Decache_v1.1.1.zip
- SHA256 feb12f8484ca9b848e178da360b6434b1af9fab48a47a2e42b193e6d9fa46433
Overview
overview
9Static
static
9Decache Ex...7z.dll
windows10-2004-x64
3Decache Ex...7z.dll
windows11-21h2-x64
3Decache Ex...7z.exe
windows10-2004-x64
3Decache Ex...7z.exe
windows11-21h2-x64
3Decache Ex...7z.exe
windows10-2004-x64
1Decache Ex...7z.exe
windows11-21h2-x64
1Decache Ex...ux.sfx
ubuntu-18.04-amd64
3Decache Ex...on.exe
windows10-2004-x64
1Decache Ex...on.exe
windows11-21h2-x64
1Decache Ex...32.dll
windows10-2004-x64
3Decache Ex...32.dll
windows11-21h2-x64
3Decache Ex...on.dll
windows10-2004-x64
3Decache Ex...on.dll
windows11-21h2-x64
3Decache Ex...ec.dll
windows10-2004-x64
3Decache Ex...ec.dll
windows11-21h2-x64
3Decache Ex...nc.dll
windows10-2004-x64
3Decache Ex...nc.dll
windows11-21h2-x64
3Decache Ex...ts.bat
windows10-2004-x64
1Decache Ex...ts.bat
windows11-21h2-x64
1Decache Ex...ze.bat
windows10-2004-x64
1Decache Ex...ze.bat
windows11-21h2-x64
1Decache Ex...rl.exe
windows10-2004-x64
1Decache Ex...rl.exe
windows11-21h2-x64
1Decache Ex...dd.exe
windows10-2004-x64
3Decache Ex...dd.exe
windows11-21h2-x64
3Decache Ex...eg.exe
windows10-2004-x64
3Decache Ex...eg.exe
windows11-21h2-x64
3Decache Ex...ew.exe
windows10-2004-x64
7Decache Ex...ew.exe
windows11-21h2-x64
7Decache Ex...ew.exe
windows10-2004-x64
9Decache Ex...ew.exe
windows11-21h2-x64
9Decache Ex...ew.exe
windows10-2004-x64
9Behavioral task
behavioral1
Sample
Decache Exporter/bin/7z/7z.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Decache Exporter/bin/7z/7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Decache Exporter/bin/7z/7z.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Decache Exporter/bin/7z/7z.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Decache Exporter/bin/7z/7z.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Decache Exporter/bin/7z/7z.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Decache Exporter/bin/7z/7zCon.linux.sfx
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Decache Exporter/bin/7z/7zCon.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Decache Exporter/bin/7z/7zCon.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Decache Exporter/bin/7z/Codecs/Modern7z.32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
Decache Exporter/bin/7z/Codecs/Modern7z.32.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlicommon.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlicommon.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlidec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlidec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlienc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlienc.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
Decache Exporter/bin/check_dir_exists.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Decache Exporter/bin/check_dir_exists.bat
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Decache Exporter/bin/check_size.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Decache Exporter/bin/check_size.bat
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Decache Exporter/bin/curl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Decache Exporter/bin/curl.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Decache Exporter/bin/dd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Decache Exporter/bin/dd.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Decache Exporter/bin/ffmpeg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
Decache Exporter/bin/ffmpeg.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
Decache Exporter/bin/history/BrowsingHistoryView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral29
Sample
Decache Exporter/bin/history/BrowsingHistoryView.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
Decache Exporter/bin/history/ChromeHistoryView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral31
Sample
Decache Exporter/bin/history/ChromeHistoryView.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target Decache_v1.1.1.zip
- Size 11.8MB
- Sample260602-ejmn7adv4v
- SHA256 feb12f8484ca9b848e178da360b6434b1af9fab48a47a2e42b193e6d9fa46433
- MD5 a9bc7ed01138633872895a3a4479a69e
- SHA1 5d044976535763a766538942811f5e851feddd3b
- SHA512 256e5b944d518c2751a62d88f7e6e090a27018f3a8f3c3070e614f2cc5d27bd98e956dc4bd87542c5364e694d5b66ff39df8de104c0e6a8cdf17fcc10b62a23b
- SSDEEP 196608:Oa3PxZBwvfvvn6GPoAFUG7Tjc5IrhC4RTrammj5F1qpDm2w5j77TXCFVFrkqNm11:Oa3RsPo0HjLI4xBmL1qpDm2cj77TXCFm
- TLSH T1EAC633A673F8B36ADEDFE6F61237EA87463329444DD2360941B436A860F3355924C32D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 7 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/Decache Exporter/bin/history/BrowsingHistoryView.exe Nirsoft static1/unpack002/out.upx Nirsoft static1/unpack003/out.upx Nirsoft static1/unpack004/out.upx Nirsoft static1/unpack005/out.upx Nirsoft static1/unpack006/out.upx Nirsoft static1/unpack007/out.upx Nirsoft - Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/Decache Exporter/bin/nirsoft/IECacheView.exe -
resource yara_rule static1/unpack001/Decache Exporter/bin/history/ChromeHistoryView.exe upx static1/unpack001/Decache Exporter/bin/history/MozillaHistoryView.exe upx static1/unpack001/Decache Exporter/bin/nirsoft/ChromeCacheView.exe upx static1/unpack001/Decache Exporter/bin/nirsoft/IECacheView.exe upx static1/unpack001/Decache Exporter/bin/nirsoft/MZCacheView.exe upx static1/unpack001/Decache Exporter/bin/nirsoft/OperaCacheView.exe upx - Unsigned PE 22 IoCs
Checks for missing Authenticode signature.
