dsE1122.rar
- SHA256 441116d55e97124a067207bf57483dd3462bccfb034e56c4152675b0dcb118e7
Overview
overview
10Static
static
700FAEE82AB...AD.exe
windows7-x64
100B8E9BC319...20.exe
windows7-x64
100c9fa52ace...7a.exe
windows7-x64
715f7ea290d...8c.exe
windows7-x64
101DD70E8036...25.exe
windows7-x64
101E229029B2...DA.exe
windows7-x64
1021977fc851...61.exe
windows7-x64
1021e1bc4340...01.exe
windows7-x64
72272954a2c...5a.exe
windows7-x64
102C3542B5D9...85.exe
windows7-x64
73ac7f91e37...38.exe
windows7-x64
103c0fe521f6...16.exe
windows7-x64
1041c53e90f0...4a.exe
windows7-x64
10467c2b23b7...be.exe
windows7-x64
105b79b6a814...b0.exe
windows7-x64
10712affaa8b...1).exe
windows7-x64
172716d15ea...21.exe
windows7-x64
78b04af13b7...21.exe
windows7-x64
10Bit Paymer.exe
windows7-x64
10KeepCalm.exe
windows7-x64
1LockedIn.exe
windows7-x64
1Purge.exe
windows7-x64
1Scarab.exe
windows7-x64
10a631ad1b1a...4b.exe
windows7-x64
6a9053a3a52...bc.exe
windows7-x64
7b764629e1f...1c.exe
windows7-x64
10cf89f70633...5c.exe
windows7-x64
1e951e82867...50.exe
windows7-x64
1fa0c321e1a...d2.exe
windows7-x64
9fc184274ad...27.exe
windows7-x64
10Behavioral task
behavioral1
Sample
00FAEE82AB5B800CF6DBE97AFD39790B856AD1EC25DC7ED8F798ACA702BEE7AD.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
0B8E9BC31964C9433BD5CC20E556CFD0590C3B17B0DB23CDC3AD0547683F3820.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral5
Sample
1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
1E229029B2D3FF00EDDE061B1AAF470EE437FA8196D97FAD2C2C6C9EDE5B44DA.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral7
Sample
21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061.exe
Resource
win7-20240215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
2272954a2c9f631b4f9c5f6d230287b0989ab3b512bb5f4a282214eadf42085a.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral12
Sample
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral14
Sample
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral15
Sample
5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0.exe
Resource
win7-20240220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral16
Sample
712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
Bit Paymer.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral20
Sample
KeepCalm.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
LockedIn.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Purge.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Scarab.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral24
Sample
a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
b764629e1f43851daf984c9372422b65ddceae28f83d6211873f4c8f8672c41c.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
cf89f70633865aa06123062a7dc51f8158905afb4b00f6f3597de3edfba97c5c.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
e951e82867a4f3af5a34b714571e9acf99cca794c4ed1895c9025a642d5d4350.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral30
Sample
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
General
- Target dsE1122.rar
- Size 14.2MB
- Sample240316-slqqhsde8t
- SHA256 441116d55e97124a067207bf57483dd3462bccfb034e56c4152675b0dcb118e7
- MD5 394f07bca7aaedfe23ad7dc24a68520b
- SHA1 e17adcc112d1d0ea8f71aedbdae528de4ed5c4fc
- SHA512 4834610ae95493a7e51e1493bf8c48e8e2bf8905d0b61af4b685c2b822ef22a78c9fd6cbbb188b20436a71f19972d9ebd211ccf0e75fc542d19f9340781c7eb3
- SSDEEP 393216:jBSYPG3rPQ2PUtOd37WjqC6tZ0ksxVmESyOcG7b/ZuHvWpbYqc7p:jQYyPDP2E0qCoZhLESyOf/YHvWOld
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe aspack_v212_v242 - Unsigned PE 30 IoCs
Checks for missing Authenticode signature.
resource unpack001/00FAEE82AB5B800CF6DBE97AFD39790B856AD1EC25DC7ED8F798ACA702BEE7AD.exe unpack001/0B8E9BC31964C9433BD5CC20E556CFD0590C3B17B0DB23CDC3AD0547683F3820.exe unpack001/0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a.exe unpack001/15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe unpack001/1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe unpack001/1E229029B2D3FF00EDDE061B1AAF470EE437FA8196D97FAD2C2C6C9EDE5B44DA.exe unpack001/21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061.exe unpack001/21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01.exe unpack001/2272954a2c9f631b4f9c5f6d230287b0989ab3b512bb5f4a282214eadf42085a.exe unpack001/2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe unpack001/3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338.exe unpack001/3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe unpack001/41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe unpack001/467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe unpack001/5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0.exe unpack001/712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe unpack001/72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe unpack001/8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe unpack001/Bit Paymer.exe unpack001/KeepCalm.exe unpack001/LockedIn.exe unpack001/Purge.exe unpack001/Scarab.exe unpack001/a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe unpack001/a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe unpack001/b764629e1f43851daf984c9372422b65ddceae28f83d6211873f4c8f8672c41c.exe unpack001/cf89f70633865aa06123062a7dc51f8158905afb4b00f6f3597de3edfba97c5c.exe unpack001/e951e82867a4f3af5a34b714571e9acf99cca794c4ed1895c9025a642d5d4350.exe unpack001/fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe unpack001/fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
File Explorer
-
dsE1122.rar.rar 14.2MB
-
00FAEE82AB5B800CF6DBE97AFD39790B856AD1EC25DC7ED8F798ACA702BEE7AD.exe.exe 1.3MB
-
0B8E9BC31964C9433BD5CC20E556CFD0590C3B17B0DB23CDC3AD0547683F3820.exe.exe 2.0MB
-
0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a.exe.exe 596KB
-
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe.exe 473KB
-
1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe.exe 716KB
-
1E229029B2D3FF00EDDE061B1AAF470EE437FA8196D97FAD2C2C6C9EDE5B44DA.exe.exe 1.9MB
-
21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061.exe.exe 235KB
-
21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01.exe.exe 708KB
-
2272954a2c9f631b4f9c5f6d230287b0989ab3b512bb5f4a282214eadf42085a.exe.exe 299KB
-
2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe.exe 10KB
-
3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338.exe.exe 390KB
-
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe.exe 947KB
-
41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe.exe 27KB
-
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe.exe 363KB
-
5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0.exe.exe 236KB
-
712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe.exe 1.7MB
-
72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe.exe 703KB
-
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe.exe 1020KB
-
Bit Paymer.exe.exe 92KB
-
KeepCalm.exe.exe 218KB
-
LockedIn.exe.exe 650KB
-
Purge.exe.exe 24KB
-
Scarab.exe.exe 342KB
-
a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe.exe 272KB
-
a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe.exe 703KB
-
b764629e1f43851daf984c9372422b65ddceae28f83d6211873f4c8f8672c41c.exe.exe 3.6MB
-
cf89f70633865aa06123062a7dc51f8158905afb4b00f6f3597de3edfba97c5c.exe.exe 322KB
-
e951e82867a4f3af5a34b714571e9acf99cca794c4ed1895c9025a642d5d4350.exe.exe 2.2MB
-
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe.exe 121KB
-
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe.exe 268KB
00FAEE82AB5B800CF6DBE97AFD39790B856AD1EC25DC7ED8F798ACA702BEE7AD.exe
- IMPHASH 79b3362178937bf9559741c46bb9e035
- SHA256 00faee82ab5b800cf6dbe97afd39790b856ad1ec25dc7ed8f798aca702bee7ad
- MD5 b53d9a3861ba2e66a83ed1827aef11c8
- SHA1 e3d021ae61b901fc0e375269aeea8a956b5d170a
- SHA512 c7478893531fbaf674dc90b404dada8ffefba4dfa2209063061a3c30df7992e3d95a9b5aa598ef2e5b6730fa961e44d15b70f5ea2075859ed8dfc528b1b5f434
- SSDEEP 24576:jnbkBTLZO5z2gux4qXrNuN6zZkMPPX47Ypk2z364swWUpZKfO+fIQ:jIBTL8HPq7NS6tY7Uzps6pZcfn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2158705
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
Name
.
