kayflock-beta.rar
- SHA256 9ecbf28720a944bdd3f3c20cdb3f4da7f40da903b651be520348e01a8efa2504
Password
hell nigga
Overview
overview
10Static
static
10kayflock-b...nt.dll
windows7-x64
1kayflock-b...nt.dll
windows10-2004-x64
1kayflock-b...on.exe
windows7-x64
1kayflock-b...on.exe
windows10-2004-x64
1kayflock-b...ck.exe
windows7-x64
1kayflock-b...ck.exe
windows10-2004-x64
7kayflock-b...us.dll
windows7-x64
1kayflock-b...us.dll
windows10-2004-x64
1kayflock-b...ne.exe
windows10-2004-x64
1kayflock-b...vc.exe
windows10-2004-x64
1kayflock-b...er.exe
windows10-2004-x64
1kayflock-b...ic.exe
windows7-x64
8kayflock-b...ic.exe
windows10-2004-x64
8kayflock-b...hh.exe
windows10-2004-x64
1kayflock-b...ad.exe
windows10-2004-x64
1kayflock-b...64.exe
windows10-2004-x64
1kayflock-b...32.dll
windows10-2004-x64
1kayflock-b...32.exe
windows10-2004-x64
1kayflock-b...te.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
kayflock-beta/System.Management.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
kayflock-beta/System.Management.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
kayflock-beta/byfron.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
kayflock-beta/byfron.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
kayflock-beta/kayflock.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
kayflock-beta/kayflock.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
kayflock-beta/nexus.dll
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
kayflock-beta/nexus.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
kayflock-beta/packages/ranks/HelpPane.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
kayflock-beta/packages/ranks/bfsvc.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
kayflock-beta/packages/ranks/explorer.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
kayflock-beta/packages/ranks/fullstack-magic.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
kayflock-beta/packages/ranks/fullstack-magic.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
kayflock-beta/packages/ranks/hh.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
kayflock-beta/packages/ranks/notepad.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
kayflock-beta/packages/ranks/splwow64.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
kayflock-beta/packages/ranks/twain_32.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
kayflock-beta/packages/ranks/winhlp32.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
kayflock-beta/packages/ranks/write.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target kayflock-beta.rar
- Size 9.9MB
- Sample240413-v4rrmsab8v
- SHA256 9ecbf28720a944bdd3f3c20cdb3f4da7f40da903b651be520348e01a8efa2504
- MD5 97aa3a079dd9755550f3dc33b5cfc215
- SHA1 68706f4f9fada471773b87c051c1d0bbc0da1ac6
- SHA512 bb94b7252d1eaf201ec3bac6ed154159c30c69759d9683866be1be4ee6c173581eb5ab033e5fb346dfb0eb811ec850204ae2b925d125230579c6978e7737990a
- SSDEEP 196608:I9wZUrLVz1Ik1+pfk/1eAD5kh7mv486rCujLl/yvhEW9NZ1elAbinuDll:FY1zWk/1XD5Y7VPjhyvSWHZ1AGinGll
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/kayflock-beta/Guna.UI2.dll family_agenttesla - Agenttesla family
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/kayflock-beta/nexus.dll agile_net - Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/kayflock-beta/byfron.dll unpack001/kayflock-beta/kayflock.exe unpack001/kayflock-beta/packages/ranks/HelpPane.exe unpack001/kayflock-beta/packages/ranks/bfsvc.exe unpack001/kayflock-beta/packages/ranks/fullstack-magic.exe unpack001/kayflock-beta/packages/ranks/hh.exe unpack001/kayflock-beta/packages/ranks/notepad.exe unpack001/kayflock-beta/packages/ranks/splwow64.exe unpack001/kayflock-beta/packages/ranks/twain_32.dll unpack001/kayflock-beta/packages/ranks/winhlp32.exe unpack001/kayflock-beta/packages/ranks/write.exe
File Explorer
-
kayflock-beta.rar.rar 9.9MB
-
kayflock-beta/Guna.UI2.dll.dll 2.1MB
-
kayflock-beta/System.Management.dll.dll 70KB
-
kayflock-beta/byfron.deps.json2KB
-
kayflock-beta/byfron.dll.exe 15.1MB
-
kayflock-beta/byfron.pdb16KB
-
kayflock-beta/byfron.runtimeconfig.json266B
-
kayflock-beta/kayflock.exe.exe 253KB
-
kayflock-beta/nexus.dll.dll 516KB
-
kayflock-beta/packages/ranks/Core.xml29KB
-
kayflock-beta/packages/ranks/DtcInstall.log2KB
-
kayflock-beta/packages/ranks/HelpPane.exe.exe 1.0MB
-
kayflock-beta/packages/ranks/PFRO.log40KB
-
kayflock-beta/packages/ranks/WMSysPr9.prx309KB
-
kayflock-beta/packages/ranks/bfsvc.exe.exe 94KB
-
kayflock-beta/packages/ranks/bootstat.dat66KB
-
kayflock-beta/packages/ranks/explorer.exe.exe 5.4MB
-
kayflock-beta/packages/ranks/fullstack-magic.exe.exe 1.4MB
-
kayflock-beta/packages/ranks/hh.exe.exe 18KB
-
kayflock-beta/packages/ranks/lsasetup.log1KB
-
kayflock-beta/packages/ranks/mib.bin42KB
-
kayflock-beta/packages/ranks/notepad.exe.exe 196KB
-
kayflock-beta/packages/ranks/setupact.log482B
-
kayflock-beta/packages/ranks/splwow64.exe.exe 160KB
-
kayflock-beta/packages/ranks/system.ini219B
-
kayflock-beta/packages/ranks/twain_32.dll.dll 63KB
-
kayflock-beta/packages/ranks/win.ini92B
-
kayflock-beta/packages/ranks/winhlp32.exe.exe 11KB
-
kayflock-beta/packages/ranks/write.exe.exe 11KB
-
kayflock-beta/runtimes/win/lib/net6.0/System.Management.dll.dll 284KB
kayflock-beta/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cad8bb34cf070c10e995ebdb60d9d1b4e206bc763183a8cdfb29e17ffa30dd10
- MD5 fc5aba3c395c5f9098cb8e2f78e17022
- SHA1 217061a89757a1d6eb976ad48fb9c93a7a58edcb
- SHA512 148b275edaccd403ee7dcb70e959b29a22ed1c5f61b674afb94af6e9e6b010bb0a7dd9e964d2811dff9c2642a49bb278cc1a838a4f384f5648470187ee83936d
- SSDEEP 49152:YTTFBySg6etzcwp8fB0hXGErGn9lut4XrgF0:irG8farRo
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
Password
hell nigga
PE Signature issue
Digest
fc:f1:4f:80:29:85:d5:17:61:00:50:90:0b:29:ff:b3:2a:f2:5b:54
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2225806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
kayflock-beta/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7387f80ef7e40f2f056d862a66afea0b16b46d101e69093dc7ba84f3d1d0881
- MD5 88b0572d04511832862a672aa59f6e57
- SHA1 0c0c00a22ee85f5c053b90929941a1d4e892f87c
- SHA512 c3f313de263c996277a97121f804f8a21f7ac8bab36bf485605ffa281e30083f9a7ff783dc58e66a32e5a09669ff3798233b963764281b7ea8eb9afa43ea997a
- SSDEEP 768:l3FJV6QNGiHKxqv/7F/dttlswUGcVzKkb46jf9LJKdbY2SdMEQj:l31/MiHKsFBqtRUkb46j99yc2SdMEo
- MD5 SHA1 SHA512 SSDEEP
Password
hell nigga
PE Signature issue
Digest
f9:29:e4:44:46:e1:a8:0c:76:29:93:8e:25:54:3c:9a:f6:db:f6:85:a2:77:71:3c:9e:5b:42:43:63:07:8e:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
67078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/net6.0-Release/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
kayflock-beta/byfron.deps.json
- SHA256 c2b18045006132c79e458c6e004d56fa3ecc6dcf286c037dc5cdd9c267b05bbe
- MD5 0b45167dac553c48dac4e1aa14aed27b
- SHA1 19d17893e905694e8e6676a1fefd1130860168e2
- SHA512 f1d8e1235659101fb261dd017f94dc9889ef10b7dea9916b7f9ebc4ae782054e3850ffdad5e9fbcfd52467acdf4c44506dc1cdfeb20e59b738daeae2c8c7f408
- MD5 SHA1 SHA512
kayflock-beta/byfron.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 efd93048311e5feb5e853a5cff20112b6991ce662b8f8d90fa5377ef2aa16252
- MD5 027dcfe7428ee64267c19120bde8607a
- SHA1 929621600cda0642861d57c3e39bc344f96f4926
- SHA512 155b4b18d59933b62602d934a197395d269d2011db8d3f0a86855e55f405fd66839ca6232c5d6075987750acc362d048d3783bbfd6940559f5924f3db2da50cd
- SSDEEP 393216:dgCrScjgeDIC/tBmVczYo6kUFnURXrScjgeDIC/tBmVczYo6kUFnUR:VWcEe0ZVkUKWcEe0ZVkU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hell nigga
Minor OS version
0
Major OS version
4
Entry point
15727594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\nevin\source\repos\byfron\byfron\obj\Debug\net6.0-windows\byfron.pdb
mscoree
_CorExeMain
Name
.text
Size
15.0MB
Virtual Size
15.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
kayflock-beta/byfron.pdb
