Installer-master-BlackMythWukong.rar
- SHA256 b28507f5d646bff668608fd5815137dc2317f2536bfd9dcbb4c412506b31856c
Password
2121
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Driver_x32.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Driver_x32.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Installer-master-BlackMythWukong.msi
Resource
win7-20240704-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
Installer-master-BlackMythWukong.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target Installer-master-BlackMythWukong.rar
- Size 54.8MB
- Sample240831-rjmemsxerr
- SHA256 b28507f5d646bff668608fd5815137dc2317f2536bfd9dcbb4c412506b31856c
- MD5 ee0ca9deced958f712b37416ded0ec77
- SHA1 cc2f57bc78c61b50b76605975ffc2271fce60bf7
- SHA512 fbf9d3ff8d5754aafab9f19b2c44b6c60d1e1b80f0fbf5b8cd492a4f6d82f38be225ee4e1e3d46251d1349e9d5f1be66f8cf11b2e6c1d0b60390193e589431e9
- SSDEEP 786432:yK9FbHTJiZVCh7UZaMwuM1nfRZ+bs4ZuRJhHxgqCiIFGD0TvjihWrc2oVNVjZc51:pLd8ChPuqfjis4ZuRJhaqqBTIIR1
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/dll/Microsoft.Msmq.Activex.Interop.dll unpack001/dll/mqcertui.dll unpack001/dll/mqoa.dll unpack001/dll/mqsnap.dll unpack001/dll/nshwfp.dll
File Explorer
-
Installer-master-BlackMythWukong.rar.rar 54.8MB
-
Driver_x32.exe.exe 1.9MB
-
Installer-master-BlackMythWukong.msi.msi 43.8MB
-
dll/Microsoft.Msmq.Activex.Interop.dll.dll 100KB
-
dll/Windows.Media.Protection.PlayReady.dll.dll 8.5MB
-
dll/install_from_ida.py5KB
-
dll/mispace.dll.dll 2.4MB
-
dll/mqcertui.dll.dll 14KB
-
dll/mqoa.dll.dll 281KB
-
dll/mqsnap.dll.dll 613KB
-
dll/nshwfp.dll.dll 601KB
-
ipyida/.gitignore28B
-
ipyida/LICENSE1KB
-
ipyida/README.adoc4KB
-
ipyida/README.virtualenv.adoc1KB
-
ipyida/__init__.py213B
-
ipyida/ida_plugin.py3KB
-
ipyida/ida_qtconsole.py8KB
-
ipyida/ipyida-screenshot.png.png 1.0MB
-
ipyida/ipyida_plugin_stub.py449B
-
ipyida/kernel.py8KB
-
ipyida/notebook.py7KB
-
ipyida/setup.py.py .sh 1KB
-
mispace.dll535KB
Driver_x32.exe
- IMPHASH 322007af740de7180c372869bc4e46e0
- SHA256 4b8390a4dcc7a6fee0e6f336f1f968863f324ca56ec597089d63ef10e9a1f9de
- MD5 d3601e19000f0745812b600b57e10ab1
- SHA1 b63e17df4e73234390f610769d013456c5e07131
- SHA512 ce8740d0ab032a80ea0f1e44162d6a2eba646adc77caaa4c5906ca6038df10e0f461259fa86282d22ebc1a1522114d78194362a9a1556180dc9a0603bae86335
- SSDEEP 49152:etO4J7W69DooDY0W5y9wM216qN+I/8gUKMMWmeqtKicIPWC:p4u0W5y9wM216qPUj4eqt0ID
- MD5 SHA1 SHA512 SSDEEP
Password
2121
Digest
28:56:5c:d7:46:7a:0d:c8:41:ac:c8:7c:26:65:be:40:7a:76:ec:00:fe:00:67:1c:87:2a:d5:89:01:e4:9f:08
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Lenovo,OU=G09,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
Chains
Dec 30, 2020
CN=Lenovo,OU=G09,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Lenovo,OU=G09,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
Serial Number
6f:69:17:9a:79:4a:35:5e:5f:5c:8f:21:12:a4:9c:4a
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 17, 2019 - Jan 6, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2014 - Jul 21, 2024
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
5
Entry point
154592
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
GetModuleFileNameW
GetLastError
GetACP
lstrlenW
CompareStringW
QueryPerformanceCounter
LocalFree
CloseHandle
VirtualProtect
WideCharToMultiByte
GetTickCount
FindClose
MultiByteToWideChar
LoadLibraryA
GetVersion
VirtualFree
RaiseException
ExitProcess
GetStartupInfoW
SwitchToThread
InitializeCriticalSection
GetEnvironmentVariableW
VirtualAlloc
WriteFile
RtlUnwind
GetSystemInfo
GetCommandLineW
GetProcAddress
DeleteCriticalSection
TlsGetValue
GetStdHandle
TlsSetValue
GetModuleHandleW
LoadLibraryExW
FreeLibrary
LocalAlloc
GetCurrentThreadId
UnhandledExceptionFilter
FindFirstFileW
VirtualQuery
SetThreadLocale
Sleep
comctl32
InitCommonControls
user32
CreateWindowExW
CharNextW
LoadStringW
oleaut32
SysAllocStringLen
SysFreeString
SysReAllocStringLen
advapi32
RegQueryValueExW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExW
AllocateAndInitializeSid
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
143KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
113B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Installer-master-BlackMythWukong.msi
- SHA256 395c44cce9624a5750c97c313b5ede45ea36dd623bc71f7d1bf2e4964492dcd4
- MD5 4cbea3318f7107adb73e10fd8de96abf
- SHA1 c6db50f856e92e5b0fa2f4b3855cbd58aa408fc1
- SHA512 724291101a4859c8e700ff762e48f6e2ded60fed23bfd64be7c438552c885b22d35b693ec03c2d234afe60d9defdc39ada77fedd9d3c881710935aa4e4f9b931
- SSDEEP 786432:H8JJ5v6bZ0no3r27KIvSOcaVWfoyI4aEK0Gpqq++mFIjqEKrdLi9VMkryQs:HC5i10noy7KS/RVLCqpP++mF+gLBf
- MD5 SHA1 SHA512 SSDEEP
dll/Microsoft.Msmq.Activex.Interop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c4686af0a6b25bf26733f9e3a37b16bd986fdb14d87079e87b93f323f6fd40df
- MD5 b7756ca15ed3ef312e323b3172d6560f
- SHA1 d89ae4e80fccda6aaa49c8927b507dac13d30bdd
- SHA512 b6a5f2ab7b4a6fb1dd07c5ef1227e3ed9ed062e355371848db255783fbb3326b708b577396462679ed0b0f88bfd3f151fd49a63944716b743bad8aabf4f1d656
- SSDEEP 1536:dyVRjGcWOoc1AV/c561fJWv0n1nMFMYFq9VI7zcYfEbLLd0MLxD/R:dymcWg0n1nMFjFq9VI7YYMbtT5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2121
Minor OS version
0
Major OS version
4
Entry point
95166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
88KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dll/Windows.Media.Protection.PlayReady.dll
- IMPHASH 3272cf4753562bdedf68f6b6df70aa27