resource unpack001/Decache Exporter/bin/7z/7z.dll unpack001/Decache Exporter/bin/7z/7z.exe unpack001/Decache Exporter/bin/7z/7z.sfx unpack001/Decache Exporter/bin/7z/7zCon.sfx unpack001/Decache Exporter/bin/7z/Codecs/Modern7z.32.dll unpack001/Decache Exporter/bin/7z/Codecs/brotli/libbrotlicommon.dll unpack001/Decache Exporter/bin/7z/Codecs/brotli/libbrotlidec.dll unpack001/Decache Exporter/bin/7z/Codecs/brotli/libbrotlienc.dll unpack001/Decache Exporter/bin/dd.exe unpack001/Decache Exporter/bin/ffmpeg.exe unpack001/Decache Exporter/bin/history/BrowsingHistoryView.exe unpack001/Decache Exporter/bin/history/ChromeHistoryView.exe unpack002/out.upx unpack003/out.upx unpack001/Decache Exporter/bin/nirsoft/ChromeCacheView.exe unpack004/out.upx unpack005/out.upx unpack001/Decache Exporter/bin/nirsoft/MZCacheView.exe unpack006/out.upx unpack001/Decache Exporter/bin/nirsoft/OperaCacheView.exe unpack007/out.upx unpack001/Decache Exporter/bin/phash.exe - Untrusted Codesign Signers 3 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Decache Exporter/bin/curl.exe unpack001/Decache Exporter/bin/libcurl.dll unpack001/Decache Exporter/bin/nirsoft/IECacheView.exe
File Explorer
-
Decache_v1.1.1.zip.zip 11.8MB
-
Decache Exporter/bin/7z/7z.dll.dll 1.3MB
-
Decache Exporter/bin/7z/7z.exe.exe 349KB
-
Decache Exporter/bin/7z/7z.sfx.exe 424KB
-
Decache Exporter/bin/7z/7zCon.linux.sfx.elf 478KB
-
Decache Exporter/bin/7z/7zCon.sfx.exe 415KB
-
Decache Exporter/bin/7z/Codecs/Modern7z.32.dll.dll 338KB
-
Decache Exporter/bin/7z/Codecs/brotli/libbrotlicommon.dll.dll .js 132KB
-
Decache Exporter/bin/7z/Codecs/brotli/libbrotlidec.dll.dll 49KB
-
Decache Exporter/bin/7z/Codecs/brotli/libbrotlienc.dll.dll 548KB
-
Decache Exporter/bin/check_dir_exists.bat.bat 500B
-
Decache Exporter/bin/check_size.bat588B
-
Decache Exporter/bin/curl-ca-bundle.crt218KB
-
Decache Exporter/bin/curl.exe.exe 3.5MB
-
Decache Exporter/bin/data/asset_data.txt59KB
-
Decache Exporter/bin/data/history_data.txt19KB
-
Decache Exporter/bin/data/unique_names.txt110B
-
Decache Exporter/bin/data/video_data.txt60KB
-
Decache Exporter/bin/data/watch_page_data.txt7KB
-
Decache Exporter/bin/dd.exe.exe 334KB
-
Decache Exporter/bin/ffmpeg.exe.exe 13.9MB
-
Decache Exporter/bin/history/BrowsingHistoryView.exe.exe 646KB
-
Decache Exporter/bin/history/ChromeHistoryView.exe.exe 219KB
-
out.upx.exe 371KB
-
Decache Exporter/bin/history/MozillaHistoryView.exe.exe 223KB
-
out.upx.exe 415KB
-
Decache Exporter/bin/history/scan_history.bat.bat 2KB
-
Decache Exporter/bin/libcurl.dll.dll 976KB
-
Decache Exporter/bin/nirsoft/ChromeCacheView.exe.exe 248KB
-
out.upx.exe 520KB
-
Decache Exporter/bin/nirsoft/IECacheView.exe.exe 56KB
-
out.upx.exe 82KB
-
Decache Exporter/bin/nirsoft/MZCacheView.exe.exe 244KB
-
out.upx.exe 514KB
-
Decache Exporter/bin/nirsoft/OperaCacheView.exe.exe 41KB
-
out.upx.exe 75KB
-
Decache Exporter/bin/nirsoft/read_cache.bat.bat 11KB
-
Decache Exporter/bin/perm_error.bat.bat 3KB
-
Decache Exporter/bin/phash.exe.exe 1.1MB
-
Decache Exporter/bin/vbs/askforname.vbs.vbs 3KB
-
Decache Exporter/bin/vbs/cleanse_ex.vbs.vbs 531B
-
Decache Exporter/bin/vbs/date_to_unix.vbs.vbs 483B
-
Decache Exporter/bin/vbs/decompress_error.vbs212B
-
Decache Exporter/bin/vbs/error32.vbs338B
-
Decache Exporter/bin/vbs/fixdir.vbs.vbs 405B
-
Decache Exporter/bin/vbs/hex.vbs.vbs 503B
-
Decache Exporter/bin/vbs/indiv_check.vbs.vbs 302B
-
Decache Exporter/bin/vbs/likely_alert.vbs.vbs 478B
-
Decache Exporter/bin/vbs/limit_cache_dump.vbs.vbs 876B
-
Decache Exporter/bin/vbs/lowstorage.vbs.vbs 534B
-
Decache Exporter/bin/vbs/md5.vbs.vbs 13KB
-
Decache Exporter/bin/vbs/multitask.vbs328B
-
Decache Exporter/bin/vbs/nointernet.vbs1002B
-
Decache Exporter/bin/vbs/perm_error.vbs.vbs 1KB
-
Decache Exporter/bin/vbs/pickfolder.vbs.vbs 354B
-
Decache Exporter/bin/vbs/recursive_dir.vbs.vbs 1KB
-
Decache Exporter/bin/vbs/regex.vbs.vbs 694B
-
Decache Exporter/bin/vbs/unmodify_date.vbs.vbs 635B
-
Decache Exporter/start_decache.bat.bat 33KB
Decache Exporter/bin/7z/7z.dll
- IMPHASH 798aaa6264af3f5296c893624ce39150
- SHA256 a575175338706d1473e2bebe1cd811283c63c697a17c0865de85ede345898af6
- MD5 b418b54dc8da84500c7070e160d500b4
- SHA1 e355240da7851f619168a830ef1eede3aef2383b
