archive.7z
- SHA256 7c3b461ac1c770e3f1570e7c84bac81829d5afb06b6c85a7945537b1f3158cc0
Password
1234
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FileApp.exe
Resource
win10-20240404-es
windows10-1703-x64
44 signatures
600 seconds
Behavioral task
behavioral2
Sample
FileApp.exe
Resource
win7-20240729-es
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral3
Sample
FileApp.exe
Resource
win10v2004-20240802-es
windows10-2004-x64
11 signatures
600 seconds
General
- Target archive.7z
- Size 12.4MB
- Sample240812-ppalxsvfre
- SHA256 7c3b461ac1c770e3f1570e7c84bac81829d5afb06b6c85a7945537b1f3158cc0
- MD5 240a2abb7b6776afd9db6783485f2bce
- SHA1 711cbe4788c2f62a6ce5617aaf02ec40b1dfe413
- SHA512 f91893761d665a2a4d712175a52c4c12591134139e0fd9a50ea308afbe01a4d8279c0b63370be07a5693cc6234056974cb5eb3fe041b81169a8aaa13ddcd0b63
- SSDEEP 393216:pOvCzVd7AcF+VWe6s6wpHMmvdm6SGtFix5bi0+KZJ0MN:tzvA74rwZMJ6SgavKMN
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/data/Cache_Data/PrintConfig.dll unpack001/data/Cache_Data/mscorlib.dll unpack001/data/Cache_Data/mssrch.dll unpack001/data/dll/rdvgogl32.dll.mui
File Explorer
-
archive.7z.7z 12.4MB
-
FileApp.exe.exe 720.8MB
-
$TEMP/Hundred84KB
-
PeeingHarry/Subtle87KB
-
RouletteRedhead/Construction64KB
-
RouletteRedhead/Discretion68KB
-
RouletteRedhead/Dj57KB
-
RouletteRedhead/Gangbang10KB
-
RouletteRedhead/Lab246B
-
RouletteRedhead/Pour68KB
-
RouletteRedhead/Profile94KB
-
RouletteRedhead/Promoted30KB
-
RouletteRedhead/Road95KB
-
RouletteRedhead/Saying61KB
-
RouletteRedhead/Shorter61KB
-
RouletteRedhead/Thumbnail94KB
-
RouletteRedhead/Voted872KB
-
RouletteRedhead/Workshops98KB
-
data/Cache_Data/PrintConfig.dll.dll 2.9MB
-
data/Cache_Data/mscorlib.dll.dll 4.4MB
-
data/Cache_Data/mssrch.dll.dll 2.2MB
-
data/dll/Microsoft.Msmq.Activex.Interop.dll388B
-
data/dll/Microsoft.Msmq.PowerShell.Commands.dll491B
-
data/dll/Microsoft.Msmq.Runtime.Interop.dll723B
-
data/dll/PenIMC.dll.dll 12KB
-
data/dll/PhotoAcq.dll7KB
-
data/dll/mqcertui.dll279B
-
data/dll/mqise.dll15KB
-
data/dll/mqrt.dll4KB
-
data/dll/mqtrig.dll1KB
-
data/dll/rasppp.dll4KB
-
data/dll/rdvgogl32.dll.mui.dll 4KB
-
data/res_mods/Microsoft.GroupPolicy.AdmTmplEditor.dll626B
-
data/res_mods/Microsoft.GroupPolicy.Interop.dll656B
-
data/res_mods/mqtrig.dll1KB
-
data/res_mods/rasppp.dll1KB
-
data/res_mods/slc.dll315B
-
data/res_mods/sppc.dll284B
-
data/updates/Data/slc.dll316B
-
data/updates/PlayToStatusProvider.dll945B
-
data/updates/Uninstall/PhotoAcq.dll8KB
-
data/updates/secproc_ssp.dll254B
-
data/updates/sppc.dll286B
FileApp.exe
- IMPHASH be41bf7b8cc010b614bd36bbca606973
- SHA256 847bb424d852a1443fb522145959a7b35aca8ece5497a8e53a6b4e2cc0284974
- MD5 10eb329245b7c592d94b54939c4e4f1e
- SHA1 30f445fe8ae1043582f1cf5fb35b2854e2897b6f
- SHA512 8155a9bfbe432d66c20c4ce9c44581aee08b391824523806e9ea10ef51355c0216d630e1a663301d2548975204a6ee316caae2dd5f1cc39ffa97d42bfd79e3b5
- SSDEEP 1572864:HB11111111111111111111111111111111111111111111111111111111111117:
- MD5 SHA1 SHA512 SSDEEP
Password
1234
PE Signature issue
Digest
1a:ca:e5:c3:b8:87:52:18:e9:ec:9a:42:c2:6a:be:64:5a:60:04:c3:5d:9c:8c:71:b6:89:06:43:ef:b2:f6:8b
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jul 18, 2024
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 8, 2024 - Apr 10, 2027
Minor OS version
0
Major OS version
5
Entry point
14511
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$TEMP/Hundred
- SHA256 f8686358fbc1aaaffadd9ea6986bef68bd929bcf73fb37f532c011a68857a2a2
- MD5 3c603337855a0360ae7fe4a3d7130bae
- SHA1 4f033fb5cd6cca627d49d31614bbaecaf69f5801
- SHA512 1d164630466bd6826db54b2738cf34f118bc7666444ecfdcb66127bc3533f3851eaa359f73d5895b0334c5b88ba73de200a68ed93270462081ee20352657cb03
- SSDEEP 1536:hDb2ty35xHZd0BYRMIvLYuAY2XDc0x28YCatHscvnCYCvQBKj1bzlXoQq:At4LHZ+a9XgcSATtfvn1CvQBKjZFoQq
- MD5 SHA1 SHA512 SSDEEP
PeeingHarry/Subtle
- SHA256 eaf4752558ab39b7a4a4b7d0d7203b74504f021ccd194699b76c2a9b9a05f920
- MD5 c2b8f88c64dd399d0e1643ab246acc74
- SHA1 94ff6eebffca588a800d7af60717595f5eb260e5
- SHA512 3f2312be22deb582dc0634b39f8ee9ed286f5e2518d80520fecd7ee1a86787b2e09117615a976b75da4e1ffee2bbdef2e49a43d7f3abc950f1a7741f9cab8bc5
- SSDEEP 1536:1Y5XrGnCqIMag27aJ7AdXpMvBNxtzasSZ+eux69:1crGCMaueQvHTwZzux69
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Construction
- SHA256 426be0ca5792350680049d970f334dc1fbbdaf66114d24e09fa80906ec34b776
- MD5 f1a760939bbf04fd50a7fcffb925b3f8
- SHA1 6e1e572de529bc27864e40d81e3c7e5bf189a4b3
- SHA512 36342086a2903394c142fa9fe8e46515560479ca8ab15fbb67295e90533826ff6c6c86da98c4048885df8ec08126868f94a2464e5a54aabc4cda9028cf204a42
- SSDEEP 1536:TwBIiyQa/VnzDvAx5gjlufSjp0SdWs1i6Sz1LSVyM7GsY3cq:sw/BzDYgj4fSjhtvShOzY3cq
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Discretion
- SHA256 2ba9d55815b75a3be300ca0890a53e7c2ee16b3f1f838330a54d69d36f0a16b7
