00980d66f756e72b8f4818490608e7c0_JaffaCakes118

resource	yara_rule
static1/unpack001/efsdll.dll	acprotect

resource	yara_rule
static1/unpack001/efsdll.dll	upx
static1/unpack001/efskey.exe	upx

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/nsisdll.dll
unpack001/123key.exe
unpack001/acbtkey.exe
unpack001/actkey.exe
unpack001/ariskkey.dll
unpack001/ariskkey.exe
unpack001/bckey.exe
unpack001/bckupkey.exe
unpack001/efsdll.dll
unpack001/efskey.exe
unpack001/fmkey.exe
unpack001/iekey.exe
unpack001/lnkey.exe
unpack001/mailkey.exe
unpack001/moneykey.exe
unpack001/msgrkey.exe
unpack001/msvcr71.dll
unpack001/myobkey.exe
unpack001/nckey.exe
unpack001/oekey.exe
unpack001/offkey.exe
unpack001/onkey.exe
unpack001/orgkey.exe
unpack001/pdoxkey.exe
unpack001/peachkey.exe
unpack001/pk83.dll
unpack001/projkey.exe
unpack001/qbkey.exe
unpack001/qpkey.exe
unpack001/quickey.exe
unpack001/rarkey.exe
unpack001/scdkey.exe
unpack001/sqlkey.exe
unpack001/winkey.exe
unpack001/wpkey.exe
unpack001/wprokey.exe
unpack001/zipkey.exe

resource	yara_rule
sample	nsis_installer_1

IMPHASH 18bc6fa81e19f21156316b1ae696ed6b
SHA256 b92e1ee2bfeb614cbc96df222bd9dd085ce48185e350b5fd6d85d681897ff454
MD5 00980d66f756e72b8f4818490608e7c0
SHA1 a02807bf355adc5ac42ab0aae345e57f35da1a90
SHA512 fd177c77eabb54e5f4bd5f11c76e171a3e25affa954884ffbb88ed077502dce73e6278162e28e55b2151eeb9944bbdb17e21058a290fd2db5948a39289a9d306
SSDEEP 196608:005FlRcTKwGbl6dxWLuPQhuGaAhjPyDzChPsjjDF0a2F3PfKLA3IP8emRfv:005HWTdAlPLmoNaAhjPxhSjDTu3Py83d
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f2:8c:be:21:07:7e:e4:42:0d:ed:23:04:e5:5f:02:67:31:66:8c:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Passware\, Inc. Limited,O=Passware\, Inc. Limited,POSTALCODE=NA,STREET=30-38 Main Street+STREET=Suite 31 Don House,L=Gibraltar,ST=GI,C=GI

Chains

Sep 26, 2024

Minor OS version

0

Major OS version

4

Entry point

12599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess lstrcmpiA ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 57354bdeea3dfae6e948101add87501a
SHA256 120e4fac0538b7e7b75934706668063a4e7785d0405dca43fde36d55f6d968de
MD5 99bc22826a0568dce241be3a4ffd0c0d
SHA1 62e4662250abdf10d23a61076fd7cbd00a5c5b6f
SHA512 35b016b6e2dc850e5432becd57f35faf73b180c0a6f822a406cf9d5439a87126c41c49aac025cdeecd38bbd01705ddbd8c217cb33134e978ecc9624053b52be9
SSDEEP 384:sKlm7i+c3QW6ckPhyDEaLnr2bbBBIXwZ:5qi8BcyhEhLCbbTI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10417

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 28d94e5199b88ad374b3cb2118e31a66
SHA256 f90ebff31051802116def3349310f9b0e3dbee0f0236d54f364149e1feb186bc
MD5 c6ca47bb4198f483c8b31fd90b779acb
SHA1 ea9024cb535fd5471f30d27b22318b59cb4d31f6
SHA512 b761b4ae89ecf15edadb3015fe0d3012048f1480b84ec8d30997c128e210818d0da9c7ec75de9efe8e1e08f84501c314a32c109f4ff1e8adca2cec5a73fab7db
SSDEEP 96:z1C0Qaep2wbE+WH1/FMXF6CGQhFzK1KQ5FnhElMmV4d:Vep2w5k/FyEttgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6359

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 497434944f47fc3a0c2605bad862d9b431821886dbe249afd433751722956a90
MD5 6660daa2419ed044100077d267854b66
SHA1 083ad918a21aafd10abf3bdb0517694142d60ccf
SHA512 34217fd5fff90c17f0b10a9fe998bb22d751a48fa0524974148c8abb34c3a75910bb2c5a2b19fa84899582322e6dd05a17b11b245f88256360399ae3a84de33b
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsisdll.dll

IMPHASH 39c9ab7fb34a30e52b7a7164f24285fd
SHA256 54291864b272f0621dad26eb2c6987a41f32ef02e2e8049c4e8294905a41ffd6
MD5 478982dffa90b951e07fb411ca5d97f9
SHA1 3cb96be75f6d8a7ac9bd53fe0b176ca74823091f
SHA512 e95ee9b65879fd0285dba387e9fc7333ac760f01c1c8632d0648e4d97f6a0366e5df611ed4660d2bb38712396c61f416a01605f723eb6df5bfc9e657ed4b9521
SSDEEP 6144:RgOel/FsKFSrTrjo3+EZtyILwO3R2g+ZBijQwnw6kgtgvOenREq2CTdbYvbM4oo1:RgOel/FdFSrTvo3+EZtyILwO3Rl+ZBiv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

133350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalLock GlobalAlloc GetLastError GlobalMemoryStatus GetVersionExA GetFullPathNameA WideCharToMultiByte MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetWindowsDirectoryA GetCurrentDirectoryA GetModuleHandleA SetEndOfFile RtlUnwind RaiseException GetCurrentThreadId GetCommandLineA ExitProcess TerminateProcess GetDriveTypeA GetSystemTimeAsFileTime GetFileAttributesA FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FlushFileBuffers SetFilePointer SetStdHandle GetFileType SetLastError HeapFree GlobalUnlock SetHandleCount GetStdHandle GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree UnhandledExceptionFilter WriteFile VirtualProtect VirtualAlloc GetSystemInfo LCMapStringA LCMapStringW GetTimeZoneInformation CompareStringA CompareStringW HeapReAlloc HeapSize ReadFile IsBadReadPtr IsBadWritePtr IsBadCodePtr GetACP GetOEMCP GetCPInfo InterlockedExchange GetLocaleInfoA GetStringTypeA GetStringTypeW QueryPerformanceCounter GetTickCount GetCurrentProcessId CreateFileA SetEnvironmentVariableA MulDiv TlsAlloc LoadLibraryA GetProcAddress GetCurrentProcess DuplicateHandle GetCurrentThread CloseHandle TlsFree FreeLibrary SetUnhandledExceptionFilter TlsGetValue TlsSetValue GetModuleFileNameA VirtualQuery GlobalFree InterlockedDecrement InterlockedIncrement HeapAlloc lstrcpyA

advapi32

RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegQueryValueExA GetUserNameA RegSetValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA RegEnumValueA RegFlushKey

user32

GetDlgItemTextA GetSysColor EnableMenuItem GetSystemMenu SetWindowLongA SystemParametersInfoA DialogBoxIndirectParamA GetWindowLongA SetFocus GetParent GetDesktopWindow GetWindowRect CopyRect SetCursor SetWindowPos GetClassInfoA LoadCursorA CreateCursor UnregisterClassA RegisterClassA SendDlgItemMessageA SetClipboardData OpenClipboard EmptyClipboard CloseClipboard GetKeyState MessageBoxA GetDC ReleaseDC EndDialog OffsetRect SendMessageA GetDlgItem

gdi32

GetDeviceCaps CreateSolidBrush SetTextColor SetBkMode GetStockObject GetObjectA CreateFontIndirectA SelectObject DeleteObject GetTextExtentPoint32A

shell32

ShellExecuteA

imagehlp

SymGetLineFromAddr64 SymInitialize SymSetOptions StackWalk64 SymFunctionTableAccess64 SymGetModuleBase64 SymCleanup SymGetSymFromAddr64

$PLUGINSDIR/serial.ini

SHA256 5f8a342a1fd359cac4cb54b664d076b8c51d118a492b045427d8c13b87b3fa91
MD5 048ffc46fbd646f8beb32271ae8850bc
SHA1 77581cec465866f3840e27431f3a3c6b0c57596e
SHA512 96104d5d3ff33af938676defd6f8a306bc3c73ed0525faa683943683e9372ab91ea0dfc7020d6c3da91e911c89cae42993cbabadb0970868a1538bf55eb79cdc
MD5 SHA1 SHA512

NSIS installer

installer

123key.exe

IMPHASH 592e3a5ce6ef4fbde491e82d160d314f
SHA256 972cf3830e0ff39a009ecb1d907528174306ef7ec4d25ac477f0885169386c99
MD5 2709f75d8f93267821ca00042a4f74e7
SHA1 e3dd20b583b81df91cf7704a3796661fd1de283c
SHA512 965407ff9967d6fde2fa2302f1ae5c7549df7703870a83fce680d7743ce656f19bc5af09b171f12bc82a90b3cda918b6f8f2175a68f1e58ad4e1eb4bf13eefdd
SSDEEP 6144:AWIGtS6973o7AClkkXgHgcVVTiyQXs1g7emQcPkKDIWbHsWWGapG3eTppzXJ/:/pS6973AAClkkQHguVePXsUemQcPkK9m
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord1436 ord56 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord10236 ord10574 ord20037 ord6202 ord2449 ord4937 ord240 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord17675 ord2663 ord953 ord21782 ord15771 ord17152 ord11443 ord12710 ord22055 ord631 ord5406 ord15744 ord4499 ord7488 ord15327 ord10337 ord11533 ord12947 ord11348 ord4107 ord76 ord12446 ord21320 ord7980 ord17303 ord7304 ord4490 ord10704 ord22060 ord8582 ord18687 ord19786 ord15537 ord1356 ord1478 ord19401 ord3891 ord16859

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 isprint _purecall _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

729B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

204KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_BSS

Size

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

506B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

acbtkey.exe

IMPHASH 9ff7774073a0e89d42e5c528498968ed
SHA256 6a28dca3284a054b097dd79c6420a3f84bbae73e628598cb5522269a3eb3d320
MD5 bb6e8d47de522d51fcd13a8e9c3a0c95
SHA1 bbf0540fc916e6f70479870b09f595ad614a19ab
SHA512 37478da21941e55a713ceb12e0bc7e35ebc4bbf73721bdad9213e52db11be6b491f56f7ef85fde858972409980c2f8c72347d989e1a4c6fcf366cbce5d4568f3
SSDEEP 6144:Rak0SQLoKFih2ZBC5o7uLPJsDGKaN6vRC0ABaWyJlYrVjeMhhTwWDKFJflV1fzJK:Rak0SyoKX7uLPJstaN6vRYBaW5yMh1wM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

142472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement GetStartupInfoA GetModuleHandleA InterlockedDecrement

pk83

ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord12947 ord15046 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord4881 ord12625 ord19735 ord15881 ord13788 ord15224 ord3560 ord15868 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord19555 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord1029 ord241 ord16310 ord4499 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord18454 ord21500 ord21377 ord18126 ord854 ord2568 ord4291 ord16148 ord20606 ord21724 ord2769 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord21368 ord14169 ord13987 ord9464 ord8458 ord13091 ord16740 ord19774 ord16406 ord4669 ord14627 ord14321 ord16470 ord2056 ord6947 ord19674 ord5488 ord7452 ord18275 ord18483 ord20511 ord9968 ord2138 ord5272 ord19184 ord9914 ord1092 ord5159 ord21204 ord11835 ord5371 ord9196 ord1228 ord21844 ord916 ord18379 ord8287 ord4926 ord3548 ord8377 ord11251 ord10185 ord15771 ord548 ord21128 ord20153 ord19971 ord1631 ord13693 ord19075 ord20009 ord455 ord15044 ord6689 ord21892 ord17099 ord17043 ord13843 ord17838 ord12538 ord10005 ord346 ord9525 ord8199 ord4806 ord11348 ord4107 ord18186 ord9455 ord17935 ord16500 ord21165 ord20129 ord9351 ord12333 ord229 ord15465 ord12587 ord7984 ord19195 ord4304 ord10960 ord18757 ord11403 ord3035 ord13200 ord7558 ord2451 ord5678 ord9636 ord12378 ord12288 ord10904 ord18933 ord14837 ord7481 ord14486 ord13134 ord966 ord186 ord18835 ord7306 ord12148 ord11786 ord5825 ord12667 ord1592 ord11080 ord3482 ord6584 ord5518 ord5406 ord10323 ord1543 ord14375 ord11359 ord16512 ord15744 ord21835 ord20395 ord4490 ord22060 ord7304 ord17303 ord10704 ord20989 ord7980 ord17044 ord12446 ord21320 ord485 ord18525 ord8582 ord18687 ord19786 ord12044 ord20980 ord149 ord6811 ord10059 ord6748 ord3891 ord7225

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc memmove __CxxLongjmpUnwind _setjmp3 strchr _CxxThrowException _purecall __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z _access

Name

.text

Size

156KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

530B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

597B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

820B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

actkey.exe

IMPHASH 13273865ddf3d20c9ad8a3ce5f3df77a
SHA256 d2e09905ac114f7b84a29878e6ac79f13a295a10e644a699bdb1bd1780701954
MD5 6c3b0889b7d9a9c52bc465d6362516d2
SHA1 a3f75fdc0a7b0976e59d2de3707547c1fc1cbcf1
SHA512 fa94148b43535a3f612bdc6fe4a70e7349564c6d752f6b62af779be56e64224148815b1f495d74da2c86bff31ebc42196bbffef56d14710104feb9d427867478
SSDEEP 6144:0qIc1bNPwHG6VhFR9gsWwDyUSLxE7P0BK6gZ35vvKpBYTqdBlTxD7BTZYUGbcK1i:0qIc1bNPwHGyFRZWwD9SLxE7P0Ba35vM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