- SHA512 52a7454716cf165d2e6e65edabbe4b507bcf8199288d44de40bbce488a43dc45261d32b63bb0e547c4b3bdadfd29d98d4eaaaebefb1a0b15e3a734a809a10d20
- SSDEEP 24576:Yhzoc/XupYDLimyUBKGm2MWYe3swtF7Qv/jVq1hgaZVgpoKODpT9e6isdC:YhzocvupYDLcGm2Oe3sMaXegaik9zVdC
- TLSH T174558D11F7F1C0B4D58D5630862DBBBA50F8E729CA10A8D777C0BE6E6F319D2C225A49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
953935
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharPrevExA
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
realloc
strchr
memset
free
malloc
strlen
wcscmp
strcmp
strstr
memmove
_CxxThrowException
memcpy
memcmp
_purecall
__CxxFrameHandler
kernel32
GetCurrentProcessId
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
GetVersion
IsProcessorFeaturePresent
GetModuleHandleW
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
SetLastError
GetCurrentDirectoryW
GetTempPathW
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
ReadFile
WriteFile
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
1007KB
Virtual Size
1007KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=106, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=230, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=35, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=260, version=35222,
count=6, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Decache Exporter/bin/7z/7z.exe
- IMPHASH 935e925b1f750076b05f0553ad3abe08
- SHA256 2f17553a71ad019d64ad83b79c82c3f824491281c9ef514dad8006918319e6ff
- MD5 6137cb5ea86c03a20131a98be533c1f5
- SHA1 f221c9390e2b5c077b49cf33e50b144ecc8fca96
- SHA512 b4bea20e23a20c8ce6a0ffdd91c27a992a6376ae3d3922ee0349a7e7e4908cada2fa85049341818fa01b6e8b0b41a8415f736a417683e8447d6accd5771e7378
- SSDEEP 6144:NWqF8itGhnIVsIqEV8CfqW2WJRckYeaPKjy2nGzLGd7ByF6L69r4YpYrrV:NgkWGqqxqYRxYe5jvq2YpSrV
- TLSH T166747C127BE8E43AD2420131CB5AABA5E4F9D3684E71484337C4196C2B75DD6E33AF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
264186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
SysStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
advapi32
LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
_ftol
_isatty
_get_osfhandle
memcmp
_purecall
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
_iob
free
malloc
memcpy
_CxxThrowException
__CxxFrameHandler
kernel32
GetVersion
WaitForSingleObject
ResumeThread
SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
CreateFileW
VirtualFree
VirtualAlloc
SetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetConsoleMode
SetProcessAffinityMask
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
GetCurrentProcess
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
SetFileAttributesW
RemoveDirectoryW
MoveFileW
MoveFileWithProgressW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
GetLogicalDriveStringsW
GetFileSize
Name
.text
Size
273KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=76, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=260, version=35222,
count=3, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Decache Exporter/bin/7z/7z.sfx
- IMPHASH 2ed1041d522219179e9c1bd5bf762094
- SHA256 353a3f6d7cbd06c6f25589df00b40f363e9f597c4edc4ad782f6d6b21f297f09
- MD5 cd076ef23ef776a8212aa42f28beb6ed
- SHA1 ad230c2c18852a1dae5abb68fbe5d630bc951d66
- SHA512 a8dc29bb9454a82fa62f4dda4b5deb1631cbde108a4060605320eb88bbc45a4b6f2046c0a7ea01daa203c7d11c94c819d1792c1fa135d79bd3f148ba9531d802
- SSDEEP 6144:9n8/VEOuUg4ziefIZSn08IPOXlFP7ZmrBBWQkPUrbFEkNXI5iixcJhXZtu6:9n8/6OxgZeIrLclFzWrkPALNrTJ06
- TLSH T130946C6BF27840F8E0B7D178C5629A07F775785A0370EB8F02A8867A2F136E55D2D721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
254720
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysFreeString
VariantClear
SysAllocString
SysStringLen
SysAllocStringLen
ole32
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
OleInitialize
user32
CheckDlgButton
DestroyIcon
GetFocus
EndDialog
SetDlgItemTextW
GetKeyState
EnableWindow
PostMessageW
SetFocus
InvalidateRect
SetWindowTextW
MessageBoxW
DialogBoxParamW
SystemParametersInfoW
GetMonitorInfoA
MonitorFromWindow
IsDlgButtonChecked
GetDlgItem
GetWindowLongPtrW
SetWindowLongPtrW
ShowWindow
MoveWindow
ScreenToClient
GetWindowRect
GetParent
GetWindowTextW
GetWindowTextLengthW
SendMessageW
LoadStringW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CharUpperW
SetCursor
LoadCursorW
LoadIconW
KillTimer
SetTimer
