archive[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

archive.7z
Size

12.4MB
MD5

240a2abb7b6776afd9db6783485f2bce
SHA1

711cbe4788c2f62a6ce5617aaf02ec40b1dfe413
SHA256

7c3b461ac1c770e3f1570e7c84bac81829d5afb06b6c85a7945537b1f3158cc0
SHA512

f91893761d665a2a4d712175a52c4c12591134139e0fd9a50ea308afbe01a4d8279c0b63370be07a5693cc6234056974cb5eb3fe041b81169a8aaa13ddcd0b63
SSDEEP

393216:pOvCzVd7AcF+VWe6s6wpHMmvdm6SGtFix5bi0+KZJ0MN:tzvA74rwZMJ6SgavKMN

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/data/Cache_Data/PrintConfig.dll
unpack001/data/Cache_Data/mscorlib.dll
unpack001/data/Cache_Data/mssrch.dll
unpack001/data/dll/rdvgogl32.dll.mui

Files

archive.7z
.7z

Password: 1234
FileApp.exe
.exe windows:5 windows x86 arch:x86

Password: 1234

be41bf7b8cc010b614bd36bbca606973

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/04/2024, 00:00

Not After

10/04/2027, 23:59

Subject

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1a:ca:e5:c3:b8:87:52:18:e9:ec:9a:42:c2:6a:be:64:5a:60:04:c3:5d:9c:8c:71:b6:89:06:43:ef:b2:f6:8b
Signer

Actual PE Digest

1a:ca:e5:c3:b8:87:52:18:e9:ec:9a:42:c2:6a:be:64:5a:60:04:c3:5d:9c:8c:71:b6:89:06:43:ef:b2:f6:8b

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 516KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/Hundred
PeeingHarry/Subtle
RouletteRedhead/Construction
RouletteRedhead/Discretion
RouletteRedhead/Dj
RouletteRedhead/Gangbang
RouletteRedhead/Lab
RouletteRedhead/Pour
RouletteRedhead/Profile
RouletteRedhead/Promoted
RouletteRedhead/Road
RouletteRedhead/Saying
RouletteRedhead/Shorter
RouletteRedhead/Thumbnail
RouletteRedhead/Voted
RouletteRedhead/Workshops
data/Cache_Data/PrintConfig.dll
.dll regsvr32 windows:10 windows x86 arch:x86

Password: 1234

4bb2134e88cdb7eaead9826df05441dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PrintConfig.pdb

Imports

msvcrt

??0exception@@QAE@ABQBDH@Z
_callnewh
fputc
wcstoul
realloc
strchr
fclose
fwrite
__mb_cur_max
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
wcschr
ungetwc
ungetc
fputwc
fgetwc
fgetc
strncmp
_wtoi
wcstol
_wtof
_time64
ldexp
_errno
_wtol
strcspn
localeconv
sprintf_s
memcpy
memmove
_wcsdup
__crtCompareStringW
calloc
wcscat_s
wcsncpy_s
_wcsnicmp
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
___lc_handle_func
__uncaught_exception
setlocale
_lock
_unlock
___mb_cur_max_func
___lc_codepage_func
_ismbblead
memset
islower
fprintf
_wsplitpath_s
_wmakepath_s
vfprintf
towupper
fseek
_wfsopen
___lc_collate_cp_func
memcmp
abort
isalnum
isdigit
_ftol2
floor
_ftol2_sse
_XcptFilter
_amsg_exit
_initterm
__dllonexit
_onexit
?terminate@@YAXXZ
__pctype_func
isupper
isspace
tolower
memchr
_CxxThrowException
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
wcscpy_s
_stricmp
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_vsnprintf_s
_except_handler4_common
??1type_info@@UAE@XZ
??8type_info@@QBEHABV0@@Z
ceil
wcsncmp
swprintf_s
atoi
_itow
wcstok_s
_vsnprintf
qsort
wcstod
iswspace
_ultoa_s
strrchr
iswctype
_strnicmp
wcsnlen
_vsnwprintf
wcsrchr
wcsstr
memmove_s
memcpy_s
_resetstkoflw
free
malloc
_wcsicmp
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
__CxxFrameHandler3

