Ruination.Swapper 2.0.8.zip
- SHA256 0bd48f713b543fa69cebab66718e20c33defff30e49894d0587ef2e5f6b6e5f9
Password
1313
Overview
overview
10Static
static
3Ruination....r3.dll
windows10-2004-x64
1Ruination....r3.dll
windows7-x64
1Ruination....r3.dll
windows10-2004-x64
1Ruination....r3.dll
windows7-x64
1Ruination....r3.dll
windows10-2004-x64
1Ruination....on.exe
windows7-x64
10Ruination....on.exe
windows10-2004-x64
10Ruination....er.dll
windows7-x64
1Ruination....er.dll
windows10-2004-x64
1Ruination....ss.dll
windows7-x64
1Ruination....ss.dll
windows10-2004-x64
1Ruination....64.dll
windows7-x64
1Ruination....64.dll
windows10-2004-x64
1Ruination....r3.dll
windows7-x64
1Ruination....r3.dll
windows10-2004-x64
1Ruination....r3.dll
windows7-x64
1Ruination....r3.dll
windows10-2004-x64
1Ruination....64.dll
windows7-x64
1Ruination....64.dll
windows10-2004-x64
1Ruination....64.dll
windows7-x64
1Ruination....64.dll
windows10-2004-x64
1Ruination....ts.jar
windows7-x64
1Ruination....ts.jar
windows10-2004-x64
7Ruination....oy.jar
windows7-x64
1Ruination....oy.jar
windows10-2004-x64
7Ruination....ws.jar
windows7-x64
1Ruination....ws.jar
windows10-2004-x64
7Ruination....se.jar
windows7-x64
1Ruination....se.jar
windows10-2004-x64
7Ruination....ce.jar
windows7-x64
1Ruination....ce.jar
windows10-2004-x64
7Ruination....fr.jar
windows7-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Ruination.Swapper 2.0.8/D3DCompiler_47_cor3.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ruination.Swapper 2.0.8/PenImc_cor3.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Ruination.Swapper 2.0.8/PenImc_cor3.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Ruination.Swapper 2.0.8/PresentationNative_cor3.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Ruination.Swapper 2.0.8/PresentationNative_cor3.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Ruination.Swapper 2.0.8/Ruination.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
Ruination.Swapper 2.0.8/Ruination.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral8
Sample
Ruination.Swapper 2.0.8/WebView2Loader.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Ruination.Swapper 2.0.8/WebView2Loader.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Ruination.Swapper 2.0.8/aspnetcorev2_inprocess.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Ruination.Swapper 2.0.8/aspnetcorev2_inprocess.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Ruination.Swapper 2.0.8/oo2core_9_win64.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Ruination.Swapper 2.0.8/oo2core_9_win64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Ruination.Swapper 2.0.8/vcruntime140_cor3.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Ruination.Swapper 2.0.8/vcruntime140_cor3.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Ruination.Swapper 2.0.8/wpfgfx_cor3.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Ruination.Swapper 2.0.8/wpfgfx_cor3.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Ruination.Swapper 2.0.8/wwwroot/aopaliance/lince/NVSPCAPS/_nvspcaps64.dll
Resource
win7-20240319-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Ruination.Swapper 2.0.8/wwwroot/aopaliance/lince/NVSPCAPS/_nvspcaps64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Ruination.Swapper 2.0.8/wwwroot/aopaliance/lince/Plugins/LocalSystem/_nvspserviceplugin64.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Ruination.Swapper 2.0.8/wwwroot/aopaliance/lince/Plugins/LocalSystem/_nvspserviceplugin64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/charsets.jar
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/charsets.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/deploy.jar
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/deploy.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/javaws.jar
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/javaws.jar
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/jsse.jar
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/jsse.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jce.jar
Resource
win7-20240319-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jce.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jfr.jar
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Errors
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-fil>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
General
- Target Ruination.Swapper 2.0.8.zip
- Size 27.5MB
- Sample240410-e6l16sgc8y
- SHA256 0bd48f713b543fa69cebab66718e20c33defff30e49894d0587ef2e5f6b6e5f9
- MD5 a88d448b3b371d86bf8203805d8fc810
- SHA1 5525fe99468900a2ba3720ffdb491b20a49fa4fe
- SHA512 0e65127941645adb48567b858b3bca12f0859d2c3f643d6e041748543402e68a5fe1c9cb6644ba4d060135712b9d0b62969094301cf0a2882a53b206715a2d57
- SSDEEP 786432:uHCVECYinW/SYwaZKbzOSRGOaXsk9+baGYnW:uHhSdlbzlRtk9Qj
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ruination.Swapper 2.0.8/Ruination.exe unpack001/Ruination.Swapper 2.0.8/oo2core_9_win64.dll
File Explorer
-
Ruination.Swapper 2.0.8.zip.zip 27.5MB
-
Ruination.Swapper 2.0.8/D3DCompiler_47_cor3.dll.dll 4.7MB
-
Ruination.Swapper 2.0.8/PenImc_cor3.dll.dll 158KB
-
Ruination.Swapper 2.0.8/PresentationNative_cor3.dll.dll 1.2MB
-
Ruination.Swapper 2.0.8/Ruination.exe.exe 550KB
-
Ruination.Swapper 2.0.8/Ruination.pdb24KB
-
Ruination.Swapper 2.0.8/WebView2Loader.dll.dll 154KB
-
Ruination.Swapper 2.0.8/WebviewAppShared.pdb397KB
-
Ruination.Swapper 2.0.8/aspnetcorev2_inprocess.dll.dll 376KB
-
Ruination.Swapper 2.0.8/items15.1MB
-
Ruination.Swapper 2.0.8/oo2core_9_win64.dll.dll 569KB
-
Ruination.Swapper 2.0.8/vcruntime140_cor3.dll.dll 116KB
-
Ruination.Swapper 2.0.8/wpfgfx_cor3.dll.dll 1.9MB
-
Ruination.Swapper 2.0.8/wwwroot/aopaliance/lince/NVSPCAPS/_nvspcaps64.dll.dll 2.7MB
-
Ruination.Swapper 2.0.8/wwwroot/aopaliance/lince/Plugins/LocalSystem/_nvspserviceplugin64.dll.dll 680KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/CIEXYZ.pf50KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/GRAY.pf632B
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/LINEAR_RGB.pf1KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/PYCC.pf268KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/accessibility.properties149B
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/calendars.properties1KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/charsets.jar.jar 2.9MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/classlist82KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/content-types.properties5KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/currency.data4KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/deploy.jar.jar 4.8MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/flavormap.properties3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/javaws.jar.jar 934KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/jsse.jar.jar 1.7MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/plugin.jar.jar 1.8MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/sRGB.pf3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/jvm.cfg634B
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/NVSPCAPS/_nvspcaps64.dll.dll 2.7MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/NvRemux.dll.dll 664KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/Plugins/LocalSystem/_nvspserviceplugin64.dll.dll 680KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/cudart64_55.dll.dll 296KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/ipccommon64.dll.dll 591KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/nvspscreenshot64.dll.dll 617KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaBrightDemiBold.ttf73KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaBrightDemiItalic.ttf73KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaBrightItalic.ttf78KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaBrightRegular.ttf336KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaSansDemiBold.ttf310KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaSansRegular.ttf681KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaTypewriterBold.ttf228KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaTypewriterRegular.ttf237KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/access-bridge-64.jar.jar 192KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/cldrdata.jar.jar 3.7MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/ffjcext.zip.zip .js 13KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/fontconfig.bfc3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/fontconfig.properties.src10KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/hijrah-config-umalqura.properties13KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/javafx.properties56B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jce.jar.jar 119KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jfr.jar.jar 563KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jfxswt.jar.jar 33KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jvm.hprof.txt4KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/logging.properties2KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/management-agent.jar.jar 382B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages.properties.jnlp 2KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_de.properties.jnlp 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_es.properties3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_fr.properties.jnlp 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_it.properties3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_ja.properties.jnlp 6KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_ko.properties.jnlp 5KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_pt_BR.properties.jnlp 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_sv.properties.jnlp 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_zh_CN.properties.jnlp 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_zh_HK.properties.jnlp 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_zh_TW.properties.jnlp 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/meta-index2KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/net.properties5KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/psfont.properties.ja2KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/psfontj2d.properties10KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/splash.gif.gif 8KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/[email protected].gif 14KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/splash_11-lic.gif.gif 7KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/[email protected].gif 11KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/dnsns.jar.jar 8KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/cursors.properties1KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/invalid32x32.gif.gif 153B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_CopyDrop32x32.gif.gif 165B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_CopyNoDrop32x32.gif.gif 153B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_LinkDrop32x32.gif.gif 168B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_LinkNoDrop32x32.gif.gif 153B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_MoveDrop32x32.gif.gif 147B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_MoveNoDrop32x32.gif.gif 153B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/jaccess.jar.jar 43KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/jfr/default.jfc.xml 20KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/jfr/profile.jfc.xml 20KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/jfxrt.jar.jar 17.4MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/localedata.jar.jar 2.1MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/management/jmxremote.access3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/management/jmxremote.password.template2KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/management/management.properties14KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/management/snmp.acl.template3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/meta-index1KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/nashorn.jar.jar 1.9MB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/blacklist3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/blacklisted.certs2KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/cacerts110KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/java.policy2KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/java.security55KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/javaws.policy98B
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/policy/limited/US_export_policy.jar.jar 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/policy/limited/local_policy.jar.jar 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/policy/unlimited/US_export_policy.jar.jar 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/policy/unlimited/local_policy.jar.jar 3KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/public_suffix_list.dat.zip 224KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/sunec.jar.jar 46KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/sunjce_provider.jar.jar 287KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/sunmscapi.jar.jar 48KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/sunpkcs11.jar.jar 287KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/ext/zipfs.jar.jar 68KB
-
Ruination.Swapper 2.0.8/wwwroot/backup/nvspapi64.dll.dll 1.8MB
Ruination.Swapper 2.0.8/D3DCompiler_47_cor3.dll
- IMPHASH 8235041cfd6fffb926142c2c78013446
- SHA256 b23e7b820ed5c6ea7dcd77817e2cd79f1cec9561d457172287ee634a8bd658c3
- MD5 03a60a6652caf4f49ea5912ce4e1b33c
- SHA1 a0d949d4af7b1048dc55e39d1d1260a1e0660c4f
- SHA512 6711d40d171ea200c92d062226a69f33eb41e9232d74291ef6f0202de73cf4dc54fbdd769104d2bb3e89dc2d81f2f2f3479e4258a5d6a54c545e56b07746b4c4
- SSDEEP 49152:xCZnRO4XyM53Rkq4ypQqdoRpmrgBVYvkaRwv/ZD0/WYLDltog/RfznLeHTRhFRNI:YG2QCS6HHzog/pznA7T6VP
- MD5 SHA1 SHA512 SSDEEP
Password
1313
PE Signature issue
Digest
80:5d:c5:12:35:5e:e1:23:cc:cd:fc:86:0b:c4:64:6d:59:c0:f9:e1:ad:8e:a3:f6:ea:5f:b1:cf:f9:7e:07:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
2702512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D3DCompiler_47.pdb
kernel32
WriteFile
FreeLibrary
Sleep
TlsAlloc
TlsSetValue
HeapDestroy
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
GetEnvironmentVariableA
VirtualFree
VirtualAlloc
GetSystemInfo
GetProcAddress
LoadLibraryExW
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetFilePointerEx
GetStringTypeW
ReadFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RaiseException
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
ReadConsoleW
HeapSize
HeapReAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionEx
RtlPcToFileHeader
LocalAlloc
LocalFree
GetFileSizeEx
GetLastError
CreateFileW
HeapFree
GetProcessHeap
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetFileAttributesW
SetFileAttributesW
DeleteFileW
SetEndOfFile
DeviceIoControl
MapViewOfFileEx
CreateFileMappingA
ExpandEnvironmentStringsW
HeapAlloc
OutputDebugStringA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
HeapCreate
GetModuleFileNameA
CreateFileA
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetDriveTypeW
GetCurrentDirectoryW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
MultiByteToWideChar
SetStdHandle
DisableThreadLibraryCalls
advapi32
CryptDestroyHash
CryptAcquireContextW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
CryptGetHashParam
CryptCreateHash
CryptHashData
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptReleaseContext
rpcrt4
UuidCreate
D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DCreateFunctionLinkingGraph
D3DCreateLinker
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DLoadModule
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReflectLibrary
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
916KB
Virtual Size
913KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=146, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=60, id=261, version=27316,
count=1, id=260, version=27316,
count=30, id=259, version=30795,
count=222, id=261, version=30795,
count=55, id=260, version=30795,
count=1, id=256, version=30795,
count=136, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Ruination.Swapper 2.0.8/PenImc_cor3.dll
- IMPHASH 4093c03428ffebcedcb974ab93290ca8
- SHA256 bed3c7f6cf295929504239543c8fd948ed9f53a032e5282399d57e8b03525da3
- MD5 f8852f500b48675d752c7aef6fbc8b30
- SHA1 d553939d34896fb0a80ccc31ce5250c4881a1340
- SHA512 e4a874c8168c5e0cdbedf951ddd5f1c0bc0e85b8f5da6a76a871927d3387bf3b26ba3a1c1ad2635b13d6186d80199888c53f9c6442cd988e6acd216cdc0145f1
- SSDEEP 3072:izAUq2kMBlUb8BQLBzDUw7aaHSuEm8WPuoATZ+AiRvsY4Jib:izHkMTvmLtDUw2huEmb2LbYv/
- MD5 SHA1 SHA512 SSDEEP
Password
1313
Digest
19:a2:11:49:b3:5f:3d:c9:8e:4a:88:08:ac:b2:b3:67:81:e8:61:f3:da:82:4d:a1:6f:b4:f2:cd:b4:e9:cd:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