MapDialogRect
shell32
SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW
kernel32
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetStringTypeW
SetStdHandle
GetFileType
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
HeapReAlloc
TerminateProcess
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateSemaphoreW
ResetEvent
SetEvent
GetCommandLineW
MultiByteToWideChar
GetLastError
WideCharToMultiByte
GlobalLock
GlobalUnlock
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
FormatMessageW
LocalFree
GetSystemDirectoryW
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryW
DeleteFileW
SetLastError
GetCurrentDirectoryW
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetFileInformationByHandle
GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GlobalAlloc
GlobalFree
CompareFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcAddress
GetModuleHandleW
GetCurrentProcess
GetProcessAffinityMask
GetSystemInfo
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
Sleep
SetPriorityClass
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
GetVersion
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
CreateEventW
Name
.text
Size
320KB
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=142, id=261, version=30795,
count=46, id=261, version=30034,
count=18, id=260, version=30034,
count=9, id=259, version=30034,
count=12, id=260, version=30795,
count=1, id=262, version=30795,
count=13, id=257, version=30795,
count=215, id=1, productName=Unmarked objects,
count=125, id=265, version=30158,
count=4, id=259, version=30158,
count=1, id=255, version=30158,
count=1, id=258, version=30158,
Decache Exporter/bin/7z/7zCon.linux.sfx
- SHA256 c29701887677adc82aaf3f2c55432007b3228f5d05ec3b932e08bfc3ed1a7159
- MD5 db3535a4081f88de6ba7de17906b8f8c
- SHA1 726f77a8ad4624835d01b5106873c160c191b1b3
- SHA512 88474b1e27b6dd72eeb7b7252ffdc24ec4fb3ce38ce9a124a78d268dd7ae93e862b318ea935898e90ef8a7fee907751c75ac86ba1fac3e09097db61f400392d8
- SSDEEP 6144:2KFVMp2yvRO0SHs/oQlMrtdLqAKoEfn49t0QpUstbvOXLhw8:wp2040SHszlMDnKownX
- TLSH T1B7A41A0BB6664ABDC09DCA32455FC132647138A41336693B3784FA350EE5E64AF3FB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Decache Exporter/bin/7z/7zCon.sfx
- IMPHASH 3ddf0cf83149f466a294071ebc3dfc34
- SHA256 5f5a7f958c8a9cdbf43a8135670a8e389050b5aeb0c0325300f6c08e640aa24b
- MD5 91504a2c2d6a44787959bce544f6072b
- SHA1 3b11b27e7b1a236cfb54413c972a99263b17b65f
- SHA512 ad347bed26f124e170ec5208ace90013245864d6edc98edb97cbcb0a169a4b3d2a2c2abc60c610e4d0b8439e3fa893bcd5d67882e097d03443b77d23893656cb
- SSDEEP 6144:pC9jKj19cJ7ljZjMFFzTNI4xYHrOrmiojJVJVIrWaVLEQNubwe0nb0KxvfJP:pkmjfggHpY6mrVVviVLEgub+bD
- TLSH T14D947D5BF76440F9E0B7D038C6525A07F775B89A0360EB8F02A887762F236A55D3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
242056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysAllocStringLen
SysAllocString
VariantClear
SysFreeString
SysStringLen
user32
CharUpperW
kernel32
GetProcAddress
WriteConsoleW
HeapSize
ReadConsoleW
GetStringTypeW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
SetFileApisToOEM
GetCommandLineW
MultiByteToWideChar
GetLastError
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
FormatMessageW
LocalFree
GetSystemDirectoryW
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryW
DeleteFileW
SetLastError
GetCurrentDirectoryW
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetFileInformationByHandle
GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcess
GetProcessAffinityMask
GetSystemInfo
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetConsoleMode
SetConsoleMode
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
GetVersion
RtlUnwind
GetModuleHandleW
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
GetEnvironmentStringsW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
TerminateProcess
GetCommandLineA
GetFileType
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
Name
.text
Size
317KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=146, id=261, version=30795,
count=46, id=261, version=30034,
count=18, id=260, version=30034,
count=9, id=259, version=30034,
count=11, id=260, version=30795,
count=7, id=257, version=30795,
count=149, id=1, productName=Unmarked objects,
count=115, id=265, version=30158,
count=4, id=259, version=30158,