- SHA256 9a63d81f121f16fd13786177dedf6db136249b6b3226cd3c618551fac131b486
- MD5 084c1cb1da493c8b8071d6342e6587af
- SHA1 e48dd2a66b88a7d5d482564359bc4d04322079f4
- SHA512 7bdb4022aa877c9e1f592015efd21400c2d2c8d24a20da33f1f51d371e6015d80f56fc2790369b305062c533361fee5bea9c86cf649e946836f6a51f25d38df7
- SSDEEP 384:jOcJkHlQ2hXjMu4Ra46pcspT/M2DZOIaH7YXrpc7b/sujW1B/+0OHef0QYlZYrpL:jOcJkoV8oIEAIbpq/pXUO
- MD5 SHA1 SHA512 SSDEEP
kayflock-beta/byfron.runtimeconfig.json
- SHA256 321b4e463bbacd6113aa337511bdebf5e7356e9971744346b28424607c7b483a
- MD5 d720176a229e9d969b40fabeb0baf62e
- SHA1 f2d8e97a6c6098a10dd80553eaaef7547ad32ba3
- SHA512 0844f9aca147014a68248c43310bf97e0a0a3679fc84650aa0a27aa09f70f56fa071c0ace1be80f0e33ce4dd3f865eae11e946d98d21af916dc1a7f945acaba0
- MD5 SHA1 SHA512
kayflock-beta/kayflock.exe
- IMPHASH 6dbf27f4c70fe2c8ed3e0122ba75d641
- SHA256 7a25def99b85f8486606ec7eb4d52395308afcc930e7b2df23897022b1d6baf1
- MD5 2ea6211ab19482dddf2b32fdeddfe409
- SHA1 bfb9ab42d59ec933d1ebb8674bc697faaa99a52e
- SHA512 e54d8b6db035ab9274c3f3a00474cf19d1543eb19f1c8eb89e11e33ddc6d675648201a70f495e6ddc0da4d71f17f01e3f6d77d5264effe1f0c46877379933bae
- SSDEEP 3072:yczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOGm0kqxidvA8qY:yA4NCmBPry/N2VOOPwxU1q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hell nigga
Minor OS version
0
Major OS version
6
Entry point
80992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_exit
__p___argc
_initterm_e
_initterm
_get_initial_wide_environment
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_set_app_type
__p___wargv
_seh_filter_exe
_register_onexit_function
_cexit
terminate
_errno
exit
abort
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
setvbuf
fflush
_wfopen
__stdio_common_vswprintf
__stdio_common_vfwprintf
_set_fmode
__stdio_common_vsprintf_s
__acrt_iob_func
fputwc
fputws
__p__commode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_locale_name_func
localeconv
_unlock_locales
_lock_locales
___mb_cur_max_func
_configthreadlocale
__pctype_func
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=77, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=29395,
count=162, id=1, productName=Unmarked objects,
count=10, id=265, version=30153,
count=1, id=258, version=30153,
kayflock-beta/nexus.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a3f02ad6a8f319b352f4ab3222bd57d9699882db065fb344b9828243b1d0015
- MD5 8cd9953ff0283305f3998f6893c7d244
- SHA1 db906639e1b164bb813e3e94e548a4c5549bd36e
- SHA512 3121712026e63ae2c9df423c24511249895e773a5e56f3fd19dff89eefe58042c990afcd7ffba21bf9f181045b9b4d9f439c7e69114f0f9282adbd707558e133
- SSDEEP 12288:MykYXttq4mBpDetgo3DcHGF2HcvHWUSA9uN:iYi4Xt7zcHGFxI+uN
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Password
hell nigga
Digest
5c:77:06:b1:6d:99:75:73:11:ed:06:41:47:14:c8:c3:c0:0b:e3:a1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Chains
Sep 14, 2018
SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Serial Number
08:f8:b2:43:88:63:93:78:21:d1:77:24:80:3c:cf:30
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 7, 2017 - Nov 12, 2018
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
525670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\bunifu\Desktop\Bunifu Framework\Projects\Master\bunifu-framework-winforms-repo\Obfuscation\1.5.4 - secured\Bunifu_UI_v1.5.3.pdb
mscoree
_CorDllMain
Name
.text
Size
506KB
Virtual Size
505KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
kayflock-beta/packages/ranks/Core.xml
- SHA256 34133b0cbf84e68e82bbb2c70df561081af5d48ec9a4c62f9f09d576f3f7c356
- MD5 c6c52af48a75dcc59644dc894d2f524e
- SHA1 94d1df084ae2fb4462a2cf11b1ac714e580d93d0
- SHA512 089b1bf55e7879cf2f8b5f3c13eb808f708dae3c8487b94d18ad77bb4a0ef8ef0109d409486bc2da1beb09b022b37be2cb29281984d312e1830d5c0cb90f0ea2
- SSDEEP 192:ikfo8Lkfo8gabaprkfdJkvmuhpGPemB7YSLJAId/LmuhpGPemB7YSLJAId/bkfdt:ikAIkADA8SLJAId/ZSLJAId/U
- MD5 SHA1 SHA512 SSDEEP
kayflock-beta/packages/ranks/DtcInstall.log
- SHA256 498ad4b107661f81b7725163328f2bdef504aaaf40ced24d6ccb5b4967652096
- MD5 cf93c1434d887d934f58d2475ced305f
- SHA1 9c5bc19d1470288852053f0328d196b1c2b5c8b8
- SHA512 76e27501ee5ba2d14a50f44b2544ea8b1b77050262858b19e2752eb37d5e67cedbf7efeea0d785996de9baf1ea9d150933ceda9347b268a0bfbde975edfc715e
- MD5 SHA1 SHA512
kayflock-beta/packages/ranks/HelpPane.exe
- IMPHASH 77598c173b521d9294a60fea0a91cc1e
- SHA256 e00db4259a014d3833023ae6ea22923f0f35902615910ccb058a1ee53131dcb8
- MD5 24fa2b633440a793683f8d5f1372dc43
- SHA1 6f8af3fc0d9f7a876ffb44c645e87ec4db75784e
- SHA512 cedf87859612080487562530543b9c24ce69b600713737f1c7ce669a04707c5473008fc0884bb820bcec4433ed5cbff3c89300e0e90d4bb388089e269946e21f
- SSDEEP 12288:dvcZCbt3V79HwWt1BJM6HJHnmf/7BGR+dxYGXKPXPiXuHNHGb6bH/zx/GCLW/nhf:n3d9HJvJtGH7PdxY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hell nigga
Minor OS version
0
Major OS version
10
Entry point
363552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
helppane.pdb
advapi32
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
UnregisterTraceGuids
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
RegGetValueW
EqualSid
OpenThreadToken
OpenProcessToken
GetTokenInformation
GetSidLengthRequired
InitializeSid
IsValidSid
GetSidSubAuthority
GetLengthSid
CopySid
SetEntriesInAclW
kernel32
LocalFree
CloseHandle
GetLastError
WaitForSingleObject
SetEvent
GetQueuedCompletionStatus
ResetEvent
PostQueuedCompletionStatus
GetSystemInfo
CreateIoCompletionPort
CreateEventW
ProcessIdToSessionId
GetCurrentProcessId
GetExitCodeThread
TerminateThread
LoadLibraryExW
LoadResource
CreateMutexW
GetSystemDirectoryW
SetCurrentDirectoryW
HeapSetInformation
ReleaseMutex
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
FormatMessageW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
InitializeCriticalSectionEx
OpenSemaphoreW
CreateThreadpoolTimer
GetFileAttributesW
GetPackagesByPackageFamily
GetCurrentThread
CompareStringW
InitOnceBeginInitialize
InitOnceComplete
CreateMutexExW
CreateSemaphoreExW
CreateThread
ResumeThread
MulDiv
WaitForMultipleObjects
GetCurrentProcess
LocalAlloc
GlobalFree
GlobalAlloc
MultiByteToWideChar
LoadLibraryW
FreeLibrary
RaiseException
GetCurrentThreadId
SetLastError
GetModuleFileNameW
InitializeCriticalSection
ExpandEnvironmentStringsW
LockResource
FindResourceExW
SizeofResource
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
GetProcAddress
OutputDebugStringW
GetVersionExW
DelayLoadFailureHook
ResolveDelayLoadedAPI
lstrcmpiW
gdi32
GetTextExtentPoint32W
SelectObject
GetDeviceCaps
GetStockObject
CreateFontIndirectW
GetObjectW
SetTextColor
SetBkMode
DeleteObject
user32
GetWindowPlacement
MonitorFromRect
GetMonitorInfoW
GetWindowRect
MonitorFromPoint
GetProcessDefaultLayout
GetDC
ReleaseDC
ShowWindow
GetDlgItem
CheckDlgButton
IsDlgButtonChecked
EnableWindow
EndDialog
BringWindowToTop
SetDlgItemTextW
GetDlgItemTextW
GetClientRect
SendMessageW
GetSysColor
GetSysColorBrush
SetWindowPos
LockWindowUpdate
PostQuitMessage
LoadCursorW
IsZoomed
DestroyIcon
DispatchMessageW
GetWindowLongW
GetMenu
AdjustWindowRectEx
MoveWindow
IsWindowEnabled
GetSystemMetrics
UnregisterClassA
IsWindowVisible
SetFocus
CreateWindowExW
DefWindowProcW
GetClassInfoExW
RegisterClassExW
SetWindowLongPtrW
CallWindowProcW
GetSubMenu
LoadMenuW
GetParent
InvalidateRect
GetWindowLongPtrW
CheckMenuRadioItem
EnableMenuItem
IsIconic
SystemParametersInfoW
SetCursor
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
CharNextW
PostMessageW
KillTimer
SetTimer
MessageBoxW
SetActiveWindow
GetKeyState
SetWindowTextW
DestroyMenu
DialogBoxParamW
TrackPopupMenuEx
ClientToScreen
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
wcscmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
_initterm
api-ms-win-crt-private-l1-1-0
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wtoi
_o_calloc
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wmemcpy_s
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o__beginthreadex
wcschr
wcsstr
