HWID Spoofer.rar
- SHA256 6633dc1065eb03be134931bd57332c8ed34a289d5fe181e156c303b36dc0fbce
Overview
overview
9Static
static
9HWID Spoof...er.url
windows11-21h2-x64
1HWID Spoof...te.url
windows11-21h2-x64
1HWID Spoof...or.lnk
windows11-21h2-x64
3HWID Spoof...te.url
windows11-21h2-x64
1HWID Spoof...PN.url
windows11-21h2-x64
1HWID Spoof...Ds.cmd
windows11-21h2-x64
1HWID Spoof...id.exe
windows11-21h2-x64
3HWID Spoof...64.exe
windows11-21h2-x64
1HWID Spoof...Ds.cmd
windows11-21h2-x64
1HWID Spoof...64.exe
windows11-21h2-x64
1HWID Spoof...pt.lnk
windows11-21h2-x64
3HWID Spoof...64.sys
windows11-21h2-x64
1HWID Spoof...up.exe
windows11-21h2-x64
3HWID Spoof...RU.exe
windows11-21h2-x64
3HWID Spoof...ll.exe
windows11-21h2-x64
3HWID Spoof...rt.exe
windows11-21h2-x64
5HWID Spoof...64.exe
windows11-21h2-x64
5HWID Spoof...ew.chm
windows11-21h2-x64
1HWID Spoof...ew.exe
windows11-21h2-x64
6Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Download Revo Uninstaller.url
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Updated Step 1 - Follow instructions on website.url
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
HWID Spoofer/STEP 2 - Edit HWID Registry keys/1. Registry Editor.lnk
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
HWID Spoofer/STEP 2 - Edit HWID Registry keys/3. GUID Generator Website.url
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
HWID Spoofer/STEP 3 - Mask your IP Address/1. Download NordVPN.url
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/1. Change Disk IDs.cmd
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid.exe
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid64.exe
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/1. Change ALL HWIDs.cmd
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/AMIDEWINx64.exe
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/Command Prompt.lnk
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/amifldrv64.sys
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
HWID Spoofer/STEP 6 - MAC address/1. Install TMACv6.0.7_Setup.exe
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
HWID Spoofer/STEP 8 - Monitor HWID/CRU.exe
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
HWID Spoofer/STEP 8 - Monitor HWID/reset-all.exe
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
HWID Spoofer/STEP 8 - Monitor HWID/restart.exe
Resource
win11-20240802-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
HWID Spoofer/STEP 8 - Monitor HWID/restart64.exe
Resource
win11-20240802-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.chm
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.exe
Resource
win11-20240802-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target HWID Spoofer.rar
- Size 2.5MB
- Sample240901-rxexqatfjd
- SHA256 6633dc1065eb03be134931bd57332c8ed34a289d5fe181e156c303b36dc0fbce
- MD5 4e397ee45aa2f12f5abfeae5abcaa765
- SHA1 fa9182fad3545bdbd84b58cfe3624bdc24cfdc2e
- SHA512 0f1507d623990d33f560cf23b9b38875d1b0f8238771c618b2aa820a519982fca076a9511034115f83cec66d042794e84b253e22ca59e5fbbf50303039642496
- SSDEEP 49152:yVBi65s42EY6Aa77AWODCWoxX4TLnpiBXT84C96uzSJehL2UERHCzY:yzik12q77AWlGTzpaHHJCL7EuY
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.exe Nirsoft - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/HWID Spoofer/STEP 5 - HWIDs of everything/_/AMIDEWINx64.EXE unpack001/HWID Spoofer/STEP 6 - MAC address/1. Install TMACv6.0.7_Setup.exe unpack001/HWID Spoofer/STEP 8 - Monitor HWID/CRU.exe unpack001/HWID Spoofer/STEP 8 - Monitor HWID/reset-all.exe unpack001/HWID Spoofer/STEP 8 - Monitor HWID/restart.exe unpack001/HWID Spoofer/STEP 8 - Monitor HWID/restart64.exe
File Explorer
-
HWID Spoofer.rar.rar 2.5MB
-
HWID Spoofer/READ ME PLEASE.txt2KB
-
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Download Revo Uninstaller.url.url 153B
-
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/READ THIS FILE PLEASE.txt217B
-
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Updated Step 1 - Follow instructions on website.url.url 148B
-
HWID Spoofer/STEP 2 - Edit HWID Registry keys/1. Registry Editor.lnk.lnk 1KB
-
HWID Spoofer/STEP 2 - Edit HWID Registry keys/2. Locations in Registry.txt148B
-
HWID Spoofer/STEP 2 - Edit HWID Registry keys/3. GUID Generator Website.url.url 143B
-
HWID Spoofer/STEP 2 - Edit HWID Registry keys/READ ME PLEASE.txt160B
-
HWID Spoofer/STEP 3 - Mask your IP Address/1. Download NordVPN.url.url 128B
-
HWID Spoofer/STEP 3 - Mask your IP Address/READ ME PLEASE.txt419B
-
HWID Spoofer/STEP 4 -Disk Serial NumberID/1. Change Disk IDs.cmd1KB
-
HWID Spoofer/STEP 4 -Disk Serial NumberID/READ ME PLEASE.txt719B
-
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid.exe.exe 228KB
-
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid64.exe.exe 165KB
-