count=1, id=255, version=30158,
count=1, id=258, version=30158,
Decache Exporter/bin/7z/Codecs/Modern7z.32.dll
- IMPHASH 5c634dc6fbde274575b46d25aa679794
- SHA256 7b65219a1095cda0bb8469bc9728177ac727bbbc1a8ff069b53a0408d7108ca0
- MD5 d17baf2aa7e097ad1faf4272b762cc2e
- SHA1 9e20498f5ef4f856ddf7d8f79159c64016e32ce1
- SHA512 ba03f88d9036cf54656633943f354428fe565ab85615fa65e68c90ac20edfd22a8dac5cd3484bce49149700f4cfd361f7c1fc7b4de02297d47173d26321186cf
- SSDEEP 6144:LDANS5esvcU8ljTrocKLX9rGrnw2lEHdGBQ6PceoX:L8NS5eMRptranvlSdoQ6PceoX
- TLSH T100741A33E6904033E16F0A3958E7B31465FE76E1AAE5740B1EE03E5F4AB9642583CF52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
306512
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
SysAllocString
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
user32
MessageBoxA
CharNextW
LoadStringW
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperW
CharLowerBuffW
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
lstrcpynW
VirtualQuery
GetTickCount
GetSystemInfo
GetVersion
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjects
VirtualQuery
TryEnterCriticalSection
SetEvent
ResetEvent
LocalFree
LoadLibraryExW
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
GetVersionExW
GetTickCount
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFileAttributesW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCPInfo
FreeLibrary
FormatMessageW
FindFirstFileW
FindClose
FileTimeToSystemTime
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileW
CreateEventW
CompareStringW
CloseHandle
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty2
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
Name
.text
Size
289KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
262B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Decache Exporter/bin/7z/Codecs/brotli/libbrotlicommon.dll
- IMPHASH 57b955c12f3d6c8c5ac20d4fba8b766c
- SHA256 98ed8968fdf0b0f49dcf0438bd02097f62bbf17c3a197984f2fe938ab48fcefe
- MD5 04176598b71ed83e15612cb407b3d0df
- SHA1 07b92f98db283466e4856f554a46001f7103f199
- SHA512 bab6e54b95b29fdaac33fb3731f0bd1906445c7e4d11afe228781f780a6798fc51bc072d09927367074846a8e0ddb3ec43735515b22434b0aed1b563de8c30ed
- SSDEEP 3072:cc4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBG:V4AhdNorGvHdbi09GJ
- TLSH T16AD37CA1B3050736C25B227AE49A6BB9F33581B597670520F4A9466D20C3CA4933F7FF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
calloc
free
fwrite
malloc
strlen
strncmp
abort
vfprintf
BrotliGetDictionary
BrotliGetTransforms
BrotliSetDictionaryData
BrotliTransformDictionaryWord
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
194B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Decache Exporter/bin/7z/Codecs/brotli/libbrotlidec.dll
- IMPHASH c20a3e71eacc9ed7525b5f46ed0ec0b3
- SHA256 22867c89943eff315e5e811564e6d96a208134470e4e5adf0d46ba9a4f9ad3cd
- MD5 198affe102c5998980300fa307742f11
- SHA1 854845c60ed8470836c435a7a1131a3d015de4a9
- SHA512 5644c2647176285dbf8bbf4c9d37dd5169088104b5b0efa6116521d7736722bbfe62c9375a98e9e3872f2649ac3187911a0106cbc25d0ba1797aad285fedede6
- SSDEEP 768:2Q1n9COlu6I3cY5487AekN5X4Sa0ValJ7diL1BFnbx0vuzd6+7fT/bnDvLXzf7jz:fn0x3cYFMRN5oSa0g0fJgMap
- TLSH T1EB337D41BB932CBADD5B03B452427F7F06BD4B025926C66FE1B4B9DEBE232137644148
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
calloc
free
fwrite
malloc
memcpy
memmove
memset
strlen
strncmp
abort
vfprintf
libbrotlicommon
BrotliGetDictionary
BrotliGetTransforms
BrotliTransformDictionaryWord
BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
481B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Decache Exporter/bin/7z/Codecs/brotli/libbrotlienc.dll
- IMPHASH 93ceb0ae2cabf7658739d75095a38aa2
- SHA256 ba9675ba658f609e01a6cbd4fcc10f4413ec40c720824dbc25ade5edfa6299fc
- MD5 e33e47300deaf84d658d225101a51dd5
- SHA1 b03c75819abfafb7b20608e392d4cc68a6ba824b
- SHA512 1fa9f983789eac168ecef370ece11baf615d990cd01d103687b16a26319fd7272b106732b2023a223ef4063e685f9b02006b3b4d503d5800e546447c4fbae4f5
- SSDEEP 12288:1MOZpu6WGnJSP+aqnKYufoMMzXTw05nmZfRR8:1MD6WGnJSP+aqnKYufVtAmZfR2
- TLSH T1F2C47D06DDE383F2E84749744DA7B63F4A3467118420DC7BF76CAE51FA93B06019AA8D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
calloc
exit
free
fwrite
malloc
memcpy
memmove
memset
strlen
strncmp
abort
vfprintf
libbrotlicommon
BrotliGetDictionary