- SHA256 b51a64f16fdf1c5f8d176978bdea55833ea3bf9b5c07e23093465ed733cc86a9
- MD5 696f9d97210f15b1e3db4c13bb6e52a4
- SHA1 1a7beacb965af59764aa41df2dc0ac027de19d28
- SHA512 ae2fd29b732c09786ca313be550b54e898fab1d25d82ba64d15bd7485d2583bcd7ff859498e7f11d1abd1a24c5dc4b9b5c5da08c960fe68f770ea3dee6f25e0f
- SSDEEP 196608:X4LqMlFY59Ze0VwxCYV6UQ46ODkkBjRnoXpkxzySnxiMlm1YESlR:X4GMlifZTVwxCGr6O/BCXpuzhn5m1C
- MD5 SHA1 SHA512 SSDEEP
Password
2121
Digest
22:52:42:c8:2c:d9:c1:fc:54:56:7b:26:54:58:97:d4:a1:f9:51:d9:14:1e:b0:14:94:5c:91:f9:cb:f2:28:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
129008
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Windows.Media.Protection.PlayReady.pdb
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceEnableLevel
api-ms-win-core-localization-l1-2-0
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
GetACP
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
ExitProcess
TlsGetValue
TlsSetValue
GetCurrentThreadId
GetStartupInfoW
TlsAlloc
TlsFree
GetExitCodeProcess
CreateThread
GetCurrentProcessId
CreateProcessW
TerminateProcess
GetCurrentProcess
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapSize
HeapFree
HeapCreate
HeapAlloc
GetProcessHeap
HeapDestroy
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadLibraryExW
LoadLibraryExA
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockShared
WaitForSingleObjectEx
ResetEvent
EnterCriticalSection
CreateEventW
WaitForSingleObject
InitializeSRWLock
AcquireSRWLockExclusive
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
ReleaseSemaphore
ReleaseMutex
SetEvent
LeaveCriticalSection
CreateEventExW
CreateMutexExW
CreateSemaphoreExW
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsGetStringLen
HSTRING_UserSize
HSTRING_UserUnmarshal
WindowsCreateStringReference
HSTRING_UserMarshal
HSTRING_UserFree
WindowsIsStringEmpty
api-ms-win-core-featurestaging-l1-1-0
GetFeatureEnabledState
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError
RoOriginateError
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoGetApartmentType
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoMarshalInterface
CoCreateInstance
CoGetMarshalSizeMax
CoUnmarshalInterface
CoWaitForMultipleHandles
PropVariantCopy
CoCreateFreeThreadedMarshaler
PropVariantClear
CoTaskMemAlloc
CreateStreamOnHGlobal
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
MapViewOfFile
VirtualQueryEx
VirtualProtect
VirtualQuery
VirtualFree
VirtualAlloc
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
api-ms-win-core-string-l1-1-0
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-processenvironment-l1-1-0
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStdHandle
SetStdHandle
GetCommandLineA
oleaut32
BSTR_UserFree
LPSAFEARRAY_UserSize
BSTR_UserSize
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
SysAllocString
SysFreeString
SysAllocStringLen
BSTR_UserUnmarshal
SysStringLen
BSTR_UserMarshal
LPSAFEARRAY_UserMarshal
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetLocalTime
GetVersionExW
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwind
api-ms-win-core-file-l1-1-0
GetFileType
SetFilePointer
CreateDirectoryW
ReadFile
WriteFile
CreateFileW
GetFileSize
LockFileEx
DeleteFileW
GetDiskFreeSpaceW
FlushFileBuffers
SetFileAttributesW
GetFileAttributesW
UnlockFileEx
SetEndOfFile
FileTimeToLocalFileTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-console-l1-1-0
GetConsoleCP
GetConsoleMode
WriteConsoleW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
propsys
PSCreateMemoryPropertyStore
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
api-ms-win-security-sddl-l1-1-0
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-core-kernel32-legacy-l1-1-0
GlobalMemoryStatus
mfplat
MFCopyImage
MFPutWorkItemEx2
MFPutWaitingWorkItem
MFGetSystemTime
MFPutWorkItem
MFScheduleWorkItemEx
MFLockWorkQueue
MFPutWorkItemEx
MFCreateAsyncResult
MFCreateTrackedSample
MFIsContentProtectionDeviceSupported
MFCreateMediaExtensionActivate
MFCreateCollection
MFShutdown
MFStartup
MFUnwrapMediaType
MFInvokeCallback
MFCreateMediaEvent
MFCreateAttributes
MFCreateEventQueue
MFCreateContentProtectionDevice
MFCreateContentDecryptorContext
MFUnlockWorkQueue
ntdll
VerSetConditionMask
rpcrt4
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
NdrCStdStubBuffer_Release
IUnknown_Release_Proxy
NdrDllCanUnloadNow
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrStubForwardingFunction
NdrStubCall2
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
api-ms-win-core-com-midlproxystub-l1-1-0
NdrProxyForwardingFunction5
NdrProxyForwardingFunction3
NdrProxyForwardingFunction4
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction7
CStdStubBuffer2_Connect
ObjectStublessClient3
CStdStubBuffer2_Disconnect
ObjectStublessClient10
ObjectStublessClient7
ObjectStublessClient5
NdrProxyForwardingFunction8
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient4
ObjectStublessClient16
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction6
ObjectStublessClient11
NdrProxyForwardingFunction9
ObjectStublessClient17
ObjectStublessClient19
ObjectStublessClient13
ObjectStublessClient15
ObjectStublessClient18
ObjectStublessClient14
ObjectStublessClient12
userenv
GetAppContainerRegistryLocation
api-ms-win-dx-d3dkmt-l1-1-0
GdiEntry13
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
api-ms-win-core-heap-l2-1-0
GlobalFree
LocalAlloc
LocalFree
api-ms-win-core-wow64-l1-1-0
IsWow64Process
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageId
GetCurrentPackageFamilyName
GetCurrentApplicationUserModelId
rtworkq
RtwqSetLongRunning
BootstrapReleaseUnusedResources
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
MSPRMFDllCanUnloadNow
MSPRMFGetClassObject
Name
.text
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=257, version=27412,
count=125, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=416, id=1, productName=Unmarked objects,
count=140, id=260, version=27412,
count=74, id=261, version=27412,
count=1, id=256, version=27412,
count=25, id=259, version=27412,
count=468, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
dll/install_from_ida.py
- SHA256 5e2422ba975571075b8b5d36f1805f12e974aa93616b4572731438f3ce67efb9
- MD5 f899824528d1ec959579997c1d7b9867
- SHA1 bf9fac7d1425302f6eb62d06f4999ba694cbb105
- SHA512 98026045e52319c7f98be5d9bfab174223323e1d1b7dd647df0aee8485921b6cb2d1d70b0ed1b59bb313721e93e67395e8b59fc1b0279a53bf2c3c2341fdb536
- SSDEEP 96:qvTdeyN4VsaklaIDVfJDJAHB0gb0QZQkbWJu2osKqvCz0JLHuuud:wTdeyN47klfVfJhN3u2osW0Y9d
- MD5 SHA1 SHA512 SSDEEP
dll/mispace.dll
- IMPHASH 96cc7d69d4489565fff1a31584ba2774
- SHA256 d5e013a2e0c3a01ff821068aeb82997c46eb9190cfaca0e6d6ce10a2a54e25e0
- MD5 9bb409faf3234d8f3335468cc2ac6bfd
- SHA1 83e40d2495ce1c764500eef7d0fd42638ccaf977
- SHA512 29edd9138a18ae6c4e39966b142eb52147a62372b6de8186868a59f1190e68aad3dcf06c82bd299a4a1b6869ffcfa50f552c677015051dcc79b396c28c24265a
- SSDEEP 49152:WGjrLVLB1eOjLq+D9tNXSzXdcOdEDEyTJRThu8UL:tHLf1njLRD9tNXSzXdcOdEDEy9dh8
- MD5 SHA1 SHA512 SSDEEP
Password
2121
Digest
34:75:02:f2:49:7d:a8:b1:16:7f:23:e0:50:f4:8b:9e:52:54:05:aa:b1:80:1f:42:3c:e6:08:51:0f:17:37:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
2175568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mispace.pdb
msvcrt
?terminate@@YAXXZ
_CxxThrowException
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_except_handler4_common
??1type_info@@UAE@XZ
_callnewh
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
memmove
_wcsicmp
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
memcpy_s
_vsnwprintf
__CxxFrameHandler3
wcstok_s
_ui64tow_s
_wcsnicmp
wcsnlen
_itow_s
_wtoi
_ftol2
towupper
wcschr
wcsncmp
wcsncat_s
swscanf_s
iswalpha
_wtoi64
iswspace
mbtowc
localeconv
wcsstr
_vscwprintf
memcmp
memcpy
toupper
malloc
free
swprintf_s
_onexit
isspace
memset
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemTime
GetTickCount
GetComputerNameExW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
FreeLibrary
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryExW
LoadStringW
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockShared
InitializeCriticalSection
CreateMutexExW
WaitForMultipleObjectsEx
OpenSemaphoreW
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection
ResetEvent
ReleaseMutex
InitializeSRWLock
AcquireSRWLockExclusive
WaitForSingleObject
SetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
InitializeCriticalSectionEx
LeaveCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWorkCallbacks
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SubmitThreadpoolWork
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
CloseThreadpool
CreateThreadpool
CreateThreadpoolWork
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
OpenThreadToken
CreateThread
ResumeThread
TlsGetValue
SetThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-handle-l1-1-0
CloseHandle
rpcrt4
UuidCreate
RpcServerListen
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
NdrServerCall2
RpcRevertToSelf
RpcImpersonateClient
I_RpcServerDisableExceptionFilter
api-ms-win-core-synch-l1-2-0
Sleep
sxshared
SxTracerGetThreadContextRetail
SxTracerShouldTrackFailure
SxTracerDebuggerBreak
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegGetValueW
RegDeleteKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-security-base-l1-1-0
IsValidSid
GetLengthSid
AdjustTokenPrivileges
CopySid
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ImpersonateLoggedOnUser
DuplicateTokenEx
RevertToSelf
GetTokenInformation
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoUninitialize
CLSIDFromString
CoTaskMemFree
CoDisconnectObject
CoCreateGuid
CoSetProxyBlanket
CoCreateInstance
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-file-l1-1-0
FlushFileBuffers
QueryDosDeviceW
SetFilePointer
FindFirstVolumeW
ReadFile
GetDriveTypeW
GetDiskFreeSpaceW
WriteFile
SetFilePointerEx
DeleteFileW
GetVolumePathNameW
GetFileAttributesW
CreateFileW
FindClose
GetFinalPathNameByHandleW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
FindNextVolumeW
CompareFileTime
DeleteVolumeMountPointW
GetDiskFreeSpaceExW
CreateDirectoryW
FindVolumeClose
DefineDosDeviceW
GetLongPathNameW
GetVolumeInformationW
GetFileSizeEx
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
sspicli
LogonUserExExW
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
EnableTraceEx2
StartTraceW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l2-1-0
MoveFileWithProgressW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
CompareStringW
api-ms-win-core-file-l1-2-0
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-devices-config-l1-1-1
CM_Get_Parent
srvcli
NetShareAdd
NetShareEnum
NetShareDel
netutils
NetApiBufferFree
api-ms-win-core-perfcounters-l1-1-0
PerfSetCounterSetInfo
PerfStartProviderEx
PerfCreateInstance
PerfDeleteInstance
PerfSetULongCounterValue
PerfIncrementULongCounterValue
PerfStopProvider
wmiclnt
WmiQueryAllDataW
WmiOpenBlock
WmiCloseBlock
devobj
DevObjDeleteDevice
DevObjEnumDeviceInfo