78352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\bin\PenImc\x64\Release\PenImc_cor3.pdb
kernel32
SetThreadLocale
DeleteCriticalSection
RaiseException
DecodePointer
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
CreateEventW
GetCurrentProcessId
OpenEventW
OpenMutexW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEvent
LocalFree
SignalObjectAndWait
IsWow64Process
GetCurrentProcess
OutputDebugStringW
GetThreadLocale
CreateThread
QueueUserAPC
SetWaitableTimer
CancelWaitableTimer
CreateActCtxW
ActivateActCtx
VerSetConditionMask
LoadLibraryW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
RtlPcToFileHeader
InterlockedFlushSList
CreateMutexW
CloseHandle
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
lstrcmpiW
GetModuleHandleW
GetProcAddress
FreeLibrary
CreateWaitableTimerW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwindEx
RtlLookupFunctionEntry
GetCurrentThreadId
user32
GetWindow
GetWindowRect
CallNextHookEx
SetWindowsHookExW
EqualRect
GetParent
GetWindowThreadProcessId
CharNextW
PeekMessageW
MsgWaitForMultipleObjectsEx
IsWindow
UnhookWindowsHookEx
GetSystemMetrics
MonitorFromWindow
GetMonitorInfoW
GetDesktopWindow
advapi32
ConvertSidToStringSidW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
shell32
ShellExecuteExW
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoLockObjectExternal
StringFromGUID2
CoCreateInstance
CoGetApartmentType
oleaut32
UnRegisterTypeLi
VarUI4FromStr
LoadTypeLi
SysFreeString
RegisterTypeLi
SysStringLen
SysAllocString
api-ms-win-crt-string-l1-1-0
strcpy_s
wcscpy_s
wcscat_s
wcsncmp
wcsncpy_s
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
realloc
_recalloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_invalid_parameter_noinfo
abort
terminate
_initterm
_initterm_e
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_errno
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
rpcrt4
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrDllRegisterProxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
NdrDllUnregisterProxy
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
CreateResetEvent
DestroyResetEvent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetLastSystemEventData
GetPenEvent
GetPenEventMultiple
GetProxyDllInfo
LockWispObjectFromGit
RaiseResetEvent
RegisterDllForSxSCOM
UnlockWispObjectFromGit
Name
.text
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
197B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=46, id=261, version=33030,
count=11, id=260, version=33030,
count=17, id=259, version=33030,
count=3, id=260, version=27412,
count=15, id=257, version=27412,
count=170, id=1, productName=Unmarked objects,
count=13, id=264, version=33128,
count=1, id=256, version=33128,
count=1, id=255, version=33128,
count=1, id=151,
count=1, id=258, version=33128,
Ruination.Swapper 2.0.8/PresentationNative_cor3.dll
- IMPHASH a09c9abadde79aec9926dc99ee900a1a
- SHA256 e284235a4d6e5d905692351cdfe8bc42ed842df8e5a8eb42fde90d1c3e2e90fa
- MD5 0c147149b444748dae0a04e2e3d3269a
- SHA1 f7edbcd6d1d6b199b6c997d6b781a794d736d3ff
- SHA512 ec057829c03623cabc5a42ddebec9b75107f987eaf9cb642f3f1aed4d4c64c544f60a1dc7bc4208e025bce38c72091e615ac2fd9f1bd27651d49addcb0ae8b36
- SSDEEP 24576:TgqKM/uABRPKWdTCG9YQ9HnsWJP41rWVxFyG/YtiB5gda4HADUSjNrNmH7Sz5PMC:TMM/uAXKWdTCGgWJP4AVx8WYgB5g9HA9
- MD5 SHA1 SHA512 SSDEEP
Password
1313
Digest
43:b1:45:66:5e:a6:45:c8:7c:73:12:d5:7d:b9:0a:d8:a1:b7:c6:7d:dd:5f:a7:eb:57:90:8a:57:79:98:4e:6f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
5648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\bin\PresentationNative\x64\Release\PresentationNative_cor3.pdb
kernel32
UnhandledExceptionFilter
GetCurrentThread
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
TerminateThread
GetProcAddress
VerSetConditionMask
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
OutputDebugStringW
DeleteCriticalSection
DisableThreadLibraryCalls
LoadLibraryW
InitializeCriticalSection
InitializeCriticalSectionEx
GlobalDeleteAtom
DebugBreak
OutputDebugStringA
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
InterlockedFlushSList
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
EncodePointer
SetLastError
GetLastError
ntdll
RtlLookupFunctionEntry
DbgPrompt
RtlPcToFileHeader
RtlUnwindEx
DbgPrintEx
RtlCaptureContext
DbgBreakPoint
RtlVirtualUnwind
NtQuerySystemInformation
api-ms-win-crt-runtime-l1-1-0
terminate
abort
_cexit
_crt_atexit
_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
free
calloc
malloc
api-ms-win-crt-string-l1-1-0
strcpy_s
iswpunct
wcsncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
user32
GetAncestor
FindWindowExW
SetWindowLongPtrW
SetWindowLongW
SetScrollPos
SetFocus
MapWindowPoints
GetWindowTextLengthW
GetWindowTextW
GetWindowLongPtrW
GetWindowLongW
GetWindow
GetKeyboardLayoutList
GetParent
GetMenuBarInfo
EnableWindow
gdi32
GetTextExtentPoint32W
ole32
CoTaskMemFree
CoCreateInstance
oleaut32
SysAllocString
VariantInit
VariantChangeType
VariantClear
CreateDocContext
CreateInstalledObjectsInfo
CreateTextAnalysisSink
CreateTextAnalysisSource
DestroyDocContext
DestroyInstalledObjectsInfo
EnableWindowWrapper
FindWindowExWrapper
FsAddFigureObstacle
FsClearUpdateInfoInPage
FsClearUpdateInfoInSubpage
FsClearUpdateInfoInSubtrack
FsClearUpdateInfoInTableSrv
FsCommitFilledRectangle
FsCompareSubpages
FsCompareSubtrack
FsCompareTableSrv
FsCreateDocContext
FsCreateDummyFootnoteRejector
FsCreatePageBottomless
FsCreatePageFinite
FsCreateSubpageBottomless
FsCreateSubpageFinite
FsDestroyDocContext
FsDestroyFootnoteRejector
FsDestroyPage
FsDestroyPageBreakRecord
FsDestroySubpage
FsDestroySubpageBreakRecord
FsDestroySubtrack
FsDestroySubtrackBreakRecord
FsDestroyTableSrv
FsDestroyTableSrvBreakRecord
FsDuplicateGeometry
FsDuplicatePageBreakRecord
FsDuplicateSubpageBreakRecord
FsDuplicateSubtrackBreakRecord
FsDuplicateTableSrvBreakRecord
FsFAllFootnotesAllowed
FsFFootnoteAllowed
FsFormatSubtrackBottomless
FsFormatSubtrackFinite
FsFormatTableSrvBottomless
FsFormatTableSrvFinite
FsGetClientHandle
FsGetColumnRectangle
FsGetEmptySpaces
FsGetFigureObstacleData
FsGetFloaterFsimethods
FsGetIntervals
FsGetMaxNumberEmptySpaces
FsGetMaxNumberIntervals
FsGetNextTick
FsGetNumberSubpageFootnotes
FsGetNumberSubtrackFootnotes
FsGetPageRectangle
FsGetShiftOffset
FsGetSubpageColumnBalancingInfo
FsGetSubpageFootnoteInfo
FsGetSubtrackColumnBalancingInfo
FsGetSubtrackFootnoteInfo
FsGetTableObjFsimethods
FsGetTableSrvColumnBalancingInfo
FsGetTableSrvFootnoteInfo
FsGetTableSrvNumberFootnotes
FsJustifySubpage
FsQueryAttachedObjectList
FsQueryCompositeColumnDetails
FsQueryCompositeColumnFootnoteList
FsQueryDcpLineVariantsFromCachedTextPara
FsQueryEndnoteColumnDetails
FsQueryFigureObjectDetails
FsQueryFloaterDetails
FsQueryFootnoteColumnDetails
FsQueryFootnoteColumnTrackList
FsQueryHeightDefinedColumnSpanAreaList
FsQueryLineCompositeElementList
FsQueryLineListComposite
FsQueryLineListSingle
FsQueryPageDetails
FsQueryPageFootnoteColumnList
FsQueryPageSectionList
FsQuerySectionBasicColumnList
FsQuerySectionCompositeColumnList
FsQuerySectionDetails
FsQuerySectionEndnoteColumnList
FsQuerySegmentDefinedColumnSpanAreaList
FsQuerySubpageBasicColumnList
FsQuerySubpageDetails
FsQuerySubpageHeightDefinedColumnSpanAreaList
FsQuerySubpageSegmentDefinedColumnSpanAreaList
FsQuerySubtrackDetails
FsQuerySubtrackParaList
FsQueryTableObjCellList
FsQueryTableObjDetails
FsQueryTableObjFigureCountWord
FsQueryTableObjFigureListWord
FsQueryTableObjRowDetails
FsQueryTableObjRowList
FsQueryTableObjTableProperDetails
FsQueryTableSrvCellList
FsQueryTableSrvRowDetails
FsQueryTableSrvRowList
FsQueryTableSrvTableDetails
FsQueryTextDetails
FsQueryTrackDetails
FsQueryTrackParaList
FsRegisterFloatObstacle
FsReleaseGeometry
FsResolveOverlap
FsRestoreGeometry
FsShiftSubtrackVertical
FsSynchronizeBottomlessSubtrack
FsTransferDisplayInfoSubpage
FsTransferDisplayInfoSubtrack
FsTransferDisplayInfoTableSrv
FsTransformBbox
FsTransformPoint
FsTransformRectangle
FsTransformVector
FsUpdateBottomlessPage
FsUpdateBottomlessSubpage
FsUpdateBottomlessSubtrack
FsUpdateBottomlessTableSrv
FsUpdateFinitePage
GetAncestorWrapper
GetFloaterHandlerInfo
GetKeyboardLayoutListWrapper
GetMenuBarInfoWrapper
GetNumberSubstitutionList
GetParentWrapper
GetScriptAnalysisList
GetTableObjHandlerInfo
GetTextExtentPoint32Wrapper
GetWindowLongPtrWrapper
GetWindowLongWrapper
GetWindowTextLengthWrapper
GetWindowTextWrapper
GetWindowWrapper
GlobalDeleteAtomWrapper
IsPrintPackageTargetSupported
IsStartXpsPrintJobSupported
IsWindows10OrGreater
IsWindows10RS1OrGreater
IsWindows10RS2OrGreater
IsWindows10RS3OrGreater
IsWindows10RS4OrGreater
IsWindows10RS5OrGreater
IsWindows10TH1OrGreater
IsWindows10TH2OrGreater
IsWindows7OrGreater
IsWindows7SP1OrGreater
IsWindows8OrGreater
IsWindows8Point1OrGreater
IsWindowsServer
IsWindowsVistaOrGreater
IsWindowsVistaSP1OrGreater
IsWindowsVistaSP2OrGreater
IsWindowsXPOrGreater
IsWindowsXPSP1OrGreater
IsWindowsXPSP2OrGreater
IsWindowsXPSP3OrGreater
LateBoundStartXpsPrintJob
LoAcquireBreakRecord
LoAcquirePenaltyModule
LoCloneBreakRecord
LoCreateBreaks
LoCreateContext
LoCreateLine
LoCreateParaBreakingSession
LoDestroyContext
LoDisplayLine
LoDisposeBreakRecord
LoDisposeLine
LoDisposeParaBreakingSession
LoDisposePenaltyModule
LoEnumLine
LoGetEscString
LoGetPenaltyModuleInternalHandle
LoQueryLineCpPpoint
LoQueryLinePointPcp
LoRelievePenaltyResource
LoSetBreaking
LoSetDoc
LoSetTabs
LocbkGetObjectHandlerInfo
MILGetClassificationTables
MapWindowPointsWrapper
NlCreateHyphenator
NlDestroyHyphenator
NlGetClassObject
NlHyphenate
NlLoad
NlUnload
PrintToPackageTarget
SetFocusWrapper
SetScrollPosWrapper
SetWindowLongPtrWrapper
SetWindowLongWrapper
Name
.text
Size
951KB
Virtual Size
951KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=33, id=261, version=33030,
count=10, id=260, version=33030,
count=17, id=259, version=33030,
count=15, id=257, version=27412,
count=111, id=1, productName=Unmarked objects,
count=228, id=265, version=33128,
count=1, id=256, version=33128,
count=1, id=255, version=33128,
count=2, id=151,
count=1, id=258, version=33128,
Ruination.Swapper 2.0.8/Ruination.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9ccd6294ecc8f96465e1da62e5cb9760e15ab0d60b41398c91b0767ad18ae106
- MD5 f080b0a7566fd39312c19928b94536c0
- SHA1 f6a4a83899a18801203a07b3aec9507a934f377d
- SHA512 3c2edc28cf9a8c61baed70bbb7be9fbffce9ec4155f0f45c09f1ee9f5b37a0a160655150bef2f0f8c22593dd880ad8181118fa5ccd511d6b1fa17467b1fd6faf
- SSDEEP 12288:swh2gUTgJGbFqQmLQiwFEncOSb96IByw8NvrQdR:sw4HgJUFX3iwoSb94Mj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1313
Minor OS version
0
Major OS version
4
Entry point
13254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\tucd2rnjuxxnc\obj\Release\Beyound.pdb
mscoree
_CorExeMain
Name
.text
Size
547KB
Virtual Size
547KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ruination.Swapper 2.0.8/Ruination.pdb
- SHA256 694bef7018ca3e4bbb3391adad5de6525df2bbbe5249922c91c4e6bdcd182973
- MD5 5dd7c9208127ba2e4c8615564b706815
- SHA1 ed34a637da157da3aa79856e1d09f30adcc1989e
- SHA512 ce24ad2e5101aa207daf8dcfe6c96344d01bb7ba78e68045ceeaab803c59d84a21e4353fe66fa0b85b42b18d15b249b9cdb0df0deea3a4b2614c000ad53b9f23
- SSDEEP 768:HcQliHIPQNSJiM7P9kWpTzqFa7nMf9dH0KO:HxlQmPieq1rH0n
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/WebView2Loader.dll
- IMPHASH dc9fbafd0b96c0a640df70f088bfd2b0
- SHA256 824e7d6a57e7a107bf3982bf593315547f8e578f26994e51a2d7b984a58cee1c
- MD5 ff09a22bb8ff9c2a966e9e74a45c1201
- SHA1 3d1e636e6a9ee2951e7a4e15be3c1f2f4eb9d2f2
- SHA512 88ed65901eb0924c0f1e904607b45844d39e591314b097d8776a9b8b1ebfca3fb831d09a3f85bd7208a974fb63fc1131f9bd53f5c4936ce54a767b5fd4f857ed
- SSDEEP 3072:cZMDhmKsOKqS4Yvhl+XlOwcQTScZ6JiTesEtGYSY9k6+:cVSS4YZYXEVQThEt5a
- MD5 SHA1 SHA512 SSDEEP
Password
1313
PE Signature issue
Digest
7e:2e:49:05:9e:ae:a9:1c:3c:b9:6b:29:58:e2:66:98:0f:9e:66:cd:54:19:44:38:27:88:70:01:67:f2:50:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cf:a0:25:90:e3:13:04:ef:15:00:00:00:00:02:cf
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
2
Major OS version
5
Entry point
17520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
CloseHandle
CreateEventW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
92B
Characteristics
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.voltbl
Size
512B
Virtual Size
68B
Characteristics
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Ruination.Swapper 2.0.8/WebviewAppShared.pdb
- SHA256 014f2e5580e69e64a21db9e54f4bab2c11978ff87870fa52e3b40e78480ebf89
- MD5 2a1374341bd8c9722b128c86708b1fc7
- SHA1 82a65dab89c438a0559c43b455134c88c1f65fe3
- SHA512 6204ba4247ee4b9b656d7bc6a216c206338e790b1ed9bd54f3f9a7ac7e6b21237032b110c658698df03f11f9589552880de9869ad058350b80c6f282dcdbb83a
- SSDEEP 6144:rLF/cN4y3xQkypjbeus49Rp4NUSTSwKqPB2F:/F6Qn6ut/86
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/aspnetcorev2_inprocess.dll
- IMPHASH cf9e2a3365af497b12c61a3dddf05adb
- SHA256 8a794de04a8898b84724685cc99594a3ce856ea0910809840e2231a4599d241b
- MD5 ba8ca91731dc115e31ec734ba99ecda6
- SHA1 5b0fe195adc45927d769ec532a4b39297fe7ffd8
- SHA512 27d89d1e9cf4b1a57121b5a734ce881512138be2150c9ce8c0330175167414be78dd0af12ed7641059ac7e514ecabfa84285e27ce999542a154c62793671338c
- SSDEEP 6144:Rep+oqSYXq7wSKUN+PDEvmkEolnphAScg+dzDsQcldbc:4/BYa7wU+PDEvmolb+EPbc
- MD5 SHA1 SHA512 SSDEEP
Password
1313
PE Signature issue
Digest
47:34:af:c5:55:a1:ae:e5:f1:95:43:9f:71:ec:5e:4c:23:c2:8d:37:e6:31:d1:0c:a4:be:85:3d:dc:8c:9e:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
192512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\bin\InProcessRequestHandler\x64\Release\aspnetcorev2_inprocess.pdb
kernel32
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleExW
SetDllDirectoryW
CloseHandle
GetConsoleWindow
DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
LoadLibraryA
InitializeCriticalSection
IsDebuggerPresent
SetCurrentDirectoryW
GetLastError
SetEnvironmentVariableW
DisableThreadLibraryCalls
GetCurrentProcessId
InitializeSRWLock
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
EncodePointer
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
GetStringTypeW
QueryPerformanceCounter
GetFileInformationByHandleEx
AreFileApisANSI
SetLastError
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
GetProcessHeap
HeapLock
HeapUnlock
HeapWalk
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryDepthSList
GetCurrentProcessorNumber
GetSystemInfo
GetModuleHandleW
GetStdHandle
CreateFileW
FlushFileBuffers
SetFilePointer
WriteFile
OutputDebugStringW
DuplicateHandle
GetCurrentProcess
CompareStringOrdinal
WideCharToMultiByte
GetConsoleOutputCP
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CreateDirectoryW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetNativeSystemInfo
IsWow64Process
GetDllDirectoryW
CopyFileW
GetProcessTimes
FileTimeToSystemTime
GetProcAddress
LoadLibraryW
ReadFile
CreatePipe
CancelSynchronousIo
CreateThread
TerminateThread
GetExitCodeThread
AllocConsole
SetHandleInformation
GetExitCodeProcess
CreateProcessW
LocalFree
GetBinaryTypeW
SetStdHandle
GetFileAttributesW
HeapReAlloc
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ExitThread
QueueUserWorkItem
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
ReadDirectoryChangesW
RaiseException
EnterCriticalSection
LeaveCriticalSection
FormatMessageA
GetLocaleInfoEx
WaitForSingleObjectEx
GetCurrentThreadId
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
user32
GetWindowThreadProcessId
PostMessageW
EnumWindows
advapi32
RegCloseKey
RegQueryValueExW
ReportEventW
RegisterEventSourceW
RegGetValueW
RegOpenKeyExW
oleaut32
VariantClear
VariantInit
SysAllocString
VariantChangeType
SysFreeString
api-ms-win-crt-runtime-l1-1-0
terminate
_beginthreadex
_configure_narrow_argv
_seh_filter_dll
_initialize_narrow_environment
abort
_crt_atexit
_cexit
_initterm
_initterm_e
_errno
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_execute_onexit_table
_invalid_parameter_noinfo
_register_onexit_function
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsnicmp
isupper
strcpy_s
_wcsdup
wcsncmp
wcsnlen
__strncnt
toupper
strcspn
islower
api-ms-win-crt-stdio-l1-1-0
fseek
setvbuf
ungetc
__acrt_iob_func
freopen_s
fwrite
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
_fseeki64
fsetpos
_fileno
__stdio_common_vsnwprintf_s
fputws
fputwc
_dup
fread
fputc
fgetpos
fgetc
fflush
fclose
_dup2
_get_osfhandle
_get_stream_buffer_pointers
__stdio_common_vswprintf
__stdio_common_vsprintf
__stdio_common_vfwprintf
_wfsopen
_open_osfhandle
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
_callnewh
_aligned_malloc
_aligned_free
api-ms-win-crt-time-l1-1-0
_gmtime64_s
wcsftime
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
frexp
_dclass
_ldclass
_fdopen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
strtol
shell32
CommandLineToArgvW
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-crt-locale-l1-1-0
_unlock_locales
setlocale
_lock_locales
___lc_locale_name_func
__pctype_func
___mb_cur_max_func
localeconv
