edkdpu.zip
- SHA256 f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f
Overview
overview
9Static
static
9tox tweaki...or.exe
windows11-21h2-x64
1tox tweaki...or.exe
windows11-21h2-x64
1tox tweaki...CK.exe
windows11-21h2-x64
9tox tweaki...ew.exe
windows11-21h2-x64
6tox tweaki...up.exe
windows11-21h2-x64
1tox tweaki...8.appx
windows11-21h2-x64
1Microsoft.UI.Xaml.dll
windows11-21h2-x64
1Microsoft.UI.Xaml.dll
windows11-21h2-x64
1tox tweaki...up.exe
windows11-21h2-x64
8tox tweaki...LG.exe
windows11-21h2-x64
1tox tweaki...el.exe
windows11-21h2-x64
1tox tweaki...un.exe
windows11-21h2-x64
3Export.bat
windows11-21h2-x64
1Import.bat
windows11-21h2-x64
1SCEWIN_64.exe
windows11-21h2-x64
1amifldrv64.sys
windows11-21h2-x64
1amigendrv64.sys
windows11-21h2-x64
1tox tweaki...64.exe
windows11-21h2-x64
1tox tweaki...CL.exe
windows11-21h2-x64
1tox tweaki...64.exe
windows11-21h2-x64
7tox tweaki...64.sys
windows11-21h2-x64
1tox tweaki...64.sys
windows11-21h2-x64
1tox tweaki...vc.exe
windows11-21h2-x64
1CRU/CRU.exe
windows11-21h2-x64
3CRU/reset-all.exe
windows11-21h2-x64
3CRU/restart.exe
windows11-21h2-x64
5CRU/restart64.exe
windows11-21h2-x64
5tox tweaki...on.exe
windows11-21h2-x64
1Export.bat
windows11-21h2-x64
3tox tweaki...ll.exe
windows11-21h2-x64
7tox tweaki...xp.exe
windows11-21h2-x64
8tox tweaki...tr.exe
windows11-21h2-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
tox tweaking/Emu/KeyAuthEmulator.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
tox tweaking/Emu/KeyAuthEmulator.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
tox tweaking/ToX Premium UtilityCRACK.exe
Resource
win11-20241007-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
tox tweaking/niggers/DevManView.exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
tox tweaking/niggers/DeviceCleanup.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
tox tweaking/niggers/Microsoft-uiXAML2.8.appx
Resource
win11-20241023-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
Microsoft.UI.Xaml.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Microsoft.UI.Xaml.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
tox tweaking/niggers/MicrosoftEdgeSetup.exe
Resource
win11-20241007-en
windows11-21h2-x64
28 signatures
150 seconds
Behavioral task
behavioral10
Sample
tox tweaking/niggers/NSudoLG.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
tox tweaking/niggers/NVIDIA Control Panel.exe
Resource
win11-20241007-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
tox tweaking/niggers/PowerRun.exe
Resource
win11-20241007-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
Export.bat
Resource
win11-20241007-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Import.bat
Resource
win11-20241007-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
SCEWIN_64.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
amifldrv64.sys
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
amigendrv64.sys
Resource
win11-20241023-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
tox tweaking/niggers/SCEWIN_64.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
tox tweaking/niggers/SetACL.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
tox tweaking/niggers/VC_redist.x64.exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
tox tweaking/niggers/amifldrv64.sys
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
tox tweaking/niggers/amigendrv64.sys
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
tox tweaking/niggers/bfsvc.exe
Resource
win11-20241023-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
CRU/CRU.exe
Resource
win11-20241007-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
CRU/reset-all.exe
Resource
win11-20241007-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
CRU/restart.exe
Resource
win11-20241007-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
CRU/restart64.exe
Resource
win11-20241007-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
tox tweaking/niggers/devcon.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Export.bat
Resource
win11-20241007-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
tox tweaking/niggers/openshell.exe
Resource
win11-20241007-en
windows11-21h2-x64
22 signatures
150 seconds
Behavioral task
behavioral31
Sample
tox tweaking/niggers/procexp.exe
Resource
win11-20241007-en
windows11-21h2-x64
15 signatures
150 seconds
Behavioral task
behavioral32
Sample
tox tweaking/niggers/str.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target edkdpu.zip
- Size 77.7MB
- Sample241108-sblntavank
- SHA256 f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f
- MD5 4b83e98030b4931166fb6be77773bce8
- SHA1 11d6e04430abe5e4143845fcf0ad0f86b87fc74d
- SHA512 37e2b382e3f906d8b9a7fbeee6511a20e6186770f8454c48f9f374f9b7eddd1467634d59a39605fe79c3f3e854068f31c0ceee79bac22ffb18011344519f7166
- SSDEEP 1572864:e/RuquMtjMd/wG3F+Z+NQ2RdnBW0vW67scv2TmCYh+vzFtnDdX5vFoQkBBr:eE3d/H3FTpnnBpvW67smNDh+LdXT+nr
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/tox tweaking/niggers/DevManView.exe Nirsoft - Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/tox tweaking/Emu/KeyAuthEmulator.dll unpack001/tox tweaking/Emu/KeyAuthEmulator.exe unpack001/tox tweaking/ToX Premium UtilityCRACK.exe unpack002/Microsoft.UI.Xaml.winmd unpack001/tox tweaking/niggers/NSudoLG.exe unpack001/tox tweaking/niggers/bfsvc.exe unpack004/CRU/CRU.exe unpack004/CRU/reset-all.exe unpack004/CRU/restart.exe unpack004/CRU/restart64.exe unpack001/tox tweaking/niggers/devcon.exe unpack001/tox tweaking/niggers/openshell.exe unpack001/tox tweaking/niggers/str.exe
File Explorer
-
edkdpu.zip.zip 77.7MB
-
tox tweaking/Emu/KeyAuthEmulator.deps.json437B
-
tox tweaking/Emu/KeyAuthEmulator.dll.exe 22KB
-
tox tweaking/Emu/KeyAuthEmulator.exe.exe 135KB
-
tox tweaking/Emu/KeyAuthEmulator.runtimeconfig.json268B
-
tox tweaking/Emu/secret.txt64B
-
tox tweaking/ToX Premium UtilityCRACK.exe.exe 37.8MB
-
tox tweaking/niggers/Basic.nip6KB
-
tox tweaking/niggers/DevManView.exe.exe 163KB
-
tox tweaking/niggers/DeviceCleanup.exe.exe 21KB
-
tox tweaking/niggers/GameUserSettings.ini7KB
-
tox tweaking/niggers/LowGraphics.nip2KB
-
tox tweaking/niggers/MaxFPS.nip17KB
-
tox tweaking/niggers/Microsoft-uiXAML2.8.Appx.appx 4.9MB
-
AppxBlockMap.xml.xml 19KB
-
AppxManifest.xml.xml 18KB
-
AppxMetadata/CodeIntegrity.cat12KB
-
AppxSignature.p7x11KB
-
Microsoft.UI.Xaml.dll.dll 5.9MB
-
Microsoft.UI.Xaml.winmd.dll 279KB
-
Microsoft.UI.Xaml/Assets/NoiseAsset_256x256_PNG.png.png 3KB
-
[Content_Types].xml.xml 742B
-
logo.png.png 1KB
-
resources.pri10.1MB
-
tox tweaking/niggers/MicrosoftEdgeSetup.exe.exe 1.6MB
-
tox tweaking/niggers/NSudoLG.exe.exe 174KB
-
tox tweaking/niggers/NVIDIA Control Panel.exe.exe 13.5MB
-
tox tweaking/niggers/New_Project_1.png.png 724KB
-
tox tweaking/niggers/OpenShell Settings.xml.xml 2KB
-
tox tweaking/niggers/PowerRun.exe.exe 775KB
-
tox tweaking/niggers/SCEWIN.zip.zip 288KB
-
Export.bat529B
-
Import.bat739B
-
SCEWIN_64.exe.exe 668KB
-
amifldrv64.sys.sys 28KB
-
amigendrv64.sys.sys 34KB
-
tox tweaking/niggers/SCEWIN_64.exe.exe 668KB
-
tox tweaking/niggers/SetACL.exe.exe 601KB
-
tox tweaking/niggers/ToX.pow24KB
-
tox tweaking/niggers/ToX3.nip22KB
-
tox tweaking/niggers/Ultimate.pow9B
-
tox tweaking/niggers/VC_redist.x64.exe.exe 24.2MB
-
tox tweaking/niggers/amifldrv64.sys.sys 28KB
-
tox tweaking/niggers/amigendrv64.sys.sys 34KB
-
tox tweaking/niggers/bfsvc.exe.exe 108KB
-
tox tweaking/niggers/cru.zip.zip 532KB
-
CRU/CRU.exe.exe 1.2MB
-
CRU/Info.txt635B
-
CRU/reset-all.exe.exe 51KB
-
CRU/restart.exe.exe 63KB
-
CRU/restart64.exe.exe 73KB
-
tox tweaking/niggers/devcon.exe.exe 80KB
-
tox tweaking/niggers/file.zip.zip 288KB
-
Export.bat1KB
-
Import.bat739B
-
SCEWIN_64.exe.exe 668KB
-
amifldrv64.sys.sys 28KB
-
amigendrv64.sys.sys 34KB
-
tox tweaking/niggers/oldversion.txt12B
-
tox tweaking/niggers/openshell.exe.exe 7.9MB
-
tox tweaking/niggers/openshell.reg17KB
-
tox tweaking/niggers/procexp.exe.exe 2.7MB
-
tox tweaking/niggers/servers.txt3B
-
tox tweaking/niggers/str.exe.exe 136KB
-
tox tweaking/niggers/version.txt13B
-
tox tweaking/readme.txt167B
tox tweaking/Emu/KeyAuthEmulator.deps.json
- SHA256 98150b82cbb9f35dc99daa5116d9eae18adf22c11cbe245e1822ff42a254d624
- MD5 47306d1fc832c57ab35f197f48e05864
- SHA1 3606f87598d00701916d8ea63fb1b118cf47a418
- SHA512 cd0465b45c49d95bcf1c395d2d90fad37fcc53a7969afa3059d49abbc30d90732471398b4efc6b52fcb4b0f0878a01b3a5bf6d19fead1f18331b2fb63b118a2b
- MD5 SHA1 SHA512
tox tweaking/Emu/KeyAuthEmulator.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8997bb8b9ffb50c9387f906e42a64f52ac0b686e26153257b5bf0c1aad30fd79
- MD5 d653595679fe9ce7790dd473d2077d1a
- SHA1 d5080e0679ddb5a4d7b91fbe2169a9c29f7dc8e6
- SHA512 aa2a7a8bf3d27ad9932504813015f260a264bd502fbaf5956fe1a52255146294cddab86775be54147610b1f5ba1a6ed4ca40ff8d69ac92673174bd061f757ee5
- SSDEEP 384:gwDaZMPaRpdx367j16AQoRaMGgFMsKzh1sxJbutu0xOma6xPpyJyM/aqpj1bXGW+:g5MPQ0XgM0sKzhSxZE9A+B2JJI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Penguin\source\repos\KeyAuthEmulator\obj\Debug\net8.0\KeyAuthEmulator.pdb
mscoree
_CorExeMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
tox tweaking/Emu/KeyAuthEmulator.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 71fede3d07f8b24d08e15748abcd95abcfe48e21a5a71f0c96d6bf752c12252c
- MD5 cf78d5995312872c075ae9772a14a5a2
- SHA1 1de6c53b6acad6140567693f0fff7379826477a5
- SHA512 d4ca332800195a3a1c0dbe7c1669d91e23f5ad68c491589c8168b0040114fb761672778c39f092e8909133a1027e25e836f3951e17cffbc20e5fe5e271b0d845
- SSDEEP 3072:WjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfOCFhBuO:WjK4TDUqgpqWDLZ5H+xuZ04RFhA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70208
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=33731,
count=12, id=260, version=33731,
count=87, id=261, version=33731,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33808,
count=1, id=258, version=33808,
tox tweaking/Emu/KeyAuthEmulator.runtimeconfig.json
- SHA256 162d81f468bec570ec15e527433f4de5d5729ffe338ab79b22671f38760d34bd
- MD5 9fcdf880f73e74cf6347f8194b9f3509
- SHA1 ab571c7ed4920129c89c7e083f3c9f22597198bc
- SHA512 23ea2a78914aeec443bded1e6dddb1fce61f0445c53e0428e97353dcc25e9ee80a98603069de336d57c1d12b00eb14ad59847137387df330a3925bd763f4fde1
- MD5 SHA1 SHA512
tox tweaking/Emu/secret.txt
- SHA256 175c1065c4849740fad4127e0f47e8f2c5bd5957abe4fe10fb29aec689eb55c6
- MD5 44b9a6e19201b976d62400b5db2f2cf6
- SHA1 7dc859306be59615319a48614fa3737829b6dff4
- SHA512 c7e1d6a222857190565358b8f59a758153548a2f2e7aed42cdca2bf614719402346debc3b895ce4c56870467fa4d0cbf984acb4697a7f6cb5c381fec6768701c
- MD5 SHA1 SHA512
tox tweaking/ToX Premium UtilityCRACK.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ed4ede2502e8af6c22df6a697fa66c04ed4ce241ceecdf00ed32b27faa22afe8
- MD5 08570a753f944196e653507ca68a65ce
- SHA1 02fc64d90f5ec3e20e0985f50a3b882569ddd354
- SHA512 3592af44e3f31182a49e7cc5d103f5a5637f68feaea9d2a4fb5ae626fe8cd7e4e03556d85aa0a31e92852796d2620a78b6d5bc87dcc786525be6aaaef78f5893
- SSDEEP 786432:3zQEQ2zOTHQKTyXjbQEV9Frfy+FYL24WbjNRQ4rX+w71/QnX5:DQ92zSQKTyzbBV91tFjN5q8qX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39461102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
37.6MB
Virtual Size
37.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
tox tweaking/niggers/Basic.nip
- SHA256 2856d7d954bc6927cbab98ae137496c75941469e09288becddd227907897c9cb
- MD5 dca724615c6221b2e58cad050c89bba4
- SHA1 90fb7d545773c0a025093444c69a489d501e8f00
- SHA512 cb4464ae1ee9b05cc81ea2e11767467cc9cb55b2fb87f5a4961e4ae0cef599f56e08e8e389d04ae3410930819a4f35e16bda24ee3c3cca5f0c175bd1fcaaa70e
- SSDEEP 96:PKIROHo7HUHrHeHAH+H8THgH1HBaHIsHCHIH2H4HgHtHYHBHnHkHDHJH9HQHhy9V:iIM/yT
- MD5 SHA1 SHA512 SSDEEP
tox tweaking/niggers/DevManView.exe
- IMPHASH fe266af95ae0f37d1609f05d789a2fe0
- SHA256 9abdc7cdc19548ada451aee6caabe296957c050062991892e7d9787ff6e0bdef
- MD5 d22ceb6b43f721fe4e892fea6c8990e6
- SHA1 3ad25b431280a0056579aeaacdf687bd8c3aa901
- SHA512 8c37d941c108172340697887529f3fdc430cdee31d1ff7501d4da7fa21183e8f02832651a99daa30908820b935798ae85e046374e70c1ea4802763edbe47ebc1
- SSDEEP 3072:d4xZZydQqxFMqeq48iiXvK1YY8IkTLuX1VBJsHSnSa7J:Ajrqy8iovKmdulVlt
- MD5 SHA1 SHA512 SSDEEP
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Digest
c7:d7:bf:56:a6:1d:b8:67:0d:16:c4:f5:e3:52:70:4b:73:a0:bd:14:3d:2a:3b:1d:3c:5d:ec:8a:96:4b:c9:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Chains
Aug 1, 2022
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Serial Number
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 9, 2019 - Sep 9, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
109680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\Projects\VS2005\DevManView\x64\Release\DevManView.pdb
msvcrt
_initterm
__wgetmainargs
_wcmdln
__setusermatherr
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
_commode
_fmode
__set_app_type
exit
strlen
qsort
_wcslwr
towupper
wcscmp
_ultow
malloc
_memicmp
free
modf
memcmp
wcstoul
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
wcschr
wcsrchr
_itow
_wcsnicmp
_purecall
_wtoi
wcslen
_wcsicmp
memcpy
wcscpy
memset
wcscat
_snwprintf
wcsncat
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_SetImageCount
CreateToolbarEx
CreateStatusWindowW
ImageList_SetOverlayImage
ImageList_ReplaceIcon
ord17
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
Process32FirstW
GetCurrentThreadId
WinExec
EnumResourceTypesW
GetStartupInfoW
CreateToolhelp32Snapshot
GetProcAddress
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
CompareFileTime
GetLastError
SystemTimeToFileTime
LoadLibraryW
FileTimeToSystemTime
CloseHandle
OpenProcess
ExpandEnvironmentStringsW
GetDriveTypeW