DevObjDestroyDeviceInfoList
DevObjGetDeviceInterfaceDetail
DevObjEnumDeviceInterfaces
DevObjGetDeviceRegistryProperty
DevObjOpenDeviceInterface
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjGetDeviceInstanceId
ntdll
RtlGetLastNtStatus
RtlSetThreadErrorMode
NtQueryVolumeInformationFile
NtPowerInformation
NtQuerySystemInformation
RtlFreeHeap
RtlAllocateHeap
NtSystemDebugControl
RtlNtStatusToDosError
NtCompareTokens
RtlEnumerateGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
EtwTraceMessage
RtlDeleteElementGenericTableAvlEx
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitAnsiString
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
SetVolumeMountPointW
wevtapi
EvtArchiveExportedLog
EvtExportLog
mi
MI_Application_InitializeV1
virtdisk
GetStorageDependencyInformation
resutils
ResUtilFindSzProperty
bcrypt
BCryptGenRandom
cfgmgr32
CM_Unregister_Notification
CM_Reenumerate_DevNode
CM_MapCrToWin32Err
CM_Register_Notification
CM_Reenumerate_DevNode_Ex
bcd
BcdOpenSystemStore
BcdCloseObject
BcdOpenObject
BcdDeleteObject
BcdCloseStore
BcdEnumerateObjects
BcdEnumerateElementTypes
BcdGetElementDataWithFlags
BcdSetElementData
BcdDeleteElement
BcdGetElementData
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualFree
api-ms-win-core-rtlsupport-l1-2-0
RtlCompareMemory
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
PreShutdown
SetShutdownCallback
SmpUnload
WspCheckMinimumSubsystemVersion
WspCompleteMethod
WspCreateJob
WspEnumerateRemoteInstances
WspFreeString
WspGetClassName
WspGetRemoteInstance
WspGetSubsystemFilter
WspGuidToString
WspInvokeRemoteMethod
WspIsAutomaticClusteringEnabled
WspIsRemoteInstance
WspIsRemoteRequest
WspPackObjectId
WspPostAssociation
WspPostSubsystemAssociationReferenceObject
WspProviderEnter
WspProviderExit
WspReferencesOfRemoteInstance
WspRunMethodAsJob
WspSendIndication
WspUnpackObjectId
WspUpdateMethod
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
60KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
184KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=98, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=260, version=27412,
count=9, id=259, version=27412,
count=414, id=1, productName=Unmarked objects,
count=21, id=257, version=27412,
count=7, id=261, version=27412,
count=1, id=256, version=27412,
count=207, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
dll/mqcertui.dll
- IMPHASH 7e2c8964de87ab813c601b588607ecc6
- SHA256 c9b9278ff04844ea9f3fcfb4b4762e86ed887edbfdc4497990447eef70da3c85
- MD5 ead10942c26b68339ebf98e16a234ede
- SHA1 c737ac5c2de9aa1910a4fcb561195d6cf1b9dd19
- SHA512 e3e6222f8a7dc7a95de063803b494d53596bcd1432b09008640ce93d6d0229db1445b3f0e3d1a97c04fc698df2ee127c1ece846f737d54550b68fa97c0ff4005
- SSDEEP 384:Y5DKHa3q/fNVjFMR+AIze1AsVEUrM38XWLxW7N:zFVjFSY8oU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2121
Minor OS version
0
Major OS version
10
Entry point
9216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mqcertui.pdb
msvcrt
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
??1type_info@@UAE@XZ
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
free
_except_handler4_common
?terminate@@YAXXZ
_callnewh
__CxxFrameHandler3
memset
kernel32
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
Sleep
QueryPerformanceCounter
GetCurrentThreadId
user32
SetWindowTextW
EndDialog
SendMessageW
DialogBoxParamW
MessageBoxW
GetWindowPlacement
SetWindowPlacement
EnableWindow
GetDlgItem
LoadStringW
ShowWindow
comctl32
ord17
crypt32
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreW
CertDuplicateCertificateContext
CertCloseStore
advapi32
CryptAcquireContextW
CryptReleaseContext
cryptui
CryptUIDlgViewCertificateW
mqsec
MQSigCloneCertFromSysStore
MQSigCreateCertificate
MQSigCloneCertFromReg
mqrt
MQFreeMemory
RTGetInternalCert
mqutil
MQGetResourceHandle
SelectPersonalCertificateForRegister
SelectPersonalCertificateForRemoval
ShowCertificate
ShowPersonalCertificates
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=27412,
count=13, id=260, version=27412,
count=56, id=1, productName=Unmarked objects,
count=21, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=3, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
dll/mqoa.dll
- IMPHASH fe565bc43e01092ee087db21572e5104
- SHA256 1afe45870c0b4742c90f7e6ee5de2255725345e111b08c3e29536634a9130f67
- MD5 1347efa2ce1060c9f9e173ccd362c17d
- SHA1 a5d57d608deabe9fb99a7a3697f54f7753bc1bc6
- SHA512 4ec53fe644e1dc42d62bbbd4bbedd911a3a077c48e77e68ea0408050c3a55e2763d3ead94d6e66df5d06fa63ad09ca9bc6827ee83fbddb90f18c1ca2ceffe36a
- SSDEEP 6144:gPu8ZGT3LE8q5kz+rDXjtmDfSUrihwaaX/IYw:8I3LXz+gjVrJamI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2121
Minor OS version
0
Major OS version
10
Entry point
148688
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mqoa.pdb
msvcrt
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_purecall
_vsnwprintf
?what@exception@@UBEPBDXZ
free
malloc
wcscat_s
memcpy_s
_vsnprintf_s
memmove_s
_ui64tow_s
_snwscanf_s
??0exception@@QAE@ABQBD@Z
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
realloc
mktime
iswspace
wcschr
time
_wcsnicmp
localtime
_initterm
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
_lock
memcmp
memcpy
_unlock
__dllonexit
_onexit
__CxxFrameHandler3
??0exception@@QAE@XZ
memset
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetLastError
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetComputerNameW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