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_o__configthreadlocale
_o__cexit
_o__callnewh
memcmp
memcpy
memmove
comctl32
ImageList_LoadImageW
ord380
ord344
InitCommonControlsEx
ord345
ImageList_Destroy
ole32
CoCreateInstance
CoImpersonateClient
CoUninitialize
CoRevertToSelf
CoInitialize
CoIncrementMTAUsage
CoTaskMemFree
CoTaskMemRealloc
OleInitialize
CoInitializeSecurity
PropVariantClear
CoResumeClassObjects
CoRevokeClassObject
CoGetMalloc
OleUninitialize
CoTaskMemAlloc
CoRegisterClassObject
oleaut32
VarBstrCat
VarUI4FromStr
LoadTypeLibEx
SysAllocStringByteLen
SysFreeString
SysAllocString
VariantClear
VariantInit
SysStringLen
LoadRegTypeLi
LoadTypeLi
DispCallFunc
SysAllocStringLen
VariantCopy
SysStringByteLen
shell32
ShellExecuteW
SHGetPropertyStoreForWindow
shlwapi
SHRegGetValueW
ord176
SHGetValueW
ord2
UrlUnescapeW
UrlEscapeW
SHStrDupW
slwga
SLIsGenuineLocal
ntdll
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapSize
HeapDestroy
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
FlushInstructionCache
GetProcessMitigationPolicy
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
TerminateProcess
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
OpenEventW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-security-base-l1-1-0
FreeSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetSecurityDescriptorDacl
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-localization-l1-2-0
GetUserPreferredUILanguages
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
Name
.text
Size
370KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
524KB
Virtual Size
523KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=260, version=27412,
count=4, id=259, version=27412,
count=25, id=257, version=27412,
count=1371, id=1, productName=Unmarked objects,
count=63, id=264, version=27412,
count=36, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/packages/ranks/PFRO.log
- SHA256 08fccc77a8a6fd3677d8faaf786ec201073b8f72c1b7f2885afb8396ff4c2504
- MD5 31c6e61014eff5bafc52ce9649da7f6d
- SHA1 c982e860f9429ccaec25190e6de07221c8fc8ef7
- SHA512 0906455f621f55c89127b3ae765850985bf5a126eafa7235931cd1b8d85988ed3c65982662700c3598a257eb412d90c2cbae5957443b4ee902694187dfe6347b
- SSDEEP 96:aI2Tcb2U66dn8dn6iKWumeuWmhupmFutmtulA4dNf8dX88iMtYL0KYL0KN:R66yR+8lqUZ
- MD5 SHA1 SHA512 SSDEEP
kayflock-beta/packages/ranks/WMSysPr9.prx
- SHA256 45a572f3dea4f20e077d1162a77bd0922e5b52fc679bef0c05425fbd14e7a108
- MD5 e7e4d8d7340da6934b9ea81cbb21374c
- SHA1 b0b24e36351258444768769f48cc3505b957d460
- SHA512 2832e66ba0964a44ce3ecd6b7b6349529e3e284e78af3e7b6481276f1890b7d6de1b52a03150dd6bf0610f8e30b4af6b0b323ea59d88c156fcf1b46b2a07fd3a
- SSDEEP 768:dfQWPE1EdGK6LK5Sj5zDWPEKjoT7tEYTDiDtcBXQ:aWP3P6LK5SVWPuT7tEYTDUcBXQ
- MD5 SHA1 SHA512 SSDEEP
kayflock-beta/packages/ranks/bfsvc.exe
- IMPHASH 8f37383f783aa5f937062790b2149d46
- SHA256 1ac616c3c7b314a79cd06802b43cad4ab97c37f6b800961f7e8f031e1a85dedf
- MD5 47661a0f06b7bcc30715c0ad97756e39
- SHA1 ed527f16529ad312640fef174fb8ea816c7e61f8
- SHA512 b483485ac96a5f799161fe277553ce74cae34833da6bc6238980509ddafa50f3f26d871395d20ec4d9a5dae0e48720384a7ce2256fbe061056760a8683e4f0a7
- SSDEEP 1536:nJrvLNn0Vux8uZUnqDzlO3h+dmZn6tQsaxH9D2eQtezaZgJQKi:JXNnTxXtO3h+dmZn65WYezSei
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hell nigga
Minor OS version
0
Major OS version
10
Entry point
56912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bfsvc.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetTokenInformation
OpenThreadToken
SetThreadToken
DuplicateTokenEx
LookupPrivilegeValueW
GetSecurityDescriptorSacl
AdjustTokenPrivileges
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
OpenProcessToken
ConvertSidToStringSidW
kernel32
GetLastError
LocalFree
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetVolumeInformationW
FindFirstFileW
HeapFree
SetLastError
FindNextFileW
WriteFile
GetPrivateProfileSectionW
FindClose
GetVolumePathNameW
CreateFileW
GetFileAttributesW
GetVolumeNameForVolumeMountPointW
SetFileAttributesW
CloseHandle
HeapAlloc
GetProcAddress
MoveFileExW
GetProcessHeap
CreateDirectoryW
GetFileSizeEx
DeviceIoControl
UnmapViewOfFile
GetCurrentThread
GetFullPathNameW
CopyFileExW
DeleteFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
LocalAlloc
FreeLibrary
LoadLibraryExW
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
GetStartupInfoW
msvcrt
__iob_func
memcpy
wcsnlen
memset
_wcslwr
_snwscanf_s
wcsstr
swprintf_s
fwprintf
_vsnwprintf_s
fflush
wcschr
wcsncmp
wcsrchr
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_wcsicmp
_wcsnicmp
_vsnwprintf
rpcrt4
UuidCreate
bcrypt
BCryptHashData
BCryptCreateHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
crypt32
CertGetNameStringW
imagehlp
CheckSumMappedFile
shell32
CommandLineToArgvW
shlwapi
PathRemoveBackslashW
ntdll
NtEnumerateBootEntries
NtQueryDirectoryObject
NtOpenDirectoryObject
NtQueryBootOptions
NtQueryBootEntryOrder
NtQueryValueKey
NtQuerySymbolicLinkObject
NtOpenKey
NtOpenSymbolicLinkObject
RtlImpersonateSelf
NtOpenThreadTokenEx
NtOpenProcessTokenEx
NtAdjustPrivilegesToken
NtTranslateFilePath
RtlFreeHeap
RtlAllocateHeap
NtSetInformationFile
NtQuerySystemEnvironmentValueEx
LdrAccessResource
LdrFindResource_U
NtOpenFile
NtQueryInformationThread
NtQueryInformationFile
RtlImageNtHeader
NtDeviceIoControlFile
NtSetInformationThread
NtReadFile
NtOpenProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtClose
RtlInitUnicodeString
NtWriteFile
NtQuerySystemInformation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=261, version=27412,
count=2, id=259, version=27412,
count=19, id=260, version=27412,
count=25, id=257, version=27412,
count=278, id=1, productName=Unmarked objects,
count=42, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/packages/ranks/bootstat.dat
- SHA256 f454ee676cd3b56f962e24d3da58dcef17f04dc50a756850a661a8ca7b4211a8
- MD5 a9a74a3a11517540f53d9816183e0754
- SHA1 24a39c3743612bc0948de326e894262f2b6ecb4a
- SHA512 1f4ac96f8f06e07ee5fc3b576a9bdba5893cb2e30f47478f9d11207f421adfc53454ed97e1cd70c32fc115f852b5ac8081e6738c9e622f7e4e41d3848bd0868c
- SSDEEP 48:cXL92bZ9/bFE9Vbmj9MbE99ljbk99hbh9eb69IbBQb9jbj:YZiPjFKlAkK95q/HaQQBeHj
- MD5 SHA1 SHA512 SSDEEP
kayflock-beta/packages/ranks/explorer.exe
- IMPHASH 54dc9b405d017a6766f4cd96028ba126
- SHA256 33ca082676d3e3162eccdbef28daa3240930245ff218b70d309f34ab0e7b372e
- MD5 238538d74fea273bff1e00622eccaf3a
- SHA1 61ee53287d7aa2abbf323cc04e4475ae07ed6e75
- SHA512 9f6d02be5cbd10635e25acb96d09710876d860c51b3402c2a9863c1fb6725b00978ff0c4d851245e77c30471774b2394a1f886d60d4328f30be5457a5e4e2894
- SSDEEP 49152:o5TqDcv5BBX/kxeONz5frwQPBqsOnTufmZrboosBB+SpfwcwP6cfwQ/Imu7/Qmrt:vQbNovRRwcGtiw8a0cD5
- MD5 SHA1 SHA512 SSDEEP
Password
hell nigga
Digest
32:07:f7:39:6f:57:33:f3:f5:40:cc:36:54:45:87:21:1b:52:ac:22:c6:f3:03:0d:21:32:ed:1f:e6:f5:5a:29
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
670784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
explorer.pdb
msvcp_win
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Xbad_alloc@std@@YAXXZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$collate@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?width@ios_base@std@@QEAA_J_J@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
_Mtx_init_in_situ
_Xtime_get_ticks
_Mtx_destroy_in_situ
_Mtx_unlock
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
_Wcsxfrm
api-ms-win-crt-runtime-l1-1-0
_set_error_mode
_initterm
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
api-ms-win-crt-string-l1-1-0
_wcsrev
wcsncpy
wcsncmp
strncmp
memset
wcscspn
wcscmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-private-l1-1-0
_o_iswalnum
_o_iswspace
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_roundf
_o_sqrt
_o_terminate
_o_toupper
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoll
__C_specific_handler
__CxxFrameHandler3
_o__purecall
_o_free
_o__mktime64
_o_floor
_o_exit
_o_ceil
memmove
_o_bsearch
_o__wtoi
_o__wcsnicmp
_o__wcsicmp
_o__localtime64
_o__itow_s