GetLogicalDrives
GetTickCount
DeviceIoControl
CreateFileW
QueryDosDeviceW
GetFileAttributesW
WriteFile
ReadFile
FindResourceW
LoadResource
GetWindowsDirectoryW
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
GlobalAlloc
GetSystemDirectoryW
lstrlenW
LocalFree
LockResource
lstrcpyW
WideCharToMultiByte
GlobalUnlock
GetTempPathW
GetDateFormatW
GetTempFileNameW
GlobalLock
GetFileSize
SizeofResource
FormatMessageW
GetVersionExW
GetModuleHandleW
GetTimeFormatW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
Sleep
SetErrorMode
CreateProcessW
DeleteFileW
ExitProcess
GetCurrentProcessId
GetCurrentProcess
ReadProcessMemory
Process32NextW
user32
ReleaseDC
GetDC
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
GetWindow
EndPaint
DrawFrameControl
SetWindowTextW
GetWindowPlacement
SetCursor
SetDlgItemInt
SetDlgItemTextW
GetDlgItemTextW
BeginPaint
GetSystemMetrics
GetClientRect
DeferWindowPos
CreateWindowExW
SetWindowPos
SendDlgItemMessageW
EndDialog
GetWindowRect
GetDlgItem
GetDlgItemInt
InvalidateRect
SetWindowPlacement
SetMenu
LoadAcceleratorsW
DefWindowProcW
PostMessageW
SendMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
LoadImageW
DestroyIcon
LoadIconW
SetWindowLongW
GetWindowLongW
SetFocus
KillTimer
SetTimer
EndDeferWindowPos
BeginDeferWindowPos
GetParent
GetSysColor
MapWindowPoints
CloseClipboard
GetMenu
EmptyClipboard
EnableMenuItem
MoveWindow
OpenClipboard
GetSubMenu
GetClassNameW
InsertMenuItemW
CheckMenuItem
GetMenuItemCount
GetMenuStringW
GetCursorPos
SetClipboardData
EnableWindow
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
LoadStringW
GetDesktopWindow
DestroyWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
CreatePopupMenu
SetMenuItemInfoW
GetKeyState
RegisterWindowMessageW
TrackPopupMenu
DispatchMessageW
PostQuitMessage
GetMessageW
IsDialogMessageW
TranslateMessage
DrawTextExW
InsertMenuW
RemoveMenu
DeleteMenu
GetMonitorInfoW
MonitorFromWindow
GetWindowThreadProcessId
EnumWindows
AttachThreadInput
SetForegroundWindow
UpdateWindow
gdi32
GetDeviceCaps
DeleteObject
GetStockObject
GetTextExtentPoint32W
SetBkColor
SelectObject
CreateFontIndirectW
SetTextColor
SetBkMode
comdlg32
FindTextW
GetOpenFileNameW
GetSaveFileNameW
advapi32
CloseServiceHandle
ControlService
OpenSCManagerW
StartServiceW
QueryServiceStatus
OpenServiceW
ChangeServiceConfigW
RegSetKeySecurity
RegLoadKeyW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegConnectRegistryW
RegGetKeySecurity
RegUnLoadKeyW
shell32
ExtractIconExW
ShellExecuteW
SHGetFileInfoW
Shell_NotifyIconW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=12, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=310, id=1, productName=Unmarked objects,
count=21, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=30, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
tox tweaking/niggers/DeviceCleanup.exe
- IMPHASH c08d3d26064239a79f795d1f80fb52a5
- SHA256 4f37b11d7cf3ede7e30bfbafa697c0e08eecdc000d0fb14b5956da1adc0a87bd
- MD5 4c5136c06e5a167a29e0d2793024ae48
- SHA1 65463469485aa1745e23b5cd0e9c117b599ca51b
- SHA512 6cdfa995efccce489b5cf58293152721c34a8106f8f568c0b18df86a300951b5a46d64c9b1f262ae68aee7d335da9eb035acfb6fd13e5b41821e9fb78ec2e7d3
- SSDEEP 384:xoJBzkp5kZZRIrJUXXAteV+3BpX0ZjDd1VsRannYPLv:xoLzkTkZLmJ0XAr3BpXK3hsRana
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
87:31:e9:97:23:1c:67:39:45:3c:68:b3:84:49:f1:24:3f:48:05:e5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465
Chains
Mar 31, 2019
Subject
CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465
Serial Number
5b:16:02:a6:5c:10:8c:b5:47:a1:5f:08:9a:33:5c:5b
Issuer
CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 8, 2011 - Dec 30, 2099
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
2
Major OS version
5
Entry point
6272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
u:\1Source\VC\DeviceCleanupCmd070\Release_x64\DeviceCleanupCmd.pdb
setupapi
SetupDiSetClassInstallParamsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
CM_Get_Parent
CM_Get_DevNode_Registry_PropertyA
CM_Get_Device_IDA
SetupDiGetClassDevsA
CM_Locate_DevNode_ExA
CM_Reenumerate_DevNode_Ex
SetupDiRemoveDevice
shlwapi
StrToIntA
StrStrIA
StrRChrA
StrChrA
kernel32
GetSystemTime
SystemTimeToFileTime
CloseHandle
GetLastError
OpenProcess
GetWindowsDirectoryA
GetCurrentProcess
ReadConsoleInputA
FlushConsoleInputBuffer
Sleep
GetCurrentProcessId
GetConsoleWindow
GetNumberOfConsoleInputEvents
GetTickCount
SetConsoleTextAttribute
GetStdHandle
PeekConsoleInputA
lstrcpyA
GetConsoleScreenBufferInfo
SetConsoleMode
SetConsoleCtrlHandler
GetModuleFileNameA
HeapAlloc
HeapFree
lstrlenA
GetCommandLineA
GetSystemDirectoryA
SetFileAttributesA
GetFileAttributesA
GetProcAddress
ExitProcess
GetModuleHandleA
GetProcessHeap
WriteFile
lstrcatA
SetConsoleWindowInfo
SetConsoleScreenBufferSize
LoadLibraryA
GetVersionExA
SetLastError
FreeLibrary
user32
GetDesktopWindow
GetWindowPlacement
IsWindowVisible
CharUpperA
GetWindowThreadProcessId
wsprintfA
wvsprintfA
MessageBoxA
advapi32
CheckTokenMembership
FreeSid
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
OpenProcessToken
AllocateAndInitializeSid
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
372B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=111, id=1, productName=Unmarked objects,
count=7, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
tox tweaking/niggers/GameUserSettings.ini
- SHA256 1e6a57c438b37f1ec5097dab51091b707bbe67d6ae25d742539a5bbcf98e4e5e
- MD5 f90627522057c354509e71fab48f4ae6
- SHA1 6ddf39c9637504d8e2f4c6602fe09f88e0321277
- SHA512 82f855c5a66bb6461b903b39af61400ecad241d67bedf562f442b000e19e15f69486715ff4cef774cda1adebeee36c7dcaf7d30b767f9afe71efc64f57bf0c50
- SSDEEP 192:ppjf7bIRtYZaL4nepQo0viVk5FdiMx3+fuR0m0fez0jcN32RJB0K6Tve1Sauiv1e:jjPIRtYZaIepQo0vETK+eauiv1x45g7u
- MD5 SHA1 SHA512 SSDEEP
tox tweaking/niggers/LowGraphics.nip
- SHA256 b123b554afafa62cfd7c96766cd95aa8f4ab642d360517c432a99bcf433673be
- MD5 3a6fca9fe890c40b3f0cee7edca5d57b
- SHA1 518edb3cbea65664b76d312811eda3dec3c15786
- SHA512 8e8e456420172a93f49ee9bfd85e3e411cc01ddaaf88653d1e9c9bbe0215cc7a6f6f34e0b985e375c97261ce3dc4fb2caaa199714c7946c7e28efe9cef9925d4
- MD5 SHA1 SHA512
tox tweaking/niggers/MaxFPS.nip
- SHA256 0f1d4c97aeb53a7dd68e13233c9d22db506bee3b54d7a154b02439862cb3d087
- MD5 adc022d668f338b5b435b7d6c2d50945
- SHA1 35c9c5d898bfea8aa0fe4f0ec99e473da4126fc0
- SHA512 159f451c2704a05885fced28df0811df547ade319bd946f39dd17480622f7c86b1b051683fa69833107adb9e1b04c982627289aaa77c5234855601e35a48833b
- SSDEEP 96:PKIRcHkHyHoUHhHUHQH2HrHeHMRsHAH4H+HeHcHdHcHtHfH5HJH6YMHZY823HZYY:iIJR125y5CTl
- MD5 SHA1 SHA512 SSDEEP
tox tweaking/niggers/Microsoft-uiXAML2.8.Appx
- SHA256 d3c222a694aece945c98da01bb412b3da1e36428efa353665ac38e96127f3f49
- MD5 77cfc41c3181f50589396f6dc04b4a54
- SHA1 4bf7cc0762db6df1088c4d6142f0a93b9b268a91
- SHA512 abff20d295105d8fbb10a106c5bb61352014ec5448f9d75be9183829e8cb5bbb5359494e55af97cdf61dc92deb4875e8ad9a3b8bbb9e574ba306928962cfbe38
- SSDEEP 98304:eaSUNTP6MKd7wQnG/yM7/h0Rq39gj1H1dfYw+KclReo5kb6VeEAfMc:vSUNr6MKaQnih/j97w3W/VlSMc
- MD5 SHA1 SHA512 SSDEEP
AppxBlockMap.xml
- SHA256 577e68b08cbf49f84cb386af0ccfd86d0db9e69ad460ceb3e994c62293ad8c1d
- MD5 cd63ad9aefcf2ea778ec6ded3b3b9fc1
- SHA1 fedb4075ea6a458a5aef400e4b3dbca6cb35003a
- SHA512 fdc784ca5e3fe79fc995c8a8e2f5110cad1a5a42485e832bb9614b9f0596b1e3481f9a1f202c43314dd50f72d2806a20ba97cc2b499c52ed00a10a46b09e6ebd
- SSDEEP 384:a1I+34mL5tktaG2HjtroJVDdJ5AKtnW7biGrJ:/+IiqQprApJKM+iGrJ
- MD5 SHA1 SHA512 SSDEEP
AppxManifest.xml
- SHA256 f4678e79c8737a3e07c6f43a26056abdef9fb0c0b4987d27a69cac892a3db5f4
- MD5 e4b0369e7f58e6ab56cb4a2323af92c9
- SHA1 7636971b50dd33d58cb9cb654ecf7dd5b7a42250
- SHA512 3f92096178401ea65d6ffbe1b7a6ecbe95bfa3aa1e024f9b6fb277bf2e85e15846f9de6f0a9d4fc87721a8bb73d09371385ecad328182a7015553151cb525dc2
- SSDEEP 384:fEGAOJm1x6U6RUM5juWZiZX9hnCt57zeC12ejUuRT1dLrfYhptlbw/FraepPetAC:xVyHiLoJJFLe8
- MD5 SHA1 SHA512 SSDEEP
AppxMetadata/CodeIntegrity.cat
- SHA256 f072dc22c9a12370b972cb79c6ad790ff7a33ddcf51a129d4502cecdd1950640
- MD5 511e7b33d161071c2ee4b82043d84ba0
- SHA1 9d0d8b17561be48c1df4c8ca66054bc203bbeb12
- SHA512 649e5ad94d6b09722dbc1db610d04a062fe4682cf10be34ef9dcbf6b637f6671783ff070bc60eb4a2ee2cdf8cea64514b55925246ae66653c8aebbbebf734328
- SSDEEP 192:8ypJxiJFg9hMxLaRvpkdZmp8TKjX01k9z3Ab2WjHj:vxi3g9hM4RvpYsWAR9zg2WjD
- MD5 SHA1 SHA512 SSDEEP
AppxSignature.p7x
- SHA256 c5a7f2e7cec5654bbb68240610c8a6b99393c80ca9fe3fcd95847568cb5222be
- MD5 910b4a5213f89508f4e30de8e6414a73
- SHA1 9a60a38f5acb46449d72f09fa79a2e9a8bedf215
- SHA512 2f34d85fcc4b0e23397f611aad9a10126a2484749b7e19df645b18fd892133d55c9c6dc7c039a27140f33f40b5d2b20713df7616a205a3ab27cf3dda785d2a8a
- SSDEEP 192:qdpypJxiJFg9hMxLaRvpc3Zmp8TKjX01k9z3Ab2WMv4:pxi3g9hM4Rvp8sWAR9zg2Ww4
- MD5 SHA1 SHA512 SSDEEP
Microsoft.UI.Xaml.dll
- IMPHASH cd2511fe0afac31e49793c33a75ecb68
- SHA256 3f761d13cddc2148368403460c31e09596a42f5be439b4568956a2feaa77bb20
- MD5 adec19eb52f1728d6b6b6ccaa3e3ba60
- SHA1 002c7f609d99be79eb36daf8805636136df72466
- SHA512 405610213286722cdd935507151c0410b3c9cdf3ad5dad35988daf7d36726a39d5c571f639e971f3ea9df47259878a6aa832020dc901a905b9c39abaa98f27b1
- SSDEEP 98304:hW22oXPBI2l1O3+CtDJSeU/JKarqXWY6FwiPcvJYk4Y2xnaKl6PLQRdQ5:XXm2l1OOCtDJSeU/JKarqXp6FwiPcvJx
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
df:57:92:12:54:9b:38:ac:c1:21:72:00:13:a5:bc:10:c0:77:a1:7c:c8:79:7d:6e:56:d8:9f:2d:74:7e:94:14
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
2
Major OS version
6
Entry point
606016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\BuildOutput\Release\x64\Microsoft.UI.Xaml\Microsoft.UI.Xaml.pdb
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLocaleName
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoGetObjectContext
CoGetApartmentType
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolTimer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-synch-l1-1-0
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
SetEvent
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryExW
oleaut32
GetErrorInfo
SysFreeString
SafeArrayCreateVector
SetErrorInfo
SysAllocString
SysStringLen
SafeArrayPutElement
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
d2d1
ord1
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
_initterm_e
_errno
terminate
_wassert
_invalid_parameter_noinfo_noreturn
abort
_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsicmp
_wcsdup
towupper
iswspace
wcsncmp
api-ms-win-crt-convert-l1-1-0
wcstol
wcstof
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
round
ceil
_fdclass
cos
floor
nextafterf
floorf
_dclass
pow
sqrt
roundf
atan2
sin
ceilf
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-heap-l1-1-0
calloc
malloc
realloc
_callnewh
free
kernel32
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SwitchToThread
InitOnceBeginInitialize
InitOnceComplete
RaiseException
RtlPcToFileHeader
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
InitializeSListHead
GetCurrentProcessId
RtlVirtualUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
api-ms-win-crt-locale-l1-1-0
_unlock_locales
setlocale
__pctype_func
_lock_locales
___lc_locale_name_func
___lc_codepage_func
___lc_collate_cp_func
___mb_cur_max_func
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
DllCanUnloadNow
DllGetActivationFactory
DllMain
SendTelemetryOnSuspend
Name
.text
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
301KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=12, id=260, version=32533,
count=88, id=261, version=32533,
count=12, id=259, version=32533,
count=1, id=260, version=29395,
count=1, id=261, version=29395,
count=65, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=207, id=1, productName=Unmarked objects,
count=403, id=270, version=32825,
count=1, id=256, version=32825,
count=1, id=255, version=32825,
count=1, id=258, version=32825,
Microsoft.UI.Xaml.winmd
- SHA256 2bf1f13298fda7f3eedf66a19bde55f9de0a57e902a9a60bc6ac37c9c4cf9d0b
- MD5 e5db745bd07c98984c27be118542ba3b
- SHA1 ac0a7959252e73e10486127babf5f86c232fab44
- SHA512 480f9e7e0a7fe1cf7b89825db19e41fe8c3f6f21dd183ea2db7225c81be431d152952384ceb279aa074de36a5b4f692ba3268088a1f5fc428f432cd89922b854
- SSDEEP 6144:o8M+IFNxaeugzwfs88O43KuYS8IMzscp5NGg3SqEN0nk3:o80u3k88JMzscp5NGgC/NT3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
278KB
Virtual Size
278KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
generic
Microsoft.UI.Xaml/Assets/NoiseAsset_256x256_PNG.png
- SHA256 4f2aa94a2e345a32dae689176b86c644bef87081ff9daef8c77417731862031b
- MD5 81f27726c45346351eca125bd062e9a7
- SHA1 688aef60c29de41ee32163082e0e1f1b96806bea
- SHA512 053dc1e2ac51b3682ec858a7f24e98e83b6d033c376baa67d82f57feacbe0475219119ffa22cdbad990a1e387a987d7d38018c47819c913713677d05fbb20be7
- MD5 SHA1 SHA512
[Content_Types].xml
- SHA256 f58d69e9bbd65dd2f28e1741c1c6cbcdf9d0e8ae572b6d848e834959145fc0d9
- MD5 c0f75b59b18395c08ca7ad29b39df690
- SHA1 830cc0366a667ac8c8d378c728761ef486e8eb8a
- SHA512 d9c96fbffa7bea1f864a455d4dca8d6e62f287fb6d6ce6b4421886e382b204cd4d6b0d1d52bdc969610038f70737380f9a1313214c427473bc9b235f4bbf847f
- MD5 SHA1 SHA512
logo.png
- SHA256 5a9d9b919cd6a05aecb690d4edf361be4cacc1bc4a50c28130bc8182888f8e43
- MD5 0320a712f53073d420b96a9a6fa3b943
- SHA1 99e9fcea8d8209eed8a61554af259f050b62729a
- SHA512 7fd02d60c4726294332f8da09a88cfa7db6f830c7b3b64d751f1e961cb2d9f1dc9b93f2d1157c153d238ad30b6b8c618743f9ce8f4619ab4473576d25ef27664
- MD5 SHA1 SHA512
resources.pri
- SHA256 4d7adf369da89ddd5ded37942591f5209a03c059ed9e5da386ccba9f03781ac6
- MD5 86d9809708775e4d335c35b5216fb2ac
- SHA1 098bc5d4dc03335bca2de3f773a5eb14d85b5efc