Size
1.3MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
0B8E9BC31964C9433BD5CC20E556CFD0590C3B17B0DB23CDC3AD0547683F3820.exe
- IMPHASH 59d096c737d7e50445f5ef26a4c4324c
- SHA256 0b8e9bc31964c9433bd5cc20e556cfd0590c3b17b0db23cdc3ad0547683f3820
- MD5 e32ef8a36b6a6c010b27a7871ebda037
- SHA1 0ea7d9bf90c5fc6bfadaf3c14e140fc9c9aa5361
- SHA512 e98f941c7be2c650de033048b8a9d4556da2204f9b0c90d399c981dcb9e215d5322a765884aad1a4e5b31b23227827cb21fd1ed5d3a79cc7f83226c07f579eb3
- SSDEEP 49152:pdGNHxQXLx6cHqNQDQg6nNw1WCj/vd2Xptvh4:pd0QXL/t
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualAlloc
GetUserDefaultLCID
user32
GetMessageTime
Name
.text
Size
676KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a
- MD5 922b22f3be97b5974e317c5b55b07d15
- SHA1 96eef7001f9b555ac686a640e43a38cfbd963c4a
- SHA512 33a93de5d7e3927d3dd750dac4e12f9be5384ac2d5edbf8d5947708bdf18a7542e9fde3fb3dd526cd00e1973b18eb20b2793fe517469c831a39f7a5917d08179
- SSDEEP 12288:zbiqlq3Z3wSGTjDPOnpLWGJFFQgKzL+EFHUNrkqJgtK2b:zbNgd1wOpLWGF5C+EF0+qJgtZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
616130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
594KB
Virtual Size
593KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe
- IMPHASH 44f25d61c956e0f747f8bf2a72d8b614
- SHA256 15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c
- MD5 aadb6e0f1cc845e196570e800380fe85
- SHA1 72b088cf546c36b6dda67cfb430874f83645397f
- SHA512 55ba8c4734b9fb1c08b3c0be3c6c524a265aa1d3dc4a9f3a2f97f172c2913fc66ea7a002ad877d786e03db54b0a35f3244e9230c49fb30c6c6284404cffaf1b7
- SSDEEP 6144:ULIaDW2Dm6jNkcZjvw6RQVe0yV4JMaT710E5BmutiO3XwGk/Rz+wLefC9rB6uN:XaiajeUjvw6RQHVJMau43XwG25NW4rd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15828
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoCreateGuid
CoInitialize
CLSIDFromString
CoCreateInstance
CoUninitialize
CoFreeUnusedLibraries
CoTaskMemFree
oleaut32
VariantInit
VarBstrCmp
SysFreeString
SysAllocString
VariantClear
VariantChangeType
OleCreatePropertyFrame
SysStringLen
user32
GetMessagePos
ReleaseDC
GetMenuCheckMarkDimensions
InvalidateRect
IsWindowEnabled
DrawTextExW
SetCursor
SetFocus
GetDesktopWindow
IsRectEmpty
GetMessageTime
RemovePropW
SetActiveWindow
GetSystemMetrics
SetPropW
PtInRect
SetForegroundWindow
EnableWindow
GetMenu
CreatePopupMenu
GetFocus
GetSysColorBrush
KillTimer
GetClassInfoExW
GetClassInfoW
GetSubMenu
IsDialogMessageW
RealChildWindowFromPoint
SetMenuItemInfoW
IsWindowVisible
LoadCursorW
PeekMessageW
GrayStringW
SetWindowTextW
GetDlgCtrlID
GetForegroundWindow
GetDC
SendDlgItemMessageA
EndDialog
GetWindowThreadProcessId
CopyRect
SetWindowPos
GetMessageW
GetSysColor
DispatchMessageW
ClientToScreen
BeginPaint
CharToOemA
GetWindowRect
SetTimer
ValidateRect
CheckMenuItem
InflateRect
EqualRect
GetDlgItem
TrackPopupMenu
RegisterClassW
SetWindowsHookExW
GetWindow
ShowWindow
SetRect
GetNextDlgTabItem
GetCapture
GetParent
MessageBoxW
ScreenToClient
GetMenuItemID
MonitorFromWindow
GetClientRect
GetKeyState
GetPropW
MapWindowPoints
GetTopWindow
DestroyIcon
GetClassNameW
IntersectRect
GetLastActivePopup
UpdateWindow
GetClassLongW
GetMenuItemCount
GetWindowTextLengthW
RegisterWindowMessageW
LoadIconW
CharUpperW
EndPaint
GetWindowLongW
GetCursorPos
EnableMenuItem
PostQuitMessage
LoadBitmapW
DestroyMenu
AdjustWindowRectEx
IsWindow
CreateWindowExW
shlwapi
PathIsUNCW
PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW
gdi32
CloseFigure
DeleteObject
ScaleWindowExtEx
CreatePen
SetViewportOrgEx
GetClipBox
SetBkColor
ScaleViewportExtEx
SetViewportExtEx
CreateBitmap
SetMapMode
OffsetViewportOrgEx
SetTextColor
BeginPath
SetWindowExtEx
Escape
SaveDC
GetTextExtentPoint32W
SelectObject
SetBkMode
TranslateCharsetInfo
GetStockObject
AbortPath
RestoreDC
advapi32
RegEnumKeyW
RegCloseKey
RegCreateKeyW
RegQueryValueW
RegSetValueW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
winspool.drv
ExtDeviceMode
kernel32
IsDBCSLeadByte
SizeofResource
FindResourceW
DuplicateHandle
GetFileSize
CreateEventW
IsDBCSLeadByteEx
RemoveDirectoryW
GlobalReAlloc
SetEndOfFile
SwitchToThread
LockFile
GetModuleFileNameW
DeleteTimerQueueTimer
GlobalAddAtomW
SetStdHandle
TlsGetValue
SetThreadPriority
ReadFile
QueryPerformanceCounter
GlobalLock
OutputDebugStringA
GlobalUnlock
LocalFree
SetFileAttributesW
FileTimeToSystemTime
LocalReAlloc
FindFirstChangeNotificationW
HeapReAlloc
GetShortPathNameW
GetLongPathNameW
FindCloseChangeNotification
GetFileTime
CreateDirectoryW
GetStringTypeW
GlobalFree
SetLastError
GetSystemDirectoryW
CloseHandle
FreeEnvironmentStringsW
GetPrivateProfileStringW
GetCPInfo
DeleteCriticalSection
GetProcessHeap
GetEnvironmentStringsW
UnlockFile
LoadLibraryW
DeleteFileW
InitializeSListHead
MoveFileW
GetUserDefaultLCID
SystemTimeToFileTime
LocalAlloc
GetModuleHandleExW
GetStdHandle
GetVolumeInformationW
EnterCriticalSection
GetProcAddress
GetThreadPriority
GetFileAttributesExW
WriteFile
GlobalAlloc
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetCommandLineA
GetCurrentProcess
OutputDebugStringW
TlsSetValue
GetSystemDefaultUILanguage
AreFileApisANSI
LoadLibraryA
SetFileTime
GlobalHandle
GetLastError
InitializeCriticalSection
ExitProcess
FormatMessageW
VirtualProtect
HeapFree
GlobalFlags
GetACP
SetThreadAffinityMask
LockResource
GetLocaleInfoW
CreateTimerQueue
VirtualFree
EnumSystemLocalesW
CreateFileW
GetFileType
GetFileAttributesW
GetConsoleCP
GetFullPathNameW
FreeResource
GetModuleFileNameA
GetProcessAffinityMask
RaiseException
SignalObjectAndWait
HeapSize
InitializeCriticalSectionAndSpinCount
HeapAlloc
MulDiv
FindNextFileW
IsDebuggerPresent
lstrcmpA
WriteConsoleW
WaitForSingleObjectEx
lstrcmpW
GetThreadTimes
GetCurrentThreadId
GetCurrentThread
ReadConsoleW
TlsFree
LeaveCriticalSection
FindClose
WaitForSingleObject
GetModuleHandleW
InterlockedIncrement
SetUnhandledExceptionFilter
LCMapStringW
WritePrivateProfileStringW
FindFirstFileW
LoadResource
Sleep
GetFileSizeEx
CreateThread
CreateTimerQueueTimer
GetModuleHandleA
SetEvent
SetFilePointer
shell32
SHSetUnreadMailCountW
SHExtractIconsW
ShellExecuteW
DoEnvironmentSubstW
Name
.text
Size
73KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
232KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
1024B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe
- SHA256 1dd70e803623d5311b71129976710b11a8942d206a5d8d86cdf8417255f15725
- MD5 cc3f68e8a50b05aa77d88b6119583b9e
- SHA1 71c7b93a8947265fe30e6928730504a5456ca788
- SHA512 e4fe7c8ec1d88c0bc81834de0a1212902849d7c9f6228e26fb8aaf3f046011f934d6de01becb339ab88169533ff8dc0d6fad7d6d7ff7e956e408242a21809e55
- SSDEEP 12288:ZMMpXKb0hNGh1kG0HWnAsaHy41Dxm1zRRaMMMMM2MMMMMu:ZMMpXS0hN0V0HYah1I1zRRaMMMMM2MMd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
475137
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
154KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
2KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
1E229029B2D3FF00EDDE061B1AAF470EE437FA8196D97FAD2C2C6C9EDE5B44DA.exe
- IMPHASH dbc1055db78e0eb7de5de4fbdef168b4
- SHA256 1e229029b2d3ff00edde061b1aaf470ee437fa8196d97fad2c2c6c9ede5b44da
- MD5 92318a59ed03b2d195a8d08befd0efbb
- SHA1 33c974d620ceede52581194ef99f3f57a9cd5d11
- SHA512 ea57ebd9484ade992b5b7b1b1a43b84b5af37491b063de0718e3ae6897fa84f500194dc251f117d11a1361f3164eea11becddb394e697400b7eb1ea40c568230
- SSDEEP 24576:TAlFsCeXap8KGLTg/6PeXTAg6L+Gzt0DkyYz1/oM5i7eXTXbQ5MTjrp2WHa/1jlE:kICe+cmxj4LlWoB/oeDfF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcess
VirtualAlloc
user32
GetClipboardOwner
GetOpenClipboardWindow
Name
.
Size
676KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.