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
Name
.text
Size
249KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
292KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
417B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Decache Exporter/bin/check_dir_exists.bat
- SHA256 630cb7e4db8334c5a5245f1964d2e7508e2aece7afb54adeb34e30d2256acf54
- MD5 e8f12cd121ec63c0218ae98067f59d23
- SHA1 fdd9c0b3725e13a75402d9e402d3712fe79d1b19
- SHA512 21e042d33df8e0d94bf4c35b99bd5c543036df1520212ab8c67c7d777db0650730d47c3412507cff6930360c5d72ee4f9054235b0a23b4d4a6f4bf75681b45fe
- TLSH T144F00E93A8711D0226FCA26ACACE71613E92800C031817F9324071FA91647A80FDB9CC
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/check_size.bat
- SHA256 9c1ee564da975281f5f9d6deb93497a3a389f0908d85b6ab25440f02caebb1d7
- MD5 7e99f785f7d3bedc25c2674265656685
- SHA1 7603e466852a1f77642273a155de1caaa402e427
- SHA512 187643687d938d7dcbb53b6f20c25af081fb4c996fea1b98e708280a708380f1497aa67231b1059b2627c7b29a01f95ab9cfd34c69ec70daa22660f8545fab8e
- TLSH T197F0F6ED441862527CB6CA767901D052F74A581B1101A14C3B9EE6C5AF3635242EA6EA
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/curl-ca-bundle.crt
- SHA256 adf770dfd574a0d6026bfaa270cb6879b063957177a991d453ff1d302c02081f
- MD5 c726ae88fd600aa26df1d30f42b51fec
- SHA1 0176d2fbcc41808b1b03b773145b2549953a8334
- SHA512 cc129ae1a4377a43a74b0854b6eccb2b315cdfce018142d1dd5524fb64c8945cde067cb18f366351fa7d6af3f9f36cf21bc1f626f987f9e4627878472ea59cde
- SSDEEP 6144:XNc597qxzwd9aUaNR6dTd4tL2b02dTDkMgX:XNcf7M576f4tLe0mIM0
- TLSH T12024AEE78F852D4928E3E490C9AB126EC959C362EDDBB0B31D193841C785B3D66FD08D
- MD5 SHA1 SHA512 SSDEEP TLSH
Decache Exporter/bin/curl.exe
- IMPHASH 1cb123c09fad3f8eda0c7c34a7e2f76c
- SHA256 91bec35c02d901fa4e9cbdb84a59bfa538d82f5a4d81fd0f3a6f8e0b907e82bf
- MD5 43d76e80407faaa9f076d28a2eb62d6d
- SHA1 3e1bab1cf235f715791bd622daf492f6f94ea251
- SHA512 f443e283a5cc097e2fee6c712005f14c06750717c5065743a92bd9a0850b0ac3fbc2d85ad19ece4343837022460f7142ae98fb4e663eb9d380878a9f2ba94a07
- SSDEEP 98304:M8eY0vJLrYS2LeHqRTaWkD5mZR9pEHRWWZOI2KiMDJmEF9BV+mRfO685Focpquwt:M8envJLrYS2LeHqRnkD5mZR9pEHRWWZj
- TLSH T1E6065A84FA8350F2FE5B5CB1A04BF7BF4B349601D830CEE6DA44D945F823A52660A76D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ec:60:be:99:99:19:46:9d:21:84:0c:13:72:14:ea:f7:f0:ba:43:69:42:46:d7:45:83:ea:9b:75:fc:aa:a7:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=curl-for-win Code Signing Authority,OU=curl-for-win Code Signing Authority,O=curl-for-win
Chains
May 27, 2026
CN=curl-for-win Code Signing Authority,OU=curl-for-win Code Signing Authority,O=curl-for-win
CN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-win
Subject
CN=curl-for-win Code Signing Authority,OU=curl-for-win Code Signing Authority,O=curl-for-win
Serial Number
01
Issuer
CN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-win
Timespan
Aug 31, 2018 - Aug 30, 2021
Subject
CN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-win
Serial Number
af:42:e4:09:5d:94:1d:14
Issuer
CN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-win
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2018 - Aug 31, 2023
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
DeregisterEventSource
RegisterEventSourceW
ReportEventW
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringA
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore
kernel32
CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateFiber
CreateFileA
CreateFileMappingA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FormatMessageA
FormatMessageW
FreeLibrary
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileSizeEx
GetFileTime
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
GetVersion
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MapViewOfFile
Module32First
Module32Next
MoveFileExA
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleA
ReadConsoleW
ReadFile
SearchPathA
SetConsoleMode
SetEndOfFile
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepEx
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoA
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_chmod
_errno
_exit
_fileno
_fstati64
_get_osfhandle
_getpid
_initterm
_iob
_lseeki64
_onexit
_setmode
_snwprintf
_vsnwprintf
_stati64
_strdup
_stricmp
_strnicmp
_strtoi64