lstrcpynW
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
DisableThreadLibraryCalls
HeapDestroy
GetModuleHandleA
FormatMessageW
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
InitializeCriticalSectionEx
GlobalAlloc
GlobalLock
WaitForSingleObject
OpenSemaphoreW
CreateThreadpoolTimer
GlobalHandle
GlobalFree
GlobalUnlock
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
LoadLibraryW
GetCurrentThread
GetCurrentProcess
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW
user32
RegisterClassA
CharPrevW
CharNextW
DestroyWindow
SetWindowPos
SetWindowLongW
CreateWindowExW
GetWindowLongW
DefWindowProcA
PostMessageA
IsWindow
CharLowerW
LoadStringW
UnregisterClassA
RegisterWindowMessageW
advapi32
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
CopySid
GetTokenInformation
OpenProcessToken
OpenThreadToken
TraceMessage
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetAce
EqualSid
GetAclInformation
ole32
ReadClassStg
OleSave
StgCreateDocfileOnILockBytes
OleSaveToStream
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StringFromGUID2
ReadClassStm
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString
CreateStreamOnHGlobal
oleaut32
CreateErrorInfo
VariantTimeToSystemTime
VariantCopy
SysFreeString
SysStringLen
SetErrorInfo
SystemTimeToVariantTime
SysReAllocString
VariantChangeType
SysStringByteLen
SafeArrayPutElement
VariantClear
SysAllocStringByteLen
LoadRegTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VarUI4FromStr
SysAllocStringLen
SysAllocString
VariantInit
mqsec
MQSec_GetAnonymousSid
MQSec_GetWorldSid
MQSec_GetDefaultQueueAuthentication
MQSec_GetDefaultHashAlgorithm
MQSec_GetDefaultMessageAuthenticationLevel
mqrt
MQBeginTransaction
RTXactGetDTC
MQInstanceToFormatName
MQLocateNext
MQLocateBegin
MQLocateEnd
MQGetQueueSecurity
MQSetQueueProperties
MQGetQueueProperties
MQOpenQueue
MQDeleteQueue
MQCreateQueue
MQPurgeQueue
MQCreateCursor
MQCloseCursor
MQReceiveMessage
MQReceiveMessageByLookupId
MQDeleteCursorMemory
MQCloseQueue
MQHandleToFormatName
MQPathNameToFormatName
MQACCloseCursor
MQSendMessage
MQGetSecurityContext
MQGetSecurityContextEx
MQFreeSecurityContext
MQLogHR
MQMgmtAction
MQMgmtGetInfo
MQGetPrivateComputerInformation
MQRegisterCertificate
MQFreeMemory
MQGetMachineProperties
MQADsPathToFormatName
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
159KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=27412,
count=21, id=260, version=27412,
count=229, id=1, productName=Unmarked objects,
count=17, id=257, version=27412,
count=9, id=261, version=27412,
count=1, id=256, version=27412,
count=23, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
dll/mqsnap.dll
- IMPHASH 6a3cf26e6f7821c972ab1c02b9ecd997
- SHA256 780783b64de61caef8c4c5cc424cd875e919deec11cf2136a8c92380ba5bcabd
- MD5 9ea4736be2727f13528df7223b58c810
- SHA1 dfa23a4a63a3fbc595181c7d9cb672d77a9c3d6c
- SHA512 5c1a808aebb64b908ed6b940b1a40ad736b09609596fbdaee8bddac17de4da778c04ad66ed7981ab2c8d95c5f092cbe0b72618b8980e87fa0243d10540e13353
- SSDEEP 6144:VgSLV7eg0PF4a0bz7NZKd0kyXGHpgwl+Btm3sX5KNo6T/DWlfQksrmwRs5TgpTKw:Vgqo2ZE6XGHwm25ZuaGrmwRsmmuHSCd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2121
Minor OS version
0
Major OS version
10
Entry point
389168
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mqsnap.pdb
mfc42u
ord5303
ord4692
ord4074
ord5298
ord5296
ord3341
ord2388
ord3917
ord5727
ord2546
ord6371
ord3605
ord656
ord4270
ord3614
ord2406
ord3621
ord1634
ord5142
ord860
ord3714
ord793
ord2293
ord2356
ord2287
ord3133
ord4294
ord2281
ord941
ord539
ord5677
ord2809
ord926
ord859
ord3092
ord2507
ord3494
ord6484
ord2876
ord3470
ord6655
ord536
ord826
ord269
ord600
ord1240
ord1571
ord1250
ord1568
ord1570
ord342
ord1179
ord1248
ord1115
ord1194
ord1563
ord1197
ord2116
ord6195
ord1594
ord2821
ord3993
ord3991
ord6485
ord5949
ord1145
ord2914
ord2910
ord6456
ord561
ord5193
ord1089
ord2504
ord4480
ord1143
ord5710
ord4219
ord2235
ord355
ord942
ord2036
ord2440
ord5830
ord4371
ord3396
ord540
ord800
ord6466
ord4616
ord3733
ord1128
ord2717
ord3948
ord815
ord324
ord2822
ord1155
ord1165
ord1662
ord2385
ord2644
ord1560
ord268
ord1196
ord2606
ord3658
ord6390
ord326
ord4229
ord1808
ord4848
ord4992
ord2506
ord6048
ord4073
ord1767
ord4508
ord6481
ord2371
ord4253
ord6593
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5283
ord3793
ord4829
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord5273
ord2977
ord5446
ord2099
ord6928
ord6379
ord5436
ord768
ord2362
ord4155
ord3087
ord6330
ord861
ord2820
ord2634
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3142
ord3254
ord4459
ord3131
ord5285
ord5977
ord924
ord6238
ord3088
ord2859
ord4272
ord4273
ord5679
ord4370
ord5276
ord4847
ord2637
ord2350
ord2291
ord2284
ord2854
ord2756
ord6218
ord5568
ord5268
ord5267
ord927
ord537
ord3332
ord3312
ord4124
ord6279
ord6278
ord5706
ord2755
ord3577
ord4392
ord2570
ord4213
ord2015
ord2403
ord4704
ord6024
ord2357
ord2290
ord6483
ord4709
ord6584
ord5284
ord4433
ord2046
ord3381
ord4425
ord6740
ord2520
ord6564
ord6525
ord693
ord3635
ord3365
ord4396
ord2574
ord2729
ord3798
ord3871
ord692
ord3634
ord4395
ord2573
ord4214
ord2016
ord2405
ord6362
ord1764
ord3569
ord4390
ord2567
ord795
ord567
ord3716
ord4418
ord3397
ord4831
ord5286
ord1768
ord6051
ord6211
ord940
ord925
ord922
ord535
ord858
ord641
ord616
ord609
ord4199
ord2836
ord2294
ord5155
ord5156
ord5154
ord4899
ord4736
ord4970
ord4942
ord4352
ord2078
ord5261
msvcrt
memcmp
__RTDynamicCast
__CxxFrameHandler3
_vsnwprintf
memcpy_s
