Toolkit[.]zip | Triage

Resubmissions

27-11-2023 14:24

231127-rq2sxaha9z 8

27-11-2023 14:20

231127-rnfsnaha8v 7

Sharing

Copy URL

Twitter E-mail

General

Target

Toolkit.zip
Size

244.2MB
MD5

8171ae1ffadf3413b70e458bb9bd3261
SHA1

5f19afc55842408d995507d81d5656e46b871b2c
SHA256

35b0a6cc54e58f30ab84638d5b9b24b07ec4796ebf1a1e534ec0adcd0f4edf9f
SHA512

919f0ca40dafad97b18bab234f41b536f54aa3957c4673adabe861151e6b868d9620aa5d4e53b0a0f2a2474b9e715a5167230da3e787da5fa02e4496039f449f
SSDEEP

6291456:sM//b7cvHyXgFcsJ0hi87SYqIE2BIzpGV8EvOfnFTsd3BsiHF8:sMnUvSXgJ0hi82YqI292hv+nFTCRhu

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Toolkit/STEP 4 (Softwares)/2/Win_Icon_Pack.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Toolkit/STEP 3 (replacing the system files)/6/Themes/aero/aero.msstyles
unpack001/Toolkit/STEP 4 (Softwares)/1/ep_setup.exe
unpack001/Toolkit/STEP 4 (Softwares)/2/Win_Icon_Pack.exe
unpack002/out.upx
unpack001/Toolkit/STEP 4 (Softwares)/3/rectify.exe