kernel32

VirtualProtect
LoadLibraryExA
GetSystemInfo
VirtualQuery
OutputDebugStringA
GetFinalPathNameByHandleW
GetPrivateProfileStringW
GetSystemDirectoryW
SetThreadUILanguage
LocaleNameToLCID
SetThreadPreferredUILanguages
LoadLibraryW
MulDiv
GetTempFileNameW
HeapCreate
SetErrorMode
SetFilePointer
GetFileTime
GetPrivateProfileIntW
GetPrivateProfileSectionW
LockResource
FindResourceW
GetSystemDefaultLCID
GetACP
GetUserDefaultUILanguage
VirtualFree
GetCPInfo
VirtualAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
DecodePointer
EncodePointer
GetStringTypeW
GetLastError
DeleteCriticalSection
CloseHandle
FreeLibrary
GetProcAddress
CreateFileW
ReadFile
InitializeCriticalSectionEx
GetFileAttributesExW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
GetModuleHandleW
GetFullPathNameW
GetFileSize
GetCurrentThreadId
HeapAlloc
HeapFree
FormatMessageW
SetLastError
GetCurrentProcess
GetCurrentThread
GetProcessHeap
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
MapViewOfFile
UnmapViewOfFile
ReleaseSRWLockShared
ReleaseSRWLockExclusive
DeleteFileW
OpenSemaphoreW
CreateThreadpoolTimer
OpenMutexW
CreateMutexW
RemoveDirectoryW
CreateDirectoryW
WriteFile
GetTempPathW
SetFileInformationByHandle
CreateFileMappingW
CreateProcessW
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
SetEvent
GetModuleFileNameW
CreateEventW
CreateActCtxW
ReleaseActCtx
QueueUserWorkItem
InitOnceBeginInitialize
InitOnceComplete
LocalFree
InitializeCriticalSection
ResetEvent
CloseThreadpoolWait
Sleep
CreateEventExW
GetTickCount64
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
MultiByteToWideChar
RaiseException
LoadResource
SizeofResource
FindResourceExW
LoadLibraryExW
lstrcmpiW
TerminateJobObject
CreateWaitableTimerW
WaitForMultipleObjects
IsWow64Process
WideCharToMultiByte
GetSystemWindowsDirectoryW
SetWaitableTimer
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
GetTickCount
MoveFileExW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
CopyFileW
CompareStringOrdinal
GlobalLock
GlobalSize
GlobalUnlock
OpenProcess
LocalAlloc
GetProcessId
CreateJobObjectW
AssignProcessToJobObject
ResumeThread
TerminateProcess
IsProcessInJob
CompareFileTime
CreateThread
GetComputerNameW
SystemTimeToTzSpecificLocalTime
OpenEventW
lstrcmpW
GetLocaleInfoW
EnumUILanguagesW
GetThreadPreferredUILanguages
HeapSize
HeapReAlloc
HeapDestroy

oleaut32

LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
LoadRegTypeLi
VariantCopy
SystemTimeToVariantTime
VarBstrCat
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
VariantChangeType
VarUI4FromStr
SysFreeString
SysStringLen
SysAllocString
VariantInit
VariantClear

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CoUninitialize
CoInitializeEx
CLSIDFromProgID
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
PropVariantClear
StgCreateStorageEx
StgOpenStorageEx
CoGetCallerTID
CoRevertToSelf
CoImpersonateClient
GetHGlobalFromStream
StringFromGUID2
CoGetContextToken
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoGetClassObject
CoSuspendClassObjects
CoResumeClassObjects

rpcrt4

UuidFromStringW
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
RpcServerInqCallAttributesW
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
RpcStringFreeW
UuidToStringW
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
UuidCreate

winspool.drv

FreePrinterNotifyInfo
EnumPrintersW
FindFirstPrinterChangeNotification
FindClosePrinterChangeNotification
EnumJobsW
FindNextPrinterChangeNotification
SetJobW
EnumFormsW
GetFormW
SetPrinterW
OpenPrinterW
ClosePrinter
GetPrinterDataExW
GetPrinterDataW
OpenPrinter2W
SetPrinterDataW
GetPrinterDriverW
GetPrinterDriverDirectoryW
GetPrinterW
DeviceCapabilitiesW
DeleteFormW
AddFormW
DeletePrinterDataW
EnumPrinterDataExW
SetPrinterDataExW
DeletePrinterDataExW