- SHA512 4bc429e21efd567ec8e8da8cc89c8de0dbb72337bda6ffa5980f8f265d2b03bd61151f522607da0e76ba8beb10112b9342d31356207e290cb446043968263cf8
- SSDEEP 24576:zUt//KP21/CjN+L/maS7aALqd/918mAqa5H18LFDweXw1118eZz/eXwk46UtB6K3:I/aCSnLcaQWA54f6qE5u
- MD5 SHA1 SHA512 SSDEEP
tox tweaking/niggers/MicrosoftEdgeSetup.exe
- IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
- SHA256 7531341da720162541747b3142722f9c52d9d5fe57678d8aeefa62532014f672
- MD5 9008b1f2c99b79594ccba4afd923056a
- SHA1 4d88557702696906b44a37b289b4a5716e7c9fbe
- SHA512 ab9a48a6816c97d3e5988dacd8a2f270bd30b16cc558e0667c77a65121228bb3de90d03bf8cb48a92fe91c737876e260f2d782cb1aae18f1711e5f5679be9cb6
- SSDEEP 49152:jiEa3J/lPA552bT8TCKpxVt2sl0TD5yncADYOS0jZ2/vgm9d:jirIOoT9pnt9l45mcADRS0SRb
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b3:6c:15:ca:d5:64:3c:a7:06:bd:26:b3:90:91:6b:ae:69:90:07:92:c6:e2:fc:86:56:4c:26:69:9e:d6:54:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=C2RService,O=C2RService,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
PE Signature issue
Digest
b3:6c:15:ca:d5:64:3c:a7:06:bd:26:b3:90:91:6b:ae:69:90:07:92:c6:e2:fc:86:56:4c:26:69:9e:d6:54:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=C2RService,O=C2RService,L=Redmond,ST=Washington,C=US
Serial Number
15:e2:29:fe:14:35:70:74:b6:6a:98:f8:0b:49:59:7c
Issuer
CN=C2RService,O=C2RService,L=Redmond,ST=Washington,C=US
Timespan
Feb 17, 2017 - Dec 31, 2039
Minor OS version
1
Major OS version
5
Entry point
33776
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mi_exe_stub.pdb
kernel32
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
OutputDebugStringW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
RaiseException
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
DecodePointer
VirtualProtect
EncodePointer
LoadLibraryExW
QueryPerformanceCounter
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RtlUnwind
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStringTypeW
CreateDirectoryW
SizeofResource
FindFirstFileW
Wow64DisableWow64FsRedirection
RemoveDirectoryW
GetTempPathW
FormatMessageW
Wow64RevertWow64FsRedirection
GetFileAttributesExW
GetDiskFreeSpaceExW
LockResource
DeleteFileW
FindResourceExW
LoadResource
FindResourceW
HeapDestroy
LocalFree
VerSetConditionMask
CopyFileW
VerifyVersionInfoW
GetTempFileNameW
lstrcmpiW
CreateMutexW
WaitForSingleObject
ReleaseMutex
CreateEventW
SetEvent
CreateThread
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
VirtualQuery
CreateProcessW
GetExitCodeProcess
ResetEvent
WaitForSingleObjectEx
GetSystemInfo
LoadLibraryExA
advapi32
RegSetValueExA
SetSecurityDescriptorDacl
GetAclInformation
SetSecurityDescriptorOwner
GetSidSubAuthority
GetSidLengthRequired
CopySid
InitializeSid
IsValidSid
AddAce
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
GetSecurityDescriptorLength
MakeSelfRelativeSD
MakeAbsoluteSD
SetSecurityDescriptorGroup
RegOpenKeyExW
RegQueryValueExW
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExW
RegOpenKeyExA
RegDeleteValueA
ole32
CoTaskMemFree
CoUninitialize
CoInitializeEx
shell32
SHGetKnownFolderPath
ord680
CommandLineToArgvW
SHGetFolderPathW
user32
CharLowerBuffW
MessageBoxW
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=147, id=261, version=27412,
count=17, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=20, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=13, id=265, version=31104,
count=52, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=19, id=260, version=27412,
count=1, id=262, version=27412,
count=13, id=257, version=27412,
count=169, id=1, productName=Unmarked objects,
count=1, id=255, version=31104,
count=86, id=151,
count=1, id=258, version=31104,
tox tweaking/niggers/NSudoLG.exe
- IMPHASH 1188b455132bc86c7e9e68ae98ce4171
- SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
- MD5 423129ddb24fb923f35b2dd5787b13dd
- SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
- SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
- SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
55784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\MouriNaruto\NSudoPrivate\Source\Native\Output\Binaries\Release\x64\NSudoLG.pdb
kernel32
ExpandEnvironmentStringsW
GetModuleFileNameW
OpenProcess
CreateEventW
MultiByteToWideChar
GetTickCount64
LockResource
QueryPerformanceFrequency
FindResourceExW
LoadResource
GetProcAddress
VerSetConditionMask
FreeLibrary
SleepEx
GetFileInformationByHandleEx
QueryPerformanceCounter
LoadLibraryExW
GetModuleHandleExW
ExitProcess
Sleep
RtlUnwindEx
OutputDebugStringW
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
SizeofResource
GetLocalTime
GetCurrentProcessId
ResumeThread
WaitForSingleObjectEx
InitializeCriticalSection
GetCurrentProcess
SetPriorityClass
MulDiv
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
CloseHandle
GetThreadUILanguage
GetLastError
GetCurrentThreadId
GetFileAttributesW
CreateFileW
InitializeCriticalSectionEx
LeaveCriticalSection
SetThreadUILanguage
GetCommandLineW
EnterCriticalSection
SetLastError
HeapFree
VerifyVersionInfoW
ReadFile
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeCriticalSectionAndSpinCount
user32
LoadImageW
DialogBoxParamW
EndDialog
SendMessageW
GetWindowTextW
EndPaint
BeginPaint
DrawIconEx
GetClientRect
LoadIconW
ChangeWindowMessageFilter
DestroyIcon
UnregisterClassW
SetWindowLongPtrW
MonitorFromWindow
GetDC
GetDlgItem
SetWindowTextW
gdi32
DeleteDC
GetDeviceCaps
comdlg32
GetOpenFileNameW
advapi32
AdjustTokenPrivileges
GetAce
CloseServiceHandle
OpenSCManagerW
AllocateAndInitializeSid
IsWellKnownSid
AddAce
CreateRestrictedToken
FreeSid
StartServiceW
InitializeAcl
OpenServiceW
GetLengthSid
AddAccessAllowedAce
QueryServiceStatusEx
LookupPrivilegeValueW
SetTokenInformation
OpenProcessToken
SetThreadToken
CreateProcessAsUserW
DuplicateTokenEx
GetTokenInformation
shell32
DragQueryFileW
DragFinish
ole32
CoInitializeEx
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
wtsapi32
WTSFreeMemory
WTSEnumerateProcessesW
WTSQueryUserToken
WTSEnumerateSessionsW
msvcrt
strcpy_s
__pctype_func
tolower
___mb_cur_max_func
wcsnlen
wcstol
_mbtowc_l
?terminate@@YAXXZ
__wgetmainargs
_msize
_XcptFilter
_errno
_wcmdln
?_set_new_mode@@YAHH@Z
_commode
___lc_codepage_func
realloc
ceil
log10
_clearfp
_set_fmode
_initterm_e
_initterm
_callnewh
memcpy
_wcsnicmp
malloc
free
strncmp
_wcsicmp
strrchr
__DestructExceptionObject
_amsg_exit
memmove
memset
__C_specific_handler
_CxxThrowException
wcsstr
wcsrchr
abort
__set_app_type
memcmp
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=260, version=27412,
count=3, id=261, version=27412,
count=7, id=199, version=41118,
count=2, id=257, productName=VS2019 v16.10.4 build 30040, version=30040,
count=31, id=261, productName=VS2019 v16.10.4 build 30040, version=30040,
count=10, id=260, version=30034,
count=6, id=259, version=30034,
count=36, id=261, version=30034,
count=21, id=257, version=27412,
count=215, id=1, productName=Unmarked objects,
count=5, id=265, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=4, id=151,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
tox tweaking/niggers/NVIDIA Control Panel.exe
- IMPHASH 3d7eeab1dee7f38fb22072ebd77b5fea
- SHA256 066365731d031099bf04198644e38fdf620113b2eb08a351610273751ad92671
- MD5 f4cdad23d303ae4b57cb72dc558b721c
- SHA1 c45ce0fcf47662510f90b41ef2cef45e94dad279
- SHA512 3140684adb577b319f073e6d27f119ab00b23f5c218bb9f54415e2981b1ef8c0ca5bbeb0e15607b6da0051c41224d61f501607299f358899452ffe56cbfb139e
- SSDEEP 49152:tZF5q/RI7h8kaOGmflzhSgExJRtKxk55vX3ivx4DNdGd1UeiyuWTy6SL/tWCF16t:t9f7rfUSLNuntbF1fo4sNQUK
- MD5 SHA1 SHA512 SSDEEP
Digest
59:f7:57:97:81:4c:5d:17:f3:e8:98:38:27:d5:53:56:ce:cb:71:c3:57:64:0a:d1:a3:2e:cd:94:39:55:e3:7e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Jun 8, 2021
CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
62:e7:45:e9:21:65:21:3c:97:1f:5c:49:0a:ea:12:a5
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 9, 2018 - Jul 9, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2014 - Jul 21, 2024
Minor OS version
0
Major OS version
6
Entry point
2388032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\dvs\p4\build\sw\rel\gpu_drv\r465\r466_61\drivers\ui\Sedona\Sedona\x64\Release\bin\nvCplUI.pdb
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
rpcrt4
UuidFromStringW
gdiplus
GdipDrawImageRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFontFromLogfontW
GdipCreateFont
GdipDeleteFont
GdipGetLogFontW
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipSetStringFormatAlign
GdipGetDpiY
GdipGetFontHeightGivenDPI
GdipLoadImageFromStream
GdipCloneImage
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipGetFontHeight
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageDimension
GdipCreateSolidFill
GdipDeleteBrush
GdipFree
GdipCloneBrush
GdipDeleteStringFormat
GdipCreateBitmapFromScan0
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipAlloc
wtsapi32
WTSRegisterSessionNotification
WTSQueryUserToken
WTSUnRegisterSessionNotification
shlwapi
StrFormatKBSizeW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFileExistsW
SHSetValueW
SHGetValueW
PathRemoveFileSpecW
comctl32
ImageList_AddMasked
ImageList_Create
ImageList_Draw
ImageList_ReplaceIcon
InitCommonControlsEx
ord17
msimg32
TransparentBlt
AlphaBlend
setupapi
SetupDiEnumDeviceInfo
CM_Get_Parent
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
kernel32
SetFilePointer
UnlockFile
DuplicateHandle
MoveFileW
GetStringTypeExW
GlobalGetAtomNameW
CompareStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
SearchPathW
GetTempPathW
GetProfileIntW
FileTimeToLocalFileTime
GetFileAttributesExW
GetShortPathNameW
SystemTimeToTzSpecificLocalTime
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
CompareStringW
GetSystemDefaultUILanguage
GlobalFlags
VirtualProtect
lstrcpyW
GetCurrentDirectoryW
SetErrorMode
GetWindowsDirectoryW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEndOfFile
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetFileSize
FlushFileBuffers
DeleteFileW
GetUserDefaultLCID
SystemTimeToFileTime
ReplaceFileW
SetFileTime
GetTempFileNameW
GetFileTime
GetDiskFreeSpaceW
ResumeThread
SetThreadPriority
CreateEventW
InitializeCriticalSectionAndSpinCount
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
GetModuleHandleExW
EncodePointer
OutputDebugStringA
CopyFileW
GlobalSize
LoadLibraryExA
ExpandEnvironmentStringsA
lstrcmpA
CreateProcessW
GetFullPathNameW
ReadFile
LockFile
UnhandledExceptionFilter
GetVolumeInformationW
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
GetModuleHandleExA
OpenMutexW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
WideCharToMultiByte
GetSystemTimeAsFileTime
GetProcessTimes
CreateEventA
WaitForSingleObjectEx
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
WriteFile
GetFileSizeEx
ExpandEnvironmentStringsW
SetThreadUILanguage
SetThreadLocale
GetSystemDirectoryW
GetCurrentThread
GetCurrentProcess
DecodePointer
GetComputerNameW
GetLocalTime
CreateFileW
GetTickCount
CreateMutexW
ReleaseMutex
OutputDebugStringW
lstrcmpW
OpenEventW
WaitForSingleObject
GetFileAttributesW
FindFirstFileW
FindClose
GetEnvironmentVariableW
GlobalFree
GlobalLock
GetStringTypeW
LCMapStringW
GetCPInfo
FormatMessageA
GlobalUnlock
GlobalAlloc
lstrcatW
lstrlenW
MultiByteToWideChar
lstrcmpiW
MulDiv
LoadLibraryExW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetCurrentThreadId
IsBadReadPtr
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
LoadLibraryW
ProcessIdToSessionId
GetCurrentProcessId
CloseHandle
FileTimeToSystemTime
GetProcAddress
FreeLibrary
LocalAlloc
CreateThread
Sleep
GetThreadLocale
VerifyVersionInfoW
lstrcpynW
FreeResource
FindResourceExW
GetVersionExW
VerSetConditionMask
GetSystemDefaultLCID
GetUserDefaultLangID
GetLocaleInfoW
FormatMessageW
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
SetLastError
GetLastError
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
SetFilePointerEx
DeviceIoControl
GetModuleHandleA
MoveFileExW
AreFileApisANSI
RtlUnwindEx
RtlPcToFileHeader
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
HeapQueryInformation
GetSystemInfo
VirtualQuery
SetStdHandle
GetFileType
GetStdHandle
ExitProcess
GetConsoleCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
LocalFileTimeToFileTime
WriteConsoleW
user32
EnableScrollBar
UpdateLayeredWindow
DrawEdge
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetAsyncKeyState
RealChildWindowFromPoint
UnionRect
LockWindowUpdate
MonitorFromPoint
MapDialogRect
SetWindowContextHelpId
RegisterClipboardFormatW
ShowOwnedPopups
PostQuitMessage
IsZoomed
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
CharUpperW
GetMessageW
GetIconInfo
CopyImage
GetNextDlgGroupItem
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
MapVirtualKeyW
GetKeyNameTextW
SendDlgItemMessageA
GetActiveWindow
CreateDialogIndirectParamW
CheckDlgButton
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetScrollInfo
GetLastActivePopup
GetTopWindow
EqualRect
MessageBoxW
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
ValidateRect
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
DeferWindowPos
SetWindowPlacement
GetWindowPlacement
GetClassInfoExW
GetClassInfoW
GetMessageTime
GetMessagePos
GetMenuState
GetMenuStringW
SetRectEmpty
GetWindowThreadProcessId
GetShellWindow
PeekMessageW
DispatchMessageW
TranslateMessage
DrawFocusRect
GetUpdateRect
DestroyCursor
CallWindowProcW
SystemParametersInfoW
GetClassLongPtrW
GetDCEx
GetSystemMenu
ReleaseCapture
SetCapture
EndDeferWindowPos
BeginDeferWindowPos
LoadImageW
FillRect
DrawIcon
SetParent
EnumDisplayDevicesW
EnumWindows
FindWindowExW
SetWindowTextW
SetForegroundWindow
DestroyAcceleratorTable
IsClipboardFormatAvailable
GetCursorPos
InflateRect
IsChild
GetClassNameW
GetKeyState
SetFocus