Size
10KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=98, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=114, version=50727,
count=16, id=149, version=30718,
count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=27, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=204, version=65501,
count=11, id=93, version=2179,
21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061.exe
- IMPHASH 1fc1ca157c798a8f3ee2422fc024e5e2
- SHA256 21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061
- MD5 fac89802b3db89ba74cf8891824af3d6
- SHA1 27b57dfdc8b1b265e3755cc0068be846c4c4981e
- SHA512 2c604a00446fe4901341a4c8093443cba06fc00ee90a946749c3b66b2205339850740406edd0553ef55a33573599c7e494eb1b0552395d1cd9e54a8d4268b3e5
- SSDEEP 3072:thrQ6J0Exp7gW31x+S/EkuIDNGqLW4t5P0tz/aMgb2JpL7Ag0FujYWkcv23nNT3I:tiHgpR31kS8kuIpW60tRPAOs3sc8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
44931
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetDriveTypeW
GetLastError
WriteConsoleW
HeapSize
CreateFileW
WinExec
SetStdHandle
FindClose
lstrcpynA
ExitProcess
GetCurrentProcessorNumber
GetLocalTime
OpenMutexA
Sleep
CreateMutexA
GetCurrentThreadId
ReadConsoleW
FindNextFileA
ExpandEnvironmentStringsW
FindFirstFileA
GetLogicalDrives
GetModuleFileNameA
lstrcmpiA
GetFileSize
CloseHandle
CreateFileA
MoveFileExA
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetProcessHeap
SetFilePointerEx
GetConsoleMode
lstrlenA
WriteFile
FreeEnvironmentStringsW
ReadFile
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapReAlloc
HeapFree
GetModuleHandleExW
GetStdHandle
GetACP
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
SetEndOfFile
user32
GetDC
FillRect
GetSystemMetrics
GetActiveWindow
wsprintfW
DrawTextW
SystemParametersInfoW
wsprintfA
GetClipboardOwner
gdi32
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
SetTextColor
SetBkMode
CreateSolidBrush
CreateFontIndirectW
advapi32
RegOpenKeyExW
CryptHashData
CryptDeriveKey
RegCloseKey
RegSetValueExW
CryptSetKeyParam
CryptAcquireContextA
CryptEncrypt
CryptCreateHash
shell32
ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteW
shlwapi
PathFindFileNameA
PathFindExtensionA
mpr
WNetEnumResourceA
WNetGetLastErrorA
WNetOpenEnumA
WNetCloseEnum
crypt32
CryptStringToBinaryA
CryptDecodeObjectEx
CryptImportPublicKeyInfo
Name
.text
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
20.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=24610,
count=161, id=261, version=24610,
count=22, id=260, version=24610,
count=22, id=259, version=24723,
count=60, id=261, version=24723,
count=34, id=260, version=24723,
count=17, id=257, version=24610,
count=147, id=1, productName=Unmarked objects,
count=4, id=265, version=25019,
count=1, id=258, version=25019,
21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01
- MD5 987a06a5c02be92cdeae2a99a408a716
- SHA1 31e4c64f1fcff7824b023e86482e75870389edef
- SHA512 90db12153f5abd1f8d20a89a473c46f0577ffc2c3a681f4f2bd68f53b8cd2d45c372bce6e0d11d2832ae223eebcb2b9a8a1dc806b5cd8a510134cad830c2596e
- SSDEEP 12288:VROJm7hOOdN2++KEjDz/lnp2WBILtj+fITU4Td9T31r6U2dEV7uikFg:VROJ8hjkLKgP/n2WaLtj+fINR979N/l/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
614174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
592KB
Virtual Size
591KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
115KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2272954a2c9f631b4f9c5f6d230287b0989ab3b512bb5f4a282214eadf42085a.exe
- IMPHASH 53249f65d2f64c09446341c1827aaa66
- SHA256 2272954a2c9f631b4f9c5f6d230287b0989ab3b512bb5f4a282214eadf42085a
- MD5 2ad96b646ad5f323f0bef0bfb6b23ebb
- SHA1 a8ac661b22bd557fe3dbff8f706cb5741d43ac67
- SHA512 8959aebd064c488e7247604b7b30e8487ecc498695206173d1251eff565bd5bb3e8ee90ac22bb1250f78412bcabe9a57d930972d6d4fdd886eef0901d89b38a9
- SSDEEP 6144:0gggrNE0oCD4IKXgWi2AL/Pe5f6LiJbfPcEfm0fg:G6DhfTR8C2JbMEfm0fg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
6474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
FindWindowExA
MessageBoxW
PostMessageA
ShowWindow
EndPaint
RegisterClassExA
DrawTextA
OemToCharA
IsDialogMessageW
RemovePropA
SendMessageW
SetWindowTextA
LoadCursorW
LoadImageA
HideCaret
GetClassNameW
odbctrac
TraceSQLError
TraceSQLCancel
kernel32
OpenMutexW
SetEvent
InterlockedDecrement
GetModuleHandleA
WaitForSingleObject
GetDiskFreeSpaceA
GetProcAddress
GetExpandedNameA
GetConsoleTitleA
DefineDosDeviceA
CreateEventW
CreateFileMappingA
ReleaseMutex
GetStartupInfoW
SystemTimeToFileTime
SetErrorMode
GetConsoleAliasW
iojraq
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
Name
.data
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
265KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
generic
count=1076, id=19, version=8078,
count=1, id=18, version=8444,
2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe
- IMPHASH e836076a09dba03e4d6faa46dda0fefc
- SHA256 2c3542b5d9ab4eed2dd88cd74a02236a944afd76e8717f65dcd544912229ca85
- MD5 ffb938c96bb741d2d1dcc05930072926
- SHA1 643508e98cd746eb91adb0b3a0096ff3d7497dad
- SHA512 09c63015e0a6f1c97f657106d01c7a5399686039f75ccbd9a097544d458edee3ca094b24c1d075658bd34ef332deee5736711f0ac6f7ea273baa42dda5c18215
- SSDEEP 192:xjpBKnwR27YRs/5+K/OUzbx/wz93ADv8Ei:NunwR2JQKZx/wz93ADUv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wininet
HttpSendRequestW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestW
HttpQueryInfoW
InternetReadFile
InternetConnectW
InternetOpenW
kernel32
GetTempPathW
GetFileSize
GetCurrentDirectoryW
DeleteFileW
CloseHandle
WriteFile
lstrcmpW
ReadFile
GetModuleHandleW
ExitProcess
HeapCreate
HeapAlloc
GetModuleFileNameW
CreateFileW
lstrlenW
user32
wsprintfW
shell32
ShellExecuteW
Name
.text
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
166B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=1, productName=Unmarked objects,
count=2, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338.exe
- IMPHASH d594c3da09df47926f98761efef2f7b1
- SHA256 3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338
- MD5 08109df08fa4a035c59d56d1e6c5baf4
- SHA1 bec86bce6f6963d0cc69c441c6d5fb6d04d3a833
- SHA512 61e6cc3e94ddb7a980bfb0a2e5e5ffeeb5414c9e2ef3e42551820017dbedab5cccdd8ece1fed2ca057e240bdb7836663a7f9be28f1bb9136da972750caf59704
- SSDEEP 12288:s8TC7FeAA9IsQwycG888888888888W88888888888E7xCYsdG:s8TygVinw1Z7xCZdG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
InterlockedPushEntrySList
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadResource
LockResource
MultiByteToWideChar
OpenEventW
OpenFileMappingW
OpenJobObjectA
OpenSemaphoreA
PulseEvent
RaiseException
ReadConsoleOutputCharacterW
ReadConsoleOutputW
ReleaseMutex
SearchPathW
HeapValidate
SetDllDirectoryW
SetEnvironmentVariableW
SetErrorMode
SetLastError
SetVolumeLabelW
SizeofResource
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WaitForSingleObject
WriteConsoleW
WriteFile
WritePrivateProfileStringW
WriteProfileStringA
_lclose
_lwrite
lstrcatW
lstrcmpW
lstrcmpiW
lstrcpyW
lstrcpynW
lstrlenA
lstrlenW
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapAlloc
GetVolumeInformationA
GetVersionExW
GetVersionExA
GetThreadPriorityBoost
GetTempFileNameW
GetSystemTime
GetSystemDirectoryW
GetSystemDirectoryA
GetStringTypeExW
GetQueuedCompletionStatus
GetProfileSectionA
GetProfileIntA
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileSectionNamesA
GetPrivateProfileIntW
GetOEMCP
GetModuleHandleA
GetModuleFileNameW
GetLastError
GetCurrentThreadId
GetCurrentProcess
GetConsoleMode
GetConsoleDisplayMode
GetConsoleCP
GetConsoleAliasW
GetConsoleAliasExesLengthA
GetComputerNameExW
GetCommandLineW
GetACP
FreeLibrary
FormatMessageW
FlushInstructionCache
FindResourceW
FindResourceExW
FindNextFileA
FindFirstFileExA
FillConsoleOutputCharacterW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
ExitProcess
EnterCriticalSection
EndUpdateResourceW
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreateMutexW
CreateMutexA
CreateFileMappingW
CreateFileMappingA
CreateEventW
CreateDirectoryA
CopyFileExA
ConvertThreadToFiber
CompareStringW
CommConfigDialogW
CloseHandle
BindIoCompletionCallback
BeginUpdateResourceW
AddConsoleAliasW
VirtualAlloc
CreateFileW
SetCurrentDirectoryW
GetModuleHandleW
user32
DrawIcon
DrawIconEx
DrawTextExW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndDialog
EndPaint
EnumChildWindows
EnumDesktopWindows
EnumDisplayMonitors
EnumThreadWindows
EnumWindows
EqualRect
FillRect
FindWindowExW
FindWindowW
FrameRect
GetActiveWindow
GetAncestor
GetAsyncKeyState
GetCapture
GetClassInfoA
GetClassInfoExW
GetClassInfoW
GetClassLongW
GetClassNameW
GetClassWord
GetClientRect
GetClipboardSequenceNumber
CopyImage
GetDCEx
GetDlgCtrlID
GetDlgItem
GetDlgItemTextW