Files

Toolkit.zip
.zip
Toolkit/STEP 1 (Fonts)/FluentSystemIcons-Filled.ttf
Toolkit/STEP 1 (Fonts)/FluentSystemIcons-Regular.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Display-Bold.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Display-Light.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Display-Semibold.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Display-Semilight.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Display.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Small-Bold.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Small-Light.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Small-Semibold.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Small-Semilight.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Small.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Text-Bold.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Text-Light.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Text-Semibold.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Text-Semilight.ttf
Toolkit/STEP 1 (Fonts)/Segoe-UI-Variable-Static-Text.ttf
Toolkit/STEP 1 (Fonts)/SegoeUI-VF.ttf
Toolkit/STEP 1 (Fonts)/segmdl2v2.ttf
Toolkit/STEP 1 (Fonts)/seguiemj.ttf
Toolkit/STEP 2 (Take ownership)/Add Take Ownership to Context menu.reg
Toolkit/STEP 3 (replacing the system files)/1/images/Apps.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/AppsRtl.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Contact.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/DefaultPinTile.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Devices.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/EaseOfAccess.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Extras.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Gaming.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Globe.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Holographic.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Lock.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Personalize.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/RestrictBackgroundData.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/Square71x71Logo.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/System.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-black.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-black_scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-black_scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-black_scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-black_scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-black_scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-white.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-white_scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-white_scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-white_scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-white_scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.contrast-white_scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TileSmall.scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TimeLanguage.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-black.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-black_scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-black_scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-black_scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-black_scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-black_scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-white.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-white_scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-white_scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-white_scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-white_scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.contrast-white_scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/TinyTile.scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/UpdateRestore.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.altform-unplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-black.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-black_scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-black_scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-black_scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-black_scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-black_scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-white.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-white_scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-white_scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-white_scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-white_scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.contrast-white_scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-100_altform-lightunplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-100_altform-unplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-125_altform-lightunplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-125_altform-unplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-150_altform-lightunplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-150_altform-unplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-200_altform-lightunplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-200_altform-unplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-400_altform-lightunplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/logo.scale-400_altform-unplated.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/phone.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-black.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-black_scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-black_scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-black_scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-black_scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-black_scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-white.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-white_scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-white_scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-white_scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-white_scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.contrast-white_scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.scale-100.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.scale-125.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.scale-150.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.scale-200.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/splashscreen.scale-400.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Apps.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.AppsRtl.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Contact.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.DefaultPinTile.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Devices.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.EaseOfAccess.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Extras.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Gaming.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Globe.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Holographic.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Lock.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.Personalize.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.RestrictBackgroundData.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.System.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.TimeLanguage.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.UpdateRestore.png
.png
Toolkit/STEP 3 (replacing the system files)/1/images/wide.phone.png
.png
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm01.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm02.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm03.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm04.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm05.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm06.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm07.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm08.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm09.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Alarm10.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Desktop.ini
Toolkit/STEP 3 (replacing the system files)/2/Media/Focus0_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/Focus1_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/Focus2_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/Focus3_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/Focus4_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/GoBack_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/Hide_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/Invoke_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/MoveNext_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/MovePrevious_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring01.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring02.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring03.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring04.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring05.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring06.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring07.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring08.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring09.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Ring10.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Show_48000Hz.raw
Toolkit/STEP 3 (replacing the system files)/2/Media/Speech Disambiguation.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Speech Misrecognition.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Speech Off.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Speech On.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Speech Sleep.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Background.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Balloon.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Battery Critical.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Battery Low.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Critical Stop.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Default.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Ding.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Error.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Exclamation.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Feed Discovered.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Foreground.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Hardware Fail.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Hardware Insert.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Hardware Remove.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Information Bar.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Logoff Sound.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Logon.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Menu Command.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Message Nudge.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Minimize.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Navigation Start.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Notify Calendar.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Notify Email.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Notify Messaging.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Notify System Generic.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Notify.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Pop-up Blocked.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Print complete.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Proximity Connection.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Proximity Notification.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Recycle.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Restore.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Ringin.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Ringout.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Shutdown.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Startup.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows Unlock.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/Windows User Account Control.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/chimes.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/chord.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/ding.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Background.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Foreground.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Hardware Fail.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Hardware Insert.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Hardware Remove.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Notify Calendar.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Notify Email.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Notify Messaging.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows Notify System Generic.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/dm/Windows User Account Control.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/flourish.mid
Toolkit/STEP 3 (replacing the system files)/2/Media/notify.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/onestop.mid
Toolkit/STEP 3 (replacing the system files)/2/Media/recycle.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/ringout.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/tada.wav
Toolkit/STEP 3 (replacing the system files)/2/Media/town.mid
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_1024x768.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_1200x1920.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_1366x768.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_1600x2560.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_1920x1200.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_2160x3840.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_2560x1600.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_3840x2160.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_768x1024.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img0_768x1366.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/4K/Wallpaper/Windows/img19_1920x1200.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Screen/img100.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Screen/img101.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Screen/img101.png
.png
Toolkit/STEP 3 (replacing the system files)/3/Web/Screen/img102.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Screen/img103.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Screen/img103.png
.png
Toolkit/STEP 3 (replacing the system files)/3/Web/Screen/img104.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Screen/img105.jpg
.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/Extended/Desktop.ini
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeA/Desktop.ini
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeA/img20.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeA/img21.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeA/img22.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeA/img23.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeB/Desktop.ini
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeB/img24.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeB/img25.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeB/img26.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeB/img27.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeC/Desktop.ini
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeC/img28.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeC/img29.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeC/img30.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeC/img31.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeD/Desktop.ini
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeD/img32.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeD/img33.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeD/img34.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/ThemeD/img35.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/Windows/img0.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/Windows/img19.jpg
Toolkit/STEP 3 (replacing the system files)/3/Web/Wallpaper/Windows/wp9139434-mac-os-big-sur-4k-wallpapers.jpg
.jpg
Toolkit/STEP 3 (replacing the system files)/4/bootres.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-09-2021 18:23

Not After

01-09-2022 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:b8:d1:74:ca:8d:a9:f5:3a:a4:43:9d:31:49:47:6c:79:c2:4b:b0:67:9a:0e:aa:f5:30:f9:bf:da:9b:78:98
Signer