___lc_codepage_func
CreateApplication
get_hostfxr_path
http_cancel_io
http_close_connection
http_disable_buffering
http_enable_websockets
http_flush_response_bytes
http_get_application_properties
http_get_authentication_information
http_get_completion_info
http_get_raw_request
http_get_raw_response
http_get_server_variable
http_has_response4
http_indicate_completion
http_post_completion
http_read_request_bytes
http_reset_stream
http_response_set_known_header
http_response_set_need_goaway
http_response_set_trailer
http_response_set_unknown_header
http_set_completion_status
http_set_managed_context
http_set_response_status_code
http_set_server_variable
http_set_startup_error_page_content
http_stop_calls_into_managed
http_stop_incoming_requests
http_websockets_flush_bytes
http_websockets_read_bytes
http_websockets_write_bytes
http_write_response_bytes
register_callbacks
set_main_handler
Name
.text
Size
258KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33030,
count=18, id=259, version=33030,
count=84, id=261, version=33030,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=261, version=32822,
count=1, id=263, version=27412,
count=17, id=257, version=27412,
count=297, id=1, productName=Unmarked objects,
count=34, id=261, version=33130,
count=1, id=256, version=33130,
count=1, id=255, version=33130,
count=2, id=151,
count=1, id=258, version=33130,
Ruination.Swapper 2.0.8/items
- SHA256 04376e2f90ee39601ffe3097501b395d5d945641de0b482da515c99c6c4bb2fc
- MD5 44d1eb63df6b0b95069cf2654d2f4cce
- SHA1 e19c0c9ed91cc72ac56898524800907259b5a118
- SHA512 b1dcacb9538660b8a58447f31157c1f032c99b3d6d6a4e7ca0f2a5845ff9cbf7d48e686a5b8bf194f90402f16147e43deb1ef97fb66310ebb4b8e52750673106
- SSDEEP 49152:kuyzEJINmWhuUuVAH733R2uULp5TvnT+PfIXU4bwPF6WystxmbxWbc3W2gvzGlqN:fMU3eXtpcuX0HdQL
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/oo2core_9_win64.dll
- IMPHASH edbf2a036293674c2ebc72357df2b00a
- SHA256 19452ae1abae65e1305d3818354d4fae7b1200294322f0d9c6d5ddeb7bd9f978
- MD5 f2db01967705b62aecef3cd3e5a28e4d
- SHA1 4bcc73614cb8fd2b0bce8d0f91ee5f3202d9d624
- SHA512 d442fa32e7490bfb39ebf052d2d81cb52b504c26f25a710e83e3ef1e57abc428b3ee8d942777666af25c991ba84c458fa84cccccefcef67212499edfe5ac3a4c
- SSDEEP 12288:RAwwqEbT/SS2gyCmVV9FOhihV+kIy9k52je9sSZEjacR+V+nFKnGwnl6BdRMeu9q:RAwwqEbT/S3JCuQ0qRsSZAacRrRwnlt/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1313
Minor OS version
0
Major OS version
6
Entry point
483940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
v:\devel\projects\oodle2\cdepbuild\win64_release_dll\oo2core_9_win64.pdb
kernel32
OutputDebugStringA
HeapAlloc
HeapFree
GetProcessHeap
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
vcruntime140
_purecall
__C_specific_handler
__std_type_info_destroy_list
memset
memcpy
__CxxFrameHandler3
__std_terminate
memmove
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_execute_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initialize_onexit_table
_initterm
terminate
_cexit
_crt_atexit
_initialize_narrow_environment
_initterm_e
api-ms-win-crt-heap-l1-1-0
free
OodleCore_Plugin_DisplayAssertion_Default
OodleCore_Plugin_Free_Default
OodleCore_Plugin_MallocAligned_Default
OodleCore_Plugin_Printf_Default
OodleCore_Plugin_Printf_Verbose
OodleCore_Plugin_RunJob_Default
OodleCore_Plugin_WaitJob_Default
OodleCore_Plugins_SetAllocators
OodleCore_Plugins_SetAssertion
OodleCore_Plugins_SetJobSystem
OodleCore_Plugins_SetJobSystemAndCount
OodleCore_Plugins_SetPrintf
OodleKraken_Decode_Headerless
OodleLZDecoder_Create
OodleLZDecoder_DecodeSome
OodleLZDecoder_Destroy
OodleLZDecoder_MakeValidCircularWindowSize
OodleLZDecoder_MemorySizeNeeded
OodleLZDecoder_Reset
OodleLZLegacyVTable_InstallToCore
OodleLZ_CheckSeekTableCRCs
OodleLZ_Compress
OodleLZ_CompressOptions_GetDefault
OodleLZ_CompressOptions_Validate
OodleLZ_CompressionLevel_GetName
OodleLZ_Compressor_GetName
OodleLZ_CreateSeekTable
OodleLZ_Decompress
OodleLZ_FillSeekTable
OodleLZ_FindSeekEntry
OodleLZ_FreeSeekTable
OodleLZ_GetAllChunksCompressor
OodleLZ_GetChunkCompressor
OodleLZ_GetCompressScratchMemBound
OodleLZ_GetCompressedBufferSizeNeeded
OodleLZ_GetCompressedStepForRawStep
OodleLZ_GetDecodeBufferSize
OodleLZ_GetFirstChunkCompressor
OodleLZ_GetInPlaceDecodeBufferSize
OodleLZ_GetNumSeekChunks
OodleLZ_GetSeekEntryPackedPos
OodleLZ_GetSeekTableMemorySizeNeeded
OodleLZ_Jobify_GetName
OodleLZ_MakeSeekChunkLen
OodleLZ_ThreadPhased_BlockDecoderMemorySizeNeeded
Oodle_CheckVersion
Oodle_GetConfigValues
Oodle_LogHeader
Oodle_SetConfigValues
Oodle_SetUsageWarnings
Name
.text
Size
472KB
Virtual Size
471KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=17, id=261, version=26706,
count=8, id=260, version=26706,
count=3, id=259, version=26706,
count=3, id=257, version=26715,
count=55, id=1, productName=Unmarked objects,
count=11, productName=Unmarked objects (old),
count=70, id=261, version=27038,
count=1, id=256, version=27038,
count=1, id=258, version=27038,
Ruination.Swapper 2.0.8/vcruntime140_cor3.dll
- IMPHASH 7f07fd94e5bb907093556781cc464017
- SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
- MD5 be8dbe2dc77ebe7f88f910c61aec691a
- SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
- SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
- SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
- MD5 SHA1 SHA512 SSDEEP
Password
1313
PE Signature issue
Digest
ad:55:39:9d:70:70:f4:f3:a5:2a:ec:30:c8:36:4c:bc:53:5e:94:67:76:ba:fe:fe:52:2a:4f:6f:df:53:c2:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2024
PE Signature issue
Digest
ad:55:39:9d:70:70:f4:f3:a5:2a:ec:30:c8:36:4c:bc:53:5e:94:67:76:ba:fe:fe:52:2a:4f:6f:df:53:c2:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2024
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:e5:ce:9e:eb:de:4d:48:35:f4:00:00:00:00:00:e5
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 2, 2023 - Jan 31, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
67024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
strncmp
wcsncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsprintf_s
api-ms-win-crt-convert-l1-1-0
atol
kernel32
GetLastError
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
GetModuleHandleW
GetModuleFileNameW
RtlUnwind
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=21, id=259, version=33030,
count=16, id=260, version=33030,
count=31, id=261, version=33030,
count=1, id=256, version=33030,
count=1, id=255, version=33030,
count=1, id=258, version=33030,
Ruination.Swapper 2.0.8/wpfgfx_cor3.dll
- IMPHASH ac3b0abeae626484285b3156c68cdebc
- SHA256 bcce265100575aa0862fa899591b7289f39c7a6329dc930b431b6b6f3d561e12
- MD5 a2cd4d24a4cbcb71b92d662874d4ad1f
- SHA1 c663c3a7275cbc72bdfba66a5741e2135f307dec
- SHA512 eb48796e09fbbba15b9978bde4f074d41fe05ca7b2d620925c4db201a7f885a13bb4002c3c794cb0476bade7110d828cc7781179bc7ecfe4352b7f0fe4368b94
- SSDEEP 24576:coi3Wh3SvfhpukFvGOYzSMTJ4100b19r9gcBYJwguiJ+vlfmPcjjCmL7gXwh:kS+fnuGv8x8tr9gLJwS+dePca27gX8
- MD5 SHA1 SHA512 SSDEEP
Digest
90:e1:09:a7:e7:d5:f0:07:a4:57:ef:d2:37:7b:45:0d:9d:1e:96:4a:c8:98:b3:48:88:c4:ff:c8:17:b2:35:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
339792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\bin\wpfgfx\x64\Release\wpfgfx_cor3.pdb
kernel32
WaitForSingleObject
CloseHandle
CreateEventW
CreateThread
GetCurrentThreadId
ResetEvent
TryEnterCriticalSection
MulDiv
QueryPerformanceCounter
Sleep
FindResourceW
LoadResource
LockResource
GlobalUnlock
QueryPerformanceFrequency
InitializeSListHead
InterlockedPushEntrySList
QueryDepthSList
InterlockedFlushSList
SleepEx
RtlCaptureStackBackTrace
IsDebuggerPresent
ExitProcess
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
TerminateThread
GetCurrentThread
GetCurrentProcessId
SetThreadPriority
LoadLibraryExW
TryAcquireSRWLockExclusive
GetLocaleInfoEx
LocalFree
FormatMessageA
GetSystemTimeAsFileTime
SleepConditionVariableSRW
FindClose
FindFirstFileW
GetSystemDirectoryW
SystemTimeToFileTime
LoadLibraryA
LoadLibraryExA
DebugBreak
GetModuleFileNameW
FreeLibrary
OutputDebugStringW
LoadLibraryW
LeaveCriticalSection
GetVersionExW
SetEvent
EnterCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
GetLastError
DisableThreadLibraryCalls
IsProcessorFeaturePresent
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
EncodePointer
VerSetConditionMask
VirtualAlloc
VirtualFree
TerminateProcess
GetCurrentProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SizeofResource
GetTickCount
WaitForMultipleObjects
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemInfo
VirtualProtect
GetModuleHandleW
GetProcAddress
VirtualQuery
advapi32
UnregisterTraceGuids
RegQueryValueExW
RegCloseKey
AllocateLocallyUniqueId
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
TraceEvent
RegOpenKeyExW
ntdll
RtlClearBits
RtlFindClearBitsAndSet
RtlSetBits
RtlInitializeBitMap
DbgPrompt
NtQuerySystemInformation
DbgPrintEx
RtlInterlockedFlushSList
DbgBreakPoint
RtlCaptureContext
RtlUnwindEx
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlVirtualUnwind
user32
MonitorFromWindow
OffsetRect
GetMonitorInfoW
SystemParametersInfoW
EnumDisplaySettingsW
ClientToScreen
GetClientRect
InvalidateRect
GetWindowLongW
WindowFromDC
GetDC
GetParent
GetWindowDC
ScreenToClient
UpdateLayeredWindow
IsWindow
PeekMessageW
TranslateMessage
EqualRect
DispatchMessageW
SetLayeredWindowAttributes
GetWindowRect
EnumDisplayMonitors
EnumDisplayDevicesW
ReleaseDC
MsgWaitForMultipleObjects
GetDesktopWindow
GetGuiResources
RegisterWindowMessageW
PostMessageW
IsRectEmpty
SetRect
IntersectRect
gdi32
SetLayout
CreateCompatibleDC
CreatePalette
GetRandomRgn
SelectPalette
GetSystemPaletteEntries
GetDIBits
RealizePalette
OffsetRgn
GetRgnBox
SetRectRgn
CreateRectRgn
GetRegionData
RectInRegion
CombineRgn
CreateRectRgnIndirect
SelectObject
CreateDIBSection
DeleteObject
CreateICW
GetDeviceCaps
DeleteDC
BitBlt
CreateCompatibleBitmap
ole32
CoUninitialize
CoInitialize
CoCreateInstance
PropVariantClear
PropVariantCopy
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
d3dcompiler_47_cor3
D3DCompile
api-ms-win-crt-runtime-l1-1-0
abort
terminate
_seh_filter_dll
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_initialize_narrow_environment
_cexit
_initterm
_initterm_e
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-math-l1-1-0
exp
cosf
_isnan
_finite
floor
cos
ceilf
pow
fmod
fmodf
logf
_copysign
atan2f
modf
sin
sinf
sqrt
sqrtf
nextafterf
floorf
tan
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
strcpy_s
wcsncmp
api-ms-win-crt-utility-l1-1-0
qsort
GetNextPerfElementId
IWICColorContext_GetExifColorSpace_Proxy
IWICColorContext_GetProfileBytes_Proxy
IWICColorContext_GetType_Proxy
InteropDeviceBitmap_AddDirtyRect
InteropDeviceBitmap_Create
InteropDeviceBitmap_Detach
InteropDeviceBitmap_GetAsSoftwareBitmap
MIL3DCalcProjected2DBounds
MILAddRef
MILCreateEventProxy
MILCreateFactory
MILCreateStreamFromStreamDescriptor
MILFactoryCreateBitmapRenderTarget
MILFactoryCreateMediaPlayer
MILFactoryCreateSWRenderTargetForBitmap
MILIStreamWrite
MILLoadResource
MILMediaCanPause
MILMediaClose
MILMediaGetBufferingProgress
MILMediaGetDownloadProgress
MILMediaGetMediaLength
MILMediaGetNaturalHeight
MILMediaGetNaturalWidth
MILMediaGetPosition
MILMediaHasAudio
MILMediaHasVideo
MILMediaIsBuffering
MILMediaNeedUIFrameUpdate
MILMediaOpen
MILMediaProcessExitHandler
MILMediaSetBalance
MILMediaSetIsScrubbingEnabled
MILMediaSetPosition
MILMediaSetRate
MILMediaSetVolume
MILMediaShutdown
MILMediaStop
MILQueryInterface
MILRelease
MILRenderTargetBitmapClear
MILRenderTargetBitmapGetBitmap
MILSwDoubleBufferedBitmapAddDirtyRect
MILSwDoubleBufferedBitmapCreate
MILSwDoubleBufferedBitmapGetBackBuffer
MILSwDoubleBufferedBitmapProtectBackBuffer
MILUpdateSystemParametersInfo
MilChannel_AppendCommandData
MilChannel_BeginCommand
MilChannel_CloseBatch
MilChannel_CommitChannel
MilChannel_EndCommand
MilChannel_GetMarshalType
MilChannel_SetNotificationWindow
MilChannel_SetReceiveBroadcastMessages
MilCompositionEngine_DeinitializePartitionManager
MilCompositionEngine_EnterCompositionEngineLock
MilCompositionEngine_ExitCompositionEngineLock
MilCompositionEngine_GetComposedEventId
MilCompositionEngine_InitializePartitionManager
MilCompositionEngine_UpdateSchedulerSettings
MilComposition_PeekNextMessage
MilComposition_SyncFlush
MilComposition_WaitForNextMessage
MilConnection_CreateChannel
MilConnection_DestroyChannel
MilContent_AttachToHwnd
MilContent_DetachFromHwnd
MilGlyphRun_GetGlyphOutline
MilGlyphRun_ReleasePathGeometryData
MilPlayer_Create
MilPlayer_Process
MilResource_CreateCWICWrapperBitmap
MilResource_CreateOrAddRefOnChannel
MilResource_DuplicateHandle
MilResource_GetRefCountOnChannel
MilResource_ReleaseOnChannel
MilResource_SendCommand
MilResource_SendCommandBitmapSource
MilResource_SendCommandMedia
MilUtility_ArcToBezier
MilUtility_CopyPixelBuffer
MilUtility_GeometryGetArea
MilUtility_GetPointAtLengthFraction
MilUtility_GetTileBrushMapping
MilUtility_PathGeometryBounds
MilUtility_PathGeometryCombine
MilUtility_PathGeometryFlatten
MilUtility_PathGeometryHitTest
MilUtility_PathGeometryHitTestPathGeometry
MilUtility_PathGeometryOutline
MilUtility_PathGeometryWiden
MilUtility_PolygonBounds
MilUtility_PolygonHitTest
MilVersionCheck
MilVisualTarget_AttachToHwnd
MilVisualTarget_DetachFromHwnd
RenderOptions_ForceSoftwareRenderingModeForProcess
RenderOptions_IsSoftwareRenderingForcedForProcess
SetMilPerfInstrumentationFlags
WgxConnection_Create
WgxConnection_Disconnect
WgxConnection_SameThreadPresent
WgxConnection_ShouldForceSoftwareForGraphicsStreamClient
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
346KB
Virtual Size
345KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=263, version=27412,
count=1, id=261, version=27412,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=49, id=261, version=33030,
count=10, id=260, version=33030,
count=16, id=259, version=33030,
count=7, id=260, version=27412,
count=17, id=257, version=27412,
count=258, id=1, productName=Unmarked objects,
count=421, id=265, version=33128,
count=1, id=256, version=33128,
count=1, id=255, version=33128,
count=3, id=151,
count=1, id=258, version=33128,
Ruination.Swapper 2.0.8/wwwroot/aopaliance/lince/NVSPCAPS/_nvspcaps64.dll
- IMPHASH c27cb76bf211b8bcd4628bb3c785f146
- SHA256 caef12c56aea4ac3bb753567dfe550a231517e51c13431185131420968e5685e
- MD5 dfac0820398d9f403047fcf953df273e
- SHA1 63054c7b090cf28d3752b5bf0c1dbe7a412d147f
- SHA512 37533fc8ded43c9ad6cd52d47c1f4f535ba56dffd09f9cb71c21e9107b8b3b4dd400dd412c0a1d789bc590fca8223999142216f93f066664d82b70653273b795
- SSDEEP 24576:IpxtRcVVVVVVVVV8HhtrOKa3PH89wev0WFG2x8jneVOsU9sFyk5lnP2YJbz9STPQ:ex4VVVVVVVV6c32x8jns5t20QTP1q
- MD5 SHA1 SHA512 SSDEEP
Digest
4b:7d:5d:f4:ad:da:af:83:e0:e5:42:60:86:e7:68:43:ca:5e:b6:75:6c:6b:ae:6f:3a:18:3b:cc:27:93:13:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
2b:90:4c:82:c6:09:f4:e9:03:a9:fc:30:1b:26:cf:4c:74:db:c1:59
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
0
Major OS version
6
Entry point
39361
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dvs\p4\build\sw\rel\gfclient\rel_03_11\shadowplay2\server\win7_amd64_release\_nvspcaps64.pdb
kernel32
DeleteCriticalSection
LoadLibraryW
WideCharToMultiByte
GetCurrentProcessId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateThread
WaitForMultipleObjects
CreateSemaphoreA
ResetEvent
GetFileAttributesA
Sleep
TerminateProcess
GetExitCodeProcess
GetTickCount
OpenEventA
HeapFree
GetProcessHeap
CreateEventW
GetSystemTimeAsFileTime
OpenProcess
GetCurrentThreadId
GetThreadId
GetModuleHandleA
CreateDirectoryA
CreateFileA
OutputDebugStringA
GetLocalTime
GetModuleFileNameW
MoveFileExA
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
CreateDirectoryW
RemoveDirectoryW
GetTempPathW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
K32GetModuleFileNameExW
InitializeCriticalSectionEx
Process32FirstW
Process32NextW
SetCurrentDirectoryA
GetCurrentProcess
ProcessIdToSessionId
GetSystemDirectoryA
GetVersionExA
GetModuleFileNameA
GetVolumeInformationA
WTSGetActiveConsoleSessionId
K32GetProcessMemoryInfo
GetSystemTime
SystemTimeToFileTime
DeleteFileA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
QueryFullProcessImageNameA
RaiseException
DecodePointer
WriteFile
ReadFile
GetFileSizeEx
VerifyVersionInfoW
SetEndOfFile
ReadConsoleW
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
CloseHandle
lstrcmpA
LocalFree
LocalAlloc
LoadLibraryExW
GetModuleHandleW
CreateProcessW
CreateProcessA
SetLastError
OutputDebugStringW
GetFullPathNameW
GetFileAttributesW
CreateFileW
VerSetConditionMask
GetProcAddress
FreeLibrary
GetSystemDirectoryW
CreateWaitableTimerA
CancelWaitableTimer
SetWaitableTimer
GetLastError
CreateToolhelp32Snapshot
FlushFileBuffers
GetStringTypeW
SetConsoleCtrlHandler
GetACP
GetCurrentThread
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ReleaseMutex
OpenFileMappingA
CreateMutexA
OpenMutexA
CreateMutexW
OpenMutexW
OpenEventW
CreateFileMappingW
OpenFileMappingW
user32
FindWindowA
UnregisterClassA
WaitForInputIdle