HWID Spoofer/STEP 5 - HWIDs of everything/1. Change ALL HWIDs.cmd2KB
-
HWID Spoofer/STEP 5 - HWIDs of everything/READ ME PLEASE.txt253B
-
HWID Spoofer/STEP 5 - HWIDs of everything/_/AMIDEWINx64.EXE.exe 455KB
-
HWID Spoofer/STEP 5 - HWIDs of everything/_/Command Prompt.lnk.lnk 1KB
-
HWID Spoofer/STEP 5 - HWIDs of everything/_/amifldrv64.sys.sys 29KB
-
HWID Spoofer/STEP 6 - MAC address/1. Install TMACv6.0.7_Setup.exe.exe 5.1MB
-
HWID Spoofer/STEP 6 - MAC address/READ ME PLEASE.txt142B
-
HWID Spoofer/STEP 8 - Monitor HWID/CRU.exe.exe 1.2MB
-
HWID Spoofer/STEP 8 - Monitor HWID/READ ME PLEASE.txt194B
-
HWID Spoofer/STEP 8 - Monitor HWID/reset-all.exe.exe 51KB
-
HWID Spoofer/STEP 8 - Monitor HWID/restart.exe.exe 63KB
-
HWID Spoofer/STEP 8 - Monitor HWID/restart64.exe.exe 73KB
-
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/READ ME PLEASE.txt194B
-
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.cfg1KB
-
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.chm.chm 24KB
-
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.exe.exe 189KB
-
Readme as well.txt51B
HWID Spoofer/READ ME PLEASE.txt
- SHA256 d1f866a13cd3f752fcd93f4989d2ffa65013ab210442fcfee0f338ff6cf6ec72
- MD5 9bf4c9f9f4cb412b554afbfc3981d458
- SHA1 4b7d2cb04b167726fe54724896ec016c61b1f902
- SHA512 66d5261d1dfcb858afaa3086d86c157730a79ab151871beca6bd76e7a3fa0c2a163b72a5842c6f293920f2a36c605bc507523689477c3ff0fd40083e93fd072f
- MD5 SHA1 SHA512
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Download Revo Uninstaller.url
- SHA256 f6db928c42771e18d7795dab63dc991ec8d3dc371e8b4804d467f65ce11c607f
- MD5 b8af8aa3d0d8003e486b3f952bafbaac
- SHA1 d452237651cb4b04ea8ade827cbb3512f69c0f9d
- SHA512 a34972401cca357962507ac28907ad83eac902235f52608b77a1ee005032bbf5f76fbc65a2bead1d5cab85ff867641926a281a0fb3df145282bbd93e8de49b7f
- MD5 SHA1 SHA512
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/READ THIS FILE PLEASE.txt
- SHA256 ac1724e71a8010b0189879e440e0398d73497867e6f73de19c68cd36f1ca0862
- MD5 5215db1dfa2fbd6c443e91999d9bf7c4
- SHA1 b11266ce8546c9a18b006e216c937b0b7c8c8fb5
- SHA512 07ac1fc75d92d2d63d9daab63af5a0f24b047ab26e26396a566178cfc26da6ae7470e8e6c7166c09fa3750e45b3a1a3befad3460906be6796cf571b7c48b77f0
- MD5 SHA1 SHA512
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Updated Step 1 - Follow instructions on website.url
- SHA256 c7a9eb7d13feaaccf24d3cc3a591fe47dbcd1b228bd287c75422776aeb71a4e5
- MD5 ef9fa18d6d49e92eaf2324b0d014813a
- SHA1 f68a93434a8829909bb047bffb57b8271121f78d
- SHA512 5c44360313ce713b3fceaf1a16de6ce66fd2f567d225f80b813f88125a0e3bca21bfd0f4b3ad2a083398778a2183ac2df3e629f5cd57f46215db4e8fbc618b22
- MD5 SHA1 SHA512
HWID Spoofer/STEP 2 - Edit HWID Registry keys/1. Registry Editor.lnk
- SHA256 64aa810fa77628dc199f75f54dd764c142b0a479cdb62e24f853a707ca3a2db5
- MD5 0e2092f136d0e7f155a6c688e34533dc
- SHA1 33f71faf7585c7a4a450b91f794334f200bf15f7
- SHA512 8057d335d66ca0257d7c53b3fd681efbd9123c7c5cb955c1b49cbca243e8550cc5210de9044b4481c311873c28fd79ad79f1d32905b473005584631fe61c4f92
- MD5 SHA1 SHA512
HWID Spoofer/STEP 2 - Edit HWID Registry keys/2. Locations in Registry.txt
- SHA256 446a8e31ec8925d9bbf7fc92a5a3c77b13a6597376c30afab869bf0d2f7b462d
- MD5 fb9405b514d82e994f83f67c5a712351
- SHA1 9454afdfb61c141e8bbcd4f80214e87e26ccf3e1
- SHA512 2d2546f00954fecab6700a5bcde691ea815f7e0d7a394b46674144d489245a09d3fdf792f5d8d3d7727d0bccf5301a5dbcbb7470288930f140da829b04637b97
- MD5 SHA1 SHA512
HWID Spoofer/STEP 2 - Edit HWID Registry keys/3. GUID Generator Website.url
- SHA256 21c4de7b2083d60d3f0d2f38e70d1b2a1e0049279b1ade9ba900a77d2e3a64e4
- MD5 dc2726585a60180658c2fb0714e436b8
- SHA1 1568187c8c250ca83340f02d8df4695680a5b0ff
- SHA512 5c495093a71613bbee9e83ca59155c43263274dd9bb83fb6d456ee4c23ed8e7bb11ea2ade66f1e18c83d33f03771ede3da80c50fc7c97809322487cd650f6ce9
- MD5 SHA1 SHA512
HWID Spoofer/STEP 2 - Edit HWID Registry keys/READ ME PLEASE.txt
- SHA256 01bd6b9a90e72b878d06471163c22a81f0d5bffa42175cdf2bc7fe8aafc9dcad
- MD5 488e8a8011a1b78eb97bcb5a6921e575
- SHA1 4ab7c7a216700b7545ae70b57ae1325251c26418
- SHA512 50e9dbf9aeb8cbe6b67f51ffaf97fb6a564fea81b007ac91f1a51a4ea6d22163a02e590f330265f2cfa9ad4cd318748e4e509b5717632c2ba1e9bb259170ebf6
- MD5 SHA1 SHA512
HWID Spoofer/STEP 3 - Mask your IP Address/1. Download NordVPN.url
- SHA256 89ff7443cc30c87127b75fe899648c8729beffd67cb91940ca97cacf9085f17f
- MD5 92a3e5db54b4166e789b643b53be9004
- SHA1 1806667f266b68f92272cb45dce83811633c3d6a
- SHA512 a529d0691a6307261cc1a94c1c83df0949552105614bb8c472f684cdabd29970cf451e7c383191eedc198b2068f1749bdfb4727827c5573017914930b73206d3
- MD5 SHA1 SHA512
HWID Spoofer/STEP 3 - Mask your IP Address/READ ME PLEASE.txt
- SHA256 168747ab118bf7c91f82dc2bd9dce73b871435ba688c1027499d7391df810455
- MD5 71d70475229122dd28a5196024bf2da4
- SHA1 2192a11cd4f6c5b11bccffaa2bfd93f30fda0f41