_vsnprintf_s
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memmove
memmove_s
wcsnlen
_purecall
malloc
_wcsicmp
free
realloc
?what@exception@@UBEPBDXZ
_itow_s
memcpy
??0exception@@QAE@ABV0@@Z
swscanf_s
_ui64tow_s
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
memset
iswdigit
_snwscanf_s
towupper
wcstol
_wtoi
wcstoul
wcscspn
??0exception@@QAE@ABQBD@Z
wcschr
iswspace
isalpha
qsort
_wcsnicmp
_strnicmp
_wcsdup
mqsec
?Add@CColumns@@QAEXABK@Z
??1CColumns@@QAE@XZ
??0CColumns@@QAE@I@Z
SetFalconKeyValue
GetFalconKeyValue
MQSec_GetAnonymousSid
MQSec_GetWorldSid
GetComputerNameInternal
IsLocalSystemCluster
??0CRestriction@@QAE@I@Z
??1CRestriction@@QAE@XZ
?AddRestriction@CRestriction@@QAEXPAU_GUID@@KK@Z
MQSec_GetAdminSid
MQSec_SetDirectorySecurityForService
MQSec_SetPrivilegeInThread
MQSec_GetProcessUserSid
MQSigCreateCertificate
MQSec_StorePubKeysInDS
GetDomainFQDNName
MSMQGetOperatingSystem
MQSec_GetUserType
mqutil
MQGetResourceHandle
mqrt
MQReceiveMessage
MQFreeMemory
RTRemoveUserCert
RTRemoveUserCertSid
MQGetQueueProperties
MQMgmtGetInfo
MQMgmtAction
MQGetMachineProperties
MQBeginTransaction
MQMoveMessage
MQDeleteQueue
MQGetQueueSecurity
MQSetQueueProperties
MQCreateCursor
MQOpenQueue
RTDeleteInternalCert
RTRegisterUserCert
RTGetInternalCert
RTCreateInternalCertificate
RTIsDependentClient
MQSetQueueSecurity
MQPathNameToFormatName
MQPurgeQueue
MQCreateQueue
MQCloseQueue
MQSendMessage
MQReceiveMessageByLookupId
RTGetUserCerts
MQCloseCursor
mqcertui
SelectPersonalCertificateForRemoval
SelectPersonalCertificateForRegister
ShowCertificate
ShowPersonalCertificates
kernel32
VirtualAlloc
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
OutputDebugStringA
GetModuleFileNameW
LoadLibraryW
LoadLibraryExW
GetModuleHandleA
lstrcpynW
CreateSemaphoreExW
LeaveCriticalSection
CreateMutexExW
GetCurrentProcessId
CreateThreadpoolTimer
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
SetLastError
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
GetLastError
InitializeCriticalSectionAndSpinCount
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
FormatMessageW
CloseHandle
LoadLibraryA
LocalAlloc
ExpandEnvironmentStringsW
FindClose
GetFileAttributesW
GetDriveTypeW
CreateDirectoryW
RemoveDirectoryW
FindFirstFileW
MoveFileW
FindNextFileW
OpenProcess
Sleep
GetComputerNameW
VirtualFree
LoadLibraryExA
EncodePointer
DecodePointer
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
lstrlenA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
RaiseException
GetCurrentProcess
InitializeCriticalSection
HeapDestroy
lstrcpyW
GlobalFree
GetModuleHandleW
LockResource
GetDateFormatW
GetTimeFormatW
CompareStringW
GetProcAddress
GlobalAlloc
LocalFree
user32
CharNextW
LoadStringW
RegisterClipboardFormatW
GetDlgItem
SendMessageW
GetWindowLongW
GetParent
GetWindowRect
GetClientRect
SetWindowLongW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
LoadImageW
LoadMenuW
GetSubMenu
GetMenuItemInfoW
DestroyMenu
PostMessageW
IsWindow
InsertMenuW
SetWindowTextW
GetDC
ReleaseDC
LoadIconW
ScreenToClient
SetDlgItemTextW
GetDlgItemTextW
SetActiveWindow
BringWindowToTop
FindWindowExW
GetWindowThreadProcessId
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
oleaut32
VarI4FromStr
SysFreeString
SysStringLen
SysAllocStringLen
GetErrorInfo
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
RegisterTypeLi
LoadTypeLi
VariantInit
VariantClear
SysAllocString
ole32
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemFree
IIDFromString
StringFromGUID2
OleRun
CoInitialize
CLSIDFromProgID
advapi32
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
MakeSelfRelativeSD
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
TraceMessage
CopySid
OpenProcessToken
GetSecurityDescriptorDacl
GetAclInformation
GetAce
RegCreateKeyExW
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertSidToStringSidW
LookupAccountSidW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetSecurityDescriptorLength
MapGenericMask
GetFileSecurityW
InitiateSystemShutdownExW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatusEx
QueryServiceStatus
ControlService
EnumDependentServicesW
StartServiceW
TraceEvent
IsValidSid
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
gdi32
GetTextExtentPoint32W
DeleteObject
CreateFontIndirectW
aclui
ord1
activeds
ord9
ord18
ord20
crypt32
CertCloseStore
CertOpenStore
netapi32
NetApiBufferFree
DsGetDcNameW
ntdsapi
DsFreeNameResultW
DsCrackNamesW
cryptui
CryptUIDlgSelectCertificateFromStore
clusapi
CloseClusterNode
CloseCluster
OpenCluster
OpenClusterNode
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
432KB
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=27412,
count=20, id=260, version=27412,
count=45, id=257, version=27412,
count=692, id=1, productName=Unmarked objects,
count=24, id=253, version=27412,
count=17, id=261, version=27412,
count=1, id=256, version=27412,
count=108, id=265, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
dll/nshwfp.dll
- IMPHASH d66558feaf8c05a236d7bec5cbc74298
- SHA256 641c0cb649637c588543900601b82428ec54531ec8a24fee57ba7235f4f1a472
- MD5 da241bcdd47fce5e14a231f82344b722
- SHA1 3c7ba2b7dcde4289babb633c182b82ccf6bac63a
- SHA512 0e3994f6530727e82b75f0a9c812a66bc9b2f7e2f29dc7a333a47c29d7c175bb0811f9a0a16c7e962fc0a8e54145c9d42fb4e0778082bbdafd03af4e44bff7f3
- SSDEEP 12288:Z5YRTJyUjo1yY/+QdhTuh9T80M8sczjL7rbL7rbL7rV:Z5YRTBj2yY/X880M8sczjL7rbL7rbL75
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2121
Minor OS version