- MD5 e1285503e4e9924f9334358e57507345
- SHA1 a4d96751e18da68a16ef63d2a0a8340b113c391a
- SHA512 cebee001db3edc57c5ac3e913da2493fe2692f31fb8314fed028bcc806818a2208457cdc20cf11a8e92dc7a26956980fc652cde4a2652b39dc638580b7dfe331
- SSDEEP 768:xPo8GIxyj01SY9+I7HJQ+4gqeS84SPEnF3KA+l/+v49WKKqEOD4G6qdFwnjQuCco:5GiX7HJn3SYEIe0bKqUOPVcakLrV2p5r
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Dj
- SHA256 4a2b039829f85a86c707f74a41a7beb37538d2b454fac710b0809c54148b3807
- MD5 370fc6ad60fee6c79d2389b59a6ce763
- SHA1 6ccbb4c9ef2968c2e8762558261b598f0ac407aa
- SHA512 8ce8000fdc892ecfa5fbd1535b16e4574a83b58c11f9b28da6ff41ea8b04469e6a8e69a5994ce687730f0b0ea0cebe2f16a03783135d91f3a6d736540c1ac7e8
- SSDEEP 1536:ykOFn7odZ5ot9oCr0MtmKLocYZ6glG42oKfJ:Lgnsat9oCr0CmKLocYZ6glG42dR
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Gangbang
- SHA256 83987053484edb2fc303a5193f28ece6a04f6acd565982e741e6d762a612c503
- MD5 3a1eddbb4dfea260fa0b5e1311b100e8
- SHA1 682c49e8beb24dbbcfb2475ee7616cff5676eabf
- SHA512 6173296187a0115a6c6659424220368dbe1b87076933d934415aef84bf2f56d163d74d5c673a56916e9e0f45c0f529942e2e98fd43b65640e33e752b46317236
- SSDEEP 192:xpG2rhmXe2ldQ2LiOl3qeZgGvx4Za8vXwsBc3E7KxLxEcDyZm8HPWKqcO1BxTn+5:xpVhBY0Ol3qXGZ48vg20gt1nzo
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Lab
- SHA256 88f14ad9388326b6e394a08dc148a2cad54138045425d29d96aced194ef3971c
- MD5 7f659b1ec418e14e9c119befe717ad14
- SHA1 6efb7176e44618fc2f85d9434da97191bfaa81f8
- SHA512 a28ae43224c43662c46d2f32b58de051d4c9b574f1fbab0042189995d8c6897f807939406ccfced2b541fe97e83dff24f84922c85649363febc6314360f52a50
- MD5 SHA1 SHA512
RouletteRedhead/Pour
- SHA256 94903a5d7ac0e84fa19bbdd0d602c80441c8f4d23423097b01949c77178c6728
- MD5 1e380212aeee4051250207e64e7412e2
- SHA1 d07a818ba438115ef54b86a13f6898b502b8da68
- SHA512 4841b8f6b020ba1112d5a774a5ab02283a2de041bd654f2bae3fa18371ac4ebb6cd58719acf48435393f2afef37a071088a7cd50db02e46af399b739a42593f2
- SSDEEP 1536:FoGoh4IqMPrMBUdhRKzAZX797vMdCaQl5JuGTSdZeI:F989qM0UdTxZXpYCHHvI
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Profile
- SHA256 e5132a088632c91c887d41ca8b8d1ba1fea7b5aa53825ff7573f944e0e62d8ed
- MD5 f0bf8359f47a5ab39e5407b8e7ce4591
- SHA1 90c5c8e4c15c60521d409c3d2da9e4f4a63cdbc5
- SHA512 9f0ebff1910ec98a43dce137a43a9e6e21dfe851266decfe95335097e7a89c94e2eaccbee4fb634cc6ebac59c94eea922202b40ae9d8095b55b902beda334e07
- SSDEEP 1536:hi2aoTNIlByhGpV9/hvosT8oq3C8H2xIq4pivDsACiYUrEISZEwtfOZOCz9nLySC:hi2HTbhUr/+oIlPFpivDsACiZNSZEwtv
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Promoted
- SHA256 56b38de77277a818e9dddb8307434fee6beed8a26faf4ebb80e311991bf424a7
- MD5 0ff72b1108893368cd23553f6395d463
- SHA1 e169d2b41e3e09495d4f44b506fcfd52ae0845a7
- SHA512 e52396c82ea6832b63abcb6d2cedeb220563160fff9787e9d5e25a2b5d844414ac246cec76b60592fd8187fc2096fb1362d37b7884093da7b6a22e4d37f1a31b
- SSDEEP 768:Dp3R+jiBzaaJpomiE2MvLRa61HkLYUIFsjXlgD/CZ5:Dp3Aj7aJ1RabnIoXWE
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Road
- SHA256 7947fbebaf67fcc58a8bb63fed61e58438417bfac1fa96dea17074a9dc9be517
- MD5 904a3d6a30d97485d469cf77c1517d6d
- SHA1 4ebf48fcb48cbe894f9dc3e83eb15c9b59716b42
- SHA512 37da479bf82ad67cdc6049607a9ed8eaa144c79d93304516a9c0112bfba6b3865112b074fae43fde0f6a74dcaed2505944d9104f7fd42cceb1960a448e795d70
- SSDEEP 1536:op8Fra3zXSaeIyfNEr5LC5zxpDn7wosVgy69rwUYMMyHTzk/W/lWieBjM643cQq1:oyF+3TSaeIAhV3r8osh69rmiH/Sje64o
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Saying
- SHA256 af5d9928830d143a6ebe2acfd80b2b72069014cb837c31a49bdd4f9787c37478
- MD5 c4b29fde8df62b4f278176a70c166d12
- SHA1 f6c9c1dc854826067ff7e0cb820768965d3b8d58
- SHA512 e9030101e042e659e1a6d7a65a43e7267ebc4b097c8a72d596d957d22ff5747d51e3c70e26e88a7441b2a417834d74acbf06ab6a4cb81b550af175da31656406
- SSDEEP 768:ngm2Ui3DMw/c5vXPv7A0MgTZPDDMZ8fzSm6ctiaJBSijcK8O6cP0FY7BNTNbuG/7:gmtSNcp/vLTZPDDBS9YBSiIO6cz3TN1T
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Shorter
- SHA256 de37514375e9381e37106d01d14cc5373d095c39e052ee3188d6c116c71d0f05
- MD5 34cb1b1b2b751f5dcd760870528bcb41
- SHA1 0afb7f3b54e76bd4602761695c19703ec1974746
- SHA512 158ac527c0cc8ed9916b1bcf71df96097c4f741f2cf8d5844904200759d74eca4851e5672e94df218afbce2afeb4be58d02b35362e5cd6dd3e8c1e75de216b64
- SSDEEP 1536:iq6mYuObvcvCB6wOuBuoMbt3xpKczmBKo4jl/2V:56mtObvxB6Vvo+fQ0BeV
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Thumbnail
- SHA256 5482b87c25a05c32d77893bbcbb1b1817199322a8f8613b1049f5d5ab8704596
- MD5 2d2c4da886325bbdf26959ba43ca6cb0
- SHA1 c8658270fdc4c50f997ca74ab1534ac79dee2b16
- SHA512 d749c19826322672f27e65081a9021ce20fc3c6433f8231613b5b2ec28ffa2dd14e92c90b27a2449c7ad32187326eec57a7936764decd5f7de1668b34233d489
- SSDEEP 1536:gdgHCkRPUKfIAP7ezNjsEWVesOsc0XT8uuxndGw/Trf+6nvzVVo:9C50dKjassOFM41drLrPnvZO
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Voted