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterDeviceNotificationA
UnregisterDeviceNotification
DefWindowProcA
PostQuitMessage
RegisterClassExA
GetWindow
EnumChildWindows
GetDesktopWindow
CreateWindowExA
GetWindowRect
IsWindowVisible
IsWindow
EnumDisplaySettingsExA
GetWindowThreadProcessId
EnumWindows
GetShellWindow
FindWindowExW
FindWindowW
GetWindowLongA
GetForegroundWindow
PostMessageA
SendMessageA
RedrawWindow
EnumDisplayDevicesA
EnumDisplaySettingsA
DestroyWindow
advapi32
RegCloseKey
ConvertStringSidToSidW
OpenSCManagerA
CloseServiceHandle
GetUserNameW
GetUserNameA
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
RegDeleteKeyValueA
RegSetValueExA
RegQueryValueExW
RegDeleteKeyExA
RegDeleteKeyA
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityInfo
RegQueryValueExA
RegOpenKeyExA
AllocateAndInitializeSid
CopySid
FreeSid
GetSecurityDescriptorDacl
GetTokenInformation
SetEntriesInAclA
shell32
SHGetPropertyStoreFromParsingName
SHGetKnownFolderPath
SHGetFolderPathW
SHGetFolderPathA
ole32
PropVariantClear
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
oleaut32
SetErrorInfo
VariantChangeType
GetErrorInfo
SysAllocStringLen
CreateErrorInfo
SysFreeString
VariantInit
VariantCopy
SysAllocString
VariantClear
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
shlwapi
PathFileExistsA
NvPluginGetInfo
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
319B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=24610,
count=6, id=259, version=24610,
count=162, id=261, version=24610,
count=1, id=199, version=41118,
count=10, id=259, version=25305,
count=21, id=260, version=25305,
count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=44, id=261, version=25305,
count=1, id=209, version=65501,
count=1, id=207, version=65501,
count=1, id=206, version=65501,
count=2, id=208, version=65501,
count=19, id=203, version=65501,
count=250, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2017 v15.3 build 25506, version=25506,
count=45, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=256, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,
Ruination.Swapper 2.0.8/wwwroot/aopaliance/lince/Plugins/LocalSystem/_nvspserviceplugin64.dll
- IMPHASH be4f48d4b1a7e383cbeb76503e3754ad
- SHA256 030df582ebd1b0e1ddef21e14b4de6ef292f983bc6541abab3416c0a45d46a68
- MD5 6a04bf5c5ca2fb95aac4714460246699
- SHA1 f37870c3a34c23beb2ce561d9402cb8e35b9ec14
- SHA512 ed50b8d4ab86aa255b536b203f4aea7188f4d1be2a87ae25e3557111bda27bb5016b52e6c210b7ec069cbd7a34d72a10f088125505c157f61a121e86a3bb65ae
- SSDEEP 12288:ViafQWasuH1mJO26zQVSBn4sVJGdDgr8yVgJKRvysH:kafHO26zKSJJGdDgr8q/ssH
- MD5 SHA1 SHA512 SSDEEP
Digest
41:75:97:62:96:e8:42:53:f9:0c:db:79:a8:db:c4:48:a8:9b:97:c0:a6:31:2b:a0:66:e0:09:0d:da:79:b3:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
c0:7b:96:9d:57:72:79:8b:4a:37:66:32:d7:ca:86:09:08:cd:37:3d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
0
Major OS version
6
Entry point
17421
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dvs\p4\build\sw\rel\gfclient\rel_03_11\shadowplay2\ServicePlugin\win7_amd64_release\_nvspserviceplugin64.pdb
shell32
SHGetFolderPathW
SHGetKnownFolderPath
ole32
CoTaskMemFree
advapi32
RegQueryValueExA
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
RegCloseKey
RegOpenKeyExA
SetSecurityInfo
OpenProcessToken
user32
WaitForInputIdle
UnregisterClassW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
kernel32
ReadFile
ReadConsoleW
WriteConsoleW
InitializeCriticalSectionEx
SetEndOfFile
SetFilePointerEx
SetStdHandle
GetStringTypeW
SetConsoleCtrlHandler
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
VerSetConditionMask
CreateFileW
GetFileAttributesW
GetFullPathNameW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
CreateProcessA
CreateProcessW
GetSystemDirectoryW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LocalAlloc
LocalFree
lstrcmpA
VerifyVersionInfoW
GetCurrentProcessId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateThread
WaitForMultipleObjects
CreateSemaphoreW
CreateDirectoryW
GetFileSizeEx
GetCurrentThreadId
GetLocalTime
GetModuleFileNameW
MoveFileExW
WideCharToMultiByte
SetCurrentDirectoryW
GetCurrentProcess
TerminateProcess
ProcessIdToSessionId
OpenProcess
GetSystemInfo
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
RemoveDirectoryW
DecodePointer
RaiseException
OutputDebugStringA
CreateSymbolicLinkW
GetLocaleInfoW
LCMapStringW
CompareStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
HeapFree
HeapAlloc
GetCurrentThread
GetACP
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
shlwapi
PathFileExistsW
NvPluginGetInfo
Name
.text
Size
505KB
Virtual Size
505KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
319B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=24610,
count=5, id=259, version=24610,
count=136, id=261, version=24610,
count=1, id=199, version=41118,
count=9, id=259, version=25305,
count=33, id=261, version=25305,
count=19, id=260, version=25305,
count=1, id=208, version=65501,
count=17, id=203, version=65501,
count=140, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2017 v15.3 build 25506, version=25506,
count=6, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=256, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/CIEXYZ.pf
- SHA256 207d748a76c10e5fa10ec7d0494e31ab72f2bacab591371f2e9653961321fe9c
- MD5 10f23396e21454e6bdfb0db2d124db85
- SHA1 b7779924c70554647b87c2a86159ca7781e929f8
- SHA512 f5c5f9fc3c4a940d684297493902fd46f6aa5248d2b74914ca5a688f0bad682831f6060e2264326d2ecb1f3544831eb1fa029499d1500ea4bfe3b97567fe8444
- SSDEEP 1536:2Qnt0y7xFNksbeCqY39JJ8GmaNo68GmaNo68GmaNoW:JOy7xXjtqYNfHxNo6HxNo6HxNoW
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/GRAY.pf
- SHA256 081caac386d968add4c2d722776e259380dcf78a306e14cc790b040ab876d424
- MD5 1002f18fc4916f83e0fc7e33dcc1fa09
- SHA1 27f93961d66b8230d0cdb8b166bc8b4153d5bc2d
- SHA512 334d932d395b46dfc619576b391f2adc2617e345aff032b592c25e333e853735da8b286ef7542eb19059cde8215cdcea147a3419ed56bdd6006ca9918d0618e1
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/LINEAR_RGB.pf
- SHA256 712036aa1951427d42e3e190e714f420ca8c2dd97ef01fcd0675ee54b920db46
- MD5 a387b65159c9887265babdef9ca8dae5
- SHA1 7913274c2f73bafcf888f09ff60990b100214ede
- SHA512 359d9b57215855f6794e47026c06036b93710998205d0817c6e602b2a24daeb92537c388f129407461fc60180198f02a236aeb349a17430ed7ac85a1e5f71350
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/PYCC.pf
- SHA256 48122294b5c08c69b7fe1db28904969dcb6edc9aa5076e3f8768bf48b76204d0
- MD5 24b9dee2469f9cc8ec39d5bdb3901500
- SHA1 4f7eed05b8f0eea7bcdc8f8f7aaeb1925ce7b144
- SHA512 d23ce2623de400216d249602486f21f66398b75196e80e447143d058a07438919a78ae0ed2ddf8e80d20bd70a635d51c9fb300e9f08a4751e00cd21883b88693
- SSDEEP 6144:nJleRNRyAnAqNaADEJHeeeeevoAuaiqwV6sg0pUjRVgYgI:nJleRNRpN0j3qhjRC9I
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/accessibility.properties
- SHA256 68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf
- MD5 2ed483df31645d3d00c625c00c1e5a14
- SHA1 27c9b302d2d47aae04fc1f4ef9127a2835a77853
- SHA512 4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/calendars.properties
- SHA256 1169fcba1385b8e4baccbd8156a43e3179c26e1877cc154bd16ff23874b208ea
- MD5 3f731b169e01a9efe3e19a1f40679c9a
- SHA1 531a6316953fc152809601806fec55e1be806700
- SHA512 81c03e0b1cf93c873ea495cb6f434fa5fa41f02cfd7dc399e859c565e52e2e942e3ed04d4025f1e4f114ddb180503a5f97ff88fd4c41bb1c810afb0f03b93ec6
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/charsets.jar
- SHA256 30b3b694efd41128b01ef192182ce48656973866e2b64754a9bca6683fcde90a
- MD5 395bf6081334f01b8a33b3d636756a86
- SHA1 d6321f1155fff108b5a11f9953a7ecd61620859c
- SHA512 049ee9fe16e0a3992b52ba6abba7fd3a5007e86665f21487a57a4294370fa096b18dc29636eb81fe1470d6fdbe25a15b31b4d1b3ab21e9fddfd7de57fa1dc1ab
- SSDEEP 49152:osixGz1n4jCewNvUc/pItUcT1nvv4clbIyWNN:osiMzNFZb2/n3ZlbI9
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/classlist
- SHA256 01fe24232d0dbefe339f88c44a3fd3d99ff0e17ae03926ccf90b835332f5f89c
- MD5 7fc71a62d85ccf12996680a4080aa44e
- SHA1 199dccaa94e9129a3649a09f8667b552803e1d0e
- SHA512 b0b9b486223cf79ccf9346aaf5c1ca0f9588247a00c826aa9f3d366b7e2ef905af4d179787dcb02b32870500fd63899538cf6fafcdd9b573799b255f658ceb1d
- SSDEEP 1536:4X/nxfn5rxLyMznYolTzlff5OK3COHoHNG5rb/cxNwmCX1g86K2oWdAqNqc+KMjD:qxn5rxLyMzbf5OK3CJNG51g86A
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/content-types.properties
- SHA256 46f47b3883c7244a819ae1161113fe9d2375f881b75c9b3012d7a6b3497e030a
- MD5 f507712b379fdc5a8d539811faf51d02
- SHA1 82bb25303cf6835ac4b076575f27e8486dab9511
- SHA512 cb3c99883336d04c42cea9c2401e81140ecbb7fc5b8ef3301b13268a45c1ac93fd62176ab8270b91528ac8e938c7c90cc9663d8598e224794354546139965dfe
- SSDEEP 96:r45Vf4fq7MBzO4pYEZ2MQ6KXr3NO0slzMX+W1CuHvvABbiAQ+xaW/ioLHTU+Wsch:r4KJO4mEZ2MQ6Cr3NO0slzMX+WIuHvvv
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/currency.data
- SHA256 9174361aa1251f9d6d55263ed0ad44ef4c58ca26b7937808b609b46fec06950b
- MD5 59cff2dd57555a994a9546a7c5d066c3
- SHA1 0bf9bf04670e62c9bea8a995b4afe4af3738fc8f
- SHA512 358f2acd2de4957177ea624c5ce1c5596317f425b03d99b23d0727671c440e1034f52cb390568082dfc756c72c1dd9015ddcf9110c52b7184c05f35f1222929e
- SSDEEP 48:xlWAFFGFSupi9VBjOtF8CSh8kkC6/wU4XRr/bVdxe+0fBJ:xlWAEi9VBjOtzSh8kk0/pdTkr
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/deploy.jar
- SHA256 f4e95eea5514653e0d01c99378d482c41d4833857b796a535c8f47e178b54c75
- MD5 8654ed204f7b53b562f7bfdbf7270d51
- SHA1 4aeb57be056d2ae09127f0b02b53fd99c0dcfec5
- SHA512 46cdf45fb73ba1785ce7259b071011b8a0d457bb83020effd6408dfae9a9a9b2a9f2dfa68841f23713dea1c65e1929ec70fdff2642b970840f4e5473847484ca
- SSDEEP 49152:grlLf03SJ+vH8wi7pmb7kfBIp5pdu6jHtfRVA+vr:NZn1Re+vr
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/flavormap.properties
- SHA256 c2748e07b59398cc40cacccd47fc98a70c562f84067e9272383b45a8df72a692
- MD5 d8b47b11e300ef3e8be3e6e50ac6910b
- SHA1 2d5ed3b53072b184d67b1a4e26aec2df908ddc55
- SHA512 8c5f3e1619e8a92b9d9cf5932392b1cb9f77625316b9eef447e4dce54836d90951d9ee70ffd765482414dd51b816649f846e40fd07b4fbdd5080c056adbbae6f
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/javaws.jar
- SHA256 396f2d3154756a58a802e2d3a8cd87a04da832168f3ca06a75285cbadee1f6b8
- MD5 a08cee1608602206e191168dcc103542
- SHA1 a8feff3b2aa2fd53c32eab195ef87268f66ef6c2
- SHA512 db0ed2c2b4d133a98d1ad0007f34d41dadda1d3196fa90712fb7d55e074aaad7ebaf15c6cc4d2ba6ecab649d513296b7de32acb82851c0234978b9f40fd413f1
- SSDEEP 6144:4IkXEYiwz2aWlyAQmwCBitgVE49L2ugHHz274rZzd5AHYa3hztQofKJMNFty+jsQ:IETlyIBSa2DaozCPZ
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/jsse.jar
- SHA256 7b125f8fe4815faa5be93db0cd7152ae70a7034d889a06f085b11141e80b619c
- MD5 a01a8f6587e34d3ab4497b6c1e92b663
- SHA1 6781d859142209309fec84ebfc833b049f9c6997
- SHA512 d8f8508c8012ce0b3bc525d8eba5667aca5719785e66785f215a90356480202edd084fac10aa8458cf19c83f889555c17f86491352f6b5e1d58f2a3f84459964
- SSDEEP 12288:mj1qLoQa9DEwXKwxQqd1mcTIfMgocoNTPHOQwa3:mj1rzXKwxTdnT20cCH
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/plugin.jar
- SHA256 7e386b771f7728c62a120e1f1c13fbe40526e59856552fb21661a9611f6f181b
- MD5 6788225da55a061cab584c7b589e9c6a
- SHA1 dae115736a68f1a6e7b5e3a7b30531a3c0d74483
- SHA512 cce73bf7da384136fb5dc181e3a4cbad4c6f9dc94033de0a76da39734e9a297f38e2dacb370e8827a7df94e1b91519262a00b6c113eca7a32e0d8e8e1e24a68b
- SSDEEP 12288:R7qUN6A8uJBLvaU0TUX+Bk3PmgXOK9U+C:RGUN1VJNGczXOwC
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/cmm/sRGB.pf
- SHA256 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
- MD5 1d3fda2edb4a89ab60a23c5f7c7d81dd
- SHA1 9eaea0911d89d63e39e95f2e2116eaec7e0bb91e
- SHA512 16aae81acf757036634b40fb8b638d3eba89a0906c7f95bd915bc3579e3be38c7549ee4cd3f344ef0a17834ff041f875b9370230042d20b377c562952c47509b
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/amd64/jvm.cfg
- SHA256 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
- MD5 499f2a4e0a25a41c1ff80df2d073e4fd
- SHA1 e2469cbe07e92d817637be4e889ebb74c3c46253
- SHA512 7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/NVSPCAPS/_nvspcaps64.dll
- IMPHASH c27cb76bf211b8bcd4628bb3c785f146
- SHA256 caef12c56aea4ac3bb753567dfe550a231517e51c13431185131420968e5685e
- MD5 dfac0820398d9f403047fcf953df273e
- SHA1 63054c7b090cf28d3752b5bf0c1dbe7a412d147f
- SHA512 37533fc8ded43c9ad6cd52d47c1f4f535ba56dffd09f9cb71c21e9107b8b3b4dd400dd412c0a1d789bc590fca8223999142216f93f066664d82b70653273b795
- SSDEEP 24576:IpxtRcVVVVVVVVV8HhtrOKa3PH89wev0WFG2x8jneVOsU9sFyk5lnP2YJbz9STPQ:ex4VVVVVVVV6c32x8jns5t20QTP1q
- MD5 SHA1 SHA512 SSDEEP
Digest
4b:7d:5d:f4:ad:da:af:83:e0:e5:42:60:86:e7:68:43:ca:5e:b6:75:6c:6b:ae:6f:3a:18:3b:cc:27:93:13:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
2b:90:4c:82:c6:09:f4:e9:03:a9:fc:30:1b:26:cf:4c:74:db:c1:59
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
0
Major OS version
6
Entry point
39361
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dvs\p4\build\sw\rel\gfclient\rel_03_11\shadowplay2\server\win7_amd64_release\_nvspcaps64.pdb
kernel32
DeleteCriticalSection
LoadLibraryW
WideCharToMultiByte
GetCurrentProcessId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateThread
WaitForMultipleObjects
CreateSemaphoreA
ResetEvent
GetFileAttributesA
Sleep
TerminateProcess
GetExitCodeProcess
GetTickCount
OpenEventA
HeapFree
GetProcessHeap
CreateEventW
GetSystemTimeAsFileTime
OpenProcess
GetCurrentThreadId
GetThreadId
GetModuleHandleA
CreateDirectoryA
CreateFileA
OutputDebugStringA
GetLocalTime
GetModuleFileNameW
MoveFileExA
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
CreateDirectoryW
RemoveDirectoryW
GetTempPathW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
K32GetModuleFileNameExW
InitializeCriticalSectionEx
Process32FirstW
Process32NextW
SetCurrentDirectoryA
GetCurrentProcess
ProcessIdToSessionId
GetSystemDirectoryA
GetVersionExA
GetModuleFileNameA
GetVolumeInformationA
WTSGetActiveConsoleSessionId
K32GetProcessMemoryInfo
GetSystemTime
SystemTimeToFileTime
DeleteFileA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
QueryFullProcessImageNameA
RaiseException
DecodePointer
WriteFile
ReadFile
GetFileSizeEx
VerifyVersionInfoW
SetEndOfFile
ReadConsoleW
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
CloseHandle
lstrcmpA
LocalFree
LocalAlloc
LoadLibraryExW
GetModuleHandleW
CreateProcessW
CreateProcessA
SetLastError
OutputDebugStringW
GetFullPathNameW
GetFileAttributesW
CreateFileW
VerSetConditionMask
GetProcAddress
FreeLibrary
GetSystemDirectoryW
CreateWaitableTimerA
CancelWaitableTimer
SetWaitableTimer
GetLastError
CreateToolhelp32Snapshot
FlushFileBuffers
GetStringTypeW
SetConsoleCtrlHandler
GetACP
GetCurrentThread
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ReleaseMutex
OpenFileMappingA
CreateMutexA
OpenMutexA
CreateMutexW
OpenMutexW
OpenEventW
CreateFileMappingW
OpenFileMappingW
user32
FindWindowA
UnregisterClassA
WaitForInputIdle
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterDeviceNotificationA
UnregisterDeviceNotification
DefWindowProcA
PostQuitMessage
RegisterClassExA
GetWindow
EnumChildWindows
GetDesktopWindow
CreateWindowExA
GetWindowRect
IsWindowVisible
IsWindow
EnumDisplaySettingsExA
GetWindowThreadProcessId
EnumWindows
GetShellWindow
FindWindowExW
FindWindowW
GetWindowLongA
GetForegroundWindow
PostMessageA
SendMessageA
RedrawWindow
EnumDisplayDevicesA
EnumDisplaySettingsA
DestroyWindow
advapi32
RegCloseKey
ConvertStringSidToSidW
OpenSCManagerA
CloseServiceHandle
GetUserNameW
GetUserNameA
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
RegDeleteKeyValueA
RegSetValueExA
RegQueryValueExW
RegDeleteKeyExA
RegDeleteKeyA
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityInfo
RegQueryValueExA
RegOpenKeyExA
AllocateAndInitializeSid
CopySid
FreeSid
GetSecurityDescriptorDacl
GetTokenInformation
SetEntriesInAclA
shell32
SHGetPropertyStoreFromParsingName
SHGetKnownFolderPath
SHGetFolderPathW
SHGetFolderPathA
ole32
PropVariantClear
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
oleaut32
SetErrorInfo
VariantChangeType
GetErrorInfo
SysAllocStringLen
CreateErrorInfo
SysFreeString
VariantInit
VariantCopy
SysAllocString
VariantClear
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
shlwapi
PathFileExistsA
NvPluginGetInfo
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
319B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=24610,
count=6, id=259, version=24610,
count=162, id=261, version=24610,
count=1, id=199, version=41118,
count=10, id=259, version=25305,
count=21, id=260, version=25305,
count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=44, id=261, version=25305,
count=1, id=209, version=65501,
count=1, id=207, version=65501,
count=1, id=206, version=65501,
count=2, id=208, version=65501,
count=19, id=203, version=65501,
count=250, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2017 v15.3 build 25506, version=25506,
count=45, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=256, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/NvRemux.dll
- IMPHASH 32239a8689b43baf17eaf1d56db9bedf