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__beginthreadex
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsstr
__std_terminate
__CxxFrameHandler4
_o__seh_filter_exe
_o__register_onexit_function
_o__recalloc
_CxxThrowException
memcmp
memcpy
aepic
PicRetrieveFileInfo
PicFreeFileInfo
twinapi
ord9
api-ms-win-core-job-l2-1-0
AssignProcessToJobObject
CreateJobObjectW
QueryInformationJobObject
SetInformationJobObject
api-ms-win-core-windowserrorreporting-l1-1-3
RegisterApplicationRestart
api-ms-win-core-url-l1-1-0
HashData
UrlUnescapeW
PathIsURLW
api-ms-win-core-kernel32-private-l1-1-0
CheckElevation
CheckElevationEnabled
api-ms-win-core-registryuserspecific-l1-1-0
SHRegGetUSValueW
SHRegGetBoolUSValueW
api-ms-win-core-com-private-l1-1-0
CoRegisterMessageFilter
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
api-ms-win-core-sidebyside-l1-1-0
ActivateActCtx
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
ntdll
RtlGetVersion
RtlInitString
wcsspn
RtlQueryResourcePolicy
ZwQuerySystemInformation
RtlInitUnicodeString
RtlUpcaseUnicodeChar
RtlGetNativeSystemInformation
ZwQueryDirectoryFile
RtlNtPathNameToDosPathName
ZwOpenFile
ZwEnumerateKey
RtlInitUnicodeStringEx
RtlFormatCurrentUserKeyPath
ZwCreateFile
ZwQueryInformationFile
ZwCreateSection
ZwQueryInformationProcess
ZwSetInformationProcess
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
ZwMapViewOfSection
LdrResSearchResource
RtlVerifyVersionInfo
RtlImageDirectoryEntryToData
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
RtlCompareUnicodeString
RtlFreeHeap
RtlAllocateHeap
wcschr
RtlpEnsureBufferSize
wcsrchr
strchr
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlPublishWnfStateData
NtSetSystemInformation
RtlFlushHeaps
ZwQueryValueKey
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData
RtlNtStatusToDosError
ZwOpenKey
RtlCaptureContext
RtlGetDeviceFamilyInfoEnum
NtSetInformationProcess
NtQueryInformationProcess
ZwClose
RtlReAllocateHeap
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlIsStateSeparationEnabled
RtlDosPathNameToNtPathName_U_WithStatus
RtlNtStatusToDosErrorNoTeb
RtlFreeUnicodeString
NtSetThreadExecutionState
VerSetConditionMask
WinSqmSetDWORD
WinSqmIsOptedIn
WinSqmAddToStreamEx
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
GetProcAddress
FindStringOrdinal
GetModuleHandleA
FindResourceExW
LockResource
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
GetModuleHandleExW
LoadResource
LoadStringW
FreeLibrary
GetModuleFileNameA
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
Sleep
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
ReleaseMutex
EnterCriticalSection
CreateSemaphoreExW
OpenMutexW
OpenEventW
WaitForMultipleObjectsEx
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
SleepEx
InitializeCriticalSection
CreateEventW
SetEvent
ReleaseSRWLockExclusive
DeleteCriticalSection
WaitForSingleObject
CreateMutexExW
TryAcquireSRWLockExclusive
CreateMutexW
CreateEventExW
ReleaseSRWLockShared
ResetEvent
OpenSemaphoreW
AcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
AcquireSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError
RaiseException
api-ms-win-core-file-l1-1-0
GetLongPathNameW
FindClose
DeleteFileW
GetFileAttributesW
WriteFile
CreateFileW
FindNextFileW
CompareFileTime
FindFirstFileW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventActivityIdControl
EventEnabled
EventSetInformation
EventRegister
EventWrite
EventProviderEnabled
EventUnregister
api-ms-win-core-registry-l1-1-0
RegDeleteTreeW
RegOpenKeyExW
RegDeleteValueW
RegSetKeySecurity
RegOpenCurrentUser
RegGetKeySecurity
RegSetValueExW
RegDeleteKeyExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegEnumValueW
RegGetValueW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
api-ms-win-core-threadpool-l1-2-0
SubmitThreadpoolWork
CreateThreadpoolWait
CreateThreadpoolWork
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolWait
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
ExitProcess
GetCurrentProcess
GetPriorityClass
GetExitCodeProcess
SetThreadPriorityBoost
SetProcessShutdownParameters
QueueUserAPC
CreateProcessW
GetCurrentProcessId
ProcessIdToSessionId
GetThreadPriority
GetCurrentThreadId
TerminateProcess
ResumeThread
SetPriorityClass
GetProcessId
CreateThread
OpenProcessToken
GetCurrentThread
OpenThreadToken
OpenThread
SetThreadPriority
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
GetThreadUILanguage
GetGeoInfoW
GetCalendarInfoW
GetUserDefaultLangID
FormatMessageW
GetLocaleInfoW
GetUserDefaultLocaleName
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
oleaut32
SafeArrayDestroy
SysAllocStringByteLen
SysAllocString
VarUI4FromStr
SafeArrayUnaccessData
SafeArrayCreate
SysStringLen
VariantClear
VariantInit
SysFreeString
SafeArrayAccessData
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
api-ms-win-shcore-sysinfo-l1-1-0
SetCurrentProcessExplicitAppUserModelID
IsOS
api-ms-win-core-com-l1-1-0
CoFreeUnusedLibraries
CoGetObjectContext
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoMarshalInterThreadInterfaceInStream
CoGetApartmentType
CoWaitForMultipleHandles
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoGetStdMarshalEx
CoInitializeSecurity
IIDFromString
PropVariantClear
CoCancelCall
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoDisableCallCancellation
StringFromGUID2
StringFromIID
CoEnableCallCancellation
CoCreateGuid
CLSIDFromString
CoRegisterClassObject
CoSetProxyBlanket
CoGetCallContext
CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
CoInitializeEx
CoUninitialize
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpICW
StrStrIW
StrToIntW
StrCmpIW
StrCmpNICW
StrCmpICA
StrChrW
QISearch
StrCmpW
StrCmpNIW
StrChrIW
StrRChrW
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
SHStrDupW
api-ms-win-shcore-comhelpers-l1-1-0
IUnknown_Set
IUnknown_SetSite
IUnknown_QueryService
IUnknown_GetSite
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalAlloc
LocalReAlloc
GlobalFree
LocalAlloc
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
GetProcessMitigationPolicy
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
api-ms-win-core-sysinfo-l1-1-0
GetLocalTime
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetWindowsDirectoryW
GetVersionExW
GetSystemTime
GetLogicalProcessorInformation
api-ms-win-core-datetime-l1-1-1
GetDateFormatEx
GetTimeFormatEx
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
SearchPathW
ExpandEnvironmentStringsW
GetCommandLineW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
PathRemoveBlanksW
PathFindFileNameW
PathRemoveFileSpecW
PathQuoteSpacesW
PathFindExtensionW
PathGetDriveNumberW
PathCombineW
PathIsFileSpecW
SHExpandEnvironmentStringsW
PathParseIconLocationW
PathGetArgsW
PathCommonPrefixW
api-ms-win-core-winrt-string-l1-1-0
WindowsCompareStringOrdinal
WindowsSubstringWithSpecifiedLength
WindowsDuplicateString
WindowsDeleteStringBuffer
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsGetStringLen
WindowsCreateStringReference
WindowsCreateString
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
RoActivateInstance
api-ms-win-shcore-registry-l1-1-0
SHQueryInfoKeyW
SHDeleteKeyW
SHGetValueW
SHDeleteValueW
SHEnumKeyExW
SHRegGetValueW
SHSetValueW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-shcore-thread-l1-1-0
SetProcessReference
SHCreateThread
SHGetThreadRef
SHCreateThreadRef
SHSetThreadRef
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrlenW
api-ms-win-security-base-l1-1-0
IsValidSid
CopySid
GetTokenInformation
GetLengthSid
SetKernelObjectSecurity
AddAce
EqualSid
InitializeAcl
DeleteAce
GetAce
MakeAbsoluteSD
CreateWellKnownSid
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
CheckTokenMembership
DuplicateToken
GetAclInformation
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-errorhandling-l1-1-1
RemoveVectoredExceptionHandler
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchCombine
PathCchRemoveFileSpec
PathCchAppend
PathCchAddExtension
