exm.zip
- SHA256 9cc9678578270690295e1e26ae50c1d3f6647d36650fe3ecfcd3c1db763d4eff
Overview
overview
10Static
static
3Autoruns/Autoruns.exe
windows7-x64
3Autoruns/Autoruns.exe
windows10-2004-x64
3Autoruns/A...64.exe
windows7-x64
3Autoruns/A...64.exe
windows10-2004-x64
3Autoruns/A...4a.exe
windows7-x64
Autoruns/A...4a.exe
windows10-2004-x64
Autoruns/autoruns.chm
windows7-x64
1Autoruns/autoruns.chm
windows10-2004-x64
1Autoruns/a...sc.exe
windows7-x64
3Autoruns/a...sc.exe
windows10-2004-x64
3Autoruns/a...64.exe
windows7-x64
3Autoruns/a...64.exe
windows10-2004-x64
3Autoruns/a...4a.exe
windows7-x64
Autoruns/a...4a.exe
windows10-2004-x64
EXMservice.exe
windows7-x64
7EXMservice.exe
windows10-2004-x64
10FortniteSe...gs.exe
windows7-x64
7FortniteSe...gs.exe
windows10-2004-x64
7NvidiaProf...or.exe
windows7-x64
1NvidiaProf...or.exe
windows10-2004-x64
1WindowsUpd...ub.exe
windows7-x64
10WindowsUpd...ub.exe
windows10-2004-x64
10WindowsUpd...64.exe
windows7-x64
10WindowsUpd...64.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
Autoruns/Autoruns.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Autoruns/Autoruns.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Autoruns/Autoruns64.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Autoruns/Autoruns64.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
Autoruns/Autoruns64a.exe
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Autoruns/Autoruns64a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Autoruns/autoruns.chm
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Autoruns/autoruns.chm
Resource
win10v2004-20250314-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Autoruns/autorunsc.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
Autoruns/autorunsc.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Autoruns/autorunsc64.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Autoruns/autorunsc64.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
Autoruns/autorunsc64a.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Autoruns/autorunsc64a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
EXMservice.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
EXMservice.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
57 signatures
150 seconds
Behavioral task
behavioral17
Sample
FortniteSettings/FortniteSettings.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
FortniteSettings/FortniteSettings.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
NvidiaProfileInspector/nvidiaProfileInspector.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
NvidiaProfileInspector/nvidiaProfileInspector.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
WindowsUpdateBlocker/Wub.exe
Resource
win7-20241023-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
WindowsUpdateBlocker/Wub.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
WindowsUpdateBlocker/Wub_x64.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
WindowsUpdateBlocker/Wub_x64.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target exm.zip
- Size 34.4MB
- Sample250318-samvgsymt5
- SHA256 9cc9678578270690295e1e26ae50c1d3f6647d36650fe3ecfcd3c1db763d4eff
- MD5 da21f8ec79eb535a331d2a895cef7ef9
- SHA1 b74b2aa321175ab5132dacbdd15cb046cc65adc8
- SHA512 331c5b1dc3514b929c00c10775448899aade61f46900038bf7e9ef15f74435e7646e32e181add9f3da8063b5621765d05c895d91f344a8a455c0f8bad439cfde
- SSDEEP 786432:S3MHSELiCe3nEneNaCiPYf5RNdrxSxRaUHVRUJPyv3Ut+NgXjy3ge:S3HELiP3ExALNdtSfnHVRr+of
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/EXMservice.exe pyinstaller static1/unpack001/FortniteSettings/FortniteSettings.exe pyinstaller - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/EXMservice.exe unpack001/FortniteSettings/FortniteSettings.exe unpack001/NvidiaProfileInspector/nvidiaProfileInspector.exe
File Explorer
-
exm.zip.zip 34.4MB
-
Autoruns/Autoruns.exe.exe 1.7MB
-
Autoruns/Autoruns64.exe.exe 1.9MB
-
Autoruns/Autoruns64a.exe2.0MB
-
Autoruns/Eula.txt7KB
-
Autoruns/autoruns.chm.chm 24KB
-
Autoruns/autorunsc.exe.exe 701KB
-
Autoruns/autorunsc64.exe.exe 784KB
-
Autoruns/autorunsc64a.exe807KB
-
EXMservice.exe.exe 21.7MB
-
main.pyc758B
-
FortniteSettings/FortniteSettings.exe.exe 9.3MB
-
FortniteSettingsManager.pyc11KB
-
NvidiaProfileInspector/Exm_Premium_Profile_V4.nip684KB
-
NvidiaProfileInspector/Reference.xml.xml 213KB
-
NvidiaProfileInspector/nv.config.xml 158B
-
NvidiaProfileInspector/nvidiaProfileInspector.exe.exe 535KB
-
PowerPlan/Exm_Premium_Power_Plan_V3.pow12KB
-
WindowsUpdateBlocker/Wub.exe.exe 791KB
-
WindowsUpdateBlocker/Wub.ini97KB
-
WindowsUpdateBlocker/Wub_x64.exe.exe 939KB
Autoruns/Autoruns.exe
- IMPHASH ee7d0ec49c38d4f4d12574e449f1a355
- SHA256 6111a70da65153e6ded71eae2057bf6760f340476261f6e15a80479daf9724eb
- MD5 17bd13edd536269c417ba8e1b4534fbe
- SHA1 22470bb3a4c37a0c612ff7ad2596306065ac0c9b
- SHA512 00d8c80dcfdda235d06160b40d06e47bd0be5178c5fb2b26bf4cd984eae520d877517a16d1a62d88ed1f0a46244eafd4cc4b4183a35f85d13b250e492d441455
- SSDEEP 12288:5nhZrVs162LpM5mzIhM6jl8/yX0Chz8rgRO6u2TdimrfZetCvmKT6IQViL/MW5b8:s0qQhMIX0e8uOR2xZnkiYWZk3
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
bf:30:20:a0:42:0e:26:5e:60:73:43:49:b4:41:b7:ed:c7:d8:97:fa:20:fc:38:12:03:a5:93:53:98:4e:0d:cb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 14, 2025
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
519821
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\1\s\Win32\Release\Autoruns.pdb
kernel32
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetConsoleCP
ExitProcess
VirtualProtect
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetSystemTimeAsFileTime
FlushFileBuffers
QueryPerformanceCounter
LCMapStringEx
InitOnceBeginInitialize
InitOnceComplete
AcquireSRWLockShared
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetFullPathNameW
GetNativeSystemInfo
IsWow64Process
GetFileTime
QueryDosDeviceW
GetLogicalDrives
SearchPathW
K32GetMappedFileNameW
WaitForMultipleObjects
CreateSemaphoreW
CreateEventW
SetEnvironmentVariableW
FindClose
FindNextFileW
FindFirstFileW
ReleaseSemaphore
SetEvent
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
FileTimeToLocalFileTime
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetSystemWindowsDirectoryW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
ReadFile
WriteConsoleW
LocalAlloc
GetFileType
GetStdHandle
GetVersionExW
GetTickCount64
GetSystemDirectoryW
TerminateThread
CreateThread
WaitForSingleObject
WideCharToMultiByte
OpenProcess
Sleep
ExpandEnvironmentStringsW
GetStartupInfoW
CreateProcessW
GetCommandLineW
VerifyVersionInfoW
GetComputerNameW
lstrcmpW
LocalFree
VirtualQuery
GetCurrentProcessId
VerSetConditionMask
MoveFileW
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
GetNumberFormatEx
GetLocaleInfoW
GetTimeFormatW
GlobalAlloc
GetDateFormatW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetFileInformationByHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
MultiByteToWideChar
lstrcmpiW
LoadLibraryExW
ReadConsoleW
SetThreadPriority
GetCurrentThread
DecodePointer
SetCurrentDirectoryW
FormatMessageW
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
GetThreadId
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
GetModuleFileNameW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GlobalLock
GlobalUnlock
user32
CloseClipboard
SendMessageW
SetClipboardData
EmptyClipboard
IsRectEmpty
EnumDisplaySettingsW
FindWindowExW
FindWindowW
SetForegroundWindow
WaitForInputIdle
IsDlgButtonChecked
CheckDlgButton
EnableWindow
GetDlgItemTextW
DestroyMenu
SetMenuItemInfoW
GetSysColor
LoadImageW
DialogBoxIndirectParamW
OpenClipboard
DrawIconEx
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetFocus
GetFocus
SetTimer
KillTimer
DrawTextW
BeginPaint
EndPaint
InvalidateRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
MonitorFromPoint
IsDialogMessageW
CheckMenuRadioItem
GetWindowThreadProcessId
GetDesktopWindow
SetRectEmpty
SetRect
WindowFromPoint
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
MessageBeep
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenuEx
DeleteMenu
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
CreatePopupMenu
GetMenuStringW
SetMenu
GetMenu
TranslateAcceleratorW
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetActiveWindow
CharLowerW
GetDlgCtrlID
DialogBoxParamW
CreateDialogParamW
SetWindowPlacement
GetWindowPlacement
IsMenu
PostQuitMessage
GetMessagePos
DrawFrameControl
DrawEdge
TrackMouseEvent
RegisterWindowMessageW
LoadStringA
EnumChildWindows
MessageBoxW
LoadMenuW
LoadAcceleratorsW
CharNextW
DestroyWindow
IsWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
LoadIconW
GetDlgItem
GetWindow
MapWindowPoints
GetWindowRect
SetDlgItemTextW
EndDialog
GetAncestor
GetWindowModuleFileNameW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
SetClassLongW
PtInRect
OffsetRect
InflateRect
CopyRect
FrameRect
FillRect
DrawFocusRect
ScreenToClient
ShowScrollBar
SetScrollPos
RedrawWindow
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
GetSystemMetrics
IsWindowEnabled
IsZoomed
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
IsChild
PostMessageW
GetSysColorBrush
LoadCursorW
GetParent
SetWindowLongW
GetWindowLongW
gdi32
SetBkColor
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
ExtTextOutW
SetViewportOrgEx
CreateFontIndirectW
SetBkMode
SetTextColor
GetObjectW
CreateSolidBrush
CreatePen
GetDeviceCaps
GetStockObject
GetTextExtentPoint32W
LineTo
Rectangle
SetTextAlign
MoveToEx
TextOutW
Polyline
CreateBitmap
CreatePatternBrush
ExcludeClipRect
PatBlt
CreateDIBSection
SetBrushOrgEx
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
Polygon
GetCurrentObject
comdlg32
PrintDlgW
ChooseFontW
FindTextW
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegEnumKeyExW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
RegLoadMUIStringW
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceConfig2W
GetServiceDisplayNameW
CryptDestroyHash
RegGetValueW
RegOpenKeyW
RegCreateKeyW
RegRenameKey
RegEnumValueW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
CloseServiceHandle
ConvertStringSidToSidW
LookupAccountSidW
RegCopyTreeW
RegDeleteTreeW
RegQueryValueExW
ConvertSidToStringSidW
RegLoadKeyW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CryptReleaseContext
shell32
ShellExecuteW
SHEvaluateSystemCommandTemplate
SHGetStockIconInfo
ExtractIconExW
SHGetKnownFolderPath
ExtractAssociatedIconW
CommandLineToArgvW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromGUID2
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
StgCreateStorageEx
StgOpenStorageEx
CoTaskMemAlloc
oleaut32
SysStringLen
VariantClear
VarUI4FromStr
SysFreeString
SysAllocString
VariantInit
shlwapi
SHCreateStreamOnFileW
SHAutoComplete
comctl32
ImageList_Destroy
ImageList_DrawIndirect
ImageList_GetImageCount
ImageList_Create
ImageList_WriteEx
ImageList_Read
ImageList_GetIcon
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_GetIconSize
ImageList_Duplicate
ImageList_DrawEx
CreateStatusWindowW
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_AddMasked
ImageList_Draw
uxtheme
IsThemeActive
SetWindowTheme
IsAppThemed
msimg32
GradientFill
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
dwmapi
DwmSetWindowAttribute
DwmDefWindowProc
winhttp
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpConnect
crypt32
CertGetNameStringW
Name
.text
Size
720KB
Virtual Size
720KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
211KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
727KB
Virtual Size
726KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=30795,
count=180, id=261, version=30795,
count=19, id=260, version=32420,
count=26, id=259, version=32420,
count=95, id=261, version=32420,
count=29, id=265, version=32535,
count=25, id=260, version=30795,
count=1, id=262, version=30795,
count=33, id=257, version=30795,
count=531, id=1, productName=Unmarked objects,
count=2, id=260, version=32535,
count=50, id=261, version=32535,
count=1, id=255, version=32535,
count=1, id=151,
count=1, id=258, version=32535,
Autoruns/Autoruns64.exe
- IMPHASH 4b05847b4dcacb7d4c02d8fdd78d6b50
- SHA256 f59056339de56820e57c961d6ddd9032bd78af9f2333797944f4ee57b77ee2ca
- MD5 6ae8e963b33ee52df761412b451b2962
- SHA1 f7ab1987848a91af2c77a72583211dcadeed420a
- SHA512 472f07bb37966d056d9efb97e4b686951987ca358a9f213fa6db5ec50cf4a32084cb18c863c8c1add20a2619154cf9f4705541e27c196142917eb9491b54846a
- SSDEEP 24576:qU8EqexVDmS0d1ARkxDRlzmYj0tYC/5JReKq1QMcXEkb9fzTXJe:qHEqexVDmSOxxDI5JRhMIFT4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ea:ae:ce:db:cf:43:3c:f5:8b:9a:8a:39:89:c6:a3:1e:d8:f5:b4:9f:59:9c:4f:30:e5:c4:23:1e:9d:5e:a8:9d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 14, 2025
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
642404
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\x64\Release\Autoruns64.pdb
kernel32
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetConsoleCP
ExitProcess
VirtualProtect
GetSystemInfo
RtlUnwind
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwindEx
RtlPcToFileHeader
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetSystemTimeAsFileTime
FlushFileBuffers
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
QueryPerformanceCounter
LCMapStringEx
InitOnceBeginInitialize
InitOnceComplete
AcquireSRWLockShared
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetFullPathNameW
GetNativeSystemInfo
IsWow64Process
GetFileTime
QueryDosDeviceW
GetLogicalDrives
SearchPathW
K32GetMappedFileNameW
WaitForMultipleObjects
CreateSemaphoreW
CreateEventW
SetEnvironmentVariableW
FindClose
FindNextFileW
FindFirstFileW
ReleaseSemaphore
SetEvent
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
FileTimeToLocalFileTime
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetSystemWindowsDirectoryW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
ReadFile
WriteConsoleW
LocalAlloc
GetFileType
GetStdHandle
GetVersionExW
GetTickCount64
GetSystemDirectoryW
TerminateThread
CreateThread
WaitForSingleObject
WideCharToMultiByte
OpenProcess
Sleep
ExpandEnvironmentStringsW
GetStartupInfoW
CreateProcessW
GetCommandLineW
VerifyVersionInfoW
GetComputerNameW
lstrcmpW
LocalFree
VirtualQuery
GetCurrentProcessId
VerSetConditionMask
MoveFileW
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
GetNumberFormatEx
GetLocaleInfoW
GlobalAlloc
GetTimeFormatW
GetDateFormatW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetFileInformationByHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
ReadConsoleW
MultiByteToWideChar
lstrcmpiW
LoadLibraryExW
SetThreadPriority
GetCurrentThread
DecodePointer
SetCurrentDirectoryW
FormatMessageW
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
GetThreadId
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
GetModuleFileNameW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GlobalLock
GlobalUnlock
user32
SetClipboardData
CloseClipboard
OpenClipboard
DialogBoxIndirectParamW
IsRectEmpty
EnumDisplaySettingsW
FindWindowExW
FindWindowW
SetForegroundWindow
WaitForInputIdle
IsDlgButtonChecked
DestroyMenu
SetMenuItemInfoW
GetSysColor
LoadImageW
EmptyClipboard
SendMessageW
DrawIconEx
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetFocus
GetFocus
SetTimer
KillTimer
DrawTextW
BeginPaint
EndPaint
InvalidateRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
CheckDlgButton
EnableWindow
GetDlgItemTextW
MonitorFromPoint
IsDialogMessageW
CheckMenuRadioItem
GetWindowThreadProcessId
GetDesktopWindow
SetRectEmpty
SetRect
WindowFromPoint
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
MessageBeep
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenuEx
DeleteMenu
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
CreatePopupMenu
GetMenuStringW
SetMenu
GetMenu
TranslateAcceleratorW
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetActiveWindow
CharLowerW
GetDlgCtrlID
DialogBoxParamW
CreateDialogParamW
SetWindowPlacement
GetWindowPlacement
IsMenu
PostQuitMessage
GetMessagePos
DrawFrameControl
DrawEdge
TrackMouseEvent
RegisterWindowMessageW
LoadStringA
EnumChildWindows
MessageBoxW
LoadMenuW
LoadAcceleratorsW
CharNextW
DestroyWindow
IsWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
LoadIconW
GetDlgItem
GetWindow
MapWindowPoints
GetWindowRect
SetDlgItemTextW
EndDialog
GetAncestor
GetWindowModuleFileNameW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
SetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
InflateRect
CopyRect
FrameRect
FillRect
DrawFocusRect
ScreenToClient
ShowScrollBar
SetScrollPos
RedrawWindow
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
GetSystemMetrics
IsWindowEnabled
IsZoomed
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
IsChild
PostMessageW
GetSysColorBrush
LoadCursorW
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
gdi32
CreateFontIndirectW
SetViewportOrgEx
ExtTextOutW
SetBkColor
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SetBkMode
SetTextColor
GetObjectW
CreateSolidBrush
CreatePen
GetDeviceCaps
GetStockObject
GetTextExtentPoint32W
LineTo
Rectangle
SetTextAlign
MoveToEx
TextOutW
Polyline
CreateBitmap
CreatePatternBrush
ExcludeClipRect
GetCurrentObject
PatBlt
Polygon
SetBrushOrgEx
SetMapMode
EndDoc
StartPage
EndPage
StartDocW
CreateDIBSection
comdlg32
FindTextW
PrintDlgW
ChooseFontW
ReplaceTextW
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegSetValueExW
CryptDestroyHash
GetServiceDisplayNameW
QueryServiceConfig2W
AdjustTokenPrivileges
LookupPrivilegeValueW
RegLoadMUIStringW
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
RegCloseKey
RegCreateKeyExW
RegGetValueW
RegOpenKeyW
RegCreateKeyW
RegRenameKey
RegEnumValueW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
CloseServiceHandle
ConvertStringSidToSidW
LookupAccountSidW
RegCopyTreeW
RegDeleteTreeW
RegQueryValueExW
ConvertSidToStringSidW
RegLoadKeyW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
shell32
SHGetKnownFolderPath
SHEvaluateSystemCommandTemplate
CommandLineToArgvW
ShellExecuteExW
SHGetStockIconInfo
ExtractIconExW
ShellExecuteW
ExtractAssociatedIconW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
StgCreateStorageEx
StgOpenStorageEx
CLSIDFromString
oleaut32
VarUI4FromStr
VariantInit
VariantClear
SysStringLen
SysAllocString
SysFreeString
shlwapi
SHAutoComplete
SHCreateStreamOnFileW
comctl32
ImageList_DrawIndirect
ImageList_DrawEx
ImageList_GetIconSize
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Read
ImageList_WriteEx
ImageList_Create
ImageList_GetImageCount
ImageList_Draw
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_Duplicate
CreateStatusWindowW
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_Destroy
uxtheme
IsThemeActive
SetWindowTheme
IsAppThemed
msimg32
GradientFill
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
dwmapi
DwmSetWindowAttribute
DwmDefWindowProc
winhttp
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpConnect
crypt32
CertGetNameStringW
Name
.text
Size
845KB
Virtual Size
844KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
271KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
43KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
727KB
Virtual Size
726KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=180, id=261, version=30795,
count=18, id=260, version=32420,
count=12, id=259, version=32420,
count=98, id=261, version=32420,
count=29, id=265, version=32535,
count=22, id=260, version=30795,
count=1, id=262, version=30795,
count=33, id=257, version=30795,
count=538, id=1, productName=Unmarked objects,
count=2, id=260, version=32535,
count=50, id=261, version=32535,
count=1, id=255, version=32535,
count=1, id=151,
count=1, id=258, version=32535,
Autoruns/Autoruns64a.exe
- SHA256 d6aee475688b942a2ea49ba4cc5c73ca97191ad91d7d8c2e4a57e07dcf9c9ba6
- MD5 d518661b0940e2464aa8d3073599ab89
- SHA1 66be7b41b80477d7ea0045319a08362253d08097
- SHA512 e12967de56c1e514c22adeac308c87b2ee12d86055fb3b4e456db29bb653254cc96715afc3b701ff21c5137b2223a67bbb84a08fd05bfd15f199bdb6ab24e915
- SSDEEP 12288:2ypw7n7rV3lzyNzvOdBFAijmciVjJEa2K54uWjseVCAR1RadyOBTG3M4EbK2AwZV:2ymsLOdAi2Jl4uvIvEBTG/wZZG/rjM
- MD5 SHA1 SHA512 SSDEEP
Autoruns/Eula.txt
- SHA256 8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a
- MD5 8c24c4084cdc3b7e7f7a88444a012bfc
- SHA1 5ab806618497189342722d42dc382623ac3e1b55
- SHA512 6c74bed85638871fd834b30183e1536e48512dd0f8471624732ac1b487f0eba34dec99f88d2d583335f66df543d5fabf4b8c9456255df2248a4c086f111f0baa
- SSDEEP 192:RCVPxjERdQe/lb9iLbRvhSXH3DsDw3zF55Mz6h:RcFERdXlRiLbujuw3zF55jh
- MD5 SHA1 SHA512 SSDEEP
Autoruns/autoruns.chm
- SHA256 ecb58342290940a5eb6b72be6faa1d0afeec9df5898df3e026d75b7b08bd8f9a
- MD5 2c099793584365b8897fca7a4fa397e8
- SHA1 50eaf2f529b1e923f7d0238ea8d3eb2187ad19cf
- SHA512 ae407cd6b2d6ddf033f04b19ddf168423f819a4a42834afe03b7c35f86dd7b6572ced6c325fd9a56eacc9613944c4f3d17831d15713a35f0ea24f4c4c14af0ce
- SSDEEP 384:h2Svimo+ByfYV9H27NbyQhxEj4sbHxQpHgQkOx:h2Svimo+h8RrSjnHupAQkE
- MD5 SHA1 SHA512 SSDEEP
Autoruns/autorunsc.exe
- IMPHASH b41d6e6ce42874adf85f48ff789bfa9b
- SHA256 bfbcf41b4659a4f371d434fc92b0f13bd46cfb82b74910633e900008765bd6da
- MD5 1d4611e03d8f32ae08cf8ade9a958729
- SHA1 a8a3504eaf57a7d640bd42b5d59d2b8afa3e5f33
- SHA512 b3114eb005aa1f5f855d86d846099d43b61bbc7353d3acec241a79b691f69080474d356d9e414dfb65036c9a36751d9839fef15f8115ea391e906a841eb52ea4
- SSDEEP 12288:6p7RGU8Fyh5h1nRoKWoS+ajSUwDeFHvOfKf:6p8rqH1nuKWoS+9DUvdf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c5:b0:8e:d3:4f:03:0f:e9:d9:36:8f:14:df:64:2b:72:fa:b9:38:47:70:b5:f7:82:f3:de:fa:fc:c5:f9:4c:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 14, 2025
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
266882
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\1\s\Win32\Release Console\autorunsc.pdb
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
comctl32
ImageList_ReplaceIcon
ImageList_Add
crypt32
CryptSIPLoad
CryptSIPRetrieveSubjectGuidForCatalogFile
CertGetNameStringW
CertDuplicateCertificateContext
wintrust
CryptCATAdminCalcHashFromFileHandle
ntdll
RtlUnwind
NtOpenKey
NtCreateKey
kernel32
GetSystemWow64DirectoryW
FormatMessageA
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
FreeLibrary
MultiByteToWideChar
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
SetThreadPriority
CreateThread
GetTimeFormatW
FindResourceExW
LoadResource
LockResource
IsWow64Process
FindResourceW
InitializeSRWLock
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetStringTypeW
SetFilePointerEx
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetFileTime
FlushFileBuffers
LCMapStringW
CompareStringW
GetCommandLineA
FreeLibraryAndExitThread
SetStdHandle
GetConsoleCP
GetModuleHandleExW
ExitProcess
TlsFree
EncodePointer
RaiseException
OutputDebugStringW
WideCharToMultiByte
GetSystemWindowsDirectoryW
GetVersion
OpenProcess
TlsSetValue
TlsAlloc
ExitThread
GetCurrentProcess
InitializeCriticalSection
SetErrorMode
WriteFile
GetLongPathNameW
SizeofResource
GetFileSize
ExpandEnvironmentStringsW
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
MulDiv
GetModuleHandleW
FileTimeToLocalFileTime
LoadLibraryW
InitializeSListHead
GetProcAddress
Sleep
GetLastError
ReadFile
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CloseHandle
GetFileSizeEx
LoadLibraryExW
GetVersionExW
SetLastError
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetFullPathNameW
SetEnvironmentVariableW
TlsGetValue
GetModuleFileNameW
LocalFree
LocalAlloc
GetCommandLineW
GetFileType
GetConsoleOutputCP
GetStdHandle
SetEndOfFile
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetExitCodeThread
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
TryAcquireSRWLockExclusive
user32
GetSysColorBrush
InflateRect
LoadCursorW
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetMenu
CheckMenuItem
GetSubMenu
InsertMenuW
SendMessageW
MessageBoxW
GetParent
SetDlgItemTextW
PostMessageW
LoadStringW
DestroyIcon
LoadIconW
DeleteMenu
gdi32
DeleteObject
EndPage
StartPage
EndDoc
StartDocW
SetMapMode
GetDeviceCaps
DeleteDC
CreateCompatibleDC
comdlg32
PrintDlgW
advapi32
RegOpenKeyExW
QueryServiceConfig2W
GetServiceDisplayNameW
RegQueryValueW
RegUnLoadKeyW
RegQueryInfoKeyW
RegLoadKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteKeyW
LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExW
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
shell32
SHGetFileInfoW
SHGetFolderPathW
ShellExecuteW
ole32
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SysAllocStringByteLen
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantClear
VariantChangeType
shlwapi
ord176
UrlUnescapeW
winhttp
WinHttpGetProxyForUrl
WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryHeaders
Name
.text
Size
413KB
Virtual Size
412KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
136KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=175, id=261, version=30795,
count=61, id=261, version=32420,
count=19, id=260, version=32420,
count=22, id=259, version=32420,
count=26, id=260, version=30795,
count=2, id=262, version=30795,
count=31, id=257, version=30795,
count=319, id=1, productName=Unmarked objects,
count=3, id=260, version=32535,
count=33, id=261, version=32535,
count=1, id=255, version=32535,
count=1, id=151,
count=1, id=258, version=32535,
Autoruns/autorunsc64.exe
- IMPHASH 065a7e996133a13a5e539ef6d19c7a5a
- SHA256 110651323222353e13588adcf82f7a21faa51422a251033a4e1163b9e95ae08a
- MD5 848e852089ba84056308e184b034c302
- SHA1 ffd77f9da61b955b07c76fa392b48c09273d81fd
- SHA512 8e45aec194863838ee2e128f765e77b0e6fbfca710279a67fe516a20c273a595a5b1eceba33988c5cbe0c3b3d0238dc25e335a38431b49ac29a35ade099a6259
- SSDEEP 12288:Fa1oHlwuPdzVlet1w0BYWBzzZmEEqMSbwDQL:RFwAZlejw0BYWZEhKEDQL
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1c:b1:8f:88:16:c4:91:eb:86:ce:d5:41:b0:57:fa:4e:8c:69:6a:d3:23:92:47:57:f7:2d:b6:ac:e1:f3:13:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 14, 2025
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
312512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\x64\Release Console\autorunsc64.pdb
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
comctl32
ImageList_ReplaceIcon
ImageList_Add
crypt32
CryptSIPLoad
CryptSIPRetrieveSubjectGuidForCatalogFile
CertGetNameStringW
CertDuplicateCertificateContext
wintrust
CryptCATAdminCalcHashFromFileHandle
ntdll
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
NtOpenKey
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtCreateKey
kernel32
GetSystemWow64DirectoryW
FormatMessageA
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
FreeLibrary
MultiByteToWideChar
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
SetThreadPriority
CreateThread
GetTimeFormatW
FindResourceExW
LoadResource
LockResource
IsWow64Process
FindResourceW
QueryPerformanceCounter
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetStringTypeW
SetFilePointerEx
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetFileTime
FlushFileBuffers
LCMapStringW
CompareStringW
GetCommandLineA
FreeLibraryAndExitThread
SetStdHandle
GetConsoleCP
GetModuleHandleExW
ExitProcess
TlsFree
EncodePointer
RaiseException
OutputDebugStringW
WideCharToMultiByte
GetSystemWindowsDirectoryW
GetVersion
OpenProcess
TlsSetValue
TlsAlloc
ExitThread
GetCurrentProcess
InitializeCriticalSection
SetErrorMode
WriteFile
GetLongPathNameW
SizeofResource
GetFileSize
ExpandEnvironmentStringsW
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
MulDiv
GetModuleHandleW
FileTimeToLocalFileTime
LoadLibraryW
GetProcAddress
Sleep
GetStartupInfoW
GetLastError
ReadFile
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CloseHandle
GetFileSizeEx
LoadLibraryExW
GetVersionExW
SetLastError
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetFullPathNameW
SetEnvironmentVariableW
TlsGetValue
GetModuleFileNameW
LocalFree
LocalAlloc
GetCommandLineW
GetFileType
GetConsoleOutputCP
GetStdHandle
SetEndOfFile
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitializeSListHead
GetSystemTimeAsFileTime
user32
SetCursor
GetSysColorBrush
InflateRect
LoadCursorW
SendMessageW
SetWindowTextW
DialogBoxIndirectParamW
GetDlgItem
EndDialog
MessageBoxW
GetSubMenu
InsertMenuW
DeleteMenu
CheckMenuItem
DestroyIcon
GetMenu
GetParent
SetDlgItemTextW
PostMessageW
LoadStringW
LoadIconW
gdi32
DeleteObject
EndPage
StartPage
EndDoc
StartDocW
SetMapMode
GetDeviceCaps
DeleteDC
CreateCompatibleDC
comdlg32
PrintDlgW
advapi32
CloseServiceHandle
QueryServiceConfig2W
GetServiceDisplayNameW
RegQueryValueW
RegUnLoadKeyW
RegQueryInfoKeyW
RegLoadKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteKeyW
LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
shell32
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW
ole32
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SysAllocStringByteLen
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantClear
VariantChangeType
shlwapi
UrlUnescapeW
ord176
winhttp
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
Name
.text
Size
469KB
Virtual Size
469KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=172, id=261, version=30795,
count=64, id=261, version=32420,
count=18, id=260, version=32420,
count=9, id=259, version=32420,
count=16, id=260, version=30795,
count=2, id=262, version=30795,
count=31, id=257, version=30795,
count=324, id=1, productName=Unmarked objects,
count=3, id=260, version=32535,
count=33, id=261, version=32535,
count=1, id=255, version=32535,
count=1, id=151,
count=1, id=258, version=32535,
Autoruns/autorunsc64a.exe
- SHA256 b9c11b7701a269b8151ec8b38577fe2bb4de1e4e1ecd7f63324454054acf6881
- MD5 0c790f64e69f9d9a4cbde5e21f1a4e93
- SHA1 356d1dde5bb5d1a6c43d118910eeff6725a219e9
- SHA512 5d285ff8738dc9aeed61d24e8823f81b568cc251793619d660fa42781b1cb4979c0f67e015183cccddf366f6a96ba9fcda53e91d522642ca8f8bc4bf2461a479
- SSDEEP 12288:rOWkiYFavNULaT5zq5N1YsA4tF5JWYByz6YCOM5EdAdahYAwD3W:kaT525b7YCfahYdD3W
- MD5 SHA1 SHA512 SSDEEP
EXMservice.exe
- IMPHASH 1e92fd54d65284238a0e3b74b2715062
- SHA256 40c4fc26947ad84ecbfbeba71c930dc8f7f4dd5ae737c0021a0cdf721a76facf
- MD5 f551d9082d5a86776a906984e9cac3b3
- SHA1 7f2294fb608e65fb06b844a559dc3e8ec26dff8b
- SHA512 444f10d6468c28bab1920e33544becbc228b9cca6d710e4751bab50cd04baf6fe2c2d499ed578116212e1219a68f55c6cf836a61dd5f576cce8c6fd3fc1afe1d
- SSDEEP 393216:xQKf8nAG+bkX7ViesEfcGhCDNz1FNcRQR35DNJ93IPzIYHEKwPs91DQVtUcpBc:OK0AHbuViP6cGhCDdxDRFXePnkM91DQd
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
44960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetCPInfo
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=29395,
count=190, id=261, version=29395,
count=10, id=260, version=29395,
count=4, id=253, version=30818,
count=40, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=17, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=9, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=11, id=257, version=29395,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=31328,
count=1, id=258, version=31328,
main.pyc
- SHA256 d9f62b1e07b2c27d6226384c9fa08b89dab614b5b679154e864dd9b61d9da4cf
- MD5 c0b3c66ad1cd0dab72d99c9d371d6c8e
- SHA1 f7ef7218af6319c29b94c85b9dd0a25556cd72ba
- SHA512 d15a6ce37155023f50216623d445e7d6966fde6a2e5b3d9ec5649a410c494fba79cea29afd00e90092175a75bc0a922ab0aad0d4e678151ecc6ebde20b3074e9
- MD5 SHA1 SHA512
FortniteSettings/FortniteSettings.exe
- IMPHASH 0b5552dccd9d0a834cea55c0c8fc05be
- SHA256 3b4e1a5a0d85269d9491e155864e630339e292a9228dc1eb37ff61b0a657ff6e
- MD5 a39de0d010e9d34de70abad81f031e23
- SHA1 9903ee2dd6b87369eb33de49d5a3d13135309899
- SHA512 6247314d4ccf1fc14d8a999d476a6370b4e553bab76fb086f4cbf163f59c982643b0820d7d829ed3d3415456a613c777f90ac8c0ff3112be0ec44a7ee126a9d9
- SSDEEP 196608:SVKRZdQmRJ8dA6lbuVaycBIGpER/1q3+dgSVQ0W8/La8G5Ikq:fZdQuslbl9uq3+d9V3W82Id
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
45840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetOEMCP
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetEndOfFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
174KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=191, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=31823,
count=40, id=261, version=31823,
count=17, id=260, version=31823,
count=9, id=259, version=31823,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=31933,
count=1, id=258, version=31933,
FortniteSettingsManager.pyc
- SHA256 ac9381a577f2f27d17399190627fac7dbb2b45d7f46ee06e6d5dfa17d1e37681
- MD5 6563c0577e03c28a33721a0968e3765e
- SHA1 02627206324e5cbd2b740863139f1bca4d9dbb7f
- SHA512 114dfd380db25dfb7a825f27b23484e28bca85176fc4891e5a0dbc654dd1633685fb8a1b05c5ced4906202d925bcb96ba7c5417a41fa58cbbd9052b585bf4987
- SSDEEP 192:x93LaXPPe3+P8Wp6WITC6Bq3WQQtSF6UPRnlnWrVpB:x9bcq+PtITdI3WQQtozxl4/
- MD5 SHA1 SHA512 SSDEEP
NvidiaProfileInspector/Exm_Premium_Profile_V4.nip
- SHA256 f3904fe5c2475af316b4a41e69bd833e05d8a160089b96e4f97b83fb125426f7
- MD5 d5563eaeb8f6e5dbfb2d01fd24b7c8d5
- SHA1 f619d9c97f356c0f41ccb8a7da2961b46c4242ef
- SHA512 0d3823f7582766df5f06cad6e59aca7046889f8be3b6d179a1f7fa1e007f1eed488473bc0f79b0aa347bb86637e0fa14bf4c7a34d13a8835b37acaf17fa4db8d
- SSDEEP 3072:y6rtgdclmNYrbal222222222222222e5SkVVwV4+nJJ8D1z1IwvcGL5k3vtfxrAk:WSYt0uyx
- MD5 SHA1 SHA512 SSDEEP
NvidiaProfileInspector/Reference.xml
- SHA256 5a31c0500500713efd83160cef3db3f56b807b7c4f7a8b4ee7f4ffe05c676081
- MD5 1a8493bff2d17c83e299101954dcb562
- SHA1 439258f42f755d40311a31b37f6d37f447d546ba
- SHA512 75f2383f73fd3e03fdd17e93091cca7192919cb76ff564cafa7ee8d33d50db83d94dd3905d06b67c01f52f580b73573b490beb61f9a58af3cad3c0a29ce0aa2f
- SSDEEP 768:4wPznLJY2cI2YDqbcSQ98orYfLERQe1jE9Vv+hpGT6yYfoBVxL0n:vLKnI2YDqSDrYxUjE7v/T6yZBVBI
- MD5 SHA1 SHA512 SSDEEP
NvidiaProfileInspector/nv.config
- SHA256 383b8dcb968b6bd0633658d9bb55c4acaf4c85a075aa456904a42d4e4efd5561
- MD5 ce6d0bc7328b0fab08de80f292c1eaa4
- SHA1 ae505d6f60a71259b91865f6d5a3d674e9de0ebe
- SHA512 f009ad44131f19997c7c7be38144132d9f701fda4492f3782a2717b92859f189196fac5a7d7e6ff6952f2c1735f27ffaddf0f7acbb45b98a7d85572e96c16c00
- MD5 SHA1 SHA512
NvidiaProfileInspector/nvidiaProfileInspector.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1233487ea4db928ee062f12b00a6eda01445d001ab55566107234dea4dc65872
- MD5 ff5f39370b67a274cb58ba7e2039d2e2
- SHA1 3020bb33e563e9efe59ea22aa4588bed5f1b2897
- SHA512 7decec37c80d1d5ad6296d737d5d16c4fc92353a3ae4bd083c4a7b267bb6073a53d9f6152b20f9b5e62ba6c93f76d08f813812a83ce164db4c91107d7ad5a95f
- SSDEEP 6144:4sP/zdlaCgMOx9mN1S0Mi11iBFmEobpU0u5p:/P5cCdOHmN1S0Mi2BFmLU0A
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
537638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
517KB
Virtual Size
517KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PowerPlan/Exm_Premium_Power_Plan_V3.pow
- SHA256 e14a55794a97986b70c4de0f7318561ca525641646451fee00ea53b793f15b6d
- MD5 abec2ceb9e8425172e1c7bbabbaf8eb1
- SHA1 96bcfdc9bcb7c6fae883473dead92d332f06b162
- SHA512 c86445f87673d2ec4302adba4c6d828b1d1fe0429c7168cdc8f0f7074b8b2bd60974e9b27567b8e25eda2272e7f0fe5253ceb7090d54086c2c821d95bf30f5f1
- SSDEEP 96:t2F6WOEWeWZtTJs7coq2Sa2q2dpnSaABHmH8b01ktzpscsYUheoCi+C:tG6WOEWeWZtTJ2wmHopnlAxm6zIheZd
- MD5 SHA1 SHA512 SSDEEP
WindowsUpdateBlocker/Wub.exe
- IMPHASH 870b8e75c7190e202e9c6c81dff1040c
- SHA256 aac1123f17f8569a36bf93876cea30e15103fd2379b401a79129a2a6e7285ac2
- MD5 82aff8883099cf75462057c4e47e88ac
- SHA1 68e2939f59b3869e9bd3ecc4aca3947649631bf8
- SHA512 212ac940a1f8bdd805813c279d471efc53b858bc35c5edad182dfde3c29c37854618a507a0a0839e5a383d1ba4fe317c0b3c8275d023c86ecfa36f221560b96d
- SSDEEP 12288:ZaWzgMg7v3qnCiWErQohh0F4YCJ8lnyTQrv2HzAMI3u18:4aHMv6CWrj8nyTQrv2TAMI3ua
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ce:a3:d7:4e:89:0b:26:a8:99:dd:81:85:cf:0e:ee:ee:5d:3b:1e:98
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Jun 9, 2023
Subject
CN=Sordum Software
Serial Number
79:9e:5f:0f:69:be:cb:93:49:4a:b3:10:ef:62:cc:c3
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 15, 2021 - Jul 31, 2032
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 10, 2014 - Dec 10, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:48:90:3d:c2:8a:bc:a7:a1:19:4d:0c:1c:57:b8:29
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Minor OS version
0
Major OS version
5
Entry point
90896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
__WSAFDIsSet
setsockopt
ntohs
recvfrom
sendto
htons
select
listen
WSAStartup
bind
closesocket
connect
socket
send
WSACleanup
ioctlsocket
accept
WSAGetLastError
inet_addr
gethostbyname
gethostname
recv
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
mpr
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WNetUseConnectionW
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetQueryOptionW
InternetQueryDataAvailable
psapi
EnumProcesses
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcessModules
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile
LoadUserProfileW
kernel32
HeapAlloc
Sleep
GetCurrentThreadId
RaiseException
MulDiv
GetVersionExW
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
FindNextFileW
lstrcmpiW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
OutputDebugStringW
GetLocalTime
CompareStringW
CompareStringA
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
GetTempPathW
GetTempFileNameW
VirtualFree
FormatMessageW
GetExitCodeProcess
SetErrorMode
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
DeviceIoControl
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetComputerNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcessId
GetCurrentThread
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
LoadLibraryExW
HeapFree
WaitForSingleObject
CreateThread
DuplicateHandle
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameW
GetFullPathNameW
ExitProcess
ExitThread
GetSystemTimeAsFileTime
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
ResumeThread
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameA
HeapReAlloc
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
RtlUnwind
SetFilePointer
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetTickCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
EnumResourceNamesW
SetEnvironmentVariableA
user32
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
ReleaseCapture
SetCapture
WindowFromPoint
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
CheckMenuRadioItem
CopyImage
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
PeekMessageW
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
GetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
MessageBoxW
DefWindowProcW
MoveWindow
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
GetMenuItemID
TranslateMessage
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
keybd_event
LoadImageW
GetWindowLongW
gdi32
DeleteObject
GetObjectW
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
BeginPath
Rectangle
GetDeviceCaps
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
SetViewportOrgEx
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegConnectRegistryW
RegEnumKeyExW
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
InitiateSystemShutdownExW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
CopySid
LogonUserW
GetTokenInformation
GetAclInformation
GetAce
AddAce
GetSecurityDescriptorDacl
shell32
DragQueryPoint
ShellExecuteExW
SHGetFolderPathW
DragQueryFileW
SHEmptyRecycleBinW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
StringFromCLSID
IIDFromString
StringFromIID
OleInitialize
CreateBindCtx
CLSIDFromProgID
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OleUninitialize
oleaut32
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SysAllocString
OleLoadPicture
SafeArrayGetVartype
SafeArrayDestroyData
SafeArrayAccessData
VarR8FromDec
VariantTimeToSystemTime
VariantClear
VariantCopy
VariantInit
SafeArrayDestroyDescriptor
LoadRegTypeLi
GetActiveObject
SafeArrayUnaccessData
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=178, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=525, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
WindowsUpdateBlocker/Wub.ini
- SHA256 30eb977d58106050818626b9b556a3badc7b7d012462903120a0663987c74c0b
- MD5 a16bf55cd2ef7d9e56565b0ed1aa208a
- SHA1 19edddaa24f73d9d01150babd58b1bcc0ff5d849
- SHA512 ab87d94620b0d77bfa8ff3e721bbb68a28185245b173be7b62195588e2a3b3d3a9ee085497300c14876118dff4edca7fea202328f3156a76c53f786b8d5b6118
- SSDEEP 3072:/sRhs8Y6aeg3r3wgjkyIFJ6QT3yc8Bi3r/ZpHG:xqJ6T
- MD5 SHA1 SHA512 SSDEEP
WindowsUpdateBlocker/Wub_x64.exe
- IMPHASH 42b8d4fa3bc2c4336a20de1bdf1422d8
- SHA256 187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2
- MD5 9d6778f7f274f7ecd4e7e875a7268b64
- SHA1 452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa
- SHA512 d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87
- SSDEEP 24576:12DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZY9:12EmXGQsW/PN0QNlZI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
22:8c:20:21:a8:7d:2d:05:97:59:54:86:c4:a2:59:bc:a7:2f:99:ef
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Jun 9, 2023
Subject
CN=Sordum Software
Serial Number
79:9e:5f:0f:69:be:cb:93:49:4a:b3:10:ef:62:cc:c3
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 15, 2021 - Jul 31, 2032
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 10, 2014 - Dec 10, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:48:90:3d:c2:8a:bc:a7:a1:19:4d:0c:1c:57:b8:29
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Minor OS version
2
Major OS version
5
Entry point
119932
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsock32
__WSAFDIsSet
setsockopt
ntohs
recvfrom
sendto
htons
select
listen
WSAStartup
bind
closesocket
connect
socket
send
WSACleanup
ioctlsocket
accept
WSAGetLastError
inet_addr
gethostbyname
gethostname
recv
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
mpr
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WNetUseConnectionW
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetQueryOptionW
InternetQueryDataAvailable
psapi
EnumProcesses
GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcessModules
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile
LoadUserProfileW
kernel32
HeapAlloc
Sleep
GetCurrentThreadId
RaiseException
MulDiv
GetVersionExW
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
FindNextFileW
lstrcmpiW
MoveFileW
CopyFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetProcessHeap
CompareStringW
CompareStringA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetStdHandle
CreatePipe
TerminateThread
GetTempPathW
GetTempFileNameW
VirtualFree
FormatMessageW
GetExitCodeProcess
SetErrorMode
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
DeviceIoControl
SetFileAttributesW
GetShortPathNameW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetComputerNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcessId
GetCurrentThread
GetProcessIoCounters
CreateProcessW
SetPriorityClass
LoadLibraryW
VirtualAlloc
LoadLibraryExW
HeapFree
WaitForSingleObject
CreateThread
DuplicateHandle
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameW
GetFullPathNameW
ExitProcess
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetStartupInfoW
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
FlsFree
SetLastError
FlsAlloc
HeapSize
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
GetModuleFileNameA
HeapSetInformation
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
SetFilePointer
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetTickCount
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
GetLocalTime
SetEnvironmentVariableA
user32
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetWindowLongW
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongPtrW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
SetWindowLongPtrW
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
ReleaseCapture
SetCapture
WindowFromPoint
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
IsCharAlphaNumericW
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
IsClipboardFormatAvailable
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongPtrW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
GetUserObjectSecurity
CloseDesktop
CloseWindowStation
IsCharAlphaW
GetKeyboardLayoutNameW
ClientToScreen
RegisterHotKey
GetCursorInfo
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
TrackPopupMenuEx
GetClipboardData
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
OpenClipboard
BlockInput
GetMessageW
SystemParametersInfoW
LockWindowUpdate
GetDesktopWindow
gdi32
DeleteObject
GetObjectW
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
StrokePath
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
PolyDraw
BeginPath
Rectangle
GetDeviceCaps
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
SetViewportOrgEx
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegConnectRegistryW
RegEnumKeyExW
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
InitiateSystemShutdownExW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
CopySid
SetSecurityDescriptorDacl
LogonUserW
GetTokenInformation
GetAclInformation
GetAce
AddAce
GetSecurityDescriptorDacl
shell32
DragQueryPoint
ShellExecuteExW
SHGetFolderPathW
DragQueryFileW
SHEmptyRecycleBinW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
StringFromCLSID
IIDFromString
StringFromIID
OleInitialize
CreateBindCtx
CLSIDFromProgID
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
OleUninitialize
oleaut32
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SysAllocString
OleLoadPicture
SafeArrayGetVartype
SafeArrayDestroyData
SafeArrayAccessData
VariantInit
VariantCopy
VariantClear
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
LoadRegTypeLi
GetActiveObject
SafeArrayUnaccessData
VarR8FromDec
Name
.text
Size
599KB
Virtual Size
598KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=185, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=128, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=531, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,