GetForegroundWindow
GetIconInfo
GetKeyNameTextW
GetKeyboardLayoutList
GetKeyboardLayoutNameW
GetKeyboardState
GetLastActivePopup
GetMenu
GetMenuDefaultItem
GetMenuItemID
GetMenuItemInfoW
GetMenuState
GetMenuStringW
GetMessageExtraInfo
GetMessagePos
GetMessageW
GetMonitorInfoW
GetParent
GetPropW
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSysColorBrush
GetSystemMenu
GetUpdateRect
GetWindow
GetWindowContextHelpId
GetWindowDC
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextW
GetWindowThreadProcessId
HideCaret
InflateRect
InsertMenuItemW
InsertMenuW
IntersectRect
InvalidateRect
IsCharAlphaNumericW
IsChild
IsDialogMessageA
IsDialogMessageW
IsIconic
IsRectEmpty
IsWindow
IsWindowUnicode
IsZoomed
KillTimer
LoadBitmapW
LoadIconW
LoadImageW
LoadKeyboardLayoutW
LoadMenuW
LoadStringW
MapVirtualKeyW
MapWindowPoints
MessageBeep
MessageBoxA
MessageBoxExW
MessageBoxW
ModifyMenuW
MonitorFromPoint
MonitorFromWindow
MoveWindow
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
OemToCharBuffA
OffsetRect
OpenClipboard
OpenDesktopW
PeekMessageA
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RealChildWindowFromPoint
RedrawWindow
RegisterClassExW
RegisterClassW
RegisterClipboardFormatW
RegisterHotKey
RegisterWindowMessageW
ReleaseDC
RemoveMenu
RemovePropW
DrawFrameControl
ScrollWindow
SendDlgItemMessageW
SendInput
SendMessageA
SendMessageTimeoutW
SendMessageW
SetActiveWindow
SetCapture
SetClassLongW
SetClipboardData
SetCursor
SetCursorPos
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetKeyboardState
SetLastErrorEx
SetMenu
SetMenuDefaultItem
SetMenuItemInfoW
SetParent
SetPropW
SetRect
SetRectEmpty
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowCursor
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoW
TabbedTextOutA
TabbedTextOutW
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnregisterClassA
UnregisterClassW
UnregisterHotKey
UpdateWindow
WaitMessage
WinHelpW
WindowFromPoint
wsprintfW
wvsprintfW
CloseClipboard
ClientToScreen
ChildWindowFromPoint
CheckMenuItem
CharUpperBuffW
CharToOemBuffA
CharPrevW
CharLowerW
CharLowerBuffW
CallWindowProcW
CallNextHookEx
BeginPaint
AllowSetForegroundWindow
AdjustWindowRectEx
ActivateKeyboardLayout
GetKeyState
GetWindowTextLengthW
LoadCursorW
GetKeyboardLayout
GetClipboardOwner
GetSysColor
GetInputState
CharNextW
DestroyIcon
VkKeyScanA
IsCharAlphaW
VkKeyScanW
GetDoubleClickTime
GetKBCodePage
GetCaretBlinkTime
PaintDesktop
InSendMessage
GetQueueStatus
GetMenuCheckMarkDimensions
WindowFromDC
GetShellWindow
IsCharAlphaNumericA
IsClipboardFormatAvailable
CreatePopupMenu
GetThreadDesktop
LoadCursorFromFileA
GetClipboardViewer
GetProcessWindowStation
ShowCaret
GetWindowTextLengthA
GetMenuContextHelpId
DrawMenuBar
GetTopWindow
GetDC
GetFocus
IsWindowEnabled
EnumClipboardFormats
ReleaseCapture
IsMenu
GetSystemMetrics
IsWindowVisible
GetDesktopWindow
OemKeyScan
IsCharUpperW
GetMessageTime
CloseWindowStation
CharUpperW
GetClipboardData
GetMenuItemCount
DestroyWindow
GetCursor
DrawFocusRect
DrawEdge
DlgDirSelectComboBoxExA
DispatchMessageW
DispatchMessageA
DialogBoxParamW
DialogBoxIndirectParamW
DestroyMenu
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreateWindowExW
CreateMenu
IsCharLowerW
GetKeyboardType
CloseDesktop
CreateIconIndirect
CreateIcon
CreateDialogParamW
CountClipboardFormats
ScreenToClient
CopyRect
GetCursorPos
gdi32
GetDCBrushColor
SaveDC
GetStockObject
GetGraphicsMode
GetStretchBltMode
GetColorSpace
AddFontResourceW
DeleteDC
GetBkColor
DeleteColorSpace
CloseFigure
CreateCompatibleDC
EndDoc
GetBkMode
AbortPath
GetPolyFillMode
GetEnhMetaFileA
CreatePatternBrush
BitBlt
CreateCompatibleBitmap
StrokePath
CreateFontIndirectW
CreatePen
CreateSolidBrush
DPtoLP
DeleteObject
ExtTextOutW
GetDIBColorTable
GetDeviceCaps
GetEnhMetaFileHeader
GetObjectW
PtVisible
Rectangle
RoundRect
SelectObject
SetBkColor
SetBkMode
SetDIBColorTable
SetTextColor
StretchBlt
gdiPlaySpoolStream
SwapBuffers
GetObjectType
GetTextCharacterExtra
GetTextAlign
EndPage
SetMetaRgn
DeleteMetaFile
GetSystemPaletteUse
GetFontLanguageInfo
GetLayout
CloseMetaFile
CreateDIBSection
GetTextCharset
advapi32
RegDeleteKeyW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
GetUserNameW
RegOpenKeyExW
shell32
SHFileOperationW
ShellExecuteW
ShellExecuteExW
SHQueryRecycleBinW
SHInvokePrinterCommandW
DoEnvironmentSubstA
DragQueryFileAorW
SHChangeNotify
SHFileOperationA
Shell_NotifyIconW
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ole32
OleInitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
OleUninitialize
shlwapi
StrStrW
StrRChrIW
StrRChrIA
StrChrA
PathFindExtensionW
comctl32
InitCommonControlsEx
imm32
ImmDisableIME
Name
.text
Size
231KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=19, id=123, productName=VS2005 build 50727, version=50727,
count=486, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=5, productName=Unmarked objects (old),
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
- IMPHASH c0cf0052bc809c1335de5569fdee9950
- SHA256 3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816
- MD5 39217b125403ff7c755622ef9bbef974
- SHA1 9fc607b7c17919c83999bdd119e9cd6bf413101a
- SHA512 1252ea94931eaf4426ca1eb94a070645238775c447a09286109fe894c569de29ca502882a0fa34e97e09109c43c486a3aa32081e3a3afef0b6557db59c71fc50
- SSDEEP 12288:3+Zn/gJtKaNIBpB+iMMOD30ZnZ47m0T3JF9j3GOF0l7B2FzqL2aZa7rf58bs:3+RYeaNILZi/JDLG60y1aZvs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
18303
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
DecodePointer
HeapFree
GetACP
GetModuleHandleExW
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
WriteFile
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
GetCommandLineW
GetConsoleCP
GetStdHandle
EncodePointer
Process32Next
Process32First
SetLastError
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
CreateToolhelp32Snapshot
SetConsoleTitleA
CreateTimerQueue
CreateFileW
LoadLibraryA
MulDiv
CreateTapePartition
CloseHandle
CreateIoCompletionPort
GetLastError
GetProcessHeap
HeapAlloc
HeapCreate
RaiseException
TerminateProcess
GetCurrentProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcAddress
FlushFileBuffers
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetConsoleMode
SetFilePointerEx
WriteConsoleW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
user32
PostQuitMessage
DefWindowProcA
SendMessageA
DispatchMessageA
CreateWindowExA
ShowWindow
IsWindowVisible
GetDlgItem
CheckDlgButton
IsDlgButtonChecked
SendDlgItemMessageA
SetFocus
TranslateMessage
RegisterClassA
wsprintfA
DrawFrameControl
RealChildWindowFromPoint
DefMDIChildProcA
LoadCursorA
LoadBitmapA
GetWindow
FindWindowExA
SetWindowLongA
GetWindowLongA
PtInRect
OffsetRect
InvertRect
DrawFocusRect
GetSysColorBrush
GetSysColor
MessageBoxA
SetWindowTextA
GetScrollRange
RedrawWindow
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
DeleteMenu
GetSystemMenu
GetSystemMetrics
GetFocus
GetMessageA
gdi32
SetWindowExtEx
MoveToEx
SetTextJustification
SetTextAlign
SetBkMode
SelectObject
Rectangle
LineTo
GetTextExtentPoint32A
GetTextAlign
GetStockObject
GetDeviceCaps
DeleteObject
CreateSolidBrush
CreatePen
CreateFontA
advapi32
SystemFunction036
AllocateAndInitializeSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
IsValidSid
shell32
SHBrowseForFolderA
ole32
CLSIDFromString
CoInitialize
ws2_32
WSAStartup
shutdown
closesocket
WSASocketA
netapi32
NetShareGetInfo
avifil32
AVIStreamStart
AVIStreamRelease
AVIFileGetStream
AVIStreamLength
AVIFileOpenA
AVIFileRelease
AVIFileExit
AVIFileInit
AVIStreamGetFrameOpen
AVIStreamGetFrame
AVIStreamGetFrameClose
AVIFileInfoA
msacm32
acmFormatEnumA
acmFormatTagDetailsA
acmMetrics
winmm
mmioAscend
iphlpapi
GetInterfaceInfo
GetIfTable
GetIfEntry
shlwapi
StrChrA
AssocCreate
comctl32
ImageList_AddMasked
ImageList_GetImageCount
ImageList_Create
wintrust
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
rpcrt4
UuidHash
setupapi
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
Name
.text
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
840KB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=241, version=40116,
count=123, id=243, version=40116,
count=26, id=242, version=40116,
count=20, id=259, version=23406,
count=18, id=260, version=23406,
count=40, id=261, version=23406,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=207, id=1, productName=Unmarked objects,
count=1, id=261, productName=VS2015 UPD1 build 23506, version=23506,
count=1, id=255, productName=VS2015 UPD1 build 23506, version=23506,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD1 build 23506, version=23506,
41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
- IMPHASH 59e94e5f36f690a93172696aa6586953