advapi32

RegNotifyChangeKeyValue
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CopySid
GetLengthSid
IsValidSid
EqualSid
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
OpenThreadToken
TraceMessage
CreateWellKnownSid
AddAccessAllowedAceEx
RegGetValueW
RegDeleteKeyW
SetThreadToken
EventUnregister
EventRegister
EventWriteTransfer
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
SaferCloseLevel
SaferComputeTokenFromLevel
SaferCreateLevel
CreateProcessAsUserW
DuplicateTokenEx
CreateRestrictedToken
EventActivityIdControl
ConvertSidToStringSidW
IsWellKnownSid
RegOpenKeyW
RegCreateKeyW
DeleteService
OpenServiceW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CloseServiceHandle
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW

shlwapi

ord12
SHCreateStreamOnFileEx

prntvpt

ord1
ord3
ord6
ord9
ord8
ord10
ord7
ord4
ord2

user32

PostMessageW
ShowWindow
CharNextW
GetParent
GetAppCompatFlags2
GetGUIThreadInfo
GetWindowLongW
SetWindowLongW
GetAncestor
SetFocus
SetForegroundWindow
LoadStringW
GetWindowThreadProcessId
AllowSetForegroundWindow
UnregisterClassA
DialogBoxParamW
LoadIconW
SetDlgItemTextA
SetDlgItemTextW
EndDialog
CheckRadioButton
MessageBoxW
MessageBeep
WinHelpW
SendDlgItemMessageW
GetDlgItemTextW
SetCursor
LoadCursorW
InvalidateRect
CheckDlgButton
DispatchMessageW
GetDlgItem
SendMessageW
SetActiveWindow
EnableWindow
GetFocus
GetActiveWindow
IsGUIThread
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

gdi32

ExtEscape
EnumFontFamiliesW
SetGraphicsMode
CreateDCW
CreateICW
GetDeviceCaps
DeleteDC

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile

Exports

Exports

DevQueryPrintEx
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPopulateFilterServices
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvResetConfigCache
DrvSplDeviceCaps
DrvUpgradePrinter
GetStandardMessageForPrinterStatus
MxdcGetPDEVAdjustment
NotifyEntry
ServiceMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/Cache_Data/mscorlib.dll
.dll windows:4 windows x86 arch:x86

Password: 1234

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mscorlib.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 532KB - Virtual size: 530KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/Cache_Data/mssrch.dll
.dll regsvr32 windows:10 windows x86 arch:x86

Password: 1234

16234a7a0600b05bb65b8aaa6680f3b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mssrch.pdb

Imports

msvcrt

___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
___lc_collate_cp_func
wcstombs
memcmp
_aligned_malloc
___mb_cur_max_func
_aligned_free
time
srand
strcspn
localeconv
_ismbblead
memset
sprintf_s
__uncaught_exception
iswpunct
_wcsrev
_itow
wcscspn
wcsspn
islower
vswprintf_s
bsearch
feof
fgetws
_wfopen
wcstok_s
_wcsdup
_wtoi
fclose
swscanf_s
__crtCompareStringW
iswctype
__crtLCMapStringW
strrchr
__crtLCMapStringA
wcsrchr
_vsnprintf
toupper
_wsetlocale
abort
strchr
towlower
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
swscanf
strerror
_itow_s
towupper
_wtol
wcschr
isalnum
iswxdigit
iswdigit
iswspace
_ultow
_vscwprintf
__iob_func
realloc
_errno
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
wcstol
fprintf
strncmp
iswascii
swprintf_s
wcstok
qsort
_wcsupr
_wtoi64
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
calloc
wcsstr
wcsncpy_s
malloc
wcsncmp
memmove_s
_wcsnicmp
wcscat_s
wcscpy_s
free
_wcsicmp
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
setlocale
__CxxFrameHandler3
_ftol2

tquery

ciNew
ciDelete
ciNewNoThrow
??0CFullPropSpec@@QAE@ABV0@@Z

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetProcAddress
LoadStringW
GetModuleHandleA
LoadLibraryExW
FindResourceExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleFileNameW
LockResource
FindStringOrdinal
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
SizeofResource