GetMenuItemInfoW
DeleteMenu
DestroyMenu
LoadMenuIndirectW
WindowFromPoint
ScreenToClient
EnumDisplayMonitors
EnumDisplaySettingsW
GetWindow
FindWindowW
GetDesktopWindow
SetRect
LockSetForegroundWindow
UpdateWindow
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
CreatePopupMenu
LoadMenuW
IsWindowEnabled
GetFocus
CharLowerW
GetNextDlgTabItem
CreateWindowExW
SendNotifyMessageW
wsprintfW
SetWindowLongW
GetWindowLongW
CopyRect
GetWindowTextLengthW
GetWindowTextW
DrawTextW
IsRectEmpty
EndPaint
BeginPaint
RegisterClassW
DefWindowProcW
GetParent
IntersectRect
SetCursor
TrackMouseEvent
WinHelpW
IsDialogMessageW
DestroyIcon
ReleaseDC
GetDC
GetSystemMetrics
CharNextW
GetDialogBaseUnits
CreateDialogParamW
DestroyWindow
UnregisterClassW
DrawIconEx
LoadCursorW
CallNextHookEx
GetTabbedTextExtentW
MessageBeep
PostThreadMessageW
CopyAcceleratorTableW
InvalidateRgn
CreateMenu
GetMenuDefaultItem
HideCaret
InvertRect
NotifyWinEvent
SetClassLongPtrW
SetCursorPos
CopyIcon
FrameRect
UnhookWindowsHookEx
SetWindowsHookExW
PtInRect
ClientToScreen
RedrawWindow
SetWindowRgn
KillTimer
SetTimer
IsWindowVisible
RegisterClassExW
ToUnicodeEx
GetWindowRgn
DrawFrameControl
IsWindow
GetSysColorBrush
GetSysColor
LoadBitmapW
InvalidateRect
SetLayeredWindowAttributes
PostMessageW
RegisterWindowMessageW
GetMonitorInfoW
MonitorFromWindow
SetScrollInfo
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
SetScrollPos
ScrollWindow
EnableWindow
MoveWindow
LoadIconW
MapWindowPoints
MessageBoxExW
GetWindowRect
GetDlgCtrlID
SendDlgItemMessageW
IsDlgButtonChecked
SetDlgItemTextW
GetDlgItem
EndDialog
DialogBoxParamW
SetWindowPos
ShowWindow
SendMessageW
CreateAcceleratorTableW
GetKeyboardState
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
CharUpperBuffW
MapVirtualKeyExW
IsCharLowerW
GetComboBoxInfo
WaitMessage
ModifyMenuW
SetMenuDefaultItem
OffsetRect
GetDoubleClickTime
IsIconic
GetKeyboardLayout
IsMenu
gdi32
GetObjectW
SetTextColor
SetBkMode
SelectObject
OffsetViewportOrgEx
CreateBitmap
BitBlt
SetWindowOrgEx
CreateCompatibleDC
GetBitmapDimensionEx
GetDeviceCaps
StretchBlt
SetBitmapDimensionEx
GetTextExtentPoint32W
CombineRgn
CreateRectRgn
CreateRoundRectRgn
CreateSolidBrush
FrameRgn
GetRgnBox
ScaleViewportExtEx
ScaleWindowExtEx
SetRectRgn
GetBkColor
CreateEllipticRgn
Ellipse
LPtoDP
CreateFontW
GetCharWidthW
StretchDIBits
SetWindowExtEx
StartPage
EndPage
AbortDoc
SetAbortProc
GetViewportOrgEx
CreateDIBitmap
GetTextCharsetInfo
RealizePalette
SetPixel
SetDIBColorTable
Polygon
Polyline
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetWindowOrgEx
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
OffsetRgn
RoundRect
FillRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
SetViewportExtEx
GetViewportExtEx
TextOutW
MoveToEx
StartDocW
SetTextAlign
SetStretchBltMode
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
GetStockObject
DeleteObject
LineTo
IntersectClipRect
EndDoc
CreateFontIndirectW
GetPixel
GetObjectType
GetCurrentPositionEx
ExcludeClipRect
Escape
CreatePatternBrush
CreateHatchBrush
CopyMetaFileW
DPtoLP
SetMapMode
SetBkColor
GetMapMode
CreateDIBSection
SetDIBitsToDevice
SetViewportOrgEx
Rectangle
PatBlt
CreatePen
CreateDCW
GetTextColor
ExtTextOutW
EnumFontFamiliesW
CreateRectRgnIndirect
OffsetWindowOrgEx
GetClipBox
GetTextFaceW
DeleteDC
CreateCompatibleBitmap
GetTextMetricsW
GetTextExtentPointW
GetCurrentObject
CreatePolygonRgn
GetWindowExtEx
winspool.drv
ClosePrinter
DocumentPropertiesW
OpenPrinterW
GetJobW
advapi32
RegEnumKeyW
SetFileSecurityW
GetFileSecurityW
RegSetValueW
RegOpenKeyExA
RegQueryValueExA
EqualSid
TraceMessage
RegEnumValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
ImpersonateSelf
GetTokenInformation
GetLengthSid
FreeSid
AllocateAndInitializeSid
AddAccessAllowedAce
AccessCheck
OpenThreadToken
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RevertToSelf
ImpersonateLoggedOnUser
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueW
shell32
SHGetFileInfoW
ShellExecuteExW
ExtractAssociatedIconW
ShellExecuteW
DragQueryFileW
DragFinish
SHAddToRecentDocs
ExtractIconW
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation
ole32
RegisterDragDrop
DoDragDrop
OleDuplicateData
ReleaseStgMedium
OleLockRunning
StringFromCLSID
StringFromGUID2
CoRevokeClassObject
CoRegisterClassObject
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoGetMalloc
CoDisconnectObject
CoUninitialize
CoInitializeEx
CoCreateGuid
CoInitialize
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CLSIDFromProgID
CoGetClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleGetClipboard
CoLockObjectExternal
RevokeDragDrop
oleaut32
VarBstrFromDate
VariantCopy
OleCreateFontIndirect
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantClear
VariantInit
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
oledlg
OleUIBusyW
oleacc
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
uxtheme
CloseThemeData
DrawThemeBackground
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeText
DrawThemeParentBackground
IsAppThemed
OpenThemeData
winmm
PlaySoundW
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1006KB
Virtual Size
1005KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
52KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9.5MB
Virtual Size
9.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=26715,
count=3, id=261, version=23013,
count=36, id=260, version=26715,
count=210, id=261, version=26715,
count=3, id=262, version=26715,
count=39, id=260, version=24123,
count=10, id=259, version=24123,
count=383, id=261, version=24123,
count=45, id=257, version=26715,
count=914, id=1, productName=Unmarked objects,
count=1, id=263, version=26715,
count=1, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=53, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
tox tweaking/niggers/New_Project_1.png
- SHA256 d0e26530e71e254a5394998a3dfd1ad3da91495770dd9e27c7183206f4e7d3b1
- MD5 4b43d4d223986e34b6cb8e735f715786
- SHA1 3cf67d7a204dcde9e551cf4406d8227ab5d96307
- SHA512 f54a04cf1900f5caef076873816adc9e872181c414ad6f6486b1e4bb584cb6d66228b49043fc93b05a9cbf1d0237bc33028ce174835eaa2f2fcb6c0bb58dad8f
- SSDEEP 12288:Nb8CXPg9BCbCJXnCayh/4tqsrVN5B6uZ6d6oIQth9MUxOvIMkU:Nb4BNnCay95aVdhUd6oIQtnMUx2IMZ
- MD5 SHA1 SHA512 SSDEEP
tox tweaking/niggers/OpenShell Settings.xml
- SHA256 e0216d48ac0e478320a2ebc6533fb9bdbb2abd9ad7786cb0bcb2faa5352dbe51
- MD5 d58ea8965a4e1eef9b58828f7e8e55e9
- SHA1 96b3244b33d922aeebfa388ab5c2a109abe9b79b
- SHA512 8bee5159fd2a4896be5dd3de5bfd988f779db306e71ebb49a43a76db4e081f5581ab04a37835edb59adbcba552f95767326902d5c39ee667d351560b15141424
- MD5 SHA1 SHA512
tox tweaking/niggers/PowerRun.exe
- IMPHASH 870b8e75c7190e202e9c6c81dff1040c
- SHA256 c0abbeea8ae726503bc5643f3471e378d92fcb59a37043062bbf9ba64d95004c
- MD5 71c7975385f73ae32b06f69dbe79290b
- SHA1 05a1197cb8bd88447199e42a75bfcf99e32f2c48
- SHA512 1a6549788e97e5d07560f58dc11088424f0f90815f0ced2173be169ad4dbf0e55cd19b40fbf8f65d65e0f6cadb21c0489dc6a8de999859d12244879f4722ec95
- SSDEEP 12288:XaWzgMg7v3qnCi9ErQohh0F4fCJ8lnyQQdbpSulVAbWjuixwhQaB/Q:qaHMv6CRrj3nyQQdpSulmWjxwhQaG
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ce:5e:43:01:ef:03:b0:b7:18:a7:d1:71:ff:fa:d6:b2:e2:48:11:7f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Jun 24, 2021
Subject
CN=Sordum Software
Serial Number
3d:34:42:6b:94:3c:02:46:bb:2a:dd:6c:e2:9e:2a:e6
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 31, 2005 - Dec 31, 2025
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:84:d3:a8:ce:37:81:eb:57:f4:fd:87:7b:83:ae:b2
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 27, 2021 - Jun 28, 2032
Minor OS version
0
Major OS version
5
Entry point
90896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
setsockopt
ntohs
recvfrom
sendto
htons
select
listen
WSAStartup
bind
closesocket
connect
socket
send
WSACleanup
ioctlsocket
accept
WSAGetLastError
inet_addr
gethostbyname
gethostname
recv
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
mpr
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WNetUseConnectionW
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetQueryOptionW
InternetQueryDataAvailable
psapi
EnumProcesses
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcessModules
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile
LoadUserProfileW
kernel32
HeapAlloc
Sleep
GetCurrentThreadId
RaiseException
MulDiv
GetVersionExW
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
FindNextFileW
lstrcmpiW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
OutputDebugStringW
GetLocalTime
CompareStringW
CompareStringA
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
GetTempPathW
GetTempFileNameW
VirtualFree
FormatMessageW
GetExitCodeProcess
SetErrorMode
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
DeviceIoControl
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetComputerNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcessId
GetCurrentThread
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
LoadLibraryExW
HeapFree
WaitForSingleObject
CreateThread
DuplicateHandle
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameW
GetFullPathNameW
ExitProcess
ExitThread
GetSystemTimeAsFileTime
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
ResumeThread
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameA
HeapReAlloc
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
RtlUnwind
SetFilePointer
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetTickCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
EnumResourceNamesW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
ReleaseCapture
SetCapture
WindowFromPoint
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
CheckMenuRadioItem
CopyImage
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
PeekMessageW
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
GetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
MessageBoxW
DefWindowProcW
MoveWindow
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
GetMenuItemID
TranslateMessage
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
keybd_event
LoadImageW
GetWindowLongW
gdi32
DeleteObject
GetObjectW
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
BeginPath
Rectangle
GetDeviceCaps
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
SetViewportOrgEx
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegConnectRegistryW
RegEnumKeyExW
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
InitiateSystemShutdownExW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
CopySid
LogonUserW
GetTokenInformation
GetAclInformation
GetAce
AddAce
GetSecurityDescriptorDacl
shell32
DragQueryPoint
ShellExecuteExW
SHGetFolderPathW
DragQueryFileW
SHEmptyRecycleBinW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
StringFromCLSID
IIDFromString
StringFromIID
OleInitialize
CreateBindCtx
CLSIDFromProgID
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OleUninitialize
oleaut32
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SysAllocString
OleLoadPicture
SafeArrayGetVartype
SafeArrayDestroyData
SafeArrayAccessData
VarR8FromDec
VariantTimeToSystemTime
VariantClear
VariantCopy
VariantInit
SafeArrayDestroyDescriptor
LoadRegTypeLi
GetActiveObject
SafeArrayUnaccessData
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=178, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=525, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
tox tweaking/niggers/SCEWIN.zip
- SHA256 8940164c3e5cadab189d74ec93e08b0dc8cf3127e17d2e932f1ffea6f61045a3
- MD5 f49b1976130f583d26a45fb5af4d64e3
- SHA1 3fd75a948a0958b4efc0aa84ddbf161165c2ca34
- SHA512 05dd19d005652574fb2f92bf6d88e200570f6b419580a1a238a8f582212bd48264f3d46d78677adc7445fa4d4b9058e6245893a7ba89f3ac5cf6bdf4582da0b6
- SSDEEP 6144:0zibEQ0E5mbwLCGwkLmLiRBSsEeTp2T4TkwmZZGMIv6:02bEiywxPaeTppkw/Ms6
- MD5 SHA1 SHA512 SSDEEP
Export.bat
- SHA256 283d6ea32f1aa30985dc7ff1564e345ef62ca8193d764418b3031bbba82bb7da
- MD5 bf354baed02884dc4cf002db55818873
- SHA1 66475f4de3baf56280ead4fc7c1303f5acbad307
- SHA512 205c681c36b856f46c4cb91ae7adab2bd006c4950a660414dffd12ddafd23828d82a2128a19eef4cf05124a2b1237a8f1a3c50643479c91c0cef045df7c98134
- MD5 SHA1 SHA512
Import.bat
- SHA256 dc0f3e8f2d484742469d768266ca833fe7330d618770b628bcbaeb6bb40df6fd
- MD5 69ef99d985f7bc5e5e35471b251a84a3
- SHA1 36d08bc2cbf4cc6a1203fe1de18be71eac6a1cd2
- SHA512 f76067a1802be0dd45111ee85f9e69f989a716db962595b58898291ed3fd5178e0eb97c9c54742650b2969ab45184dedf6d8158975c93823c2b60117beec7b40
- MD5 SHA1 SHA512
SCEWIN_64.exe
- IMPHASH c6ad08a1589dd9cf353748c20ce378ce
- SHA256 2d78e7bb62fcab44c54fe853f51e8836ada45ea374027423bcb6d7a5db46502b
- MD5 d89e8173dc0b82d80add7451d4aa4622
- SHA1 578358cd958756b1786f30e913e4195c0003333c
- SHA512 cb5e4ebf895b5414b70caa243d032ec1d8820ff3aac155aa065a449f3a3f7ef0b01a29b006d49c69c8c1f8c11235742f0a453b120132942d32d310c7b2d3808a
- SSDEEP 6144:Jk/u4+ss7CVVs7DYebnaGSEM1JLCUdDcwDfTx1ZdeuLJzVpEKz7k32lobAYBhXcP:JTjC/s7DjkDZdeuLHuEm2ybAYBc/3+s
- MD5 SHA1 SHA512 SSDEEP
Digest
a0:4f:56:4e:4f:9b:a7:68:c9:b1:53:d9:6b:ae:32:32:e5:c1:99:ae:20:01:3d:d6:fd:62:2d:be:df:b4:f3:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 22, 2021
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
b9:96:37:58:ea:d2:36:c6:e1:5c:d4:8b:a5:43:3a:ae
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 21, 2020 - Sep 21, 2023
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
RaiseException
RtlPcToFileHeader
HeapSize
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
LoadLibraryExW
GetCommandLineA
GetProcessHeap
SetEndOfFile
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
GetSystemFirmwareTable
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
GetVersionExA