api-ms-win-shcore-unicodeansi-l1-1-0
SHAnsiToUnicode
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
api-ms-win-core-processthreads-l1-1-3
SetProcessInformation
SetThreadDescription
api-ms-win-core-memory-l1-1-0
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-shcore-stream-l1-1-0
IStream_Reset
IStream_Write
SHOpenRegStream2W
IStream_Read
SHCreateStreamOnFileW
SHCreateMemStream
SHCreateStreamOnFileEx
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-shcore-path-l1-1-0
ord170
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
api-ms-win-core-sysinfo-l1-2-0
GetOsSafeBootMode
GetProductInfo
api-ms-win-core-localization-l1-2-3
GetUserDefaultGeoName
userenv
GetProfileType
DeriveAppContainerSidFromAppContainerName
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime
GetDynamicTimeZoneInformation
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
GetSystemPowerStatus
RegisterWaitForSingleObject
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
api-ms-win-core-string-l2-1-0
CharNextW
CharLowerBuffW
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
NotifyServiceStatusChangeW
api-ms-win-core-io-l1-1-0
CreateIoCompletionPort
GetQueuedCompletionStatus
api-ms-win-core-sysinfo-l1-2-1
GetPhysicallyInstalledSystemMemory
api-ms-win-shcore-stream-winrt-l1-1-0
CreateStreamOverRandomAccessStream
api-ms-win-shcore-registry-l1-1-1
SHRegGetValueFromHKCUHKLM
api-ms-win-shcore-scaling-l1-1-1
ord244
GetDpiForMonitor
iphlpapi
GetNetworkConnectivityHint
api-ms-win-core-toolhelp-l1-1-0
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-stringansi-l1-1-0
CharNextA
api-ms-win-power-base-l1-1-0
CallNtPowerInformation
GetPwrCapabilities
PowerDeterminePlatformRoleEx
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-shlwapi-winrt-storage-l1-1-1
ord197
SHIsChildOrSelf
SHPinDllOfCLSID
ord509
SHCreateWorkerWindowW
ord635
ord544
ord478
ord165
ord479
ord481
ord279
StrRetToBufW
ShellMessageBoxW
IUnknown_GetWindow
StrRetToStrW
ord292
PathRemoveArgsW
AssocQueryStringW
api-ms-win-ntuser-sysparams-l1-1-0
QueryDisplayConfig
GetDisplayConfigBufferSizes
GetSystemMetrics
EnumDisplayMonitors
EnumDisplayDevicesW
GetMonitorInfoW
SystemParametersInfoW
api-ms-win-ntuser-rectangle-l1-1-0
CopyRect
InflateRect
PtInRect
SetRect
IsRectEmpty
EqualRect
SetRectEmpty
IntersectRect
OffsetRect
SubtractRect
UnionRect
api-ms-win-rtcore-ntuser-winevent-l1-1-0
UnhookWinEvent
SetWinEventHook
NotifyWinEvent
api-ms-win-shell-namespace-l1-1-0
SHBindToParent
ILCombine
SHCreateItemFromIDList
SHBindToFolderIDListParent
SHBindToObject
ILIsParent
SHGetNameFromIDList
ILFindLastID
ILFree
ILIsEqual
ILRemoveLastID
ILCloneFirst
ILGetSize
SHGetIDListFromObject
SHCreateItemFromParsingName
SHParseDisplayName
ILClone
dxgi
DXGIDeclareAdapterRemovalSupport
api-ms-win-rtcore-ntuser-wmpointer-l1-1-0
GetPointerDevices
GetCurrentInputMessageSource
EnableMouseInPointer
GetPointerType
GetPointerInfo
api-ms-win-storage-exports-internal-l1-1-0
SetThreadFlags
GetThreadFlags
SHGetFolderPathEx
SHGetKnownFolderIDList
api-ms-win-rtcore-ntuser-synch-l1-1-0
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
api-ms-win-appmodel-runtime-l1-1-0
GetPackageFullName
GetPackagesByPackageFamily
api-ms-win-rtcore-ntuser-wmpointer-l1-1-2
SetWindowFeedbackSetting
api-ms-win-rtcore-ntuser-clipboard-l1-1-0
RegisterClipboardFormatW
api-ms-win-rtcore-ntuser-private-l1-1-0
GetWindowBand
CreateWindowInBand
api-ms-win-rtcore-ntuser-powermanagement-l1-1-0
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
propsys
PSCreateMemoryPropertyStore
PropVariantToBoolean
InitVariantFromResource
InitVariantFromGUIDAsString
PSPropertyBag_WriteStr
PropVariantToUInt32
PSPropertyBag_WriteDWORD
PropVariantToStringAlloc
PSGetPropertyFromPropertyStorage
coremessaging
CreateDispatcherQueueController
urlmon
URLOpenBlockingStreamW
api-ms-win-shell-changenotify-l1-1-0
SHChangeNotify
api-ms-win-shell-dataobject-l1-1-0
SHCreateDataObject
api-ms-win-appmodel-runtime-l1-1-1
FindPackagesByPackageFamily
ParseApplicationUserModelId
wtsapi32
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
gdi32
StretchBlt
ExcludeClipRect
SetStretchBltMode
Rectangle
GetCurrentObject
SelectClipRgn
GetClipRgn
GetOutlineTextMetricsW
GetGlyphOutlineW
CreateRectRgnIndirect
GetTextExtentPoint32W
GetStockObject
ExtTextOutW
GetTextMetricsW
GetDeviceCaps
CreateRectRgn
GetClipBox
SetRectRgn
OffsetRgn
CombineRgn
DeleteObject
GetObjectW
DeleteDC
CreateCompatibleDC
SelectObject
CreateFontIndirectW
SetTextColor
SetTextAlign
kernel32
IsBadWritePtr
rpcrt4
RpcBindingFree
NdrClientCall3
RpcStringFreeW
RpcBindingSetAuthInfoExW
I_RpcExceptionFilter
RpcStringBindingComposeW
UuidFromStringW
RpcBindingFromStringBindingW
wininet
InternetCrackUrlW
shcore
ord121
ord174
ord109
ord126
ord213
ord183
ord210
ord192
ord1
ord162
SHUnicodeToAnsi
ord190
ord123
ord187
ord186
ord142
ord200
ord184
shell32
ord743
ord907
ord43
Shell_GetCachedImageIndexW
ord790
ord792
ord727
ord162
SHAppBarMessage
ord894
ord193
ord906
ord895
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord764
ord866
SHEvaluateSystemCommandTemplate
ord181
ord244
ExtractIconExW
ShellExecuteW
ord132
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord2
ord711
SHFileOperationW
ord4
SHGetPathFromIDListW
ord645
ord644
ord753
ord733
SHChangeNotifyRegisterThread
DragQueryFileW
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
ord172
ord680
ord723
ord885
ord95
ord850
ord22
ord137
ord134
shlwapi
ChrCmpIW
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
AssocCreate
PathIsRelativeW
uxtheme
GetThemeBackgroundExtent
GetThemeBool
OpenThemeData
OpenThemeDataForDpi
GetThemeMargins
ord138
BufferedPaintSetAlpha
ord126
GetThemePartSize
IsThemeActive
GetBufferedPaintBits
GetThemeInt
GetThemeColor
GetThemeMetric
SetWindowTheme
GetWindowTheme
BufferedPaintUnInit
EndBufferedPaint
BeginBufferedPaint
IsAppThemed
CloseThemeData
DrawThemeParentBackground
DrawThemeBackground
ord86
GetThemeFont
DrawThemeTextEx
IsCompositionActive
BufferedPaintInit
dwmapi
ord113
DwmGetWindowAttribute
DwmRegisterThumbnail
ord159
ord140
DwmQueryThumbnailSourceSize
ord124
ord141
DwmSetWindowAttribute
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties
DwmEnableBlurBehindWindow
ord138
DwmIsCompositionEnabled
ord139
ord114
user32
SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
EndTask
SetLayeredWindowAttributes
DrawTextExW
IsProcessDPIAware
SetThreadDpiAwarenessContext
ord2573
IsWindowUnicode
LoadAcceleratorsW
ChangeWindowMessageFilterEx
TranslateAcceleratorW
BringWindowToTop
ord2611
MonitorFromRect
GetGuiResources
IsHungAppWindow
ord2574
SwitchToThisWindow
GetMenuState
UnregisterHotKey
RegisterHotKey
SendDlgItemMessageW
EndDialog
ExitWindowsEx
GetKeyState
LoadIconW
HungWindowFromGhostWindow
CascadeWindows
TileWindows
LockWorkStation
InjectMouseInput
MapVirtualKeyExW
InjectKeyboardInput
DeleteMenu
GetCaretBlinkTime
GetSysColor
CopyImage
DestroyIcon
InsertMenuW
GetSystemMetricsForDpi
ord2005
GetLastActivePopup
TrackMouseEvent
SetCapture
ShowWindowAsync
GetCursorInfo
PostThreadMessageW
UnregisterClassA
GetWindowCompositionAttribute
GetWindowProcessHandle
GetClassLongPtrW
UpdateLayeredWindow
ord2521
UnregisterClassW
ord2522
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
GetCapture
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
ReleaseCapture
GetDoubleClickTime
LoadCursorW
DestroyMenu
IsTopLevelWindow
GetPhysicalCursorPos
GetIconInfo
GetIconInfoExW
GhostWindowFromHungWindow
GetClassLongW
GetClassWord
DefWindowProcA
SetMenuItemInfoW
DrawIconEx
SetCursor
GetSysColorBrush
GetSystemMenu
ModifyMenuW
CalculatePopupWindowPosition
GetAsyncKeyState
ReplyMessage
CopyIcon
MonitorFromPoint
GetMenuItemInfoW
GetMenuItemCount
GetLastInputInfo
AdjustWindowRect
CreateIconIndirect
GetDpiForWindow
GetSubMenu
SetWindowCompositionAttribute
SetGestureConfig
LoadMenuW
LoadImageW
DrawTextW
CheckMenuItem
FillRect
GetMenuDefaultItem
CreatePopupMenu
EnableMenuItem
IsIconic
MonitorFromWindow
ReleaseDC
GetDC
RemoveMenu