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObject
EnterCriticalSection
TryAcquireSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
SetEvent
CreateMutexW
CreateMutexA
ReleaseSRWLockExclusive
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseMutex
CreateEventW
OpenMutexW
SetWaitableTimerEx
InitializeCriticalSectionEx
WaitForMultipleObjectsEx
CreateWaitableTimerExW
InitializeCriticalSection
OpenEventW
WaitForSingleObjectEx
ResetEvent
OpenSemaphoreW
CreateMutexExW
InitializeSRWLock
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapSize
HeapAlloc
HeapDestroy
HeapCreate
HeapCompact
HeapWalk
GetProcessHeap
HeapValidate
HeapFree
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
SetErrorMode

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
TlsAlloc
ExitProcess
TlsFree
OpenThreadToken
CreateProcessAsUserW
GetCurrentProcess
SetThreadPriority
ResumeThread
GetCurrentProcessId
OpenProcessToken
GetExitCodeProcess
GetProcessId
CreateThread
CreateProcessA
CreateProcessW
TlsGetValue
GetPriorityClass
GetProcessTimes
TerminateProcess
GetCurrentThread
GetCurrentThreadId
SetPriorityClass
GetThreadPriority
ProcessIdToSessionId

api-ms-win-core-com-l1-1-0

CoCancelCall
CoDisableCallCancellation
CoCreateFreeThreadedMarshaler
PropVariantCopy
CoCreateGuid
CLSIDFromProgID
CoWaitForMultipleHandles
CoUninitialize
StringFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
ProgIDFromCLSID
StringFromGUID2
IIDFromString
CoImpersonateClient
CoEnableCallCancellation
CoGetMalloc
CoRevertToSelf
CoGetClassObject
CoGetCallContext
CoCreateInstance
CLSIDFromString
PropVariantClear
CoTaskMemFree
CoSetProxyBlanket
CoInitializeEx

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalAlloc
GlobalFree
LocalFree

api-ms-win-core-localization-l1-2-0

GetSystemPreferredUILanguages
ResolveLocaleName
GetSystemDefaultLCID
GetUserDefaultLangID
LocaleNameToLCID
FormatMessageA
GetLocaleInfoW
GetSystemDefaultLangID
LCMapStringW
FormatMessageW
GetNLSVersionEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayCreate
SafeArrayDestroy
VariantInit
LoadRegTypeLi
SystemTimeToVariantTime
SafeArrayPutElement
SysAllocString
SetErrorInfo
SafeArrayGetUBound
VariantTimeToSystemTime
SysFreeString
VariantChangeType
VariantCopy
DosDateTimeToVariantTime
VariantTimeToDosDateTime
SysStringLen
CreateErrorInfo
VariantClear
SysAllocStringLen
LoadTypeLi
VarUI4FromStr

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegQueryValueExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegSetKeySecurity
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
CompareStringOrdinal
CompareStringW

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
ReadFile
CreateFileW
GetFileSizeEx
GetFileType
SetEndOfFile
GetTempFileNameW
CreateFileA
CompareFileTime
GetFileTime
CreateDirectoryW
DeleteFileA
FindFirstFileW
FindNextFileW
GetVolumeInformationW
GetLogicalDrives
FindClose
GetFullPathNameW
GetShortPathNameW
DeleteFileW
GetDiskFreeSpaceW
SetFileTime
GetVolumePathNameW
LockFile
GetDriveTypeW
WriteFile
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
LocalFileTimeToFileTime
SetFileAttributesW
GetFileAttributesW
UnlockFile
FlushFileBuffers
GetFileSize
SetFilePointer

api-ms-win-core-kernel32-legacy-l1-1-0

FileTimeToDosDateTime
DosDateTimeToFileTime
CopyFileA
GetSystemPowerStatus
GetComputerNameW
CreateFileMappingA
GlobalMemoryStatus