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
CreateFileA
DeviceIoControl
CreateNamedPipeA
ReadFile
CreateThread
LocalFree
GetLocalTime
DebugBreak
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointer
CreateFileW
WriteConsoleW
SetStdHandle
advapi32
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
shell32
ShellExecuteA
user32
SystemParametersInfoA
BlockInput
ExitWindowsEx
MessageBoxA
RegisterClassExA
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
wsprintfA
Name
.text
Size
523KB
Virtual Size
523KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=2, id=150, version=20413,
count=12, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
amifldrv64.sys
- IMPHASH 4fbdc03e4487f98fb59360ea5b3e640d
- SHA256 e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f
- MD5 e5e8ecb20bc5630414707295327d755e
- SHA1 06ecf73790f0277b8e27c8138e2c9ad0fc876438
- SHA512 f8949a43b5d0b08349b719daac12089fd94e824e307ae5265fd39885029a19a91d35a45dd3f3ff41cd0e3d563d4419d96221212d96b5a9a10e5ebe952dfb16aa
- SSDEEP 384:xv+wvxzpsQbQS5Z5OxV0HM2DecoLiZFnJtQSZsHLPK6jzHpNMbvFRJl6p+w:xvPvxtV5lgCM8eBLgJt6PKgDpNMPO
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
70:9a:b9:53:02:bb:44:c7:a7:da:fa:f3:42:ca:93:34:22:ea:03:ed:7b:49:2b:e2:04:a3:19:16:1f:eb:35:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Digest
c4:2f:ea:a6:c9:78:8b:71:61:b7:65:f7:25:07:02:04:f7:b5:e3:ec
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 11, 2020
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmMapIoSpace
MmMapLockedPagesSpecifyCache
IoAllocateMdl
MmAllocateContiguousMemory
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmGetPhysicalAddress
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
910B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=23, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
amigendrv64.sys
- IMPHASH 07a42e80559d960b176c0fc8fd309bfe
- SHA256 ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f
- MD5 7b9717c608a5f5a1c816128a609e9575
- SHA1 ec457a53ea03287cbbd1edcd5f27835a518ef144
- SHA512 4138ca89d0d74799ff10e512c247ea626846d107f0e054aef403adafeb7c7708415cb9e4ce7dbf0d168e98101f9faf5d5d3567ca7fc64406f72b1bd7a751664c
- SSDEEP 384:79TBPBgGLd6veRHilu/XWncQ528rQjX+kl811pZFnJtQSZsHLPK6jzE9bvFRrqP8:pFsvSClu/mRH8lklJt6PKg49Puti
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
51:67:b3:3a:95:b4:db:0a:12:44:cb:3b:95:d4:02:45:87:d9:a5:a9:52:22:ba:bb:03:32:10:e6:b1:11:d2:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Digest
60:55:db:c4:53:c1:11:e5:7c:85:ec:8c:fa:d9:e6:e1:14:21:c8:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 22, 2020
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
10
Entry point
36864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\AMIBIOS\Utility\AmiFlashDriver\AmiFlashDriverSrc\sys\x64\Release\amifldrv64.pdb
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
IoFreeMdl
MmGetPhysicalAddress
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeLowerIrql
KfRaiseIrql
MmBuildMdlForNonPagedPool
MmUnmapIoSpace
ObReferenceObjectByHandle
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
MmMapIoSpace
RtlCompareMemory
hal
HalTranslateBusAddress
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
508B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=33, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=5, id=259, version=24610,
count=4, id=262, version=24610,
count=4, id=260, version=24610,
count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=9, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
tox tweaking/niggers/SCEWIN_64.exe
- IMPHASH c6ad08a1589dd9cf353748c20ce378ce
- SHA256 2d78e7bb62fcab44c54fe853f51e8836ada45ea374027423bcb6d7a5db46502b
- MD5 d89e8173dc0b82d80add7451d4aa4622
- SHA1 578358cd958756b1786f30e913e4195c0003333c
- SHA512 cb5e4ebf895b5414b70caa243d032ec1d8820ff3aac155aa065a449f3a3f7ef0b01a29b006d49c69c8c1f8c11235742f0a453b120132942d32d310c7b2d3808a
- SSDEEP 6144:Jk/u4+ss7CVVs7DYebnaGSEM1JLCUdDcwDfTx1ZdeuLJzVpEKz7k32lobAYBhXcP:JTjC/s7DjkDZdeuLHuEm2ybAYBc/3+s
- MD5 SHA1 SHA512 SSDEEP
Digest
a0:4f:56:4e:4f:9b:a7:68:c9:b1:53:d9:6b:ae:32:32:e5:c1:99:ae:20:01:3d:d6:fd:62:2d:be:df:b4:f3:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 22, 2021
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
b9:96:37:58:ea:d2:36:c6:e1:5c:d4:8b:a5:43:3a:ae
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 21, 2020 - Sep 21, 2023
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
RaiseException
RtlPcToFileHeader
HeapSize
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
LoadLibraryExW
GetCommandLineA
GetProcessHeap
SetEndOfFile
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
GetSystemFirmwareTable
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
GetVersionExA
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
CreateFileA
DeviceIoControl
CreateNamedPipeA
ReadFile
CreateThread
LocalFree
GetLocalTime
DebugBreak
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointer
CreateFileW
WriteConsoleW
SetStdHandle
advapi32
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
shell32
ShellExecuteA
user32
SystemParametersInfoA
BlockInput
ExitWindowsEx
MessageBoxA
RegisterClassExA
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
wsprintfA
Name
.text
Size
523KB
Virtual Size
523KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=2, id=150, version=20413,
count=12, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
tox tweaking/niggers/SetACL.exe
- IMPHASH d4f9425f57877ed12395f309e063b715
- SHA256 4efc87b7e585fcbe4eaed656d3dbadaec88beca7f92ca7f0089583b428a6b221
- MD5 1fb64ff73938f4a04e97e5e7bf3d618c
- SHA1 aa0f7db484d0c580533dec0e9964a59588c3632b
- SHA512 da6007847ffe724bd0b0abe000b0dd5596e2146f4c52c8fe541a2bf5f5f2f5893dccd53ef315206f46a9285ddbd766010b226873038ccac7981192d8c9937ece
- SSDEEP 12288:3G2NBTh+l8gAqAbdsuEa3nZGSebY7o937bfJ9Ud:3xNBTYlaLdaynZGBc7orbJ9Ud
- MD5 SHA1 SHA512 SSDEEP
Digest
58:79:a5:f0:95:48:9a:59:4d:13:ba:ad:1b:d9:84:2a:dd:4e:29:7c:47:1b:d6:d8:4f:d2:2d:20:28:42:3c:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE
Chains
Jun 26, 2021
CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE
Serial Number
f9:28:d8:58:4a:73:ea:4b:0a:69:0d:b1:15:02:87:dd
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 11, 2018 - Dec 11, 2022
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
271480
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdb
ws2_32
WSAStartup
WSACleanup
secur32
GetUserNameExW
version
VerQueryValueW
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
activeds
ord13
kernel32
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalFree
FormatMessageA
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
SetLastError
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
SetEvent
CreateEventW
LoadLibraryExW
FormatMessageW
FreeLibrary
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetCurrentThreadId
GetFileSizeEx
WriteFile
SetFilePointerEx
CreateMutexW
ReleaseMutex
ResetEvent
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetModuleFileNameW
GetCPInfo
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
LCMapStringW
GetUserDefaultLCID
RtlUnwindEx
RtlPcToFileHeader
RaiseException
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
CompareStringW
GetFileType
HeapReAlloc
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
ReadFile
ReadConsoleW
WriteConsoleW
GetVersionExW
GetComputerNameW
GetUserDefaultLangID
FreeResource
LockResource
LoadResource
FindResourceW
CloseHandle
GetCurrentProcess
GetProcAddress
GetLastError
GetModuleHandleW
CompareFileTime
DeleteFileW
GetFileAttributesW
CreateDirectoryW
GetLocalTime
MoveFileExW
SetEndOfFile
user32
LoadStringW
advapi32
LookupAccountNameW
CopySid
ConvertSidToStringSidW
ConvertStringSidToSidW
IsValidSid
GetAclInformation
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetSecurityDescriptorControl
SetEntriesInAclW
MakeAbsoluteSD
ConvertStringSecurityDescriptorToSecurityDescriptorW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
RegCloseKey
LookupAccountSidW
GetSecurityDescriptorLength
AddAccessAllowedAce
AddAce
InitializeAcl
IsValidAcl
DeleteAce
MakeSelfRelativeSD
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetNamedSecurityInfoW
SetSecurityInfo
IsValidSecurityDescriptor
GetNamedSecurityInfoW
MapGenericMask
RegCreateKeyExW
RegOpenKeyExW
RegConnectRegistryW
RegEnumKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
EqualSid
IsWellKnownSid
GetLengthSid
GetKernelObjectSecurity
GetAce
ole32
CoSetProxyBlanket
CoInitialize
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoQueryProxyBlanket
oleaut32
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SysAllocString
VariantInit
VariantClear
SafeArrayGetLBound
SysAllocStringLen
SafeArrayGetUBound
SysFreeString
SysAllocStringByteLen
SysStringByteLen
netapi32
DsGetDcNameW
NetApiBufferFree
NetShareSetInfo
NetShareGetInfo
NetDfsGetClientInfo
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
Name
.text
Size
423KB
Virtual Size
423KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
136KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26715,
count=171, id=261, version=26715,
count=1, id=262, version=26715,
count=6, id=261, productName=VS2019 v16.8.2 build 29334, version=29334,
count=16, id=260, version=30034,
count=10, id=259, version=30034,
count=87, id=261, version=30034,
count=20, id=260, version=26715,
count=27, id=257, version=26715,
count=292, id=1, productName=Unmarked objects,
count=26, id=265, version=30037,
count=1, id=255, productName=VS2019 v16.10.0 build 30037, version=30037,
count=2, id=151,
count=1, id=258, productName=VS2019 v16.10.0 build 30037, version=30037,
tox tweaking/niggers/ToX.pow
- SHA256 9f3bc316417c8513d7d0daa62a661b94b67f267844b947ab7afc326ba784c38a
- MD5 3b370dd7d49048f73239a6cce253517e
- SHA1 a954c98c893217da650594148a9576567a59873b
- SHA512 3daf064bf73a1126552f125ebc3c45694d32a317ae3f7e11279dfbf6a51b2899d34be6b046ab98a8f47334c5424739d93eb9318f6db0c8bc27517095303e3886
- SSDEEP 192:tHyLNkJsebLVtFA/ity5tssfITKzgSSLV0hmH8ivv5L:tywA/i04UOKzm/vJ
- MD5 SHA1 SHA512 SSDEEP
tox tweaking/niggers/ToX3.nip
- SHA256 f17ce19aec1ea10899ada86340206f6506580b5e21feb802052e5706f430a786
- MD5 832c63a5df4d7ea4ce32bb435228a1e4
- SHA1 2b625b7aeeb725c7b051dd16d2796daade69933e
- SHA512 f37699d52801dd924f975000e94b31052017ef374733b9c3bcb2dfd257aa0314cdf26390fbcc30d725ce918eb7faa22650723edc17faa14ce53a48ce0e02ae60
- SSDEEP 96:PKIR8H1HOHOHwHZHTHhHwH5uHUH4HbHrHeHRpHuHAHbH4H6H+HEHBuH1HeH1HjH5:iIs1W2DIE
- MD5 SHA1 SHA512 SSDEEP
tox tweaking/niggers/Ultimate.pow
- SHA256 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
- MD5 9d1ead73e678fa2f51a70a933b0bf017
- SHA1 d205cbd6783332a212c5ae92d73c77178c2d2f28
- SHA512 935b3d516e996f6d25948ba8a54c1b7f70f7f0e3f517e36481fdf0196c2c5cfc2841f86e891f3df9517746b7fb605db47cdded1b8ff78d9482ddaa621db43a34
- MD5 SHA1 SHA512
tox tweaking/niggers/VC_redist.x64.exe
- IMPHASH 1a5cdbf711fee14b077e599d13fddab2
- SHA256 1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073
- MD5 a8a68bcc74b5022467f12587baf1ef93
- SHA1 046f00c519900fcbf2e6e955fc155b11156a733b
- SHA512 70a05bde549e5a973397cd77fe0c6380807cae768aa98454830f321a0de64bd0da30f31615ae6b4d9f0d244483a571e46024cf51b20fe813a6304a74bd8c0cc2
- SSDEEP 393216:Dwlp+dkBSuF2SfUfn6+eDl2ugjMoA+hxV33wsBH+Jh+5l+BvlOchteAHYhx9vy:DMp+Ty2SfUfnxk/kpsjlOchcEu2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5e:18:06:fe:03:84:bc:c9:9b:18:69:dd:02:f9:1c:4d:21:5e:1c:b6:9c:c2:01:d7:6c:82:c7:2b:73:76:55:23
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
5
Entry point
188525
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\8\s\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DecryptFileW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
GetMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
TranslateMessage
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
gdi32
CreateCompatibleDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
DeleteDC
shell32
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetCommandLineA
GetCPInfo
GetOEMCP
CloseHandle
CreateFileW
GetProcAddress
LocalFree
HeapSetInformation
GetLastError
GetModuleHandleW
FormatMessageW
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
Sleep
GetLocalTime
GetModuleFileNameW
ExpandEnvironmentStringsW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetFullPathNameW
CompareStringW
GetCurrentProcessId
WriteFile
SetFilePointer
LoadLibraryW
GetSystemDirectoryW
CreateFileA
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindClose
GetCommandLineW
GetCurrentDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
GetCurrentProcess
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetEnvironmentStringsW
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetNativeSystemInfo
GetModuleHandleExW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetComputerNameW
VerifyVersionInfoW
GetVolumePathNameW
GetDateFormatW
GetSystemDefaultLangID
GetUserDefaultLangID
GetStringTypeW
ReadFile
SetFilePointerEx
DuplicateHandle
InterlockedExchange
InterlockedCompareExchange
CreateEventW
ProcessIdToSessionId
OpenProcess
GetProcessId
WaitForSingleObject
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
InterlockedIncrement
InterlockedDecrement
ResetEvent
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
CreateFileMappingW
GetThreadLocale
IsValidCodePage
FreeEnvironmentStringsW
TlsAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DecodePointer
WriteConsoleW
GetModuleHandleA
GlobalAlloc
GlobalFree
GetFileSizeEx
CopyFileW
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
SetCurrentDirectoryW
FindFirstFileExW
GetFileType
GetACP
ExitProcess
GetStdHandle