SetMenuDefaultItem
GetLayeredWindowAttributes
TrackPopupMenuEx
AdjustWindowRectEx
sspicli
GetUserNameExW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
PowerCreateRequest
PowerSetRequest
api-ms-win-security-isolatedcontainer-l1-1-1
IsProcessInWDAGContainer
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-kernel32-legacy-l1-1-2
SetTermsrvAppInstallMode
api-ms-win-shell-shdirectory-l1-1-0
ord292
api-ms-win-eventing-controller-l1-1-0
StopTraceW
StartTraceW
EnableTraceEx2
api-ms-win-appmodel-runtime-l1-1-3
GetStagedPackagePathByFullName2
api-ms-win-core-biptcltapi-l1-1-7
BiPtEnumerateWorkItemsForPackageName
BiPtQueryWorkItem
BiPtAssociateApplicationEntryPoint
BiPtFreeMemory
api-ms-win-crt-math-l1-1-0
ceilf
floorf
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.imrsiv
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
753KB
Virtual Size
752KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
136KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=260, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=260, version=27412,
count=3, id=259, version=27412,
count=2491, id=1, productName=Unmarked objects,
count=31, id=257, version=27412,
count=373, id=269, version=27412,
count=35, id=261, version=27412,
count=2, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/packages/ranks/fullstack-magic.exe
- IMPHASH cda4bf1ee2e43c5921d64b48cad76c9e
- SHA256 7e01d1f8f33c2df815d95078825da15efdeaa5cbd6a8556d8323c0d39ad0cd53
- MD5 4a629a32c3cc21b2276bb0785713eb1e
- SHA1 7888df74655fcbd13b80cf614098f1a773596438
- SHA512 1f1765b9699aa1da93763d956b2cc110228a74f492fde210e27b4ec4b7b26c55fefc6dd5a4e73c8e324b2208be28f52b8261a64247cb42f8330c9cfea451570d
- SSDEEP 24576:Mc8sHmuATYC2ts1BsuZYrPNVfBAmNvf26ikntJMVoUx8AI8AKwsKI2+Xf:z3Hmu+B2ts1BsEYhVHpfCKMVoUiAI8Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1147780
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\nevin\Desktop\kay\output\build\silence-workspace.pdb
kernel32
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
MoveFileExA
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
GetTickCount
GetLocaleInfoEx
GetFileType
QueryPerformanceCounter
VerSetConditionMask
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
QueryPerformanceFrequency
GetLocaleInfoA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
lstrcmpiA
Process32Next
CreateFileA
CreateToolhelp32Snapshot
CreateFileW
Process32First
GetCurrentProcess
SetLastError
CloseHandle
LoadLibraryA
GetCurrentProcessId
VirtualAlloc
DeviceIoControl
GetModuleFileNameA
VirtualFree
GetConsoleWindow
Sleep
GetModuleHandleA
SetConsoleTitleA
FormatMessageA
FreeLibrary
QueryFullProcessImageNameW
ReadFile
GetStdHandle
GetEnvironmentVariableA
VerifyVersionInfoA
WaitForSingleObjectEx
GetModuleHandleW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualProtect
CreateThread
DeleteCriticalSection
CreateDirectoryW
InitializeCriticalSectionEx
GetProcAddress
GetLastError
LoadLibraryExA
user32
ReleaseCapture
SetCursorPos
SetCursor
SetCapture
GetKeyboardLayout
SetProcessDPIAware
OpenClipboard
ClientToScreen
CloseClipboard
GetCapture
MonitorFromWindow
IsWindowUnicode
GetClientRect
EmptyClipboard
GetClipboardData
TrackMouseEvent
SetClipboardData
GetWindowRect
DestroyWindow
GetSystemMetrics
SetWindowLongA
SetWindowDisplayAffinity
MessageBoxA
GetMonitorInfoA
ScreenToClient
GetAsyncKeyState
GetForegroundWindow
GetCursorPos
SendInput
FindWindowA
GetMessageA
DispatchMessageA
ShowWindow
MoveWindow
RegisterClassA
DefWindowProcA
LoadCursorA
GetMessageExtraInfo
GetKeyState
UpdateWindow
RegisterClassExA
UnregisterClassA
PeekMessageA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
LoadIconA
PostQuitMessage
SetForegroundWindow
gdi32
CreateSolidBrush
advapi32
CryptDestroyKey
RegQueryValueExA
RegCloseKey
OpenProcessToken
RegSetValueExA
RegDeleteKeyA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptEncrypt
CryptImportKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
RegCreateKeyA
RegOpenKeyExA
shell32
Shell_NotifyIconA
ShellExecuteA
SHGetFolderPathW
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Query_perf_frequency
_Query_perf_counter
_Thrd_detach
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?setf@ios_base@std@@QEAAHHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Xtime_get_ticks
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
ntdll
RtlInitAnsiString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySystemInformation
RtlAnsiStringToUnicodeString
dbghelp
ImageRvaToVa
ImageDirectoryEntryToData
ImageNtHeader
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
memmove
memcpy
__current_exception
__std_exception_copy
memcmp
memchr
_CxxThrowException
_purecall
__std_exception_destroy
__C_specific_handler
strrchr
longjmp
strchr
__intrinsic_setjmp
strstr
__std_terminate
memset
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
realloc
free
_callnewh
calloc
api-ms-win-crt-math-l1-1-0
asin
acosf
ceil
atan2
_dclass
atan2f
pow
ldexp
roundf
log10
log
fmodf
fmod
floor
acos
_dsign
sin
ceilf
sinf
powf
sqrt
exp
cosf
tan
sqrtf
llround
cos
__setusermatherr
frexp
api-ms-win-crt-string-l1-1-0
isblank
strncmp
toupper
isalnum
strspn
isdigit
isxdigit
isspace
isalpha
isupper
_strdup
strcspn
strcmp
tolower
strncpy
iscntrl
_stricmp
strpbrk
strcoll
islower
ispunct
isgraph
api-ms-win-crt-runtime-l1-1-0
perror
_invalid_parameter_noinfo_noreturn
_errno
strerror
abort
exit
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
system
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_getpid
_beginthreadex
terminate
__sys_nerr
api-ms-win-crt-stdio-l1-1-0
fseek
ftell
__stdio_common_vsscanf
fputs
_lseeki64
_get_stream_buffer_pointers
fsetpos
fgetpos
fgetc
fputc
tmpnam
_set_fmode
__p__commode
__stdio_common_vsprintf
_fseeki64
_ftelli64
ungetc
_popen
setvbuf
tmpfile
_pclose
clearerr
_read
fgets
fwrite
_write
fread
feof
_close
__stdio_common_vfprintf
getc
fclose
fflush
__acrt_iob_func
fopen
ferror
freopen
_open
_wfopen
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
setlocale
_configthreadlocale
localeconv
api-ms-win-crt-time-l1-1-0
strftime
_time64
_localtime64
_gmtime64
_difftime64
_mktime64
clock
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
strtod
strtoull
atoi
strtoll
atof
api-ms-win-crt-filesystem-l1-1-0
_unlink
remove
_unlock_file
_fstat64
_access
rename
_lock_file
_stat64
api-ms-win-crt-utility-l1-1-0
qsort
rand
ws2_32
send
recv
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
bind
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
ntohl
WSAGetLastError
normaliz
IdnToAscii
crypt32
CryptStringToBinaryA
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
PFXImportCertStore
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore
wldap32
ord46
ord217
ord50
ord41
ord22
ord45
ord27
ord32
ord33
ord143
ord301
ord35
ord60
ord26
ord200
ord79
ord30
ord211
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
254KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=253, version=33218,
count=10, id=260, version=33218,
count=4, id=259, version=33218,
count=40, id=261, version=33218,
count=6, id=257, version=33218,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=2, id=260, version=32535,
count=2, id=261, version=32535,
count=608, id=1, productName=Unmarked objects,
count=41, id=257, version=30795,
count=69, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
kayflock-beta/packages/ranks/hh.exe
- IMPHASH d3d9c3e81a404e7f5c5302429636f04c
- SHA256 eb63fd45ed7ec773eccaf0f20d44bc9b4ed0a3e01779d62321b1da954a0f6eb8
- MD5 2c8fe78d53c8ca27523a71dfd2938241
- SHA1 0111959e0f521d0c01d258abbb42bba9c23e407d
- SHA512 4fba46ecc4f12bae5f4c46d4d6136bb0babf1abf7327e5210d1291d786ce2262473212a64da35114776b1ce26ead734a9fd3972ffa0f294d97ab6907953fd137
- SSDEEP 192:U8kHEFbfhORz4NqRGQE7KpcPUKU/dlk06Sl0+m5GJ1KDJD/QWc7:U8kH67heMMRGQEOpR/dlk06I1KDuWc7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6208
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
hh.pdb
advapi32