55562

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement InterlockedDecrement GetModuleHandleA GetStartupInfoA

advapi32

CloseServiceHandle OpenSCManagerA StartServiceA QueryServiceStatus OpenServiceA ControlService

pk83

ord15044 ord16417 ord8704 ord10309 ord16148 ord13843 ord8679 ord21428 ord8095 ord9556 ord1058 ord4180 ord2244 ord17976 ord8666 ord10677 ord11683 ord19018 ord10419 ord16500 ord11348 ord4310 ord10323 ord8582 ord18948 ord14259 ord76 ord4768 ord4107 ord5906 ord12148 ord6723 ord12143 ord15771 ord7020 ord953 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21320 ord1615 ord4223 ord19146 ord14822 ord11495 ord2242 ord21377 ord10994 ord854 ord13023 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord15046 ord8363 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord241 ord16310 ord2568 ord4291 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord20864 ord15594 ord6928 ord13474 ord11471 ord20146 ord6409 ord240 ord10337 ord3159 ord1084 ord12438 ord21197 ord19473 ord17044 ord2008 ord8274 ord15331 ord4499 ord1029 ord17043 ord13811 ord14169 ord12947 ord11533 ord12378 ord5406 ord11359 ord7310 ord14377 ord16512 ord12446 ord3482 ord6584 ord5518 ord485 ord18687 ord19786 ord10097 ord4490 ord22060 ord7304 ord17303 ord10704 ord15744 ord1944 ord14984 ord19427 ord19555 ord7980 ord3891 ord21431

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh toupper setlocale memmove free malloc _purecall __CxxLongjmpUnwind _setjmp3 wcscmp _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

60KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

582B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

212KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

ariskkey.dll

IMPHASH b52d799c44c87a199ae8aec934147fc4
SHA256 6059b8a00f6aca503bc1af3f0969a3b547f37fd0a2ce1231e66f1ac38d7c5938
MD5 7d54cbaf078eb1ca67b5eacb1c8bb280
SHA1 774e0edbf678aa17046b432c6a7af2758bd5d2e4
SHA512 991b532f64a9ac9fa7ac7f825846bff62edb2c89453d4e7bd2a75cd101cbf9635f85ea4a219ab674abf2d6bb94da1b3937698e9f51065ceded5381939db3e7c3
SSDEEP 768:vItccBdlsLHYxKFhXLRydVeWZRa/hhiiuVnpHdHI6lhy7rwYnErYlGJ:vCp7lCHYxKFhXLcdJhq6la8YflG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetVersionExA CloseHandle MapViewOfFile UnmapViewOfFile OpenFileMappingA MultiByteToWideChar WaitForSingleObject OpenEventA SetEvent CreateEventA CreateFileMappingA GetModuleHandleA GetSystemInfo VirtualProtect GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetCurrentThreadId GetCommandLineA ExitProcess GetProcAddress TerminateProcess GetCurrentProcess TlsAlloc SetLastError GetLastError TlsFree TlsSetValue TlsGetValue HeapFree HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree UnhandledExceptionFilter WriteFile LeaveCriticalSection EnterCriticalSection GetACP GetOEMCP GetCPInfo VirtualAlloc HeapReAlloc InitializeCriticalSection RtlUnwind InterlockedExchange VirtualQuery LoadLibraryA HeapSize GetLocaleInfoA

user32

SetWindowsHookExA CallNextHookEx EnumChildWindows PostMessageA UnhookWindowsHookEx RegisterWindowMessageA GetClassNameW GetWindowTextLengthW GetWindowLongA IsWindowVisible GetClassNameA GetWindowTextW GetWindowTextA GetWindow GetParent

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

1024B

Virtual Size

549B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ariskkey.exe

IMPHASH 15ef0cfc147effc09ab8deef4b7e6c51
SHA256 904209ef08b9b4680d90c11431c29bb39dea2480766a93551c1b5812eddac7bb
MD5 23f3634968f6cf4e367923a078386507
SHA1 d4ca3553ac0f62324c8c13513d82feb0c474fb6d
SHA512 ef688cb350ac426acbeabcc1bfb3bbfdd6075dcc0a8641accb1bbef442dce8d291578214ffcf9de2f7140101d2db11afe7e07ed8b125e5e80bd1def68aa4897c
SSDEEP 768:J+f9hr5lcuYNyqvFskBl4DW8XwL3rkl3U4Yqh4UnsDv9+wsK:J+Fhr5lcumFGknGW8ALbul6UnsDUI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

24068

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetCurrentThreadId GetStartupInfoA LocalFree GetModuleHandleA

user32

GetClassNameA GetWindowTextLengthA GetWindowTextW GetWindowTextLengthW GetKeyState GetParent EnumChildWindows IsWindowVisible EnumWindows PostMessageA SetActiveWindow AttachThreadInput GetWindowThreadProcessId IsWindow GetWindowTextA

ole32

OleInitialize OleUninitialize OleRun CoCreateInstance

oleaut32

GetErrorInfo VariantClear

ariskkey

ord25 ord11 ord19 ord33 ord41

pk83

ord332 ord11848 ord4499 ord5174 ord11533 ord12947 ord14169 ord5406 ord19313 ord2093 ord5915 ord3350 ord18921 ord7488 ord15327 ord953 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord8377 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord18891 ord21431 ord1615 ord4223 ord19146 ord2242 ord19555 ord10994 ord14822 ord10009 ord17680 ord8058 ord8177 ord13048 ord4287 ord6273 ord14075 ord1029 ord241 ord18933 ord10574 ord20037 ord6202 ord17827 ord3587 ord16310 ord9607 ord449 ord9423 ord21377 ord854 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord2008 ord14377 ord16512 ord12446 ord21320 ord7980 ord3482 ord12483 ord5518 ord90 ord1478 ord6584 ord16859 ord485 ord18525 ord8582 ord18687 ord19786 ord3891 ord15314 ord15046 ord4490 ord7304 ord17303 ord10704 ord18595 ord20078 ord4107 ord21444 ord2931 ord16406 ord11786 ord5825 ord7224 ord15744 ord17195 ord21105 ord8815 ord22060 ord12667 ord1592 ord11080 ord11359 ord17044 ord20608 ord7310 ord20342

msvcr71

_CxxThrowException __CxxFrameHandler strncmp _setjmp3 _controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs __CxxLongjmpUnwind ??3@YAXPAX@Z _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc _purecall

bckey.exe

IMPHASH 972b5b9b42f88880b94724cd8f5d0da8
SHA256 0c68ab9d6be77095b4932779b4309c2f35af78db1d16d3ac12f12ead15773f05
MD5 a5c101aa2aa4202d73d455e0a62ed701
SHA1 9a8fc7f4413deaf81cf1a8b932ea548bb0e9a493
SHA512 ad388bcb7193534914f1955c9f9f90c4c0a8174eec7dc0fa8ca49b1071522fe302e368233037d88f0176bd5c502c9527137fb732bde90844ae288b3f2b34aec8
SSDEEP 6144:ATXmIFz7jRzOEuxFTecs904rhkIeONdJtIIdbuhqqDLtm9FB:sBOEuxNecw041kIeOnJtIIdjqnKr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

98692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord7225 ord4669 ord14627 ord14321 ord16470 ord2056 ord6947 ord19674 ord5488 ord7452 ord18275 ord18483 ord20511 ord9968 ord2138 ord5272 ord19184 ord1592 ord11080 ord12667 ord15744 ord5825 ord16406 ord11786 ord18687 ord7224 ord8815 ord17195 ord12483 ord21105 ord16859 ord1478 ord90 ord21444 ord2931 ord15046 ord14146 ord4291 ord6272 ord11251 ord10185 ord241 ord16310 ord548 ord21128 ord20153 ord16387 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord18454 ord8582 ord7488 ord15327 ord2663 ord17675 ord56 ord10059 ord12838 ord409 ord19774 ord12666 ord20342 ord16167 ord4881 ord12625 ord19735 ord15881 ord13788 ord15224 ord3560 ord15868 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord19555 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord21500 ord21377 ord18126 ord854 ord2568 ord16148 ord20606 ord21724 ord2769 ord19694 ord8448 ord13016 ord13371 ord5021 ord10510 ord17237 ord2631 ord18525 ord8287 ord9914 ord11533 ord11513 ord15496 ord10661 ord21368 ord16740 ord3482 ord6584 ord5518 ord7980 ord1029 ord13091 ord4490 ord22060 ord7304 ord17303 ord11359 ord8458 ord9464 ord5406 ord13987 ord14169 ord20989 ord6748 ord21320 ord19786 ord3548 ord18379 ord916 ord21844 ord1228 ord9196 ord5371 ord11835 ord21204 ord5159 ord8075 ord9265 ord12947 ord4499 ord17043 ord6005 ord10704 ord3891 ord20192

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh free malloc fopen __CxxLongjmpUnwind _setjmp3 _purecall _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

100KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

335B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

76KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

700B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

59B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bckupkey.exe

IMPHASH e8059f44b88ecc2e1f17065a1508ef3b
SHA256 2e942e3d9251dbcf32fcfa604ef9eec1e59e422691f549b81ea71d8ff611c653
MD5 6ea62599a65aba234ea95383fafee749
SHA1 765b952f6d4f05aed23140efdaaea722636ec5fb
SHA512 f058130a91def114a2daa6b30ccc2e79c79bde211622c9df6df013e37ed174c533ce43ad586f5fb51623c9499e400dc63d553c37029cf89f41bdce06f68463fa
SSDEEP 6144:1ta6eEO0FNbQqBO7rB4Tj6Plor/548K+fsj8qEeU1TQatCJ90wv:Da6eEOUNbbBO7rB4Tj6Plojq8K+fsj8C
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord15744 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord18687 ord19735 ord7488 ord15327 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10236 ord10574 ord20037 ord6202 ord2449 ord4937 ord240 ord12625 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord953 ord4499 ord17303 ord7304 ord15537 ord15771 ord7020 ord4490 ord10704 ord22060 ord4768 ord12378 ord10337 ord11533 ord12947 ord11348 ord4107 ord76 ord12446 ord21320 ord2931 ord8582 ord3891 ord21444

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _purecall _CxxThrowException strncmp __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

550B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

148KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

dict.txt

SHA256 874ae8196162e7cefcbd51d0e3b62467b660b0eb1a0af354fe849cb64229dd69
MD5 171eb5d877f47ca03e66947e3da9a13f
SHA1 7d0011dead4cf4ea5911954f0228e47427a2dbfd
SHA512 b4cb93a5703f94eea2a933c9a1489bbf1b67d2aa6ec490b104e379332653ec0414f629fb8395d94f5dffc1b490fd254326cec8585ed1153c949f791eb306c542
SSDEEP 6144:JXCmtRrKD6cXIk7P3MEyvbpCag6gW8R8knWLR1B9K/Q+68mrKPsjsWr8Y8fY/3nL:JXFMag+/K/Q+63mPsjsWr8Y8fY/AZA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

efsdll.dll

SHA256 9a55de57f24a2ed96759a8e8cef0470ff09e79174dfc7220d36a586c4ecdb01f
MD5 a380576572ca1a7b23ea2c05fbdadfa4
SHA1 3755d18417b1338d5fe1b3560480a3fed558be08
SHA512 58352bbee22a2a3a37547f398924b447601a9d9dae532d04255f5524c4bad913ea48a142880f2cbf2b36fb28d2820d1fe967c5a9e5ccfc56c9b04dbc7da5ba48
SSDEEP 3072:naUfLpn9ocdukzaOjBh8nSf35/IexSzGbflbD+fDyBGdx6Mxo8tsSVNXRyz1s4ml:nXDp9ocdHjySP5V7l/+8GdxNq8tfVNBn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

2979840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

efskey.exe

SHA256 ade854f456f8bd05aeaed87de207caaa84b5ba457ad1dcfe902d252478564c6a
MD5 5aed2dc2ffa22134e8204301dfb7bf12
SHA1 6b1c81390c18739849ca105c8d45a1d305094d46
SHA512 f794567e3d06e2e39cb70ba793a8871dd85fa72e542ab7775b49f2053ccf6121d2a909f3a13a9182ee9553fe873127af2cbd0b808d07d0ba87694131d76579dc
SSDEEP 6144:qU9rVJ56cLxGnl8JTtE6xNPOTSE2Cy/rcK:VVJnLxYOtrxsG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

451680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

fmkey.exe

IMPHASH c75132cb9cb1ab2ef1c8f8c9c3e52e10
SHA256 7d2489b9a0afd221acafe8fcf2abd4a1650ac7d3facb12eb5d50e16f758a021c
MD5 7285b5ed94fcf0c831d00d42c899a7fd
SHA1 b8f2c611c542a4746572f34fbbc3fe77aac94934
SHA512 905e31ed3ded409bb6c9d4d49d087cb6cd91c11b08a1d23ed8caf4f6a9dcf4a24e3d60d6b0c21815b7e29fd73d303bad74f076b9429744a72ed6809e565b4a8a
SSDEEP 12288:FCJ9SHkpzFonHMEpguHv1+P+Tq28ds4iy0y7Lp+XQNkfwJA6oLL8aOeghFM4lPrq:FCJ9SHkpzFETxOseBbNZl/xh10pRPK2P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23612

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetSystemDefaultLCID InterlockedExchange GetModuleHandleA GetStartupInfoA

user32

GetKeyState

pk83

ord953 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord15331 ord14075 ord1029 ord8274 ord16310 ord2568 ord4291 ord16148 ord20606 ord21724 ord13016 ord19694 ord8448 ord6272 ord16387 ord14146 ord5021 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord15044 ord6689 ord21892 ord9525 ord17099 ord13843 ord10323 ord2244 ord17976 ord8666 ord17223 ord16878 ord1687 ord2189 ord264 ord17044 ord3494 ord8581 ord2479 ord10695 ord7594 ord15400 ord4272 ord5885 ord20461 ord17702 ord21859 ord20538 ord11513 ord19067 ord9242 ord6453 ord2926 ord20313 ord6678 ord19108 ord2045 ord17520 ord4942 ord16346 ord18098 ord8979 ord21580 ord10661 ord16500 ord21897 ord3035 ord16157 ord15744 ord18595 ord7186 ord11533 ord18723 ord17043 ord15180 ord12947 ord11348 ord4499 ord7020 ord11359 ord4768 ord3507 ord4107 ord9265 ord12139 ord76 ord12446 ord21320 ord10510 ord2631 ord17237 ord8582 ord18687 ord19786 ord4490 ord22060 ord7304 ord17303 ord5406 ord10704 ord241 ord3891 ord6273

msvcr71

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit _onexit __dllonexit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _purecall ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1exception@@UAE@XZ memmove _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

24KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

476KB

Virtual Size

473KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_BSS

Size

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CRT

Size

4KB

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

iekey.exe

IMPHASH 8dc486803f4467042a488031d2240f12
SHA256 125e1ba9eda1e87fe34eea6badeb749cc820feb977aab2f43623fcdb49729125
MD5 1ec49b8d563a805a9bd09810d37c4647
SHA1 a68a1b232681ba54b50e082c5f0a8246587d9f26
SHA512 bd052c014a8aea6f37c81268b0fc787bbbc758d657b938a0457d9da954e1a52b49bde7dabce780e64f6ec884aabfc0c99276d4cfd6617bf1c257a897e775212e
SSDEEP 24576:tEJ07sfwY328G9vv6wCoGjTUzQ4TiaZGxjbsYTyKghGALQKOQQDOMc:tEJ07sfFo7LubsY3ghGnKOQ1Mc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

55944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary InterlockedIncrement InterlockedDecrement lstrlenA InitializeCriticalSection GetStartupInfoA GetModuleHandleA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListA

pk83

ord20012 ord15721 ord15055 ord19066 ord3223 ord5518 ord3482 ord11080 ord1592 ord12667 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord953 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord20578 ord5031 ord18891 ord21431 ord1615 ord4223 ord19146 ord2242 ord19555 ord10994 ord14822 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord21306 ord21905 ord15478 ord1029 ord241 ord18933 ord3587 ord16310 ord21377 ord3350 ord854 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord3035 ord20078 ord10323 ord1198 ord9172 ord14443 ord4551 ord15671 ord5276 ord6936 ord2703 ord2913 ord4815 ord3419 ord1547 ord10285 ord16236 ord4107 ord5906 ord5825 ord13121 ord13200 ord10419 ord10677 ord11683 ord19018 ord17223 ord8666 ord17976 ord2244 ord13307 ord7310 ord1543 ord18525 ord7266 ord9248 ord485 ord2931 ord2008 ord11359 ord17044 ord16248 ord11348 ord2898 ord14169 ord5406 ord4298 ord4511 ord18279 ord12148 ord16512 ord15594 ord11471 ord6928 ord17043 ord11533 ord15744 ord20864 ord20146 ord4499 ord4490 ord10704 ord22060 ord17303 ord7304 ord12947 ord7488 ord15327 ord20060 ord8377 ord12446 ord7980 ord13023 ord6584 ord8582 ord18687 ord19786 ord21320 ord3891 ord18237 ord6110 ord9455 ord12698 ord21220

msvcr71

_read _lseek _controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ ?terminate@@YAXXZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _except_handler3 _callnewh ??0exception@@QAE@XZ ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z memmove __CxxLongjmpUnwind _setjmp3 _close _purecall malloc free _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z _open

Name

.text

Size

64KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_BSS

Size

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

894B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

lnkey.exe

IMPHASH 89a1783f5a4ae28f8d13f3e38fb8da52
SHA256 456d90eecd3d26a712dfe29a660f87d0174847649b22010f2a762c75045b6f36
MD5 d8c1536eb0941b40bda8172bf340fb42
SHA1 430571c8c7f82de2bb3fedbe905464cc55d59ff0
SHA512 e2fa42d33a1696d64b3ff9216390a05639f8fd9f45cd6fb5d373ebc928e162b976354ca41461faa33bb2bff12201f6ae8be19c8b3beffc6c0af74912e17e0ba0
SSDEEP 1536:qNdBP+abJW9Zk5M2QPnkQc7N4Kgwkj4p0waxgJU6rF/fKydcU9syPnf:GvnlWjk5M2QPnLcxgJwaxIU6B/pdDPnf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

42568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord548 ord11251 ord6272 ord16387 ord16310 ord14146 ord8582 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord4881 ord12625 ord19735 ord15881 ord13788 ord15224 ord3560 ord15868 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord19555 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord21377 ord18126 ord854 ord2568 ord16148 ord7304 ord4490 ord20606 ord21724 ord2769 ord19694 ord8448 ord20153 ord5021 ord19786 ord21320 ord12446 ord11359 ord6748 ord9359 ord17694 ord7511 ord424 ord16616 ord21368 ord8287 ord9914 ord2142 ord9737 ord20989 ord8075 ord5208 ord5159 ord21204 ord11835 ord5371 ord9196 ord1228 ord21844 ord916 ord18379 ord3548 ord14169 ord13987 ord10704 ord5406 ord9464 ord8458 ord17303 ord13091 ord7980 ord16740 ord19774 ord7225 ord4669 ord14627 ord14321 ord16470 ord2056 ord6947 ord19674 ord5488 ord7452 ord18275 ord18483 ord20511 ord9968 ord2138 ord5272 ord19184 ord15044 ord6689 ord21892 ord9525 ord17043 ord13843 ord17099 ord18933 ord12378 ord14837 ord16512 ord21128 ord10185 ord241 ord4291 ord15771 ord1029 ord4499 ord15046 ord12947 ord15327 ord7488 ord76 ord2931 ord21444 ord7224 ord12483 ord17195 ord21105 ord90 ord1478 ord16859 ord18687 ord8815 ord22060 ord16406 ord11786 ord15744 ord5825 ord12667 ord1592 ord11080 ord3482 ord6584 ord13371 ord5518 ord3891 ord13016

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc _CxxThrowException __CxxLongjmpUnwind _setjmp3 _purecall __CxxFrameHandler ??3@YAXPAX@Z

mailkey.exe

IMPHASH c2a13e47fe337ddbb23c8bcda29aa28c
SHA256 a7411902b700947cd2e145adb869611fa61b762c990bccedf2210f0b3e98cda5
MD5 c2e0ea689342afc86b2d9c21bca16dfd
SHA1 93da86de5229b72ddb835e994cc306769ddcee4f
SHA512 38de7995b92fc29a75e6365530741c4ba3a1a3f01428ded86ba561c17565812802f6b3647f4110a4d890e4efb8bf3844774d88d9e0ea4f59cbc679ad65e5286f
SSDEEP 3072:bhRReTrWhqOGg0ZB0aTpdnm2/mfeu3PxBMpjLNeeOOUDx0MI6XT:b/uWlGg0ZB0aT7nm2/qeu3PxUjLNeFHN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord11080 ord1592 ord12667 ord5825 ord15744 ord11786 ord16406 ord22060 ord8815 ord18687 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord12947 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord953 ord3482 ord2568 ord4291 ord16148 ord7304 ord4490 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord21320 ord12446 ord76 ord17043 ord4768 ord10704 ord6723 ord7020 ord15771 ord11533 ord6584 ord5518 ord8582 ord854 ord10994 ord21377 ord2242 ord19555 ord14822 ord19146 ord4223 ord1615 ord21431 ord18891 ord7792 ord5031 ord21220 ord11868 ord3970 ord19735 ord12625 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord4499 ord2663 ord3891 ord16310

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc _CxxThrowException __CxxLongjmpUnwind _setjmp3 _purecall __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

512B

Virtual Size

263B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

512B

Virtual Size

188B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

1024B

Virtual Size

844B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

moneykey.exe

IMPHASH d20e6d1feed0bb9c13798d5590e33e85
SHA256 fa76d5a2e6b4ff6755a0ac5cc47832b3442381ff16c46bcced42adc85ff8ace6
MD5 08812585388679fc10ea080067117462
SHA1 b08909a68e7997ef004fd2bd27d2ef2205d44836
SHA512 e9cfa62dd83e79241759f690240de7c5eba238d4d59d57defc2de22b44793558947442b8fd5444b7725ae4aa748d383508fb6c8ebeefb2a7e1ca3d9a5b158e0d
SSDEEP 6144:Vse4dnirIQLQuOBh6JgOpxMlRAIIe2gV3Ag1/NuKhRUwWl2aGLEou8HaDC6rXwzt:VseinirIQLQjcgOpxaRAIIe5FAg1/Nuc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

104168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement InterlockedDecrement GetModuleHandleA GetStartupInfoA

advapi32

CryptDestroyHash CryptGetHashParam CryptDestroyKey CryptAcquireContextA CryptReleaseContext CryptSetKeyParam CryptDecrypt CryptDeriveKey CryptHashData CryptCreateHash

pk83

ord11359 ord13091 ord1029 ord7980 ord5518 ord6584 ord3482 ord16740 ord19774 ord7225 ord4669 ord14627 ord14321 ord16470 ord2056 ord6947 ord19674 ord5488 ord7452 ord10695 ord18483 ord20511 ord9968 ord2138 ord5272 ord19184 ord17237 ord2631 ord10510 ord18687 ord14377 ord1592 ord11080 ord12667 ord5825 ord16406 ord11786 ord7224 ord8815 ord17195 ord12483 ord21105 ord16859 ord1478 ord90 ord21444 ord2931 ord76 ord7488 ord12947 ord15327 ord15046 ord11533 ord4499 ord3507 ord10661 ord15496 ord19843 ord16354 ord21404 ord17043 ord15771 ord14146 ord4291 ord6272 ord11251 ord10185 ord548 ord21128 ord20153 ord16387 ord6723 ord4107 ord3035 ord7020 ord10059 ord15537 ord9265 ord5174 ord17668 ord2663 ord17675 ord3548 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord4881 ord12625 ord19735 ord15881 ord13788 ord15224 ord3560 ord15868 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord19555 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord241 ord16310 ord10236 ord10574 ord20037 ord6202 ord2449 ord4937 ord240 ord21377 ord18126 ord854 ord2568 ord16148 ord20606 ord21724 ord2769 ord19694 ord8448 ord13016 ord13371 ord5021 ord12333 ord229 ord15465 ord7984 ord15044 ord6689 ord21892 ord17099 ord13843 ord8287 ord18933 ord4768 ord14837 ord19621 ord17513 ord21544 ord16263 ord16617 ord18102 ord15744 ord8458 ord9464 ord5406 ord13987 ord18379 ord916 ord21844 ord1228 ord9196 ord5371 ord11835 ord21204 ord5851 ord5208 ord8075 ord20989 ord7838 ord4490 ord22060 ord7304 ord17303 ord10704 ord9914 ord21368 ord6748 ord17044 ord7310 ord8377 ord16512 ord2008 ord12446 ord21320 ord8582 ord18525 ord56 ord19786 ord3891 ord11348

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc _wcsupr fopen __CxxLongjmpUnwind _setjmp3 _CxxThrowException _purecall __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

112KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

188KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

561B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

msgrkey.exe

IMPHASH 9b2eb68d6593b1e92e4617f5b9ccdc47
SHA256 f223384fb988e035c4a826fbccda9e998cdef59dfc5203d88392d895393e060f
MD5 616c74bb90bb15b404fba59b4c7d39e9
SHA1 1c0cdfe912aa7448c15e97f55f4c049223d67639
SHA512 6bbfd574faf982fe54af44c667c4e31a0a341ef580f0d6058af97e9ba1068470c16e2140eb35ac686d65c2886704b1d6d8772ee2a7e5653047eefd2a250e8923
SSDEEP 3072:LwJC8Yk5KZF9B7ipMhriJtt+7ISc0O8D2WJflVvy9TdFgWGO41q6:LQC8Yk5KZF9cpMhGDt8lc0pDJflVvyXi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

80298

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeInformationA GetWindowsDirectoryA InterlockedIncrement GetLastError GetCurrentThread LoadLibraryA GetProcAddress InterlockedDecrement GetCurrentProcess FreeLibrary GetModuleHandleA GetStartupInfoA

advapi32

OpenProcessToken GetTokenInformation LookupAccountSidA OpenThreadToken

pk83

ord17043 ord4499 ord12947 ord19786 ord12378 ord10323 ord5192 ord2008 ord10695 ord15044 ord6689 ord21892 ord9525 ord17099 ord13843 ord7838 ord6936 ord7488 ord15327 ord20285 ord11533 ord16141 ord18525 ord9607 ord5518 ord6584 ord3482 ord7310 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord15046 ord953 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord10704 ord16167 ord10610 ord1780 ord12625 ord19735 ord3970 ord11868 ord4310 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord2242 ord14822 ord19555 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord18237 ord4815 ord4881 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord4291 ord241 ord16148 ord20606 ord1029 ord9423 ord16310 ord6272 ord16387 ord14146 ord14169 ord6110 ord2913 ord21377 ord3350 ord10994 ord854 ord2568 ord21724 ord19694 ord8448 ord13016 ord13371 ord5021 ord15954 ord21657 ord12959 ord8377 ord6103 ord13121 ord17035 ord5406 ord16236 ord10285 ord15671 ord1547 ord16512 ord10337 ord7552 ord8773 ord1281 ord16878 ord1687 ord8666 ord17976 ord2244 ord76 ord13307 ord11359 ord7980 ord17044 ord12446 ord21320 ord11348 ord4107 ord1134 ord2931 ord8582 ord18687 ord15744 ord4490 ord22060 ord7304 ord21220 ord17303 ord3891 ord20342