- SHA256 9d03f13e829dbecb8b059bd970a097c90c47123385d1e1da70848b5201916cfc
- MD5 e3256d7d0b9458678caf502137df7eb1
- SHA1 242fafe7d087acd64974c999d416547df8865430
- SHA512 40b8a0b489aa8e23450fcdc1f2edfb140192f6a9ed05794771bd40142418ebe4ac263e755d7149ff92e82f418bbb0a24e282b88d2e4dfed8cc12d0a2ce085be1
- SSDEEP 12288:ApVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:AT3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP
RouletteRedhead/Workshops
- SHA256 6c38a581bd72888557074ac4dc0172d2d4c8a3cc38f5f6f12fcf49ec9e69ff59
- MD5 2bfa7c50264a7011db52167a01e09e55
- SHA1 58ecd0c4c180a3df5b6e7d26e4b0dd9dcfb8988c
- SHA512 3ef78bd9f73affaea3d010d271583b602b5b2847b6e0eb881bcb9aa1ef8d57163fa98dd137c369fb75070574567377c38034f01dc4f21d3e5c0f027ffc74a7b9
- SSDEEP 3072:npVlUEPKDn4dWSZDKPmovWpoBu+pj4NV2hb:ZXPKUoSZ2PmyWiBliob
- MD5 SHA1 SHA512 SSDEEP
data/Cache_Data/PrintConfig.dll
- IMPHASH 4bb2134e88cdb7eaead9826df05441dc
- SHA256 e1bed4ac51ae54a5a39965036fafe2094db368c9db80e7a50d87a2b89613c775
- MD5 c4ccd7b372ea0d07c4325128aae48bfe
- SHA1 c39ce44e538ec36c5d54605b622829708e3e7437
- SHA512 93f5baba6e18d00a05d885e0aab25d9982de887259e0a33ab9e7b6adce9b8973ff3cfe99464dff2abd2bb48f1e960b7103468436143dd75140e0393398e90baf
- SSDEEP 49152:6xt48TfpGb9WGWCTte+5k43y9+Cb7BABUdfLvRHIcdreOSWPdR5ESPb:AfpGbBtewCPBvd7GcdreOJHr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
10
Entry point
1558624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
PrintConfig.pdb
msvcrt
??0exception@@QAE@ABQBDH@Z
_callnewh
fputc
wcstoul
realloc
strchr
fclose
fwrite
__mb_cur_max
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
wcschr
ungetwc
ungetc
fputwc
fgetwc
fgetc
strncmp
_wtoi
wcstol
_wtof
_time64
ldexp
_errno
_wtol
strcspn
localeconv
sprintf_s
memcpy
memmove
_wcsdup
__crtCompareStringW
calloc
wcscat_s
wcsncpy_s
_wcsnicmp
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
___lc_handle_func
__uncaught_exception
setlocale
_lock
_unlock
___mb_cur_max_func
___lc_codepage_func
_ismbblead
memset
islower
fprintf
_wsplitpath_s
_wmakepath_s
vfprintf
towupper
fseek
_wfsopen
___lc_collate_cp_func
memcmp
abort
isalnum
isdigit
_ftol2
floor
_ftol2_sse
_XcptFilter
_amsg_exit
_initterm
__dllonexit
_onexit
?terminate@@YAXXZ
__pctype_func
isupper
isspace
tolower
memchr
_CxxThrowException
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
wcscpy_s
_stricmp
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_vsnprintf_s
_except_handler4_common
??1type_info@@UAE@XZ
??8type_info@@QBEHABV0@@Z
ceil
wcsncmp
swprintf_s
atoi
_itow
wcstok_s
_vsnprintf
qsort
wcstod
iswspace
_ultoa_s
strrchr
iswctype
_strnicmp
wcsnlen
_vsnwprintf
wcsrchr
wcsstr
memmove_s
memcpy_s
_resetstkoflw
free
malloc
_wcsicmp
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
__CxxFrameHandler3
kernel32
VirtualProtect
LoadLibraryExA
GetSystemInfo
VirtualQuery
OutputDebugStringA
GetFinalPathNameByHandleW
GetPrivateProfileStringW
GetSystemDirectoryW
SetThreadUILanguage
LocaleNameToLCID
SetThreadPreferredUILanguages
LoadLibraryW
MulDiv
GetTempFileNameW
HeapCreate
SetErrorMode
SetFilePointer
GetFileTime
GetPrivateProfileIntW
GetPrivateProfileSectionW
LockResource
FindResourceW
GetSystemDefaultLCID
GetACP
GetUserDefaultUILanguage
VirtualFree
GetCPInfo
VirtualAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
DecodePointer
EncodePointer
GetStringTypeW
GetLastError
DeleteCriticalSection
CloseHandle
FreeLibrary
GetProcAddress
CreateFileW
ReadFile
InitializeCriticalSectionEx
GetFileAttributesExW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
GetModuleHandleW
GetFullPathNameW
GetFileSize
GetCurrentThreadId
HeapAlloc
HeapFree
FormatMessageW
SetLastError
GetCurrentProcess
GetCurrentThread
GetProcessHeap
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
MapViewOfFile
UnmapViewOfFile
ReleaseSRWLockShared
ReleaseSRWLockExclusive
DeleteFileW
OpenSemaphoreW
CreateThreadpoolTimer
OpenMutexW
CreateMutexW
RemoveDirectoryW
CreateDirectoryW
WriteFile
GetTempPathW
SetFileInformationByHandle
CreateFileMappingW
CreateProcessW
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
SetEvent
GetModuleFileNameW
CreateEventW
CreateActCtxW
ReleaseActCtx
QueueUserWorkItem
InitOnceBeginInitialize
InitOnceComplete
LocalFree
InitializeCriticalSection
ResetEvent
CloseThreadpoolWait
Sleep
CreateEventExW
GetTickCount64
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
MultiByteToWideChar
RaiseException
LoadResource
SizeofResource
FindResourceExW
LoadLibraryExW
lstrcmpiW
TerminateJobObject
CreateWaitableTimerW
WaitForMultipleObjects
IsWow64Process
WideCharToMultiByte
GetSystemWindowsDirectoryW
SetWaitableTimer
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
GetTickCount
MoveFileExW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
CopyFileW
CompareStringOrdinal
GlobalLock
GlobalSize
GlobalUnlock