- SHA256 41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a
- MD5 b0492e56e1246873173e8f7d32f8a278
- SHA1 b31e8e98a4b570f739dd1e1098f4e593f930f450
- SHA512 fa078565f4eab7b1a618dff2182ac0f630f32a151fdbb5c3d73d1544cc4371d283cc76f597dde990eaa9e389355aca9c73cd1e8b3087b769340f3b9642642979
- SSDEEP 384:U0Ne12bO+rTx8S0VL+5ka0OXE8vDIXam7JV4DXi4EECyBsnK/8kHaHKczlyDqq:612hTa7JULXEfXamDIy4HBs7HKwQx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
10367
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualAlloc
GetCPInfo
GetOEMCP
HeapAlloc
lstrcmpiW
GetCurrentProcess
lstrcpynW
GetCommandLineA
lstrcmpW
FreeEnvironmentStringsA
HeapFree
GetProcessHeap
GetStartupInfoA
GetEnvironmentVariableW
GetEnvironmentStringsA
user32
ShowStartGlass
EndPaint
IsIconic
GetWindowTextA
SetCursor
BeginPaint
GetCursorPos
oleaut32
SysStringLen
VariantChangeTypeEx
SysAllocStringLen
VarI1FromR8
SafeArrayGetDim
VarDecMul
VarBstrFromR8
VarUI8FromI2
VarDateFromI1
VariantClear
UnRegisterTypeLib
VarTokenizeFormatString
VariantCopyInd
CreateTypeLib2
VarI2FromI8
VarR8Round
VarUI4FromUI8
Name
.text
Size
24KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=1, productName=Unmarked objects,
count=4, id=93, version=2179,
count=1, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe
- IMPHASH d5af612192dea3485d4c6e2bdcaa0ae7
- SHA256 467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be
- MD5 36a0cefeb8b0a606358142d4140ea7cf
- SHA1 03ce13b4f60d2fc632b67b41b82b5e8cfaf9939f
- SHA512 63304f3ddca578beac157197581e6a2a762d9cf1fb08fa6ae85dcdc26340ae64badb0f4a9cb47521315c366b70bd0cf89bf1b72be29f89e2d91504cec7ca9093
- SSDEEP 6144:VEwaWsAzrp8viKgjdCU641BHoKIPi2CRp2pFSnfJxLw/mq3pT+Qrm9m7s:G9UjdtzIKl2YY3SRxLw/BT+X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7603
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetDriveTypeW
GetCommProperties
GetModuleHandleW
TerminateProcess
GetProcAddress
LoadLibraryA
AddAtomA
GetCommTimeouts
GetProcessAffinityMask
VirtualProtect
GetTempPathA
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapReAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetLastError
HeapFree
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
Sleep
HeapSize
user32
EnableScrollBar
LoadImageA
shell32
Shell_NotifyIconA
SHGetFileInfoA
ExtractIconExA
SHGetDiskFreeSpaceExW
msimg32
TransparentBlt
GradientFill
AlphaBlend
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
320KB
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=68, id=170, productName=VS2010 build 30319, version=30319,
count=29, id=171, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0.exe
- IMPHASH fcf96dc829b5f24b92a7b578e6908702
- SHA256 5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0
- MD5 6aa5d9b03d34c87026ac11a6f30524fe
- SHA1 c0c532d64bc1d16aeb12ea58c9e94c48eb3d64d4
- SHA512 1e0cdbfd5399c03e6db32b309d38f56dc0761d6a9d2319c712f771fecc9fec8aac0c2dd2ee00e4674b26168265558e4d02a810a6326c73e36a1e453ecc394069
- SSDEEP 3072:A2XIX/5EEAmkN7HqOaeV/RPMObiZif2fXSF9uvm8dDuCb4NeIAg0Fuj3RK3o1yL:AliN3qO1hR0UiZi+fC+iAObo41I
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
45024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcessorNumber
ExitProcess
lstrcpynA
WinExec
GetTickCount
GetDriveTypeW
GetLastError
WriteConsoleW
GetLocalTime
CreateFileW
ReadConsoleW
SetStdHandle
GetLogicalDrives
FreeEnvironmentStringsW
OpenMutexA
Sleep
GetCurrentThreadId
CreateMutexA
FindFirstFileA
FindClose
FindNextFileA
ExpandEnvironmentStringsW
HeapSize
GetModuleFileNameA
GetFileTime
lstrcmpiA
SystemTimeToFileTime
GetFileSize
CloseHandle
FileTimeToSystemTime
CreateFileA
MoveFileExA
lstrlenA
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetProcessHeap
SetFilePointerEx
GetConsoleMode
SetFileTime
WriteFile
ReadFile
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapReAlloc
HeapFree
GetModuleHandleExW
GetStdHandle
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
SetEndOfFile
user32
GetDC
FillRect
GetSystemMetrics
GetActiveWindow
wsprintfW
DrawTextW
SystemParametersInfoW
wsprintfA
GetClipboardOwner
gdi32
GetDIBits
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
SetTextColor
SetBkMode
CreateSolidBrush
CreateFontIndirectW
advapi32
RegOpenKeyExW
CryptHashData
CryptDeriveKey
RegCloseKey
RegSetValueExW
CryptSetKeyParam
CryptAcquireContextA
CryptEncrypt
CryptCreateHash
shell32
ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteW
shlwapi
PathFindFileNameA
PathFindExtensionA
mpr
WNetEnumResourceA
WNetGetLastErrorA
WNetOpenEnumA
WNetCloseEnum
crypt32
CryptStringToBinaryA
CryptDecodeObjectEx
CryptImportPublicKeyInfo
Name
.text
Size
155KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
20.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=24610,
count=161, id=261, version=24610,
count=22, id=260, version=24610,
count=22, id=259, version=24723,
count=60, id=261, version=24723,
count=34, id=260, version=24723,
count=17, id=257, version=24610,
count=151, id=1, productName=Unmarked objects,
count=4, id=265, version=25019,
count=1, id=258, version=25019,
712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
- IMPHASH 4893cd8c9409b7c6586b6402339acab9
- SHA256 712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489
- MD5 1c526b6bd496e217833972f77a235928
- SHA1 49dde9bf9e2f11abf13dc55cbf901af49e575bc1
- SHA512 884b01546adc3c64ec04cc5856fdd7ce5f851dea2eb4066ea398dfeb62a23eab14a592e7be4f286625cd94b3c8b6254d3646eb05ddf0d6a70aa160e7e2cba2a8
- SSDEEP 24576:lTnv8YkXw+xfggJJmlm5SJPC/QMyKesckckSZahVY06uIxf+ubfOLVU:J0Husckc4Y0/IACmL2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1537324
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
user32
CharNextW
LoadStringW
ShowWindow
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperBuffW
CharUpperW
CharLowerBuffW
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsDBCSLeadByteEx
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetConsoleOutputCP
GetConsoleCP
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
GetFileType
GetFileSize
CreateFileW
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
WriteFile
WinExec
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VerSetConditionMask
VerifyVersionInfoW
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SetThreadPriority
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
MoveFileW
LocalFree
LoadLibraryW
LeaveCriticalSection
LCMapStringW
IsValidLocale
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetWindowsDirectoryW
GetVersionExW
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathW
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetACP
FreeLibrary
FormatMessageW
FindNextFileW
FindFirstFileW
FindClose
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateFileW
CreateEventW
CompareStringW
CloseHandle
Sleep
GetConsoleWindow
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
netapi32
NetApiBufferFree
NetWkstaGetInfo
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
1024B
Virtual Size
614B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
153B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
32B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821
- MD5 d7c62a22cc1a832ba2ce0bfd1c4f9e9c
- SHA1 a484b5a49a5b94f045100dd5e659b9504ed99211
- SHA512 7c036f46c6c5a34d991d277c3ecf3c8abdf3a70042c40aaa3c20ce2f3e02a5a63200530587c2980ba5e000a7f1394a33390e63ec53782892b27874e293dff1c6
- SSDEEP 12288:Qu/mk3LQLwumO7mL945Hj1wcBsXcDBif+w+nstV7uikFg:5+WLQLP7mL9eDb+Msfsnstlubg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
608818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
587KB
Virtual Size
586KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
115KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
- IMPHASH caeae43a095cc441a32b8fb2f33dae42
- SHA256 8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621
- MD5 496f86f951e1dbd3c4534d51a5297668
- SHA1 1199c5f30f5724841905cbdb9787649d15aae3d5
- SHA512 382abc596081ca5d0fdea39b12afe433e446cd50f59e4abca818162d96e46465beb1cda631109083071e7c050af6bfcf867be41d02c1e2ebe5dd99f61f45d510
- SSDEEP 24576:es0fVWVbd8fKT0KqTAFFCa/2yDEmdvAkomBbOsn51D:es0fVWVR8fKTeU1imBbl51D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
32594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
LoadLibraryExW
GetModuleFileNameW
WriteFile
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
lstrlenA
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
Sleep
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
GetCommandLineA
RtlUnwind
RaiseException
WideCharToMultiByte
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
LCMapStringW
HeapReAlloc
GetStringTypeW
OutputDebugStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
SetStdHandle
WriteConsoleW