Actual PE Digest

2f:b8:d1:74:ca:8d:a9:f5:3a:a4:43:9d:31:49:47:6c:79:c2:4b:b0:67:9a:0e:aa:f5:30:f9:bf:da:9b:78:98

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Toolkit/STEP 3 (replacing the system files)/5/User Account Pictures/guest.bmp
Toolkit/STEP 3 (replacing the system files)/5/User Account Pictures/guest.png
.png
Toolkit/STEP 3 (replacing the system files)/5/User Account Pictures/user-192.png
.png
Toolkit/STEP 3 (replacing the system files)/5/User Account Pictures/user-32.png
.png
Toolkit/STEP 3 (replacing the system files)/5/User Account Pictures/user-40.png
.png
Toolkit/STEP 3 (replacing the system files)/5/User Account Pictures/user-48.png
.png
Toolkit/STEP 3 (replacing the system files)/5/User Account Pictures/user.bmp
Toolkit/STEP 3 (replacing the system files)/5/User Account Pictures/user.png
.png
Toolkit/STEP 3 (replacing the system files)/6/Copy and run in run.txt
Toolkit/STEP 3 (replacing the system files)/6/Themes/ThemeTool.exe
.exe windows:6 windows x86 arch:x86

d9058d25db9f14861a0c89c72a77d8be

Code Sign

12:76:97:f2:09:ae:19:f0:de:c4:5a
Certificate

Issuer

CN=GLOBALTRUST 2020,O=e-commerce monitoring GmbH,C=AT

Not Before

16-02-2021 00:00

Not After

10-06-2040 00:00

Subject

CN=GLOBALTRUST 2020 CODESIGNING 1,O=e-commerce monitoring GmbH,C=AT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:39:eb:b2:b5:aa:b6:f1:9e:69:be
Certificate

Issuer

CN=GLOBALTRUST 2020 CODESIGNING 1,O=e-commerce monitoring GmbH,C=AT

Not Before

05-07-2023 15:14

Not After

08-07-2024 17:14

Subject

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:27:79:d7:43:a4:3a:a8:8d:ad:f3:90:ec:a6:71:ea:be:f9:34:72:df:29:5b:c2:e4:d4:a8:cc:e5:2a:61:8f
Signer

Actual PE Digest

bb:27:79:d7:43:a4:3a:a8:8d:ad:f3:90:ec:a6:71:ea:be:f9:34:72:df:29:5b:c2:e4:d4:a8:cc:e5:2a:61:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetFileSizeEx
WriteFile
Wow64DisableWow64FsRedirection
CreateFileW
OpenEventW
Wow64RevertWow64FsRedirection
DeleteFileW
GetNativeSystemInfo
GetProcAddress
MoveFileExW
GetModuleHandleW
VirtualProtect
LoadLibraryExW
GetFullPathNameW
SetFilePointer
GetFileSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetStringTypeW
SetStdHandle
FormatMessageW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
CloseHandle
GetCurrentProcess
SetLastError
DeleteCriticalSection
DecodePointer
InitializeCriticalSectionEx
GetLastError
LockResource
SizeofResource
LoadResource
LCMapStringW
HeapReAlloc
HeapSize
FindResourceW
GetFileType
HeapAlloc
HeapFree
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
EncodePointer
WriteConsoleW

user32

GetWindowRect
MonitorFromWindow
GetMonitorInfoW
CharLowerW
ShowWindow
GetMessageW
IsDialogMessageW
TranslateMessage
CreateDialogParamW
MessageBoxW
SetWindowPos
DispatchMessageW
SetWindowLongW
GetWindowLongW
DestroyWindow
EnableWindow
LoadImageW
GetDlgItem
ExitWindowsEx
SendMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
PostQuitMessage

advapi32

RegDeleteKeyValueW
GetTokenInformation
RegSetKeyValueW
RegCloseKey
RegDeleteKeyW
OpenProcessToken
RegGetValueW
RegCreateKeyW
LookupAccountSidW

ole32

CoInitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

comctl32

InitCommonControlsEx

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

ntdll

RtlInitUnicodeString
NtClose
NtRenameKey
RtlAdjustPrivilege
RtlNtStatusToDosError
RtlGetNtVersionNumbers
NtOpenSymbolicLinkObject
NtOpenKey
NtQuerySymbolicLinkObject