OpenProcess
LocalAlloc
GetProcessId
CreateJobObjectW
AssignProcessToJobObject
ResumeThread
TerminateProcess
IsProcessInJob
CompareFileTime
CreateThread
GetComputerNameW
SystemTimeToTzSpecificLocalTime
OpenEventW
lstrcmpW
GetLocaleInfoW
EnumUILanguagesW
GetThreadPreferredUILanguages
HeapSize
HeapReAlloc
HeapDestroy
oleaut32
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
LoadRegTypeLi
VariantCopy
SystemTimeToVariantTime
VarBstrCat
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
VariantChangeType
VarUI4FromStr
SysFreeString
SysStringLen
SysAllocString
VariantInit
VariantClear
ole32
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CoUninitialize
CoInitializeEx
CLSIDFromProgID
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
PropVariantClear
StgCreateStorageEx
StgOpenStorageEx
CoGetCallerTID
CoRevertToSelf
CoImpersonateClient
GetHGlobalFromStream
StringFromGUID2
CoGetContextToken
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoGetClassObject
CoSuspendClassObjects
CoResumeClassObjects
rpcrt4
UuidFromStringW
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
RpcServerInqCallAttributesW
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
RpcStringFreeW
UuidToStringW
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
UuidCreate
winspool.drv
FreePrinterNotifyInfo
EnumPrintersW
FindFirstPrinterChangeNotification
FindClosePrinterChangeNotification
EnumJobsW
FindNextPrinterChangeNotification
SetJobW
EnumFormsW
GetFormW
SetPrinterW
OpenPrinterW
ClosePrinter
GetPrinterDataExW
GetPrinterDataW
OpenPrinter2W
SetPrinterDataW
GetPrinterDriverW
GetPrinterDriverDirectoryW
GetPrinterW
DeviceCapabilitiesW
DeleteFormW
AddFormW
DeletePrinterDataW
EnumPrinterDataExW
SetPrinterDataExW
DeletePrinterDataExW
advapi32
RegNotifyChangeKeyValue
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CopySid
GetLengthSid
IsValidSid
EqualSid
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
OpenThreadToken
TraceMessage
CreateWellKnownSid
AddAccessAllowedAceEx
RegGetValueW
RegDeleteKeyW
SetThreadToken
EventUnregister
EventRegister
EventWriteTransfer
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
SaferCloseLevel
SaferComputeTokenFromLevel
SaferCreateLevel
CreateProcessAsUserW
DuplicateTokenEx
CreateRestrictedToken
EventActivityIdControl
ConvertSidToStringSidW
IsWellKnownSid
RegOpenKeyW
RegCreateKeyW
DeleteService
OpenServiceW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CloseServiceHandle
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
shlwapi
ord12
SHCreateStreamOnFileEx
prntvpt
ord1
ord3
ord6
ord9
ord8
ord10
ord7
ord4
ord2
user32
PostMessageW
ShowWindow
CharNextW
GetParent
GetAppCompatFlags2
GetGUIThreadInfo
GetWindowLongW
SetWindowLongW
GetAncestor
SetFocus
SetForegroundWindow
LoadStringW
GetWindowThreadProcessId
AllowSetForegroundWindow
UnregisterClassA
DialogBoxParamW
LoadIconW
SetDlgItemTextA
SetDlgItemTextW
EndDialog
CheckRadioButton
MessageBoxW
MessageBeep
WinHelpW
SendDlgItemMessageW
GetDlgItemTextW
SetCursor
LoadCursorW
InvalidateRect
CheckDlgButton
DispatchMessageW
GetDlgItem
SendMessageW
SetActiveWindow
EnableWindow
GetFocus
GetActiveWindow
IsGUIThread
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
gdi32
ExtEscape
EnumFontFamiliesW
SetGraphicsMode
CreateDCW
CreateICW
GetDeviceCaps
DeleteDC
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile
DevQueryPrintEx
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPopulateFilterServices
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvResetConfigCache
DrvSplDeviceCaps
DrvUpgradePrinter
GetStandardMessageForPrinterStatus
MxdcGetPDEVAdjustment
NotifyEntry
ServiceMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
66KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=27412,
count=545, id=1, productName=Unmarked objects,
count=27, id=257, version=27412,
count=25, id=261, version=27412,
count=70, id=260, version=27412,
count=1, id=256, version=27412,
count=250, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
data/Cache_Data/mscorlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 562e44b89bfe0c40c7d1e092fcb477595b0a55b1e668687145f85fafb27d68ee
- MD5 4fcf81ede48c6a8967ceab6421f3f5bc
- SHA1 0fb59766b2095467a7fbe584193819954c3a0986
- SHA512 cbf5a5cde11c1dc6a8d0cadd9c718c8874b80097c2ace0091a92234bf80bedd62e1e65e4688a4b49c5198326ce4ebb34b1b227d0ab3b716356202db942a33a92
- SSDEEP 49152:rnkAOt911nq7Y9sk/IRUnPycw8fWpCvyPw3/zmTceDI:rnkb1d3PzE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
4081182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscorlib.pdb
mscoree
_CorDllMain
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
532KB
Virtual Size
530KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
data/Cache_Data/mssrch.dll
- IMPHASH 16234a7a0600b05bb65b8aaa6680f3b2
- SHA256 e242ee4f9bea6fb4f6a4d05e3aae2c1b7c51a77c273e7eae8d4017870a1612a7
