84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9.zip
- SHA256 84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9
Overview
overview
6Static
static
384f2d27362...9.appx
windows7-x64
84f2d27362...9.appx
windows10-2004-x64
ChromeSetup.exe
windows7-x64
6ChromeSetup.exe
windows10-2004-x64
6PsfLauncher32.exe
windows7-x64
1PsfLauncher32.exe
windows10-2004-x64
3PsfLauncher64.exe
windows7-x64
1PsfLauncher64.exe
windows10-2004-x64
1PsfRunDll32.exe
windows7-x64
1PsfRunDll32.exe
windows10-2004-x64
3PsfRunDll64.exe
windows7-x64
1PsfRunDll64.exe
windows10-2004-x64
1PsfRuntime32.dll
windows7-x64
3PsfRuntime32.dll
windows10-2004-x64
3PsfRuntime64.dll
windows7-x64
1PsfRuntime64.dll
windows10-2004-x64
1StartingSc...er.ps1
windows7-x64
3StartingSc...er.ps1
windows10-2004-x64
3VFS/Progra...13.exe
windows7-x64
3VFS/Progra...13.exe
windows10-2004-x64
3VFS/Progra...za.dll
windows7-x64
3VFS/Progra...za.dll
windows10-2004-x64
3VFS/Progra...xa.dll
windows7-x64
3VFS/Progra...xa.dll
windows10-2004-x64
3VFS/Progra...ar.dll
windows7-x64
3VFS/Progra...ar.dll
windows10-2004-x64
3VFS/Progra...64.dll
windows7-x64
1VFS/Progra...64.dll
windows10-2004-x64
1VFS/Progra...ar.dll
windows7-x64
1VFS/Progra...ar.dll
windows10-2004-x64
1VFS/Progra...za.dll
windows7-x64
1VFS/Progra...za.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9.appx
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9.appx
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ChromeSetup.exe
Resource
win7-20241010-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral4
Sample
ChromeSetup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral5
Sample
PsfLauncher32.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
PsfLauncher32.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
PsfLauncher64.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
PsfLauncher64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
PsfRunDll32.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
PsfRunDll32.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
PsfRunDll64.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
PsfRunDll64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
PsfRuntime32.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
PsfRuntime32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
PsfRuntime64.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
PsfRuntime64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
StartingScriptWrapper.ps1
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
StartingScriptWrapper.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
VFS/ProgramFilesX64/13/13.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
VFS/ProgramFilesX64/13/13.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
VFS/ProgramFilesX64/13/7za.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
VFS/ProgramFilesX64/13/7za.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
VFS/ProgramFilesX64/13/7zxa.dll
Resource
win7-20241023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
VFS/ProgramFilesX64/13/7zxa.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
Resource
win7-20241023-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
VFS/ProgramFilesX64/13/arm64/7za.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
VFS/ProgramFilesX64/13/arm64/7za.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9.zip
- Size 9.9MB
- Sample241030-dcj42stmft
- SHA256 84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9
- MD5 dfaace3296fabb7f9652fb36756a4b51
- SHA1 65e87e3efdc905c49198ddb97110f54d0a306a8f
- SHA512 3edd42734a8141e9d7fe27d9cc87f84411cf501b496f4cd83217355e636604936df2c7114463366ce8a316421d0ba43d19d080344b7c5c51d640ab76c1a6050b
- SSDEEP 196608:CLFqy0ANIjC3Lh9KvhE/tjTMLoWMsJQwfwr2NV9lDegE5PTtvNBZXcnCncN:CL/TjLuvhCjTIJhfwr2NnVrWlIH
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/VFS/ProgramFilesX64/13/13.exe unpack001/VFS/ProgramFilesX64/13/7za.dll unpack001/VFS/ProgramFilesX64/13/7zxa.dll unpack001/VFS/ProgramFilesX64/13/Far/7-ZipFar.dll unpack001/VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll unpack001/VFS/ProgramFilesX64/13/x64/7za.dll unpack001/VFS/ProgramFilesX64/13/x64/7za.exe unpack001/VFS/ProgramFilesX64/13/x64/7zxa.dll
File Explorer
-
84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9.zip.appx 9.9MB
-
AppxBlockMap.xml.xml 22KB
-
AppxManifest.xml2KB
-
AppxMetadata/CodeIntegrity.cat11KB
-
AppxSignature.p7x8KB
-
Assets/logo.png.png 1KB
-
ChromeSetup.exe.exe 1.3MB
-
PsfLauncher32.exe.exe 302KB
-
PsfLauncher64.exe.exe 370KB
-
PsfRunDll32.exe.exe 92KB
-
PsfRunDll64.exe.exe 115KB
-
PsfRuntime32.dll.dll 368KB
-
PsfRuntime64.dll.dll 467KB
-
Registry.dat48KB
-
Resources.pri5KB
-
StartingScriptWrapper.ps1.ps1 14KB
-
User.dat20KB
-
VFS/ProgramFilesX64/13/13.exe.exe 826KB
-
VFS/ProgramFilesX64/13/7za.dll.dll 283KB
-
VFS/ProgramFilesX64/13/7zxa.dll.dll 159KB
-
VFS/ProgramFilesX64/13/Far/7-ZipEng.hlf2KB
-
VFS/ProgramFilesX64/13/Far/7-ZipEng.lng3KB
-
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll.dll 273KB
-
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll.dll 458KB
-
VFS/ProgramFilesX64/13/Far/7-ZipRus.hlf2KB
-
VFS/ProgramFilesX64/13/Far/7-ZipRus.lng3KB
-
VFS/ProgramFilesX64/13/Far/7zToFar.ini2KB
-
VFS/ProgramFilesX64/13/Far/far7z.reg2KB
-
VFS/ProgramFilesX64/13/Far/far7z.txt2KB
-
VFS/ProgramFilesX64/13/GoogleChrome2.7z.7z 1.4MB
-
VFS/ProgramFilesX64/13/License.txt5KB
-
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll457KB
-
VFS/ProgramFilesX64/13/arm64/7za.dll434KB
-
VFS/ProgramFilesX64/13/arm64/7za.exe1.1MB
-
VFS/ProgramFilesX64/13/arm64/7zxa.dll281KB
-
VFS/ProgramFilesX64/13/history.txt11KB
-
VFS/ProgramFilesX64/13/readme.txt4KB
-
VFS/ProgramFilesX64/13/x64/7za.dll.dll 402KB
-
VFS/ProgramFilesX64/13/x64/7za.exe.exe 1.3MB
-
VFS/ProgramFilesX64/13/x64/7zxa.dll.dll 211KB
-