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _purecall _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

msvcr71.dll

IMPHASH 7acc8c379c768a1ecd81ec502ff5f33e
SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
MD5 86f1895ae8c5e8b17d99ece768a70732
SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr71.pdb

kernel32

GetModuleFileNameA GetModuleFileNameW ExitProcess GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess WriteFile GetStdHandle GetCurrentThreadId GetCommandLineA GetVersionExA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ExitThread CloseHandle GetLastError ResumeThread CreateThread TlsAlloc SetLastError GetCurrentThread TlsFree TlsSetValue TlsGetValue FindNextFileA FindFirstFileA FindClose FindNextFileW FindFirstFileW HeapAlloc HeapFree GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr SetHandleCount GetFileType GetStartupInfoA GetACP GetOEMCP GetCPInfo LoadLibraryA MultiByteToWideChar GetCommandLineW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW InitializeCriticalSection RtlUnwind UnhandledExceptionFilter LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetConsoleCtrlHandler InterlockedExchange VirtualQuery QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetEnvironmentVariableA SetEnvironmentVariableW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetLocaleInfoW GetTimeFormatA GetDateFormatA GetTimeZoneInformation HeapSize VirtualProtect GetSystemInfo FlushFileBuffers SetFilePointer SetStdHandle CompareStringA CompareStringW Sleep Beep FileTimeToSystemTime FileTimeToLocalFileTime GetDiskFreeSpaceA GetLogicalDrives SetErrorMode GetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetDriveTypeA CreateDirectoryA RemoveDirectoryA DeleteFileA GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW SetFileAttributesW GetFullPathNameW CreateDirectoryW DeleteFileW MoveFileW RemoveDirectoryW GetDriveTypeW MoveFileA RaiseException IsBadReadPtr SetUnhandledExceptionFilter IsBadCodePtr GetExitCodeProcess WaitForSingleObject FreeLibrary CreateProcessA CreateProcessW HeapValidate HeapCompact HeapWalk ReadConsoleA SetConsoleMode GetConsoleMode IsDBCSLeadByteEx GetConsoleCP ReadConsoleW SetEndOfFile WriteConsoleA GetConsoleOutputCP WriteConsoleW DuplicateHandle GetFileInformationByHandle PeekNamedPipe ReadConsoleInputA PeekConsoleInputA GetNumberOfConsoleInputEvents ReadConsoleInputW LockFile UnlockFile CreateFileA CreatePipe ReadFile CreateFileW SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetLocalTime SetLocalTime

$I10_OUTPUT ??0__non_rtti_object@@QAE@ABV0@@Z ??0__non_rtti_object@@QAE@PBD@Z ??0bad_cast@@AAE@PBQBD@Z ??0bad_cast@@QAE@ABQBD@Z ??0bad_cast@@QAE@ABV0@@Z ??0bad_cast@@QAE@PBD@Z ??0bad_typeid@@QAE@ABV0@@Z ??0bad_typeid@@QAE@PBD@Z ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1__non_rtti_object@@UAE@XZ ??1bad_cast@@UAE@XZ ??1bad_typeid@@UAE@XZ ??1exception@@UAE@XZ ??1type_info@@UAE@XZ ??2@YAPAXI@Z ??3@YAXPAX@Z ??4__non_rtti_object@@QAEAAV0@ABV0@@Z ??4bad_cast@@QAEAAV0@ABV0@@Z ??4bad_typeid@@QAEAAV0@ABV0@@Z ??4exception@@QAEAAV0@ABV0@@Z ??8type_info@@QBEHABV0@@Z ??9type_info@@QBEHABV0@@Z ??_7__non_rtti_object@@6B@ ??_7bad_cast@@6B@ ??_7bad_typeid@@6B@ ??_7exception@@6B@ ??_Fbad_cast@@QAEXXZ ??_Fbad_typeid@@QAEXXZ ??_U@YAPAXI@Z ??_V@YAXPAX@Z ?_query_new_handler@@YAP6AHI@ZXZ ?_query_new_mode@@YAHXZ ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z ?_set_new_mode@@YAHH@Z ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z ?before@type_info@@QBEHABV1@@Z ?name@type_info@@QBEPBDXZ ?raw_name@type_info@@QBEPBDXZ ?set_new_handler@@YAP6AXXZP6AXXZ@Z ?set_terminate@@YAP6AXXZP6AXXZ@Z ?set_unexpected@@YAP6AXXZP6AXXZ@Z ?swprintf@@YAHPAGIPBGZZ ?swprintf@@YAHPA_WIPB_WZZ ?terminate@@YAXXZ ?unexpected@@YAXXZ ?vswprintf@@YAHPAGIPBGPAD@Z ?vswprintf@@YAHPA_WIPB_WPAD@Z ?what@exception@@UBEPBDXZ _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _CRT_RTC_INIT _CxxThrowException _EH_prolog _Getdays _Getmonths _Gettnames _HUGE _Strftime _XcptFilter __CppXcptFilter __CxxCallUnwindDtor __CxxCallUnwindVecDtor __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __RTCastToVoid __RTDynamicCast __RTtypeid __STRINGTOLD ___lc_codepage_func ___lc_collate_cp_func ___lc_handle_func ___mb_cur_max_func ___setlc_active_func ___unguarded_readlc_active_add_func __argc __argv __badioinfo __buffer_overrun __crtCompareStringA __crtCompareStringW __crtGetLocaleInfoW __crtGetStringTypeW __crtLCMapStringA __crtLCMapStringW __dllonexit __doserrno __fpecode __getmainargs __initenv __iob_func __isascii __iscsym __iscsymf __lc_clike __lc_codepage __lc_collate_cp __lc_handle __lconv_init __mb_cur_max __p___argc __p___argv __p___initenv __p___mb_cur_max __p___wargv __p___winitenv __p__acmdln __p__amblksiz __p__commode __p__daylight __p__dstbias __p__environ __p__fileinfo __p__fmode __p__iob __p__mbcasemap __p__mbctype __p__osver __p__pctype __p__pgmptr __p__pwctype __p__timezone __p__tzname __p__wcmdln __p__wenviron __p__winmajor __p__winminor __p__winver __p__wpgmptr __pctype_func __pioinfo __pwctype_func __pxcptinfoptrs __security_error_handler __set_app_type __set_buffer_overrun_handler __setlc_active __setusermatherr __threadhandle __threadid __toascii __unDName __unDNameEx __uncaught_exception __unguarded_readlc_active __wargv __wcserror __wgetmainargs __winitenv _abnormal_termination _access _acmdln _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _adjust_fdiv _aexit_rtn _aligned_free _aligned_malloc _aligned_offset_malloc _aligned_offset_realloc _aligned_realloc _amsg_exit _assert _atodbl _atoi64 _atoldbl _beep _beginthread _beginthreadex _c_exit _cabs _callnewh _cexit _cgets _cgetws _chdir _chdrive _chgsign _chkesp _chmod _chsize _clearfp _close _commit _commode _control87 _controlfp _copysign _cprintf _cputs _cputws _creat _cscanf _ctime64 _cwait _cwprintf _cwscanf _daylight _dstbias _dup _dup2 _ecvt _endthread _endthreadex _environ _eof _errno _except_handler2 _except_handler3 _execl _execle _execlp _execlpe _execv _execve _execvp _execvpe _exit _expand _fcloseall _fcvt _fdopen _fgetchar _fgetwchar _filbuf _fileinfo _filelength _filelengthi64 _fileno _findclose _findfirst _findfirst64 _findfirsti64 _findnext _findnext64 _findnexti64 _finite _flsbuf _flushall _fmode _fpclass _fpieee_flt _fpreset _fputchar _fputwchar _fsopen _fstat _fstat64 _fstati64 _ftime _ftime64 _ftol _fullpath _futime _futime64 _gcvt _get_heap_handle _get_osfhandle _get_sbh_threshold _getch _getche _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getsystime _getw _getwch _getwche _getws _global_unwind2 _gmtime64 _heapadd _heapchk _heapmin _heapset _heapused _heapwalk _hypot _i64toa _i64tow _initterm _inp _inpd _inpw _iob _isatty _isctype _ismbbalnum _ismbbalpha _ismbbgraph _ismbbkalnum _ismbbkana _ismbbkprint _ismbbkpunct _ismbblead _ismbbprint _ismbbpunct _ismbbtrail _ismbcalnum _ismbcalpha _ismbcdigit _ismbcgraph _ismbchira _ismbckata _ismbcl0 _ismbcl1 _ismbcl2 _ismbclegal _ismbclower _ismbcprint _ismbcpunct _ismbcspace _ismbcsymbol _ismbcupper _ismbslead _ismbstrail _isnan _itoa _itow _j0 _j1 _jn _kbhit _lfind _loaddll _local_unwind2 _localtime64 _lock _locking _logb _longjmpex _lrotl _lrotr _lsearch _lseek _lseeki64 _ltoa _ltow _makepath _mbbtombc _mbbtype _mbcasemap _mbccpy _mbcjistojms _mbcjmstojis _mbclen _mbctohira _mbctokata _mbctolower _mbctombb _mbctoupper _mbctype _mbsbtype _mbscat _mbschr _mbscmp _mbscoll _mbscpy _mbscspn _mbsdec _mbsdup _mbsicmp _mbsicoll _mbsinc _mbslen _mbslwr _mbsnbcat _mbsnbcmp _mbsnbcnt _mbsnbcoll _mbsnbcpy _mbsnbicmp _mbsnbicoll _mbsnbset _mbsncat _mbsnccnt _mbsncmp _mbsncoll _mbsncpy _mbsnextc _mbsnicmp _mbsnicoll _mbsninc _mbsnset _mbspbrk _mbsrchr _mbsrev _mbsset _mbsspn _mbsspnp _mbsstr _mbstok _mbstrlen _mbsupr _memccpy _memicmp _mkdir _mktemp _mktime64 _msize _nextafter _onexit _open _open_osfhandle _osplatform _osver _outp _outpd _outpw _pclose _pctype _pgmptr _pipe _popen _purecall _putch _putenv _putw _putwch _putws _pwctype _read _resetstkoflw _rmdir _rmtmp _rotl _rotr _safe_fdiv _safe_fdivr _safe_fprem _safe_fprem1 _scalb _scprintf _scwprintf _searchenv _seh_longjmp_unwind _set_SSE2_enable _set_error_mode _set_purecall_handler _set_sbh_threshold _set_security_error_handler _seterrormode _setjmp _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _snprintf _snscanf _snwprintf _snwscanf _sopen _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _stat _stat64 _stati64 _statusfp _strcmpi _strdate _strdup _strerror _stricmp _stricoll _strlwr _strncoll _strnicmp _strnicoll _strnset _strrev _strset _strtime _strtoi64 _strtoui64 _strupr _swab _sys_errlist _sys_nerr _tell _telli64 _tempnam _time64 _timezone _tolower _toupper _tzname _tzset _ui64toa _ui64tow _ultoa _ultow _umask _ungetch _ungetwch _unlink _unloaddll _unlock _utime _utime64 _vscprintf _vscwprintf _vsnprintf _vsnwprintf _waccess _wasctime _wchdir _wchmod _wcmdln _wcreat _wcsdup _wcserror _wcsicmp _wcsicoll _wcslwr _wcsncoll _wcsnicmp _wcsnicoll _wcsnset _wcsrev _wcsset _wcstoi64 _wcstoui64 _wcsupr _wctime _wctime64 _wctype _wenviron _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst _wfindfirst64 _wfindfirsti64 _wfindnext _wfindnext64 _wfindnexti64 _wfopen _wfreopen _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _winmajor _winminor _winver _wmakepath _wmkdir _wmktemp _wopen _wperror _wpgmptr _wpopen _wputenv _wremove _wrename _write _wrmdir _wsearchenv _wsetlocale _wsopen _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wstat _wstat64 _wstati64 _wstrdate _wstrtime _wsystem _wtempnam _wtmpnam _wtof _wtoi _wtoi64 _wtol _wunlink _wutime _wutime64 _y0 _y1 _yn abort abs acos asctime asin atan atan2 atexit atof atoi atol bsearch calloc ceil clearerr clock cos cosh ctime difftime div exit exp fabs fclose feof ferror fflush fgetc fgetpos fgets fgetwc fgetws floor fmod fopen fprintf fputc fputs fputwc fputws fread free freopen frexp fscanf fseek fsetpos ftell fwprintf fwrite fwscanf getc getchar getenv gets getwc getwchar gmtime is_wctype isalnum isalpha iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv localeconv localtime log log10 longjmp malloc mblen mbstowcs mbtowc memchr memcmp memcpy memmove memset mktime modf perror pow printf putc putchar puts putwc putwchar qsort raise rand realloc remove rename rewind scanf setbuf setlocale setvbuf signal sin sinh sprintf sqrt srand sscanf strcat strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtod strtok strtol strtoul strxfrm swprintf swscanf system tan tanh time tmpfile tmpnam tolower toupper towlower towupper ungetc ungetwc vfprintf vfwprintf vprintf vsprintf vswprintf vwprintf wcscat wcschr wcscmp wcscoll wcscpy wcscspn wcsftime wcslen wcsncat wcsncmp wcsncpy wcspbrk wcsrchr wcsspn wcsstr wcstod wcstok wcstol wcstombs wcstoul wcsxfrm wctomb wprintf wscanf

myobkey.exe

IMPHASH 9eff66fa43205bd1322d08a9b2b14783
SHA256 10d50e76046ff608261ed7dbc0ac634f525be3b2d128aaf7c083efc019ff7989
MD5 b23e6709206d426b1bb8eeade483de79
SHA1 5507537c1a9497726bddf48502a8d12680bd98cf
SHA512 f006799f919cbaf4f7dc1c72f0bedb07b796ae8c0fae660b3207115f8a75f3f7a29eeb8ac89483ebf0e088ba15eb5833f8de10d0a58f520ba5809e8e456ba074
SSDEEP 6144:KZW8vKJo8vKOoKFKaWcdXoRBfb4l2aXq9uSbgrf04jEUNybwyecNnJoCJbVIiM+h:aW8vZ0KSsaJdoBfb4gaa9uSbwf04AUNK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord11786 ord16406 ord8815 ord16859 ord1478 ord18687 ord953 ord17195 ord12483 ord7224 ord21444 ord2931 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord5406 ord15331 ord12143 ord3035 ord8274 ord5451 ord5825 ord16500 ord17303 ord7304 ord4490 ord22060 ord1687 ord16878 ord17223 ord8666 ord17976 ord2244 ord19786 ord18102 ord17152 ord10704 ord4768 ord17044 ord17043 ord15744 ord16512 ord12378 ord4499 ord10337 ord11533 ord11348 ord4107 ord12947 ord7488 ord15327 ord76 ord12446 ord21320 ord21105 ord8582 ord3891 ord90

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _CxxThrowException _purecall islower __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

248KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

nckey.exe

IMPHASH 89698ecd95d75c0dd721a484fb6a6c72
SHA256 35f1076d037a1af4cfa6726931e347bc389d78fb3347ebc73072bef2002041c5
MD5 2608c0fdb5d89a21e50955de42a87792
SHA1 be3b1fcd3db395a42318ea55657ff7da5807db7f
SHA512 6d0971a8d9e11fed8746f2d76d0e05ccad7a4ca56231b1b468e1737d65e7b506306884b35f773f561a96e99b98f76dcc2b37b84e493af2b648d807b7941aad01
SSDEEP 12288:1Pvg8fmnIx+5VIvjQXFPF5eDOVObLXuDl/N2XVYKP600Yn/58ruIe0XKQzwIn874:RVxuZpUmmvHyu4mmadE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

rasapi32

RasEnumEntriesA

kernel32

GetProcAddress GetStartupInfoA InterlockedDecrement FreeLibrary InterlockedExchange GetModuleHandleA LoadLibraryA InterlockedIncrement GetPrivateProfileStringA

user32

PostMessageA

pk83

ord15721 ord15055 ord19066 ord1198 ord6728 ord76 ord10439 ord18784 ord12139 ord15942 ord16324 ord21478 ord21419 ord15044 ord18554 ord2126 ord7453 ord13843 ord18731 ord5885 ord20313 ord8928 ord18723 ord19439 ord4499 ord12947 ord7980 ord21320 ord12446 ord16512 ord14377 ord8377 ord17044 ord11359 ord7488 ord15327 ord18595 ord17043 ord11533 ord14169 ord6584 ord5518 ord3482 ord1592 ord11080 ord12667 ord5825 ord16406 ord11786 ord7224 ord8815 ord17195 ord12483 ord21105 ord16859 ord1478 ord90 ord21444 ord2931 ord12965 ord2663 ord953 ord19735 ord12625 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord14822 ord2242 ord12838 ord20192 ord56 ord17675 ord19146 ord4223 ord1615 ord21431 ord18891 ord7266 ord5031 ord21220 ord11868 ord3970 ord19555 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord2449 ord10574 ord6202 ord20037 ord240 ord15537 ord4937 ord10236 ord449 ord9607 ord241 ord16310 ord1029 ord2898 ord3752 ord5481 ord854 ord10994 ord21377 ord3350 ord11685 ord14146 ord4291 ord6272 ord20606 ord19694 ord8448 ord21724 ord5021 ord2568 ord13016 ord13371 ord16148 ord16387 ord9302 ord2479 ord16219 ord2273 ord10695 ord9405 ord16157 ord15362 ord2045 ord9242 ord10623 ord12603 ord16184 ord2189 ord3494 ord19067 ord5406 ord17303 ord7304 ord4490 ord10704 ord9265 ord3507 ord20538 ord19786 ord10510 ord15823 ord17237 ord21106 ord3615 ord22060 ord8582 ord18687 ord3891 ord7792 ord15744 ord15046

msvcr71

_access ??_V@YAXPAX@Z _controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc _setjmp3 __CxxLongjmpUnwind _purecall _CxxThrowException __CxxFrameHandler ??3@YAXPAX@Z

Name

.text

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

388KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

654B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

oekey.exe

IMPHASH d033b91f6831dcf883bc9a380ddb93bd
SHA256 a04f5f444116f127df0462470b7e7d4f76409d4584178b258f920f287a0d003c
MD5 749b5eee4cb501dd646eec02bf5b1979
SHA1 6a8c183dd4a8e3f014fcf986ee30ef8e84b8cc47
SHA512 96c1330436869938f86ed88266566cf8a54509ff27aa7b6b04d9c4f9c46c29ec3aa78ed58a5ba8c377c59939236e5498eb58b79411640790886f9832bb0e675b
SSDEEP 1536:NInFa0r1Q/nfrF4UqxMzZu/3F/ICmmCfzb0Jh15y5oUns/Ln:NAFa0rAB4Uqx3falmC7IH15y5yn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

user32

PostMessageA GetKeyState

pk83

ord18186 ord16859 ord1478 ord90 ord12483 ord11080 ord1592 ord12667 ord8815 ord21105 ord17195 ord7224 ord11786 ord16406 ord21444 ord7488 ord15327 ord953 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord18891 ord21431 ord1615 ord4223 ord19146 ord2242 ord19555 ord10994 ord16500 ord14822 ord15046 ord3223 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord15643 ord9607 ord449 ord4573 ord5915 ord21377 ord3350 ord854 ord2568 ord4291 ord241 ord16148 ord20606 ord21724 ord19694 ord8448 ord16310 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord18933 ord10574 ord17043 ord20037 ord6202 ord17827 ord3587 ord16512 ord18595 ord14169 ord20078 ord12446 ord8377 ord11240 ord6147 ord13216 ord1134 ord12148 ord2931 ord13553 ord7980 ord15721 ord19066 ord1198 ord20337 ord5906 ord15055 ord1029 ord5825 ord15744 ord4499 ord5406 ord4551 ord11359 ord6635 ord6841 ord13200 ord12947 ord11533 ord4490 ord22060 ord7304 ord17303 ord10704 ord3482 ord6584 ord5518 ord18525 ord8582 ord18687 ord19786 ord21320 ord3891 ord10009

msvcr71

_exit _controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter ??3@YAXPAX@Z _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _purecall _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z

offkey.exe

IMPHASH 84a7f71af6c06229f8d6a654a17d21fa
SHA256 5d4b6e8aec8df5006433ae8363e14a2bf03c6763e7e8754b369b59e87fb331e2
MD5 dfd2d65bab2e29d28cfa7820b462d086
SHA1 42bd7fbf72d26d6ea44d2ce782f2fdd8b1ec1d15
SHA512 dc0f5169ed712aa5dcd4baaa6e51652957171a275382271257803b8918bbd2fb54cebb576be0d4f99d062615c8ab5872847e62422e82f59c1e18f8d81e7ad1af
SSDEEP 98304:3rgW+mHqE+JI10DJMQNhcrUpgHcDGZ3jbESHiDK4rXD8jGli8VkKQzFluuUdEfZB:3rgW+mHqE+JI10DJMQNhcrUpgHcDGZ3X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

189581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetStartupInfoA LoadLibraryA GetProcAddress FreeLibrary InterlockedExchange InterlockedIncrement InterlockedDecrement

user32

PostMessageA

advapi32

CryptReleaseContext CryptDeriveKey CryptEncrypt CryptDecrypt CryptDestroyKey CryptGetHashParam CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA

pk83

ord19843 ord16354 ord21404 ord5825 ord21544 ord16263 ord16617 ord11251 ord10185 ord548 ord21128 ord20153 ord15771 ord17043 ord9265 ord17668 ord18102 ord485 ord5406 ord2189 ord12378 ord19067 ord3494 ord14169 ord2931 ord10464 ord18595 ord5530 ord14700 ord13032 ord5705 ord17158 ord3762 ord6250 ord20619 ord11080 ord1592 ord12667 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord5988 ord15046 ord4768 ord11348 ord10337 ord6723 ord16148 ord20606 ord4291 ord241 ord7020 ord16310 ord6272 ord17400 ord14146 ord21209 ord12336 ord10739 ord18455 ord11971 ord7706 ord14837 ord18933 ord565 ord20078 ord2763 ord9337 ord2244 ord17976 ord8666 ord17223 ord19018 ord11683 ord10677 ord10419 ord7136 ord7386 ord13383 ord2554 ord9248 ord631 ord12710 ord22055 ord11443 ord1436 ord5451 ord8756 ord5011 ord14802 ord3766 ord3182 ord20538 ord20746 ord15273 ord9328 ord12288 ord4516 ord12568 ord20702 ord10568 ord12217 ord11519 ord15362 ord16248 ord1543 ord1134 ord9455 ord18279 ord17838 ord10760 ord5513 ord18021 ord2451 ord7558 ord1759 ord15044 ord6689 ord9525 ord17099 ord13843 ord20009 ord8363 ord20459 ord17702 ord20461 ord16157 ord21047 ord19971 ord22024 ord639 ord8930 ord5620 ord2043 ord8037 ord6150 ord6543 ord6949 ord8274 ord15331 ord1270 ord12871 ord16728 ord13871 ord18879 ord10017 ord8924 ord10661 ord4120 ord20299 ord6942 ord12139 ord15537 ord5826 ord5429 ord3837 ord16387 ord17242 ord1307 ord18723 ord17640 ord1020 ord4307 ord20416 ord11194 ord1687 ord16878 ord12333 ord7984 ord229 ord15465 ord10323 ord7527 ord19190 ord5174 ord21859 ord12519 ord7027 ord4609 ord15342 ord1029 ord19401 ord4927 ord1356 ord1838 ord12148 ord18525 ord20337 ord15055 ord15721 ord19066 ord1198 ord11240 ord6147 ord13216 ord4551 ord13553 ord3223 ord21368 ord20989 ord8075 ord5208 ord5851 ord5159 ord21204 ord11835 ord5371 ord9196 ord1228 ord21844 ord916 ord18379 ord13987 ord9464 ord8458 ord3548 ord13091 ord16740 ord19774 ord7225 ord4669 ord14627 ord14321 ord16470 ord2056 ord6947 ord19674 ord5488 ord7452 ord10695 ord18483 ord20511 ord9968 ord2138 ord5272 ord19184 ord932 ord2669 ord805 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord4881 ord12625 ord19735 ord15881 ord13788 ord3560 ord15868 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord21555 ord8069 ord2843 ord3459 ord4534 ord13578 ord19397 ord15923 ord4812 ord10236 ord4937 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord19555 ord9607 ord449 ord15224 ord7836 ord535 ord5710 ord14907 ord10869 ord3350 ord21377 ord12746 ord18126 ord854 ord2568 ord21724 ord9321 ord2769 ord19694 ord8448 ord13016 ord13371 ord5021 ord2449 ord240 ord10574 ord20037 ord6202 ord3587 ord17827 ord20395 ord21892 ord10005 ord6811 ord149 ord20980 ord21835 ord12044 ord4582 ord19798 ord4507 ord9636 ord3507 ord8287 ord17513 ord19621 ord9914 ord7488 ord15327 ord76 ord7310 ord3482 ord5518 ord6584 ord17237 ord10510 ord2631 ord17303 ord7304 ord4490 ord10704 ord22060 ord12636 ord15744 ord4107 ord4499 ord11533 ord12947 ord11359 ord17044 ord8377 ord2008 ord16512 ord14377 ord12446 ord7980 ord8582 ord18687 ord19786 ord5070 ord21429 ord4877 ord1701 ord12485 ord4198 ord10059 ord6748 ord21320 ord3891 ord21910 ord15496 ord902

msvcr71

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit _onexit __dllonexit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc strchr memmove rand strtoul isxdigit sprintf _mktemp _strupr wcscmp _stricmp _setjmp3 __CxxLongjmpUnwind fopen _purecall wcslen _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z _access

Name

.text

Size

212KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_BSS

Size

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

560KB

Virtual Size

557KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

onkey.exe

IMPHASH c8b606a7e8e6a278469104502b49dcff
SHA256 6b9b599467bb9b7e6f50fa9203fdc39b0750fe8b12c091fe19d3036c2ba19146
MD5 6a0a4057c16ce65e93e9757b81aa5d9f
SHA1 9c7e584b00c98dfbb162ddd8f3a535d630439ee7
SHA512 203348330f2ef91dcefdd45c07004b770954f7c74833f483908930f07cc03437d0800bc6ac10ce24d4be78cb6b32548994b3d28a4bc3174afb0a19dd3ac7fb4e
SSDEEP 6144:uqR3mImKtNKvFmARTn9JCNcZ4k78r7atRH8Q5SRjwOiLeF1q2sA7Ycjhff2HMN7R:HbARjbCNcZ4k78natN8bRjxkeF1qYUUF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement InterlockedDecrement GetModuleHandleA GetStartupInfoA

advapi32

CryptImportKey CryptDeriveKey CryptDestroyHash CryptAcquireContextA CryptReleaseContext CryptDestroyKey CryptDuplicateKey CryptCreateHash CryptHashData

pk83

ord16387 ord14146 ord15771 ord9914 ord4499 ord8582 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord4881 ord12625 ord19735 ord15881 ord13788 ord15224 ord3560 ord15868 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord19555 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord241 ord16310 ord21377 ord18126 ord854 ord2568 ord16148 ord7304 ord4490 ord10059 ord21724 ord2769 ord19694 ord8448 ord13016 ord6272 ord5021 ord19786 ord21320 ord12446 ord8377 ord7310 ord6748 ord21368 ord20989 ord17303 ord13987 ord9464 ord8458 ord17043 ord11533 ord8075 ord5208 ord5851 ord5159 ord21204 ord11835 ord5371 ord9196 ord1228 ord21844 ord916 ord18379 ord3548 ord11359 ord13091 ord7980 ord16740 ord19774 ord7225 ord4669 ord14627 ord14321 ord16470 ord2056 ord6947 ord19674 ord5488 ord7452 ord10695 ord18483 ord20511 ord9968 ord2138 ord5272 ord19184 ord76 ord2244 ord17976 ord8666 ord17223 ord19018 ord11683 ord10677 ord10419 ord229 ord15465 ord7984 ord12333 ord16512 ord8876 ord8287 ord20500 ord4768 ord14837 ord18933 ord5406 ord10704 ord11251 ord548 ord20153 ord21128 ord10185 ord4291 ord1029 ord15046 ord12947 ord15327 ord7488 ord2931 ord21444 ord7224 ord12483 ord17195 ord21105 ord90 ord1478 ord16859 ord18687 ord8815 ord22060 ord16406 ord11786 ord15744 ord5825 ord12667 ord1592 ord11080 ord3482 ord6584 ord13371 ord5518 ord3891 ord20606

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc memmove _CxxThrowException __CxxLongjmpUnwind _setjmp3 _purecall __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

40KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

929B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

152KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

715B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

186B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

orgkey.exe

IMPHASH 638f2cc02e313b7dc49be0150faca516
SHA256 923039ef72375ef4682469980316934beb7c5533dcadc7384c202fc76381bb2e
MD5 b33fe159e93ed5cf3d3837f363aee8f3
SHA1 7d3bc500eb3dbf9dec996c392920f55f04c0156d
SHA512 3632972713b3dd5e151ae8d0fbf8e07c66d4ed86416e426a45c1ceb2e4e5b2f75b398e3d2b645d5477a723012336b757292d3609bfb846215516fd3fe051c0b6
SSDEEP 3072:SE1Lq+9xZFrr3azZCf/oYFkTW0ybXPKisZwokmYDkWYkLW0mKRjT:p1LRnrrqzcf/oYFkTnybFsZwokmkkWYW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord18687 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord19786 ord11868 ord15327 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord3970 ord19735 ord12625 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord953 ord15744 ord5406 ord18102 ord17152 ord17303 ord7304 ord4499 ord4490 ord10704 ord11348 ord22060 ord4768 ord12947 ord76 ord12446 ord21320 ord7488 ord8582 ord3891 ord2931