0
Major OS version
10
Entry point
497552
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
nshwfp.pdb
msvcrt
memset
bsearch
_tempnam
remove
_lseek
_close
_write
_read
_errno
_open
strcpy_s
_wcsnicmp
qsort
_ui64toa_s
_i64toa_s
_ltoa_s
isprint
sprintf_s
strstr
strpbrk
_ultoa_s
_get_errno
wcstoul
_set_errno
wcsncmp
swprintf_s
_ultow_s
_snwprintf_s
_wcsicmp
wcstol
wprintf
_vsnwprintf
_vsnprintf
memcmp
memcpy
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
netsh.exe
PrintMessage
MatchEnumTag
PrintMessageFromModule
PreprocessCommand
RegisterHelper
RegisterContext
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadStringW
GetProcAddress
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
ExitProcess
CreateProcessW
GetExitCodeProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
ntdll
RtlIpv6AddressToStringW
RtlEthernetAddressToStringA
RtlIpv6AddressToStringA
RtlIpv4AddressToStringA
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
EtwEventWriteTransfer
RtlApplicationVerifierStop
RtlNtStatusToDosError
EtwTraceMessage
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapSize
HeapAlloc
HeapReAlloc
HeapCreate
HeapDestroy
rpcrt4
MesDecodeBufferHandleCreate
MesEncodeDynBufferHandleCreate
UuidFromStringW
NdrMesTypeDecode2
I_RpcExceptionFilter
MesHandleFree
UuidCreate
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
CreateEventW
EnterCriticalSection
LeaveCriticalSection
OpenEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
firewallapi
FWFreeDynamicKeywordAddressData0
FWEnumDynamicKeywordAddressesByType0
fwpuclnt
FwpmFilterSetSecurityInfoByKey0
FwpmEngineOpen0
FwpmEngineSetSecurityInfo0
IkeextSaDbSetSecurityInfo0
FwpmCalloutGetSecurityInfoByKey0
FwpmLayerEnum0
FwpmLayerCreateEnumHandle0
FwpmCalloutDestroyEnumHandle0
FwpmCalloutEnum0
FwpmFilterGetByKey0
FwpmCalloutCreateEnumHandle0
FwpmProviderContextDeleteByKey0
FwpmCalloutGetByKey0
FwpmNetEventsGetSecurityInfo0
FwpmGetAppIdFromFileName0
FwpmEngineSetOption0
FwpmCalloutSetSecurityInfoByKey0
FwpmSubLayerGetByKey0
FwpmLayerSetSecurityInfoByKey0
FwpmEngineGetOption0
FwpmProviderContextGetByKey3
FwpmProviderGetByKey0
FwpmProviderContextDestroyEnumHandle0
FwpmProviderContextGetSecurityInfoByKey0
FwpmProviderContextCreateEnumHandle0
FwpmSubLayerGetSecurityInfoByKey0
FwpmFilterGetSecurityInfoByKey0
FwpmFilterDestroyEnumHandle0
FwpmFilterEnum0
FwpmProviderUnsubscribeChanges0
FwpmProviderContextUnsubscribeChanges0
FwpmFilterCreateEnumHandle0
FwpmSubLayerUnsubscribeChanges0
FwpmCalloutUnsubscribeChanges0
FwpmFilterUnsubscribeChanges0
FwpmNetEventUnsubscribe0
FwpmNetEventSubscribe4
FwpmFilterSubscribeChanges0
FwpmCalloutSubscribeChanges0
IPsecDospStateDestroyEnumHandle0
IPsecDospStateEnum0
FwpmSubLayerSubscribeChanges0
FwpmProviderContextSubscribeChanges0
FwpmProviderSubscribeChanges0
FwpmNetEventDestroyEnumHandle0
FwpmNetEventEnum5
FwpmNetEventCreateEnumHandle0
IPsecGetStatistics1
IkeextGetStatistics1
FwpmSubLayerSubscriptionsGet0
FwpmProviderContextSubscriptionsGet0
FwpmProviderSubscriptionsGet0
FwpmNetEventSubscriptionsGet0
IPsecDospStateCreateEnumHandle0
IPsecDospGetStatistics0
FwpmFilterSubscriptionsGet0
FwpmCalloutSubscriptionsGet0
FwpmTransactionAbort0
FwpsAleEndpointDestroyEnumHandle0
FwpsAleEndpointEnum0
FwpsAleEndpointCreateEnumHandle0
IPsecSaContextDestroyEnumHandle0
IPsecSaContextEnum1
IPsecSaContextCreateEnumHandle0
IkeextSaDestroyEnumHandle0
IkeextSaEnum2
IkeextSaCreateEnumHandle0
FwpmSubLayerDestroyEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerCreateEnumHandle0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineGetSecurityInfo0
FwpmProviderContextAdd3
FwpmProviderGetSecurityInfoByKey0
FwpmNetEventsLost0
IPsecSaDbGetSecurityInfo0
FwpmEngineClose0
FwpmLayerGetSecurityInfoByKey0
FwpmSessionDestroyEnumHandle0
FwpmFilterAdd0
FwpmSessionEnum0
FwpmProviderContextSetSecurityInfoByKey0
FwpmSessionCreateEnumHandle0
FwpmProviderDestroyEnumHandle0
FwpmProviderEnum0
FwpmNetEventsSetSecurityInfo0
FwpmProviderCreateEnumHandle0
FwpmSubLayerSetSecurityInfoByKey0
FwpmSystemPortsGet0
FwpmLayerDestroyEnumHandle0
FwpmFreeMemory0
IPsecSaDbSetSecurityInfo0
FwpmFilterDeleteByKey0
IkeextSaDbGetSecurityInfo0
FwpmProviderSetSecurityInfoByKey0
FwpmProviderContextEnum3
nsi
NsiSetAllParameters
NsiGetAllParameters
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
api-ms-win-core-console-l1-1-0
GetConsoleOutputCP
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
api-ms-win-core-file-l1-1-0
GetFileAttributesA
WriteFile
DeleteFileW
DeleteFileA
CreateFileA
GetFileInformationByHandle
FileTimeToLocalFileTime
CreateFileW
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-security-base-l1-1-0
GetLengthSid
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-console-l1-2-0
AttachConsole
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
iphlpapi
GetAdaptersAddresses
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
crypt32
CertNameToStrW
CertFreeCertificateContext
CertGetNameStringW
CertCreateCertificateContext
api-ms-win-security-lsapolicy-l1-1-0
LsaQueryInformationPolicy
LsaFreeMemory
LsaOpenPolicy
LsaClose
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
api-ms-win-eventing-controller-l1-1-0
ControlTraceW
StartTraceW
api-ms-win-eventing-legacy-l1-1-0
EnableTrace
cabinet
ord11
ord13
ord14
ord10
api-ms-win-core-kernel32-legacy-l1-1-0
FileTimeToDosDateTime
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RegQueryValueExW
IdpConfigAddPolicy
IdpConfigAllocateAndGetPolicy