- SHA256 fabcfa2956579919b28289fbf27dc31816b958512e54f58544740155fa362393
- MD5 301802a68433adeed2f5bade486ee4d5
- SHA1 eb84b9cd4b95488bab3f85947b229718e64fa1e7
- SHA512 e165830792a267d03aea7398b7c483753606b90e929bd8e75ed527e02b23c43b2245165ad5766c2194768b3524fb1f159fc49a7bd21500961e590b5f205d974d
- SSDEEP 12288:OnVt5PlEgrgbHyxP2MjwTkV5EiMzKjjZl7WT4A:OVySjwQV5rFjdRWc
- MD5 SHA1 SHA512 SSDEEP
Digest
a9:bf:a3:7a:20:3e:4f:0d:f8:e7:47:c1:bf:54:ae:e0:2a:80:8c:57:98:1d:e5:66:bb:e7:04:8a:53:3d:40:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
9a:ae:69:9d:72:4a:08:91:a2:6b:32:ce:33:19:5f:4d:21:f1:46:b2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
0
Major OS version
6
Entry point
5546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\dvs\p4\build\sw\rel\gfclient\rel_03_11\shadowplay2\mux\remux\win7_x86_release\NvRemux.pdb
shell32
SHGetKnownFolderPath
SHGetPropertyStoreFromParsingName
SHGetFolderPathW
ole32
CoUninitialize
CoInitializeEx
CoTaskMemFree
PropVariantClear
oleaut32
VariantClear
SysFreeString
SetErrorInfo
GetErrorInfo
SysAllocString
VariantInit
VariantChangeType
CreateErrorInfo
mfplat
MFStartup
MFShutdown
mfreadwrite
MFCreateSourceReaderFromURL
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetSecurityInfo
user32
PostThreadMessageW
kernel32
SetEndOfFile
HeapReAlloc
HeapSize
SetFilePointerEx
SetStdHandle
ReadFile
SetConsoleCtrlHandler
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
ReadConsoleW
WriteConsoleW
DecodePointer
GetStringTypeW
SetUnhandledExceptionFilter
LCMapStringW
CompareStringW
VerSetConditionMask
ExpandEnvironmentStringsW
CreateFileW
GetFileAttributesW
GetFullPathNameW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
GetCurrentProcess
CreateProcessA
CreateProcessW
GetSystemDirectoryW
FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LocalAlloc
LocalFree
lstrcmpA
lstrcmpW
VerifyVersionInfoW
GetVolumeInformationW
GetVersionExW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
CreateDirectoryW
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetFileSizeEx
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetModuleFileNameW
MoveFileExW
WideCharToMultiByte
GetSystemTime
SystemTimeToFileTime
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
CreateThread
GetThreadId
UnhandledExceptionFilter
OutputDebugStringA
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetCurrentThread
GetACP
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
_CreateInstance@0
Name
.text
Size
444KB
Virtual Size
444KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
174KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=24610,
count=138, id=261, version=24610,
count=18, id=260, version=24610,
count=1, id=199, version=41118,
count=19, id=259, version=25305,
count=18, id=260, version=25305,
count=1, id=209, version=65501,
count=2, id=206, version=65501,
count=37, id=261, version=25305,
count=17, id=203, version=65501,
count=137, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2017 v15.3 build 25506, version=25506,
count=7, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=256, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/Plugins/LocalSystem/_nvspserviceplugin64.dll
- IMPHASH be4f48d4b1a7e383cbeb76503e3754ad
- SHA256 030df582ebd1b0e1ddef21e14b4de6ef292f983bc6541abab3416c0a45d46a68
- MD5 6a04bf5c5ca2fb95aac4714460246699
- SHA1 f37870c3a34c23beb2ce561d9402cb8e35b9ec14
- SHA512 ed50b8d4ab86aa255b536b203f4aea7188f4d1be2a87ae25e3557111bda27bb5016b52e6c210b7ec069cbd7a34d72a10f088125505c157f61a121e86a3bb65ae
- SSDEEP 12288:ViafQWasuH1mJO26zQVSBn4sVJGdDgr8yVgJKRvysH:kafHO26zKSJJGdDgr8q/ssH
- MD5 SHA1 SHA512 SSDEEP
Digest
41:75:97:62:96:e8:42:53:f9:0c:db:79:a8:db:c4:48:a8:9b:97:c0:a6:31:2b:a0:66:e0:09:0d:da:79:b3:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
c0:7b:96:9d:57:72:79:8b:4a:37:66:32:d7:ca:86:09:08:cd:37:3d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
0
Major OS version
6
Entry point
17421
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dvs\p4\build\sw\rel\gfclient\rel_03_11\shadowplay2\ServicePlugin\win7_amd64_release\_nvspserviceplugin64.pdb
shell32
SHGetFolderPathW
SHGetKnownFolderPath
ole32
CoTaskMemFree
advapi32
RegQueryValueExA
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
RegCloseKey
RegOpenKeyExA
SetSecurityInfo
OpenProcessToken
user32
WaitForInputIdle
UnregisterClassW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
kernel32
ReadFile
ReadConsoleW
WriteConsoleW
InitializeCriticalSectionEx
SetEndOfFile
SetFilePointerEx
SetStdHandle
GetStringTypeW
SetConsoleCtrlHandler
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
VerSetConditionMask
CreateFileW
GetFileAttributesW
GetFullPathNameW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
CreateProcessA
CreateProcessW
GetSystemDirectoryW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LocalAlloc
LocalFree
lstrcmpA
VerifyVersionInfoW
GetCurrentProcessId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateThread
WaitForMultipleObjects
CreateSemaphoreW
CreateDirectoryW
GetFileSizeEx
GetCurrentThreadId
GetLocalTime
GetModuleFileNameW
MoveFileExW
WideCharToMultiByte
SetCurrentDirectoryW
GetCurrentProcess
TerminateProcess
ProcessIdToSessionId
OpenProcess
GetSystemInfo
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
RemoveDirectoryW
DecodePointer
RaiseException
OutputDebugStringA
CreateSymbolicLinkW
GetLocaleInfoW
LCMapStringW
CompareStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
HeapFree
HeapAlloc
GetCurrentThread
GetACP
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
shlwapi
PathFileExistsW
NvPluginGetInfo
Name
.text
Size
505KB
Virtual Size
505KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
319B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=24610,
count=5, id=259, version=24610,
count=136, id=261, version=24610,
count=1, id=199, version=41118,
count=9, id=259, version=25305,
count=33, id=261, version=25305,
count=19, id=260, version=25305,
count=1, id=208, version=65501,
count=17, id=203, version=65501,
count=140, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2017 v15.3 build 25506, version=25506,
count=6, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=256, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/cudart64_55.dll
- IMPHASH 843c192c7d7896462173279e0cd57f3b
- SHA256 f6d2e11b1e57be0c816f9a9ba5a94fce569a7884fc3771c23ddbb49127a8d194
- MD5 2b4e5f399eee805bfa25626704615a53
- SHA1 d2aec91d560eec69e4fc2b6b8964292e7da4537a
- SHA512 26d8359f58b5386ee48761f51fc2bed9d8e593c9e057a5791b3abcc8eb8febcee4da2283470944496e6a7cc7d2a63255f731944c02eb145ba3dcbdfa67e0bb2d
- SSDEEP 6144:H34rX7AGjLfcPOC+gBsxqT2ltwShG65M8:H34rX7AGjLfGJ+gyj5M
- MD5 SHA1 SHA512 SSDEEP
Digest
b0:b0:e0:3e:5d:b1:77:b7:a5:6b:4c:43:ef:21:11:36:b5:fc:77:1a:e8:ba:19:98:3c:4f:c5:e9:6c:5d:cc:be
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
ea:1d:f0:ca:ec:41:65:f4:b1:7f:12:3b:2a:06:3c:f8:21:b7:c8:04
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
2
Major OS version
5
Entry point
165688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
FlushFileBuffers
GetProcAddress
FreeLibrary
LoadLibraryA
QueryPerformanceCounter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThreadId
CloseHandle
SwitchToThread
GetLastError
GetModuleFileNameA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapCreate
GetModuleHandleW
ExitProcess
DecodePointer
EncodePointer
FlsSetValue
GetCommandLineA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryW
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
WriteFile
GetStdHandle
GetModuleFileNameW
HeapSize
SetHandleCount
GetStartupInfoW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
MultiByteToWideChar
GetStringTypeW
WriteConsoleW
CreateFileW
NvOptimusEnablementCuda
__cudaRegisterDeviceFunction
__cudaRegisterFatBinary
__cudaRegisterFunction
__cudaRegisterPrelinkedFatBinary
__cudaRegisterShared
__cudaRegisterSharedVar
__cudaRegisterSurface
__cudaRegisterTexture
__cudaRegisterVar
__cudaUnregisterFatBinary
cudaArrayGetInfo
cudaBindSurfaceToArray
cudaBindTexture
cudaBindTexture2D
cudaBindTextureToArray
cudaBindTextureToMipmappedArray
cudaChooseDevice
cudaConfigureCall
cudaCreateChannelDesc
cudaCreateSurfaceObject
cudaCreateTextureObject
cudaD3D10GetDevice
cudaD3D10GetDevices
cudaD3D10GetDirect3DDevice
cudaD3D10MapResources
cudaD3D10RegisterResource
cudaD3D10ResourceGetMappedArray
cudaD3D10ResourceGetMappedPitch
cudaD3D10ResourceGetMappedPointer
cudaD3D10ResourceGetMappedSize
cudaD3D10ResourceGetSurfaceDimensions
cudaD3D10ResourceSetMapFlags
cudaD3D10SetDirect3DDevice
cudaD3D10UnmapResources
cudaD3D10UnregisterResource
cudaD3D11GetDevice
cudaD3D11GetDevices
cudaD3D11GetDirect3DDevice
cudaD3D11SetDirect3DDevice
cudaD3D9Begin
cudaD3D9End
cudaD3D9GetDevice
cudaD3D9GetDevices
cudaD3D9GetDirect3DDevice
cudaD3D9MapResources
cudaD3D9MapVertexBuffer
cudaD3D9RegisterResource
cudaD3D9RegisterVertexBuffer
cudaD3D9ResourceGetMappedArray
cudaD3D9ResourceGetMappedPitch
cudaD3D9ResourceGetMappedPointer
cudaD3D9ResourceGetMappedSize
cudaD3D9ResourceGetSurfaceDimensions
cudaD3D9ResourceSetMapFlags
cudaD3D9SetDirect3DDevice
cudaD3D9UnmapResources
cudaD3D9UnmapVertexBuffer
cudaD3D9UnregisterResource
cudaD3D9UnregisterVertexBuffer
cudaDestroySurfaceObject
cudaDestroyTextureObject
cudaDeviceCanAccessPeer
cudaDeviceDisablePeerAccess
cudaDeviceEnablePeerAccess
cudaDeviceGetAttribute
cudaDeviceGetByPCIBusId
cudaDeviceGetCacheConfig
cudaDeviceGetLimit
cudaDeviceGetPCIBusId
cudaDeviceGetSharedMemConfig
cudaDeviceGetStreamPriorityRange
cudaDeviceReset
cudaDeviceSetCacheConfig
cudaDeviceSetLimit
cudaDeviceSetSharedMemConfig
cudaDeviceSynchronize
cudaDriverGetVersion
cudaEventCreate
cudaEventCreateWithFlags
cudaEventDestroy
cudaEventElapsedTime
cudaEventQuery
cudaEventRecord
cudaEventSynchronize
cudaFree
cudaFreeArray
cudaFreeHost
cudaFreeMipmappedArray
cudaFuncGetAttributes
cudaFuncSetCacheConfig
cudaFuncSetSharedMemConfig
cudaGLGetDevices
cudaGLMapBufferObject
cudaGLMapBufferObjectAsync
cudaGLRegisterBufferObject
cudaGLSetBufferObjectMapFlags
cudaGLSetGLDevice
cudaGLUnmapBufferObject
cudaGLUnmapBufferObjectAsync
cudaGLUnregisterBufferObject
cudaGetChannelDesc
cudaGetDevice
cudaGetDeviceCount
cudaGetDeviceProperties
cudaGetErrorString
cudaGetExportTable
cudaGetLastError
cudaGetMipmappedArrayLevel
cudaGetSurfaceObjectResourceDesc
cudaGetSurfaceReference
cudaGetSymbolAddress
cudaGetSymbolSize
cudaGetTextureAlignmentOffset
cudaGetTextureObjectResourceDesc
cudaGetTextureObjectResourceViewDesc
cudaGetTextureObjectTextureDesc
cudaGetTextureReference
cudaGraphicsD3D10RegisterResource
cudaGraphicsD3D11RegisterResource
cudaGraphicsD3D9RegisterResource
cudaGraphicsGLRegisterBuffer
cudaGraphicsGLRegisterImage
cudaGraphicsMapResources
cudaGraphicsResourceGetMappedMipmappedArray
cudaGraphicsResourceGetMappedPointer
cudaGraphicsResourceSetMapFlags
cudaGraphicsSubResourceGetMappedArray
cudaGraphicsUnmapResources
cudaGraphicsUnregisterResource
cudaHostAlloc
cudaHostGetDevicePointer
cudaHostGetFlags
cudaHostRegister
cudaHostUnregister
cudaIpcCloseMemHandle
cudaIpcGetEventHandle
cudaIpcGetMemHandle
cudaIpcOpenEventHandle
cudaIpcOpenMemHandle
cudaLaunch
cudaMalloc
cudaMalloc3D
cudaMalloc3DArray
cudaMallocArray
cudaMallocHost
cudaMallocMipmappedArray
cudaMallocPitch
cudaMemGetInfo
cudaMemcpy
cudaMemcpy2D
cudaMemcpy2DArrayToArray
cudaMemcpy2DAsync
cudaMemcpy2DFromArray
cudaMemcpy2DFromArrayAsync
cudaMemcpy2DToArray
cudaMemcpy2DToArrayAsync
cudaMemcpy3D
cudaMemcpy3DAsync
cudaMemcpy3DPeer
cudaMemcpy3DPeerAsync
cudaMemcpyArrayToArray
cudaMemcpyAsync
cudaMemcpyFromArray
cudaMemcpyFromArrayAsync
cudaMemcpyFromSymbol
cudaMemcpyFromSymbolAsync
cudaMemcpyPeer
cudaMemcpyPeerAsync
cudaMemcpyToArray
cudaMemcpyToArrayAsync
cudaMemcpyToSymbol
cudaMemcpyToSymbolAsync
cudaMemset
cudaMemset2D
cudaMemset2DAsync
cudaMemset3D
cudaMemset3DAsync
cudaMemsetAsync
cudaPeekAtLastError
cudaPointerGetAttributes
cudaProfilerInitialize
cudaProfilerStart
cudaProfilerStop
cudaRuntimeGetVersion
cudaSetDevice
cudaSetDeviceFlags
cudaSetDoubleForDevice
cudaSetDoubleForHost
cudaSetValidDevices
cudaSetupArgument
cudaStreamAddCallback
cudaStreamCreate
cudaStreamCreateWithFlags
cudaStreamCreateWithPriority
cudaStreamDestroy
cudaStreamGetFlags
cudaStreamGetPriority
cudaStreamQuery
cudaStreamSynchronize
cudaStreamWaitEvent
cudaThreadExit
cudaThreadGetCacheConfig
cudaThreadGetLimit
cudaThreadSetCacheConfig
cudaThreadSetLimit
cudaThreadSynchronize
cudaUnbindTexture
cudaWGLGetDevice
Name
.text
Size
194KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=95, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=119, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/ipccommon64.dll
- IMPHASH a31bc150fd5eb667acc500380648124a
- SHA256 13e10f26ea6623f854cab11e28ce7bb97bc6b4b7490b44c054fbf263ee1de340
- MD5 90a9d0b784a144fa418c4b1724aa7f29
- SHA1 bf1db791ac00468756cf16f0ec89c438f0831057
- SHA512 da9928f885180926d65c0f031591a2689a31a43f63a261e551980de637a3014712ceb2a52e434d9cc2d068ab7b2d6f417dbd8305620418bad60e9cc5e7a8e15c
- SSDEEP 6144:ziqf3sq4Ivjea2vwObfTkNfcvObZSyZWu3AGcLHO1qvxmupqKxHc:bf3sq4ZpPpOhWulcLHO1qvxwK
- MD5 SHA1 SHA512 SSDEEP
Digest
0c:89:df:7d:85:34:aa:5e:aa:9a:ee:57:e2:2a:47:d4:37:09:6b:cf:c4:12:e0:3e:a3:4b:a2:37:be:1f:c5:a7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
45:3e:8e:09:45:58:76:b0:f8:e1:08:38:66:10:bf:f2:fc:20:bd:3e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
0
Major OS version
6
Entry point
179716
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dvs\p4\build\sw\rel\gfclient\rel_03_11\shadowplay2\common\ipcwrapper\win7_amd64_release\ipccommon64.pdb
shell32
SHGetFolderPathA
advapi32
SetSecurityInfo
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
messagebus
getMessageBusInterface
releaseMessageBusInterface
libprotobuf
?ListFields@GeneratedMessageReflection@internal@protobuf@google@@UEBAXAEBVMessage@34@PEAV?$vector@PEBVFieldDescriptor@protobuf@google@@V?$allocator@PEBVFieldDescriptor@protobuf@google@@@std@@@std@@@Z
?MutableMessage@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEAVMessage@34@PEAV534@PEBVFieldDescriptor@34@PEAVMessageFactory@34@@Z
?MutableRawRepeatedField@GeneratedMessageReflection@internal@protobuf@google@@MEBAPEAXPEAVMessage@34@PEBVFieldDescriptor@34@W4CppType@634@HPEBVDescriptor@34@@Z
?MutableRepeatedMessage@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEAVMessage@34@PEAV534@PEBVFieldDescriptor@34@H@Z
?MutableUnknownFields@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEAVUnknownFieldSet@34@PEAVMessage@34@@Z
?ReleaseLast@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEAVMessage@34@PEAV534@PEBVFieldDescriptor@34@@Z
?ReleaseMessage@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEAVMessage@34@PEAV534@PEBVFieldDescriptor@34@PEAVMessageFactory@34@@Z
?RemoveLast@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@@Z
?SetAllocatedMessage@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@0PEBVFieldDescriptor@34@@Z
?SetBool@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@_N@Z
?SetDouble@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@N@Z
?SetEnum@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@PEBVEnumValueDescriptor@34@@Z
?InitializationErrorString@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?SetInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@H@Z
?SetInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@_J@Z
?SetRepeatedBool@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@H_N@Z
?SetRepeatedDouble@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@HN@Z
?SetRepeatedEnum@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@HPEBVEnumValueDescriptor@34@@Z
?SetRepeatedFloat@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@HM@Z
?SetRepeatedInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@HH@Z
?SetRepeatedInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@H_J@Z
?SetRepeatedString@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@HAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetRepeatedUInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@HI@Z
?SetRepeatedUInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@H_K@Z
?SetString@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetUInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@I@Z
?SetUInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@_K@Z
?SpaceUsed@GeneratedMessageReflection@internal@protobuf@google@@UEBAHAEBVMessage@34@@Z
?SpaceUsed@Message@protobuf@google@@UEBAHXZ
?Swap@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@0@Z
?SwapElements@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@HH@Z
?SwapFields@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@0AEBV?$vector@PEBVFieldDescriptor@protobuf@google@@V?$allocator@PEBVFieldDescriptor@protobuf@google@@@std@@@std@@@Z
??_7FunctionClosure0@internal@protobuf@google@@6B@
?HasOneof@GeneratedMessageReflection@internal@protobuf@google@@UEBA_NAEBVMessage@34@PEBVOneofDescriptor@34@@Z