- MD5 f367005ea070677c3ee6c47c53f4e802
- SHA1 1af3a1ddbc44f96d01ee1f06e9f5e3f94f76a027
- SHA512 4d7d75cb16cce462585b7b58aac7fa1af0694de5ac0e681bf08f4754c458203fee169dc7e9a72137620357edefcd7812a990ad7b3568e0ee179ad815d8442a27
- SSDEEP 49152:sb/90m1Z9V8PHetFqZQ3Lsz8YhWN/9xrmVb6297tpRC/F:W+m1Zz8vetIC3Lsz8YhWNFxr8T
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
10
Entry point
950896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mssrch.pdb
msvcrt
___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
___lc_collate_cp_func
wcstombs
memcmp
_aligned_malloc
___mb_cur_max_func
_aligned_free
time
srand
strcspn
localeconv
_ismbblead
memset
sprintf_s
__uncaught_exception
iswpunct
_wcsrev
_itow
wcscspn
wcsspn
islower
vswprintf_s
bsearch
feof
fgetws
_wfopen
wcstok_s
_wcsdup
_wtoi
fclose
swscanf_s
__crtCompareStringW
iswctype
__crtLCMapStringW
strrchr
__crtLCMapStringA
wcsrchr
_vsnprintf
toupper
_wsetlocale
abort
strchr
towlower
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
swscanf
strerror
_itow_s
towupper
_wtol
wcschr
isalnum
iswxdigit
iswdigit
iswspace
_ultow
_vscwprintf
__iob_func
realloc
_errno
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
wcstol
fprintf
strncmp
iswascii
swprintf_s
wcstok
qsort
_wcsupr
_wtoi64
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
calloc
wcsstr
wcsncpy_s
malloc
wcsncmp
memmove_s
_wcsnicmp
wcscat_s
wcscpy_s
free
_wcsicmp
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
setlocale
__CxxFrameHandler3
_ftol2
tquery
ciNew
ciDelete
ciNewNoThrow
??0CFullPropSpec@@QAE@ABV0@@Z
api-ms-win-core-libraryloader-l1-2-0
LoadResource
GetProcAddress
LoadStringW
GetModuleHandleA
LoadLibraryExW
FindResourceExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleFileNameW
LockResource
FindStringOrdinal
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
SizeofResource
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObject
EnterCriticalSection
TryAcquireSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
SetEvent
CreateMutexW
CreateMutexA
ReleaseSRWLockExclusive
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseMutex
CreateEventW
OpenMutexW
SetWaitableTimerEx
InitializeCriticalSectionEx
WaitForMultipleObjectsEx
CreateWaitableTimerExW
InitializeCriticalSection
OpenEventW
WaitForSingleObjectEx
ResetEvent
OpenSemaphoreW
CreateMutexExW
InitializeSRWLock
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapSize
HeapAlloc
HeapDestroy
HeapCreate
HeapCompact
HeapWalk
GetProcessHeap
HeapValidate
HeapFree
HeapReAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
SetErrorMode
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
TlsAlloc
ExitProcess
TlsFree
OpenThreadToken
CreateProcessAsUserW
GetCurrentProcess
SetThreadPriority
ResumeThread
GetCurrentProcessId
OpenProcessToken
GetExitCodeProcess
GetProcessId
CreateThread
CreateProcessA
CreateProcessW
TlsGetValue
GetPriorityClass
GetProcessTimes
TerminateProcess
GetCurrentThread
GetCurrentThreadId
SetPriorityClass
GetThreadPriority
ProcessIdToSessionId
api-ms-win-core-com-l1-1-0
CoCancelCall
CoDisableCallCancellation
CoCreateFreeThreadedMarshaler
PropVariantCopy
CoCreateGuid
CLSIDFromProgID
CoWaitForMultipleHandles
CoUninitialize
StringFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
ProgIDFromCLSID
StringFromGUID2
IIDFromString
CoImpersonateClient
CoEnableCallCancellation
CoGetMalloc
CoRevertToSelf
CoGetClassObject
CoGetCallContext
CoCreateInstance
CLSIDFromString
PropVariantClear
CoTaskMemFree
CoSetProxyBlanket
CoInitializeEx
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalAlloc
GlobalFree
LocalFree
api-ms-win-core-localization-l1-2-0
GetSystemPreferredUILanguages
ResolveLocaleName
GetSystemDefaultLCID
GetUserDefaultLangID
LocaleNameToLCID
FormatMessageA
GetLocaleInfoW
GetSystemDefaultLangID
LCMapStringW
FormatMessageW
GetNLSVersionEx
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
oleaut32
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayCreate
SafeArrayDestroy
VariantInit
LoadRegTypeLi
SystemTimeToVariantTime
SafeArrayPutElement
SysAllocString
SetErrorInfo
SafeArrayGetUBound
VariantTimeToSystemTime
SysFreeString
VariantChangeType
VariantCopy
DosDateTimeToVariantTime
VariantTimeToDosDateTime
SysStringLen
CreateErrorInfo
VariantClear
SysAllocStringLen
LoadTypeLi
VarUI4FromStr
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegQueryValueExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegSetKeySecurity
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyExW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
CompareStringOrdinal
CompareStringW
api-ms-win-core-file-l1-1-0
RemoveDirectoryW
ReadFile
CreateFileW
GetFileSizeEx
GetFileType
SetEndOfFile
GetTempFileNameW
CreateFileA
CompareFileTime
GetFileTime
CreateDirectoryW
DeleteFileA
FindFirstFileW
FindNextFileW