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CancelThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolTimer
CreateThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
DisassociateCurrentThreadFromCallback
SetThreadpoolWait
CreateThreadpoolWork
WaitForThreadpoolIoCallbacks
CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
SetThreadpoolTimer
CloseThreadpoolIo

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce

ntdll

RtlCreateSystemVolumeInformationFolder
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
EtwEventWrite
NtQueryWnfStateData
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlGetDeviceFamilyInfoEnum
EtwEventEnabled
NtCreateFile
RtlInitUnicodeString
EtwEventActivityIdControl
RtlIsStateSeparationEnabled
RtlGetPersistedStateLocation
RtlNtStatusToDosError
NtDeleteKey
EtwEventWriteTransfer
EtwEventSetInformation
EtwEventRegister
EtwEventUnregister
RtlUnsubscribeWnfStateChangeNotification

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA
GetSystemInfo
GetComputerNameExW
GetWindowsDirectoryW
GetTickCount64
GetVersionExW
GetVersion
GetLogicalProcessorInformationEx
GetSystemDirectoryW
GetTickCount
GetSystemTime
GetLocalTime
GetWindowsDirectoryA
GetSystemTimeAsFileTime

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest
PowerClearRequest
VerifyVersionInfoW
PowerSetRequest

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
GetCommandLineW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentDirectoryW
GetEnvironmentVariableW

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses
K32GetModuleFileNameExW
K32GetProcessImageFileNameW

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetThreadTimes

api-ms-win-core-file-l1-2-0

GetTempPathW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchCombineEx
PathCchSkipRoot
PathAllocCombine
PathCchCombine
PathCchAddBackslash

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveExtensionW
PathFileExistsW
PathIsUNCW
PathFindFileNameW
PathRemoveFileSpecW
PathGetDriveNumberW
PathAppendW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
VirtualAlloc
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
VirtualFree
FlushViewOfFile
VirtualQuery
VirtualQueryEx

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventProviderEnabled
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
CopyFileExW
ReadDirectoryChangesW
MoveFileExW

api-ms-win-shcore-stream-l1-1-0

IStream_WriteStr
IStream_Write
IStream_ReadStr
IStream_Reset
SHCreateMemStream
IStream_Read

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl
CancelIoEx

cryptdll

MD5Final
MD5Init
MD5Update

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock
GlobalSize

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-shell-namespace-l1-1-0

SHBindToParent

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateSemaphoreW

api-ms-win-security-trustee-l1-1-1

BuildExplicitAccessWithNameW

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-memory-l1-1-1

SetProcessWorkingSetSizeEx

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext

api-ms-win-core-processthreads-l1-1-2

SetThreadInformation

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer

api-ms-win-core-wow64-l1-1-0

IsWow64Process

esent

JetMakeKey
JetOpenDatabaseA
JetMove
JetCommitTransaction
JetBeginTransaction
JetCloseDatabase
JetCloseTable
JetTerm2
JetDupCursor
JetAttachDatabaseA
JetIndexRecordCount
JetDetachDatabaseA
JetSetIndexRange
JetCreateTableColumnIndexW
JetGetTableColumnInfoW
JetOpenTableW
JetSetColumns
JetRollback
JetCreateIndex2A
JetUpdate
JetDeleteTableA
JetRetrieveColumns
JetBeginSessionA
JetCreateTableA
JetEndSession
JetDelete
JetDetachDatabaseW
JetSeek
JetOpenDatabaseW
JetGetColumnInfoA
JetOpenTableA
JetAttachDatabaseW
JetSetCurrentIndexA
JetAddColumnA
JetPrepareUpdate

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject
SetInformationJobObject
TerminateJobObject
CreateJobObjectW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-file-l2-1-1