VFS/ProgramFilesX64/7z24083.7z.7z 3.0MB
-
VFS/ProgramFilesX64/PsfRunDll64.exe.exe 115KB
-
[Content_Types].xml.xml 1KB
-
config.json363B
-
fedxrtdxt.ps1.ps1 480B
AppxBlockMap.xml
- SHA256 11e77007343d465f3199db1bd3d906ed0cd5bd30193015135141e5575aa5a752
- MD5 9cb347ccc5e91962e22210daed8a13eb
- SHA1 18a02634c49ca0be8e234ed2500c594d3f6d6f8c
- SHA512 baf23ad3844f89c9aebfd8f292260b3020056d6192c67d433c68e8aaf492fbb631dc385f3013f5913c3c35ba31880d7b3a65ba9c1dee14cf9accffd9f504fc1b
- SSDEEP 384:a3zB70EgbU7HZ+SOjcD+qLW7AXf/oVAGhm6:w970vgDZqjcV84oVAM
- MD5 SHA1 SHA512 SSDEEP
AppxManifest.xml
- SHA256 b74929d61fbb34ae9bfbee5e46336025782809dbe273546e249e50ed1b2fdf8d
- MD5 ad6e89d717ce4a333ed645ac34389b58
- SHA1 5746b6918c2dbf49e5af2baf37a41973befd4efb
- SHA512 45e566a63799e9366ead471468b0098012d11a65b87b1e21c0a8550c65d6808650a9e8d6d12d95165221526cae90b464a7cb884e1b7413ebb464380011ba6303
- MD5 SHA1 SHA512
AppxMetadata/CodeIntegrity.cat
- SHA256 285325b453b8a6cb932977b3029ab8de7225f395476bc57ffee72ed74ed8e0dc
- MD5 0b6bad9c02b698aa7027fe06df8d3b31
- SHA1 6cf164941622336f50d0740bb186ce2616a81ecc
- SHA512 c8b0042adaae3b13d28d24007a7efe71ec8b426fdd046b0c2d6cfe0819c36e33c26527735bd0ec273363d2bb9e01212ba3b1aefa2344851248617aaee943d7ec
- SSDEEP 192:qyiCh4FbthNOPFmHdWVEKDfxNq74sURhei3i64m/DKf:qyiCuFbthUAHd2nDZNqdEhCm/+f
- MD5 SHA1 SHA512 SSDEEP
AppxSignature.p7x
- SHA256 4eada24c10ae4d59f065d978d27797028e477b431a3c4d7d0901898890dcda79
- MD5 f148423811b0952cacfade0948c48fda
- SHA1 69acd5f62a5a94a86186988009fe3c8e327924c7
- SHA512 27828d121826458a193cd2850fb54049e7d3fe3abb9df036cd25c32c786c80855e7e8c0f9a2e633b943aa92306f663984c1992e0241bc08991140c84f9163b47
- SSDEEP 192:hthNOPFmHdWVEKDfxNq74Hshei3i64m/ZBWn:hthUAHd2nDZNqnhCm/ZBW
- MD5 SHA1 SHA512 SSDEEP
Assets/logo.png
- SHA256 3fda410beca74ac232fbb20c3df3848c0d833c867563cd6b5120de44ad3e8b13
- MD5 19fc1a72d1446a66b032e23b6d4af313
- SHA1 6e9a75c7b9c42676eb90afd4b22fa89da437ed13
- SHA512 cf20c8621a4529c7e8b8d3ca024019ac3758b4a9499227cb3296191f77d462b9dfbebdd248fe219d9e085912b370e308f722e11cceb22947972fb89a692c3479
- MD5 SHA1 SHA512
ChromeSetup.exe
- IMPHASH 7e2f200a9ecaa7ee1d0f7298f297d727
- SHA256 edb4e47cc754fe16fff2d3882651ea87717cdd64bdadcba93d30852be09ab4f1
- MD5 7f2273135df8865fa28d7d358a2693e0
- SHA1 a2e1257fba939b4273ea57ed2359671eab9dfc3f
- SHA512 e6068297bef7505cc87418af0abe8cea58145d43745c9023c539362133f616ff17bae702b9af89e8236fcbe58b1b78a3d1e45fc5105dfb47fb594cee4a8fa5c0
- SSDEEP 24576:PJvKzcVkyEq9DRho1jFP8ltPP01Ws7+wFPEl9ix4fpUzoQDt+egElxdqFWVCGC:FKzcCyEq9DRho/ctH01Ws74rA4RUBDHo
- MD5 SHA1 SHA512 SSDEEP
Digest
52:24:81:27:04:88:b5:0c:3b:68:1e:3d:69:92:d5:ea:80:eb:f1:88:cc:99:41:26:ea:59:8d:2e:ec:38:9e:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
Chains
Jan 10, 2024
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
Serial Number
0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 2, 2021 - Jul 10, 2024
Subject
CN=Dummy certificate
Serial Number
01
Issuer
CN=Unknown issuer
Key Usages
KeyUsageCertSign
Ext Key Usages
Timespan
Jan 1, 2013 - Apr 1, 2013
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
21364
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
TEST_mi_exe_stub.pdb
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
OutputDebugStringW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadFile
CreateFileW
CloseHandle
WriteConsoleW
DecodePointer
GetExitCodeProcess
CreateProcessW
WaitForSingleObject
SetFilePointer
VirtualQuery
CreateDirectoryW
SizeofResource
RemoveDirectoryW
GetEnvironmentVariableW
GetTempPathW
FormatMessageW
GetFileAttributesExW
LockResource
DeleteFileW
FindResourceExW
LoadResource
FindResourceW
HeapDestroy
LocalFree
VerSetConditionMask
CopyFileW
VerifyVersionInfoW
GetTempFileNameW
lstrcmpiW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
shlwapi
PathAppendW
PathCanonicalizeW
PathQuoteSpacesW
ole32
CoUninitialize
CoInitializeEx
shell32
ord680
SHGetFolderPathW
user32
MessageBoxW
CharLowerBuffW
Name
.text
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=29395,
count=144, id=261, version=29395,
count=20, id=260, version=29395,
count=17, id=260, version=27316,
count=18, id=259, version=27316,
count=45, id=261, version=27316,
count=6, id=265, version=27508,
count=13, id=257, version=29395,
count=118, id=1, productName=Unmarked objects,
count=1, id=255, productName=VS2019 v16.0.0 build 27508, version=27508,
count=55, id=151,
count=1, id=258, productName=VS2019 v16.0.0 build 27508, version=27508,
PsfLauncher32.exe
- IMPHASH 7b63f97e8f0c360699c20e7c30842630
- SHA256 312bd304860f9865ed4073f5baffde8df9907a1ebfedd2d1d637ab48db3ca004
- MD5 e005414b82df848717581bd260725b02
- SHA1 6ad75f8152617858d463f36cf4b2ce432e0ad4df
- SHA512 be3d06d2049551e2d5acc3232c6d520236747d53dc49e388c6e616d1f7e1f6f7b6338a4e743773f5461589f2325a8a722af023009cc709f076f51e418382b562
- SSDEEP 6144:Z85jcjnYXSFt8NUBtirDpOzF2akGcoRJKCNWcWAOEOrCng:Z85jedFtOdEF2asjnzrag
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
69:d0:13:a7:5c:5d:ae:aa:c3:29:0e:40:43:a3:04:13:6f:c5:dc:11:70:6e:61:98:2b:51:5d:b4:82:d0:23:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
100367
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\1\s\Win32\Release\PsfLauncher32.pdb
kernel32
InitializeProcThreadAttributeList
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
UpdateProcThreadAttribute
OutputDebugStringW
WaitForSingleObjectEx
QueryPerformanceFrequency
OpenSemaphoreW
CloseHandle
DeleteProcThreadAttributeList
HeapAlloc
OutputDebugStringA
GetProcAddress
CreateMutexExW
VerSetConditionMask
GetCurrentPackageFullName
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
VerifyVersionInfoW
DebugBreak
QueryPerformanceCounter
IsDebuggerPresent
GetExitCodeProcess
HeapSize
GetConsoleMode
GetCurrentApplicationUserModelId
ExpandEnvironmentStringsW
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetCurrentPackageFamilyName
GetModuleFileNameA
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
LocalFree
FormatMessageA
GetStringTypeW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
WriteConsoleW
user32
WaitForInputIdle
MessageBoxExW
advapi32
RegDeleteKeyExW
EventWriteTransfer
EventRegister
RegCreateKeyExW
EventSetInformation
EventUnregister
RegQueryValueExW
RegCloseKey
shell32
ShellExecuteExW
SHGetKnownFolderPath
ole32
CoTaskMemFree
CoInitializeEx
psfruntime32
_PSFQueryAppMonitorConfig@0
_PSFQueryConfigRoot@0
_PSFQueryCurrentAppLaunchConfig@4
_PSFReportError@4
_PSFQueryPackageRootPath@0
_PSFQueryStartScriptInfo@0
_PSFQueryEndScriptInfo@0
_PSFQueryExeConfig@4
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=164, id=261, version=30795,
count=22, id=260, version=30795,
count=18, id=260, version=30034,
count=22, id=259, version=30034,
count=83, id=261, version=30034,
count=2, id=257, version=30152,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=191, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfLauncher64.exe
- IMPHASH 8e9b7caff9376bbdc8b416a414b64656
- SHA256 338fc84d0b309a726bae061ae7ef727884fd43a71aff70900dbce27de07791ea
- MD5 bfcb4275530e99a5e3fca4614a645fb5
- SHA1 622421f44db52d39947e8229f7fa44a98339957f
- SHA512 21cab7c56f53305038fa5603720853a38aeddf0dde2e02c9f1d0e83d6dbf9983f755b11a00d487bb8356b0ab69cf9e953a9786cd89e2180b7d428e038271c41b
- SSDEEP 6144:thxzPfoMtkmiZqfrnZSG85YhDFohEUMaWT4I+wKn:tnzPLtbWqDUsNFoOaGKn
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2a:cd:2b:db:ff:a7:68:4f:c2:5f:f0:a2:a0:60:28:15:f6:47:23:6c:9f:05:81:18:52:9c:1e:da:d3:52:e0:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
109980
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\x64\Release\PsfLauncher64.pdb
kernel32
InitializeProcThreadAttributeList
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
UpdateProcThreadAttribute
OutputDebugStringW
WaitForSingleObjectEx
QueryPerformanceFrequency
OpenSemaphoreW
CloseHandle
DeleteProcThreadAttributeList
HeapAlloc
OutputDebugStringA
GetProcAddress
CreateMutexExW
VerSetConditionMask
GetCurrentPackageFullName
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
VerifyVersionInfoW
DebugBreak
QueryPerformanceCounter
IsDebuggerPresent
GetExitCodeProcess
WriteConsoleW
HeapSize
GetCurrentApplicationUserModelId
ExpandEnvironmentStringsW
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetCurrentPackageFamilyName
GetModuleFileNameA
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
LocalFree
FormatMessageA
GetStringTypeW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
user32
WaitForInputIdle
MessageBoxExW
advapi32
RegDeleteKeyExW
EventWriteTransfer
EventRegister
RegCreateKeyExW
EventSetInformation
EventUnregister
RegQueryValueExW
RegCloseKey
shell32
ShellExecuteExW
SHGetKnownFolderPath
ole32
CoTaskMemFree
CoInitializeEx
psfruntime64
PSFQueryAppMonitorConfig
PSFQueryConfigRoot
PSFQueryCurrentAppLaunchConfig
PSFReportError
PSFQueryPackageRootPath
PSFQueryStartScriptInfo
PSFQueryEndScriptInfo
PSFQueryExeConfig
Name
.text
Size
242KB
Virtual Size
242KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=164, id=261, version=30795,
count=18, id=260, version=30795,
count=17, id=260, version=30034,
count=10, id=259, version=30034,
count=85, id=261, version=30034,
count=2, id=257, version=30152,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=196, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfRunDll32.exe
- IMPHASH b1a931f51b30b56b60ecdb5d25bf3458
- SHA256 324f1db0dbe4a6577425d0c3dd72d4681e5000cca9d17cc62a2af0fcce12eca2
- MD5 96376177175a1b23a95c6498e9ffb2b5
- SHA1 f9d41e74bf714ed8ba60eac4f99060a5d5f92b26
- SHA512 f792432ac0c675548849ea238934ea84eadc44cd94eb9e2e7859267e20ea18a52a9d562602d96f61c5080e0fa94caa4ef6a41e49bafb670b7dd29e35490b48df
- SSDEEP 1536:IU5eCS6ZrIb3BIh7iCH+E+MteSQ40X/qchNXQDGdl0S6gsWRUchcdesCkwcmSZ0l:/eCh23BIhWCMSQ40XCMNl0F6kesCkwcu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
27:7e:36:6a:87:38:f0:2d:f9:50:ec:7d:2e:ce:46:5c:7b:f6:e0:42:cf:ba:4c:97:d2:a9:53:57:4a:67:a3:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
4873
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\1\s\Win32\Release\PsfRunDll32.pdb
kernel32
GetLastError
LoadLibraryA
GetProcAddress
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=142, id=261, version=30795,
count=20, id=260, version=30795,
count=38, id=261, version=30034,
count=17, id=260, version=30034,
count=20, id=259, version=30034,
count=3, id=257, version=30795,
count=82, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfRunDll64.exe
- IMPHASH 0e5c9a29fdcee2791341cd303678be64
- SHA256 b37f6780adc7c7534ab474c1a9b8a5fbc1a8e9df105be9be7a9e13d96385dbe4
- MD5 8466f69926a22670dcf6515a4fc3c054
- SHA1 fd7a2d377cce9545fff272905af7016bd512aefc
- SHA512 5be11238923613169a2627b01db76a09b83e8215dd1872f8e96d8f646171bd9e365fa653da221671fd46258f661794b846ed09aa4369b5d55b3ac27f0b96b0e7
- SSDEEP 3072:poN2YAE6yqki92M43MBaxRjn+ryYA/M5sfhew:pgAE6yq0MBBijDM5sfd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cb:df:4d:bb:88:21:a0:92:0e:ed:70:53:11:a3:0f:3a:6c:39:80:c1:ce:0d:af:38:4e:b7:e3:f9:e3:b8:97:cd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
5000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\x64\Release\PsfRunDll64.pdb
kernel32
GetLastError
LoadLibraryA
GetProcAddress
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=39, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=30795,
count=90, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfRuntime32.dll
- IMPHASH f229992937d1d790b50a1cb368509a49
- SHA256 11d6916d6066e481f5d19bb503f654dcf9cac80aef818c2b52a2a1f0ca2efd5a
- MD5 a9f0eeb621dd5883258113cc4b490929
- SHA1 3c84cdde573eb0f94865f749d9095940cdef409e
- SHA512 336709007cb4723227f47ff153c99630209995315c8ecbbbe1ca24a48a133ed74ad6e557a123886dbb9a2022c752c67ef7c26524e6a59e8f0e125753a264c2fd