- SHA512 53df172aef7d72ab09b78a85f449a4d5e419e22b03a994bd038d932422ef532cc94325ba2200316d86e11243278ba6c8a47ac10b3a611b87bdb90723343e4948
- MD5 SHA1 SHA512
HWID Spoofer/STEP 4 -Disk Serial NumberID/1. Change Disk IDs.cmd
- SHA256 282932d8caacf613b7167f674a84d320af5b9e253f21c8134c46ce25ff4bb07b
- MD5 6346b33980b7d8946c1f0dba5cbfd7f9
- SHA1 c42c97f649afa4b408d25e003277f89b4cdbe7d8
- SHA512 bef23ec08e2e9623a1b8769c509726e36e8d91b23593d59f38a3c7848ea6d07b963728a33ba74cde6da27f1944ca06ed4dd58eed4c7456c0e5c942ae227c2320
- MD5 SHA1 SHA512
HWID Spoofer/STEP 4 -Disk Serial NumberID/READ ME PLEASE.txt
- SHA256 240b617b3ac0232fdcece77e79a9fd9d02ba0decb252bbe5710b3634b4b87985
- MD5 50bc60383c45b15bb32f3168dce065f9
- SHA1 52e79efdfe16f6f0b4441082602e5cf0ac41b54b
- SHA512 a9cdc9d688d0c36ac04f4eb8e82684dd628b663e3454c140fa4a47246301369d10579758700f0ae128a3e5f62c1207ea8c458cae7eddbeb91bb43cfe61331252
- MD5 SHA1 SHA512
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid.exe
- IMPHASH 196b8047c609ccadce7fd294c9a3e6a2
- SHA256 22a2484d7fa799e6e71e310141614884f3bc8dad8ac749b6f1c475b5398a72f3
- MD5 4d867033b27c8a603de4885b449c4923
- SHA1 f1ace1a241bab6efb3c7059a68b6e9bbe258da83
- SHA512 b5d6d4a58d8780a43e69964f80525905224fa020c0032e637cd25557097e331f63d156cceaaacfe1a692ca8cea8d8bd1b219468b6b8e4827c90febe1535a5702
- SSDEEP 3072:OgfbRmDIHA98kK2WndTslNac+dA6YdqhsXCNZpp4GIoHZUFozD3zgJwDmr9u76v9:OSCgkKdcg9vCoaoMpcto
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
31:e8:46:24:b9:5c:81:15:5d:a7:f1:1a:ab:8f:86:bc:b4:c8:0e:61:43:9d:61:34:48:d8:23:fc:f3:c1:26:44
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
0b:59:24:99:54:12:f4:c9:d5:03:9a:1b:01:0c:88:29:cd:1c:f0:10
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 13, 2016
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 30, 2016 - Jun 30, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
5
Entry point
24400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Builds\13810\Tools\Volumeid_master\bin\Win32\Release\volumeid.pdb
kernel32
FormatMessageA
GetDriveTypeA
CreateFileA
GetVolumeInformationA
GetVersionExA
LCMapStringW
CloseHandle
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
OutputDebugStringW
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
GetLastError
GetCommandLineW
GetVersion
LoadLibraryA
GetModuleHandleA
GetStdHandle
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
CompareStringW
GetFileType
ReadConsoleW
RtlUnwind
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
DeleteCriticalSection
FatalAppExitA
FlushFileBuffers
GetConsoleCP
IsDebuggerPresent
IsProcessorFeaturePresent
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
GetCurrentThreadId
GetProcessHeap
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
user32
SendMessageA
DialogBoxIndirectParamA
EndDialog
GetDlgItem
SetWindowTextA
SetCursor
LoadCursorA
InflateRect
GetSysColorBrush
gdi32
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage
comdlg32
PrintDlgA
advapi32
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegSetValueExA
version
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeA
Name
.text
Size
147KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=225, productName=VS2013 build 21005, version=21005,
count=16, id=223, productName=VS2013 build 21005, version=21005,
count=130, id=224, productName=VS2013 build 21005, version=21005,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=123, id=1, productName=Unmarked objects,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid64.exe
- IMPHASH 735aed1002ee8ff1be0e1dee668e8b0d
- SHA256 fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd
- MD5 81a45f1a91448313b76d2e6d5308aa7a
- SHA1 0d615343d5de03da03bce52e11b233093b404083
- SHA512 675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d
- SSDEEP 3072:PngbfXWm18pX82lOl7NuT7DLM5Weo5UFs5QM8JwDmtFk1glurXEa:/gbfXWVoRNuT7DkbFsKM1glI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
65:97:9c:4b:c0:56:29:3c:65:68:1d:c8:51:cc:90:6a:97:43:fe:d9:91:a6:db:5c:b9:5c:47:8e:bf:73:7b:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
25:f3:81:49:d7:50:ad:69:9f:da:99:18:45:e2:bd:84:7c:66:4c:a4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 13, 2016
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 30, 2016 - Jun 30, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
2
Major OS version
5
Entry point
23260
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
FormatMessageA
GetDriveTypeA
CreateFileA
GetVolumeInformationA
GetVersionExA
LCMapStringW
CloseHandle
GetStringTypeW
OutputDebugStringW
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
GetLastError
GetCommandLineW
GetVersion
LoadLibraryA
GetModuleHandleA
GetStdHandle
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetFileType
ReadConsoleW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetProcessHeap
LoadLibraryExW
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
user32
SendMessageA
DialogBoxIndirectParamA
EndDialog
GetDlgItem
SetWindowTextA
SetCursor
LoadCursorA
InflateRect
GetSysColorBrush
gdi32
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage
comdlg32
PrintDlgA
advapi32
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegSetValueExA
version
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeA
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=225, version=20806,
count=125, id=224, version=20806,
count=9, id=223, version=20806,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=126, id=1, productName=Unmarked objects,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
HWID Spoofer/STEP 5 - HWIDs of everything/1. Change ALL HWIDs.cmd
- SHA256 74bfdf73031582b1e9431d72fb017a349f279f87d6dddcea63b0eee5c90c3545
- MD5 f79a031d21d43d3293a56d6351070c36
- SHA1 b51ec3847bdc77e15bcacdd8b5a0755de9ce0101
- SHA512 fb0bfd1eca976ed91aa45b5cec5f94fbb1fcf9e57634a25c5867ff5287dc14681533cb1467b850d23c9d719c32578d384dd18e3a4049af6aa8863548d724fbd3
- MD5 SHA1 SHA512
HWID Spoofer/STEP 5 - HWIDs of everything/READ ME PLEASE.txt
- SHA256 5c10aad4c92605843caa4457c89eb111733e0deb4fe71efb08ef48e182ec2047
- MD5 e4ab23b458870de1b176147be7d97933
- SHA1 38e6e12ae19e9a188ccc8fed7a56db174218e846
- SHA512 f4bf5a48cb069b2a43a7ea0fba16c77547b7d92899fb13bb5e50fe5ec4abcb34ff2888695490aa50290eec6255d5f66f66899eddde42dcee3555c0786e70ae6e
- MD5 SHA1 SHA512
HWID Spoofer/STEP 5 - HWIDs of everything/_/AMIDEWINx64.EXE
- IMPHASH 272dae991c0311688a7a20faa5468b8e
- SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
- MD5 9adfcdac59db3286690c7eede8da2528
- SHA1 0b54d251438a634bd13b49a1f20587cf03d4598d
- SHA512 fde1700cdb4212593ec2733944a169c7d02f436ca6831719a33482fbfd0be289697c9aa6ce7ddfb6c245e87952b35416929bbf69753d21a24197ac6c2d1243cc
- SSDEEP 6144:PRx1SY2XTh/Fq+1VU1/SznTh8NUc9v4/nOmNAFw+lgBwFejOLlC:PR/2N/I+rUqE9inOmNAFwa/TQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
182088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadConsoleInputA
GetVersionExA
LoadLibraryA
GetProcAddress
GetFullPathNameA
CloseHandle
Sleep
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
GetCurrentDirectoryA
DeleteFileA
GetLastError
CreateMutexA
GetModuleFileNameA
GetModuleHandleA
SetThreadExecutionState
SetConsoleCtrlHandler
CreateFileA
DeviceIoControl
ReadFile
WriteFile
CreateNamedPipeA
CreateThread
LocalFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetCommandLineA
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
RtlPcToFileHeader
RaiseException
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetStartupInfoW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
SetFilePointerEx
HeapReAlloc
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
OutputDebugStringW
CreateFileW
SetEnvironmentVariableA
SetEndOfFile
FreeLibrary
SetConsoleMode
shell32
ShellExecuteA
user32
RegisterClassExA
DefWindowProcA
DispatchMessageA
TranslateMessage
CreateWindowExA
MessageBoxA
BlockInput
SystemParametersInfoA
ExitWindowsEx
wsprintfA
GetMessageA
advapi32
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyExA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
OpenSCManagerA
StartServiceA
OpenServiceA
AdjustTokenPrivileges
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=52, id=225, version=20806,
count=143, id=224, version=20806,
count=12, id=223, version=20806,
count=1, id=209, version=65501,
count=9, id=203, version=65501,
count=127, id=1, productName=Unmarked objects,
count=43, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
HWID Spoofer/STEP 5 - HWIDs of everything/_/Command Prompt.lnk
- SHA256 8bee776a81eedf942937bf03cdec43b1b37f9bc1f4e10a031fb2517fd181d8bc
- MD5 6cba9707b339f1756673d2ed33b5a37a
- SHA1 373e60b3c971605d783a4c6ae44c4ea50322c49a
- SHA512 d670e3be8c72e923c89e3bd18457f8ee1155fca307eb2bcd3970381ff9e761a14eec3d926e5e2091811d4bc3b5bbcb008ee6115c99cf3309444d544966446360
- MD5 SHA1 SHA512
HWID Spoofer/STEP 5 - HWIDs of everything/_/amifldrv64.sys
- IMPHASH b05ee5c816a30bc52378c759486af0b9
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d0:52:29:92:52:f0:f0:bd:70:b5:e7:c4:6b:9c:a7:1a:99:a0:52:b4:7f:69:35:82:be:cb:6f:0d:56:7e:82:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Digest
44:4c:e1:60:87:68:88:4d:1e:97:42:f8:0c:cf:4f:53:e0:aa:70:9d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 12, 2019
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:85:7f:83:dc:2a:6c:a9:79:b8:00:00:00:00:00:85
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\work\dangerzone\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
394B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
954B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=25, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