GetVolumeInformationW
GetLogicalDrives
FindClose
GetFullPathNameW
GetShortPathNameW
DeleteFileW
GetDiskFreeSpaceW
SetFileTime
GetVolumePathNameW
LockFile
GetDriveTypeW
WriteFile
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
LocalFileTimeToFileTime
SetFileAttributesW
GetFileAttributesW
UnlockFile
FlushFileBuffers
GetFileSize
SetFilePointer
api-ms-win-core-kernel32-legacy-l1-1-0
FileTimeToDosDateTime
DosDateTimeToFileTime
CopyFileA
GetSystemPowerStatus
GetComputerNameW
CreateFileMappingA
GlobalMemoryStatus
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CancelThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolTimer
CreateThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
DisassociateCurrentThreadFromCallback
SetThreadpoolWait
CreateThreadpoolWork
WaitForThreadpoolIoCallbacks
CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
SetThreadpoolTimer
CloseThreadpoolIo
api-ms-win-core-string-l2-1-0
CharNextW
CharLowerW
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce
ntdll
RtlCreateSystemVolumeInformationFolder
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
EtwEventWrite
NtQueryWnfStateData
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlGetDeviceFamilyInfoEnum
EtwEventEnabled
NtCreateFile
RtlInitUnicodeString
EtwEventActivityIdControl
RtlIsStateSeparationEnabled
RtlGetPersistedStateLocation
RtlNtStatusToDosError
NtDeleteKey
EtwEventWriteTransfer
EtwEventSetInformation
EtwEventRegister
EtwEventUnregister
RtlUnsubscribeWnfStateChangeNotification
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
api-ms-win-core-sysinfo-l1-1-0
GetVersionExA
GetSystemInfo
GetComputerNameExW
GetWindowsDirectoryW
GetTickCount64
GetVersionExW
GetVersion
GetLogicalProcessorInformationEx
GetSystemDirectoryW
GetTickCount
GetSystemTime
GetLocalTime
GetWindowsDirectoryA
GetSystemTimeAsFileTime
api-ms-win-shell-shdirectory-l1-1-0
ord290
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
PowerCreateRequest
PowerClearRequest
VerifyVersionInfoW
PowerSetRequest
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
GetCommandLineW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentDirectoryW
GetEnvironmentVariableW
api-ms-win-core-psapi-l1-1-0
K32EnumProcesses
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
api-ms-win-core-processthreads-l1-1-1
OpenProcess
GetThreadTimes
api-ms-win-core-file-l1-2-0
GetTempPathW
GetVolumeNameForVolumeMountPointW
api-ms-win-core-localization-obsolete-l1-2-0
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchCombineEx
PathCchSkipRoot
PathAllocCombine
PathCchCombine
PathCchAddBackslash
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathRemoveExtensionW
PathFileExistsW
PathIsUNCW
PathFindFileNameW
PathRemoveFileSpecW
PathGetDriveNumberW
PathAppendW
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
VirtualAlloc
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
VirtualFree
FlushViewOfFile
VirtualQuery
VirtualQueryEx
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventProviderEnabled
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
CopyFileExW
ReadDirectoryChangesW
MoveFileExW
api-ms-win-shcore-stream-l1-1-0
IStream_WriteStr
IStream_Write
IStream_ReadStr
IStream_Reset
SHCreateMemStream
IStream_Read
api-ms-win-core-io-l1-1-0
GetOverlappedResult
DeviceIoControl
CancelIoEx
cryptdll
MD5Final
MD5Init
MD5Update
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileStringW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
GlobalSize
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-shell-namespace-l1-1-0
SHBindToParent
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
CreateSemaphoreW
api-ms-win-security-trustee-l1-1-1
BuildExplicitAccessWithNameW
api-ms-win-core-debug-l1-1-1
CheckRemoteDebuggerPresent
api-ms-win-core-memory-l1-1-1
SetProcessWorkingSetSizeEx
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
api-ms-win-core-processthreads-l1-1-2
SetThreadInformation
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer
api-ms-win-core-wow64-l1-1-0
IsWow64Process
esent
JetMakeKey
JetOpenDatabaseA
JetMove
JetCommitTransaction
JetBeginTransaction
JetCloseDatabase
JetCloseTable
JetTerm2
JetDupCursor
JetAttachDatabaseA
JetIndexRecordCount
JetDetachDatabaseA
JetSetIndexRange
JetCreateTableColumnIndexW
JetGetTableColumnInfoW
JetOpenTableW
JetSetColumns
JetRollback
JetCreateIndex2A
JetUpdate
JetDeleteTableA
JetRetrieveColumns
JetBeginSessionA
JetCreateTableA
JetEndSession
JetDelete
JetDetachDatabaseW
JetSeek
JetOpenDatabaseW
JetGetColumnInfoA
JetOpenTableA
JetAttachDatabaseW
JetSetCurrentIndexA
JetAddColumnA
JetPrepareUpdate
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-core-job-l2-1-0
AssignProcessToJobObject
SetInformationJobObject
TerminateJobObject
CreateJobObjectW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-file-l2-1-1