- SSDEEP 6144:gkIVNQKH9HisvT9/taRJ9AONndrKV1UaMCk7KxAOOCyXjmw:gkIVDvT9/t6nAuEMjOxICQjmw
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
89:87:ff:46:cb:36:89:89:f5:08:c5:c9:86:65:9d:76:b5:64:22:07:4f:0f:05:e1:8a:e4:9d:b7:ac:77:5f:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
135680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\Win32\Release\PsfRuntime32.pdb
kernel32
GetFinalPathNameByHandleW
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
GetCurrentPackagePath
MultiByteToWideChar
GetLastError
OutputDebugStringW
CloseHandle
HeapAlloc
GetCurrentPackageFamilyName
GetProcAddress
GetCurrentPackageFullName
GetProcessHeap
GetModuleHandleW
OutputDebugStringA
DebugBreak
LoadLibraryExW
IsDebuggerPresent
SetLastError
TerminateProcess
GetFileAttributesW
ResumeThread
GetFileAttributesA
CreateProcessW
QueryFullProcessImageNameW
CreateProcessA
GetCurrentThread
LoadLibraryW
FreeLibrary
HeapSize
GetConsoleOutputCP
GetCurrentApplicationUserModelId
GetModuleHandleExW
HeapFree
WideCharToMultiByte
WriteFile
FlushFileBuffers
SetStdHandle
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
SuspendThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
WriteProcessMemory
GetEnvironmentVariableW
WaitForSingleObject
OpenProcess
VirtualAllocEx
ExitProcess
ReadProcessMemory
IsWow64Process
GetExitCodeProcess
LocalFree
FormatMessageA
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
CompareStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapReAlloc
GetStdHandle
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
user32
MessageBoxW
advapi32
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
?PSFQueryPackageFamilyName@@YGPB_WXZ
DetourFinishHelperProcess
_PSFQueryAppLaunchConfig@8
_PSFQueryAppMonitorConfig@0
_PSFQueryApplicationId@0
_PSFQueryApplicationUserModelId@0
_PSFQueryConfig@8
_PSFQueryConfigRoot@0
_PSFQueryCurrentAppLaunchConfig@4
_PSFQueryCurrentExeConfig@0
_PSFQueryDllConfig@4
_PSFQueryEndScriptInfo@0
_PSFQueryExeConfig@4
_PSFQueryFinalPackageRootPath@0
_PSFQueryPackageFullName@0
_PSFQueryPackageRootPath@0
_PSFQueryStartScriptInfo@0
_PSFRegister@8
_PSFReportError@4
_PSFUnregister@8
Name
.text
Size
254KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
psf
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=170, id=261, version=30795,
count=22, id=260, version=30795,
count=15, id=260, version=30034,
count=24, id=259, version=30034,
count=70, id=261, version=30034,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=154, id=1, productName=Unmarked objects,
count=7, id=265, version=30152,
count=1, id=256, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfRuntime64.dll
- IMPHASH de350c6095b02fd305afdbe337b14afd
- SHA256 495b13461b13c3ce1c766d9899b860add4dfcd9e6b2dc5815389aed6e26cda0e
- MD5 61863b4c1aeefe10d69f54c03d373fd5
- SHA1 4b448f7b4358945b3e9d744d97d6b7c860e5c5b8
- SHA512 f97b69a5567e477ca67ad7f41933b00a57f74bb4f69c01161c17735b8bb35590cf06aff0fafe8308104e9385a0eb808d8735be9a744c8d2d100c9a9ea5f842a8
- SSDEEP 12288:ybYu1g7I2hxD54yFTuWwp6wYcoDvbAfE63U4:qg7I2hZDFTuW/wx+kHU4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d2:15:c1:18:dd:d2:e4:0f:e9:3c:98:fe:7d:bd:b3:e7:65:c6:9c:82:be:d6:03:16:20:98:4d:f6:56:3a:d1:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
160092
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\x64\Release\PsfRuntime64.pdb
kernel32
GetFinalPathNameByHandleW
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
GetCurrentPackagePath
MultiByteToWideChar
GetLastError
OutputDebugStringW
CloseHandle
HeapAlloc
GetCurrentPackageFamilyName
GetProcAddress
GetCurrentPackageFullName
GetProcessHeap
GetModuleHandleW
OutputDebugStringA
DebugBreak
LoadLibraryExW
IsDebuggerPresent
SetLastError
TerminateProcess
GetFileAttributesW
ResumeThread
GetFileAttributesA
CreateProcessW
QueryFullProcessImageNameW
CreateProcessA
GetCurrentThread
LoadLibraryW
FreeLibrary
WriteConsoleW
HeapSize
GetCurrentApplicationUserModelId
GetModuleHandleExW
HeapFree
WideCharToMultiByte
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
SuspendThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
WriteProcessMemory
GetEnvironmentVariableW
WaitForSingleObject
OpenProcess
VirtualAllocEx
ExitProcess
ReadProcessMemory
IsWow64Process
GetExitCodeProcess
LocalFree
FormatMessageA
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
CompareStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapReAlloc
GetStdHandle
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
MessageBoxW
advapi32
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
?PSFQueryPackageFamilyName@@YAPEB_WXZ
DetourFinishHelperProcess
PSFQueryAppLaunchConfig
PSFQueryAppMonitorConfig
PSFQueryApplicationId
PSFQueryApplicationUserModelId
PSFQueryConfig
PSFQueryConfigRoot
PSFQueryCurrentAppLaunchConfig
PSFQueryCurrentExeConfig
PSFQueryDllConfig
PSFQueryEndScriptInfo
PSFQueryExeConfig
PSFQueryFinalPackageRootPath
PSFQueryPackageFullName
PSFQueryPackageRootPath
PSFQueryStartScriptInfo
PSFRegister
PSFReportError
PSFUnregister
Name
.text
Size
310KB
Virtual Size
309KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
psf
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=170, id=261, version=30795,
count=18, id=260, version=30795,
count=14, id=260, version=30034,
count=10, id=259, version=30034,
count=72, id=261, version=30034,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=163, id=1, productName=Unmarked objects,
count=7, id=265, version=30152,
count=1, id=256, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
Registry.dat
- SHA256 785a7a145d736c326f900da0d760c7537d24a84dc2176b9494800697f7059283
- MD5 e12b8e929ac230dc00ae39d83a1293ef
- SHA1 03f6d7db4edce7fb6be23405d6c150c29b714004
- SHA512 20a3f1bf84f250397380288994f3ccae7de11546b41aeb5bf2f9e26ffc408952c6fc18662811b3160a6f48bd3a2a741ea2a2b7c17caab92af30c6835eb703c6b