HWID Spoofer/STEP 6 - MAC address/1. Install TMACv6.0.7_Setup.exe
- IMPHASH a8fd72e864d14b8484dd49e800fd3a36
- SHA256 a453b3ea8d8133531fad26b18701c694c324cc201e3069d07e99f0e100908c1a
- MD5 a7c8cf1d50ebe630a7d0c47686a0abbf
- SHA1 3229e8080975f4f5512d2382552f68c0389acff5
- SHA512 42340b7435605049e3f817feac1ac238177772b2b1ebf05eb9311bb58ee3dd1cab39913240a4c39e3407374009310770d8221c31914549524ecd92beab93b787
- SSDEEP 98304:ARU3j4wtopcj2dqCYV1coZ4hv3tmF1b6CrjfW/sfH6s7zQcKDsVv/JLSF66b/:ARqt/CdqRc64hv3tmF1b6CffW/sfH6sm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaPut3
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
ord669
__vbaExitProc
ord593
ord594
__vbaObjSet
__vbaOnError
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord305
__vbaStrTextCmp
__vbaEraseKeepData
_CIsin
ord631
__vbaErase
ord709
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaAryConstruct2
__vbaGet4
__vbaPutOwner3
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaCastObjVar
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaObjIs
ord311
EVENT_SINK_QueryInterface
__vbaStr2Vec
__vbaUI1I4
__vbaStrUI1
__vbaExceptHandler
ord711
ord313
ord712
__vbaPrintFile
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord531
__vbaFPException
ord717
ord532
__vbaUbound
__vbaGetOwner3
__vbaStrVarVal
__vbaVarCat
ord537
__vbaFileSeek
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaVar2Vec
ord570
__vbaNew2
ord648
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
ord579
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord613
__vbaFpI2
ord616
_CIatan
__vbaCastObj
ord618
__vbaAryCopy
__vbaStrMove
_allmul
__vbaLateIdSt
_CItan
__vbaAryUnlock
__vbaUI1Var
_CIexp
ord580
__vbaRecAssign
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=11, id=9, version=8041,
count=1, id=13, version=8169,
HWID Spoofer/STEP 6 - MAC address/READ ME PLEASE.txt
- SHA256 d7156d2a6f6bc223e605e09898e8edeaeb907f89fa1d6f53ee173962c45bc6e8
- MD5 329ed55d667f3bb5af86d42f82f5c70c
- SHA1 cfb3c8afe825496a35de8aeb809b88bb8321d8a6
- SHA512 c2b5945d99804df70a72ddc2ab6956820582d612f84032104800ce161d1e3a2e3c3e7cfb22481da118a9a8c42c058089f876d7a77dc582d12918ec5c39b2e167
- MD5 SHA1 SHA512
HWID Spoofer/STEP 8 - Monitor HWID/CRU.exe
- IMPHASH cafc89e1b0a9b2c5b10389d6d19936ce
- SHA256 8e151b2a680913f627052e18349fb9a4151c7b9ed7afa13b45df3923f450c8ab
- MD5 33ddbeafa1ef85263ff2de5f95b271ef
- SHA1 a5736867ac8d2ce41f8600ff32e949c8b1825854
- SHA512 758c5cb44be54693361f7519f1c6d4468fc40b2603a3871c8da85b96b97668aae8850ce4319cac60dde22dd5cbf50121a804233782a4f2db22f6fe30ad41f13e
- SSDEEP 24576:wR63SAdWjAvfArbdNBWQV4sU1FR5HcIT/FVAY+t+QzyTcO:GbdNAbc0o1Ec
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5004
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegFlushKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
CloseHandle
CompareStringA
CreateEventA
CreateFileA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
FindClose
FindFirstFileA
FindResourceA
FormatMessageA
FreeLibrary
FreeResource
GetACP
GetCPInfo
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetEnvironmentStrings
GetFileAttributesA
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetThreadLocale
GetTickCount
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAddAtomA
GlobalDeleteAtom
GlobalFindAtomA
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LockResource
MulDiv
MultiByteToWideChar
RaiseException
ReadFile
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
SizeofResource
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcpyA
lstrcpynA
lstrlenA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
comctl32
ImageList_Add
ImageList_BeginDrag
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_Replace
ImageList_SetBkColor
ImageList_SetIconSize
ImageList_Write
_TrackMouseEvent
ImageList_Create
comdlg32
GetOpenFileNameA
GetSaveFileNameA
gdi32
BitBlt
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateFontIndirectA
CreateHalftonePalette
CreatePalette
CreatePenIndirect
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
ExcludeClipRect
ExtTextOutA
GetBitmapBits
GetBrushOrgEx
GetClipBox
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetObjectA
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextExtentPoint32A
GetTextMetricsA
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
MoveToEx
PatBlt
RealizePalette
RectVisible
Rectangle
RestoreDC
RoundRect
SaveDC
SelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetPixel
SetROP2
SetStretchBltMode
SetTextColor
SetViewportOrgEx
SetWindowOrgEx
StretchBlt
UnrealizeObject
user32
ActivateKeyboardLayout
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcA
CharLowerA
CharNextA
CharToOemA
CheckDlgButton
CheckMenuItem
ClientToScreen
CreateIcon
CreateMenu
CreatePopupMenu
CreateWindowExA
DefFrameProcA
DefMDIChildProcA
DefWindowProcA