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _CxxThrowException _purecall __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

1024B

Virtual Size

571B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

1024B

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

512B

Virtual Size

385B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

pdoxkey.exe

IMPHASH a4ddbdfb4deab42d48093d90fb4b667d
SHA256 93ea53b79b88a07681a0763f4ba4a04b42c2cfc999731f3dc41e482e48e597a4
MD5 2153d34e5f1b1a5fdb3a9074be35c090
SHA1 05285e60c9e3c21673d791c24e833c3cb7298865
SHA512 a9f9fdb78727a265c43635f0a8f3c44843bbcdced9c5e0b9c448abe28347530c03df2da3bcaf2a808a83a73c6b84c01d7d49f2ff1707727e5074277f5e797d4d
SSDEEP 3072:3er7TKr8mJH/80d/DN1ljw6OIt5I3DVG1/xuQJLA:UTKrXJH/80lDLljw67t5oDVe/xuQJ8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10372

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord19555 ord2242 ord21377 ord10994 ord854 ord8582 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord18687 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord12947 ord15046 ord76 ord14822 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord4499 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord19146 ord4223 ord1615 ord21431 ord18891 ord7792 ord5031 ord21220 ord11868 ord3970 ord19735 ord12625 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord953 ord15744 ord17303 ord7304 ord15771 ord7020 ord4490 ord10704 ord17680 ord22060 ord3891 ord10009

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _purecall _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

512B

Virtual Size

239B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

512B

Virtual Size

74B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

peachkey.exe

IMPHASH 3275b1a6af93b295f57d2bf0144f3849
SHA256 115d126ebd4776bb32496cb8862a74e4f6a350111d0e9c8824d388ed3bd43bf4
MD5 e851cee00906680a4202289da6f0a369
SHA1 9542ac78df0f68a49897a8789cd2ae9cfcd06b41
SHA512 987fe89f230b3501165c80bc6879a9ea56dcf3d2718126f55c0d8234db94f6e8f1490a1674dd4593992ae1b6a2fb4ca95efb14dac3fe9f0fc9631d8000ecf4ef
SSDEEP 12288:zzp1UlvNxFY8YSsha5djkPBEqZXCEaFnw0x/3AaQs1TIfmPORwYADrLwZx6e8b/Y:3pg0SoTyEIw3+DcMk/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord19735 ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord7980 ord12625 ord7488 ord15327 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord10574 ord10236 ord15537 ord20037 ord6202 ord240 ord4937 ord2449 ord2568 ord4291 ord16148 ord20606 ord21724 ord13016 ord19694 ord8448 ord6272 ord16387 ord14146 ord5021 ord15771 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord953 ord8582 ord11533 ord18687 ord5406 ord15744 ord19786 ord4499 ord12947 ord17043 ord11359 ord16512 ord76 ord17303 ord7304 ord4490 ord10704 ord22060 ord12378 ord12446 ord2931 ord21320 ord3891 ord21444

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc _purecall __CxxLongjmpUnwind _setjmp3 _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

448KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

pk.chm

SHA256 edbee44cbc64d495b239dc874a8af962061b5565c21c7b7f26f09b8811ae34b7
MD5 cc31f282fdefc16284d8730d65037674
SHA1 bd92e4694b92499513de917bc6e05f9d0581d7fc
SHA512 f355af74ebffcf0f5d3db3ee08f899f16940d2e348de4c2412ac3f4143f1b56f7da5f50f2132077667fe1c66ea1f2bb2a7214d57bb67523d66dc37742ed6bc4c
SSDEEP 1536:v2AsTES96aVq2HnaINHDF3clIhYzwEC1BGvg8vybNb3iI:e0zIvNH5hGzxCTGo8vyBN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

pk83.dll

IMPHASH c503d15cab7a346063e2655c570d2ef5
SHA256 f0cd465587416fb037fdc73869b345197f9f9ac464bc1c1f463c67cea71d22cc
MD5 d9de7843c16295120a069938ebfc52cd
SHA1 66904708ec34c174bb752469c2e95018dda3ed77
SHA512 0406b27dd75bff991d25f80907d942bd5906f66269917b38ae34024af25f730defc2b1d2ec962a600e506726569639e837e278d0b8870ffc4a591178f56b4059
SSDEEP 98304:ZF7shfdsRA38YWYv/uN8BjVQzb4vzTEfa1Eb1iYTQ9szO4PF5/nuBbgsTgSvXsWh:ZF7shfdsRA38YWYv/uN8BjVQzb4vzTEC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1372990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ReleaseSemaphore SignalObjectAndWait lstrlenA DisableThreadLibraryCalls GetCurrentDirectoryA GetWindowsDirectoryA GlobalFree GetFullPathNameA GlobalMemoryStatus CreateSemaphoreA GlobalAlloc GlobalLock GlobalUnlock ResumeThread SuspendThread TerminateThread TryEnterCriticalSection WideCharToMultiByte MulDiv DuplicateHandle SetUnhandledExceptionFilter GetModuleFileNameA VirtualQuery InterlockedExchangeAdd GetCurrentThread GetCurrentProcess GetProcessTimes GetThreadTimes CreateThread GetExitCodeThread SetThreadPriority FindResourceW SetErrorMode CreateEventA ResetEvent SetEvent SetEndOfFile FormatMessageW LocalFree FindNextFileW GetDriveTypeW GetModuleFileNameW SetFileAttributesW GetFileAttributesExW FindFirstFileW FindClose Sleep GetCurrentThreadId LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection ReleaseMutex WaitForSingleObject CloseHandle CreateMutexA GetVersionExA MultiByteToWideChar TlsSetValue TlsGetValue TlsFree TlsAlloc GetTimeFormatW GetDateFormatW GetNumberFormatA GetLocaleInfoA InterlockedExchange GetLastError GetSystemTime LoadResource SizeofResource LockResource FindResourceA SetLastError GetLocalTime SystemTimeToFileTime LocalAlloc CreateFileA FormatMessageA InterlockedIncrement GetCurrentProcessId SetFileAttributesA GetFileAttributesA GetModuleHandleA FreeLibrary IsBadWritePtr GetProcAddress LoadLibraryA InterlockedDecrement

msvcr71

_onexit __dllonexit ??1type_info@@UAE@XZ __CppXcptFilter _adjust_fdiv _initterm _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ __uncaught_exception _callnewh srand rand strtod strncmp clock rename _findfirst _findnext _findclose remove _chmod _chdrive time _getdrive _getcwd _strnicmp gmtime sprintf wcscoll _wcslwr _wcsupr strtol _strlwr _strupr strstr _wputenv wprintf setlocale ?_set_new_mode@@YAHH@Z ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z _set_purecall_handler ?set_terminate@@YAP6AXXZP6AXXZ@Z abort wcsftime _get_osfhandle _commit fgetpos _lseeki64 fsetpos _vscwprintf _vscprintf iswdigit _vsnwprintf strerror isdigit _wrename _getdrives _wgetcwd _wchdir _wutime _wchmod _wstati64 _wrmdir _wmkdir _wcreat _close _waccess _strcmpi _wremove iswalpha wcscspn wcsspn strcspn strspn towupper tolower isspace iswspace getenv _wstat _wfopen _errno strncpy realloc fwrite _vsnprintf fputs fputc _snprintf _chsize fflush fprintf _iob vfprintf puts fgets free malloc wcstoul strtoul towlower _wmktemp fseek ftell printf wcschr _fpclass _isnan strtok strftime strncat fgetc isalnum isalpha iscntrl isgraph islower ispunct isupper isxdigit _CIfmod floor ceil isprint mblen _CIpow _atoi64 _creat _mktemp _rmdir _chdir _mkdir _ftime _fileno _write _read _access _wgetenv memchr wcscmp _stricmp sscanf toupper mbstowcs ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1exception@@UAE@XZ strchr wcslen memmove exit atoi _stat __CxxLongjmpUnwind _setjmp3 fopen fread fclose _purecall _CxxThrowException localtime _getpid __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

comctl32

ImageList_ReplaceIcon ImageList_Create ImageList_Draw PropertySheetA ImageList_GetIconSize InitCommonControlsEx ImageList_Destroy

user32

GetKeyState SetRectEmpty GetWindowThreadProcessId EmptyClipboard LoadIconA LoadAcceleratorsA MessageBoxA SendMessageA IsWindow GetWindowRect CreateWindowExA LoadStringA RegisterClassExA LoadCursorA UpdateWindow ShowWindow LoadBitmapA OpenClipboard SetClipboardData CreateCursor SetWindowPos UnregisterClassA SetFocus GetDlgItemTextA EnableMenuItem GetSystemMenu SystemParametersInfoA CloseClipboard MoveWindow DialogBoxIndirectParamA FindWindowA EndPaint BeginPaint ClientToScreen GetDesktopWindow PostMessageA SetForegroundWindow SetWindowTextA CheckDlgButton GetDlgItemInt GetParent GetDlgItem ScreenToClient GetWindowTextLengthA GetWindowTextA SetCursor SendDlgItemMessageA GetClassInfoA RegisterClassA DialogBoxParamA SetDlgItemTextA EndDialog CreatePopupMenu CreateMenu DestroyMenu RemoveMenu FillRect OffsetRect TrackPopupMenuEx GetSysColorBrush InflateRect GetSysColor CopyRect DrawEdge GetDC DrawTextA ReleaseDC GetSystemMetrics GetMenuItemCount InsertMenuItemA GetMenuItemInfoA GetWindowLongA PostQuitMessage SetWindowLongA DefWindowProcA GetClientRect SetWindowsHookExA UnhookWindowsHookEx GetActiveWindow CallNextHookEx MessageBeep KillTimer SetTimer SetDlgItemInt EnableWindow RegisterWindowMessageA DispatchMessageA TranslateMessage TranslateAcceleratorA GetMessageA DestroyWindow InvalidateRect SetRect SetMenu

gdi32

GetDeviceCaps DeleteObject GetObjectA DeleteDC BitBlt SelectObject CreateCompatibleDC CreateFontIndirectA SetTextColor SetBkColor PatBlt CreateBitmap SetBkMode GetStockObject CreateSolidBrush GetTextExtentPoint32A

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

RegCreateKeyExW InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegQueryValueExW CryptEncrypt CryptGetHashParam CryptDecrypt CryptCreateHash CryptHashData CryptDeriveKey CryptSetKeyParam CryptDestroyHash CryptAcquireContextA CryptDestroyKey RegFlushKey RegCreateKeyExA RegCloseKey RegOpenKeyExA RegSetValueExA RegQueryValueExA RegQueryInfoKeyA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegEnumKeyExA SetSecurityDescriptorDacl RegSetKeySecurity RegEnumValueW RegEnumKeyExW CryptReleaseContext RegGetKeySecurity

shell32

SHGetSpecialFolderPathA SHGetMalloc ShellExecuteA SHGetPathFromIDListA SHGetSpecialFolderLocation DragAcceptFiles DragFinish DragQueryFileA

ole32

OleUninitialize OleInitialize CoUninitialize CreateILockBytesOnHGlobal CoTaskMemFree StgIsStorageILockBytes StgIsStorageFile StgCreateDocfileOnILockBytes StgCreateDocfile StgOpenStorageOnILockBytes StgOpenStorage CLSIDFromString CoCreateInstance ReleaseStgMedium CoInitialize

oleaut32

GetErrorInfo SafeArrayCreateVector SafeArrayDestroyDescriptor SafeArrayCreate SafeArrayPutElement VariantClear SysAllocString VariantInit SysStringByteLen SysAllocStringByteLen SysFreeString

imagehlp

SymInitialize SymGetSymFromAddr64 SymCleanup SymFunctionTableAccess64 SymGetLineFromAddr64 SymSetOptions SymGetModuleBase64 StackWalk64

ws2_32

ntohl accept connect htons setsockopt bind listen shutdown send recv getsockopt ioctlsocket socket closesocket WSAStartup WSACleanup htonl WSAGetLastError select __WSAFDIsSet ntohs

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

708KB

Virtual Size

704KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

525B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

144KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

344KB

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

projkey.exe

IMPHASH 76eccb796e9cb404daf6d43ba1f6e8c1
SHA256 7065a4df21f53abb0ec39197fae79bc754f54e393859a53bac0656b41e4f21f3
MD5 8203a6c0278d430051637c9a2856ff39
SHA1 0ea4c1a50ef53c683b5508c38c62d605b5a2443c
SHA512 df6175e773e93120e7fd1de7922792d3f59fc187a778df1105e4746efa71507f1daf2708d0885d626ff5784807c5dcd2e12ca7ca5c0d104a82d5c520c4de3548
SSDEEP 768:kVGlbYWfY6ZBVzKkqz6YDEYsYb35UnsPq9+ws2:kfWfY6gkEVTswJUnsPVA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord8582 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord19786 ord6005 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10236 ord10574 ord20037 ord6202 ord2449 ord4937 ord240 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord953 ord15771 ord11971 ord18455 ord10739 ord15744 ord16512 ord4490 ord22060 ord7304 ord17303 ord10704 ord20578 ord15537 ord4768 ord21782 ord17152 ord4499 ord12378 ord12947 ord11533 ord12336 ord21209 ord76 ord7310 ord8377 ord12446 ord21320 ord17195 ord18687 ord3891 ord21105