- SSDEEP 384:koTvCV/HR1mcK5EUHcKtyT87MlKYJqlXhSIP5tKsCw74lJBaByRd:kV1WEUHrteUK7atKsh74zBaB
- MD5 SHA1 SHA512 SSDEEP
Resources.pri
- SHA256 ae0e328618800983358b154262102ea2e73823108d7f86c62a37dc91377f5df3
- MD5 ce102c4b1736bf61f34e14f0173fee89
- SHA1 d166e454ca33520e0c76efecadac0224b93e60cc
- SHA512 5f3bfa7f4f12047a95b71a44da3f1cd06357d0a06b8257eded0de40fd1e6d650f892a529f6ae9368e4ac5b6f9b5a17213fb5f641500f6a6075d1cf5c4a8c05a3
- SSDEEP 96:WPDIBImIIIFICItiIPIuiImIjiIxIUiIYIpiIS6/37LCOXT4aICInowoq8RI6I64:WP5I7j0Xowoq8NqsOqC
- MD5 SHA1 SHA512 SSDEEP
StartingScriptWrapper.ps1
- SHA256 7778c658411a2f1649ced14cdfe8a92145c1c7fa53b1ce5b14920000fe99bd98
- MD5 da5bf3010154020db9db4cf8832b42ea
- SHA1 15ba3dc3bbcb16a26839862d79b3519e74a5e03a
- SHA512 d70c6df571a069797f5eb1ac9a3e30293914b8f1378714e97ae0b881ee5a833f0944ee7246e2768ed74747637deade85306e837a25b1757a1bc3abb7d6eaa9e2
- SSDEEP 384:wrBzBV4OHcvFcYlu2V8uMcg5apqpBw2qFA5WFQExxR/c/mZ1:KBr4DSYlu2VzMcgwgBLqJQO/ceD
- MD5 SHA1 SHA512 SSDEEP
User.dat
- SHA256 85c647caba0df144a1b40b5e1c78403dba8335e1c86d2ba12974f098d163a3d4
- MD5 20c8f039fe8ec000083b0d0c76247332
- SHA1 fdce32711bd5331adf206f6e4b51f50f65e2aa77
- SHA512 dca9513fd53f621366e731748be50fad417c1d66ec3fdc97a6ac3afa10e12c95479480cb9bcc5c2f490b8df1eebc948d979d2e251d4f9850306aa0459dbf3273
- SSDEEP 192:hio7dThOZy2dOt46y4aL13q9f9XmC9Yqmx/TAapIfkP5tKsCw76rQmlJCWVVkB1Q:4oX+046YJqlgpFP5tKsCw74lJBaByRd
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/13.exe
- IMPHASH 6f18dc28cf1faef40cedf506a5685aac
- SHA256 bf2ec1a2ea0242a24bb9c5b7bcaee3f335edcc384aabd07bbfe93e74888cb26c
- MD5 e58073e04563ee374ac9d33d64292b12
- SHA1 2fce424fe45978693610d0226c73648932cc1005
- SHA512 045d7b4f55aff32f15b0673dde1ba545fa81b4c8036b2a5dea5981ef1a7a103f40617bd5b66997e0658a9c7b51cf3c5978a625261d5e9e7c20670fe6abd81c2c
- SSDEEP 24576:e8VzM+vWJXYXuT7i0k/i0Rt5w4VrpMzLnODs:eAgCWJoBD/pPQis
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
676420
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear
user32
CharPrevExA
CharUpperW
advapi32
OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
realloc
_ftol
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno
kernel32
SetThreadAffinityMask
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
CreateHardLinkW
InterlockedIncrement
GetVersion
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
GetCurrentProcess
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
SetEndOfFile
ResumeThread
Name
.text
Size
701KB
Virtual Size
701KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=157, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=192, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=260, version=33523,
count=4, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=35, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
VFS/ProgramFilesX64/13/7za.dll
- IMPHASH edb01ced967d1545f46e4d8d004d088e
- SHA256 3fc4ade77fa6207c646ca3906bb8c0f21b3472ca8dfcde6635ad6da5ab5491ea
- MD5 ef65428f79e120e5fc10e3eecb843d17
- SHA1 4428930e17bccef34298826756c9af43106c3178
- SHA512 9d312179ff1b7c692252bdfd241d245e8d57b0cae6ce5c8c7755f9f074f8e31c63d93e4fae341f0af8824fc0b6c278bfe3efdb8c27e36f87a4375bd3d27caedb
- SSDEEP 6144:o2ymhthvdTJ65E44h/84s+Eol8p/wReA+H6Y7hby4xPuAM6QJ3yV:olmhthvdTJ65EVg1uETH6uzxmAMLo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
230919
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
realloc
memset
strlen
wcscmp
memcpy
memmove
free
_CxxThrowException
malloc
memcmp
_purecall
__CxxFrameHandler
kernel32
GetTempPathW
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
GetVersion
IsProcessorFeaturePresent
GetModuleHandleW
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
WriteFile
ReadFile
GetLastError
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
SetLastError
GetCurrentDirectoryW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
241KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=100, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=91, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=260, version=33523,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=25, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
VFS/ProgramFilesX64/13/7zxa.dll
- IMPHASH cd3731e16c560eee547e3c651dae4f7f
- SHA256 b20a579d21ec7d3bc3c80c5f0a4d6921b78f6af3b6e285e013f84220e143405c
- MD5 5c4408747f4bb3e3e65669004db8f8ec
- SHA1 7ac6b8a217dca16deb60c7132a0aa3e5a1b8dd9a
- SHA512 a8c6ed02ba46d8f57c756d5dc279ce84b56a44bb5e3130ae475b400d551f055f30209a7cc9fb6d54569750724921077dfa21c5e1e35943deb7de731dfcef8245
- SSDEEP 3072:o/W7sa+jaIQG8eBqcDbOWR3EHmG1xW2AdNw6bvw/9jQm6ibMdGptziybUT:onX8eIcDSq3EHmG1dAdNw6zw/9p6ibeR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
128391
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
msvcrt
__dllonexit
_onexit
_initterm
_adjust_fdiv
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_beginthreadex
memset
strlen
free
malloc
_CxxThrowException
memcpy
memmove
memcmp
_purecall
__CxxFrameHandler
_except_handler3
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
IsProcessorFeaturePresent
GetModuleHandleW
VirtualFree
VirtualAlloc
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GetModuleHandleA
GetProcAddress
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
GetVersion
GetLastError
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
128KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=61, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=72, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=260, version=33523,
count=16, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
VFS/ProgramFilesX64/13/Far/7-ZipEng.hlf
- SHA256 bd47a48183384d5f1d1d4a3ba357abe1464c567c84f8bc75ced56b81c99e1fe4
- MD5 4d6f189cbb89bda3d202e72d3a6460ec
- SHA1 6057d259ffc7fdcb3e64fcb662dfd9022aee16b3