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Toolkit/STEP 3 (replacing the system files)/6/Themes/aero.theme
Toolkit/STEP 3 (replacing the system files)/6/Themes/aero/aero.msstyles
.dll windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 110B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Toolkit/STEP 3 (replacing the system files)/6/Themes/dark.theme
Toolkit/STEP 3 (replacing the system files)/6/Themes/themeA.theme
Toolkit/STEP 3 (replacing the system files)/6/Themes/themeB.theme
Toolkit/STEP 3 (replacing the system files)/6/Themes/themeC.theme
Toolkit/STEP 3 (replacing the system files)/6/Themes/themeD.theme
Toolkit/STEP 4 (Softwares)/1/ep_setup.exe
.exe windows:6 windows x64 arch:x64

d49bd0b9e00ddd48d6db53cb9d0d703f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcessTimes
GetExitCodeProcess
FindFirstFileW
SetLastError
WriteFile
RemoveDirectoryW
GetModuleFileNameW
FindClose
CreateThread
GetCurrentDirectoryW
GetProcAddress
FreeLibrary
CopyFileW
CreateSymbolicLinkW
MoveFileW
LoadLibraryExW
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
ReadConsoleW
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
GetModuleHandleW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
MultiByteToWideChar
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
CreateProcessW
GetCurrentProcessId
LocalFree
GetWindowsDirectoryW
K32EnumProcesses
FindResourceW
LoadResource
FreeConsole
CloseHandle
DeleteFileW
LockResource
GetLastError
Sleep
CreateEventW
OpenProcess
FreeResource
GetSystemDirectoryW
K32GetProcessImageFileNameW
GetCurrentThreadId
CreateFileW
LocalAlloc
WaitForSingleObject
TerminateProcess
GetCurrentProcess
GetFileSizeEx
SizeofResource
ReadFile
FreeEnvironmentStringsW
CreateDirectoryW
HeapFree
HeapAlloc
GetStdHandle
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

user32

LoadIconW
FindWindowW
TranslateMessage
wsprintfW
LoadCursorW
SetProcessDpiAwarenessContext
SendMessageTimeoutW
SendMessageW
LoadStringW
GetWindowThreadProcessId
GetMessageW
DefWindowProcW
MessageBoxW
CreateWindowExW
RegisterClassExW
DispatchMessageW
ExitWindowsEx

advapi32

RevertToSelf
EqualSid
AllocateAndInitializeSid
RegDeleteKeyValueW
RegCreateKeyExW
CreateProcessWithTokenW
ImpersonateLoggedOnUser
RegDeleteTreeW
RegSetValueExW
FreeSid
CheckTokenMembership
DuplicateTokenEx
RegOpenKeyW
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
OpenProcessToken
RegOpenKeyExW
RegGetValueW
CryptGetHashParam
RegQueryValueExW
CryptReleaseContext

shell32

Shell_NotifyIconW
SHGetFolderPathW
SHFileOperationW
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString

rstrtmgr

RmRegisterResources
RmGetList
RmStartSession
RmShutdown
RmEndSession
RmRestart

version

VerQueryValueW

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW

shlwapi

PathStripPathW
PathFileExistsW
PathRemoveFileSpecW
PathRemoveExtensionW

Exports

Exports

ZZLaunchExplorer
ZZLaunchExplorerDelayed
ZZRestartExplorer
ZZTestBalloon

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Toolkit/STEP 4 (Softwares)/2/Win_Icon_Pack.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 192KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Toolkit/STEP 4 (Softwares)/3/rectify.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 180.1MB - Virtual size: 180.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Toolkit/STEP 5 (Optional)/cursor/Install.inf
Toolkit/STEP 5 (Optional)/cursor/alternate.cur
Toolkit/STEP 5 (Optional)/cursor/beam.cur
Toolkit/STEP 5 (Optional)/cursor/busy.ani
Toolkit/STEP 5 (Optional)/cursor/dgn1.cur
Toolkit/STEP 5 (Optional)/cursor/dgn2.cur
Toolkit/STEP 5 (Optional)/cursor/handwriting.cur
Toolkit/STEP 5 (Optional)/cursor/help.cur
Toolkit/STEP 5 (Optional)/cursor/horz.cur
Toolkit/STEP 5 (Optional)/cursor/link.cur
Toolkit/STEP 5 (Optional)/cursor/move.cur
Toolkit/STEP 5 (Optional)/cursor/person.cur
Toolkit/STEP 5 (Optional)/cursor/pin.cur
Toolkit/STEP 5 (Optional)/cursor/pointer.cur
Toolkit/STEP 5 (Optional)/cursor/precision.cur
Toolkit/STEP 5 (Optional)/cursor/unavailable.cur
Toolkit/STEP 5 (Optional)/cursor/vert.cur
Toolkit/STEP 5 (Optional)/cursor/working.ani

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

2f:b8:d1:74:ca:8d:a9:f5:3a:a4:43:9d:31:49:47:6c:79:c2:4b:b0:67:9a:0e:aa:f5:30:f9:bf:da:9b:78:98Signer

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 4KB - Virtual size: 256B

.rsrc Size: 148KB - Virtual size: 146KB

d9058d25db9f14861a0c89c72a77d8be

Code Sign

12:76:97:f2:09:ae:19:f0:de:c4:5aCertificate

Extended Key Usages

Key Usages

74:39:eb:b2:b5:aa:b6:f1:9e:69:beCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

bb:27:79:d7:43:a4:3a:a8:8d:ad:f3:90:ec:a6:71:ea:be:f9:34:72:df:29:5b:c2:e4:d4:a8:cc:e5:2a:61:8fSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

comctl32

wtsapi32

ntdll

Sections

.text Size: 109KB - Virtual size: 108KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 2KB - Virtual size: 5KB

.rsrc Size: 101KB - Virtual size: 101KB

.reloc Size: 6KB - Virtual size: 5KB

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 8B

.data Size: - Virtual size: 808B

.rsrc Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 512B - Virtual size: 110B

d49bd0b9e00ddd48d6db53cb9d0d703f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

rstrtmgr

version

wininet

shlwapi

Exports

Exports

Sections

.text Size: 118KB - Virtual size: 118KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

2f:b8:d1:74:ca:8d:a9:f5:3a:a4:43:9d:31:49:47:6c:79:c2:4b:b0:67:9a:0e:aa:f5:30:f9:bf:da:9b:78:98
Signer

.rdata
Size: 4KB - Virtual size: 256B

.rsrc
Size: 148KB - Virtual size: 146KB

12:76:97:f2:09:ae:19:f0:de:c4:5a
Certificate

74:39:eb:b2:b5:aa:b6:f1:9e:69:be
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

bb:27:79:d7:43:a4:3a:a8:8d:ad:f3:90:ec:a6:71:ea:be:f9:34:72:df:29:5b:c2:e4:d4:a8:cc:e5:2a:61:8f
Signer

.text
Size: 109KB - Virtual size: 108KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 2KB - Virtual size: 5KB

.rsrc
Size: 101KB - Virtual size: 101KB

.reloc
Size: 6KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 8B

.data
Size: - Virtual size: 808B

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 512B - Virtual size: 110B

.text
Size: 118KB - Virtual size: 118KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 6KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 2KB - Virtual size: 1KB

UPX0
Size: - Virtual size: 192KB

UPX1
Size: 57KB - Virtual size: 60KB

.rsrc
Size: 75KB - Virtual size: 76KB

.text
Size: 69KB - Virtual size: 68KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 140KB - Virtual size: 140KB

.text
Size: 180.1MB - Virtual size: 180.1MB

.rsrc
Size: 54KB - Virtual size: 53KB