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _purecall _CxxThrowException wcscmp __CxxFrameHandler ??3@YAXPAX@Z

qbkey.exe

IMPHASH 15226d3308043246a2e6d534563738cb
SHA256 c031fefaae70940dca7079e15aa9db2b3688c5e540414c7802b31c6784bd4008
MD5 4dc0b2698e890aacfdad03d18e564c8f
SHA1 376d4759521b765c06d9800b87f463bbab75fe8f
SHA512 3dd7e64aac61ad01e7be341b6541389ed761598db4aa2b87f35ee8462ef9df358f0c0dcfd7727161fe1011a5f6696435faa8507f1064b0e5f0eee272ccec68dd
SSDEEP 12288:GbAlFU27vWR+0PVE4RGR0SN/WJyr0cLRcboWRVReiRZ3q0Qx91YDHn0klq/MbJ2F:IAlmkYhIRkfMt9SMvWBkqfElDv06x8qN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement SetFileAttributesA GetFileAttributesA GetModuleHandleA GetStartupInfoA

pk83

ord21320 ord11359 ord11080 ord1592 ord12667 ord5825 ord15744 ord11786 ord16406 ord22060 ord8815 ord18687 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord12947 ord1281 ord8773 ord7552 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord4499 ord2568 ord4291 ord16148 ord7304 ord4490 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10704 ord8582 ord5406 ord3482 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord19786 ord17043 ord12446 ord76 ord18921 ord4107 ord11348 ord11533 ord10337 ord17099 ord9525 ord21892 ord6689 ord15044 ord13843 ord12143 ord15331 ord16512 ord6723 ord7020 ord15771 ord7980 ord17044 ord2244 ord17976 ord8666 ord17223 ord19018 ord11683 ord10677 ord10419 ord13121 ord10323 ord14375 ord4768 ord16500 ord7437 ord18838 ord21702 ord12378 ord18525 ord485 ord20009 ord7427 ord1520 ord17838 ord8363 ord5011 ord4310 ord12148 ord9814 ord6584 ord5518 ord854 ord10994 ord21377 ord2242 ord19555 ord14822 ord19146 ord4223 ord1615 ord21431 ord18891 ord7792 ord5031 ord21220 ord11868 ord3970 ord19735 ord12625 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord10236 ord953 ord3891 ord17303

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc _CxxThrowException __CxxLongjmpUnwind _setjmp3 _purecall __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

556KB

Virtual Size

554KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

820B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

qpkey.exe

IMPHASH 89f46820008e334951be9c9b77ff9d8b
SHA256 e0f47a81b7b237c0bac6eb566d9cbab865d32b8a7f73a1b7a89d7909bd556ecd
MD5 1cfa5a8afc2b21ed9b6f435c99294b93
SHA1 d6773e43e246ab1b5ee1bce938ddb39fee839998
SHA512 e2947d72cd85c956c0edbf35fda79ab9a28845d075db01ecc8d1268bbacb787b1d728400c075c644b2067b39da42054f9350573e36fba8a8b32c95e24bc80503
SSDEEP 6144:lE+v4Z2xGQYgNfjruBh4ZtTbV3VyO6k4P8S6sp585elpWi2JPSAAfibW+bQecreT:lE+vA2QQYsfjruBhctTx34O6k/S6sp56
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord1592 ord12667 ord5825 ord15744 ord11786 ord16406 ord22060 ord8815 ord18687 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord12947 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord953 ord11080 ord4291 ord16148 ord7304 ord4490 ord20606 ord21724 ord4499 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord19786 ord7980 ord21320 ord12446 ord8377 ord7310 ord76 ord21209 ord12336 ord11533 ord10337 ord11359 ord12378 ord11971 ord10739 ord18455 ord7020 ord15771 ord21782 ord4107 ord11348 ord10704 ord17303 ord16512 ord10323 ord4768 ord3482 ord6584 ord5518 ord8582 ord854 ord10994 ord21377 ord2242 ord19555 ord14822 ord19146 ord4223 ord1615 ord21431 ord18891 ord7792 ord5031 ord21220 ord11868 ord3970 ord19735 ord12625 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2568 ord2663 ord3891 ord240

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc wcscmp _purecall _CxxThrowException __CxxLongjmpUnwind _setjmp3 __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

256KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

158B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

quickey.exe

IMPHASH 2eba94e9acf8df9d6ed28b3955f38f5a
SHA256 7b84b1ca2c04f5d72ab2b8bd0473f3b8d82933ebc54cf99a7ab676e4359153f4
MD5 a3c6231780eac300ff5048aad603aae7
SHA1 f46dc88110aeea6e55e7388d9d35d18a36f65e6d
SHA512 88d38fab412841c507bd598b54f736b0c48de64f6f7115ccc3523f9cc010ea7f9ee99de6773b922e3ebc3b8331a4f35d01507b5bdf022869d18ce649245ececf
SSDEEP 24576:zqe//gXO4GKtR8m/YLYpnpuX2BTTQIdb90bBjqCknbcAmAMidE:zqe//gXO4GKtR8m/YIuX2b99+knb5mvD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

145912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedExchange InterlockedIncrement GetStartupInfoA GetModuleHandleA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedDecrement

pk83

ord12667 ord5825 ord16406 ord11786 ord18687 ord7224 ord8815 ord17195 ord12483 ord21105 ord16859 ord1478 ord90 ord21444 ord2931 ord76 ord15046 ord16512 ord12378 ord7020 ord15771 ord4499 ord12947 ord17043 ord4768 ord12397 ord13570 ord12143 ord15331 ord11471 ord7437 ord18838 ord21702 ord14146 ord4291 ord6272 ord16387 ord11251 ord10185 ord548 ord21128 ord20153 ord9337 ord4107 ord11348 ord9248 ord7427 ord8287 ord18933 ord14837 ord10323 ord12657 ord2008 ord10695 ord13134 ord966 ord186 ord18835 ord7488 ord15327 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord4881 ord10677 ord19735 ord11080 ord13788 ord15224 ord3560 ord15868 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord19555 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord241 ord16310 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord21377 ord18126 ord854 ord2568 ord16148 ord20606 ord21724 ord19694 ord8448 ord13016 ord13371 ord5021 ord17044 ord6723 ord2189 ord20538 ord9265 ord15180 ord7186 ord2045 ord12587 ord20313 ord8581 ord2926 ord5885 ord11991 ord18295 ord1191 ord6597 ord2479 ord4184 ord20002 ord17702 ord20461 ord16157 ord16346 ord1592 ord13680 ord13023 ord8582 ord19184 ord5272 ord2138 ord9968 ord20511 ord18483 ord18275 ord7452 ord5488 ord19674 ord6947 ord2056 ord16470 ord14321 ord14627 ord4669 ord7225 ord19774 ord16740 ord3482 ord6584 ord5518 ord7980 ord1029 ord13091 ord4490 ord22060 ord7304 ord17303 ord8458 ord9464 ord5406 ord10704 ord13987 ord15744 ord14169 ord3548 ord18379 ord916 ord21844 ord1228 ord9196 ord5371 ord11835 ord21204 ord5159 ord5208 ord8075 ord20989 ord1805 ord17091 ord16312 ord20723 ord9914 ord21368 ord16616 ord424 ord7511 ord17694 ord9359 ord16878 ord1687 ord10419 ord19018 ord15881 ord11683 ord8666 ord17976 ord17223 ord2244 ord6748 ord11359 ord12446 ord21320 ord19786 ord10059 ord3891 ord12625

msvcr71

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit _onexit __dllonexit ??1type_info@@UAE@XZ ?terminate@@YAXXZ ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z __uncaught_exception _callnewh malloc ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ strncmp ?name@type_info@@QBEPBDXZ ??9type_info@@QBEHABV0@@Z ??8type_info@@QBEHABV0@@Z _aligned_malloc _aligned_free _except_handler3 ??0exception@@QAE@XZ memmove ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z toupper __CxxLongjmpUnwind _setjmp3 _CxxThrowException _purecall __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

152KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

600KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_BSS

Size

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

807B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CRT

Size

4KB

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

rarkey.exe

IMPHASH 2e15224f629960f6f93c1404bc8044ac
SHA256 9989b901d068762c528f48655ce4c209ed2cafaf15fb1a85b8b7491631e43d03
MD5 c8a6013d4c846e86820b70295fb4240d
SHA1 02f651f54a7fc02f4389e513ecac7715e0b58764
SHA512 b704f9e80f0bd8791f9ceafd2ab1fdfbe6a7f495466d16a6cd58253f95a6275cbfdfa1266fc8ff6afa1b69779d775e4b1157505321848450309140e5da176698
SSDEEP 6144:wPKQAoZa5pM+622H7zTUr1gYgAr+7R9qXD9UDXXaY4E4svGNUhXxrzt5BDBRtZtW:wV+62259W9UrXaY4E4svMUzzt5BDjI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

128637

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord12625 ord19735 ord15881 ord13788 ord15224 ord3560 ord15868 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord19555 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord1029 ord241 ord16310 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord18454 ord21377 ord18126 ord854 ord2568 ord4291 ord16148 ord7304 ord4490 ord20606 ord21724 ord2769 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord21320 ord10185 ord21128 ord20153 ord548 ord11251 ord18933 ord9914 ord14837 ord8287 ord10704 ord5406 ord17303 ord8075 ord5208 ord5851 ord5159 ord21204 ord11835 ord5371 ord9196 ord1228 ord4881 ord18379 ord3548 ord19786 ord12446 ord8377 ord7310 ord6748 ord20989 ord13987 ord9464 ord8458 ord11359 ord13091 ord7980 ord16740 ord19774 ord7225 ord4669 ord14627 ord14321 ord16470 ord2056 ord6947 ord19674 ord5488 ord7452 ord10695 ord18483 ord20511 ord9968 ord2138 ord5272 ord19184 ord21368 ord1072 ord5988 ord15044 ord6689 ord21892 ord17099 ord17043 ord13843 ord2244 ord17976 ord8666 ord10677 ord11683 ord19018 ord10419 ord12333 ord7984 ord229 ord15465 ord16512 ord8876 ord12538 ord17044 ord10005 ord10170 ord1270 ord8199 ord565 ord14377 ord15663 ord17838 ord9814 ord10323 ord18595 ord2167 ord20395 ord6811 ord149 ord20980 ord21835 ord12044 ord4107 ord4582 ord19798 ord4507 ord11348 ord9636 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord4499 ord15046 ord12947 ord15327 ord7488 ord2931 ord21444 ord7224 ord12483 ord17195 ord21105 ord90 ord1478 ord16859 ord18687 ord8815 ord22060 ord16406 ord11786 ord15744 ord5825 ord12667 ord1592 ord11080 ord3482 ord6584 ord5518 ord916 ord8582 ord3891 ord21844

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh strchr strncpy malloc free memmove _CxxThrowException __CxxLongjmpUnwind _setjmp3 _purecall __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

scdkey.exe

IMPHASH a3ab6f24bfa88376889efbd55eaa34d2
SHA256 09bbac3bf7db1b24fd88d413e9782dc8aedfbd9d0cbe699b9d18becca86e2a77
MD5 d84be7d7b594c2637af3b37b2f053b77
SHA1 bf22b8436bc25457fc622f27a71eb188a970e792
SHA512 7567780f4b2999f2b85f593a952259fb46cbb7e6231962aa59d873a9736d87b3567e2854b9a57e294aaad180b64940f153b37afbb713e99853b38b60c442a10e
SSDEEP 3072:PW9Gt2bFSUEfGkJJN7eHC7Vxix6LY3SA+zMU8fbzsDnBO:O9u2bMUOJNC6Vxix6LY3B+zMU8sDnE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement WideCharToMultiByte GetModuleHandleA GetStartupInfoA

pk83

ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord15744 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord18687 ord2931 ord3970 ord15327 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord19735 ord12625 ord1780 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord953 ord15771 ord7020 ord17303 ord7304 ord4490 ord22060 ord4499 ord10704 ord11348 ord4768 ord12947 ord17043 ord12378 ord4107 ord76 ord12446 ord21320 ord7488 ord8582 ord3891 ord21444

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _purecall _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

512B

Virtual Size

278B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

1024B

Virtual Size

772B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

1024B

Virtual Size

553B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

512B

Virtual Size

138B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

sqlkey.exe

IMPHASH 4b6cff476f8e9b824a9baeed3e36f823
SHA256 9ecd181825da9eae3f468c9500f531d51829d959bbbc98294b077f523b2a4c74
MD5 978837dca5647b4ea46aa089725caaf3
SHA1 229310d27b4695c4a67cacf5b56c6e731d34dd76
SHA512 3058c093b1a81d3fbb331f2e23b34160ca960fcc230fca1d9cf593bf8d8711538760784d6443badbf3911fc9384ba05d8188c461c0094a75e63916289ee87d39
SSDEEP 3072:cRa4aejnEVUhNTdxxG1TK2PuKPyGWak3Fm6801WPgxp57eXM8oi:cRa4pjEVUhN92PjPyGWak3Fm6d1WPgx2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA InterlockedIncrement InterlockedDecrement GetStartupInfoA

user32

PostMessageA

advapi32

QueryServiceStatus OpenSCManagerA CloseServiceHandle OpenServiceA StartServiceA ControlService

pk83

ord11683 ord19018 ord10419 ord13811 ord6103 ord19786 ord14259 ord18687 ord8582 ord13023 ord14377 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord7488 ord15327 ord15046 ord8363 ord20864 ord15594 ord6928 ord13474 ord11471 ord20146 ord10236 ord6409 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord9607 ord449 ord10677 ord5481 ord241 ord9423 ord16310 ord8666 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord3350 ord10994 ord854 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord21220 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord17976 ord2244 ord17044 ord11533 ord4499 ord1029 ord15331 ord8274 ord15744 ord12947 ord17043 ord12378 ord3482 ord5518 ord6584 ord12164 ord13230 ord4180 ord11495 ord1084 ord5406 ord4490 ord22060 ord7304 ord17303 ord10704 ord8377 ord16512 ord11359 ord2008 ord12446 ord7310 ord21320 ord7980 ord953 ord3891 ord14169

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc _purecall _setjmp3 __CxxLongjmpUnwind wcscmp _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

362B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

72KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

142B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

un-kitd.exe.nsis

SHA256 439d5077896b6f029a705c74ec1226a6b3253e202ceebb2921e71e54d222f35a
MD5 85249e216f2531ee0032a91ea5dbddaf
SHA1 23cdb0df1a91f8c35cf92bdb227ea43c6012f3ae
SHA512 bcc3dd88a6910afd809855e15864f6f1f3408636cb82dabdc79d0aed4f3381c96eb5d2c3221456caa3c1b11f5801e258b7d2aaf50d67533675b24fcfe9f51e3c
MD5 SHA1 SHA512