OpenFileById

Exports

Exports

??0CSearchServiceObj@@QAE@ABV0@@Z
??0CSearchServiceObj@@QAE@XZ
??1CSearchServiceObj@@QAE@XZ
??4CSearchServiceObj@@QAEAAV0@ABV0@@Z
??_7CSearchServiceObj@@6B@
?Cleanup@CSearchServiceObj@@SGXXZ
?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
?HandleDplKeyChange@CSearchServiceObj@@UAGJXZ
?Initialize@CSearchServiceObj@@UAGJ_NKPBV?$vector@VReIndexPatternInfo@@V?$allocator@VReIndexPatternInfo@@@std@@@std@@@Z
?LogoffNotification@CSearchServiceObj@@UAGJK@Z
?LogonNotification@CSearchServiceObj@@UAGJK@Z
?PostServiceStartup@CSearchServiceObj@@UAGJXZ
?SetServiceStatusObj@CSearchServiceObj@@UAGJPAUIDCOMServiceStatus@@@Z
?Shutdown@CSearchServiceObj@@UAGJXZ
?Start@CSearchServiceObj@@UAGJXZ
?Stop@CSearchServiceObj@@UAGJH@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetCatalogManager
MSSrch_SysPrep_Cleanup

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/dll/Microsoft.Msmq.Activex.Interop.dll
data/dll/Microsoft.Msmq.PowerShell.Commands.dll
data/dll/Microsoft.Msmq.Runtime.Interop.dll
data/dll/PenIMC.dll
.dll windows:6 windows x86 arch:x86

Password: 1234

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:ad:e4:c7:90:ed:9b:1b:66:89:30:40:5c:67:98:37:ea:59:f8:13:fe:91:bd:1c:41:65:f1:2d:c6:b4:87:86
Signer

Actual PE Digest

f8:ad:e4:c7:90:ed:9b:1b:66:89:30:40:5c:67:98:37:ea:59:f8:13:fe:91:bd:1c:41:65:f1:2d:c6:b4:87:86

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
data/dll/PhotoAcq.dll
data/dll/mqcertui.dll
data/dll/mqise.dll
data/dll/mqrt.dll
data/dll/mqtrig.dll
data/dll/rasppp.dll
data/dll/rdvgogl32.dll.mui
.dll windows:10 windows x86 arch:x86

Password: 1234

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
data/res_mods/Microsoft.GroupPolicy.AdmTmplEditor.dll
data/res_mods/Microsoft.GroupPolicy.Interop.dll
data/res_mods/mqtrig.dll
data/res_mods/rasppp.dll
data/res_mods/slc.dll
data/res_mods/sppc.dll
data/updates/Data/slc.dll
data/updates/PlayToStatusProvider.dll
data/updates/Uninstall/PhotoAcq.dll
data/updates/secproc_ssp.dll
data/updates/sppc.dll

Sharing

General

Malware Config

Signatures

Files

Password: 1234

Password: 1234

be41bf7b8cc010b614bd36bbca606973

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ffCertificate

Extended Key Usages

Key Usages

1a:ca:e5:c3:b8:87:52:18:e9:ec:9a:42:c2:6a:be:64:5a:60:04:c3:5d:9c:8c:71:b6:89:06:43:ef:b2:f6:8bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 458KB

.ndata Size: - Virtual size: 516KB

.rsrc Size: 88KB - Virtual size: 87KB

.reloc Size: 4KB - Virtual size: 3KB

Password: 1234

4bb2134e88cdb7eaead9826df05441dc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

oleaut32

ole32

rpcrt4

winspool.drv

advapi32

shlwapi

prntvpt

user32

version

gdi32

userenv

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.data Size: 66KB - Virtual size: 70KB

.idata Size: 13KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 64B

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 111KB - Virtual size: 110KB

Password: 1234

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff
Certificate

1a:ca:e5:c3:b8:87:52:18:e9:ec:9a:42:c2:6a:be:64:5a:60:04:c3:5d:9c:8c:71:b6:89:06:43:ef:b2:f6:8b
Signer

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 458KB

.ndata
Size: - Virtual size: 516KB

.rsrc
Size: 88KB - Virtual size: 87KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 66KB - Virtual size: 70KB

.idata
Size: 13KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 64B

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 111KB - Virtual size: 110KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rsrc
Size: 532KB - Virtual size: 530KB

.reloc
Size: 4KB - Virtual size: 12B