_sys_nerr
_vsnprintf
_wfopen
abort
atoi
calloc
clearerr
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getc
getenv
islower
isprint
isspace
isupper
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
localtime
gmtime
difftime
printf
putchar
puts
qsort
raise
realloc
rename
rewind
setbuf
setlocale
setvbuf
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tolower
vfprintf
time
wcscpy
wcslen
wcsstr
_stat
_fstat
_write
_unlink
_strdup
_setmode
_read
_open
_mkdir
_isatty
_getch
_fileno
_close
_access
normaliz
IdnToAscii
IdnToUnicode
user32
FindWindowA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
SendMessageA
wldap32
ber_free
ldap_bind_s
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len
ws2_32
WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
776KB
Virtual Size
776KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
49B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Decache Exporter/bin/data/asset_data.txt
- SHA256 1ef67c3d4d7abdb6be94088490fe7eb4fb242dd5f956d28f2a0a83dd4df027c1
- MD5 3358faafb94ebc98fea9f40425ecce82
- SHA1 b821bd50947d9d386d914455a0f70a085aae2255
- SHA512 ea367c4693ecc8388b671ff2d6ec2c5ab004b0e025fd7dbf7b2d78bac7044682996714f2122179a28b4acb9ae4568f56954c741787f55add273e1569f2a47c84
- SSDEEP 1536:N+psGeJNmhIAbLxkSFJKelWSKPQZkO0pIumqvhfGKpZ8Y:kpiJNmhIAbLqulx3E3mKIY
- TLSH T1565339139C443EBF4E7395999C1C0F426AB152C1B2CFFD46A198985AA533E39FDE3428
- MD5 SHA1 SHA512 SSDEEP TLSH
Decache Exporter/bin/data/history_data.txt
- SHA256 a05b11f5c0019bdf07545a47745da6f70ce234e021d490888966be7cbdeab4f3
- MD5 e469607edafda2648d78c644dbe90afe
- SHA1 ce3b5d0564818664d5efee173c750d35c116a520
- SHA512 f2770086c859271ca20b6315d9299b5ddd5a0ef6ae9f37567527baa4e2cc9c813d22168690949eb8108763b30d457d3418465a3db4b7e0db521fd2b7d848b5f8
- SSDEEP 384:RAithdO2i/05WYVnrqS2whoszWX6IXkMEfmeemaHIDK6Z/Mq9H:bthd/isvVrqSvhoszWX6IX2m+PKC/MWH
- TLSH T1C7924B0ED0597EB80781CD583421F9ADF4EC5B4993BCBE48A54ED41F9B2B5398327E80
- MD5 SHA1 SHA512 SSDEEP TLSH
Decache Exporter/bin/data/unique_names.txt
- SHA256 11660a4d12115e730658d446102bdd0b19c3e0910e29cdc863f56f54e00ee4cf
- MD5 99b97407c75b8a975daa06f9968be908
- SHA1 202f07b9f8459c21da24f0d574cc1a1c6e7eaf21
- SHA512 d437c306ed9e876cf0fcebc0cb771673deee6cde77c9b3608318f9de450e1e67c35835d50cf263e88e07d03682de8479abaeb4a7c1c62d6099114e790a38b91e
- TLSH T158B01211D0B401890EA2C2EA608833521002FB2C209D425214F2FF01E6C55C4F34FBFF
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/data/video_data.txt
- SHA256 6ce672e9abab2f745c68be69cecaf2bf92cff636124c9fd70e2dd2d9a107e528
- MD5 eca4185a78d8d38511b6667f1820989f
- SHA1 859759ea22b89718db27263496881a1848a509a9
- SHA512 9237eb714ef3ce49909d1a7fe295a3a5903a9fdcdf7b270691921e2dd3d6e866507d6603cb39210a37219ecad89502e2f77ad767c2c15aac1477b711933edc6d
- SSDEEP 1536:mrBND1ujnrxjmJV1bD2lbtlsapbxGe8RAb8i32pcdGQ:O3uJsBDuJlXpA432qdT
- TLSH T1FD537F706A7A69F0D743D41CB20D7B333B387B02DED0D89431A539A3169B50AEBA7B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Decache Exporter/bin/data/watch_page_data.txt
- SHA256 a5340d8ae4547c1ac900df31e7867fd24d523d88a7d95945765750981f4fa3e9
- MD5 c3bd78ef766410bcdf7236a5c9934924
- SHA1 721753525572489151a40352b6d8cd0f1c3514fc
- SHA512 7041d44ffa96e3c21db329bf91eb1ebebb1fe360c17faec071b4ba2d69a249678d74793528bbaf798dbf73e74ebe53602f99a8c4ba5a4f2a78c0146a73483662
- SSDEEP 192:GdpcEZAzqd7MUTtfkTz9cjuSS09sTYF4VF+nLOgoN6z4aXo:ccEVd7Mktf5eEsTVF8BoNqs
- TLSH T1AEF18EADE0C906CB2481D9CDAA829D0038E57743A7AD5709025FC0B958DBCBEEA73494
- MD5 SHA1 SHA512 SSDEEP TLSH
Decache Exporter/bin/dd.exe
- SHA256 2f3d16ef80d336ff1d270af9c101443a6426600b6d7c6506d984cdbdc7c6e8f9
- MD5 168b73cc0f3d8c92c98c5028aec770df
- SHA1 7efcd6af6a0fda490b42e0ed4c5aa969079040d1
- SHA512 eed96b1d013e597bb9495918fee5260a8e17c5ba710315c4f7d3f92202a65a9751ad14248c5c7d88aeae9162ecd10a11c2806385268d18ceaa6bbf692ad5c421
- SSDEEP 6144:4GstW634w/+YvExOLm3hfpH2NqdMsBIdvHy/+o2tIxwgCQ:utroO+YvEkLmYzPda+f6Of
- TLSH T135746C73B6A04437D123267CDD1B9BB4983EBE103E2815866FED1D4C8F396923A25397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
296196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
289KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Decache Exporter/bin/ffmpeg.exe
- IMPHASH 6d917f3c96ace8e3841fcb40641c3860