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryValueExW
kernel32
ExpandEnvironmentStringsA
LoadLibraryA
HeapSetInformation
SetProcessDEPPolicy
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
GetSystemTimeAsFileTime
Sleep
GetTickCount
msvcrt
?terminate@@YAXXZ
_fmode
_acmdln
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_vsnprintf
_commode
__C_specific_handler
memset
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=27412,
count=2, id=259, version=27412,
count=18, id=260, version=27412,
count=7, id=257, version=27412,
count=47, id=1, productName=Unmarked objects,
count=2, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/packages/ranks/lsasetup.log
- SHA256 54c97bf5e7d47340bcc7f58d55c2e1464b794023b55ab8bc29b95685d7a77fef
- MD5 80d8071326ebcadda64e8828561ee93b
- SHA1 5d3eebcfe11f6a1e594b8636239946f062253600
- SHA512 dad9dc1be19c2d3c48088ad05ac4765fed39c49fa921038b65e3a72e75b4be381917ca7909cbb7d6d03ac787dc3b4125988e4a970fe4f07725c8168baaf498d6
- MD5 SHA1 SHA512
kayflock-beta/packages/ranks/mib.bin
- SHA256 c2bf719b19848fb90245a45a19160b479be8138ff17dc82ea38c5ee65d20097b
- MD5 23af90d2355d8c83aa4567ef1763b467
- SHA1 08007f178be90ca8cb97de922ac4f8bf45691404
- SHA512 ee1479bff096e4fcb3bdbb57eb08a51df971dd0e8d629f7b36b0758654ed2b3cc9969163b1bdcf2c8b3c276c20e5c24c000874c2ccbaea37e09ce690e5c44115
- SSDEEP 384:crfecaVB5/5GGb6GrhMAIS5uQFRwv3e+prYTB1CT7XGOKMfGwfqI1Ie72XKB8bgS:crM/5GGTF5FFRi35prYH2GwlIPXIdG
- MD5 SHA1 SHA512 SSDEEP
kayflock-beta/packages/ranks/notepad.exe
- IMPHASH 09ed737a03db7295bf734a9953f6eb5e
- SHA256 cb448ea83bcf46a21aa9a9b258f39c85df962b18ae3682f2aaac9d79e2c04ebd
- MD5 bd4718db42d3ac15939d51d8f7fd0330
- SHA1 31315201b97b1eb85bb602dcb586c3a1a7b5dbf7
- SHA512 8f35950298154563d875afd9d67414c6f8fc8eb41f12b3857e694f536d36162f17686dfa23eff2ebb7cefbb74e0304d685cc68dfa7d2aca94cbea7fc10c4c0e9
- SSDEEP 3072:JfDg8iAAFxfJZwjPCSm3tK69oUnTYS/7zk+XDBG8BNJtALCgEvkwi6/LPlcF/NL:JriAAFr7vz9oUn8AoSDBrSLCXfFz2F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
146272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
notepad.pdb
kernel32
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
GlobalFree
GetLocaleInfoW
CreateFileW
ReadFile
GetACP
MulDiv
GetCurrentProcess
GetCommandLineW
HeapSetInformation
FreeLibrary
LocalFree
LocalAlloc
FindFirstFileW
FindClose
FoldStringW
GetModuleFileNameW
GetUserDefaultUILanguage
HeapFree
HeapAlloc
GetTimeFormatW
WideCharToMultiByte
WriteFile
GetFileAttributesW
LocalLock
LocalUnlock
DeleteFileW
SetEndOfFile
GetFileAttributesExW
GetFileInformationByHandle
CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
LocalReAlloc
UnmapViewOfFile
GetFullPathNameW
LocalSize
GetStartupInfoW
lstrcmpiW
FindNLSString
GlobalLock
GlobalUnlock
GlobalAlloc
GetDiskFreeSpaceExW
CreateDirectoryW
RegisterApplicationRestart
CreateSemaphoreExW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleHandleExW
ReleaseSemaphore
EnterCriticalSection
GetDateFormatW
SetLastError
GetLocalTime
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetModuleFileNameA
gdi32
CreateDCW
StartPage
StartDocW
SetAbortProc
DeleteDC
EndDoc
AbortDoc
EndPage
GetTextMetricsW
SetBkMode
LPtoDP
SetWindowExtEx
SetViewportExtEx
SetMapMode
GetTextExtentPoint32W
TextOutW
EnumFontsW
GetTextFaceW
SelectObject
DeleteObject
CreateFontIndirectW
GetDeviceCaps
user32
PostMessageW
MessageBoxW
GetMenu
CheckMenuItem
GetSubMenu
EnableMenuItem
ShowWindow
GetDC
ReleaseDC
SetCursor
GetDpiForWindow
SetActiveWindow
LoadStringW
DefWindowProcW
IsIconic
SetFocus
PostQuitMessage
DestroyWindow
MessageBeep
GetForegroundWindow
GetDlgCtrlID
SetWindowPos
RedrawWindow
GetKeyboardLayout
CharNextW
SetWinEventHook
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
UnhookWinEvent
SetWindowTextW
OpenClipboard
IsClipboardFormatAvailable
CloseClipboard
SetDlgItemTextW
GetDlgItemTextW
EndDialog
SendDlgItemMessageW
SetScrollPos
InvalidateRect
UpdateWindow
GetWindowPlacement
SetWindowPlacement
CharUpperW
GetSystemMenu
LoadAcceleratorsW
SetWindowLongW
CreateWindowExW
MonitorFromWindow
RegisterWindowMessageW
LoadCursorW
RegisterClassExW
GetWindowTextLengthW
GetWindowLongW
PeekMessageW
GetWindowTextW
EnableWindow
CreateDialogParamW
DrawTextExW
LoadIconW
LoadImageW
DialogBoxParamW
SetThreadDpiAwarenessContext
SendMessageW
MoveWindow
GetClientRect
GetFocus
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
wcscmp
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wtol
_o_exit
_o_free
_o_iswdigit
_o_malloc
_o_terminate
_o_toupper
__CxxFrameHandler3
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___stdio_common_vswprintf
__C_specific_handler
memcmp
memcpy
memmove
api-ms-win-core-com-l1-1-0
CoWaitForMultipleHandles
CoUninitialize
PropVariantClear
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoInitializeEx
CoCreateGuid
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsFileSpecW
PathFindExtensionW
PathFileExistsW
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-shcore-path-l1-1-0
ord170
api-ms-win-shcore-scaling-l1-1-1
GetDpiForMonitor
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
api-ms-win-core-synch-l1-1-0
SetEvent
CreateEventExW
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-eventing-provider-l1-1-0
EventProviderEnabled
api-ms-win-core-synch-l1-2-0
Sleep
comctl32
CreateStatusWindowW
ord345
Name
.text
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
728B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=27412,
count=3, id=259, version=27412,
count=9, id=257, version=27412,
count=1320, id=1, productName=Unmarked objects,
count=31, id=264, version=27412,
count=31, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/packages/ranks/setupact.log
- SHA256 d9565fb485c9c3ba0b11cda8184b10759eb84a80ba8fd0f9e5f3ae6aa7674190
- MD5 be2c5442dad68977abf129dfa81725c9
- SHA1 b98bf0c6a1cac9f9f071fa5f41768ac6d6232548
- SHA512 455ac1d334350d5f08e1d5848aa4c973249c8941053c63ac6464ec1fe0b643ae7ecaf3a41127f6c5de98cbf0e859b07cceec71f71a4ed57e73d6148d48c00dc7
- MD5 SHA1 SHA512
kayflock-beta/packages/ranks/splwow64.exe
- IMPHASH 0c613b55d7b5ccc10e4a17a05d719c8e
- SHA256 cf50db5a92f185b97e6e3f002dca0b079d75da6335c3e70b737059fa68784bf9
- MD5 dfd799e78afaaa7ebc91794fdf086395
- SHA1 8cc8124e39166b9feb45dcb818eaa24c78e7f6a5
- SHA512 e91ce925656d2ba99341d7d184c76e523b45b59fa9cd515fa7955bd2ac892e8ce4f6f4c69843a74e26a361a8aea6741c6427e4a2199dc3bd038487ab0e98987a
- SSDEEP 3072:ktVg+PN4fGNKDNtLT2aobZWYXRY4CHQbPRyZ2pPTI:Ya+PN4fUKDNtX2aCvS8AZ2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
75120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
splwow64.pdb
advapi32
TraceMessage
RegOpenKeyW
RegQueryValueExW
RegCloseKey
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
ConvertStringSecurityDescriptorToSecurityDescriptorW
RevertToSelf
GetSidSubAuthority
GetSidSubAuthorityCount
OpenThreadToken
OpenProcessToken
ConvertSidToStringSidW
GetTokenInformation
kernel32
SystemTimeToFileTime
Sleep
GetProcAddress
SetLastError
FreeLibrary
LoadLibraryExW
CreateActCtxW
ActivateActCtx
GetFullPathNameW
GetSystemDirectoryW
GetFileAttributesW
DeactivateActCtx
ReleaseActCtx
LoadLibraryW
TlsAlloc
TlsFree
GetModuleHandleW
HeapSetInformation
SetErrorMode
GetErrorMode
TlsSetValue
HeapFree
GetProcessHeap
HeapAlloc
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
InitializeCriticalSectionEx
OpenSemaphoreW
CreateThreadpoolTimer
CreateFileW
OpenProcess
DuplicateHandle
GetCurrentProcess
CreateMutexExW
CreateSemaphoreExW
SetEvent
InitializeCriticalSectionAndSpinCount
CreateEventW
SetThreadPreferredUILanguages
LocalFree
VirtualQuery
GetSystemInfo
LoadLibraryExA
VirtualProtect
GetCurrentThread
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObject
CreateThread
ProcessIdToSessionId
GetSystemTime
GetCurrentProcessId
RaiseException
GetLastError
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
user32
GetGUIThreadInfo
IsWindow
AttachThreadInput
EnumWindows
EnumChildWindows
GetWindowThreadProcessId
msvcrt
memset
memcpy
?terminate@@YAXXZ