- SHA512 9df3edeeedb41e15fe6f63b60b879b33730fca9fb7017cc8df8ca9c901d289ce203305c74518eb527138295588851696fb9afec3135ba2378f4a9d492eaf0d5d
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/7-ZipEng.lng
- SHA256 02b06a71d9c7442724eeeacf3683d015b3b868b1df098c2ba4667b9a2d0f8a21
- MD5 3162638b475f8674db5ad3c2af15d2ed
- SHA1 813ee34dbf4029f8f8eaf0c74ccef6fd26088435
- SHA512 78d704f8add80161775313dba0815663b7339d7013e081858d0678818cf3832c2be42724f2a869342d01ec417fa9af8e198651aa603a72a65d6a4a0d257f21ce
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll
- IMPHASH ea76c211bceaa0b3e988007ef472c487
- SHA256 8e6d2b5bdfc4c1d3b88643a47aa13ab15005039456a7d4ebb078a42568a341b4
- MD5 d04533fdbb455465721f437a2d849b8b
- SHA1 bd8217249cf01e86b44d2ec17280de79d19dfcfd
- SHA512 2ec1d78b4e3e65db7b2ccea768e7f1964347198af1b276bebf00a91125c2fc2c3649e54f1fc61cb94d3b03fc9091abe3cf220d515e501f4c2fcc7f06a22b70ff
- SSDEEP 6144:pIVsh0MxpsgoXiDlHU5N0CHzx6KyJzE0LMtSlzNhnrgWWgOf71q:vVmiZ05N0CHz85JYvkNh+gOT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
208281
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
VariantCopy
SysFreeString
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocString
VariantClear
user32
CharUpperW
advapi32
RegOpenKeyExW
GetFileSecurityW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
msvcrt
_adjust_fdiv
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
wcsstr
strstr
free
malloc
memmove
strlen
memset
wcscmp
strcmp
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
kernel32
InitializeCriticalSection
GetModuleFileNameW
VirtualFree
VirtualAlloc
GetSystemTimeAsFileTime
FileTimeToDosDateTime
GetCurrentProcess
lstrlenW
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetDriveTypeW
DeviceIoControl
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetStdHandle
GetVersionExW
GetTickCount
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
SetLastError
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
ClosePlugin
Configure
DeleteFiles
ExitFAR
FreeFindData
GetFiles
GetFindData
GetOpenPluginInfo
GetPluginInfo
OpenFilePlugin
OpenPlugin
ProcessKey
PutFiles
SetDirectory
SetStartupInfo
Name
.text
Size
214KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=14, version=7299,
count=3, id=11, version=8047,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=126, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=73, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=260, version=33523,
count=4, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
- IMPHASH de297ca23880e1543f5c5121dfbab235
- SHA256 05c932f7c7391ba29b3dec39a7e273a9b51f1c6bd75b0aa942c08e1fa91dced8
- MD5 f8c737ca365dbbae5e0010e75bd641b3
- SHA1 997b00a5807ffff06298b11e6c5cd427dc8d2402
- SHA512 5f632dc5f85eab78ba7030be0347e497e309c4ebf109fb765368171ad5e56361f797bc742b25b1296240a02ed55eb4c14b76be849149b3b6367a00792fcdc7be
- SSDEEP 12288:SkQxAVquWibWM1ysXvTz4NaGVg/6k+VrKk:lqni6M1yovTz4NaGY6nRK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
324688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocString
SysStringLen
SysAllocStringLen
VariantClear
VariantCopy
SysStringByteLen
SysFreeString
user32
CharUpperW
advapi32
RegDeleteKeyW
GetFileSecurityW
SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
msvcrt
free
malloc
strlen
memset
memmove
strstr
strcmp
memcmp
_CxxThrowException
memcpy
__CxxFrameHandler
wcsstr
__C_specific_handler
__dllonexit
_onexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
wcscmp
kernel32
InitializeCriticalSection
Sleep
FormatMessageW
VirtualFree
VirtualAlloc
GetProcAddress
GetSystemTimeAsFileTime
FileTimeToDosDateTime
GetCurrentProcess
lstrlenW
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetDriveTypeW
DeviceIoControl
SetEndOfFile
WriteFile
ReadFile
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetStdHandle
GetLastError
GetTickCount
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
GetFileSize
SetFilePointer
ClosePlugin
Configure
DeleteFiles
ExitFAR
FreeFindData
GetFiles
GetFindData
GetOpenPluginInfo
GetPluginInfo
OpenFilePlugin
OpenPlugin
ProcessKey
PutFiles
SetDirectory
SetStartupInfo
Name
.text
Size
315KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=125, id=1, productName=Unmarked objects,
count=76, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=260, version=33523,
count=9, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
VFS/ProgramFilesX64/13/Far/7-ZipRus.hlf
- SHA256 5f78f1ad25860ef28fe3b73f915e357035176dc91b7013c554e5f8d1cab1cee0
- MD5 b3c605a5aebda78e12e39fc873470d04
- SHA1 499a7737a36c4436a83fbbd396b3b2c10977282b
- SHA512 a41caf844f4df8eaf4c005f7756d941dfb906903107b5c67d8db499e875eda6417d0a751f9be8879ce134cd2f14fe0099364d5557142762be1922a913ba895b0
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/7-ZipRus.lng
- SHA256 69e005acb0215a3cecf960eb180af0079533b46b8bd5a30e7ca1c4dc23ce5ab8
- MD5 8c389a621e0786a41c8619b02d70b005
- SHA1 71d761f46ac735fe2634fdae830d6b283bc0a481
- SHA512 299f356a2704a096b153b630e2345799c02fde7e246e50af2f30dda7a31750b6066c23288bab58131dffbb3ecef61c43428e6f7701de703145aa34ed46083c21
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/7zToFar.ini
- SHA256 483a1db874153ac9f2a1098a5ac6c05676940f90af4f8e9c903d6fc13848a118
- MD5 a7656301a8349c626452ea76cac9fa33
- SHA1 5f537aa414bcf923ca978eb047a7b99152d9857f
- SHA512 f4892f5f36aee60620307a470f52bde83754b3fc5cc8f7eb93fed93f666ffade2b1c311631c33015037d52c0f107de2bb1fabc6b1c9035f4aa91e116ce265026
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/far7z.reg
- SHA256 cab398fb2e704a8d6eb486ded87b57375414c4eba9df6f05333d041033ab1968
- MD5 6f60a13b4574fcdc675d21054499b85d
- SHA1 9ebafbadeeb4851c4496b59cf28819495a8e7e98
- SHA512 060fec36f161673d0e38dfb717111492ac08d62defd9aa8ff3b369d03038be9352eee4a5c071955ba4762dd546e02a68c779bb98434b529c5b22afbf5cb37a30
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/far7z.txt