?HasField@GeneratedMessageReflection@internal@protobuf@google@@UEBA_NAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetUnknownFields@GeneratedMessageReflection@internal@protobuf@google@@UEBAAEBVUnknownFieldSet@34@AEBVMessage@34@@Z
?GetUInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBA_KAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetUInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAIAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetTypeName@Message@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetStringReference@GeneratedMessageReflection@internal@protobuf@google@@UEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@34@PEBVFieldDescriptor@34@PEAV56@@Z
?GetString@GeneratedMessageReflection@internal@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetRepeatedUInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBA_KAEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetRepeatedUInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAIAEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetRepeatedStringReference@GeneratedMessageReflection@internal@protobuf@google@@UEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@34@PEBVFieldDescriptor@34@HPEAV56@@Z
?GetRepeatedString@GeneratedMessageReflection@internal@protobuf@google@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetRepeatedMessage@GeneratedMessageReflection@internal@protobuf@google@@UEBAAEBVMessage@34@AEBV534@PEBVFieldDescriptor@34@H@Z
?GetRepeatedInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBA_JAEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetRepeatedInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAHAEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetRepeatedFloat@GeneratedMessageReflection@internal@protobuf@google@@UEBAMAEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetRepeatedEnum@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEBVEnumValueDescriptor@34@AEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetRepeatedDouble@GeneratedMessageReflection@internal@protobuf@google@@UEBANAEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetRepeatedBool@GeneratedMessageReflection@internal@protobuf@google@@UEBA_NAEBVMessage@34@PEBVFieldDescriptor@34@H@Z
?GetReflection@Message@protobuf@google@@UEBAPEBVReflection@23@XZ
?GetOneofFieldDescriptor@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEBVFieldDescriptor@34@AEBVMessage@34@PEBVOneofDescriptor@34@@Z
?GetMessage@GeneratedMessageReflection@internal@protobuf@google@@UEBAAEBVMessage@34@AEBV534@PEBVFieldDescriptor@34@PEAVMessageFactory@34@@Z
?GetInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBA_JAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAHAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetFloat@GeneratedMessageReflection@internal@protobuf@google@@UEBAMAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetEnum@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEBVEnumValueDescriptor@34@AEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetDouble@GeneratedMessageReflection@internal@protobuf@google@@UEBANAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?GetBool@GeneratedMessageReflection@internal@protobuf@google@@UEBA_NAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?FindKnownExtensionByNumber@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEBVFieldDescriptor@34@H@Z
?FindKnownExtensionByName@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEBVFieldDescriptor@34@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?FieldSize@GeneratedMessageReflection@internal@protobuf@google@@UEBAHAEBVMessage@34@PEBVFieldDescriptor@34@@Z
?DiscardUnknownFields@Message@protobuf@google@@UEAAXXZ
?ClearOneof@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVOneofDescriptor@34@@Z
?ClearField@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@@Z
?CheckTypeAndMergeFrom@Message@protobuf@google@@UEAAXAEBVMessageLite@23@@Z
?AddUInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@_K@Z
?AddUInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@I@Z
?AddString@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?AddMessage@GeneratedMessageReflection@internal@protobuf@google@@UEBAPEAVMessage@34@PEAV534@PEBVFieldDescriptor@34@PEAVMessageFactory@34@@Z
?AddInt64@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@_J@Z
?AddInt32@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@H@Z
?AddFloat@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@M@Z
?AddEnum@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@PEBVEnumValueDescriptor@34@@Z
?AddDouble@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@N@Z
?AddBool@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@_N@Z
?VerifyUTF8StringFallback@WireFormat@internal@protobuf@google@@CAXPEBDHW4Operation@1234@0@Z
?ComputeUnknownFieldsSize@WireFormat@internal@protobuf@google@@SAHAEBVUnknownFieldSet@34@@Z
?SerializeUnknownFieldsToArray@WireFormat@internal@protobuf@google@@SAPEAEAEBVUnknownFieldSet@34@PEAE@Z
?SerializeUnknownFields@WireFormat@internal@protobuf@google@@SAXAEBVUnknownFieldSet@34@PEAVCodedOutputStream@io@34@@Z
?SkipField@WireFormat@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@IPEAVUnknownFieldSet@34@@Z
?Merge@ReflectionOps@internal@protobuf@google@@SAXAEBVMessage@34@PEAV534@@Z
??1GeneratedMessageReflection@internal@protobuf@google@@UEAA@XZ
??0GeneratedMessageReflection@internal@protobuf@google@@QEAA@PEBVDescriptor@23@PEBVMessage@23@QEBHHHHPEBVDescriptorPool@23@PEAVMessageFactory@23@H@Z
?BytesSize@WireFormatLite@internal@protobuf@google@@SAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?StringSize@WireFormatLite@internal@protobuf@google@@SAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WriteEnumNoTagToArray@WireFormatLite@internal@protobuf@google@@SAPEAEHPEAE@Z
?WriteMessageMaybeToArray@WireFormatLite@internal@protobuf@google@@SAXHAEBVMessageLite@34@PEAVCodedOutputStream@io@34@@Z
?WriteBytesMaybeAliased@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?WriteStringMaybeAliased@WireFormatLite@internal@protobuf@google@@SAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAVCodedOutputStream@io@34@@Z
?WriteEnum@WireFormatLite@internal@protobuf@google@@SAXHHPEAVCodedOutputStream@io@34@@Z
?WriteBool@WireFormatLite@internal@protobuf@google@@SAXH_NPEAVCodedOutputStream@io@34@@Z
?WriteUInt32@WireFormatLite@internal@protobuf@google@@SAXHIPEAVCodedOutputStream@io@34@@Z
?ReadBytes@WireFormatLite@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ReadString@WireFormatLite@internal@protobuf@google@@SA_NPEAVCodedInputStream@io@34@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?VarintSize32Fallback@CodedOutputStream@io@protobuf@google@@CAHI@Z
?WriteVarint32FallbackToArray@CodedOutputStream@io@protobuf@google@@CAPEAEIPEAE@Z
?WriteTagToArray@CodedOutputStream@io@protobuf@google@@SAPEAEIPEAE@Z
?WriteVarint32SignExtendedToArray@CodedOutputStream@io@protobuf@google@@SAPEAEHPEAE@Z
?WriteVarint32ToArray@CodedOutputStream@io@protobuf@google@@SAPEAEIPEAE@Z
?WriteStringWithSizeToArray@CodedOutputStream@io@protobuf@google@@SAPEAEAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAE@Z
?PopLimit@CodedInputStream@io@protobuf@google@@QEAAXH@Z
?PushLimit@CodedInputStream@io@protobuf@google@@QEAAHH@Z
?ExpectAtEnd@CodedInputStream@io@protobuf@google@@QEAA_NXZ
?ExpectTag@CodedInputStream@io@protobuf@google@@QEAA_NI@Z
?ReadTagWithCutoff@CodedInputStream@io@protobuf@google@@QEAA?AU?$pair@I_N@std@@I@Z
?ReadVarint64@CodedInputStream@io@protobuf@google@@QEAA_NPEA_K@Z
?ReadVarint32@CodedInputStream@io@protobuf@google@@QEAA_NPEAI@Z
?ClearFallback@UnknownFieldSet@protobuf@google@@AEAAXXZ
?AddVarint@UnknownFieldSet@protobuf@google@@QEAAXH_K@Z
?Swap@UnknownFieldSet@protobuf@google@@QEAAXPEAV123@@Z
?MergeFrom@UnknownFieldSet@protobuf@google@@QEAAXAEBV123@@Z
?empty@UnknownFieldSet@protobuf@google@@QEBA_NXZ
??1UnknownFieldSet@protobuf@google@@QEAA@XZ
??0UnknownFieldSet@protobuf@google@@QEAA@XZ
?Swap@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXPEAV1234@@Z
?Reserve@RepeatedPtrFieldBase@internal@protobuf@google@@IEAAXH@Z
?InternalRegisterGeneratedMessage@MessageFactory@protobuf@google@@SAXPEBVDescriptor@23@PEBVMessage@23@@Z
?InternalRegisterGeneratedFile@MessageFactory@protobuf@google@@SAXPEBDP6AXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z@Z
?generated_factory@MessageFactory@protobuf@google@@SAPEAV123@XZ
??1Message@protobuf@google@@UEAA@XZ
?InternalAddGeneratedFile@DescriptorPool@protobuf@google@@SAXPEBXH@Z
?FindFileByName@DescriptorPool@protobuf@google@@QEBAPEBVFileDescriptor@23@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?generated_pool@DescriptorPool@protobuf@google@@SAPEBV123@XZ
?GetEmptyString@internal@protobuf@google@@YAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GoogleOnceInitImpl@protobuf@google@@YAXPEA_JPEAVClosure@12@@Z
?OnShutdown@internal@protobuf@google@@YAXP6AXXZ@Z
??1FunctionClosure0@internal@protobuf@google@@UEAA@XZ
??4LogFinisher@internal@protobuf@google@@QEAAXAEAVLogMessage@123@@Z
??6LogMessage@internal@protobuf@google@@QEAAAEAV0123@PEBD@Z
??1LogMessage@internal@protobuf@google@@QEAA@XZ
??0LogMessage@internal@protobuf@google@@QEAA@W4LogLevel@23@PEBDH@Z
?VerifyVersion@internal@protobuf@google@@YAXHHPEBD@Z
?SerializeToString@MessageLite@protobuf@google@@QEBA_NPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ParseFromArray@MessageLite@protobuf@google@@QEAA_NPEBXH@Z
?GetEmptyStringAlreadyInited@internal@protobuf@google@@YAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?SetFloat@GeneratedMessageReflection@internal@protobuf@google@@UEBAXPEAVMessage@34@PEBVFieldDescriptor@34@M@Z
kernel32
GetLastError
SetEvent
ResetEvent
CreateEventA
ReadConsoleW
ReadFile
SetEndOfFile
SetStdHandle
SetFilePointerEx
GetStringTypeW
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateSemaphoreW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetModuleFileNameA
SetConsoleCtrlHandler
GetStartupInfoW
FatalAppExitA
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetCurrentThread
IsDebuggerPresent
HeapSize
MultiByteToWideChar
AreFileApisANSI
ExitProcess
IsProcessorFeaturePresent
GetCommandLineA
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
DecodePointer
EncodePointer
VerifyVersionInfoW
lstrcmpA
LocalFree
LocalAlloc
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemDirectoryW
CreateProcessW
CreateProcessA
SetLastError
OutputDebugStringW
GetFullPathNameW
GetFileAttributesW
CreateFileW
VerSetConditionMask
WideCharToMultiByte
MoveFileExA
GetModuleFileNameW
GetLocalTime
GetCurrentThreadId
OutputDebugStringA
GetFileSizeEx
CreateFileA
CreateDirectoryA
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
WaitForMultipleObjects
GetCurrentProcessId
CloseHandle
CreateIpcClient
CreateIpcProxyInterface
Name
.text
Size
398KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=140, id=224, version=20806,
count=12, id=223, version=20806,
count=55, id=225, version=20806,
count=4, id=221, productName=VS2013 build 21005, version=21005,
count=7, id=203, version=65501,
count=251, id=1, productName=Unmarked objects,
count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=5, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Ruination.Swapper 2.0.8/wwwroot/backup/applet/ShadowPlay/nvspscreenshot64.dll
- IMPHASH 08d773bb983bd578690d34f825b20422
- SHA256 cde3694deac003e0bc5244dd1c7d4cb6bd886997d1a7bb5a2fbbaac9b5ffd4f1
- MD5 9bd3b14254d39125bb72aa9064acc41c
- SHA1 8f1a6d7417be798687d9091ea7249a770aca6f3c
- SHA512 c40555fff8b6b7f8ded5e2710a124d5023ab37b1cae1c3d25961e60982decd186823db44ae35956863a280036ffb2c71099d98f64fbb0588679a9a8afa2d6767
- SSDEEP 12288:7UbPdnIzZ7uOow+J737lG3izJqK8BPNT:obPpIzZ7uOb+J737lG3ilqK8BPNT
- MD5 SHA1 SHA512 SSDEEP
Digest
f5:c4:f7:fa:7a:65:6b:ff:eb:5b:68:da:a3:af:47:03:c3:12:6b:83:d5:83:f3:a9:91:5e:11:60:3a:cb:e2:96
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
4d:1b:3b:29:80:e2:4d:4f:1b:ff:50:96:c9:de:9b:2d:e6:26:26:c0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
0
Major OS version
6
Entry point
15891
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dvs\p4\build\sw\rel\gfclient\rel_03_11\shadowplay2\screenshot\win7_amd64_release\nvspscreenshot64.pdb
shell32
SHGetFolderPathA
gdiplus
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipSetPropertyItem
GdipGetImageEncoders
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipSaveImageToFile
advapi32
SetEntriesInAclA
InitializeSecurityDescriptor
GetTokenInformation
GetSecurityDescriptorDacl
GetLengthSid
FreeSid
CopySid
AllocateAndInitializeSid
OpenProcessToken
SetSecurityDescriptorDacl
SetSecurityInfo
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32
IsValidLocale
GetUserDefaultLCID
GetLocaleInfoW
LCMapStringW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcessId
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
CreateDirectoryA
CreateFileA
GetFileSizeEx
OutputDebugStringA
GetLastError
GetCurrentThreadId
GetLocalTime
EnumSystemLocalesW
MoveFileExA
WideCharToMultiByte
ReleaseMutex
UnmapViewOfFile
OpenFileMappingA
HeapAlloc
HeapFree
GetProcessHeap
CreateMutexA
OpenEventA
GetCurrentProcess
MapViewOfFile
LocalAlloc
LocalFree
OpenMutexA
CreateFileMappingA
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FreeEnvironmentStringsW
GetStringTypeW
SetStdHandle
SetFilePointerEx
CreateFileW
HeapSize
HeapReAlloc
SetEndOfFile
ReadFile
GetModuleFileNameW
ReadConsoleW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EncodePointer
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleHandleExW
WriteConsoleW
ExitProcess
MultiByteToWideChar
WriteFile
OutputDebugStringW
SetConsoleCtrlHandler
GetCurrentThread
GetACP
FlushFileBuffers
GetConsoleCP
GetConsoleMode
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
SetEnvironmentVariableA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
NvCreateScreenshotInterface
NvReleaseScreenshotInterface
Name
.text
Size
463KB
Virtual Size
463KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
319B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=24610,
count=5, id=259, version=24610,
count=138, id=261, version=24610,
count=1, id=199, version=41118,
count=9, id=259, version=25305,
count=33, id=261, version=25305,
count=18, id=260, version=25305,
count=11, id=203, version=65501,
count=143, id=1, productName=Unmarked objects,
count=7, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=256, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaBrightDemiBold.ttf
- SHA256 72cee3e6df72ad577af49c59dca2d0541060f95a881845950595e5614c486244
- MD5 af0c5c24ef340aea5ccac002177e5c09
- SHA1 b5c97f985639e19a3b712193ee48b55dda581fd1
- SHA512 6ce87441e223543394b7242ac0cb63505888b503ec071bbf7db857b5c935b855719b818090305e17c1197de882ccc90612fb1e0a0e5d2731f264c663eb8da3f9
- SSDEEP 768:H8Jwt1GIlZ6l0/9tRWhc0x/YxvsTjyIDXCrGU/tlDaKAgKrTLznvzDJIZmjFA0zG:Mwtze9xQcQ/LDaKAgK3LLvzFogbFt5WD
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaBrightDemiItalic.ttf
- SHA256 895c5262cdb6297c13725515f849ed70609dbd7c49974a382e8bbfe4a3d75f8c
- MD5 793ae1ab32085c8de36541bb6b30da7c
- SHA1 1fd1f757febf3e5f5fbb7fbf7a56587a40d57de7
- SHA512 a92addd0163f6d81c3aeabd63ff5c293e71a323f4aedfb404f6f1cde7f84c2a995a30dfec84a9caf8ffaf8e274edd0d7822e6aabb2b0608696a360cabfc866c6
- SSDEEP 1536:lww80sTGzcKHwxWL0T+qHi/sbA06PoNORsr5sOnD0OyuusGa7bs4J:lwL0i97WL0T+qHA9cOR05FD0Oyup74w
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaBrightItalic.ttf
- SHA256 d68819a70b60ff68ca945ef5ad358c31829e43ec25024a99d17174c626575e06
- MD5 4d666869c97cdb9e1381a393ffe50a3a
- SHA1 aa5c037865c563726ecd63d61ca26443589be425
- SHA512 1d1f61e371e4a667c90c2ce315024ae6168e47fe8a5c02244dbf3df26e8ac79f2355ac7e36d4a81d82c52149197892daed1b4c19241575256bb4541f8b126ae2
- SSDEEP 1536:jw9ESkPFybxWj1V7zbPUoOPjp85rFqXpLboVklDNTc2Wt:jwZO0xWPTU7l85rFYpLbott
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaBrightRegular.ttf
- SHA256 0faaaca3c730857d3e50fba1bbad4ca2330add217b35e22b7e67f02809fac923
- MD5 630a6fa16c414f3de6110e46717aad53
- SHA1 5d7ed564791c900a8786936930ba99385653139c
- SHA512 0b7cde0face982b5867aebfb92918404adac7fb351a9d47dcd9fe86c441caca4dd4ec22e36b61025092220c0a8730d292da31e9cafd7808c56cdbf34ecd05035
- SSDEEP 6144:oBfQeUG2CCTufrmOufymM8hvFHp277tS9iZFYSATxNm:oNQ3vCCTcaFNJw7tSgYS82
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaSansDemiBold.ttf
- SHA256 53773357d739f89bc10087ab2a829ba057649784a9acbffee18a488b2dccb9ee
- MD5 5dd099908b722236aa0c0047c56e5af2
- SHA1 92b79fefc35e96190250c602a8fed85276b32a95
- SHA512 440534eb2076004bea66cf9ac2ce2b37c10fbf5cc5e0dd8b8a8edea25e3613ce8a59ffcb2500f60528bbf871ff37f1d0a3c60396bc740ccdb4324177c38be97a
- SSDEEP 6144:R5OO1ZjNDE7/MsTJ30otegK4zJwz3UhG5jXsrg2HLzYv7cf0R7o7+WX/ov2DG:bOO11CEo9xzJwljXsrhHQ7cMuX/16
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaSansRegular.ttf
- SHA256 f8d877b0b64600e736dfe436753e8e11acb022e59b5d7723d7d221d81dc2fcde
- MD5 b75309b925371b38997df1b25c1ea508
- SHA1 39cc8bcb8d4a71d4657fc92ef0b9f4e3e9e67add
- SHA512 9c792ef3116833c90103f27cfd26a175ab1eb11286959f77062893a2e15de44d79b27e5c47694cbba734cc05a9a5befa72e991c7d60eab1495aac14c5cad901d
- SSDEEP 12288:6obn11t7t7DxT+3+OQ64cctiOAq12ZX/DmfT6R83Sd8uvx7wSnyER4ky+SH/KPKQ:6oTJZzHniOAZ783Sd8uvx7wSnyER4kyI