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextA
EnableMenuItem
EnableScrollBar
EnableWindow
EndPaint
EnumChildWindows
EnumThreadWindows
EnumWindows
EqualRect
FillRect
FindWindowA
FrameRect
GetActiveWindow
GetCapture
GetClassInfoA
GetClassLongA
GetClientRect
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyNameTextA
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyboardState
GetKeyboardType
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMenuStringA
GetMessagePos
GetParent
GetPropA
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetTopWindow
GetWindow
GetWindowDC
GetWindowLongA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
InflateRect
InsertMenuA
InsertMenuItemA
IntersectRect
InvalidateRect
IsChild
IsDialogMessageA
IsDialogMessageW
IsDlgButtonChecked
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowUnicode
IsWindowVisible
IsZoomed
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
LoadKeyboardLayoutA
LoadStringA
MapVirtualKeyA
MapWindowPoints
MessageBoxA
OemToCharA
OffsetRect
PeekMessageA
PeekMessageW
PostMessageA
PostQuitMessage
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ScreenToClient
ScrollWindow
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClassLongA
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemInfoA
SetParent
SetPropA
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowsHookExA
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UpdateWindow
WaitMessage
WindowFromPoint
wsprintfA
GetSystemMetrics
oleaut32
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit
@$xp$28Vistaaltfixunit@TVistaAltFix
@Vistaaltfixunit@Finalization$qqrv
@Vistaaltfixunit@Register$qqrv
@Vistaaltfixunit@TVistaAltFix@
@Vistaaltfixunit@TVistaAltFix@$bctr$qqrp18Classes@TComponent
@Vistaaltfixunit@TVistaAltFix@$bdtr$qqrv
@Vistaaltfixunit@TVistaAltFix@VistaWithTheme$qqrv
@Vistaaltfixunit@initialization$qqrv
_AddCEADataForm
_AddDIDDataForm
_AudioFormatForm
_AudioFormatListForm
_ColorimetryForm
_CommonForm
_DIDDetailedResolutionListForm
_DetailedResolutionForm
_DisplayForm
_ExtensionBlockForm
_FreeSyncRangeForm
_HDMI2SupportForm
_HDMIResolutionForm
_HDMISupportForm
_HDRStaticMetadataForm
_PropertiesForm
_SpeakerSetupForm
_StandardResolutionForm
_TVResolutionForm
_TVResolutionListForm
_TiledDisplayTopologyForm
_VideoCapabilityForm
__GetExceptDLLinfo
___CPPdebugHook
Name
.text
Size
781KB
Virtual Size
784KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
164KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
HWID Spoofer/STEP 8 - Monitor HWID/READ ME PLEASE.txt
- SHA256 7a2312ad6a0301bcebf1a1f017258b49b551cf7033a93a8683ba923545812831
- MD5 f8680f3058da24249c32936ba5f5e703
- SHA1 c819061f060bf02649467ba1ad4867b9099fdb55
- SHA512 71c0cc8be8c443730ea12a308621329849a88319fb64a242065ac3e15aefd52487e33bcb496de0064a30a827949d18d5efb9af954daded6e7f84a53543dc9f7c
- MD5 SHA1 SHA512
HWID Spoofer/STEP 8 - Monitor HWID/reset-all.exe
- IMPHASH 32f33abb2edf5d9be4310f0050d459d0
- SHA256 70639c195430afb92799d711ed784406bfdfd04c648d5f3e4d9873da0063660b
- MD5 3d47586c62bf61dac639d8cc1bf43ee7
- SHA1 36f605e1fb7cae972c6723ded6a5f126f36a8d01
- SHA512 638a75c0159de8553e8071a68b5a4355bfc002489d9ed62bfbb1019d287073a555133bd4a55abd68c51b3e2a1616f586a26998ce32ade322cd72ffeab5ffe105
- SSDEEP 768:Jd0XBRNU+hV81e14G8xGvMhBmqVHhc6ZrLy01fA5Egt2rHNZAEDFn27DQNE5B:b0XbeQ8xG0Kqjc6lLFfSortZBMDu8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
advapi32
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegDeleteTreeW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
kernel32
TlsFree
FlushFileBuffers
GetLastError
HeapFree
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
GetCurrentThreadId
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
HeapSize
IsProcessorFeaturePresent
HeapReAlloc
SetStdHandle
WriteConsoleW
CreateFileW
CloseHandle
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=90, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=2, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
HWID Spoofer/STEP 8 - Monitor HWID/restart.exe
- IMPHASH cf4f510acda53bad738cb1d4e01b1c70
- SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
- MD5 8242ce426ad462eff02edae1487a6949
- SHA1 9a4f382d427e0de729053535aaa3310cac5f087b
- SHA512 aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
- SSDEEP 768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14313
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapSize
IsProcessorFeaturePresent
HeapReAlloc
RtlUnwind
CompareStringW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
SetStdHandle
GetStringTypeW
WideCharToMultiByte
WriteConsoleW
CreateFileW
IsWow64Process
GetModuleFileNameW
Sleep
CreateProcessW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetStartupInfoW
TerminateProcess
OpenProcess
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetLastError
HeapFree
HeapAlloc
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCommandLineW
HeapSetInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
HeapCreate
ExitProcess
WriteFile
GetStdHandle
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
FlushFileBuffers
user32
SetWindowPlacement
GetWindowRect
EnumWindows
GetWindowPlacement
SetWindowPos
ShowWindow
IsWindowVisible
SetForegroundWindow
DialogBoxParamW
OpenInputDesktop
FindWindowW
GetClientRect
CloseDesktop
EndDialog
FindWindowExW
MessageBoxW
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
GetShellWindow
PostMessageW
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegRenameKey
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueW
CreateProcessWithTokenW
OpenProcessToken
RegSetValueExW
setupapi
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
479KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=99, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=124, id=1, productName=Unmarked objects,
count=4, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
HWID Spoofer/STEP 8 - Monitor HWID/restart64.exe
- IMPHASH 2a69fe822ced9bf301916c1307e497a9
- SHA256 5f779bb822aedaf5bd11693cdf73f6c7c3342f37371a78c07c2aca1e15dbfd00
- MD5 297aa19bade534a791d053ca190b74ad
- SHA1 15cb6a33994f75fe9e30a2afbc8a7e4616b63962
- SHA512 df883950c598f31b81f22a68b2a9fed7459dcad5084ec6e39399658b0492bcc458d9fc5bb80fda6bc994bed3241f969fc67a0b8e021fb82b040455d64776c625
- SSDEEP 1536:8vXMJl7uRupZzidl/T+Dnx86Rpy4roKsIrryeq3OTM:8vMJl6RAZu/T+7x8qpRM8rNcOTM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
15380
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
HeapSize
HeapReAlloc
CompareStringW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
SetStdHandle
GetStringTypeW
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
WriteConsoleW
CreateFileW
IsWow64Process
GetModuleFileNameW
Sleep
CreateProcessW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetStartupInfoW
TerminateProcess
OpenProcess
GetCurrentProcess
QueryPerformanceCounter
GetFileType
SetHandleCount
LCMapStringW
EnterCriticalSection
GetLastError
HeapFree
HeapAlloc
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
DecodePointer
HeapSetInformation
GetVersion
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FlushFileBuffers
user32
SetWindowPlacement
GetWindowRect
EnumWindows
GetWindowPlacement
SetWindowPos
ShowWindow
IsWindowVisible
SetForegroundWindow
DialogBoxParamW
OpenInputDesktop
FindWindowW
GetClientRect
CloseDesktop
EndDialog
FindWindowExW
MessageBoxW
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
GetShellWindow
PostMessageW
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegRenameKey
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueW
CreateProcessWithTokenW
OpenProcessToken
RegSetValueExW
setupapi
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
521KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=95, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=124, id=1, productName=Unmarked objects,
count=4, id=174, version=40219,
count=1, id=255, version=25028,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/READ ME PLEASE.txt
- SHA256 7a2312ad6a0301bcebf1a1f017258b49b551cf7033a93a8683ba923545812831
- MD5 f8680f3058da24249c32936ba5f5e703
- SHA1 c819061f060bf02649467ba1ad4867b9099fdb55
- SHA512 71c0cc8be8c443730ea12a308621329849a88319fb64a242065ac3e15aefd52487e33bcb496de0064a30a827949d18d5efb9af954daded6e7f84a53543dc9f7c
- MD5 SHA1 SHA512
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.cfg
- SHA256 babfc156af4273cec1aed9918cb078fde1d36c87c13d59761929d22352e8ed44
- MD5 919177df19f3e61669dcc1c8f9034aa6
- SHA1 5f0fc8abb28f6e40bcb2e4a631abe8c463e66c4f
- SHA512 19377e34db5ac78509d0e5ec1ca0a46e862cdda9a0be906ea10fe1b8831a9957be44bfa27afbd95af2bb5ac8d9fbc176f375eb03e60c0ef5e28ed075f9df9fd0
- MD5 SHA1 SHA512
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.chm
- SHA256 63606a5617a62060a2894904bf28d53f9f80cbe7b1be885cec114173d054767c
- MD5 411e4fba3110e963a85ceaf46e8cedd2
- SHA1 4272eb5976e951c448fab798f7b1fb0437f8f148
- SHA512 c8cdb839b6a49591a64a949d8602ef14703d47a7c90b300db9a4b64fd59a8e3b3e6ee6f4881732a05ff480fc23241848cc99852733e1049da5342b7b4e176ce4
- SSDEEP 384:9TXSD100stETnEaqFqFWWreTy7H9CluSY1t5A2Xzo:9TCDWtEL8Fy0yH92zY1/A2Do
- MD5 SHA1 SHA512 SSDEEP
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.exe
- IMPHASH a40d8b81263f7fc26c2e21012deecd1a
- SHA256 95e50f7eea21bfed82a34a24bc5d66029146c7b988e889b11f30b45cb364dcf1
- MD5 5c1729d2611fdcaeeadd238c1f0427c7
- SHA1 ddcfca0994cc92783d6a942075166f026c88ed07
- SHA512 47c608e0590e1f73c32a0c677f9b81738fb188b27243e99d514911158d673f18ae7ef99ea897e87c850c5588eae19e3d6ae8736e0a974dd51f438f5190e362c5
- SSDEEP 3072:3FSG80yvkmcA4bEvLhWoLdpxgZZapW9T8iXcWWbgYrrzwKeugTedajIHNNSP7g8x:fyvkC6EvLhTLdpxgZRbWJdBHNNSd689