__CxxFrameHandler3
memcmp
__dllonexit
_unlock
_lock
_commode
_fmode
_initterm
__setusermatherr
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free
memmove_s
memcpy_s
_wtol
_wcsicmp
_vsnwprintf
_purecall
__C_specific_handler
_cexit
_onexit
sqrt
winspool.drv
ClosePrinter
GetPrinterDataW
GetPrintOutputInfo
GetPrinterDriverW
OpenPrinterW
rpcrt4
RpcRevertToSelf
RpcImpersonateClient
RpcAsyncCompleteCall
RpcMgmtStopServerListening
RpcServerListen
NdrAsyncServerCall
NdrServerCallAll
Ndr64AsyncServerCallAll
NdrServerCall2
RpcServerUseProtseqEpW
RpcServerRegisterIf3
RpcServerInqBindings
RpcBindingVectorFree
RpcServerRegisterAuthInfoW
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
CoInitializeEx
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
NtReplyPort
NtAlpcOpenSenderThread
NtClose
NtCompleteConnectPort
NtAcceptConnectPort
NtCreatePort
RtlInitUnicodeString
TpReleasePool
TpCallbackMayRunLong
TpSetWait
TpSimpleTryPost
TpAllocWork
TpPostWork
TpAllocWait
TpAllocTimer
TpSetTimer
TpAllocIoCompletion
TpStartAsyncIoOperation
TpAllocAlpcCompletion
TpWaitForWork
TpReleaseWork
TpWaitForWait
RtlVirtualUnwind
TpWaitForTimer
TpReleaseTimer
TpWaitForIoCompletion
TpReleaseIoCompletion
TpWaitForAlpcCompletion
TpReleaseAlpcCompletion
EtwTraceMessage
EtwEventEnabled
EtwEventWrite
NtReplyWaitReceivePort
RtlNtStatusToDosError
ZwQueryWnfStateData
TpReleaseWait
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=21, id=260, version=27412,
count=7, id=261, version=27412,
count=19, id=257, version=27412,
count=248, id=1, productName=Unmarked objects,
count=36, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/packages/ranks/system.ini
- SHA256 6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b
- MD5 286a9edb379dc3423a528b0864a0f111
- SHA1 18db3e3dfb6b1d4dc9bc2226109112466de28db0
- SHA512 588720a82941b44338196f1808b810fecbbc56cb9979628f1126048c28f80b946314092a8dd26f5e7aca234b7163c4b9c1283a65c9b36be2a4da9966feb8b2cb
- MD5 SHA1 SHA512
kayflock-beta/packages/ranks/twain_32.dll
- IMPHASH 316cd668ed705c998eae8d3bd7bd168f
- SHA256 eec41d62ab5d2e1d880b338c47a2156a5ee7e58f3448f58cc8120392ddc8c730
- MD5 afe119dd4e17891b227684f38aa25d4d
- SHA1 2159772933e0ba4fb108edb93067cfdd067abf15
- SHA512 37309c74f3b6e356506c40c871a90294d9f874388a1417af9eb27cde085cf62a72af79b258c78cac0ac2ed8a183e349ffb8f67f2a9c3f46c1d19f2fe3ea9408f
- SSDEEP 768:uPC0xySqWNPwcKnReqpxORBoWNOMFN5cYsFx1gAmOURksWrk/VwLtkKavNi3IJzU:uPC0xyowcklqHw9xGkLrNLtBiNR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
56320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
twain_32.pdb
msvcrt
_chdir
strcpy_s
_getcwd
_errno
_strcmpi
_chdrive
strcat_s
sprintf_s
strncpy_s
_snprintf_s
_purecall
_ltoa
atol
free
_strnicmp
_vsnwprintf
memcpy_s
remove
_read
_close
_write
_lseek
_sopen
_locking
_vsnprintf
strncmp
_XcptFilter
_amsg_exit
_initterm
_lock
malloc
_getdrive
_unlock
__dllonexit
_onexit
_except_handler4_common
memcpy
memset
kernel32
SetLastError
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetTempPathA
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
HeapAlloc
PowerClearRequest
OpenSemaphoreW
WaitForSingleObjectEx
InitOnceComplete
OutputDebugStringW
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
HeapFree
CreateSemaphoreExW
InitOnceBeginInitialize
PowerSetRequest
GetModuleFileNameA
WriteProfileStringA
GetCurrentProcess
lstrcmpiA
MultiByteToWideChar
lstrlenA
GlobalSize
GetVersion
GetLastError
GlobalFlags
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
PowerCreateRequest
CloseHandle
FindFirstFileA
FindNextFileA
FindClose
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
GetWindowsDirectoryA
GetProcAddress
FreeLibrary
GetProfileStringA
GlobalHandle
OpenFile
user32
RegisterWindowMessageA
LoadStringA
SendMessageA
FindWindowA
PeekMessageA
DdeCmpStringHandles
DdeConnect
DdeQueryConvInfo
DdeClientTransaction
DdeDisconnect
DdeGetData
DdeGetLastError
DdeCreateStringHandleA
DdeCreateDataHandle
DdeUninitialize
DdeInitializeA
DdeFreeStringHandle
DispatchMessageA
TranslateMessage
UnhookWindowsHook
CallNextHookEx
EndDialog
DialogBoxParamA
SetFocus
SendDlgItemMessageA
SetWindowsHookA
GetDlgItem
EnableWindow
PostMessageA
IsWindow
CharUpperA
apphelp
ApphelpCheckExe
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister
AboutDlgProc
ChooseDlgProc
DSM_Entry
InfoHook
WGDlgProc
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=27412,
count=133, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=1, id=256, version=27412,
count=3, id=259, version=27412,
count=21, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/packages/ranks/win.ini
- SHA256 6b3d6e268dcb76e175a7db3d9e031349ab2c32654c7e57581a851e64dd6214ab
- MD5 23cf8138f49416231807e6de371fb9e6
- SHA1 973672eeae5a05447e47395cde37e8121b7c90fe
- SHA512 42ae18a96645289cb0246d545daa955d2fb0784993726414d0bc723dfb58b33cf11bb6b62ba7f5a3765e0c6c5713e8a02cd63638877ca032b82d4806e79950cf
- MD5 SHA1 SHA512
kayflock-beta/packages/ranks/winhlp32.exe
- IMPHASH 0dfde2c713801a5c7e6dc0108384fb68
- SHA256 4fce997bdd3475c42ba856d8c288fd4f9f91fd1370075ad7e0b11b1e71ae69ce
- MD5 0629e6d130f226c009ea9ab329f37acc
- SHA1 1529c6cf3265311b690992dc975443b35177bc7c
- SHA512 a36f25cd5b79891f0cc5a8e85636ce4ef10c91ec6d6c7c0f5c5b622d0af1f4f400c864d331caffaa8a51d9a2734777b5b9ce87cabb7667a9aceaf8837e88c847
- SSDEEP 192:ZomhYgSgGvZx5qdoth1Pdk7WneHWGhh4j8q05:L67gGnP7q7WneHWGhh44q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
7152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
winhstb.pdb
advapi32
EventRegister
EventWriteTransfer
EventUnregister
kernel32
GetModuleHandleExW
RaiseException
HeapSetInformation
GetProcAddress
FreeLibrary
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
msvcrt
__p__fmode
_controlfp
?terminate@@YAXXZ
free
_XcptFilter
__p__commode
_amsg_exit
__setusermatherr
_initterm
_cexit
_exit
exit
__set_app_type
__getmainargs
_except_handler4_common
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=20, id=260, version=27412,
count=2, id=261, version=27412,
count=11, id=257, version=27412,
count=43, id=1, productName=Unmarked objects,
count=1, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/packages/ranks/write.exe
- IMPHASH 90a23f469ba0443719430cba4569b220
- SHA256 a70d52eda892edc073932b462cc367cdbfbace3f4196857d8d4fa869a13de792
- MD5 b947cca7f485f6c1156f4d02e8c9874f
- SHA1 9f184e48f17f104c6a476687e8e760a65a0326b5
- SHA512 28c6ff32bc94aad8b201e469f854dde32cad9eb2e7a80ed858ac2ff99648312cecca06918bce96e8d905d52d5ebee076bd08d957f7933602c0c79d93ead20ee3
- SSDEEP 192:ZV89t7hglDCS8O3GbXdYFWihWxu/sWGOW:ZVM7hceSP3IXioxu/sWGOW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
write.pdb
shell32
ShellExecuteW
kernel32
TerminateProcess
GetCurrentProcess
GetStartupInfoW
HeapSetInformation
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
Sleep
msvcrt
_commode
?terminate@@YAXXZ
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=27412,
count=2, id=259, version=27412,
count=17, id=260, version=27412,
count=35, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=2, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
kayflock-beta/runtimes/win/lib/net6.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aa474c96b9fd17cb3580d89bb8eb716cb1407c89026b5e8180402666eeeb766a
- MD5 83cda4cc597e6a0b2ebbd1b8f41e94d3
- SHA1 10415fa323a21d412eb36e583a98385088065d61
- SHA512 ff7d869d416e3c47c082b8bd2d6907bbbe457d17d093cd84f66d42b978d143c088e008388041b440b01f7d82e373dde9b1b5c1acfd9553f98a63fa579d7ec8d2
- SSDEEP 6144:HG17jgxtTSfK7JK7XUUmhOzZiRZHhGASipzvZhHcx:HG17jgfefK747ZmhOzZiRZH2wgx
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a1:1f:af:de:e3:96:53:43:12:1d:b3:69:f3:c4:14:7a:af:b0:e0:69:63:ab:74:f0:17:b1:9c:67:e4:03:5e:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
286382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/net6.0-windows-Release/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
272KB
Virtual Size
271KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