DecodePointer
EncodePointer
SetConsoleTitleA
GetUserDefaultLangID
EnumTimeFormatsA
lstrcpyW
CreatePipe
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemInfo
CloseHandle
LoadResource
WaitForMultipleObjects
GetLastError
GetCurrentProcess
GetProcessHeap
HeapFree
MultiByteToWideChar
GetFullPathNameA
FindResourceExW
GetModuleHandleW
GetModuleHandleA
CreateFileW
TerminateProcess
lstrlenW
HeapAlloc
HeapCreate
GlobalAlloc
GetProcAddress
user32
MoveWindow
DialogBoxParamA
TranslateMessage
UpdateLayeredWindow
GetMessagePos
PostQuitMessage
SetClipboardData
GetMessageA
ShowWindow
CreateWindowExA
GetDlgItem
RegisterClassExA
GetKeyboardLayout
EmptyClipboard
CharLowerBuffA
SendMessageA
CloseClipboard
DefWindowProcA
SetFocus
RegisterHotKey
SetMessageQueue
OpenClipboard
DispatchMessageA
GetFocus
keybd_event
EnableWindow
GetSystemMetrics
wsprintfA
EndDialog
CreatePopupMenu
AppendMenuA
GetCursorInfo
SetScrollInfo
LoadStringW
GetIconInfo
CopyIcon
DrawIconEx
CopyImage
CreateIcon
LoadIconA
LoadCursorA
CallNextHookEx
GetTopWindow
EnumWindows
GetParent
GetWindowLongA
PtInRect
WindowFromPoint
GetCursorPos
SetCursorPos
MessageBoxA
GetWindowRect
GetClientRect
SetWindowTextA
SetScrollRange
SetScrollPos
GetWindowRgn
SetWindowRgn
GetUpdateRect
EndPaint
BeginPaint
GetDC
TrackPopupMenu
gdi32
CreateCompatibleDC
CreateRectRgn
CreateSolidBrush
CreateCompatibleBitmap
CreateBitmap
SetBkMode
DeleteDC
GdiFlush
ExtTextOutA
CombineRgn
SelectObject
GetStockObject
GetPixel
Ellipse
DeleteObject
winspool.drv
SetPrinterDataExA
DeviceCapabilitiesA
comdlg32
GetSaveFileNameA
advapi32
RegCreateKeyA
GetTokenInformation
AllocateAndInitializeSid
FreeSid
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
OpenProcessToken
RegCloseKey
CheckTokenMembership
LookupPrivilegeNameA
shell32
Shell_NotifyIconA
SHBrowseForFolderA
ole32
CoTaskMemAlloc
oleaut32
VariantInit
UnRegisterTypeLi
VariantChangeTypeEx
LoadTypeLibEx
ws2_32
WSCEnumProtocols
winscard
SCardEndTransaction
winmm
timeGetTime
shlwapi
StrCmpNIA
PathAppendA
StrFormatByteSizeA
comctl32
ImageList_Remove
ImageList_Draw
ord17
ImageList_Create
pdh
PdhCollectQueryData
PdhAddCounterA
PdhGetFormattedCounterValue
PdhOpenQueryA
rpcrt4
RpcServerUseProtseqEpA
RpcServerRegisterIfEx
gdiplus
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDisposeImage
GdipCreateFromHDC
GdipLoadImageFromFile
GdipFree
GdipAlloc
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
opengl32
glLoadIdentity
glClear
glMatrixMode
imm32
ImmSetOpenStatus
ImmGetOpenStatus
ImmGetConversionStatus
ImmReleaseContext
ImmGetContext
ImmGetDescriptionA
ImmIsIME
setupapi
CM_Query_Resource_Conflict_List
CM_Query_Arbitrator_Free_Size
CM_Query_Remove_SubTree
uxtheme
OpenThemeData
GetThemeSysSize
CloseThemeData
powrprof
GetPwrCapabilities
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
903KB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Bit Paymer.exe
- IMPHASH 016fe50c549606ee977466a0e8cfdffa
- SHA256 d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2
- MD5 998246bd0e51f9582b998ca514317c33
- SHA1 5a2d799ac4cca8954fc117c7fb3e868f93c6f009
- SHA512 773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130
- SSDEEP 1536:tacFdjxs2TlWlpnXv91nhixG8/lA5jG8387SpK6jXOMVHoi5e+vRb:taqJC6lWlpnXv7nhixhlAU83VwMCifvR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7904
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
GetComputerNameExW
msvcrt
fwrite
netapi32
NetUserSetGroups
rpcrt4
I_RpcServerRegisterForwardFunction
RpcBindingFree
user32
SetDlgItemInt
GetWindowTextW
wsprintfW
wsprintfA
GetClipboardViewer
DdeGetLastError
msacm32
acmFormatDetailsW
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.code
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
W0KEjK
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
-R*
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
580B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=14, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=120, productName=VS2005 build 50727, version=50727,
KeepCalm.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 043969e70014662e6a8b90eaaec10f4b4064dc42c0aeba39639af82f11cbab7e
- MD5 f994759181fb964af17fab2f7994b9ca
- SHA1 9ae72a3dc37955af7526fd8566698b7a97ed7cb0
- SHA512 c36ff4026879e6cbab1e95e8a8a9cc6dc8538de9fa5719625ddf5a9d578dda310325cbf1e44a2dddbc85f27521e7e736637bb102e1d230f861ecb8f2e0219188
- SSDEEP 3072:Y9mM+lmsolAIrRuw+mqv9j1MWLQFidJM+lmsolAIrRuw+mqv9j1MWLQd:EF+lDAAJdi+lDAA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
128350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LockedIn.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 613af1bf17a11dbf12849568ce08186cc4109a5cdb32d0bcce7c1bd81306f5c6
- MD5 e9e34a4dbf0c9fe5fb595b0282b0b4f0
- SHA1 4f3f6bc4aff97eecb9ab52d47520e248c618da45
- SHA512 b234f7a6fef8eb3153da20b1c9f668a8177e489817b1e7e36a572fbfc7dc3604f5cd509f5ff7087f4d3a2e3c1a5a0c7e93ae571be11c70732b1078ba8050a119
- SSDEEP 12288:dl6aKEZf4r/s6IzjtyHQDWcFXXGmmBJ0d35O3CEkk4zglJaKfZf4m:dlNCr/sFFmmmHIpKCEx4sljCm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
537022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Artist\Documents\Visual Studio 2017\Projects\Data Locker\Data Locker\obj\Debug\Data Locker.pdb
mscoree
_CorExeMain
Name
.text
Size
516KB
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Purge.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b4e9d14e4ea8a1c459805ec46870f12a3e6ea3308864511a3d9c7af9fb841403
- MD5 b02916e5c5215ef3ce25269c8d8afbe2
- SHA1 7ea2e4eebea27ade84075a5bd47e048297377259
- SHA512 c84cd98801dbc515f8e800c5fae57158d4167347c2267f1decbf37e98819b2bc1e9439eacec71eaad1c6ece62bf468b21db9cc53e6568cc73499595b1935296e
- SSDEEP 384:lMX3iNFRHDy0nxaP/JqiKV+aQlSp591U7qO7o4FQcc4KVOJ5ogxlwAx9sLtsNtt7:qHitm/JqiO+aB5s7qOUvOJ5ogDrCO8tm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\users\beary\onedrive\documents\visual studio 2017\Projects\PurgeRansomware\PurgeRansomware\obj\Debug\PurgeRansomware.pdb
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Scarab.exe
- IMPHASH ac42624e1c698c88c9c9c11516c26efc
- SHA256 53f73dc2e8af9c059136029b3b535e885d4452d3375586eb9a0336d7a389aad5
- MD5 6899003aaa63ab4397f9e32e0a1daf43
- SHA1 c22272ff0944d127992b393562871473b23ef8ea
- SHA512 d8895f96e12d1b0b5907f7b1e7b976a37ff0cbe6db929cfbea5c931d905fb8269dc91bf44db83743920b63affc64ba88a0933d3111bc68f71ee266971b91b6bc
- SSDEEP 6144:zmTLRf45/wAfqj6pjohSws+wZQtmk6LnAlnZ:eq5/tyjMLd+Rtmkc0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7708
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleW
GetTickCount
GlobalAlloc
GetFileAttributesA
GetCompressedFileSizeA
CreateFileW
GetFileSizeEx
GetLastError
GetProcAddress
CloseHandle
CreateFileA
GetStartupInfoW
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapAlloc
HeapFree
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
GetModuleHandleA
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
user32
DlgDirSelectExW
PeekMessageA
EndPaint
Name
.text
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
262KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=26, id=149, productName=VS2008 build 21022, version=21022,
count=116, id=131, productName=VS2008 build 21022, version=21022,
count=39, id=132, productName=VS2008 build 21022, version=21022,
count=93, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b.exe
- IMPHASH c516e8516238a871ed55c8931b909393
- SHA256 a631ad1b1a59001a5f594880c6ae3337bda98f8ce3bb46cd7a9de0b35cd2bc4b
- MD5 cb4ef16070b2dec59effcdb4a2134a83
- SHA1 c9fcc72c08eece9ca0beb2a3d3801bbfffcb6196
- SHA512 be87293a1b9537d54780639006b6e7a6048755064ca4e78cc295ae1b6263ab4d511e4f720f2687a55372da10e8fd67a47bb091bd5357c50045690936b2411091
- SSDEEP 6144:1xIPLPHOoW/EHVDJSBD94vqW6Q65Ln1ZEVNl999999999999999999999POU:+DHOVcHVDJMgX6Qu0V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
37123
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
CloseHandle
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
IsProcessorFeaturePresent
HeapFree
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
Sleep
LCMapStringW
GetStringTypeW
CreateFileA
SetStdHandle
FlushFileBuffers
HeapSize
LoadLibraryW
WriteConsoleW
HeapReAlloc
SetEndOfFile
GetProcessHeap
ReadFile
lstrcpyA
CreateThread
lstrcpyW
GetVersionExA
GetModuleHandleA
GetProfileStringA
LoadLibraryA
GetLocalTime
GlobalFree
EnterCriticalSection
GetProcAddress
SetLastError
GetLastError
GlobalUnlock
lstrlenW
lstrcatA
MulDiv
HeapCreate
WideCharToMultiByte
CreateFileW
GetCurrentThreadId
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
EncodePointer
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GlobalAlloc
InitializeCriticalSection
WaitForSingleObject