- SHA256 b4039132a22acc7f05eb48152ccb01c54c603addb121918996c8356912404008
- MD5 7b2d14f1cd85dcdf098cf909749c48a8
- SHA1 dd96b69f3728d783d4f42522a8a3abea414f3e6b
- SHA512 861c3fdb34a092c02c816d22c5b762169433842444d4f844a21f8288b33c3e378007434daa9c333bcd9718ffaea3c1b6c8d21c31156a3c3622900182a9ace51e
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/GoogleChrome2.7z
- SHA256 3ec04b5c60939209c5d19dd525e53425aef8803d242d9ad63346445ebe09398c
- MD5 99732fb703c4d1e51ddabde2c96975e8
- SHA1 4fbff9403124dc7f5a5c1ae6252c9ffacdb1df72
- SHA512 09bd5f55b25b243d695a4f91f65bd9559f27d122d5da180312d38e83d983d743f8db2a7883aa3550f2efbad7b71510ce87393c89ee0d04c854a957788f96e10d
- SSDEEP 24576:sPkEzUSYY7iMv1BKENeII6Jz3/A1PIhus8SWQZSGzDQlEpHPCEZD8Bz7zTVw/80C:36Hti7nII6N/v4QZSGzDQlul98Bz7/VP
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/License.txt
- SHA256 d34a018bd862e4eb96d5995a06b7d922b32f37f3006a647b488e07dfbca18895
- MD5 8cd6549be1b079383db37b8c1f0809bc
- SHA1 0715015ea6349d09fe7aeccb27ea6add108588ed
- SHA512 3e288bef120982f6baea004340efebeb772d4846663efb81d56a921fd09296bd501b4ad20d82d4544c7ebb94683e2fbbee9f7330fce28bf4bd27a8756a5c07bd
- SSDEEP 96:W1hu+xLgOrLJIJzDJu3S3zVSZOrLJIJzAu3S3zVSX:ShuoLgOrNcXJu3S3JSZOrNccu3S3JSX
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll
- SHA256 6ad01b9d823c3fa3c623483e302d04568e35230091aa8af7750715b9739ce3ca
- MD5 75e8535d87e708b53f20d0bb4707129f
- SHA1 72ef3279ec34e404eb1b9db21cc1139d8b547eb0
- SHA512 8d5c865668e17ef129e274487eadc375325c7d8e8685108a1752f95f6526253a8ab000af8815b567358542b9326a44fa966bf9d8bc22e095f2dc770dbbca8cd4
- SSDEEP 6144:Esmzrvdw2gRlFmdT/oJ8A244PZ35wDDXjvfgNsNTeekilpi4lPbuOF4YSmCB7BLj:Oxgd+T/68AJeKANsZnaRnT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
VFS/ProgramFilesX64/13/arm64/7za.dll
- SHA256 49e0503b316076b9e0c90c9e3a0c475ef5d9b4376d33d702e0469029a0008e88
- MD5 ae6a4f422e16e45b5dd0ab6da1a82d8e
- SHA1 3fe04a626232b0c3de6770f8e2c600aeb4c626e8
- SHA512 940fe46e357ba3601998e4639a30c8df49d6ea92562afda65decd13f7c3d9b3a72c9d89cf1246d9a1bd97e5b8a7197cb789ce752f5dbbe0c1586bc0b2549b120
- SSDEEP 6144:QxU19008UrXRzK2xELbGQscTe8xRuKX/hyTSfUp1sL5T0:F19Z8UrX+Lb6/8r+SM7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
VFS/ProgramFilesX64/13/arm64/7za.exe
- SHA256 e94aef071141c4178fac4ccc584a12ef6301ea0d8cabe7200c2234646baaecbb
- MD5 8f456c574478339fb77ad580b50998ad
- SHA1 6c1edb83a34319090b40abbcf0fc208f80c99099
- SHA512 ef0a37e9633bb71fc31fd61c9e0fe1f12284aee9b4794ac314271424c522fd1b25acef40ffa099802a2ff31068770552e8396e5a3d08029bae1dfd271076bdd2
- SSDEEP 12288:/7THLZP31Bu7Vu/oviZcx+dQS4BTNBbpWf95n21gxEJApu6JUVKIHbw0LNG/VUNb:TLLp3ruR0J2Tza9wgxEJBc5Izcq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
VFS/ProgramFilesX64/13/arm64/7zxa.dll
- SHA256 a81e4ee586e31a3ecab3ccf0e41b41d56cb1686fdd38469aac08d9421d82bfd1
- MD5 afbf2157c80490945745f6367abb5528
- SHA1 813a03edd5fe1d28d57fd86d0e7ef00b3ae6858e
- SHA512 7e065199bec9111de62dba34d0e36ded2e9a339fe957c3cbc0c7e278544b6427f3c0644c9bd3d538fb41e8e34058058f6d9a96c53b66f6dc1532af6b37096ecd
- SSDEEP 3072:Vfe0Q+QHyx4nDoA6gD0tmhdSe5DjxHjYgXt37k0m154jCbGQakvQu9Iy:VfCyQErO+mhdSe5PxHcgXt37kWGuXY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
VFS/ProgramFilesX64/13/history.txt
- SHA256 382dfb627c44831e17ab9c5b2680a264afdd43600d074ee27734a12f742717a9
- MD5 adad8b0e892b4be1518445ddfa0fc8dc
- SHA1 bd22582f4a1f56a87cdd9e8c470a20e3d0ff45c8
- SHA512 0c0061c0d7b447dfc129528d6e61189a7fc228ada90e472b9e7bbc577653454078f3449b0d40a12edb9a0ea7ce965285c5988fbc133db1ccd869a0f97511834c
- SSDEEP 96:WfuPWkoSwcf53P1HbhvJE5um6YK5DthWTWQvJAmsD4h/roLF0KDoTf0jZ0kU8AUV:WfuP71wcfDEaYGS3h/roLeKyfz8Aqt
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/readme.txt
- SHA256 e433f4361ab01cb33099b4b721012db1460ec6767276cc6f3629b2d22e9df043
- MD5 c46bfaa3cacec7aa8cf1725c95cecddf
- SHA1 f15b4bd89ad5effa66184c6628f0a5362b6346fc
- SHA512 07cb3f620b8852f54b59579d60062addeb287aa5b7b91d00832f754c74d5e600ba6c152b92b9e6eac410990889bb9695fa60b245f291673e43bbbce0e37b09d3
- SSDEEP 96:HjujFI5LAFUm352xAT6nKXSAEOUrHeVjZlFq+L7R8cvTODoAlSJuKF:HihI50F3352xAGnKXS217RzHJuu
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/x64/7za.dll
- IMPHASH 18bc3b4099180bc67dd68352a0d42b48
- SHA256 583f67ca7b7301f5524fda8405afcb1d38b481556799d80a633978024577ebab
- MD5 967497e77171ac87ce0d9a306a7702b5
- SHA1 48270d2f65c448b362898b972b3775fd859f0fb3
- SHA512 498f3faefdbbb12d3b0170d06b954cffed6cb28889328a85a9394583b22c43908fc0b4debaff717e62e63f9b1e1dd60e73a6acf712e8e0f7b1f1853da20ec116
- SSDEEP 6144:XZQPeCI4eVX65RxgmxcI4l6ghclhu2mzt20yhwBdLPrzDh8JHVsmvUw:pQPN/eVX65bgFI4l6J7hhwBVzDK1N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
295312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysStringLen
VariantClear
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
user32
CharUpperW
advapi32
SystemFunction036
msvcrt
memset
strlen
__CxxFrameHandler
wcscmp
_purecall
memmove
memcpy
free
_CxxThrowException
malloc
memcmp
realloc
__C_specific_handler
_beginthreadex
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
Sleep
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
SetEvent
IsProcessorFeaturePresent
GetLargePageMinimum
VirtualFree
VirtualAlloc
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GlobalMemoryStatusEx
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
WriteFile
ReadFile
GetLastError
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
306KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=97, id=1, productName=Unmarked objects,
count=94, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=260, version=33523,
count=31, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
VFS/ProgramFilesX64/13/x64/7za.exe
- IMPHASH 8122af7382bf626d4b6d8f35f0d8143e
- SHA256 199c64ad672453e98d86ad2c4ea88212eafd6f7c4070dfcb7609ab7a9bd5df11
- MD5 33aaf6621cc4b441c335327c1e02a952
- SHA1 cbf58e9e35ef72c9f271200bf1056410caac9086
- SHA512 66c90ae091be3ad7e3023d4ae14efd1253c44995add3273af8350e52a8f6e825abeeced9c0b4e0d145b547d77b4b921f8f21fef999d554113b88218f51945baa
- SSDEEP 24576:f7xctZMwfCK4tJSTV0Tu5ZlyjzeG/JEt:fKtZM5K4tEByWG/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
953984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysStringLen
VariantClear
VariantCopy
SysAllocString
SysFreeString
SysAllocStringLen
user32
CharUpperW
CharPrevExA
advapi32
OpenProcessToken
SystemFunction036
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
msvcrt
_exit
_c_exit
_XcptFilter
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_beginthreadex
realloc
_purecall
_isatty
memset
strlen
_cexit
wcscmp
strcmp
memmove
fflush
fputc
fputs
_iob
fgetc
free
malloc
memcmp
__CxxFrameHandler
_CxxThrowException
memcpy
exit
__getmainargs
__initenv
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
wcsstr
kernel32
ResumeThread
SetThreadAffinityMask
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
GetVersion
RemoveDirectoryW
WaitForSingleObject
GetLargePageMinimum
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
GetConsoleMode
SetConsoleMode
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
GetProcessTimes
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
SetProcessAffinityMask
OpenEventW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
MoveFileW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
GetLogicalDriveStringsW
DeviceIoControl
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
Name
.text
Size
955KB
Virtual Size
954KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
257KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=156, id=1, productName=Unmarked objects,
count=195, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=260, version=33523,
count=49, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=7, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
VFS/ProgramFilesX64/13/x64/7zxa.dll
- IMPHASH 1353ce6b26348ac6f792fe77a59eff9d
- SHA256 7454cd03cfa197b979cb62360f69143a48a8be86227f06538c546a70a14cde2c
- MD5 5eab00f912824ebdc5aa47ebe863b63e
- SHA1 8e2391668cebcf2aa6c7efecb3911895fbb98aa0
- SHA512 6027a55536eca2724edf1e6687c6251ef9913590ebac44507b58fd9d92074ddba39d38c743cd0ef43d382f6b45d4276b1ec790108503fe6f2a85e1f4884edddb
- SSDEEP 3072:LftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PW:LtViwgLtun+soC1vx2Hr0/NG1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysFreeString
SysAllocStringByteLen
SysStringLen
VariantClear
SysAllocStringLen
msvcrt
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_beginthreadex
_purecall
memset
strlen
_initterm
malloc
__CxxFrameHandler
_CxxThrowException
memmove
memcpy
memcmp
free
_onexit
kernel32
GetProcessAffinityMask
GetCurrentProcess
GetSystemInfo
GlobalMemoryStatusEx
Sleep
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
IsProcessorFeaturePresent
GetLargePageMinimum
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
156KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=9, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=58, id=1, productName=Unmarked objects,
count=75, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=260, version=33523,
count=22, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=4, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
VFS/ProgramFilesX64/7z24083.7z
- SHA256 aa104bbb487554ffde6eaa9fe27be764f59b27404b15fbe45f3ccb5e0dcffeba
- MD5 a10bbf6b0687ceeee2cc9782b79855bf
- SHA1 9109900fe3d58da5d98cb9eff24e8eebfda5f6e5
- SHA512 2f799610c05014345ee4c0648324201827d9e717754be7068e84c67fad2102097291c4a65b5490afcd148f1a8cdb77f6d6bbe5904c67bf790ece4f086d6757ee
- SSDEEP 49152:xuG7BkaEwXVqUjcFnmkjPuU6XBSRvCAiL/akyWgr6NjhrqFxbLbfTjfPEMT0Qj4X:kGLqP6R4S7ajWgr6nrCbLbfTjTQO/pji
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/PsfRunDll64.exe
- IMPHASH 0e5c9a29fdcee2791341cd303678be64
- SHA256 b37f6780adc7c7534ab474c1a9b8a5fbc1a8e9df105be9be7a9e13d96385dbe4
- MD5 8466f69926a22670dcf6515a4fc3c054
- SHA1 fd7a2d377cce9545fff272905af7016bd512aefc
- SHA512 5be11238923613169a2627b01db76a09b83e8215dd1872f8e96d8f646171bd9e365fa653da221671fd46258f661794b846ed09aa4369b5d55b3ac27f0b96b0e7
- SSDEEP 3072:poN2YAE6yqki92M43MBaxRjn+ryYA/M5sfhew:pgAE6yq0MBBijDM5sfd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cb:df:4d:bb:88:21:a0:92:0e:ed:70:53:11:a3:0f:3a:6c:39:80:c1:ce:0d:af:38:4e:b7:e3:f9:e3:b8:97:cd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
5000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\x64\Release\PsfRunDll64.pdb
kernel32
GetLastError
LoadLibraryA
GetProcAddress
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=39, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=30795,
count=90, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
[Content_Types].xml
- SHA256 139c0b772db4e25e0f78cbb23ad361ed177fa2aa4db98bc034edec7cbbc27e06
- MD5 70111c27f9e56191c52aec0b9f1bad19
- SHA1 ca7e0a0d30443e77a0f87fd7622d0bbe66917e31
- SHA512 671ca096d29f6d1ce8a35104aa4076983d7ae1f0cfd9a8bd55b1225b7ed2309e604f058260c1328b5839f61e57eb86b84adeda91f24f1f48ecf57358d71a5fad
- MD5 SHA1 SHA512
config.json
- SHA256 882584887f522b860c6f38aa6b46a2504a7e5179618291a7fda2d409711d4998
- MD5 09cf64c0f6b1ce234a337e9b1998ec8e
- SHA1 76f81022de89fef6f6d81fcccbc532f5e08d674a
- SHA512 ea487888b3c8ca0626fa2602bf9499d322825e3e4ca03097562846488c3da3078c16f87e3255e10fe2c3841e91282256bd1f256a8265720f4c415005b704af69
- MD5 SHA1 SHA512
fedxrtdxt.ps1
- SHA256 11464f7ac40e3e5f771dfe19aee3b3d21cf526a11429038ba9de4c9d7e4bb42a
- MD5 3e390f3b3ca7d3716775f832c93fb1b1
- SHA1 5cc8837f0f87f71c5551c009a69fa12daf3254d4
- SHA512 8a71a94cb17699100bba67478e5ab0fa14f93b68d0efdcbbf1a35cb5a1d20d05a36c63b0a8be559645a084aee2109a2c77eaa7e6ecd89a99ffaf670100d56c30
- MD5 SHA1 SHA512