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaTypewriterBold.ttf
- SHA256 fc908259013b90f1cbc597a510c6dd7855bf9e7830abe3fc3612ab4092edcde2
- MD5 a0c96aa334f1aeaa799773db3e6cba9c
- SHA1 a5da2eb49448f461470387c939f0e69119310e0b
- SHA512 a43cf773a42b4cebf4170a6c94060ea2602d2d7fa7f6500f69758a20dc5cc3ed1793c7ceb9b44ce8640721ca919d2ef7f9568c5af58ba6e3cf88eae19a95e796
- SSDEEP 6144:3BPS7w5KIMtYwqcO3GbA4MJcs2ME9UGQ2n9gM/oD:xVMtgcGGPMJcs4b9gM/4
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/applet/fonts/LucidaTypewriterRegular.ttf
- SHA256 d9d0aab0354c3856df81afac49bdc586e930a77428cb499007dde99ed31152ff
- MD5 c1397e8d6e6abcd727c71fca2132e218
- SHA1 c144dcafe4faf2e79cfd74d8134a631f30234db1
- SHA512 da70826793c7023e61f272d37e2cc2983449f26926746605c550e9d614acbf618f73d03d0c6351b9537703b05007cd822e42e6dc74423cb5cc736b31458d33b1
- SSDEEP 3072:VwzZsJcCrn271g+UGFDUnrrHqMyBtlc3+fzx5R1zeqZdDgfSkecUfEDpEXzSyPMx:GWcCrn2C46Ak+naqaucYEDpEX3gZoO9
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/access-bridge-64.jar
- SHA256 75ecb81463b23ff9cc11a7eb2d677182ddc86f6f1b9ab12549a90129e7f880bf
- MD5 38aa28123922756533f0d825fa4a24dd
- SHA1 eef426c85a4f8cd95b719977914d05bc63614210
- SHA512 754ca8f73eeb8139c0944eb7e38c0cafdced415ea4b5022a76663e875308708cb4cf4d1b0cc4f92807aad76b9f30417902a7f7efd41da4f8d8a9527461e9a18a
- SSDEEP 3072:H/48+0RCqj249A5fy5C5DZm9q8vFyl9mbkLDz248sCHfwq/qS7G6hMEmJtyQH+n:oQS/swcvFq9mIL/9YHf1G6hMX6
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/cldrdata.jar
- SHA256 82b75bcc23eb585e7f4764b2caea89ea671e501bcb81cb3f82a6fe3c9445f49f
- MD5 53eac01526983f71a835cfa6b53522ff
- SHA1 bbd24e461eec509872b1b2546aacf1edf82485f8
- SHA512 c391b6f7097c4f2306dcb61ef0077b4bca98b5c373e783bca7cdb8e283d48fb0b27b887232d1987338eeeddcd753618efd8caa6473aa77abf584fac261f58371
- SSDEEP 98304:+ILko9AjAL8f4kOOH2p6H+gxlyN5VdElgykd5mpMcFZmu70l:+ILbp802i6H+4kfFPKy0cuQl
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/ffjcext.zip
- SHA256 126aab4c5443a182b4a6a63335c5a301cb5c43bd960047947eec44def13d012a
- MD5 d87b2277f71c4283f201582e4b9d850e
- SHA1 af1bcf7e8effddf02311983c31eec101b689bc25
- SHA512 1ed463d4e3e436596f58b2bdda797226558d0a7aa11b1562e56c1ef4a41f76bba61593f190ea07dc1fbf055227651bf17acfc65b0a4d4daf71b6a1c1df5bd8e7
- SSDEEP 96:elX6lXaq5hS7wZfLPmpaeIn59kfwnQ71ENEd9113ZfF7PMRl2HLkaWbZXP5Y4/CR:elIXa+1ZsqCj
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/fontconfig.bfc
- SHA256 b2ab990df3c4c1c2ec4317aaf22c946df17f0796727dbda712402307c56558ac
- MD5 ad8365719b70a2deade79683d8986a15
- SHA1 88cbf37d05f28691b7f82e74fa891792e93b41b9
- SHA512 287b19b6996a189baa3cf2894a57917b14b0615d551c5248ad55860678e5d6e58dd21247799bebe91b8236fc2f5300399fcfc1bb159edb9ae8d663805c6a30f1
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/fontconfig.properties.src
- SHA256 2c5837ca86d000a8621275540d1380880852cf6de2cfd7496418741b7e88bdf9
- MD5 77cd430a6d793b50b4501edc37a1e533
- SHA1 d18014cc830fa07c6dbb7d8b6edbdb4178b9d241
- SHA512 705bd76336d20d0c5c30266cbcd8fc91cf0ff1901bdcb682119174173f765bcc50291676664071619ac7af521a8d1c137f78efaf065afbe4a6bf413f9f604401
- SSDEEP 192:r+e6a1nsNi8bTeOiO/Ywca9nB2RwhCdvBQGuo6wj:rlnHIR9B2Rwhifj
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/hijrah-config-umalqura.properties
- SHA256 69becfe0d45b62bbdbcf6fe111a8a3a041fb749b6cf38e8a2f670607e17c9ee2
- MD5 1eddfb1ee252055556f40cdc79632e98
- SHA1 84aa425100740722e91f4725caf849e7863d12ba
- SHA512 a0fdbf42ff105c9a2f12179124606a720df8f32365605644e15600767e5732312777a58390fdb1a9b1c0b152ccc29496133b278a6e5736b38af2b5fab251d40c
- SSDEEP 96:RgZass+YXdGOS8NhN9Yd9Yq67IwOYUuUS9O0:RyJO/BFi9YqAInYUuUmO0
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/javafx.properties
- SHA256 9d9cb3d7ae629206cf24e84b25933da406c41332e8ea2ac79e3f2a02b12fad18
- MD5 b3bad0d91537f7012056fc980f3c65a2
- SHA1 77ba91f39fbfae3e9070b5754f28277c0d82bca6
- SHA512 c3c544ae971f72ad66bc9153ff54080dea848796343d4a20d4819c60e780815b1715b137bf516abd3d1dd0e9335e5c147fd2ebe6a1dd7cc573be06eb570a8211
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jce.jar
- SHA256 4362c179bb78107777d6a0557693e65eb2b318c26642162f89509dfdab8c97fe
- MD5 e0b7e0f36b9fc43d13403145db82e758
- SHA1 def42078cfa315e98393c69963efb4e35e2e28a8
- SHA512 5074a7ceb9621096f3bbf419d32ac260ea6d9d09c758544c2761121026c2b9db0b6617806d3b692347b685d541123f4eda99dcbaa29d9c9a2d740b22c44bf7bb
- SSDEEP 3072:p+uhK+XLGLuDfH3HiMAHElMueD+UgUBvVE:/f6Y3HiLvJ+Uju
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jfr.jar
- SHA256 7d378f84b2b5781531f6ae8d66c8dbcb9b68b69299321a3d0dace42db8e887d2
- MD5 f24955495625ff0d961245dec08ad538
- SHA1 c2a199daa4309d7ff3bc7eaea59a25fd913360fb
- SHA512 24da53cdeb176f66bd15d52dcbff3edf02d90b4404924f86860397bd795a71a7f6d6351bb95cb614becfa519c630d801f563ebcd9a68a9a2383697c37807327a
- SSDEEP 12288:I5l+qU67FYWg+YWgYWeoXqgYSqYQh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7TQ5cE:I5l+qU67FYWg+YWgYWeoXqgYSqYQh2fA
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jfxswt.jar
- SHA256 d4e365ea4ea97e379406a5eb00cae8847555bb62448d4b84da7ccfe2b35eece1
- MD5 bd299d76f2e97783f5ad5f9c964b6e8c
- SHA1 8655caa4b50e8e6b54847bdd2d3d40b58235d33f
- SHA512 a9e7088aebe1a031f6b7bacf87229c3420387e44c586c8d65fceaec253ecc8fab12afa489b8674eab88beec8646f2eaf8fb0141977137059c249e7fdde0f2186
- SSDEEP 768:QYjqzksT47sUgLJICsdU19SKYqLkClJzliojd+WIGArb4:QY2zvTI/gaCsdU1cj8Tjd+W9mb4
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/jvm.hprof.txt
- SHA256 b055bf25b07e5ac70e99b897fb8152f288769065b5b84387362bb9cc2e6c9d38
- MD5 c677ff69e70dc36a67c72a3d7ef84d28
- SHA1 fbd61d52534cdd0c15df332114d469c65d001e33
- SHA512 32d82daedbca1988282a3bf67012970d0ee29b16a7e52c1242234d88e0f3ed8af9fc9d6699924d19d066fd89a2100e4e8898aac67675d4cd9831b19b975ed568
- SSDEEP 96:CYrYJDrYJ+RvJ3z3d9uGG7hPxTRnhTbraYfwE5DyK:CYrsDrsgvJ3z3buGG7LvSmhDz
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/logging.properties
- SHA256 ce1688fe641099954572ea856953035b5188e2ca228705001368250337b9b232
- MD5 809c50033f825eff7fc70419aaf30317
- SHA1 89da8094484891f9ec1fa40c6c8b61f94c5869d0
- SHA512 c5aa71ad9e1d17472644eb43146edf87caa7bccf0a39e102e31e6c081cd017e01b39645f55ee87f4ea3556376f7cad3953ce3f3301b4b3af265b7b4357b67a5c
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/management-agent.jar
- SHA256 5e56a28c31cf1d6ae5ac902d9466855ec64c6de09dc026b83f29432ecedf9a76
- MD5 bbd37f88b63c35ae38729fdc1a39943d
- SHA1 6b6cb011fd143ca3389fc811aa2c049e12886115
- SHA512 71d0bb35c24df823bd089067978f94e344ebb17220c46168400b1cfd01ceafc79ce553f0686885e8ee5a5598248a850c05fcd7115a433f926696b264088239c2
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages.properties
- SHA256 926ccadaec649f621590d1aa5e915481016564e7ab28390c8d68bdaaf4785f1f
- MD5 811bafa6f97801186910e9b1d9927fe2
- SHA1 dc52841c708e3c1eb2a044088a43396d1291bb5e
- SHA512 5ae9c27dce552ea32603b2c87c1510858f86d9d10cade691b2e54747c3602fe75de032cf8917dcd4ee160ee4cc5be2e708b321bb1d5cdebfa9fe46c2f870ca7c
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_de.properties
- SHA256 c9399a33bb9c75345130b99d1d7ce886d9148f1936543587848c47b8540da640
- MD5 d77c3b5274b8161328ab5c78f66dd0d0
- SHA1 d989fe1b8f7904888d5102294ebefd28d932ecdb
- SHA512 696e28b6bc7e834c51ab9821d0d65d1a32f00eb15caa732047b751288ea73d8d703d3152bf81f267147f8c1538e1bf470748df41176392f10e622f4c7708dd92
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_es.properties
- SHA256 be987d93e23ab7318db095727dedd8461ba6d98b9409ef8fc7f5c79fa9666b84
- MD5 6d32848bd173b9444b71922616e0645e
- SHA1 1b0334b79db481c3a59be6915d5118d760c97baa
- SHA512 8e9e92d3229ff80761010e4878b4a33bfb9f0bd053040fe152565cfb2819467e9a92609b3786f9bdbf0d7934cf3c7d20bc3369fe1ad7d0df7fadf561c3fdca3c
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_fr.properties
- SHA256 8deeec35ed29348f5755801f42675e3bf3fa7ad4b1e414acca283c4da40e4d77
- MD5 c11ab66fede3042ee75dfd19032c8a72
- SHA1 69bd2d03c2064f8679de5b4e430ea61b567c69c5
- SHA512 072f8923df111f82f482d65651758b8b4ba2486cb0ea08fb8b113f472a42a1c3bcb00dae7d1780cf371e2c2bd955d8b66658d5ee15e548b1eea16b312fdcbdf9
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_it.properties
- SHA256 550954f1f80fe0e73d74eb10ad529b454d5ebc626eb94a6b294d7d2acf06f372
- MD5 a81c4b0f3bf9a499429e14a881010ef6
- SHA1 dbe49949308f28540a42ae6cd2ad58afbf615592
- SHA512 6fed61cbcd7fe82c15c9a312aced9d93836ebcffaf3e13543bc9dd8b4c88400c371d2365feee0f1bb844a6372d4128376568a5b6fe666fd6213636fcbd8c7791
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_ja.properties
- SHA256 8d499c1cb14d58e968a823e11d5b114408c010b053b3b38cfef7ebf9fb49096f
- MD5 b7279f1c3ba0b63806f37f6b9d33c314
- SHA1 751170a7cdefcb1226604ac3f8196e06a04fd7ac
- SHA512 4a3bf898a36d55010c8a8f92e5a784516475bdfffcd337d439d6da251ddb97bcc7e26f104ac5602320019ed5c0b8dc8883b2581760afea9c59c74982574d164b
- SSDEEP 96:Ltk1ZccBD8M25jCTDrk9/RoaG7THG9o7f6tEflA44CAmIbIC3j5pN/o8woJb:W1xBY1CG6OlG2r
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_ko.properties
- SHA256 d9c95c31b4c1092f32bdcf40d5232b31cc09fb5b68564067c1c2a5f59d3869fa
- MD5 fed33982e349f696ef21e35ed0dbbde3
- SHA1 bf9e055b5ab138ad6d49769e2b7630b7938848d6
- SHA512 88b16b7c3acfed2fc4b1e3a14006fef532147eb1e2930d8966e90629069462fb2e8cbf65f561e6cbc9a946f39d1866583cb02d6bb84c60c71428f489daaa61ef
- SSDEEP 96:fiX7fdokXLqlz9yx3f7yhJxpmG32i0HkZr+ywc8b8+/moD7yct070DL70Dj:g7ucLoINAYGbT/44i4
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_pt_BR.properties
- SHA256 4140663a49040ff191c07d2d04588402263ec2e1679a9a1a79b790a137ee7fb8
- MD5 ed15a441a20ea85c29521a0c7c8c3097
- SHA1 24e4951743521ab9a11381c77bd0cdb1ed30f5b5
- SHA512 be5f0639de6b0ac95792987d0af83ca77495f7f49953698c8b18692de982f77b68fe63159e8cd7537d62a71209a9ffabbecf046ad82d8341f613d39f180f9c83
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_sv.properties
- SHA256 99d7f49ecd3109370c0c6e8f1230317f7bea299ebbc811ca780028475e59b547
- MD5 bf9652f69c3be79d0972e860990ce375
- SHA1 bb5a4aa0ba499f6b1916a83e3c7922a4583b4adb
- SHA512 61232dfb1d9b9d519ee9b000802286ef2708609ea847737477ca5f762dbbba917ed958ef38d4f7aeae45ab7acf830fccdb6915c1ce1c17662baaa7722b843132
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_zh_CN.properties
- SHA256 a1752a0175f490f61e0aad46dc6887c19711f078309062d5260e164ac844f61a
- MD5 e6f84c081895acdfd98da0f496e1dd3d
- SHA1 1c2b96673dddd3596890ef4fc22017d484a1f652
- SHA512 d4d28780147e22678cd8e7415cacfad533ae5af31d74426bbe4993f05a0707e4f0f71d948093ffa1a0d6ea48310e901cd0ed1c14e2fbdf69c92462d070a9664f
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_zh_HK.properties
- SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
- MD5 880baacb176553deab39edbe4b74380d
- SHA1 37a57aad121c14c25e149206179728fa62203bf0
- SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/messages_zh_TW.properties
- SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
- MD5 880baacb176553deab39edbe4b74380d
- SHA1 37a57aad121c14c25e149206179728fa62203bf0
- SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/meta-index
- SHA256 6bd7ea02b9456a3730755e76d4ee1ccc04c524e93366cd74d7f42ac628d4ec77
- MD5 689c0cbde7697f43642bf1134f4b70af
- SHA1 307db1c4a9570f01479dea98f6b5bd33a1deb759
- SHA512 13afe0797d9c2c7ab8721fbedab42225b41f45059a9167c046a11e1bf6e03ad82accaed42884dff335b66ec41d3608d0d0bd06582af51634a81550c81baff2fb
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/net.properties
- SHA256 31ce7ce29c66a1696a985a197195b5e051b2c243ea83e9d1de614f0c4b4f7530
- MD5 8bc6628d01bad30798440cc00f638165
- SHA1 fd9471742eb759f4478bb1de9a0dc0527265b6ea
- SHA512 8da3439774a07a6309f985d1a29dda5383975bbdf6b8e2809bab69a2c44f65d3de2a546231ed6e183864193f834c9a7042fdcc4ee10181d0bd3891363032c242
- SSDEEP 96:6AcEvVEtGObfObz3Obm0ObPOnte3CO0V+r/aJ7SFvgTzDuBnZky:YEVGG4f4z34m04Pet5m27SRgTe9f
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/psfont.properties.ja
- SHA256 0c790de696536165913685785ea8cbe1ac64acf09e2c8d92d802083a6da09393
- MD5 7c5514b805b4a954bc55d67b44330c69
- SHA1 56ed1c661eeede17b4fae8c9de7b5edbad387abc
- SHA512 ccd4cb61c95defdcba6a6a3f898c29a64cd5831a8ab50e0afac32adb6a9e0c4a4ba37eb6dee147830da33ae0b2067473132c0b91a21d546a6528f42267a2c40e
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/psfontj2d.properties
- SHA256 7d51936fa3fd5812ae51f9f5657e0e70487dca810b985607b6c5d6603f5e6c98
- MD5 f8734590a1aec97f6b22f08d1ad1b4bb
- SHA1 aa327a22a49967f4d74afeee6726f505f209692f
- SHA512 72e62dc63daa2591b48b2b774e2479b8861d159061b92fd3a0a06256295da4d8b20dafa77983fdbf6179f666f9ff6b3275f7a5bcf9555e638595230b9a42b177
- SSDEEP 192:hPwn+Cyub3Ee4OECKDIcYOhAgZ50OKDQLT2IcpRuWRbHr9NRXUh/QTv9Ho39zPxq:5xzubEFOEscAW5VKsCfHz8RPxGt
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/splash.gif
- SHA256 113b01304ebbf3cc729a5ca3452dda2093bd8b3ddc2ba29e5e1c1605661f90be
- MD5 249053609eaf5b17ddd42149fc24c469
- SHA1 20e7aec75f6d036d504277542e507eb7dc24aae8
- SHA512 9c04a20e2fa70e4bcfac729e366a0802f6f5167ea49475c2157c8e2741c4e4b8452d14c75f67906359c12f1514f9fb7e9af8e736392ac8434f0a5811f7dde0cb
- SSDEEP 192:91m4OqvVyG+LMIcBc2qPjHmxJCCG/h97dIYhOX:9/OqdivcqzjH3tfDE
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/[email protected]
- SHA256 9dd5ccd6bdfdaad38f7d05a14661108e629fdd207fc7776268b566f7941e1435
- MD5 cb81fed291361d1dd745202659857b1b
- SHA1 0ae4a5bda2a6d628fac51462390b503c99509fdc
- SHA512 4a383107ac2d642f4eb63ee7e7e85a8e2f63c67b41ca55ebae56b52cecfe8a301aaf14e6536553cbc3651519db5c10fc66588c84c9840d496f5ae980ef2ed2b9
- SSDEEP 192:onqkbSDLFgIBL0IgyZCE/oIuuemXclVO/HemZ8GbRdziHm6tIclW3ZYvvebtssZn:lKMLWkpgy8sdsnOmEyPLaYoauAdI
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/splash_11-lic.gif
- SHA256 c5578ac349105de51c1e9109d22c7843aab525c951e312700c73d5fd427281b9
- MD5 9e8f541e6ceba93c12d272840cc555f8
- SHA1 8def364e07f40142822df84b5bb4f50846cb5e4e
- SHA512 2ab06cae68dec9d92b66288466f24cc25505af954fa038748d6f294d1cffb72fcc7c07ba8928001d6c487d1bf71fe0af1b1aa0f35120e5f6b1b2c209ba596ce2
- SSDEEP 96:S88k2wenvMs3iHrSI3yy73VWOcaJpGvrrXqJBcqgbf5bD0jmzDBoqCN2IWsyh:SFHhs73n73V4airrXq41Ll3vBmN2YU
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/deploy/[email protected]
- SHA256 fc39d09d187739e580e47569556de0d19af28b53df5372c7e0538fd26edb7988
- MD5 3fe2013854a5bdaa488a6d7208d5ddd3
- SHA1 d2bff9bbf7920ca743b81a0ee23b0719b4d057ca
- SHA512 e3048e8e0c22f6b200e5275477309083aa0435c0f33d1994c10ce65a52f357ee7cf7081f85c00876f438dfa1ee59b542d602287ec02ea340bfdf90c0c6abd548
- SSDEEP 192:Zzv4QPei/ueMFJ2M4xSGb/xGEyddpTa7Kv9I1BDc3KR3q6xmwJePYueHjAPZKGMr:5vTWvmxSGbkpTaYe1dc3KR3q7wJsOHmu
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/dnsns.jar
- SHA256 31227c7f0f2da38b86de245ac6f3cfa24595085b2ed24ab9c9799e8e14140a29
- MD5 8929c5c1db2e3b4387398f18f20fc69e
- SHA1 d4d24ff9154aac735331c7ffc846f0150cd7e3af
- SHA512 112ef7216af0e52f3566e8b632d507fc51061b60bfca412758c0c63c5524c86e7a50340a98cb23e0374a48fa5960bbf9650f7c860887b5abf71c8a465a3ab23b
- SSDEEP 192:N+UXHrz3io/pj55oNQYnrKcwP1CCzeLGycw:N+4Hnn/pj55IecvN
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/cursors.properties
- SHA256 7b8b63f78e2f732bd58bf8f16144c4802c513a52970c18dc0bdb789dd04078e4
- MD5 269d03935907969c3f11d43fef252ef1
- SHA1 713acb9eff5f0b14a109e6c2771f62eac9b57d7c
- SHA512 94d8ee79847cd07681645d379feef6a4005f1836ac00453fb685422d58113f641e60053f611802b0ff8f595b2186b824675a91bf3e68d336ef5bd72fafb2dcc5
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/invalid32x32.gif
- SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
- MD5 1e9d8f133a442da6b0c74d49bc84a341
- SHA1 259edc45b4569427e8319895a444f4295d54348f
- SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_CopyDrop32x32.gif
- SHA256 13c783acd580df27207dabccb10b3f0c14674560a23943ac7233df7f72d4e49d
- MD5 89cdf623e11aaf0407328fd3ada32c07
- SHA1 ae813939f9a52e7b59927f531ce8757636ff8082
- SHA512 2a35311d7db5466697d7284de75babee9bd0f0e2b20543332fcb6813f06debf2457a9c0cf569449c37f371bfeb0d81fb0d219e82b9a77acc6bafa07499eac2f7
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_CopyNoDrop32x32.gif
- SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
- MD5 1e9d8f133a442da6b0c74d49bc84a341
- SHA1 259edc45b4569427e8319895a444f4295d54348f
- SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_LinkDrop32x32.gif
- SHA256 485cbe5c5144cfcd13cc6d701cdab96e4a6f8660cbc70a0a58f1b7916be64198
- MD5 694a59efde0648f49fa448a46c4d8948
- SHA1 4b3843cbd4f112a90d112a37957684c843d68e83
- SHA512 cf2dfd500af64b63cc080151bc5b9de59edb99f0e31676056cf1afbc9d6e2e5af18dc40e393e043bbbbcb26f42d425af71cce6d283e838e67e61d826ed6ecd27
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_LinkNoDrop32x32.gif
- SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
- MD5 1e9d8f133a442da6b0c74d49bc84a341
- SHA1 259edc45b4569427e8319895a444f4295d54348f
- SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_MoveDrop32x32.gif
- SHA256 12cfce05229dba939ce13375d65ca7d303ce87851ae15539c02f11d1dc824338
- MD5 cc8dd9ab7ddf6efa2f3b8bcfa31115c0
- SHA1 1333f489ac0506d7dc98656a515feeb6e87e27f9
- SHA512 9857b329acd0db45ea8c16e945b4cfa6df9445a1ef457e4b8b40740720e8c658301fc3ab8bdd242b7697a65ae1436fd444f1968bd29da6a89725cdde1de387b8
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/images/cursors/win32_MoveNoDrop32x32.gif
- SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
- MD5 1e9d8f133a442da6b0c74d49bc84a341
- SHA1 259edc45b4569427e8319895a444f4295d54348f
- SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/jaccess.jar
- SHA256 d5274fe2ecf1c6c6c652913645ab7931c9a4c8c1118ae89005c3d44ae67599f0
- MD5 522f82bec99300eae7d0555cb19ca0fb
- SHA1 2501343e2f1e0be06969e3e8ea48530f6bd91833
- SHA512 468fd498c2c09ece961ee568fe2d38816aa073296b62e8896b57471b765bd740b38d80989fa186331ce569858de23e36cf54f5736834a7fbdb4e9a83ab946731
- SSDEEP 768:XYVD1CqfgKbWnXuZrQvfh3Jr+8ztkZQnWn109GqhljE4d:XKD1CWgfnXugfRo8mQnWn10Yq33d
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/jfr/default.jfc
- SHA256 1999297a9f25d3213938489ec8530f90ba45cbbbe26b3df02c550424cd1c543e
- MD5 bc14a629b9d89f45271c603d90d01051
- SHA1 683927d91f8449a02d220eb2ab87aabe3578ba90
- SHA512 0b120e5c8aee39c0b3f37a40b15a8d9c7764cd600c5b7496fd32fd0f829fe44b89c140e6d6a64dad75fd6c43cc6bb88305b698e11f5e00e614af824e5e247f57
- SSDEEP 192:/JA1ySPBhRt0ng3Ca66LAsmztuxqCbCdCsCNG2ixzTJDZi5OAdzAMzVdWVqGKxth:/J4yS5zaaedc2FchJ
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/jfr/profile.jfc
- SHA256 b2f827bd0e07d8908ece646a3189ec1bd1be0881f023200fbf369a21a12de086
- MD5 aa7054c1c580a8bc758acb991296a4d0
- SHA1 4520a35ba4f7b2ff9a182e003995cab17e0e0bd6
- SHA512 ea98ea8896a349f7f7e1179dcb793a1d63e1c077c7b8b237013a94c4b980c8d9e95180bb89b4910e5a2bbb2b54ecfc96b5898e2d46e1cb5012067c5f13d4ade6
- SSDEEP 192:/fA1ypPOdhJt0ng3Ca66L0smztuxqHbHdHsHNG2iYzTJDZ95OAdzAMzVdWVqGKxH:/f4ypy3aamd79Mrhl
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/jfxrt.jar
- SHA256 378f3210f27ef2e666dbd7569493acbb2bedc7b025e9ae9ec4aca2fffc3e01f0
- MD5 7357c2a994a4a51d8783c4e75b781806
- SHA1 723de7f4cf2d4dd16a8eb6b93929598e09efc628
- SHA512 8f2fcd3c32e0f90960a2810a99a8c68f0bc647d85b936112103999cd461f0b9aa8772968a0da1e56b57204e598c5d714a82d74dd2a8833e4d4ba7653db86d8ae
- SSDEEP 49152:h+8KQUO6qL3AZWL15dSCRZa7JubKydGYU4LK2pzIAiynLhX0xlnwygd3H0DF3Uxs:hVsq8+3SC0ubKyoogSxUw9+ytZKPH1
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/localedata.jar
- SHA256 a695b5df152515a1e29393e216b84eca44124b7c84e1f8cde90387d82136f02d
- MD5 5b3e580d339582675ca1432b7a379abf
- SHA1 1c57d2e59cab992050210453b3c99ab04e2f4951
- SHA512 6bfa009cc032579ba55856ba761722624b744934d29c6a85fd78187aeb82c73aaf1ac42251f6b9283393da8998af204bc19d975433e0b72bd7fc9165410d0532
- SSDEEP 49152:Z+Sow4ejiUAvQk5eBe5oFnKy9GJtV1s+b:+w4ejiDQkU5Gg+b
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/management/jmxremote.access
- SHA256 439158eb513525feda19e0e4153ccf36a08fe6a39c0c6ceeb9fcee86899dd33c
- MD5 f63bea1f4a31317f6f061d83215594df
- SHA1 21200eaad898ba4a2a8834a032efb6616fabb930
- SHA512 de49913b8fa2593dc71ff8dac85214a86de891bedee0e4c5a70fcdd34e605f8c5c8483e2f1bdb06e1001f7a8cf3c86cad9fa575de1a4dc466e0c8ff5891a2773
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/management/jmxremote.password.template
- SHA256 3d83e336c9a24d09a16063ea1355885e07f7a176a37543463596b5db8d82f8fa
- MD5 7b46c291e7073c31d3ce0adae2f7554f
- SHA1 c1e0f01408bf20fbbb8b4810520c725f70050db5
- SHA512 d91eebc8f30edce1a7e16085eb1b18cfddf0566efab174bbca53de453ee36dfecb747d401e787a4d15cc9798e090e19a8a0cf3fc8246116ce507d6b464068cdb
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/management/management.properties
- SHA256 3a923735d9c2062064cd8fd30ff8cca84d0bc0ab5a8fab80fdad3155c0e3a380
- MD5 5edb0d3275263013f0981ff0df96f87e
- SHA1 e0451d8d7d9e84d7b1c39ec7d00993307a5cbbf1
- SHA512 f31a3802665f9bb1a00a0f838b94ae4d9f1b9d6284faf626ebe4f96819e24494771a1b8bfe655fd2da202c5463d47bae3b2391764e6f4c5867c0337aa21c87c1
- SSDEEP 384:Fqsmpsj42wbZTHV+Dq3xtP3xPqaNC/R1a:wsmpsjL0ZTHV++3xtpi68Xa
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/management/snmp.acl.template
- SHA256 f1dc97da5a5d220ed5d5b71110ce8200b16cac50622b33790bb03e329c751ced
- MD5 71a7de7dbe2977f6ece75c904d430b62
- SHA1 2e9f9ac287274532eb1f0d1afcefd7f3e97cc794
- SHA512 3a46e2a4e8a78b190260afe4eeb54e7d631db50e6776f625861759c0e0bc9f113e8cd8d734a52327c28608715f6eb999a3684abd83ee2970274ce04e56ca1527
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/meta-index
- SHA256 8c55ed28260fcd7fd4e5d68e871a735148c01a711545602c2c26aa9d6653c05c
- MD5 af03d781ec85caa0f45e6e29830ce112
- SHA1 ef3dd2f731903182e47cb83cdf275f5f0e58b3db
- SHA512 df080f8c206ba125f5ce4129640fc05e9fc5b00fd87fe08866bbc7b67f5caa3ec2792dd874d49253a70ea0a9c3856c2e8ba4c39728656854a290cfdf6ba683a3
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/nashorn.jar
- SHA256 3ac68c8c946a7e60beeaa12a5bc59f105e223b0d760e940a9b8f452c0f84d1a5
- MD5 5acbd6e228f60a62b7f3863ef3f5a6aa
- SHA1 bb2d32be2cc4da884bdbd41ed1ef51966161d770
- SHA512 0b1a935f65fab6d969c614f5adaa391eee3e60d83d75952c8960364fe12e2e4df440d4ac724f036b59ad2c27590a77f6105f0f3e5c9e58d6ba6095b3c9804435
- SSDEEP 49152:z88uiJ0uT/qSnJdxiKocvnfe3HECaHUpmum+5n7/bn:z88E4/JJuKbnfIkhH565nf
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/blacklist
- SHA256 6c73c877b36d4abd086cb691959b180513ac5abc0c87fe9070d2d5426d3dbf71
- MD5 b2c6eae6382150192ea3912393747180
- SHA1 d4ffb3857eab403955ce9d156e46d056061e6a5a
- SHA512 898582c23f311f9f46825e7f8b6d36bed7255e5a4e2fa4b4452153b86efbd88db7e5b94dbd9cb9db554f62b84d19f22ae9d81822b4896081c487fb50946a9a9a
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/blacklisted.certs
- SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
- MD5 8273f70416f494f7fa5b6c70a101e00e
- SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
- SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/cacerts
- SHA256 ba2c547de918b23a5996672895e728def8ea01c165d2b340aa67c0a8186012ef
- MD5 b3ced04c4c23fc5cf5e7835608879d82
- SHA1 e41642ea209261ab8ac7d72beb206f4ef14c40f1
- SHA512 d89db9103f254a0547abfa2e413cdcaf1f736763390a2db5f8e15bdb814cebc8e21ba2678e4497b64f15d2e7aed41c6217888d1a0163753e2eae3d4a11263cf7
- SSDEEP 1536:lK1kcaUXlk471L8Q0WEXOQHoftVcKIt8nUNTalyCpSrVszxa:Iv84xF0WDyoteKIWU8lyCpSaa
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/java.policy
- SHA256 6191396d66399276d466b8cc9c932ea3f7f3faccb6876a60234a05ea0580701f
- MD5 bfdd90599e2e55ffd9378dfeb8ac1760
- SHA1 9d7c4615ff9e3902f1a19771e89e6b6423c2098d
- SHA512 aa71631aa5dbb445ea66d946dded9707df5bb6dbf03f272a643c2ac3cb8aead3cf1f9c37d4cc43561fbe19c506ee4c1543f6b38ec432a959619c31ae049ab6a8
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/java.security
- SHA256 b5e8205764b83f46b50187b2021de7c86a890df908a8d6c17275a68924f832c6
- MD5 8f0e3440fffdbcaa9d26be4730492a66
- SHA1 20a3e5a8ecbec20d41d7124120d264f61de96613
- SHA512 c04528769ce780e730ef71803ca8191c217f571f62703daca273499b90e93101383a3699263458c205cd7a8733399c3c2ca6afc85b6843c2c5e2ba0890e762cb
- SSDEEP 768:rn4LHAEcqrlANbX7qL1AdL3naP2rOpOQSvbOETyqp+Z+Ijt+M38ykbLIsS8e677c:rs2aVOQCbOETyqpmLjt1CLze0YKQN3F
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/javaws.policy
- SHA256 b7a87d1f3f4b7ba1d19d0460fa4b63bd1093afc514d67fe3c356247236326425
- MD5 9107d028bd329dbfe4c1f19015ed6d80
- SHA1 4384ca5e4d32f7dd86d8baddd1e690730d74e694
- SHA512 81b14373b64ce14af26b70d12d831e05158d5a4fa8cec0508fef8a6ca65b6f4ef73928f4b1e617c68ddeacff9328a3d4433b041b7fb14de248b1428c51dbc716
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/policy/limited/US_export_policy.jar
- SHA256 9ce50a70ed7051c155ab8ea06755f94823d8d1cba67ffd8fd3fe3249b3ac31ea
- MD5 0d59c5639aa24c7d326e7bd54bb8eda5
- SHA1 58875d7463460d7998c4013912fb89965e823044
- SHA512 2175b0cb6ff8b3afe37fb24ebeef406d7920be404ee66597a47699607a9b39f981c023f7e4133359fef9910fe7885ba846d3c532b22891a8231e23eaf440896d
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/policy/limited/local_policy.jar
- SHA256 92780525250258f336a8f746ed7437035512d06050d85786fb44fdf12e08419c
- MD5 6280d06e46e0cc047e04c85c83874566
- SHA1 7d0a29932b496edbdd1fc55572014bc89703ad07
- SHA512 e3ef446b02943915f874dc09433833e5ff131abad93d04f95aa6e887881cbf71b15ad0f41e8c7d57864a003559bbc3769452b17600664207308ae99340bfb46e
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/policy/unlimited/US_export_policy.jar
- SHA256 761aab2969883e9e5ea76df63ca404fb67673efc3f97def057f8e22517fc9518
- MD5 6cbca5808b4a8613d2fed6fe4a84c449
- SHA1 0135b30ebec03fb69d79cdc3126e608d9effb8b2
- SHA512 4d9bf052aa124d07673c601cbfb83223b87369f7be7575a13e13c0d893e57849ba11e430b7769901782c26471528dfaa130996916451e1a7e38cf28468e44cfa
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/policy/unlimited/local_policy.jar
- SHA256 02f69a433405ea928c89a8aade74e5462282ccb9a9d30851312ed3459398f85c
- MD5 360663f26c5584e6c6127254b261fa0c
- SHA1 aee6515eede2ad7c697ba8a61bdd9359be3319d2
- SHA512 e3920d5abbbe6b0e3029ed1e0b2ce1a53da6c7e728f635b12f00b1fd2eb6151fff74b9dc85ec0c0920f7fda440c1604d24ca766cdbcb78be3425088d97e00208
- MD5 SHA1 SHA512
Ruination.Swapper 2.0.8/wwwroot/backup/ext/security/public_suffix_list.dat
- SHA256 00ca9e095528e79cdcffcf6fec30c4c8c1fe45edf168e715cc89ab39b5c487b4
- MD5 beebcd1d32044e926333caa1950afb7f
- SHA1 aa329e50467feaf57d31d40629f6fce5e7180c27
- SHA512 6caaa3c2a53782fd286ab8db4a6a2470cd0150608c33b27aa506735d37185d26eedd27ef95fe0ade83d8301fdb8ac1c4b972a87b3714c303181f5cd67bc64815
- SSDEEP 3072:hB5QB6QQRwG15c7cVnjzTx+3YUmdzGWMmcLzRIXthvjxlO8nQB7wWyZ7GL2OOLCu:hbQBR4KL2nemZ
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/sunec.jar
- SHA256 cfe84c5292f9ddef96fecf118377565bbaf769eee7ff4cca81652fe1134f9809
- MD5 1227482c65dc231e3607b002950f5497
- SHA1 709ff3738d5da8db225818df2966f04c13cb7d02
- SHA512 87c4f5fa1e6dad6f2fab8a0371380fa7be9f63b05f8ff6740a4208ec115f8db9c512de9e40b4b853be35effed2804d0774c0e9426571a129cb6bdecd527cdb8c
- SSDEEP 768:4731B13B5aguVlb2TUVMbLjwP7l6lxiHsWhoc2toqMmrV3lkwhEafSkjmPX+M6ij:2/7ggIYU6GlQ0Hnhoc2mvA3ewSafSZPd
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/sunjce_provider.jar
- SHA256 55fcb115840900bb3c0b6ed3a64cb0df0ab552b08107518ddd433441579e219f
- MD5 27cfa9de474e231774b42bdaca3f9b65
- SHA1 c93ae9c1f3bc4a93104d4bae038598ae3af6860a
- SHA512 ce66831c7ce3e2a103a1aeecadced9a9cd0f5c47fd85bb4e6d3f352fb7c7c91045065354e662f476d8b3376d9a4466be6616002ff17209953a3f4fbe9d01e2c3
- SSDEEP 6144:cnu6NwF+Ff18n7h/mVT44gxNTLV59ikaQqD2GwevS9e9DRK:cu6NwFxn7agvTLV59dRawRE9DA
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/sunmscapi.jar
- SHA256 2e42b9055905b163e7fb487845ac80627c9a9a5fdf9dd7c7983c52437e1d3375
- MD5 35f7968a28732e702ce7e1074bbc46ed
- SHA1 a09992ff24238d7e5925bd2f8dc01ec8a44f78f0
- SHA512 f56e1449b7765d031831eb85b85ada1d0e468ba92e1e0bd48c065eee7d3c97ef04e1f947773f18b0f6d41994530790aafac2ef85289685fe19a795ec62f8bd27
- SSDEEP 1536:cKfrf9FJ546NJ9/JdybTw2EX4iVZ/OcW8R6t+vdZvWc8tv/D2rWYsYuOqMnI6ZDN:cHa2Ehz02mipLXN
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/sunpkcs11.jar
- SHA256 1e68df027026f78808dfb020c3386d8d1b4b27fc12ef1b73b2b814e2499cbb8c
- MD5 b1eea3508f53434cc971d7a1605796f1
- SHA1 c904c249225c5e4c93836059cc617e3a1d1b1d49
- SHA512 46fb4c63be5f86ddf742938271bd8651b14ada3b8f8bfb9a8ee47c7dc61d0226f83bb7ea060fbf994e288272253ee9437121a5d9e8f08eaaea830f531db364d5
- SSDEEP 6144:lk4xePXAK7/0Q+twNLGn3SVk4VB6JxWLEjlC7u1zMcrQ7045xjS9q0BP:lkr9vNqnCVkPWLEJJ1Vrx2xu9q0P
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/ext/zipfs.jar
- SHA256 34fd764849df2f7436c8ddf3198febf78ae3ea93aed6115a825be1d4b2715a71
- MD5 9e4eab747f716bc8979c4eb43248cbb0
- SHA1 6efbaae6361d76c996ae30e2dbbea8336887d5f9
- SHA512 74a69dfc66d32a70723c4374b303a4adb853029cc1ee229be1a15a2b5c013586bbe16969d99c65dbcbbd29c6729763fc9a3e430db9e45b298301c806e4471ef5
- SSDEEP 1536:ISwxopRm789SPjDrG0zzxnU2jP4NPrLp/ei:hwxops789S/rGkcNvD
- MD5 SHA1 SHA512 SSDEEP
Ruination.Swapper 2.0.8/wwwroot/backup/nvspapi64.dll
- IMPHASH 977f887ba1716db690f3f6cd927adbd9
- SHA256 9eedd4a4930facb5921a3c1d8f79058a62cae74f931056ee5113596162531e64
- MD5 7de1b589266e02f798427e4c1356361e
- SHA1 ca1c18fa9fdf12ba3971da3b75f8313d74d4882d
- SHA512 40b366e131c50e59f84b5a95924eb308fcb32aef764a2119a2d17d0f18af7cf1f188058261cb8096c6ea2617f9766bfd37cf5bc749788a548212e97c0140c946
- SSDEEP 24576:nazvr1FHF9REsTHM/qjsDsOCgFGRUTrj6ZRXHOR5PTTts:azv5PPiqjsDsOCpbXHOR5Pvts
- MD5 SHA1 SHA512 SSDEEP
Digest
5c:e6:b8:0f:b6:5e:84:3d:63:24:f8:08:f8:aa:96:62:96:8b:2a:37:3b:17:15:30:0f:58:da:b0:13:51:9b:57
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Nov 16, 2017
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
b0:12:be:31:da:b9:f9:e3:24:cd:c6:72:5c:a7:03:ce:e1:64:09:b6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Chains
Nov 16, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US
Serial Number
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2015 - Jul 26, 2018
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=NVIDIA Corporation,OU=IT MIIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
7b:c1:5a:f2:13:67:d0:75:8b:ed:dc:ca:11:86:42:de
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 13, 2015 - Jul 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
32:58:e8:ee:54:af:5c:27
Issuer
CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 13, 2016 - Dec 13, 2021
Minor OS version
0
Major OS version
6
Entry point
30941
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dvs\p4\build\sw\rel\gfclient\rel_03_11\shadowplay2\api\win7_amd64_release\nvspapi64.pdb
shell32
SHGetFolderPathA
SHGetKnownFolderPath
ole32
CoTaskMemFree
oleaut32
SetErrorInfo
CreateErrorInfo
GetErrorInfo
VariantCopy
SysAllocString
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
VariantChangeType
advapi32
FreeSid
ConvertStringSidToSidW
OpenSCManagerA
CloseServiceHandle
GetUserNameW
GetUserNameA
SetTokenInformation
DuplicateTokenEx
RegDeleteKeyValueA
RegSetValueExA
RegQueryValueExW
RegDeleteKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
AllocateAndInitializeSid
CopySid
RegCreateKeyExA
GetLengthSid
GetSecurityDescriptorDacl
GetTokenInformation
SetEntriesInAclA
LookupAccountNameA
ConvertSidToStringSidA
RegDeleteKeyA
wtsapi32
WTSQuerySessionInformationA
WTSFreeMemory
shlwapi
PathFindFileNameA
PathFileExistsA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
kernel32
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
HeapSize
HeapReAlloc
SetStdHandle
SetFilePointerEx
ReadConsoleW
WriteConsoleW
CreateProcessW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CloseHandle
SetEvent
CreateEventA
WaitForMultipleObjects
GetLastError
ResetEvent
WaitForSingleObject
GetCurrentProcessId
CreateThread
GetCurrentThreadId
GetThreadId
FreeLibrary
GetProcAddress
WideCharToMultiByte
GetSystemDirectoryW
SetLastError
HeapFree
GetProcessHeap
OpenEventA
Sleep
SetDllDirectoryA
GetModuleHandleA
CreateDirectoryA
CreateFileA
GetFileSizeEx
OutputDebugStringA
GetLocalTime
GetModuleFileNameW
MoveFileExA
CreateFileW
ReadFile
WriteFile
WaitNamedPipeW
CreateEventW
QueryPerformanceCounter
QueryPerformanceFrequency
OpenProcess
LoadLibraryA
ReleaseMutex
UnmapViewOfFile
OpenFileMappingA
HeapAlloc
CreateMutexA
GetCurrentProcess
MapViewOfFile
LocalAlloc
LocalFree
OpenMutexA
CreateFileMappingA
GetModuleFileNameA
WTSGetActiveConsoleSessionId
VerSetConditionMask
GetFileAttributesW
GetFullPathNameW
OutputDebugStringW
CreateProcessA
SetEndOfFile
GetModuleHandleW
LoadLibraryExW
lstrcmpA
VerifyVersionInfoW
DecodePointer
RaiseException
InitializeCriticalSectionEx
SetCurrentDirectoryA
GetFileAttributesA
TerminateProcess
ProcessIdToSessionId
GetSystemDirectoryA
GetVersionExA
GetVolumeInformationA
MultiByteToWideChar
K32GetProcessMemoryInfo
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DeleteFileA
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
GetFileType
GetStdHandle
GetACP
GetCurrentThread
GetModuleHandleExW
ExitProcess
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RtlUnwindEx
user32
EnumDisplaySettingsA
wsprintfW
ChangeWindowMessageFilterEx
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
SendMessageA
GetForegroundWindow
TranslateMessage
GetMessageA
PostThreadMessageA
RedrawWindow
PostMessageA
EnumDisplaySettingsExA
DispatchMessageA
GetWindowThreadProcessId
EnumDisplayDevicesA
DefWindowProcA
WaitForInputIdle
EnumWindows
GetShellWindow
FindWindowExW
FindWindowA
FindWindowW
CreateOverlayApiInterface
CreateShadowPlayApiInterface
ShadowPlayOnSystemStart
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
217KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
319B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=24610,
count=7, id=259, version=24610,
count=145, id=261, version=24610,
count=1, id=199, version=41118,
count=9, id=259, version=25305,
count=21, id=260, version=25305,
count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=42, id=261, version=25305,
count=1, id=208, version=65501,
count=19, id=203, version=65501,
count=216, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2017 v15.3 build 25506, version=25506,
count=28, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=256, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=255, productName=VS2017 v15.3 build 25506, version=25506,
count=1, id=258, productName=VS2017 v15.3 build 25506, version=25506,