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GlobalLock
HeapAlloc
GetComputerNameA
MultiByteToWideChar
user32
GetClientRect
GetClassLongA
CopyRect
ValidateRect
EnumDisplayDevicesA
LoadCursorA
FindWindowA
UpdateWindow
GetSystemMetrics
SystemParametersInfoA
DispatchMessageA
AppendMenuA
FrameRect
GetSysColorBrush
ShowWindow
LoadAcceleratorsA
GetDesktopWindow
DefWindowProcA
GetDlgItem
SetClassLongA
TranslateAcceleratorA
EnableMenuItem
ReleaseDC
EndPaint
SetCursor
GetMessageA
CreateWindowExA
LoadStringA
GetFocus
LoadBitmapA
LoadMenuA
LoadIconA
IsWindowEnabled
FindWindowExA
GetWindowRect
CreateMenu
SendMessageA
BeginPaint
GetDC
TranslateMessage
ShowCursor
GetMenu
GetWindowPlacement
SetWindowLongA
GetWindowLongA
gdi32
ExtTextOutA
GetStockObject
GetPixel
CreateEllipticRgn
ExtCreatePen
MoveToEx
BitBlt
PatBlt
SetViewportOrgEx
LineTo
SetTextColor
DeleteDC
CreateFontIndirectA
SetBkColor
CreateDCA
CreateBitmap
DeleteObject
SelectObject
SelectClipRgn
CreateCompatibleDC
CombineRgn
CreateCompatibleBitmap
CreateRectRgn
CreatePen
GetTextMetricsA
SetROP2
SetTextAlign
EnumFontsA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
ChooseFontA
CommDlgExtendedError
advapi32
StartServiceW
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
CreateServiceA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenSCManagerA
StartTraceA
SetServiceStatus
LsaClose
CloseServiceHandle
shell32
SHQueryRecycleBinA
SHGetFileInfoA
DragAcceptFiles
SHEmptyRecycleBinA
ole32
CreateStreamOnHGlobal
StgCreateDocfile
CoInitialize
CoMarshalInterface
CoUnmarshalInterface
CreateBindCtx
CoCreateInstance
GetHGlobalFromStream
oleaut32
OleCreatePictureIndirect
netapi32
NetUserEnum
NetApiBufferFree
NetUserAdd
NetLocalGroupAddMember
comctl32
CreatePropertySheetPageW
ord17
pdh
PdhBrowseCountersA
PdhMakeCounterPathA
PdhOpenQueryA
imm32
ImmGetDefaultIMEWnd
ImmGetContext
setupapi
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
uxtheme
DrawThemeParentBackground
IsThemeBackgroundPartiallyTransparent
usp10
ScriptGetGlyphABCWidth
ScriptFreeCache
snmpapi
SnmpUtilMemFree
SnmpUtilMemAlloc
mscms
OpenColorProfileA
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=127, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=41, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=219, id=1, productName=Unmarked objects,
count=1, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc
- MD5 43478841baa4b8754f75516220e33ac3
- SHA1 2585a613129d7e3dbff3eb16b10ce3fe940c99a3
- SHA512 9441209433e2d3d49012431011048cd33a7ce980482658a0b1e2ccd3baa70524d2585901b6130d4644d7ca0139d881a9f11a933949ed39ad805a147694b37f87
- SSDEEP 12288:C6JZ+UD5+1fpL2ikTgmPb2EdVu/BdmSHqDd6bhW2RJV7uikFg:JEUD52fpL2bgmSEds/BnKQPlubg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
609234
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
587KB
Virtual Size
586KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
115KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
b764629e1f43851daf984c9372422b65ddceae28f83d6211873f4c8f8672c41c.exe
- IMPHASH 9ecee117164e0b870a53dd187cdd7174
- SHA256 b764629e1f43851daf984c9372422b65ddceae28f83d6211873f4c8f8672c41c
- MD5 ef29f0f2a7b98ea19767b8ae66d1ffb8
- SHA1 093b3916ee1bea0442278d0aa87be5703207e627
- SHA512 9ab431d19633ed54dc1cc8bc4e511cabcfcba56ee0ff30197f5bd7aca07b33f2b605ab17f07fba066f5c910903f27bb04f4eb04cbed539af783564bbeba2c80e
- SSDEEP 98304:yDqPoBhhRxcSUDk36SAEdhvxWa9P59Uc/Jf:yDqPSxcxk3ZAEUadv1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WaitForSingleObject
InterlockedIncrement
GetCurrentThreadId
GetCurrentThread
ReadFile
GetFileSize
CreateFileA
MoveFileExA
SizeofResource
TerminateThread
LoadResource
FindResourceA
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameA
LocalFree
LocalAlloc
CloseHandle
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GlobalAlloc
GlobalFree
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
LockResource
Sleep
GetStartupInfoA
GetModuleHandleA
advapi32
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
ChangeServiceConfig2A
SetServiceStatus
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceA
CryptGenRandom
CryptAcquireContextA
OpenServiceA
ws2_32
closesocket
recv
send
htonl
ntohl
WSAStartup
inet_ntoa
ioctlsocket
select
htons
socket
connect
inet_addr
msvcp60
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
msvcrt
__set_app_type
_stricmp
__p__fmode
__p__commode
_except_handler3
__setusermatherr
_initterm
__getmainargs
_acmdln
_adjust_fdiv
_controlfp
exit
_XcptFilter
_exit
_onexit
__dllonexit
free
??2@YAPAXI@Z
_ftol
sprintf
_endthreadex
strncpy
rand
_beginthreadex
__CxxFrameHandler
srand
time
__p___argc
Name
.text
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
156KB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=4, id=14, version=7299,
count=11, id=10, version=8047,
count=1, id=11, version=8047,
count=4, id=4, version=8047,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=91, id=1, productName=Unmarked objects,
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
cf89f70633865aa06123062a7dc51f8158905afb4b00f6f3597de3edfba97c5c.exe
- IMPHASH 4a903567b2a1e8685c977b5dfd30037d
- SHA256 cf89f70633865aa06123062a7dc51f8158905afb4b00f6f3597de3edfba97c5c
- MD5 3f4e0582663260629e1046d300bfd47c
- SHA1 05d4b2e99a8ad0436cb5d9066987eb0df0321250
- SHA512 b12505249227706b22e054d47d99d4b770a958875fb5eddb9a254ec06353415f00379383a091932ed70a1bcac14a9f8113f0221abed3c6211e6b7fe1f6fe1e81
- SSDEEP 6144:2FexvJFSPxQksREdUZo64wHijE77BoLUbeKMazza722uutBq3:2FyJWQkX/njG7BSEeKMazzaqRut4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
GetLocalTime
GetLastError
HeapFree
RtlUnwind
RaiseException
ExitProcess
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
WriteFile
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
SetFilePointer
CloseHandle
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
GetTimeZoneInformation
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
IsBadReadPtr
IsBadCodePtr
SetStdHandle
ReadFile
LoadLibraryA
InterlockedExchange
VirtualQuery
VirtualProtect
GetSystemInfo
CreateFileW
GetACP
GetOEMCP
HeapSize
GetLocaleInfoW
SetEndOfFile
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileA
Name
.text
Size
92KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=105, version=2067,
count=23, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=129, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=3, id=93, version=2179,
count=74, id=1, productName=Unmarked objects,
count=26, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
e951e82867a4f3af5a34b714571e9acf99cca794c4ed1895c9025a642d5d4350.exe
- IMPHASH 62af716748ca42001336a27fa2f4b371
- SHA256 e951e82867a4f3af5a34b714571e9acf99cca794c4ed1895c9025a642d5d4350
- MD5 52cae327d2b2fef71f1af28e15a2811c
- SHA1 62b516f72b03515078cb89cbecaa4522726e79d4
- SHA512 6daabedfc0accba661c84155ea449b0cdd8819378de9c102da07631390a7a9c1fc7ee1fb71505bfb4dfb974f71696ff57bf376184934bfa230d572400bfb422a
- SSDEEP 24576:d/2jBNbRL7T3QeFlUp1BcKZbn30QYKr5kw4AMMtG3oirCM/e52bZDHwSuQWTsFNz:d/yb9dw5dirCM/cIHnksFsK971
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1805108
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExA
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExA
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
GetUserNameW
user32
MessageBoxA
CharNextW
LoadStringW
CreateWindowExW
UnregisterClassW
TranslateMessage
ReleaseDC
RegisterClassExW
PostMessageW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextW
GetSystemMetrics
GetKeyboardLayout
GetForegroundWindow
GetDesktopWindow
GetDC
GetClientRect
EnumWindows
DispatchMessageW
DefWindowProcW
CharUpperBuffW
CharUpperW
CharLowerBuffW
CallNextHookEx
CharLowerBuffA
CharUpperBuffA
ActivateKeyboardLayout
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetConsoleOutputCP
GetConsoleCP
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
GetFileType
GetFileSize
CreateFileW
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
TryEnterCriticalSection
TerminateProcess
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryW
ReadFile
RaiseException
IsDebuggerPresent
OpenProcess
MoveFileW
LockResource
LocalFree
LoadResource
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
IsValidLocale
IsBadReadPtr
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryW
GetVolumeInformationW
GetVersionExW
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathW
GetSystemInfo
GetSystemTimes
GetStringTypeExA
GetStringTypeExW
GetStdHandle
GetShortPathNameW
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetModuleHandleW
GetModuleFileNameW
GetLogicalDrives
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
FreeLibrary
FormatMessageW
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