OpenFileById
??0CSearchServiceObj@@QAE@ABV0@@Z
??0CSearchServiceObj@@QAE@XZ
??1CSearchServiceObj@@QAE@XZ
??4CSearchServiceObj@@QAEAAV0@ABV0@@Z
??_7CSearchServiceObj@@6B@
?Cleanup@CSearchServiceObj@@SGXXZ
?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
?HandleDplKeyChange@CSearchServiceObj@@UAGJXZ
?Initialize@CSearchServiceObj@@UAGJ_NKPBV?$vector@VReIndexPatternInfo@@V?$allocator@VReIndexPatternInfo@@@std@@@std@@@Z
?LogoffNotification@CSearchServiceObj@@UAGJK@Z
?LogonNotification@CSearchServiceObj@@UAGJK@Z
?PostServiceStartup@CSearchServiceObj@@UAGJXZ
?SetServiceStatusObj@CSearchServiceObj@@UAGJPAUIDCOMServiceStatus@@@Z
?Shutdown@CSearchServiceObj@@UAGJXZ
?Start@CSearchServiceObj@@UAGJXZ
?Stop@CSearchServiceObj@@UAGJH@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetCatalogManager
MSSrch_SysPrep_Cleanup
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=27412,
count=805, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=24, id=261, version=27412,
count=79, id=260, version=27412,
count=1, id=256, version=27412,
count=219, id=270, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
data/dll/Microsoft.Msmq.Activex.Interop.dll
- SHA256 d67fd50eb854b57cfaeff8c2a03ac0b0cdb11b7b361a18f5706defbd32bc438d
- MD5 1cb4feea1e9e8427dc462a168bffe070
- SHA1 c9a226797e67a38353be37f9ed340d1037f08a86
- SHA512 e70cbe5c0b022cd4d4bdf238c923479dd3885bb3986d35c152269b423bcba8964761f651650f0a63884fe9d18cbd1a98099a393d1737e3bf68e488419b7fd8dc
- MD5 SHA1 SHA512
data/dll/Microsoft.Msmq.PowerShell.Commands.dll
- SHA256 230f54cbe022828c8996aebbc28e80bffd7400fe2e3808a40ea3a38c7bbad1bb
- MD5 6dabe7292db031c16ce9222c4660e26a
- SHA1 3abcc38a3b8dc44eccff3ccd5458e9e836882b81
- SHA512 5eec2ae4d18595aeed8e830d7a24e21229bd143e699a54361e30aedb5b0ad2c77a23c660384a541e5b1741c3bdc2c6dc70de7d42eb14a4ec8ab4197a9273b84f
- MD5 SHA1 SHA512
data/dll/Microsoft.Msmq.Runtime.Interop.dll
- SHA256 d3bc009bafbaadd1914b7c2378440921e631e52dc42da2f1d54d432ba3f2a005
- MD5 0626c297b441ca5a17919ffa97028084
- SHA1 62ab5ccf24a49eb892b84a12eb1f79da17c2353d
- SHA512 6e1c703a6fcba763cc2552686908ec2cb5c1c866b93ddb4e5b7bd6270d4b1bec8c51e74acd1a3634c7f0e484bf68d447a3bfa1f5ffb6bf5f179ff8d42808fe43
- MD5 SHA1 SHA512
data/dll/PenIMC.dll
- SHA256 83ba52e4ddb6e1a294209faa95f1312a8222beb57ef30faf9a6829761d3bceab
- MD5 3c623b67a59b31dad7d02bccbc97ebb9
- SHA1 f38b0945b44edf2b3007195fec1ef878445f1cc3
- SHA512 e5e6b33248156d4b0af73d23cd39326d127059b8e0dd9f4da3fdd47b22cdae4faf976d2895f0350808003e66ab1a00c5bbb40c668bcde65689039ea4375ba0ef
- SSDEEP 192:gtlDWyX/WOfWyYyf8icHnhWgN7aMWUKIjwX01k9z3AzIe:g/WyX/WU2HRN7OHR9zmI
- MD5 SHA1 SHA512 SSDEEP
Password
1234
Digest
f8:ad:e4:c7:90:ed:9b:1b:66:89:30:40:5c:67:98:37:ea:59:f8:13:fe:91:bd:1c:41:65:f1:2d:c6:b4:87:86
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 5, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=258, productName=VS2019 v16.11.5 build 30136, version=30136,
data/dll/PhotoAcq.dll
- SHA256 f5e3a267b3097653412fcb33e61e994c87ca8c1cd5b0f7079a1a3959aa5bc9bc
- MD5 aacee66a145944bb6269c5dfbbc4e71a
- SHA1 074cac55bc40b820e0afa7c976045fc1b5b415ac
- SHA512 b5c298f9caaa059615b31991e8997a8ddad8faf76413400633cf0c86fd6d3b0758e47739f97f92c0183045b87ecf822559bf9f921e7f71c8385b389698e28caa
- SSDEEP 192:gdomfIVRhsnu8t7zuQCTANR4PVVsCuQ2uxu5x9Clfy:QomfIVRhsnu8JNC8KVdC6uJD
- MD5 SHA1 SHA512 SSDEEP
data/dll/mqcertui.dll
- SHA256 bf8ecdcadb1f459cf7367f99de791ab3e0bcaa986b86f4c77232fcbcdad8f38b
- MD5 7945fb731d11d63372bc04bba8c4c53b
- SHA1 50963ee725526c302a6bb40b6ad840d4426ae1b6
- SHA512 72672b15c1f43ea06a9429a2a81180d775f5c55a7aa647f09092777dcecc84ca0d2b92a872ed20d5063a4c19d9a46413556d52ca79c3674cc88b200ba520ea8f
- MD5 SHA1 SHA512
data/dll/mqise.dll
- SHA256 5ed39f855aaec22dd3a17121fa8b766c54cc3795d13bc9f5b2650fddb35044b5
- MD5 3630ddc8c7ee0094144bef3759553b48
- SHA1 49fb1a32f116e2f1c9771fa4844866972725ca94
- SHA512 f437cc48bab18684119aa0456b6b81157d7132ed771f7ef6198eafe638c290934f252f7df109b0a4ae125417363b0aa5c20c794f2104e6551482072b8081de0e
- SSDEEP 384:Ef3Bzlo6Rl1tldMmvBq4PAe7qX0X6FDDCsv5MM1BRvU:Ef3ll51tvMShoqXyHCsv5JtU
- MD5 SHA1 SHA512 SSDEEP
data/dll/mqrt.dll
- SHA256 b66f39b8ce33364f188348fceabe87ee70b732fb997841d828f3528cac80044e
- MD5 3a2e21df89825b44279d373a24dd537e
- SHA1 d3376c0a800dbde8f01a5ae2ba6863df310ecbe1
- SHA512 acf20fa609af0a50e2d4a704557eaca4cd41449a991119c50bdf9daf65aab1e7302c70aa7281f8af975ed85fbb2df7ff67305c322fc8150fe62b2d9904f38adb
- SSDEEP 96:9ewXWtPbap2tRoRLOa0sfRmwMPIiVOGEVZwp93n1RSPe:9ewmtTapOsOa0URlF0OGqCXD
- MD5 SHA1 SHA512 SSDEEP
data/dll/mqtrig.dll
- SHA256 a5846cc7dd01ad4e646c448d0533deef864100ffa24886a89a0af84cf79e0f6d
- MD5 460791045183c059766fded5fee09872
- SHA1 610e3de930ddc9f19058a84a4149cce10ed21a38
- SHA512 b61fb83c2f6f75c138669f02c6c06353db5f502978965e691a03793a02404b116afd21173b5c4d65f4b5fd2dcdd00ee61777d2677c2480a16ba5440561094c22