IdpConfigFreePolicy
IdpConfigInitDefaultPolicy
IdpConfigRemovePolicy
InitHelperDll
WfpCaptureExportedW
WfpCaptureStop
Name
.text
Size
485KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
75KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=94, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=17, id=260, version=27412,
count=392, id=1, productName=Unmarked objects,
count=11, id=257, version=27412,
count=6, id=261, version=27412,
count=1, id=256, version=27412,
count=81, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
ipyida/.gitignore
- SHA256 d678091b5629463854096414f4b497d1658f9f525fa03d7ed97fb1fd56098e85
- MD5 afdaa8ca6b5f4115697e0f547d0bd716
- SHA1 8d6a4037e1111ba98b6a529ff0bc0d6302875ab8
- SHA512 1a4fe01a7c5350227c67a20b0481cf8c2dff0d015e3148faf42798cae2a67c0815ec893d2a0c7e446d6bfc9a8dd704517c95e509c066e0972525809500d5fb77
- MD5 SHA1 SHA512
ipyida/LICENSE
- SHA256 05dc81e9d97a7b4b5194c4122c40928cd34d99341e28a0b0ec1b5aa577b769bf
- MD5 21e10950ecc71e4641bf47197c9b612f
- SHA1 a0bb6c2bb4dd2096526aeddfc6baa65227e70331
- SHA512 e34279da97180e4af8b717c8e9f3190e0cb7a83db334f2cd1fece201dd36b0ef344242246c4ed8204d3e066e049ffb467614d5cbd64f03d1fe1d44d704200129
- MD5 SHA1 SHA512
ipyida/README.adoc
- SHA256 33ca34c5079933e5b28b166be0a3730ad691093978634d0c2b934522e32afb7d
- MD5 e3bad316dceb3132e4f17ebb2d184ab4
- SHA1 79ddeb20164bb20930dab87bf9bd530e1689b8c0
- SHA512 332dfaafe0041183ce7f5268abc85a78d8c91c1145c42abaee711868397172a5902d3338d2146b909847b8fa2d1f9131464b929c57ec0472830a8bd314d61f8e
- SSDEEP 96:xNtILyBE9J6u1XrzsRwLc5+CKezVo0FokVUF2L154:ymiLXrzsEc5y0GkE
- MD5 SHA1 SHA512 SSDEEP
ipyida/README.virtualenv.adoc
- SHA256 b09fd7377eb933e6ec7a326fed125547b38b4d23df6a136c0515ceec681b67b9
- MD5 40c9af0628a8b76af1c036740b145c19
- SHA1 f9cdf3ba8b6f44b3e123023ffe3278241da7e107
- SHA512 3c0c5ac7ee3f992c007e371e1e2e4abae24e1c28144275f502882fd1c1ffd6dd848473e3097b2354c15851220fec828e1ba8c0360abb45f1e0a68890aec78ad0
- MD5 SHA1 SHA512
ipyida/__init__.py
- SHA256 5495a6cba64a56470119188cc592623159aead77660b5c074e19278f0fd335af
- MD5 2349404d5ae714b9f115ae2b12815947
- SHA1 c3be9e539b9afe764cfdd8a4d0741ade66b8394e
- SHA512 0851f35655a2ccef2ae524946b25219600989afd161bae8480d5300f2410ff11d5262bc2c64abf7ab602f4f415bc770469046d3106713287cea94c7045faaa44
- MD5 SHA1 SHA512
ipyida/ida_plugin.py
- SHA256 4d69ba6d597530aee25cc318fd76cb3cc87ead57fa939fea0e8c285528367746
- MD5 56ec109f4e50862787d8ebfe38c8b834
- SHA1 a42b6077e4aeaa4350945386cd55cdbcf52b19a5
- SHA512 0c47015cbd9988dc7d560745feb2e3ea9f8446d9f6d16a69449d7664c780a88a54855bda4a0e409590b50e928b7efb1e8f2f9616289c26fa63e71c2692482e45
- MD5 SHA1 SHA512
ipyida/ida_qtconsole.py
- SHA256 2dc0857e4519a8b3b026bcd829b8088a54d96300c137c96241c5fd3804ee350b
- MD5 435e84372b7f3c0b11c537812047661d
- SHA1 431d9ca1e6ab7c869297db32977be5bba7e0a9c9
- SHA512 97266bc5e4c1859a881faea0a05eef53500d4643c4c38be59a74dc1c3762a6d87c4fbe5e7c00f3461cbac50c953c21d6ce6b52ee9006438c12c58c02b5a3e190
- SSDEEP 192:aYHlQQAf1596NQ2qlDYcA0jCRtjnnlRq9cTY:VyB5C90DscUtjlRqiTY
- MD5 SHA1 SHA512 SSDEEP
ipyida/ipyida-screenshot.png
- SHA256 26d355cd7e272f01b8e836613e353322dbba1893cad1e663e869c70c5534de7f
- MD5 3b0c3495435f6f5e0f8689506cda0299
- SHA1 ae0cbac93c6443ab4448567c22acd7c033355cc7
- SHA512 9489c7a219105d3224bcddb28abdad0a3da77eac01222996e9caf67ada07bd093576e97b3a14887ae961e8645c9501e53648adeb248a7cc05f5740b427f96c2c
- SSDEEP 12288:I0nbPXMakio+e/+b9Rc/HYs5jf/Ic0Fz/5jRfiynOhdWkfTe8fwzxZ5ulFcCIV:rr1M+eGbjcPYmQFLiyOGk79fgxZ5w+V
- MD5 SHA1 SHA512 SSDEEP
ipyida/ipyida_plugin_stub.py
- SHA256 4fc8df062adacaea16fe157eb73aeb34a2dd3040e7ea33597e0361af21be4b2c
- MD5 255b7c0179c11e836020a246f4b4686d
- SHA1 8442db2ebe3adab7b93146702888cbbd3bb3addc
- SHA512 2feb33d9d1f9cc73c2bf19b5bb14467316e779e212dbfaa0efef9337e47253e8970099c8365184d5649f8618fcdeae453d02c234f48d002409acb21ac9f4ad53
- MD5 SHA1 SHA512
ipyida/kernel.py
- SHA256 2c0cb45193fe144b596c5de747aef5563cc8be21c9c4f8e42bdeb05daf8994d0
- MD5 053118a8465838e79ce3085474031c29
- SHA1 a1d562a6d0ab051292c4665cd97b58d11ae5d6eb
- SHA512 a292873e967a8de64cba7ca34f6ad7966b3ba179d9da7b8d09155927688b14125ef5620b23e9561a6c3fd6a977a3bc54ac616c25c620f37be502ac58f5a8f99a
- SSDEEP 192:324ADCKlSMtv65mT1i5X4YTFC8GqYrrFaS1W:4W9Yji5XDs9at
- MD5 SHA1 SHA512 SSDEEP
ipyida/notebook.py
- SHA256 6399de348c3223924b1acc56d488d81968410e5ae2f2e6ae463893b5601c3426
- MD5 cc21d8249aa059ba17d05ffe23169701
- SHA1 7b7c80dfad1172886ee2c16d643e12a2c5abfef1
- SHA512 235a35d27968e769c583779d92fba887907057e53f534fa567e8273d0eb6bfcab9f0f42e5f45be07ccdc96487acc2c56abaf9d0e8cf067ccce9708e2161b73b8
- SSDEEP 96:0IupwX+AGHhxYtv/k+FC42MaVim+i73p6KNRr/6D5r/kM2zUMNr/lic2Bb:0IwfAG/Yl/kEU3lllrCVrcEMNr9f2Bb
- MD5 SHA1 SHA512 SSDEEP
ipyida/setup.py
- SHA256 d011c70ed7c802185f57ae9e866fdfd767535442eab5d4ce53d077e9cf8ab176
- MD5 32ec4d0a8e245aee4b1b27de476460b2
- SHA1 5baf57125476456201197dd31e81b27eac7ebd8a
- SHA512 5f73e78484ad32123dd74dfadf42e9b7123fa3e89e1e43a515369ae493c5a5a26c4e4c97a17f9ee88c4f3f2213e50bde173b91050eadd8cbde088ccebb59b623
- MD5 SHA1 SHA512
mispace.dll
- SHA256 3ff24109fe28f528a7922092ea81fab728870bcafc8a6a8b6f9a5e7651089977
- MD5 7e8b8b460d6ef3a6d5153e3b9a907807
- SHA1 557b1589160178c308d6f6ab82f67e406360cbcd
- SHA512 6af0aad39596ab8891cc373d0e2e2dc5cca26b6f572b8397d26c056309123b4250bc87e53a98783b1975ff95482faa531b8769f8df53119cda2bcfddefae839e
- SSDEEP 12288:WboLEii2ye41wnl+ruFUNQapYheWVL4He:WbQEiQwl+iFUNQCYUWVLIe
- MD5 SHA1 SHA512 SSDEEP