ExitProcess
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateMutexW
CreateFileW
CreateEventW
CopyFileW
CompareStringA
CompareStringW
CloseHandle
Sleep
GetVersionExW
gdi32
SelectObject
GetObjectA
GetObjectW
GetDeviceCaps
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
shfolder
SHGetFolderPathW
ole32
CoTaskMemFree
CoUninitialize
CoInitialize
shell32
ShellExecuteW
FindExecutableW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
crypt32
CryptUnprotectData
CryptUnprotectData
SLClose
SLConsumeRight
SLConsumeWindowsRight
SLDepositOfflineConfirmationId
SLFireEvent
SLGenerateOfflineInstallationId
SLGetApplicationInformation
SLGetGenuineInformation
SLGetInstalledProductKeyIds
SLGetInstalledSAMLicenseApplications
SLGetLicense
SLGetLicenseFileId
SLGetLicenseInformation
SLGetLicensingStatusInformation
SLGetPKeyId
SLGetPKeyInformation
SLGetPolicyInformation
SLGetPolicyInformationDWORD
SLGetProductSkuInformation
SLGetSAMLicense
SLGetSLIDList
SLGetServiceInformation
SLGetWindowsInformation
SLGetWindowsInformationDWORD
SLInstallLicense
SLInstallProofOfPurchase
SLInstallSAMLicense
SLIsWindowsGenuineLocal
SLOpen
SLReArmWindows
SLRegisterEvent
SLSetCurrentProductKey
SLSetGenuineInformation
SLUninstallLicense
SLUninstallProofOfPurchase
SLUninstallSAMLicense
SLUnregisterEvent
SLUnregisterWindowsEvent
SLpCheckProductKey
SLpGetGenuineLocal
SLpUpdateComponentTokens
TMethodImplementationIntercept
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
539KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
28B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
176KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
226KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7_WthaiV9ed2.exe
- IMPHASH 5ba4e678a6340059fb43bdbcf8fb8c57
- SHA256 fa0c321e1aad571daaa3bf642ced8ab10931a05957ce9f17da49317816ca50c7
- MD5 eac0a08470ee67c63b14ae2ce7f6aa61
- SHA1 285c0163376d5d9a5806364411652fe73424d571
- SHA512 f3fd7eeae18843d049443f0d5e818302eb3b3f73ad85e26c01e1ddc0a102a0a22b065afe01879aafc95ff3a2d15b5c302394bd03d91e6c4401648cd4222bddc5
- SSDEEP 1536:3THoX8wNjiMsyPcjgbKx534oU6Llg/iLBkZhifkdol9LYuVF5yZbn:DjksYKx5o3Slg/itMg8+LYu9ubn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetSystemTimes
GlobalAlloc
LoadLibraryW
GetProcAddress
AddAtomA
FindAtomW
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
HeapSize
CreateFileA
CloseHandle
user32
GetMessageTime
CloseClipboard
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=31, id=132, productName=VS2008 build 21022, version=21022,
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=98, id=131, productName=VS2008 build 21022, version=21022,
count=90, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527.exe
- IMPHASH 0007f1b6ac8d35411ce207643bd2505c
- SHA256 fc184274ad3908021e4c8ef28f35dc77447ed6457375d2a4e7b411955e042527
- MD5 d3fdd9807a32f5c27c14879336762119
- SHA1 73132972d130adb7106e6b9319b21856434eff65
- SHA512 87468ab4136f449cab6e3689b4460de6dc59421ad20ce8208e251b3e4ef63f4ac281288ec51a35469e2473328de8b45b487cd72f40ba72d304a44b89a99a7a80
- SSDEEP 6144:IXJ6Mv/PMB5lZOx4ccuiA8HYVVo7bBPxwdNaLvo:KJf/kBrZOxfwAsYVVoZZwdNaE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
255648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateFileA
lstrcpynW
WriteProfileStringW
WritePrivateProfileSectionW
WriteFile
WriteConsoleW
WaitForSingleObject
WaitForMultipleObjectsEx
WaitForMultipleObjects
UnhandledExceptionFilter
TerminateProcess
SystemTimeToFileTime
Sleep
SetVolumeLabelA
SetUnhandledExceptionFilter
SetThreadUILanguage
SetThreadContext
SetProcessShutdownParameters
SetMailslotInfo
SetLastError
SetHandleInformation
SetFileApisToOEM
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
ReleaseActCtx
ReadFile
ReadConsoleInputA
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
OutputDebugStringW
MultiByteToWideChar
LockFile
LocalFree
LocalAlloc
LoadLibraryW
LoadLibraryA
LeaveCriticalSection
IsDebuggerPresent
InterlockedExchange
InterlockedCompareExchange
InitializeCriticalSection
HeapSetInformation
HeapAlloc
Heap32ListFirst
Heap32First
GlobalFlags
GetTickCount
GetTempFileNameW
GetSystemTimeAsFileTime
GetSystemPowerStatus
GetStartupInfoW
GetProcessHeap
GetProcAddress
GetNamedPipeHandleStateA
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetLocalTime
GetLastError
GetFileSizeEx
GetFileInformationByHandle
ActivateActCtx
GetFileAttributesW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameW
GetCommandLineW
GetACP
FreeLibrary
FormatMessageA
FlushFileBuffers
ExitProcess
EnumResourceLanguagesW
EnterCriticalSection
EncodePointer
DeleteFileW
DeleteCriticalSection
DecodePointer
DeactivateActCtx
CreateThread
CreateSemaphoreW
CreateFileW
CreateEventW
CreateDirectoryW
CreateConsoleScreenBuffer
CreateActCtxW
CloseHandle
HeapFree
user32
GetKeyboardType
GetClipboardViewer
GetKeyState
CopyIcon
GetMessagePos
InSendMessage
AnyPopup
IsGUIThread
CloseDesktop
GetSystemMetrics
GetCaretBlinkTime
GetDialogBaseUnits
GetOpenClipboardWindow
GetDesktopWindow
LoadCursorFromFileA
CountClipboardFormats
OpenIcon
IsMenu
LoadCursorFromFileW
IsWindowUnicode
GetQueueStatus
CharLowerA
GetClipboardSequenceNumber
GetShellWindow
CharNextW
GetWindowTextLengthA
IsIconic
VkKeyScanA
CloseClipboard
GetClipboardOwner
GetProcessWindowStation
PaintDesktop
GetDoubleClickTime
CreatePopupMenu
GetSysColor
IsWindow
IsClipboardFormatAvailable
IsCharUpperW
DestroyIcon
GetAsyncKeyState
GetWindowTextLengthW
IsCharAlphaA
IsCharAlphaNumericA
DestroyWindow
CharUpperA
GetMenuContextHelpId
wsprintfW
TranslateMessage
TranslateAcceleratorW
SetWindowContextHelpId
SetDoubleClickTime
RegisterClassW
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjects
MapVirtualKeyExA
LoadStringW
LoadCursorW
GetUserObjectInformationW
GetThreadDesktop
GetScrollInfo
GetMessageTime
GetMessageA
GetKeyboardLayoutNameW
GetDlgCtrlID
GetClassLongW
GetAltTabInfoW
EndDialog
DrawIconEx
DispatchMessageW
IsCharLowerW
GetInputState
DestroyCursor
LoadIconA
CharNextA
EndMenu
GetFocus
ShowCaret
DestroyMenu
GetDC
GetActiveWindow
IsCharLowerA
CreateMenu
IsWindowEnabled
OemKeyScan
CloseWindow
VkKeyScanW
IsCharAlphaW
GetWindowContextHelpId
CharLowerW
GetWindowDC
GetKeyboardLayout
CharUpperW
CreateWindowExW
DefWindowProcW
LoadIconW
gdi32
GdiEntry14
GdiFullscreenControl
GdiGetSpoolMessage
GetCharWidthI
GetCurrentPositionEx
GetDCOrgEx
GetEnhMetaFileDescriptionA
GetFontAssocStatus
GetMetaFileA
GetMetaFileBitsEx
GetRgnBox
GetStockObject
GetTextMetricsW
PathToRegion
PolyPolyline
PolyTextOutW
SelectPalette
SetDCPenColor
SetTextColor
XFORMOBJ_bApplyXform
bMakePathNameW
GetEnhMetaFileA
AbortDoc
GetLayout
GetPixelFormat
CloseFigure
DeleteDC
AddFontResourceA
GetGraphicsMode
DeleteObject
GetObjectType
GdiConvertRegion
WidenPath
BeginPath
SwapBuffers
GetPolyFillMode
GetBkMode
GetColorSpace
GetFontLanguageInfo
SaveDC
CreatePatternBrush
GdiGetBatchLimit
SetMetaRgn
DeleteColorSpace
UnrealizeObject
AbortPath
CreateCompatibleDC
CancelDC
StrokePath
RealizePalette
GetSystemPaletteUse
EndPath
FlattenPath
GetTextAlign
CreateMetaFileW
GetBkColor
UpdateColors
GetDCPenColor
GdiFlush
GetTextCharset
CreateMetaFileA
EngTextOut
EngCreateBitmap
EngCopyBits
EngAssociateSurface
EndFormPage
EndDoc
DescribePixelFormat
DeleteEnhMetaFile
CreateSolidBrush
CreateScalableFontResourceA
AddFontResourceW
CLIPOBJ_ppoGetPath
CloseEnhMetaFile
CopyEnhMetaFileA
CopyMetaFileW
CreateDCA
CreateEllipticRgnIndirect
CreateICA
CreateRoundRectRgn
FillPath
advapi32
TraceEvent
UnregisterTraceGuids
RegOpenKeyW
SetEntriesInAclW
RegisterTraceGuidsW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyExW
RegCloseKey
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
GetNamedSecurityInfoW
AllocateAndInitializeSid
SetNamedSecurityInfoW
shell32
DragFinish
DragQueryFileW
ExtractAssociatedIconW
ExtractIconExA
ExtractIconExW
ExtractIconW
SHBrowseForFolderW
SHChangeNotify
SHEmptyRecycleBinW
SHFileOperationA
SHFileOperationW
SHGetDesktopFolder
SHGetFileInfoA
SHGetFileInfoW
SHGetMalloc
SHGetPathFromIDListA
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
DragAcceptFiles
msvcrt
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_adjust_fdiv
_controlfp
_except_handler3
_exit
_ftol
_initterm
_onexit
_wcmdln
exit
wcscat
wcscpy
wcslen
wcsncmp
__CxxFrameHandler
_XcptFilter
_EH_prolog
__dllonexit
imm32
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
Name
.text
Size
251KB
Virtual Size
251KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=24, id=19, version=8078,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=314, id=1, productName=Unmarked objects,
count=4, productName=Unmarked objects (old),
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,