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
SetLastError
LoadLibraryExA
rpcrt4
UuidCreate
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=19, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=337, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
tox tweaking/niggers/amifldrv64.sys
- IMPHASH 4fbdc03e4487f98fb59360ea5b3e640d
- SHA256 e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f
- MD5 e5e8ecb20bc5630414707295327d755e
- SHA1 06ecf73790f0277b8e27c8138e2c9ad0fc876438
- SHA512 f8949a43b5d0b08349b719daac12089fd94e824e307ae5265fd39885029a19a91d35a45dd3f3ff41cd0e3d563d4419d96221212d96b5a9a10e5ebe952dfb16aa
- SSDEEP 384:xv+wvxzpsQbQS5Z5OxV0HM2DecoLiZFnJtQSZsHLPK6jzHpNMbvFRJl6p+w:xvPvxtV5lgCM8eBLgJt6PKgDpNMPO
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
70:9a:b9:53:02:bb:44:c7:a7:da:fa:f3:42:ca:93:34:22:ea:03:ed:7b:49:2b:e2:04:a3:19:16:1f:eb:35:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Digest
c4:2f:ea:a6:c9:78:8b:71:61:b7:65:f7:25:07:02:04:f7:b5:e3:ec
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 11, 2020
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmMapIoSpace
MmMapLockedPagesSpecifyCache
IoAllocateMdl
MmAllocateContiguousMemory
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmGetPhysicalAddress
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
910B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=23, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
tox tweaking/niggers/amigendrv64.sys
- IMPHASH 07a42e80559d960b176c0fc8fd309bfe
- SHA256 ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f
- MD5 7b9717c608a5f5a1c816128a609e9575
- SHA1 ec457a53ea03287cbbd1edcd5f27835a518ef144
- SHA512 4138ca89d0d74799ff10e512c247ea626846d107f0e054aef403adafeb7c7708415cb9e4ce7dbf0d168e98101f9faf5d5d3567ca7fc64406f72b1bd7a751664c
- SSDEEP 384:79TBPBgGLd6veRHilu/XWncQ528rQjX+kl811pZFnJtQSZsHLPK6jzE9bvFRrqP8:pFsvSClu/mRH8lklJt6PKg49Puti
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
51:67:b3:3a:95:b4:db:0a:12:44:cb:3b:95:d4:02:45:87:d9:a5:a9:52:22:ba:bb:03:32:10:e6:b1:11:d2:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Digest
60:55:db:c4:53:c1:11:e5:7c:85:ec:8c:fa:d9:e6:e1:14:21:c8:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 22, 2020
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
10
Entry point
36864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\AMIBIOS\Utility\AmiFlashDriver\AmiFlashDriverSrc\sys\x64\Release\amifldrv64.pdb
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
IoFreeMdl
MmGetPhysicalAddress
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeLowerIrql
KfRaiseIrql
MmBuildMdlForNonPagedPool
MmUnmapIoSpace
ObReferenceObjectByHandle
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
MmMapIoSpace
RtlCompareMemory
hal
HalTranslateBusAddress
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
508B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=33, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=5, id=259, version=24610,
count=4, id=262, version=24610,
count=4, id=260, version=24610,
count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=9, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
tox tweaking/niggers/bfsvc.exe
- IMPHASH 4f5a2ab974ab5b0fcfe38aac2a4c390c
- SHA256 71bdc378d175b6b2df23f5f8d394e5e90805a4e0b3e346588dc7dfe14de3dcfa
- MD5 aec2ae40f01d8f2a9f159de1fdc4961d
- SHA1 6bb23e99504f2a01af96308cdd4908e5a0859432
- SHA512 268bda90710fcef2c6e22552968557afaa18aa1669de6d225c41ce919ed70539aed0d6fa7204282abcc7695226278c6f646fed886c256c9ca4c6e6f8760a9869
- SSDEEP 1536:p3MUZobpQ76GHedxqgX65XDd2QKXWmxYej4eBK0v:tSplGHevPX65XDdov+ejHoe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bfsvc.pdb
msvcrt
wcsstr
_wcsicmp
wcsnlen
__iob_func
_wcslwr
memcpy
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
wcsncmp
exit
swprintf_s
fwprintf
_vsnwprintf_s
fflush
wcschr
wcsrchr
_wcsnicmp
_vsnwprintf
__set_app_type
__wgetmainargs
_snwscanf_s
_amsg_exit
_XcptFilter
memset
rpcrt4
UuidCreate
imagehlp
CheckSumMappedFile
ntdll
NtEnumerateBootEntries
NtQueryDirectoryObject
NtOpenDirectoryObject
NtTranslateFilePath
NtQueryBootOptions
NtQueryBootEntryOrder
NtQueryValueKey
NtQuerySymbolicLinkObject
NtOpenKey
NtOpenSymbolicLinkObject
RtlImpersonateSelf
NtOpenThreadTokenEx
NtOpenProcessTokenEx
NtAdjustPrivilegesToken
RtlFreeHeap
RtlAllocateHeap
NtSetInformationFile
LdrAccessResource
LdrFindResource_U
NtOpenFile
NtQueryInformationThread
NtQueryInformationFile
RtlImageNtHeader
NtDeviceIoControlFile
NtSetInformationThread
NtReadFile
NtOpenProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtClose
RtlInitUnicodeString
NtWriteFile
NtQuerySystemInformation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
TerminateProcess
GetCurrentProcessId
OpenProcessToken
GetStartupInfoW
GetCurrentProcess
OpenThreadToken
GetCurrentThreadId
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-file-l1-1-0
GetFullPathNameW
GetLongPathNameW
FlushFileBuffers
DeleteFileW
GetVolumeInformationW
FindFirstFileW
GetFileSizeEx
CreateDirectoryW
FindNextFileW
WriteFile
SetFileInformationByHandle
GetFileAttributesW
SetFileAttributesW
FindClose
GetVolumePathNameW
GetFileInformationByHandle
CreateFileW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileSectionW
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l2-1-0
MoveFileExW
CopyFileExW
GetFileInformationByHandleEx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathRemoveBackslashW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorSacl
GetTokenInformation
AdjustTokenPrivileges
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-security-provider-l1-1-0
SetNamedSecurityInfoW
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
Name
.text
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=64, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=30795,
count=3, id=259, version=30795,
count=20, id=260, version=30795,
count=261, id=1, productName=Unmarked objects,
count=9, id=257, version=30795,
count=38, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
tox tweaking/niggers/cru.zip
- SHA256 4f93f3610b78250ab53246caa22b2d7ae7cce9739ea0e8df604fa225f5a0a868
- MD5 01c221c599723c00bc8677753b16d0f2
- SHA1 a2b43dcb34476d1ef88dc23c7161b08a5b1ef9e0
- SHA512 8e367a9a4d7325620bdbdf248f360a09bd534334266b4548deca147396ef2dd3596b4f82bb162bf8f51c63d70ebae39595c3111c8d10f8cc706bef5058db61da
- SSDEEP 12288:vU2GOb7WLU7etmMFICZ2zCclvvjCJoxnxnxwyz7:vUWFrMFIsOr79Tz7
- MD5 SHA1 SHA512 SSDEEP
CRU/CRU.exe
- IMPHASH cafc89e1b0a9b2c5b10389d6d19936ce
- SHA256 0351a943ca93558ff36f74c3f0c768dceb724e833e282abcf1be5b2e71d5c67b
- MD5 0f69af48c32613f73c6acb87a7d18661
- SHA1 0756ae84f3b58aec29f4b9a2888624ca879f7856
- SHA512 2b30c079831a30683aabc0effa6bb60c84a960c2bcda1ce5da204bebc2050a359ec2cf36df426a0d227165afb9c4b9401fd0316b2504394c7876ed177fff2377
- SSDEEP 24576:tLEWuIj9T0gR1U2vfVD8sA15qkJ1K3mbDQca9L32GY:twfIj9T0ujvTO6L3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5004
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegFlushKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
CloseHandle
CompareStringA
CreateEventA
CreateFileA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
FindClose
FindFirstFileA
FindResourceA
FormatMessageA
FreeLibrary
FreeResource
GetACP
GetCPInfo
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetEnvironmentStrings
GetFileAttributesA
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetThreadLocale
GetTickCount
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAddAtomA
GlobalDeleteAtom
GlobalFindAtomA
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LockResource
MulDiv
MultiByteToWideChar
RaiseException
ReadFile
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
SizeofResource
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcpyA
lstrcpynA
lstrlenA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
comctl32
ImageList_Add
ImageList_BeginDrag
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_Replace
ImageList_SetBkColor
ImageList_SetIconSize
ImageList_Write
_TrackMouseEvent
ImageList_Create
comdlg32
GetOpenFileNameA
GetSaveFileNameA
gdi32
BitBlt
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateFontIndirectA
CreateHalftonePalette
CreatePalette
CreatePenIndirect
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
ExcludeClipRect
ExtTextOutA
GetBitmapBits
GetBrushOrgEx
GetClipBox
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetObjectA
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextExtentPoint32A
GetTextMetricsA
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
MoveToEx
PatBlt
RealizePalette
RectVisible
Rectangle
RestoreDC
RoundRect
SaveDC
SelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetPixel
SetROP2
SetStretchBltMode
SetTextColor
SetViewportOrgEx
SetWindowOrgEx
StretchBlt
UnrealizeObject
user32
ActivateKeyboardLayout
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcA
CharLowerA
CharNextA
CharToOemA
CheckDlgButton
CheckMenuItem
ClientToScreen
CreateIcon
CreateMenu
CreatePopupMenu
CreateWindowExA
DefFrameProcA
DefMDIChildProcA
DefWindowProcA
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextA
EnableMenuItem
EnableScrollBar
EnableWindow
EndPaint
EnumChildWindows
EnumThreadWindows
EnumWindows
EqualRect
FillRect
FindWindowA
FrameRect
GetActiveWindow
GetCapture
GetClassInfoA
GetClassLongA
GetClientRect
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyNameTextA
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyboardState
GetKeyboardType
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMenuStringA
GetMessagePos
GetParent
GetPropA
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetTopWindow
GetWindow
GetWindowDC
GetWindowLongA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
InflateRect
InsertMenuA
InsertMenuItemA
IntersectRect
InvalidateRect
IsChild
IsDialogMessageA
IsDialogMessageW
IsDlgButtonChecked
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowUnicode
IsWindowVisible
IsZoomed
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
LoadKeyboardLayoutA
LoadStringA
MapVirtualKeyA
MapWindowPoints
MessageBoxA
OemToCharA
OffsetRect
PeekMessageA
PeekMessageW
PostMessageA
PostQuitMessage
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ScreenToClient
ScrollWindow
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClassLongA
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemInfoA
SetParent
SetPropA
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowsHookExA
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UpdateWindow
WaitMessage
WindowFromPoint
wsprintfA
GetSystemMetrics
oleaut32
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit
@$xp$28Vistaaltfixunit@TVistaAltFix
@Vistaaltfixunit@Finalization$qqrv
@Vistaaltfixunit@Register$qqrv
@Vistaaltfixunit@TVistaAltFix@
@Vistaaltfixunit@TVistaAltFix@$bctr$qqrp18Classes@TComponent
@Vistaaltfixunit@TVistaAltFix@$bdtr$qqrv
@Vistaaltfixunit@TVistaAltFix@VistaWithTheme$qqrv
@Vistaaltfixunit@initialization$qqrv
_AddCEADataForm
_AddDIDDataForm
_AudioFormatForm
_AudioFormatListForm
_ColorimetryForm
_CommonForm
_DIDDetailedResolutionListForm
_DetailedResolutionForm
_DisplayForm
_ExtensionBlockForm
_FreeSyncRangeForm
_HDMI2SupportForm
_HDMIResolutionForm
_HDMISupportForm
_HDRStaticMetadataForm
_PropertiesForm
_SpeakerSetupForm
_StandardResolutionForm
_TVResolutionForm
_TVResolutionListForm
_TiledDisplayTopologyForm
_VideoCapabilityForm
__GetExceptDLLinfo
___CPPdebugHook
Name
.text
Size
784KB
Virtual Size
788KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
164KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
290KB
Virtual Size
290KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CRU/Info.txt
- SHA256 61350ce9d700627a156845dfee77c44703280b16fd30bc1c216bffc1cc82c0a1
- MD5 df95acfba3051d021ec94e47726bbd07
- SHA1 a93d201d828f003864639d356f3993ef27d475a5
- SHA512 30d5361d53b6f0a653c657010fd95f3ffaa24b6f018fd411666a5a23a49167f7fa0c0bc98a487d7c65698f78bd5f7f183089eb39dc6f28c5923140a4d0a6e57b
- MD5 SHA1 SHA512
CRU/reset-all.exe
- IMPHASH 32f33abb2edf5d9be4310f0050d459d0
- SHA256 70639c195430afb92799d711ed784406bfdfd04c648d5f3e4d9873da0063660b
- MD5 3d47586c62bf61dac639d8cc1bf43ee7
- SHA1 36f605e1fb7cae972c6723ded6a5f126f36a8d01
- SHA512 638a75c0159de8553e8071a68b5a4355bfc002489d9ed62bfbb1019d287073a555133bd4a55abd68c51b3e2a1616f586a26998ce32ade322cd72ffeab5ffe105
- SSDEEP 768:Jd0XBRNU+hV81e14G8xGvMhBmqVHhc6ZrLy01fA5Egt2rHNZAEDFn27DQNE5B:b0XbeQ8xG0Kqjc6lLFfSortZBMDu8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
advapi32
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegDeleteTreeW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
kernel32
TlsFree
FlushFileBuffers
GetLastError
HeapFree
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
GetCurrentThreadId
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
HeapSize
IsProcessorFeaturePresent
HeapReAlloc
SetStdHandle
WriteConsoleW
CreateFileW
CloseHandle
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=90, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=2, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
CRU/restart.exe
- IMPHASH cf4f510acda53bad738cb1d4e01b1c70
- SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
- MD5 8242ce426ad462eff02edae1487a6949
- SHA1 9a4f382d427e0de729053535aaa3310cac5f087b
- SHA512 aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
- SSDEEP 768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14313
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapSize
IsProcessorFeaturePresent
HeapReAlloc
RtlUnwind
CompareStringW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
SetStdHandle
GetStringTypeW
WideCharToMultiByte
WriteConsoleW
CreateFileW
IsWow64Process
GetModuleFileNameW
Sleep
CreateProcessW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetStartupInfoW
TerminateProcess
OpenProcess
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetLastError
HeapFree
HeapAlloc
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCommandLineW
HeapSetInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
HeapCreate
ExitProcess
WriteFile
GetStdHandle
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
FlushFileBuffers
user32
SetWindowPlacement
GetWindowRect
EnumWindows
GetWindowPlacement
SetWindowPos
ShowWindow
IsWindowVisible
SetForegroundWindow
DialogBoxParamW
OpenInputDesktop
FindWindowW
GetClientRect
CloseDesktop
EndDialog
FindWindowExW
MessageBoxW
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
GetShellWindow
PostMessageW
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegRenameKey
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueW
CreateProcessWithTokenW
OpenProcessToken
RegSetValueExW
setupapi
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
479KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=14, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=99, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=124, id=1, productName=Unmarked objects,
count=4, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
CRU/restart64.exe
- IMPHASH 2a69fe822ced9bf301916c1307e497a9
- SHA256 5f779bb822aedaf5bd11693cdf73f6c7c3342f37371a78c07c2aca1e15dbfd00
- MD5 297aa19bade534a791d053ca190b74ad
- SHA1 15cb6a33994f75fe9e30a2afbc8a7e4616b63962
- SHA512 df883950c598f31b81f22a68b2a9fed7459dcad5084ec6e39399658b0492bcc458d9fc5bb80fda6bc994bed3241f969fc67a0b8e021fb82b040455d64776c625
- SSDEEP 1536:8vXMJl7uRupZzidl/T+Dnx86Rpy4roKsIrryeq3OTM:8vMJl6RAZu/T+7x8qpRM8rNcOTM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
15380
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
HeapSize
HeapReAlloc
CompareStringW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
SetStdHandle
GetStringTypeW
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
WriteConsoleW
CreateFileW
IsWow64Process
GetModuleFileNameW
Sleep
CreateProcessW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetStartupInfoW
TerminateProcess
OpenProcess
GetCurrentProcess
QueryPerformanceCounter
GetFileType
SetHandleCount
LCMapStringW
EnterCriticalSection
GetLastError
HeapFree
HeapAlloc
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
DecodePointer
HeapSetInformation
GetVersion
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FlushFileBuffers
user32
SetWindowPlacement
GetWindowRect
EnumWindows
GetWindowPlacement
SetWindowPos
ShowWindow
IsWindowVisible
SetForegroundWindow
DialogBoxParamW
OpenInputDesktop
FindWindowW
GetClientRect
CloseDesktop
EndDialog
FindWindowExW
MessageBoxW
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
GetShellWindow
PostMessageW
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegRenameKey
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueW
CreateProcessWithTokenW
OpenProcessToken
RegSetValueExW
setupapi
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
521KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=95, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=124, id=1, productName=Unmarked objects,
count=4, id=174, version=40219,
count=1, id=255, version=25028,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
tox tweaking/niggers/devcon.exe
- IMPHASH ce4a5cfcfb0452b87e013f07f4d59f9c
- SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
- MD5 3904d0698962e09da946046020cbcb17
- SHA1 edae098e7e8452ca6c125cf6362dda3f4d78f0ae
- SHA512 c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea
- SSDEEP 1536:MP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7W:MePOYe4bu1epDh8RW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
29456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
devcon.pdb
advapi32
OpenProcessToken
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownExW
RegCloseKey
CloseServiceHandle
OpenSCManagerW
OpenServiceW
RegDeleteValueW
RegSetValueExW
kernel32
GetCurrentProcess
FormatMessageW
lstrlenW
GetLastError
CloseHandle
LocalFree
GetDateFormatW
FreeLibrary
LoadLibraryW
FileTimeToSystemTime
GetProcAddress
GetFullPathNameW
FindFirstFileW
GetFileAttributesW
FindClose
FindNextFileW
GetWindowsDirectoryW
Sleep
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
msvcrt
wcschr
_wcsicmp
towlower
_wcsnicmp
fputs
__iob_func
wcsrchr
fputws
?terminate@@YAXXZ
memset
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
wprintf
??2@YAPEAX_K@Z
towupper
??3@YAXPEAX@Z
iswalpha
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ole32
CLSIDFromString
setupapi
SetupScanFileQueueW
SetupDiGetClassDevsExW
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiClassNameFromGuidExW
CM_Reenumerate_DevNode_Ex
SetupCopyOEMInfW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetINFClassW
CM_Disconnect_Machine
SetupDiBuildClassInfoListExW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
CM_Connect_MachineW
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
SetupDiBuildDriverInfoList
SetupDiGetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiSetSelectedDriverW
SetupGetStringFieldW
CM_Get_Res_Des_Data_Size_Ex
SetupDiEnumDriverInfoW
CM_Free_Log_Conf_Handle
CM_Get_Device_ID_ExW
CM_Get_Next_Res_Des_Ex
SetupCloseFileQueue
SetupDiGetDriverInstallParamsW
CM_Get_Res_Des_Data_Ex
SetupDiOpenClassRegKeyExW
SetupCloseInfFile
SetupOpenFileQueue
SetupDiCallClassInstaller
SetupDiDestroyDriverInfoList
SetupOpenInfFileW
CM_Free_Res_Des_Handle
CM_Get_First_Log_Conf_Ex
SetupDiSetDeviceInstallParamsW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW
SetupDiGetClassDescriptionExW
SetupDiClassGuidsFromNameExW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDeviceInfoListExW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
user32
CharNextW
CharPrevW
LoadStringW
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=176, id=1, productName=Unmarked objects,
count=64, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
tox tweaking/niggers/file.zip
- SHA256 51d1d0f6c2634d66ca2405170a94a5210eb5215b3228e3b9047a61aea7d0e772
- MD5 71e23f60e5f4ac2240b626428cc91a86
- SHA1 6d75b40b56415fe7dca299194cd36bf3a2844b1d
- SHA512 a64b09dae9e74f72495fb0d394230aa253964df70097c61359fe2ed3d601964773be6a4d02b239651f98beb8b7ffbb24b3972f20f3e80e9c2c905f1e33570439
- SSDEEP 6144:0zibE/0E5mbwLCGwkLmLiRBSsEeTp2T4TkwmZZGMIvP:02bE/ywxPaeTppkw/MsP
- MD5 SHA1 SHA512 SSDEEP
Export.bat
- SHA256 4b1cd4bf80557c80689d6f06b15e63a3f6a3ff66db3d8bebe237d86d82cb6e46
- MD5 deb75f2d9aa4afdc7ad4796778a80bb9
- SHA1 6df26d15bd72ba548c06b908772e836c998bf208
- SHA512 474e3e25c632989ff72e3822c89b9864d4172647b78d1df8d7af70f211e48308dc33065ccaf091f52f9a160f337c82c5ed791b9323e3cc81cf31d9d87c0e4ac6
- MD5 SHA1 SHA512
Import.bat
- SHA256 dc0f3e8f2d484742469d768266ca833fe7330d618770b628bcbaeb6bb40df6fd
- MD5 69ef99d985f7bc5e5e35471b251a84a3
- SHA1 36d08bc2cbf4cc6a1203fe1de18be71eac6a1cd2
- SHA512 f76067a1802be0dd45111ee85f9e69f989a716db962595b58898291ed3fd5178e0eb97c9c54742650b2969ab45184dedf6d8158975c93823c2b60117beec7b40
- MD5 SHA1 SHA512
SCEWIN_64.exe
- IMPHASH c6ad08a1589dd9cf353748c20ce378ce
- SHA256 2d78e7bb62fcab44c54fe853f51e8836ada45ea374027423bcb6d7a5db46502b
- MD5 d89e8173dc0b82d80add7451d4aa4622
- SHA1 578358cd958756b1786f30e913e4195c0003333c
- SHA512 cb5e4ebf895b5414b70caa243d032ec1d8820ff3aac155aa065a449f3a3f7ef0b01a29b006d49c69c8c1f8c11235742f0a453b120132942d32d310c7b2d3808a
- SSDEEP 6144:Jk/u4+ss7CVVs7DYebnaGSEM1JLCUdDcwDfTx1ZdeuLJzVpEKz7k32lobAYBhXcP:JTjC/s7DjkDZdeuLHuEm2ybAYBc/3+s
- MD5 SHA1 SHA512 SSDEEP
Digest
a0:4f:56:4e:4f:9b:a7:68:c9:b1:53:d9:6b:ae:32:32:e5:c1:99:ae:20:01:3d:d6:fd:62:2d:be:df:b4:f3:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 22, 2021
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
b9:96:37:58:ea:d2:36:c6:e1:5c:d4:8b:a5:43:3a:ae
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 21, 2020 - Sep 21, 2023
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
RaiseException
RtlPcToFileHeader
HeapSize
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
LoadLibraryExW
GetCommandLineA
GetProcessHeap
SetEndOfFile
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
GetSystemFirmwareTable
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
GetVersionExA
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
CreateFileA
DeviceIoControl
CreateNamedPipeA
ReadFile
CreateThread
LocalFree
GetLocalTime
DebugBreak
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointer
CreateFileW
WriteConsoleW
SetStdHandle
advapi32
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
shell32
ShellExecuteA
user32
SystemParametersInfoA
BlockInput
ExitWindowsEx
MessageBoxA
RegisterClassExA
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
wsprintfA
Name
.text
Size
523KB
Virtual Size
523KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=2, id=150, version=20413,
count=12, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
amifldrv64.sys
- IMPHASH 4fbdc03e4487f98fb59360ea5b3e640d
- SHA256 e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f
- MD5 e5e8ecb20bc5630414707295327d755e
- SHA1 06ecf73790f0277b8e27c8138e2c9ad0fc876438
- SHA512 f8949a43b5d0b08349b719daac12089fd94e824e307ae5265fd39885029a19a91d35a45dd3f3ff41cd0e3d563d4419d96221212d96b5a9a10e5ebe952dfb16aa
- SSDEEP 384:xv+wvxzpsQbQS5Z5OxV0HM2DecoLiZFnJtQSZsHLPK6jzHpNMbvFRJl6p+w:xvPvxtV5lgCM8eBLgJt6PKgDpNMPO
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
70:9a:b9:53:02:bb:44:c7:a7:da:fa:f3:42:ca:93:34:22:ea:03:ed:7b:49:2b:e2:04:a3:19:16:1f:eb:35:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Digest
c4:2f:ea:a6:c9:78:8b:71:61:b7:65:f7:25:07:02:04:f7:b5:e3:ec
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 11, 2020
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmMapIoSpace
MmMapLockedPagesSpecifyCache
IoAllocateMdl
MmAllocateContiguousMemory
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmGetPhysicalAddress
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
910B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=23, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
amigendrv64.sys
- IMPHASH 07a42e80559d960b176c0fc8fd309bfe
- SHA256 ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f
- MD5 7b9717c608a5f5a1c816128a609e9575
- SHA1 ec457a53ea03287cbbd1edcd5f27835a518ef144
- SHA512 4138ca89d0d74799ff10e512c247ea626846d107f0e054aef403adafeb7c7708415cb9e4ce7dbf0d168e98101f9faf5d5d3567ca7fc64406f72b1bd7a751664c
- SSDEEP 384:79TBPBgGLd6veRHilu/XWncQ528rQjX+kl811pZFnJtQSZsHLPK6jzE9bvFRrqP8:pFsvSClu/mRH8lklJt6PKg49Puti
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
51:67:b3:3a:95:b4:db:0a:12:44:cb:3b:95:d4:02:45:87:d9:a5:a9:52:22:ba:bb:03:32:10:e6:b1:11:d2:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Digest
60:55:db:c4:53:c1:11:e5:7c:85:ec:8c:fa:d9:e6:e1:14:21:c8:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 22, 2020
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 30, 2017 - Sep 24, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
10
Entry point
36864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\AMIBIOS\Utility\AmiFlashDriver\AmiFlashDriverSrc\sys\x64\Release\amifldrv64.pdb
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocateContiguousMemory
MmFreeContiguousMemory
IoAllocateMdl
IoFreeMdl
MmGetPhysicalAddress
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeLowerIrql
KfRaiseIrql
MmBuildMdlForNonPagedPool
MmUnmapIoSpace
ObReferenceObjectByHandle
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
MmMapIoSpace
RtlCompareMemory
hal
HalTranslateBusAddress
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
508B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=33, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=5, id=259, version=24610,
count=4, id=262, version=24610,
count=4, id=260, version=24610,
count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=9, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
tox tweaking/niggers/oldversion.txt
- SHA256 8efd1e02fd412a9b96560bbc0d5d77e8b0577b76218c268a81b3c0afa7ad756e
- MD5 4dd46fda72d17b8fc715c15ff667cddd
- SHA1 b24cb3ca2612def7b19d7ebde93b8782325c8d5d
- SHA512 f3117865632a9412f5477b3ab4af4ce777d7da44a3559e7a8dd7808eb565fdca4eafb25f2b13548cdfd11fb65bdb02affb7a2feb8a7de61dc1dafd9a2685dd44
- MD5 SHA1 SHA512
tox tweaking/niggers/openshell.exe
- IMPHASH e7430d879d98b61bb54478ef2eeb197c
- SHA256 31e616f27fad0c9b14a22c02ded2dc524411abf53d72c4136f22db1be0156865
- MD5 cf93ef6708b8026ff44e5dfe26d6d387
- SHA1 8b1666ce02c032cbdc1a7afcd1e9395a892da386
- SHA512 9d30881098f283bf478b56267623f3d4559ca7554fabdaf777458dec1368a4d6d84b8bd7ff0982060aeea85c69f8d160b2afcfbe5bbbffb2d425bc2a8dd63f52
- SSDEEP 196608:4A+K5NrULkCZNxUmPYLWDYqqaUeqA923VnJEhqY1TUmPYbWDi2r:4A1rUIMNWmQaD/t7GVnJErwmQqDx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\projects\open-shell-menu\build\bin\Release\Setup.pdb
kernel32
SizeofResource
GetCurrentProcess
WriteFile
SetEnvironmentVariableW
WaitForSingleObject
CreateFileW
GetVersion
LockResource
DeleteFileW
CloseHandle
LoadResource
FindResourceW
GetProcAddress
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetCPInfo
OutputDebugStringW
MultiByteToWideChar
GetLastError
WideCharToMultiByte
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
LCMapStringW
user32
LoadStringW
MessageBoxW
shell32
DoEnvironmentSubstW
CommandLineToArgvW
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7.8MB
Virtual Size
7.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=142, id=261, version=30795,
count=20, id=260, version=30795,
count=18, id=260, version=32420,
count=21, id=259, version=32420,
count=48, id=261, version=32420,
count=9, id=257, version=30795,
count=104, id=1, productName=Unmarked objects,
count=4, id=265, version=32535,
count=1, id=255, version=32535,
count=1, id=151,
count=1, id=258, version=32535,
tox tweaking/niggers/openshell.reg
- SHA256 bf88401dcd9d330bdcc94fcef478dbc7f13692c68e9be61f3edfd3af32eab08d
- MD5 59b7a903df1feecdaf2883fc3c7ac50e
- SHA1 17a57d108449eee4184c4b098e7e1c985723e90d
- SHA512 6bedbc8ef7f2bb182eef0ff923344da247b3d8659e168b1b5a647fbc22e7c24a8a7a43c35de6be71225fcaf2d2594f18f3a9e2350d8046d6ab36a1713b142039
- SSDEEP 384:qo2GakFAkiR04ia0i5Afv/wAk5JzV46JJl06JgzAf3JJDJwf6+QAWQeSAk67AX0s:HakFesM5owKy10CZJZEcTJukhft441HU
- MD5 SHA1 SHA512 SSDEEP
tox tweaking/niggers/procexp.exe
- IMPHASH 553433ab8c22c54672a94bfb04f1fc03
- SHA256 0f2081ebd2ef0baafdd699dbd1b77853a35b50943418ed6207f896599f41084c
- MD5 b5e7689f66866281c26503b58733d834
- SHA1 efeee983af571f5e3e519935ec385225274d05e2
- SHA512 a327d38c63049e7973df5668af07dded5dbe386e094c1e27af97059be3056bcf512293197837c514964a3d4009d6ea80d2a859de054b8be401f8d101dcc60e14
- SSDEEP 49152:xygKkss5FYpJ1vU5LdVa2d0JbASq6lFPYhVBHxuzIS:YgKYYz185LdY4UUxuv
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
83:6f:6d:0a:21:ee:4a:4d:f1:16:c6:ed:bf:45:77:ad:16:5b:8f:74:64:47:de:5e:c9:06:c3:31:fb:8d:d8:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
638277
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\agent\1\s\exe\Win32\Release\procexp.pdb
shlwapi
SHAutoComplete
ColorHLSToRGB
ColorRGBToHLS
StrStrIW
ord176
StrCmpIW
UrlUnescapeW
iphlpapi
GetExtendedTcpTable
GetExtendedUdpTable
ws2_32
WSAStartup
getservbyport
ntohs
htonl
ntohl
htons
gethostbyaddr
mpr
WNetGetConnectionW
comctl32
ImageList_ReplaceIcon
ImageList_Add
InitCommonControlsEx
ImageList_Destroy
ImageList_DrawEx
ord17
PropertySheetW
ImageList_Create
CreateStatusWindowW
ord413
ImageList_GetIcon
ord410
CreatePropertySheetPageW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
credui
CredUIPromptForCredentialsW
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
crypt32
CertDuplicateCertificateContext
CertGetNameStringW
aclui
ord1
powrprof
SetSuspendState
IsPwrSuspendAllowed
IsPwrHibernateAllowed
wtsapi32
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
WTSDisconnectSession
WTSLogoffSession
WTSSendMessageW
uxtheme
EnableThemeDialogTexture
ntdll
NtOpenThread
NtQuerySystemInformation
NtSetInformationProcess
NtQueryObject
NtCreateKey
NtOpenKey
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
NtQuerySymbolicLinkObject
NtQuerySemaphore
NtQueryEvent
NtResumeProcess
NtQueryInformationProcess
NtQueryInformationThread
NtSuspendProcess
RtlDestroyQueryDebugBuffer
NtSuspendThread
NtLoadDriver
NtResumeThread
NtOpenSymbolicLinkObject
NtQueryMutant
NtQuerySection
RtlUnwind
gdi32
RectInRegion
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetTextColor
GetStockObject
Polyline
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
CreateFontIndirectW
GetTextExtentPoint32W
SetTextAlign
ExtTextOutW
GetTextExtentExPointW
LineTo
Rectangle
RestoreDC
SaveDC
SetROP2
MoveToEx
CreateBitmap
GetDeviceCaps
GetBkMode
GetBkColor
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
GetObjectW
CreateDIBSection
GetTextMetricsW
comdlg32
GetSaveFileNameW
ChooseFontW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError
ChooseColorW
FindTextW
kernel32
GetLastError
SetErrorMode
InitializeCriticalSection
Sleep
GetCurrentProcess
ExitThread
TlsAlloc
TlsSetValue
CreateProcessW
OpenProcess
GetVersion
GetSystemWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsWow64Process
GetSystemWow64DirectoryW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageA
lstrlenW
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstFileW
GetFileAttributesW
GetPrivateProfileStringW
FreeLibrary
LoadLibraryExW
ReadFile
SetUnhandledExceptionFilter
FindClose
FindNextFileW
LeaveCriticalSection
EnterCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateThread
GetExitCodeThread
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetLastError
GetVersionExW
GetFileSizeEx
LoadLibraryW
GetTickCount
MulDiv
GlobalAddAtomW
FormatMessageW
GetCommandLineW
GetFileType
LocalAlloc
TerminateThread
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalLock
WriteFile
Module32NextW
DeleteCriticalSection
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
IsBadStringPtrW
OpenEventW
GetEnvironmentVariableW
ReadProcessMemory
lstrcmpiW
SearchPathW
DeleteFileW
SetFilePointer
GetCurrentProcessId
IsProcessorFeaturePresent
GetSystemDirectoryW
VirtualQueryEx
ResumeThread
GetThreadContext
Thread32First
Thread32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
IsBadReadPtr
TerminateProcess
SetPriorityClass
ProcessIdToSessionId
GetProcessId
GlobalMemoryStatusEx
GetLogicalProcessorInformation
GlobalFree
SetProcessWorkingSetSize
PulseEvent
GetComputerNameW
WTSGetActiveConsoleSessionId
GetCurrentDirectoryW
GetDriveTypeW
OutputDebugStringW
DuplicateHandle
DeviceIoControl
VirtualAlloc
VirtualFree
IsProcessInJob
CreateJobObjectW
QueryInformationJobObject
GetThreadGroupAffinity
SetThreadGroupAffinity
GlobalMemoryStatus
GetProcessAffinityMask
SetProcessAffinityMask
GetProcessWorkingSetSize
GetActiveProcessorGroupCount
GetActiveProcessorCount
WideCharToMultiByte
K32GetModuleFileNameExW
K32QueryWorkingSet
K32GetMappedFileNameW
DecodePointer
RaiseException
InitializeCriticalSectionEx
GetNativeSystemInfo
ExpandEnvironmentStringsA
LoadLibraryExA
GetStartupInfoW
GetStringTypeW
GetCurrentThreadId
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitializeSListHead
TlsFree
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetConsoleCP
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
GetLongPathNameW
GetFullPathNameW
GetFileTime
GetFileSize
FileTimeToLocalFileTime
CreateFileW
ExpandEnvironmentStringsW
ReadConsoleW
SetEnvironmentVariableW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetStdHandle
TlsGetValue
EncodePointer
LCMapStringEx
GetCPInfo
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetEndOfFile
WriteConsoleW
CloseHandle
Module32FirstW
UnhandledExceptionFilter
MultiByteToWideChar
user32
RedrawWindow
WindowFromPoint
CheckMenuRadioItem
DrawIconEx
IsDialogMessageW
LockWorkStation
IsHungAppWindow
PeekMessageW
SendMessageTimeoutW
CheckRadioButton
GetDlgCtrlID
MsgWaitForMultipleObjects
GetDesktopWindow
GetWindow
GetGuiResources
LoadBitmapW
CopyImage
EndMenu
SetMenuInfo
GetMenuInfo
TrackPopupMenu
RemoveMenu
CreateMenu
DrawMenuBar
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
GetDlgItemTextW
CreateDialogParamW
SetLayeredWindowAttributes
IsWindow
PostQuitMessage
ExitWindowsEx
DispatchMessageW
TranslateMessage
GetMessageW
DrawEdge
RegisterWindowMessageW
EndTask
GetWindowDC
SetMenuItemInfoW
IsIconic
ShowWindowAsync
KillTimer
GetMonitorInfoW
MonitorFromPoint
EnumWindows
SetClassLongW
ClientToScreen
GetWindowTextW
InvalidateRgn
TrackPopupMenuEx
ModifyMenuW
AppendMenuW
GetMenuItemCount
GetMenuItemID
EnableMenuItem
CreatePopupMenu
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetWindowPlacement
LoadIconW
SetWindowPlacement
DefMDIChildProcW
DefFrameProcW
DefDlgProcW
CreateIconIndirect
FrameRect
IsWindowVisible
DestroyWindow
GetClassNameW
EnumChildWindows
PtInRect
UnionRect
CopyRect
ScreenToClient
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DrawFrameControl
ChildWindowFromPoint
DialogBoxParamW
MoveWindow
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetScrollInfo
SetScrollInfo
GetClassLongW
SetWindowLongW
GetWindowLongW
OffsetRect
IntersectRect
InflateRect
FillRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetCursorPos
GetWindowRect
SendMessageW
WaitForInputIdle
ShowWindow
SetFocus
ReleaseCapture
GetSystemMetrics
GetMenu
CheckMenuItem
GetSubMenu
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
ValidateRect
InvalidateRect
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
UpdateWindow
DrawTextW
SetTimer
SetCapture
GetCapture
GetKeyState
GetFocus
InsertMenuW
DeleteMenu
SetForegroundWindow
MessageBoxW
SetCursor
FindWindowW
FindWindowExW
GetWindowThreadProcessId
LoadCursorW
DestroyIcon
LoadImageW
EnumDisplaySettingsW
GetDC
ReleaseDC
SetWindowPos
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetParent
SetDlgItemTextW
PostMessageW
LoadStringW
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
DuplicateTokenEx
EqualSid
FreeSid
GetTokenInformation
CopySid
GetLengthSid
QueryServiceConfigW
ImpersonateLoggedOnUser
AddAccessAllowedAce
AddAce
CreateRestrictedToken
GetAce
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
RevertToSelf
LookupAccountSidW
InitializeAcl
IsValidSid
SetTokenInformation
GetSecurityInfo
SetSecurityInfo
LsaFreeMemory
OpenProcessToken
LsaOpenPolicy
LsaEnumerateAccountRights
ConvertSidToStringSidW
FlushTraceW
RegConnectRegistryW
CreateProcessAsUserW
GetKernelObjectSecurity
SetKernelObjectSecurity
LookupPrivilegeNameW
EnumServicesStatusExW
RegQueryValueExA
RegOpenKeyExA
ProcessTrace
LookupAccountNameW
LookupPrivilegeValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
OpenTraceW
ControlTraceW
StartTraceW
SetServiceObjectSecurity
QueryServiceObjectSecurity
MapGenericMask
RegCreateKeyW
LsaClose
RegCloseKey
StartServiceW
QueryServiceStatus
RegEnumValueW
RegLoadKeyW
RegOpenKeyW
ControlService
QueryServiceConfig2W
OpenServiceW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
RegDeleteValueW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueW
RegUnLoadKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
CloseTrace
shell32
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteW
SHBrowseForFolderW
Shell_NotifyIconW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFolderPathW
SHGetFileInfoW
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoSetProxyBlanket
CoInitialize
CoMarshalInterThreadInterfaceInStream
oleaut32
SafeArrayGetElement
SysAllocStringLen
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantInit
VariantClear
VariantChangeType
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
winhttp
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
Name
.text
Size
802KB
Virtual Size
801KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
201KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=27412,
count=191, id=261, version=27412,
count=19, id=260, version=30034,
count=25, id=259, version=30034,
count=89, id=261, version=30034,
count=29, id=260, version=27412,
count=3, id=262, version=27412,
count=1, id=263, version=27412,
count=49, id=257, version=27412,
count=662, id=1, productName=Unmarked objects,
count=3, id=260, productName=VS2019 v16.10.0 build 30037, version=30037,
count=64, id=261, productName=VS2019 v16.10.0 build 30037, version=30037,
count=1, id=255, productName=VS2019 v16.10.0 build 30037, version=30037,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.10.0 build 30037, version=30037,
tox tweaking/niggers/servers.txt
- SHA256 b6ac5bc39377e44ee783dff946f6703a994f5eb31a438e69dc0735b40060d2e8
- MD5 1f681635c89df401ef18598ffe3a0694
- SHA1 a09a968bf05a50058f3ad50132730b719bc39e76
- SHA512 f90f12b2c910e8796772a4fa2edb17c13a02b467c6f14270a544e9e681e5b3790aaa3896a0b8d6512537f7aed4cf7e32937af4b24ea6099d74c906ce97399480
- MD5 SHA1 SHA512
tox tweaking/niggers/str.exe
- IMPHASH 51b4d6245ba673d7bc7bbd32358b03fc
- SHA256 fe3cdbe2e332e48921ffa2a9697a66f71472d878154ba331d12adc7e7c767a2b
- MD5 958aa10581a9b1c402c5fac81ddf258f
- SHA1 fa26a7cc9259be2ac11a20bed78916bf2e545516
- SHA512 c4f8d93e2443d199d9aabb65abc3597487fcf48b83366e66fe88ebd48993cd9c5054a76526b02a58190981022750b1e93bc66451abaa2e79ae379709e9ed2d84
- SSDEEP 1536:WOjZxDRK/Quc5dnl04DG/jjhdja+RjmvXXY87eFj9PzHlVVU00:fz9KouYnl04DGekjmvIoe9nUB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
93008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\TimerResolution\TimerResolution\SetTimerResolution\x64\Release\SetTimerResolution.pdb
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryTimerResolution
NtSetTimerResolution
kernel32
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
Process32FirstW
CloseHandle
FreeConsole
LoadLibraryW
GetProcAddress
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
msvcp140
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xbad_alloc@std@@YAXXZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
memmove
memcpy
_CxxThrowException
memcmp
memchr
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__current_exception_context
__current_exception
_purecall
__std_terminate
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_c_exit
_cexit
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
__p___argv
terminate
_initterm
_seh_filter_exe
__p___argc
_initterm_e
_exit
exit
_set_app_type
api-ms-win-crt-math-l1-1-0
__setusermatherr
ceilf
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=31935,
count=3, id=259, version=31935,
count=28, id=261, version=31935,
count=6, id=257, version=31935,
count=5, id=257, version=30795,
count=146, id=1, productName=Unmarked objects,
count=1, id=265, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
tox tweaking/niggers/version.txt
- SHA256 093c73a18d8cf5ed3accf9694c802e2fefaf64d6f349ae857c7bdae313682fb9
- MD5 40d093a047ca107409feb2120563ae62
- SHA1 aeaf78fb28d62d91600294ce1bae2ffcd2f2d1a7
- SHA512 5e66fa6dea6191b72b5d81da893a8d788b95c66eb972f51c212ba67a56e265801a8c87e25b17b8f119f8149d26df693839bfe5df4e84ded28eaf6f6f401549fc
- MD5 SHA1 SHA512
tox tweaking/readme.txt
- SHA256 8df786a8bab253d236f632fb95033f038395232120dcc7780cc0cfaca47c7269
- MD5 aaf9d54e64fcdcb5e4b940e5a73f7347
- SHA1 50ec74f451317ef0fb217fbca3802b8b480f8fec
- SHA512 4c6668d3110105489f91043e85978f29863ef17edd2e98c18cdbe02612c8b1504c7b18ce72467eba34c6d3d8297e04eed152866f04ebb1c4d174432fa3c3536d
- MD5 SHA1 SHA512