- MD5 SHA1 SHA512
data/dll/rasppp.dll
- SHA256 93cb417707f2150fc224b20a6a7c5a0352445a6b56a70bbc26d128b4cffb59b2
- MD5 47be8016078bb1112d6737aa1f6bc08c
- SHA1 5824fd54d22ab2050df13c877b2e6bdc13695209
- SHA512 22d3ebb11457fadfc806a00fa9f2a8d038c073264d036e7a8119dc1aa66effc12ece6230feb138c90bc16cdbb0d8faa9abe630575439bdf90e6212f0021822c7
- SSDEEP 96:5UnR1aOTdndnO+EGf6DmJiQXvTPGvOz08mBLy0KBuUoI0ViGsDdc:/8dwRGf0A/rP0QXmVy0qEViLDdc
- MD5 SHA1 SHA512 SSDEEP
data/dll/rdvgogl32.dll.mui
- SHA256 9974b935959e9a3ffa730bcc2f023623d915f991daed47e29f2c26cdd889119f
- MD5 b385e6a86db46f55a301e0c902bb4f0b
- SHA1 ac746caaf392af5004c1872d8958515f1219759e
- SHA512 b25259e4a93db012987df787edd75c33fe67d0a74e83659a7a0205290c4e695b9aaa049efecc5868053b3d814d488f2992815393c1ce555bb95b2ed3c31d3337
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
data/res_mods/Microsoft.GroupPolicy.AdmTmplEditor.dll
- SHA256 ea818872cf6943ffef5fc0786e4b8f8023a999efd6b23fad9e572c042f9ba014
- MD5 d72a68c0eaf536605dc8a2ebac540a42
- SHA1 68eeaa04015448245dbc27614aaa2b9db84ce2d0
- SHA512 02f0e18c8ff81d85136b120f737d09965e5149ea138fb0255deabf420a895d5de2725fbc0bbf031c5091c987f8f1aba3f56d5e69a0f22b13a3e0b101ce53dfe6
- MD5 SHA1 SHA512
data/res_mods/Microsoft.GroupPolicy.Interop.dll
- SHA256 ddaffbcbb0c2f7a5cf290954b30a7c8f191a2f854d95cd55f1a8f3be73525e28
- MD5 c17a013b3dc4cfc2ea262ae1f6da6c42
- SHA1 7949f4bc569476da6eb96a56b840ead939640bca
- SHA512 c46efef6cbe21a9bd83bd1c05308a90bd47a5971ab8654bff0feb554a66cfedd91f327862ac8f084752827cdad3375ef175c2e41bce121856b5429468f670cf2
- MD5 SHA1 SHA512
data/res_mods/mqtrig.dll
- SHA256 5d05e8b092e5b2ea822332946dcabbd65fc0860f9aa4c021ff74dae8f66d2058
- MD5 a8d6767cd8344b4c35c1a30a6e2f3488
- SHA1 c6204d65eac517f952a3cba7d7fe8e0623eef6d2
- SHA512 1dc3f13605bc9e257be10d1b645f9b78a953edd910cab0c10469b0943fc351c5b732c7bea8f42c7c3b88f323453a4461840a1dff98753141e20c5351474ec3b6
- MD5 SHA1 SHA512
data/res_mods/rasppp.dll
- SHA256 12a8f9d84b7b83c1bd527501e1b8def8d6689f5ce153940c3a3f64dc5893f5ea
- MD5 0eb06ab4944c14241c4c00c733b60558
- SHA1 5fd2fbf9f4e6ecc8b62be38fa24a4899914e552a
- SHA512 e5084fe664e1e127fb3f71216523d80ea9b14fa8fd1db478eca6689ba6bbfe961df4c450d8243a9e3da60ccb353768ee1e602251ed64cd1eb19b231a6d6cd126
- MD5 SHA1 SHA512
data/res_mods/slc.dll
- SHA256 7638079238cc2ab4812536568cae34392502595d87edc3ea8939d253af9f0eab
- MD5 00a158ddb46bf1381562a4fdafa84b97
- SHA1 b1ff2fa04f533ea593f224d48c64e921c0f4fdae
- SHA512 d4d2a741479877e31cedf0777be01fea2cfa2f994c3eebe18cec330d6987cae15b7289863c5d7a2993158a8a442f8fc5c0e9bd2570dd3d03b24d7539c10de2f9
- MD5 SHA1 SHA512
data/res_mods/sppc.dll
- SHA256 3a7023bdb66178288b13d8153f8552959652fbf4d33863c9b330b708547b4f42
- MD5 ef661f3535deb5e29ba1ba124bcb1787
- SHA1 0dba35ce597bf65e1dbf019cb59f8aa65878aa1d
- SHA512 5c03d62f2dfc0ba0db9fcde62151f7de52bab77a2148a8c19611eda016089e315885803c56d2f6abfe694dd121872d3ddf5743d20057812bb21becd05e434cfc
- MD5 SHA1 SHA512
data/updates/Data/slc.dll
- SHA256 60ebef0fabf78e8f23caebc5e07197bab9a93cabd45fb505fef4e8b408d10313
- MD5 20c7266077651941756910552384b61a
- SHA1 4476c7bacc7aec1c8b9d9c1522c5aa477fb0a307
- SHA512 cea8a9629ae3faed87058c47b1a1c5e69cd8631c711de1dfb9ca8e3ed5a825bead34c89820b68c1e84e7995a29c876887eb751584ad3807c55dac269da6e074b
- MD5 SHA1 SHA512
data/updates/PlayToStatusProvider.dll
- SHA256 1b6ab2fd2b1cfd5b0ae6af62585da0982471649e6610c74a82829fa3f2a6a6b8
- MD5 244a51781b46607fc852bc4b6eccdd76
- SHA1 f9f31af434e5cad4b451b72c732ed0d68cd4ac4b
- SHA512 f5bc2eb0dff611b2db63735e874c5acee202219a1d18cb1ef354a1774923fa198cd52de8512f0aec35392bdad8271fa306a3cf99c49aaf90abaf99044d821c3a
- MD5 SHA1 SHA512
data/updates/Uninstall/PhotoAcq.dll
- SHA256 18fe9c03f75a761b9c7e32e7230720575f37e639fc08daec21c416f1728bb650
- MD5 372b0907f0e45a25d3f94c7a6693dbf9
- SHA1 bcef5587b67ff0cddd36175a593974f1794beed1
- SHA512 456c264821eee6fb548b334e1874ca6f9b911333a5717f7cc6c17f4f474d4de4eca012799067d170b30cb73f5f0f0f4236f0b2673bd54ce23471a1899f6cfc61
- SSDEEP 192:K/AsnNrWx8yMZYhrsYAL3XDK1Ad83yPry/eIKZzV9NwlSkWGXn:KIsYxAZYdQe1AdK/RKFVbokGXn
- MD5 SHA1 SHA512 SSDEEP
data/updates/secproc_ssp.dll
- SHA256 1cf596d43ef402a932a8b33f95213bdc162ac022fc87acc1305715ebf51d6420
- MD5 283596f660822bdd22598b17b74ae222
- SHA1 dd2e17d8b4c8776e164f99af1741e99edc4f7968
- SHA512 4629617c28110257294b73e7bc8b89159347ca70b031c08be461c74ea233b4a899c4e8ee29118a1fe08d2137b93d9a66368e3897c944d27d14618244c27c1cbf
- MD5 SHA1 SHA512
data/updates/sppc.dll
- SHA256 290e4985e4221bb65cde17cecabb200d1c48f3398562916365b297d59f368a43
- MD5 f8e8648a12504a85f38fb7de925e2ce9
- SHA1 19ada628147003fd608f85e8c48efeda48624438
- SHA512 18b552d79dbf166a88f0a925dacefe45dbc7e1f12372c14dc52a91fb042f1cf3f6715c985b44feb73a38c3bf4eed64385e7a324f0cb5db5a3af048310646e4e0
- MD5 SHA1 SHA512