- MD5 SHA1 SHA512 SSDEEP
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Digest
53:60:cc:dc:ea:5a:24:00:45:7c:fb:fe:3e:d2:10:52:09:52:31:f9:d5:ff:a6:e2:d2:b0:25:19:2d:71:e6:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Chains
Apr 6, 2022
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Serial Number
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 9, 2019 - Sep 9, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
130160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\Projects\VS2005\USBDeview\x64\Release\USBDeview.pdb
msvcrt
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
__dllonexit
_mbsrchr
atol
_mbsicmp
qsort
_strlwr
_mbschr
memmove
_strnicmp
strrchr
strchr
strcmp
strtoul
malloc
free
_strcmpi
modf
_memicmp
memcmp
srand
rand
abs
_strupr
_itoa
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcpy
strlen
_purecall
_stricmp
_snprintf
atoi
strcpy
memset
strcat
strncat
sprintf
comctl32
CreateToolbarEx
ord6
ImageList_SetImageCount
ImageList_Create
ImageList_AddMasked
ImageList_Add
ws2_32
send
WSAAsyncSelect
WSAAsyncGetHostByName
connect
inet_addr
htonl
WSAGetLastError
htons
bind
socket
WSASetLastError
closesocket
WSAStartup
WSACleanup
kernel32
CreateToolhelp32Snapshot
Process32Next
OpenProcess
SetEnvironmentVariableA
GetCurrentThreadId
DeviceIoControl
GetStartupInfoA
GetProcAddress
Process32First
ExitProcess
GetCurrentProcessId
ReadProcessMemory
GetCurrentProcess
Sleep
SetErrorMode
ExpandEnvironmentStringsA
FreeLibrary
GetPrivateProfileStringA
WinExec
GetComputerNameA
GetModuleFileNameA
GetLastError
CompareFileTime
SystemTimeToFileTime
GetModuleHandleA
FileTimeToSystemTime
LoadLibraryA
GetDiskFreeSpaceExA
GetLogicalDrives
GetWindowsDirectoryA
GetDriveTypeA
ReadFile
FlushFileBuffers
CloseHandle
DeleteFileA
CreateThread
CreateFileA
GetTickCount
WriteFile
FormatMessageA
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
GetDateFormatA
GetTempPathA
LocalFree
GetSystemDirectoryA
GetTempFileNameA
GetFileSize
LoadLibraryExA
GlobalAlloc
GlobalLock
WideCharToMultiByte
MultiByteToWideChar
GetTimeFormatA
GlobalUnlock
GetFileAttributesA
GetVersionExA
GetPrivateProfileIntA
WritePrivateProfileStringA
EnumResourceNamesA
GetStdHandle
CreateProcessA
user32
GetWindowThreadProcessId
SetForegroundWindow
AttachThreadInput
EnumWindows
SetTimer
GetSysColorBrush
ShowWindow
LoadCursorA
RemoveMenu
ReleaseDC
GetDC
SetCursor
SetDlgItemInt
BeginPaint
GetWindow
GetClientRect
SetDlgItemTextA
DrawFrameControl
GetDlgItemTextA
SetWindowTextA
GetSystemMetrics
DeferWindowPos
SendDlgItemMessageA
GetWindowRect
GetDlgItemInt
EndDialog
GetDlgItem
CreateWindowExA
EndPaint
InvalidateRect
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
SendMessageA
RegisterClassA
UpdateWindow
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
LoadImageA
GetSysColor
GetWindowLongA
SetWindowLongA
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetWindowTextA
GetSubMenu
GetCursorPos
GetClassNameA
CloseClipboard
CheckMenuRadioItem
MoveWindow
OpenClipboard
CheckMenuItem
GetMenu
EmptyClipboard
EnableMenuItem
InsertMenuItemA
GetMenuItemCount
GetParent
SetClipboardData
GetMenuStringA
EnableWindow
MapWindowPoints
LoadMenuA
LoadStringA
ModifyMenuA
DialogBoxParamA
GetDlgCtrlID
DestroyMenu
CreateDialogParamA
DestroyWindow
EnumChildWindows
GetMenuItemInfoA
CreatePopupMenu
LoadIconA
SetMenuItemInfoA
GetKeyState
GetMessageA
TranslateMessage
IsDialogMessageA
KillTimer
DrawTextExA
InsertMenuA
RegisterWindowMessageA
TrackPopupMenu
DispatchMessageA
PostQuitMessage
ChildWindowFromPoint
gdi32
GetTextExtentPoint32A
CreateCompatibleBitmap
SetTextColor
StretchBlt
GetStockObject
SetBkColor
GetPixel
GetObjectA
DeleteObject
SetBkMode
GetDeviceCaps
CreateFontIndirectA
CreateCompatibleDC
SelectObject
SetPixel
SetStretchBltMode
DeleteDC
comdlg32
ChooseFontA
FindTextA
GetSaveFileNameA
advapi32
QueryServiceStatus
CloseServiceHandle
OpenSCManagerA
ControlService
RegCreateKeyA
RegCloseKey
StartServiceA
ChangeServiceConfigA
OpenServiceA
RegLoadKeyA
RegUnLoadKeyA
RegConnectRegistryA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
shell32
SHGetFileInfoA
ShellExecuteExA
ShellExecuteA
Shell_NotifyIconA
ole32
CoCreateInstance
Name
.text
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=12, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=337, id=1, productName=Unmarked objects,
count=21, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=33, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Readme as well.txt
- SHA256 c5ad1fb14e54f4ab5b7aefec312d7c9684635d5f60370aa03cb98e253449bbc5
- MD5 8805d082e24cc821704d57e4261463a8
- SHA1 8874701b6bcffa069b4b662c8b512c4f8195e359
- SHA512 f3ddf854d481ac0ae956fcce0bd42531544fbb00d31b610231c1f7924eaed058b5bbe9ab8453b6be8305e05bb845e51893ca7fe02abc36d0f1931a9403d239d0
- MD5 SHA1 SHA512