NSIS installer

installer

winkey.exe

IMPHASH be2450b53b74613a98f9d6d41b539f51
SHA256 730d7fe29f04e9525dee2763986693b19fcb98a6722154d6914d7ad4bbd6f013
MD5 a23fee399b37408d07bd56d985fa337c
SHA1 b18c2e0e3e31cfd3f9e18e679ad173a2d4bf9310
SHA512 ff3fad1935d569e9bbbfff346c9b0dea68ca2a860dc881a3f57cff53c149a546d5aef7c90359c2ca8a5dd73fc5b97995e3c6b0428bf28bf01bc75780162f2687
SSDEEP 24576:OAGszX0pd1aI4cSqLu+aX3mPhC5g/JJUWbDAEwq+AkwQWrZFVRQ6Y2n:O/szX0pdgI4cSTMC58JJUWbDAEwq+AdN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

187076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

imagehlp

CheckSumMappedFile

kernel32

GetTimeZoneInformation InterlockedDecrement InterlockedIncrement InterlockedExchange CloseHandle WaitForSingleObject CreateProcessA GetTempPathA LockResource LoadResource SizeofResource FindResourceA GetModuleHandleA GetDriveTypeA GetLogicalDrives DeviceIoControl CreateFileA GetDiskFreeSpaceA SetErrorMode FormatMessageA GetLastError FlushFileBuffers GetProcAddress LoadLibraryA FreeLibrary WriteFile SetFilePointer DefineDosDeviceA EnterCriticalSection LeaveCriticalSection ResetEvent CreateEventA GetSystemTime QueryPerformanceFrequency InitializeCriticalSection DeleteCriticalSection GetStartupInfoA MultiByteToWideChar FindFirstFileA WideCharToMultiByte FindNextFileA FileTimeToSystemTime FileTimeToLocalFileTime FindClose ResumeThread SetThreadPriority Sleep QueryPerformanceCounter ReadFile CreateFileW GetFileSize GlobalFree GlobalAlloc GetFullPathNameA GetLocalTime SetEvent WaitForMultipleObjects

pk83

ord14259 ord1982 ord9088 ord15044 ord6689 ord9525 ord17099 ord13843 ord9248 ord9455 ord16521 ord4507 ord6545 ord16382 ord13784 ord10306 ord13023 ord6584 ord5518 ord1097 ord21107 ord3482 ord13307 ord13680 ord11080 ord1592 ord12667 ord16406 ord8815 ord16859 ord1478 ord90 ord21105 ord1134 ord12483 ord7224 ord21444 ord7488 ord15327 ord953 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord18891 ord21431 ord1615 ord4223 ord19146 ord2242 ord19555 ord10994 ord14822 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord22076 ord9423 ord10337 ord16369 ord9607 ord10809 ord9941 ord7065 ord1029 ord13559 ord20078 ord15180 ord15362 ord20311 ord1547 ord21377 ord3350 ord11685 ord6936 ord10285 ord6110 ord854 ord2568 ord4291 ord241 ord16148 ord20606 ord21724 ord19694 ord8448 ord16310 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord15594 ord7793 ord16219 ord19956 ord5050 ord11471 ord13570 ord11839 ord12397 ord20864 ord20146 ord3766 ord16141 ord14443 ord4402 ord7472 ord10131 ord8377 ord17044 ord12545 ord5906 ord3035 ord13200 ord4527 ord12538 ord7266 ord17043 ord16512 ord11385 ord4107 ord4937 ord17820 ord10236 ord18219 ord12102 ord2931 ord14837 ord18933 ord9640 ord5825 ord7306 ord1900 ord16695 ord15735 ord14424 ord11348 ord21534 ord10231 ord6949 ord15744 ord6543 ord5406 ord4194 ord6782 ord11786 ord12446 ord21320 ord7980 ord4490 ord7304 ord17303 ord10704 ord485 ord18525 ord8582 ord18687 ord17838 ord18731 ord20009 ord6034 ord12947 ord4499 ord10661 ord21580 ord1519 ord6205 ord17409 ord20697 ord2036 ord11896 ord10556 ord11519 ord20719 ord7753 ord9835 ord19032 ord20746 ord11533 ord22060 ord11862 ord19191 ord16184 ord16157 ord7186 ord18784 ord17234 ord18723 ord9242 ord3507 ord20538 ord9265 ord12139 ord12603 ord20137 ord10439 ord18921 ord76 ord2631 ord17237 ord10510 ord19786 ord3891 ord17195

msvcr71

_strupr _creat _stat _access _stricmp ??_V@YAXPAX@Z _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit _onexit __dllonexit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh clock islower isalpha strspn strrchr strchr _splitpath time _endthreadex _beginthreadex qsort toupper wcscmp malloc _ftol ceil fopen fprintf fclose calloc strncmp free wcscpy wcslen wcstombs __CxxLongjmpUnwind _setjmp3 _close remove sprintf ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1exception@@UAE@XZ _CxxThrowException memmove _purecall __CxxFrameHandler ??3@YAXPAX@Z

wpkey.exe

IMPHASH 900931fcda8f2186c3e6e07b87d1dc5e
SHA256 967efb8a8cf8ebfcd68a8e1487fbbebc1c9fc601c80049e3a8ad12186f319d79
MD5 941a2ac9c48fee087d642351f0aea3c7
SHA1 ad05364e54f3bc79801e88e1367e5f5b0c26520d
SHA512 af9e67bb1acbe715c98124cce60fb02335280aef0f7e729be727a2e7e69cbf4f8ab19919cc28840544c21324d05dd15cd3be72d6401d259258a4b57bd20154d8
SSDEEP 24576:9HsnCz21Lxj8hs/wfzWfwqLumE9dfgVOG1Z5yEAh/ElbQyIe9:9HsnCz2Vxj8647iLo9d0RA6lB9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30301

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord10610 ord4881 ord1780 ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord11786 ord16406 ord8815 ord18687 ord16859 ord1478 ord90 ord21105 ord17195 ord12483 ord7224 ord21444 ord2931 ord10704 ord16167 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6809 ord13389 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord12545 ord3367 ord8471 ord5348 ord9640 ord10231 ord12148 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord953 ord15331 ord12143 ord11971 ord18455 ord10739 ord15771 ord11533 ord12336 ord21209 ord7310 ord8377 ord12446 ord21320 ord19786 ord15744 ord7020 ord10337 ord11348 ord8582 ord4499 ord6723 ord12947 ord17043 ord76 ord4490 ord22060 ord7304 ord17303 ord15327 ord5406 ord3891 ord7488

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc toupper islower __CxxLongjmpUnwind _setjmp3 _purecall wcscmp wcslen memmove _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

896KB

Virtual Size

894KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_BSS

Size

Virtual Size

245B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CRT

Size

4KB

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

wprokey.exe

IMPHASH a2c346809bd445ff1b56c9e4e5a24114
SHA256 b1363e0e6bd701450b17a7d16754f72de5473060f1dd7e5120ee179b8d31a6ee
MD5 160dac5a5f104fbe7cb1de9c5619c081
SHA1 3711eacf12f06754fe8a376b62ef02b0042ee158
SHA512 efdfd25fd45e2996d52156f0774cb9f29d16ef124aa0b3666676e4cf2df415260a9103574759642902d07f9d3785c9c8151965fe444079ef4840fecbe662bbf8
SSDEEP 6144:NpT7kajihU40dEl6PIgee80rJFY5Z6WxKQ6DxFbNsfJjhU8akUHEC:NpT7kYihU42EcPIze80rJFYr6WxKQ61j
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12180

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

pk83

ord12625 ord19735 ord3970 ord11868 ord21220 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord14822 ord19555 ord2242 ord21377 ord10994 ord854 ord8582 ord5518 ord6584 ord3482 ord11080 ord1592 ord12667 ord5825 ord15744 ord11786 ord16406 ord8815 ord18687 ord16859 ord1478 ord90 ord21105 ord7980 ord1780 ord7224 ord21444 ord2931 ord15046 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord1029 ord241 ord16310 ord10236 ord10574 ord15537 ord20037 ord6202 ord2449 ord4937 ord240 ord2568 ord4291 ord16148 ord20606 ord21724 ord19694 ord8448 ord6272 ord16387 ord14146 ord13016 ord13371 ord5021 ord4881 ord10610 ord16167 ord20342 ord12666 ord6005 ord409 ord12838 ord20192 ord56 ord17675 ord2663 ord953 ord7488 ord15327 ord15771 ord17152 ord16512 ord11348 ord12378 ord76 ord10323 ord4768 ord12947 ord4499 ord17043 ord11359 ord4490 ord22060 ord7304 ord17303 ord10704 ord12446 ord12483 ord21320 ord3891 ord17195

msvcr71

_controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc __CxxLongjmpUnwind _setjmp3 _purecall _CxxThrowException __CxxFrameHandler ??_V@YAXPAX@Z ??3@YAXPAX@Z

Name

.text

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

717B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

zipkey.exe

IMPHASH 1f1031ed0f70e683901073ecbada99de
SHA256 4c5960884f19a906cb23314321583eb25fb25be2629fc9dcc20e2148ab978f35
MD5 7fc4809115a180080d10ba2cab40ee6e
SHA1 16d132b1e4d4e84a02896901fa5bc203af08930e
SHA512 656c231ea3e44af2298e2c60f7d4592f2e66847f8665dc8b9463ef559c748487ba1d3c5b090bb24610b318d504a195ed2c72fad703bed6afae5b16cefe6e2671
SSDEEP 12288:9LLXlhP1pjgDGBlVzzcI0rZXUlPExEfP1NecGF9wOJepVfxED3zqCCL7RGH3W+bI:9fX7P1pjPBlVzzcI0rZXUlPExEfP1New
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

174189

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement GetModuleHandleA GetStartupInfoA

user32

EndDialog SetWindowLongA GetDlgItemTextA SetDlgItemTextA GetDlgItem DialogBoxParamA ShowWindow EnableWindow

pk83

ord16740 ord7980 ord17044 ord19774 ord16500 ord7225 ord4669 ord14627 ord14321 ord16470 ord2056 ord6947 ord19674 ord5488 ord7452 ord1029 ord5518 ord6584 ord3482 ord8075 ord5208 ord5159 ord21844 ord18379 ord3548 ord131 ord17442 ord2008 ord16512 ord12148 ord16584 ord17312 ord2498 ord11348 ord18275 ord18483 ord20511 ord9968 ord2138 ord5272 ord19184 ord18687 ord8582 ord1592 ord11080 ord12667 ord15744 ord5825 ord16406 ord11786 ord7224 ord8815 ord17195 ord12483 ord21105 ord16859 ord1478 ord90 ord21444 ord2931 ord15046 ord8898 ord2906 ord21835 ord20980 ord149 ord6811 ord12044 ord9248 ord14146 ord4291 ord6272 ord16387 ord7065 ord22076 ord14259 ord12947 ord20606 ord4499 ord16148 ord18933 ord3350 ord240 ord7852 ord4625 ord7266 ord11251 ord10185 ord548 ord21128 ord20153 ord18202 ord11533 ord12169 ord4054 ord19021 ord17838 ord21697 ord11232 ord4582 ord241 ord14837 ord16310 ord20395 ord10005 ord10323 ord4107 ord19798 ord4507 ord9636 ord21220 ord2791 ord7488 ord15327 ord8878 ord2663 ord17675 ord56 ord20192 ord12838 ord409 ord6005 ord12666 ord20342 ord16167 ord4881 ord12625 ord13091 ord15881 ord565 ord15224 ord3560 ord15868 ord11868 ord5031 ord7792 ord18891 ord21431 ord1615 ord4223 ord19146 ord6630 ord9492 ord12450 ord20389 ord10009 ord17680 ord8058 ord8177 ord20608 ord4287 ord6273 ord14075 ord13613 ord19555 ord10236 ord10574 ord15537 ord20037 ord6202 ord17827 ord4937 ord18454 ord21500 ord21377 ord18126 ord854 ord2568 ord21724 ord2769 ord19694 ord8448 ord13016 ord13371 ord5021 ord113 ord2958 ord10299 ord10819 ord10337 ord2496 ord15373 ord9423 ord21877 ord2677 ord9387 ord6711 ord18525 ord20884 ord9866 ord18921 ord12020 ord3035 ord9083 ord9090 ord1543 ord16114 ord6679 ord144 ord3089 ord3291 ord2717 ord10824 ord16248 ord4926 ord1092 ord8363 ord17280 ord18491 ord10782 ord19950 ord6809 ord13389 ord7306 ord12288 ord6409 ord5307 ord12736 ord7481 ord14486 ord5348 ord12012 ord11728 ord3367 ord10330 ord5011 ord21107 ord3766 ord16413 ord7020 ord3116 ord531 ord17385 ord20250 ord2798 ord5562 ord13200 ord1013 ord10231 ord6723 ord9640 ord12545 ord15400 ord2050 ord4772 ord1835 ord20403 ord21204 ord11835 ord5371 ord9196 ord1228 ord916 ord3587 ord20009 ord76 ord12378 ord11511 ord15982 ord4768 ord8458 ord9464 ord13987 ord17099 ord5406 ord14169 ord9914 ord20989 ord21368 ord13843 ord17043 ord9525 ord21892 ord6689 ord15044 ord14406 ord4490 ord22060 ord7304 ord17303 ord10704 ord15479 ord8287 ord6748 ord11359 ord7310 ord8377 ord12446 ord21320 ord19786 ord15454 ord16344 ord10976 ord3405 ord996 ord10059 ord3891 ord13788 ord19735

msvcr71

_controlfp ??_V@YAXPAX@Z __CxxFrameHandler _CxxThrowException _purecall _setjmp3 __CxxLongjmpUnwind strtoul _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit ??1type_info@@UAE@XZ _except_handler3 ?terminate@@YAXXZ ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _callnewh malloc strchr memmove ??3@YAXPAX@Z

Name

.text

Size

188KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CONST

Size

4KB

Virtual Size

678B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT

Size

128KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

xdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_BSS

Size

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

40KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_DATA

Size

4KB

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer