCtrlHandler
OpenThread
GetSystemDirectoryA
TrySubmitThreadpoolCallback
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
EncodePointer
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InterlockedPushEntrySList
WideCharToMultiByte
GetStringTypeW
LCMapStringEx
GetCPInfo
RtlPcToFileHeader
RtlUnwindEx
TlsAlloc
OpenProcess
CreateProcessW
TerminateProcess
ExitProcess
WaitForSingleObject
GetLastError
GetEnvironmentVariableW
VerifyVersionInfoW
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetModuleHandleExW
GetConsoleCP
ExitThread
FreeLibraryAndExitThread
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateRemoteThreadEx
GetThreadId
ResumeThread
GetCurrentThread
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
VerSetConditionMask
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileAttributesW
GlobalLock
GlobalUnlock
GlobalAlloc
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleW
GetFileType
GetCommandLineW
GetStdHandle
LoadLibraryExW
GetVersionExW
SetLastError
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
lstrcmpW
InterlockedPopEntrySList
LCMapStringW
user32
ScrollWindowEx
IntersectRect
GetClassLongPtrW
EqualRect
FlashWindowEx
LoadStringA
DrawEdge
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessagePos
PostQuitMessage
GetWindowPlacement
SetWindowPlacement
CheckRadioButton
CharLowerW
LoadAcceleratorsW
CreatePopupMenu
RemoveMenu
InsertMenuItemW
SetRectEmpty
ChildWindowFromPoint
TranslateAcceleratorW
CharNextW
IsMenu
GetWindowThreadProcessId
FindWindowExW
FindWindowW
SetForegroundWindow
IsIconic
WaitForInputIdle
CreateIconFromResourceEx
GetDlgItemInt
GetActiveWindow
RegisterWindowMessageW
GetAsyncKeyState
SetWindowTextA
EnumChildWindows
UnionRect
GetPropW
SetPropW
DrawFrameControl
CheckMenuRadioItem
SetRect
WindowFromPoint
ClientToScreen
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
DeleteMenu
AppendMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
DestroyMenu
LoadMenuW
GetCapture
SetFocus
GetDlgCtrlID
SetDlgItemInt
CreateDialogParamW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetClassInfoExW
RegisterClassExW
UnregisterClassW
UnregisterHotKey
RegisterHotKey
GetUpdateRgn
MonitorFromPoint
GetIconInfo
MapWindowPoints
GetCursor
GetCursorPos
GetFocus
LoadStringW
LoadIconW
MessageBeep
SetActiveWindow
GetDesktopWindow
DialogBoxParamW
LoadImageW
GetWindow
MessageBoxW
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextW
DestroyWindow
IsWindow
GetWindowRect
SetDlgItemTextW
GetAncestor
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
DrawIconEx
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
GetParent
SetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
GetUpdateRect
GetKeyState
IsDialogMessageW
GetForegroundWindow
SetMenuItemInfoW
SetMenuInfo
GetMenuInfo
ModifyMenuW
InsertMenuW
CheckMenuItem
GetMenuStringW
CopyRect
FrameRect
FillRect
DrawFocusRect
ScreenToClient
GetClientRect
GetWindowTextLengthW
GetWindowTextW
ShowScrollBar
SetScrollPos
RedrawWindow
ValidateRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
DrawTextW
TrackPopupMenuEx
GetSystemMetrics
IsWindowEnabled
KillTimer
SetTimer
ReleaseCapture
SetCapture
IsZoomed
IsWindowVisible
SetMenu
TrackMouseEvent
GetMenu
SetWindowPos
MoveWindow
ShowWindow
IsChild
CreateWindowExW
CallWindowProcW
DefWindowProcW
PostMessageW
GetSysColor
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SendMessageW
SystemParametersInfoW
gdi32
RestoreDC
SetBrushOrgEx
SetPixel
PatBlt
SaveDC
SetROP2
GetPixel
ExcludeClipRect
CreatePatternBrush
CreateBitmap
SelectClipRgn
RectInRegion
GetBkMode
CreateRectRgnIndirect
CreateRectRgn
GdiFlush
SetBkMode
GetCurrentObject
CreateFontW
GetObjectW
GetBitmapBits
GetBkColor
CreateDIBSection
SetViewportOrgEx
Polyline
Polygon
ExtTextOutW
TextOutW
MoveToEx
GetTextMetricsW
SetMapMode
GetDeviceCaps
SetTextColor
SetBkColor
SelectObject
Rectangle
LineTo
GetTextExtentPoint32W
GetStockObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateSolidBrush
EndPage
StartPage
EndDoc
StartDocW
SetTextAlign
comdlg32
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
PrintDlgW
FindTextW
advapi32
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
ConvertStringSidToSidW
ConvertSidToStringSidW
RegSetValueW
RegEnumKeyW
LookupAccountSidW
MapGenericMask
GetTokenInformation
GetLengthSid
FreeSid
EqualSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegCreateKeyW
RegOpenKeyExW
RegOpenKeyW
RegCloseKey
shell32
SHGetSpecialFolderLocation
ShellExecuteW
SHGetPathFromIDListW
CommandLineToArgvW
SHChangeNotify
SHBrowseForFolderW
ExtractIconExW
SHGetMalloc
DragQueryFileW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
ReleaseStgMedium
CreateBindCtx
CoInitializeEx
RegisterDragDrop
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
OleUninitialize
oleaut32
SysFreeString
SysStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen
VarUI4FromStr
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayGetElement
shlwapi
SHAutoComplete
uxtheme
IsThemeActive
IsAppThemed
SetWindowTheme
dwmapi
DwmSetWindowAttribute
DwmDefWindowProc
ntdll
RtlGetVersion
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sections
.text Size: 947KB - Virtual size: 947KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 311KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Nova pasta/ProcMon/Procmon64a.exe
-
Nova pasta/ProcMon/procmon.chm.chm
-
Nova pasta/Process_Hacker_-_Undetected.exe.exe windows:5 windows x86
Code Sign
7d:e6:61:e7:bb:da:51:bc:4d:35:6f:66:65:69:34:faCertificate
IssuerCN=MobileDENot Before29/06/2019, 20:37Not After31/12/2039, 23:59SubjectCN=MobileDEExtended Key Usages
ExtKeyUsageCodeSigning
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7d:e6:61:e7:bb:da:51:bc:4d:35:6f:66:65:69:34:faCertificate
IssuerCN=MobileDENot Before29/06/2019, 20:37Not After31/12/2039, 23:59SubjectCN=MobileDEExtended Key Usages
ExtKeyUsageCodeSigning
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
93:4f:69:e7:55:8e:b9:38:48:b3:1f:a6:4b:a4:f4:0f:3c:d6:dc:7c:d3:b0:a4:b8:15:5d:61:e7:f3:cc:a8:e8Signer
Actual PE Digest93:4f:69:e7:55:8e:b9:38:48:b3:1f:a6:4b:a4:f4:0f:3c:d6:dc:7c:d3:b0:a4:b8:15:5d:61:e7:f3:cc:a8:e8Digest Algorithmsha256PE Digest Matchestruee3:b5:d7:ef:e5:19:88:80:99:cc:6d:a9:57:33:d2:c5:19:41:41:4cSigner
Actual PE Digeste3:b5:d7:ef:e5:19:88:80:99:cc:6d:a9:57:33:d2:c5:19:41:41:4cDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 163KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 43KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.38rlqw Size: 7B - Virtual size: 7B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Zoi1JH Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE