RealTemp_370.zip
- SHA256 4b5febd808a71beb48cd221e85a6b139381bd8bdfecde5923a56566209ba2a36
Overview
overview
3Static
static
3LoadTester.exe
windows10-2004-x64
3LoadTester.exe
windows11-21h2-x64
3RTCore.dll
windows10-2004-x64
3RTCore.dll
windows11-21h2-x64
3RTShutDown.bat
windows10-2004-x64
RTShutDown.bat
windows11-21h2-x64
RealTemp.exe
windows10-2004-x64
3RealTemp.exe
windows11-21h2-x64
3RealTempGT.exe
windows10-2004-x64
3RealTempGT.exe
windows11-21h2-x64
3WinRing0.dll
windows10-2004-x64
3WinRing0.dll
windows11-21h2-x64
3WinRing0.sys
windows10-2004-x64
1WinRing0.sys
windows11-21h2-x64
1WinRing0x64.dll
windows10-2004-x64
1WinRing0x64.dll
windows11-21h2-x64
1WinRing0x64.sys
windows10-2004-x64
1WinRing0x64.sys
windows11-21h2-x64
1i7TurboGT.exe
windows10-2004-x64
3i7TurboGT.exe
windows11-21h2-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
LoadTester.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
LoadTester.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
RTCore.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
RTCore.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
RTShutDown.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
RTShutDown.bat
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
RealTemp.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
RealTemp.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
RealTempGT.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
RealTempGT.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
WinRing0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
WinRing0.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
WinRing0.sys
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
WinRing0.sys
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
WinRing0x64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
WinRing0x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
WinRing0x64.sys
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
WinRing0x64.sys
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
i7TurboGT.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
i7TurboGT.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target RealTemp_370.zip
- Size 323KB
- Sample260504-ff2jlsf18j
- SHA256 4b5febd808a71beb48cd221e85a6b139381bd8bdfecde5923a56566209ba2a36
- MD5 eeffc3332c14d37b3d09c0f79607cc08
- SHA1 0e2f60080cadd1a3ae82096fe40d40b0e43640b2
- SHA512 4711d949fa5dd2495450d8ebd293b7c0acbce10c2064aeade676c5e30339a1af35bdb5f74edbf27353dcf936e6679c191d4fde67240d4aa2d6cc8214041100ad
- SSDEEP 6144:YokNKrcL36oF0YL6weRdjDJQ2YqqtzxwYS6RuEBnwj44:Fk8Svajw4dj9oTxw8hnW
- TLSH T1E464235957F13FA0F901C6760AD6DF32A28347570E71B60B84FB9AC7144B41BAC43ABA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/WinRing0.dll unpack001/WinRing0x64.dll - Untrusted Codesign Signers 7 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/LoadTester.exe unpack001/RTCore.dll unpack001/RealTemp.exe unpack001/RealTempGT.exe unpack001/WinRing0.sys unpack001/WinRing0x64.sys unpack001/i7TurboGT.exe
File Explorer
-
RealTemp_370.zip.zip 323KB
-
COPYRIGHT.txt1KB
-
LoadTester.exe.exe 31KB
-
RTCore.cfg98B
-
RTCore.dll.dll 39KB
-
RTCore.rth325B
-
RTFont.fon1KB
-
RTShutDown.bat53B
-
RTWarning.wav10KB
-
ReadMe.txt3KB
-
RealTemp.exe.exe 211KB
-
RealTemp.ini2KB
-
RealTempGT.exe.exe 215KB
-
RealTempGT.ini1KB
-
WinRing0.dll.dll 64KB
-
WinRing0.sys.sys 14KB
-
WinRing0x64.dll.dll 56KB
-
WinRing0x64.sys.sys 14KB
-
i7TurboGT.exe.exe 55KB
-
i7TurboGT.ini37B
COPYRIGHT.txt
- SHA256 2be4135f02a8abf2119e7d613644ac54ac7336889ba52e32990d03b45c6a935b
- MD5 e47281b3e9e27e3fcf0f58d21c0e93ad
- SHA1 4c489b3b709c36e9dd2655bfd7ae056917e3cc5c
- SHA512 d8053c2d92f468a31f05866a4c07bd6fd8cf6dfed78cfb62d24058de9f0ae5e1ee80df3049b2c6f31ab0262ed04c203af785a4e6de3145379a5364790f109f12
- TLSH T1A921535B01044BA25AE25B463A72AEC4F09ED02C3F131D08287AE208A73B13DE4B7444
- MD5 SHA1 SHA512 TLSH
LoadTester.exe
- IMPHASH e67c2bc38072d6c3b9191179d996c6ff
- SHA256 f2b70ede45489d35dd32ad61af5ed87b7995a368282770c7a9c41f39ede6f81b
- MD5 a488752b6d5c1c0cad74f9b39a144d0a
- SHA1 a8f435466209690e9f3489b79187ab13c0298dca
- SHA512 011b66c1e1e14ef6edda19ab84cd4b47dda62c463f892760b0da6e24836561dab7fb6d542caad4aea0a8d7fad73d14ef607827399b2aea011634e947e1435922
- SSDEEP 384:UiiiBvafI5w5G1g7blp8pK5+Vj3ZYhcdUb+nmB:UiiiBMIl6hpg4+9Z0HinmB
- TLSH T1DFE2FA075F7A5C62EBA5877662BF93379D70B9D20DB8820B0B10ED1C7C313616E9512E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b7:02:66:f0:c9:d4:92:0e:32:d4:fc:01:ee:cc:dc:5a:26:9f:d1:be
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Chains
Jan 16, 2012
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:35:5c
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2019
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Serial Number
11:21:8c:d7:b9:26:3b:ad:98:b3:f3:bd:78:af:bd:c7:73:e5
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 10, 2011 - Aug 10, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
4
Entry point
9146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
winmm
timeEndPeriod
timeBeginPeriod
mfc42
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord641
ord800
ord2514
ord2621
ord5265
ord6375
ord4853
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord1576
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord1146
ord1168
ord860
ord540
ord324
ord4234
ord2642
ord6199
ord3092
ord2818
ord4710
ord2379
ord755
ord470
ord2822
ord4274
ord4673
ord4376
ord2648
msvcrt
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_exit
_onexit
__dllonexit
__CxxFrameHandler
_setmbcp
kernel32
Sleep
GetStartupInfoA
QueryPerformanceFrequency
GetModuleHandleA
QueryPerformanceCounter
user32
IsIconic
LoadIconA
SendMessageA
DrawIcon
GetClientRect
GetSystemMetrics
EnableWindow
PostQuitMessage
PeekMessageA
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=123, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=6, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
RTCore.cfg
- SHA256 4f326a49960e750c28cd493c3bcc4c6b4e9cc7b289321cd25a01582acfca25d0
- MD5 b6826bb64f6908dca57e0a9ff92c4980
- SHA1 cb5b1ef83e8854747b25b447f52927edfa29e6e0
- SHA512 cc0d033111661516da2852ea82361c88e80912c7456f6f29da5bb324b122b0d210d4dce0c4d03e8779dcfc1bd71cb412a717ea2080fc46b3e2e403e451bb7ad0
- TLSH T197B009A15082A7B09928A012F1B1245B6AC12ECDD0C008C8BA534EC44CAC862A26A275
- MD5 SHA1 SHA512 TLSH
RTCore.dll
- IMPHASH 659c240093ab7203f6ded45921ee7c88
- SHA256 6f122b89698a24e29196eb3fd8075b8fdaf5f775fb885de3f1b6f5e678c2dce7
- MD5 11433ab1222cd76c632ba4e2281f88a9
- SHA1 747285c5de346b141f1c0624116b0c1abc7077e1
- SHA512 34cb659c4dfefb057ca767deeeb59aba3b9611862529dd59e8a04ab1230b0693b92cdd18e7d4b507de3295f7036f5f0690e3a66fe86b1b5bd1554f4c60d3001e
- SSDEEP 384:sTqzM4I6C6+SfEg+BMeJzj8pK5+Vj3ZYhcdUb+9AMQR:sTqrC6+SfEg+Bb9jg4+9Z0HimMQR
- TLSH T13B035A531B5E2861EE501B7460A9573F5E36AFE158AE10C74F53CC9C0C5A3733B28A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b4:4a:b4:2f:4f:0d:6d:ca:69:4b:ca:c5:75:c4:0a:d7:40:88:ca:04
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Chains
Jan 16, 2012
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:35:5c
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2019
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Serial Number
11:21:8c:d7:b9:26:3b:ad:98:b3:f3:bd:78:af:bd:c7:73:e5
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 10, 2011 - Aug 10, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
4
Entry point
12865
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
pdh
PdhGetRawCounterValue
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhAddCounterA
PdhCollectQueryData
PdhRemoveCounter
PdhCloseQuery
mfc42
ord540
ord2818
ord6877
ord860
ord537
ord2764
ord926
ord858
ord1182
ord940
ord535
ord1168
ord825
ord800
ord4278
ord1253
ord342
ord823
msvcrt
malloc
_adjust_fdiv
_initterm
free
sprintf
_ftol
atof
__CxxFrameHandler
_mbscmp
kernel32
GetSystemPowerStatus
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetModuleHandleA
Sleep
GetCurrentProcess
GetProcessAffinityMask
SetThreadAffinityMask
GetCurrentThread
SetThreadPriority
GetProcAddress
GetSourceData
GetSourceDesc
GetSourcesNum
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
716B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
728B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=50, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
RTCore.rth
- SHA256 42a8b66ad5bf6309fe9df57a34d1b852536b1d421f85bf8b329c5b1a1e6f58f7
- MD5 42c1192313e10be91152243ac4fd79bf
- SHA1 ddb94d9bc031abf1afe97dfea32685a2369c7fe3
- SHA512 d1ec1ef2021d9b25eed111e227f1368dd839d27fc730b0ea45587737df59260a9feacb3bf59f2a7986fb9ffca92bdcf371843e930899d0410a7ddf3091d27077
- TLSH T11AE0266AD3691A159962032150064293237AA14FE4D4405A0088809C5A176B1277738C
- MD5 SHA1 SHA512 TLSH
RTFont.fon
- SHA256 71b9fa31c6d89b41386bbc63e43701d4f8b9355bde63893f83c1cdefc597a177
- MD5 62668f8eaf128e4669bafd31c79847f9
- SHA1 824999c9c8cf2227dcea304bbc67b09ef4f563e8
- SHA512 7c2e81ac93996d298e34733a6a1c8511f61789c4ec375540373ffb43d3b05f7193ce6638bf05d59bba3b86acdf49104b7f9cc6ddad72e9340647a82617783ead
- TLSH T10611F6E9F3C28696E0B4543C174799A1737D50A8C6244F07065437BAEED17596B88D8C
- MD5 SHA1 SHA512 TLSH
RTShutDown.bat
- SHA256 6c23356aa95edcb13f35bb793e31c41a4c6032ed43eff8a429e193d57d7ac4c4
- MD5 d41751f0c2a76575363d0ae048400953
- SHA1 8be972fa6bd14e253618df7966f50d5ef670b11a
- SHA512 e52a2bfc45682c8eddf77325dfd95567e2fbc820b6f4c6e66a641fc0ae1eba4e0e4e1e40808c1a40d939a714c80c8519ef357c3b9457c221dcf795e95dbd9a9a
- TLSH T148900244C035172261019095CE0A824BD027544424D0840C0006949D26F156093742CA
- MD5 SHA1 SHA512 TLSH
RTWarning.wav
- SHA256 4c501698413388e7f5098587e27251e7fc83d128a879b9c45dcb0dc3b7e9931d
- MD5 4bfa27997a889d219ede2c777410742a
- SHA1 37b18d278975591af8f6a9ab6ff72d4a5fdfcda3
- SHA512 0d3aee9475138216c875491375bbe435e595d9b40654899d4913f81647a183261115259ac1dc03675aebd358e11d1b0966c5b444b221ea3b13b965cf851b4f42
- SSDEEP 192:jN1mjqZT1uO3KnGxCtMQbCNZmUKQurZHPLjRbvY4gyyqVJ2BUAvP78jwLaQlwI:51TZT1uO3KGxCtMLfblurZH/Rbgu/A3J
- TLSH T19922AE1AA9CB7A6E34413EB16C6C40CF3546F80F8E442E8529A8CCDA737427DE459E69
- MD5 SHA1 SHA512 SSDEEP TLSH
ReadMe.txt
- SHA256 c948946fddf73ca836853f2ad25a49f4a7c617bcd89bbd854342807c81abe8c9
- MD5 694df9fa0041ecdd8bb66512bf12a1bb
- SHA1 4784ac7faf469b6903048d9d3ab6f4e6d2fe0c99
- SHA512 e7a34691589775c96a039eddb18fc22e4de236b78947d0427410d955fecc15e5c77636c52f832b6a5b2674ce89be23891ebe060c191bb82849b63fa8733ae720
- TLSH T15C615455AD0BE33210A2C192380F29E3F779205E5787131560AD82AC17109E2E7FF7AF
- MD5 SHA1 SHA512 TLSH
RealTemp.exe
- IMPHASH b9a4fc4d41e5b71aaa7c75c6d1062889
- SHA256 bd1a78f05f208e116a644c1f27f6dc518898afcbea0cf0eb7d1ba3f2b4e9cad9
- MD5 d6a719d22e180fc1aac49d3b8b7ee1e7
- SHA1 7581bbeae184772bfe6474fe8ed083bcab9c38bb
- SHA512 3eaf03ea1730f9249b7ceff4d5ebff590e6075e7a1c894ff866680c931813e3f03066edbf0d3b1fb312c62d00c5aee360605105455cbe034f81136d92b039fa4
- SSDEEP 3072:6RMg9Y1MsPxAKEXtvtYCKvsSYrn98YYKIlxCIKvwxpgP4BQ8oFz8SK9Qqc:sM5MUxSpbPTjIjCI+V6e
- TLSH T14C246D30B9E944D2E241673088F963F646B6F9464B318F7B0364D92D39AA2C1B95D33E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
71:9e:34:8d:58:aa:2f:d6:48:7c:f9:28:49:72:fc:8d:63:e2:2b:41
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Chains
Jan 16, 2012
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:35:5c
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2019
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Serial Number
11:21:8c:d7:b9:26:3b:ad:98:b3:f3:bd:78:af:bd:c7:73:e5
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 10, 2011 - Aug 10, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
4
Entry point
104832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
winring0
ord11
ord22
ord1
ord7
ord21
ord8
winmm
timeEndPeriod
timeBeginPeriod
PlaySoundW
psapi
EnumProcesses
uxtheme
SetWindowTheme
pdh
PdhGetRawCounterValue
PdhAddCounterW
PdhOpenQueryW
PdhCloseQuery
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
mfc42u
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4419
ord3592
ord324
ord825
ord3621
ord3658
ord641
ord2406
ord4229
ord6195
ord858
ord922
ord925
ord927
ord2810
ord800
ord540
ord3087
ord1634
ord1143
ord4704
ord6868
ord861
ord2293
ord2362
ord2634
ord538
ord2371
ord6330
ord3793
ord3806
ord2813
ord535
ord537
ord3090
ord4294
ord1105
ord3494
ord2507
ord355
ord4219
ord2355
ord2859
ord940
ord2505
ord293
ord5706
ord4124
ord5977
ord860
ord1197
ord2756
ord942
ord2508
ord361
ord823
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord1569
ord3733
ord561
ord815
ord2613
ord1165
ord2281
ord6211
ord4155
ord2858
ord3614
ord755
ord470
ord798
ord2606
ord1989
ord6403
ord3313
ord5188
ord6867
ord533
ord3871
ord2816
ord2812
ord3084
ord4470
ord4273
ord941
ord2078
ord2357
ord2354
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4847
ord4370
ord5261
ord3566
ord6451
ord3332
ord4418
msvcrt
__dllonexit
_onexit
?terminate@@YAXXZ
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
_XcptFilter
_exit
exit
free
malloc
wcscpy
wcstod
_ftol
wcscmp
__CxxFrameHandler
kernel32
WritePrivateProfileStringW
GetStartupInfoW
GetModuleHandleW
LoadLibraryA
GetVersion
GetCurrentProcess
SetPriorityClass
Sleep
SetProcessAffinityMask
CreateProcessW
TerminateProcess
SetThreadAffinityMask
GetCurrentThread
CopyFileW
GetPrivateProfileIntW
GetProcAddress
LoadLibraryW
FreeLibrary
GetPrivateProfileStringW
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessAffinityMask
SetThreadPriority
GetModuleFileNameW
user32
PeekMessageW
SendMessageW
LoadBitmapW
PostMessageW
EnableWindow
SetTimer
KillTimer
DestroyMenu
TrackPopupMenu
GetCursorPos
SetForegroundWindow
InsertMenuW
CreatePopupMenu
OffsetRect
GetSystemMetrics
GetWindowRect
GetFocus
SetWindowPos
InvalidateRect
LoadIconW
PostQuitMessage
FindWindowW
RemoveMenu
AppendMenuW
GetSystemMenu
DrawIcon
GetClientRect
IsIconic
DestroyIcon
FlashWindow
GetMonitorInfoW
MonitorFromWindow
IsWindowVisible
CreateIconIndirect
DrawTextW
ReleaseDC
GetDC
SetCapture
ReleaseCapture
SetWindowLongW
GetWindowLongW
InflateRect
ClientToScreen
gdi32
SelectObject
CreateCompatibleDC
DeleteDC
CreateBitmap
CreateCompatibleBitmap
CreateSolidBrush
PatBlt
SetTextColor
SetBkMode
CreateFontW
CreateFontIndirectW
DeleteObject
shell32
ShellExecuteW
Shell_NotifyIconW
comctl32
_TrackMouseEvent
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=11, version=8047,
count=6, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=1, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=18, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=278, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=13, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
RealTemp.ini
- SHA256 a857e3e1b336b60a637860eeda8dcd5adae90d49275cb313bd2a63ad61d14a2d
- MD5 e18380e721398d5580492bb9f2c7eea3
- SHA1 25cce96be1cbea123a559c212c8d9425574cce78
- SHA512 140e34e9d134b5dfa0ed43428d9ccc17e9a8235f9291e6e23f8bf035a4eca489284b4cdf9cf6bdf98ebb888935dbe6fde1d973185aa807feb6f31b1e0dc50d95
- TLSH T1B551379363FE0508F2F77F54E9B621B11B76BCA6AA3DC24C91D4010E09E5A508833FA7
- MD5 SHA1 SHA512 TLSH
RealTempGT.exe
- IMPHASH 51dba6f2c7b77a9de3a938fb764ca6d1
- SHA256 47cf3475cda1b1d94f640139f228d96fd80fb5794ed865c32bfcf388950a6711
- MD5 65a2c5f28207f5cb52d048bb5ae3f3b4
- SHA1 9a36bdbd3b59d8854ed5aa09751635b478550db8
- SHA512 59e73570167d1f8f5026a9f9d6382b793d3d229aedacb667e55c987286207064da161b8a75b84b18ced06d1c0b209aceb7db572e48761e6dfd9440d6ca48ba64
- SSDEEP 3072:tWFzubkKWNvUl88Fe0qjTcLDS4hmWfVDjMbwJ3lm4BQ8oFz8S59u:tWa+UlhFe0sAGUVHKVpU
- TLSH T185244B70BEE94095E25A267044B563F65374F8965B314B7B0368DB3E38B7301F92A32E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
db:55:01:91:18:ec:0b:1d:4c:96:cc:19:14:3d:45:d2:ac:14:56:57
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Chains
Jan 16, 2012
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:35:5c
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2019
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Serial Number
11:21:8c:d7:b9:26:3b:ad:98:b3:f3:bd:78:af:bd:c7:73:e5
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 10, 2011 - Aug 10, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
4
Entry point
108122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
winring0
ord11
ord22
ord1
ord7
ord21
ord8
winmm
timeEndPeriod
timeBeginPeriod
PlaySoundW
psapi
EnumProcesses
uxtheme
SetWindowTheme
pdh
PdhGetRawCounterValue
PdhAddCounterW
PdhOpenQueryW
PdhCloseQuery
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
mfc42u
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4419
ord3592
ord324
ord825
ord3621
ord3658
ord641
ord2406
ord4229
ord6195
ord858
ord922
ord925
ord927
ord2810
ord800
ord540
ord3087
ord1634
ord1143
ord4704
ord6868
ord861
ord2293
ord2362
ord2634
ord538
ord2371
ord6330
ord3793
ord3806
ord2813
ord535
ord537
ord3090
ord4294
ord1105
ord3494
ord2507
ord355
ord4219
ord2355
ord940
ord2505
ord293
ord2859
ord5706
ord4124
ord5977
ord1197
ord2756
ord942
ord2508
ord361
ord823
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord1569
ord3733
ord561
ord815
ord2613
ord1165
ord2281
ord6211
ord4155
ord2858
ord3614
ord755
ord470
ord798
ord2606
ord1989
ord6403
ord3313
ord5188
ord6867
ord533
ord3871
ord2816
ord2812
ord3084
ord4470
ord4273
ord941
ord2078
ord2357
ord2354
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4847
ord4370
ord5261
ord3566
ord6451
ord3332
ord4418
msvcrt
__dllonexit
_onexit
?terminate@@YAXXZ
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
_XcptFilter
_exit
exit
free
malloc
wcscpy
wcstod
_ftol
wcscmp
__CxxFrameHandler
kernel32
WritePrivateProfileStringW
GetStartupInfoW
GetModuleHandleW
LoadLibraryA
QueryPerformanceFrequency
GetTickCount
QueryPerformanceCounter
Sleep
SetProcessAffinityMask
CreateProcessW
TerminateProcess
SetThreadAffinityMask
GetCurrentThread
CopyFileW
GetPrivateProfileIntW
GetProcAddress
LoadLibraryW
FreeLibrary
SetPriorityClass
GetCurrentProcess
GetPrivateProfileStringW
GetProcessAffinityMask
SetThreadPriority
GetVersion
GetModuleFileNameW
user32
PeekMessageW
SendMessageW
LoadBitmapW
PostMessageW
EnableWindow
SetTimer
KillTimer
DestroyMenu
TrackPopupMenu
GetCursorPos
SetForegroundWindow
InsertMenuW
CreatePopupMenu
OffsetRect
GetSystemMetrics
GetWindowRect
SetWindowPos
GetFocus
InvalidateRect
LoadIconW
PostQuitMessage
RemoveMenu
AppendMenuW
GetSystemMenu
DrawIcon
GetClientRect
IsIconic
DestroyIcon
FlashWindow
GetMonitorInfoW
MonitorFromWindow
IsWindowVisible
CreateIconIndirect
DrawTextW
ReleaseDC
GetDC
SetCapture
ReleaseCapture
SetWindowLongW
GetWindowLongW
InflateRect
ClientToScreen
gdi32
SelectObject
CreateCompatibleDC
DeleteDC
CreateBitmap
CreateCompatibleBitmap
CreateSolidBrush
PatBlt
SetTextColor
SetBkMode
CreateFontW
CreateFontIndirectW
DeleteObject
shell32
ShellExecuteW
Shell_NotifyIconW
comctl32
_TrackMouseEvent
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=11, version=8047,
count=6, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=1, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=18, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=276, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=12, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
RealTempGT.ini
- SHA256 dd1f49b3cd1422afebcd3a2fa204360778b92f42bc01e10401122a587de279dc
- MD5 f0f01ed8debd8905c8b82253623e0622
- SHA1 a9407e23c2fa779829d2448409253dc524e27a96
- SHA512 f5f472c3685dd1396f6519dea9e52edfd27012f37bdd22f24af86a013a4fcb2514c139087ad8038f164b746a50d1173b93ccc8589bbb5d1b30f3c1bd96552e2d
- TLSH T125418E537BFE0508F1F67B58E9B611F25B76BC61AA3DC24D90D5060E04E1A818863FE7
- MD5 SHA1 SHA512 TLSH
WinRing0.dll
- IMPHASH e4ff369ee09caa867ad3a47fc753ce7c
- SHA256 2a2a466fbe05c6293c442429bad45b223f5742eb0ae254204bdfbaeee24c84d8
- MD5 6fc52a8c0cccd5f9b1cdb3de99cb3d3c
- SHA1 f15af33a43d6af621159ec0d74a7a7b09cb28a73
- SHA512 8b56ffec3d1e7455f09a09c441c002018649310d107080fb8cc3f74d67c893712e1edbc01c14f9a53d230994e499a2434d43449e888493e0daa858359ee1b2ed
- SSDEEP 768:gRP1qwVjsRDoomqfLYowvIay/scqQOTtCPzVMei:UP1Q0oQway/Cntezk
- TLSH T1E4533B18BD9380B3D5094B38A6D247C14FFE5D0337E660EFEF96090A49E12C896B96F1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
wsprintfA
advapi32
ChangeServiceConfigA
QueryServiceConfigA
OpenSCManagerA
CloseServiceHandle
CreateServiceA
OpenServiceA
DeleteService
StartServiceA
ControlService
kernel32
ExitProcess
CloseHandle
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentThread
SetThreadAffinityMask
GetCurrentProcess
GetProcessAffinityMask
SetProcessAffinityMask
DeviceIoControl
Sleep
GetModuleFileNameA
CreateFileA
GetVersionExA
GetProcAddress
GetModuleHandleA
FindFirstFileA
FindClose
GetDriveTypeA
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
WriteFile
GetStdHandle
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
LoadLibraryA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
Cpuid
CpuidPx
CpuidTx
DeinitializeOls
FindPciDeviceByClass
FindPciDeviceById
GetDllStatus
GetDllVersion
GetDriverType
GetDriverVersion
Hlt
HltPx
HltTx
InitializeOls
IsCpuid
IsMsr
IsTsc
Rdmsr
RdmsrPx
RdmsrTx
Rdpmc
RdpmcPx
RdpmcTx
Rdtsc
RdtscPx
RdtscTx
ReadIoPortByte
ReadIoPortByteEx
ReadIoPortDword
ReadIoPortDwordEx
ReadIoPortWord
ReadIoPortWordEx
ReadPciConfigByte
ReadPciConfigByteEx
ReadPciConfigDword
ReadPciConfigDwordEx
ReadPciConfigWord
ReadPciConfigWordEx
SetPciMaxBusIndex
WriteIoPortByte
WriteIoPortByteEx
WriteIoPortDword
WriteIoPortDwordEx
WriteIoPortWord
WriteIoPortWordEx
WritePciConfigByte
WritePciConfigByteEx
WritePciConfigDword
WritePciConfigDwordEx
WritePciConfigWord
WritePciConfigWordEx
Wrmsr
WrmsrPx
WrmsrTx
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=125, productName=VS2005 build 50727, version=50727,
count=26, id=110, productName=VS2005 build 50727, version=50727,
count=71, id=109, productName=VS2005 build 50727, version=50727,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=94, id=1, productName=Unmarked objects,
count=4, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
WinRing0.sys
- IMPHASH 7cf815757705e26b809574488ed56d0e
- SHA256 206ee7a7c3f4d9496f742ccb84718f556ecb4ba2a95fe7e0cdf3a003ffbe4597
- MD5 845af1ba23c8d5e64def61bcc441604c
- SHA1 8ac34eb21b9b38f67cd29684c45696c20ab2e75a
- SHA512 0c2d625bbe5b1902cd371f4e1a3dceee6401aa9fa0b25f4720277eaaac3576c2029d7db3ae9983382e4ca8f0415ccd4b0e6c1eea864e7886276f93047258475f
- SSDEEP 384:zkg+wW5QDV08teHn+EgTWGYOf2OJ06dUb+m:JDV4+ECtfSJim
- TLSH T161523B875B3D1926EF968F7091EED6531C3EF2C09FAC659B522285DC2C103E06F2865E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a0:4d:70:19:94:6d:9d:d3:51:61:50:b4:78:9d:e9:2f:d3:18:70:af
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Chains
Jul 26, 2008
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Subject
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Serial Number
01:00:00:00:00:01:15:37:24:21:a8
Issuer
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Revocation Status
Not revoked
Timespan
Sep 24, 2007 - Sep 24, 2008
Subject
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:00:f9:7f:aa:2e:1e
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 16, 2003 - Jan 27, 2014
Subject
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:1c:d6
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 28, 1999 - Jan 27, 2014
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d
Serial Number
04:00:00:00:00:01:10:92:eb:82:95
Issuer
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 5, 2007 - Jan 27, 2014
Subject
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:24:48
Issuer
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 22, 2004 - Jan 27, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
6
Entry point
4485
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\hotproject\winring0\source\dll\sys\lib\i386\WinRing0.pdb
ntoskrnl.exe
IoCreateSymbolicLink
IofCompleteRequest
KeTickCount
MmMapIoSpace
READ_REGISTER_BUFFER_ULONG
READ_REGISTER_BUFFER_USHORT
READ_REGISTER_BUFFER_UCHAR
MmUnmapIoSpace
RtlInitUnicodeString
IoDeleteSymbolicLink
IoCreateDevice
IoDeleteDevice
RtlUnwind
KeBugCheckEx
hal
HalGetBusDataByOffset
WRITE_PORT_ULONG
WRITE_PORT_USHORT
WRITE_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
READ_PORT_UCHAR
HalSetBusDataByOffset
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
768B
Virtual Size
710B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=125, productName=VS2005 build 50727, version=50727,
count=22, id=1, productName=Unmarked objects,
count=5, id=19, version=9049,
count=6, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
WinRing0x64.dll
- IMPHASH db8c33b60b74c971086f0a29d6ce59b4
- SHA256 dee350ebaa93f8c0510d61dbe95a3e33ea68c49058c7120e1fea5d987f9921dc
- MD5 b197b687ebdba80f965335483d178efc
- SHA1 e6dd89bd8e29c66be84b00154998046fff3ffa00
- SHA512 718bb7b14a5dd9981226cba24966fb92061643c42c241096732dc6354b24619f17160a1a8aba35d04b5934079c7637f8479b3f4def76245443f230ab32b622c6
- SSDEEP 1536:PabN1P2LlFWUgxhL3CKwfEQuTrbrjbKE:Pabr+LlFWBx1wfHuTrvjGE
- TLSH T18C43499AB39320FAD866C238D9E37A4AFA71B82907B51BCF4624845B5F337E0553D710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
6128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
SetProcessAffinityMask
Sleep
GetModuleFileNameW
CreateFileW
GetVersionExW
GetProcessAffinityMask
FindClose
GetDriveTypeW
GetCurrentProcess
SetThreadAffinityMask
GetCurrentThread
DeviceIoControl
HeapFree
GetProcessHeap
HeapAlloc
GetLastError
FindFirstFileW
CloseHandle
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
HeapDestroy
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
user32
wsprintfW
advapi32
ControlService
StartServiceW
DeleteService
ChangeServiceConfigW
OpenServiceW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigW
Cpuid
CpuidPx
CpuidTx
DeinitializeOls
FindPciDeviceByClass
FindPciDeviceById
GetDllStatus
GetDllVersion
GetDriverType
GetDriverVersion
Hlt
HltPx
HltTx
InitializeOls
IsCpuid
IsMsr
IsTsc
Rdmsr
RdmsrPx
RdmsrTx
Rdpmc
RdpmcPx
RdpmcTx
Rdtsc
RdtscPx
RdtscTx
ReadIoPortByte
ReadIoPortByteEx
ReadIoPortDword
ReadIoPortDwordEx
ReadIoPortWord
ReadIoPortWordEx
ReadPciConfigByte
ReadPciConfigByteEx
ReadPciConfigDword
ReadPciConfigDwordEx
ReadPciConfigWord
ReadPciConfigWordEx
SetPciMaxBusIndex
WriteIoPortByte
WriteIoPortByteEx
WriteIoPortDword
WriteIoPortDwordEx
WriteIoPortWord
WriteIoPortWordEx
WritePciConfigByte
WritePciConfigByteEx
WritePciConfigDword
WritePciConfigDwordEx
WritePciConfigWord
WritePciConfigWordEx
Wrmsr
WrmsrPx
WrmsrTx
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=70, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=97, id=1, productName=Unmarked objects,
count=10, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
WinRing0x64.sys
- IMPHASH d41fa95d4642dc981f10de36f4dc8cd7
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- TLSH T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Chains
Jul 26, 2008
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Subject
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Serial Number
01:00:00:00:00:01:15:37:24:21:a8
Issuer
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Revocation Status
Not revoked
Timespan
Sep 24, 2007 - Sep 24, 2008
Subject
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:00:f9:7f:aa:2e:1e
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 16, 2003 - Jan 27, 2014
Subject
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:1c:d6
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 28, 1999 - Jan 27, 2014
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d
Serial Number
04:00:00:00:00:01:10:92:eb:82:95
Issuer
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 5, 2007 - Jan 27, 2014
Subject
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:24:48
Issuer
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 22, 2004 - Jan 27, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
6
Entry point
20488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoCreateDevice
MmMapIoSpace
KeBugCheckEx
IoCreateSymbolicLink
MmUnmapIoSpace
IofCompleteRequest
__C_specific_handler
hal
HalSetBusDataByOffset
HalGetBusDataByOffset
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
380B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
546B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=113, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
i7TurboGT.exe
- IMPHASH 8d0e3042f1fdf032c0a1282ab6a7401e
- SHA256 357da77e83c85cef0b930547c8a0c8662829fea0befeded0f7e3949474ecb94c
- MD5 48e61f94beb8b46a906ad7e95b38e73f
- SHA1 6b01513e77ac25630d5976fa7044eca3496af856
- SHA512 8d7f4a7621e36e8dc0d7080fe2d08b1068d0327076e343090dfec6537ecb5dc86e45cf6797cd1aaf90c8ded8fc683b2f3f5c1db7d8902201702963ec8a71ee9e
- SSDEEP 768:KMgzGjiO9raKHWHS1EhmsTJa3W94OVEZBtoW2AgSbtFDW5Yg4+9Z0Hi7FDK:1nH6S1EhmZ3WCjt2AxtpWaD+9WiBDK
- TLSH T146435CA35E56C466D300887041BED3B6CA72F96225258B1F7BD8DD3D393AB42ED1832D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7a:3a:56:24:d5:df:16:90:b1:e8:d9:47:8f:5c:d4:9e:8d:82:1e:d0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Chains
Jan 16, 2012
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:35:5c
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2019
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=TechPowerUp Ltd,O=TechPowerUp Ltd,L=Hong Kong,ST=Hong Kong,C=HK
Serial Number
11:21:8c:d7:b9:26:3b:ad:98:b3:f3:bd:78:af:bd:c7:73:e5
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 10, 2011 - Aug 10, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
4
Entry point
21658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
winring0
ord22
ord21
ord1
ord7
ord8
winmm
timeBeginPeriod
timeEndPeriod
mfc42u
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord3733
ord561
ord825
ord815
ord641
ord800
ord2506
ord2613
ord538
ord5261
ord4370
ord4992
ord6048
ord4073
ord1767
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5276
ord3793
ord4831
ord4480
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord4621
ord4419
ord3592
ord1143
ord1165
ord861
ord540
ord324
ord2293
ord2362
ord4229
ord2371
ord755
ord470
ord6451
ord2810
ord6868
ord1569
ord6330
ord6195
ord2634
ord3087
ord823
ord4219
ord2858
ord4704
ord3332
ord942
ord2606
ord927
ord940
ord2813
ord3806
ord798
ord1989
ord6403
ord858
ord922
ord3313
ord5188
ord6867
ord533
ord3871
ord4847
ord5977
ord2859
ord4294
ord6279
ord6278
ord4124
ord2755
ord941
ord6211
ord6371
ord4269
ord4667
ord4435
ord1197
msvcrt
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
_exit
_wtoi
_ftol
wcscpy
__CxxFrameHandler
kernel32
WritePrivateProfileStringW
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
GetProcessAffinityMask
SetPriorityClass
Sleep
GetCurrentThread
GetPrivateProfileIntW
SetThreadAffinityMask
SetThreadPriority
GetModuleFileNameW
user32
GetSystemMenu
InsertMenuW
EnableWindow
CreatePopupMenu
AppendMenuW
LoadIconW
DrawIcon
GetClientRect
GetSystemMetrics
SendMessageW
IsIconic
KillTimer
PostQuitMessage
SetTimer
RemoveMenu
GetCursorPos
GetFocus
SetCapture
ReleaseCapture
GetWindowRect
DestroyMenu
TrackPopupMenu
SetForegroundWindow
shell32
Shell_NotifyIconW
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=8, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=187, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=6, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
i7TurboGT.ini
- SHA256 b7d822678e44d88a076c91255884775c0ee04bea157be46af80ba05e98e21f5b
- MD5 89cab37df781380301a9178a0ab1daef
- SHA1 7d78601e732661a7b1d500497db81a03718fd2a9
- SHA512 6cf1feb9226fc7f6d52aa4063ef2afa808ac4ccc0001e0e0450db59df308874e182d4fe26110d5c1ee63066bc0801f01b9dcb7bbbcb860738d83f201f58a377f
- MD5 SHA1 SHA512