- SHA256 78ee9aaa6d4a84c0e37bd1dab90710b5be9d4ee69bfceb79ea89e2a98b50ee28
- MD5 8bfdf34d127d3e27a7ab819ac4b3bb64
- SHA1 e74fb9ad94cb626ae0c10314e31d6340caa9f0f1
- SHA512 9c7ffb9772dd3856ac22728858f5edb2cfdd4612074719e656992ab194c324395a91e92561c2b1d17ccb8d41ea21747bdd9a377f097ed03c2b054ee6fa5bb82e
- SSDEEP 393216:3Aow4DHYa8TJfE3ufInfUkI6EOglBGCnrpbt6n9QtKER8ppvJ:9HGlBJrKEKpX
- TLSH T1DEE64B82E6C742F0C86B0870409BF67F57302E09D824CE5AFFC4BA65F9B3A716925759
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5456
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
avifil32
AVIFileExit
AVIFileGetStream
AVIFileInfoA
AVIFileInit
AVIFileOpenA
AVIFileRelease
AVIStreamInfoA
AVIStreamRead
AVIStreamReadFormat
AVIStreamRelease
kernel32
CloseHandle
CreateEventA
CreateFileMappingA
CreateMutexA
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FreeLibrary
GetCommandLineW
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFile
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleTextAttribute
SetEvent
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_close
_fdopen
_fileno
_getch
_isatty
_kbhit
_open
_read
_setmode
_strdup
_tempnam
_unlink
_write
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_aligned_free
_aligned_malloc
_amsg_exit
_atoi64
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fmode
_fstat
_fstati64
_ftime
_get_osfhandle
_initterm
_iob
_lock
_lseeki64
_onexit
_setjmp3
_stat
_stati64
_stricmp
_strnicmp
_unlock
_vsnprintf
_winmajor
_wopen
_write
abort
acos
asin
atan
atof
atoi
atol
bsearch
calloc
ceil
clock
cosh
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
floor
fopen
fprintf
fputc
fputs
fread
free
frexp
fscanf
fseek
fsetpos
ftell
fwrite
getchar
getenv
gmtime
islower
isprint
isspace
isupper
localeconv
localtime
log10
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
mktime
perror
printf
putc
putchar
puts
qsort
raise
rand
realloc
rename
scanf
signal
sinh
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tan
tanh
time
tolower
toupper
ungetc
vfprintf
vsprintf
psapi
GetProcessMemoryInfo
shell32
CommandLineToArgvW
user32
DestroyWindow
GetWindowLongA
MessageBoxA
SendMessageA
SetWindowLongA
winmm
timeGetTime
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
gethostname
getpeername
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
10.2MB
Virtual Size
10.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rotext
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rodata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Decache Exporter/bin/history/BrowsingHistoryView.exe
- IMPHASH dd7a1036e2d9dbbee2b26870d8bd5269
- SHA256 a14055e8b09fd980e82a3eb551fe7ca60018b5486d46e462fda29ee88f252ca0
- MD5 0f5aba101aa4d94be74690aa60bf7840
- SHA1 40557e751e76b1f9608c2d0c12ce0cccd2588e11
- SHA512 a987c36c3b5ab8b5e65a5af8542c3cd9ec67187aab899211809c86aab93dea962e4a4ffb8107de60d0e9c6661c275a9b2f563165c2a7ac92b68901ddfab68789
- SSDEEP 12288:RxNu2A3uJepO0u9VMpw5i/9U2gI4Ka0N3E3blMq3ZWb54D8XYEcGFPH2EEYiBB2i:TYZ30epws6Civ50u3bX8b54D8XYEcyzo
- TLSH T16EE49D83FBE380F1E8A614B915FE567B1D35AA054336D6D7ABC42C408DA12F1693E387
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
CreateToolbarEx
CreateStatusWindowW
ImageList_SetImageCount
ImageList_AddMasked
ImageList_Add
ord17
ImageList_Create
ImageList_ReplaceIcon
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
msvcrt
strftime
qsort
_wcslwr
_itow
strchr
_endthreadex
memmove
modf
wcstoul
_memicmp
free
_msize
_beginthreadex
_gmtime64
realloc
_wcsnicmp
__dllonexit
wcsrchr
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
_ultow
sprintf
_wcsupr
_wtoi
_wcsicmp
wcschr
wcsncat
_snwprintf
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
memcpy
_except_handler3
_controlfp
__set_app_type
memset
wininet
FindFirstUrlCacheEntryW
FindCloseUrlCache
FindNextUrlCacheEntryW
kernel32
GetStartupInfoW
GetModuleHandleA
HeapSize
DeleteCriticalSection
InitializeCriticalSection
SetEndOfFile
GetFileAttributesExW
FormatMessageA
TryEnterCriticalSection
FlushFileBuffers
GetProcessHeap
UnlockFileEx
OutputDebugStringW
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
CloseHandle
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
CompareFileTime
CopyFileW
CreateFileW
DeleteFileW
FreeLibrary
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetTickCount
SetFilePointerEx
GetLastError
MultiByteToWideChar
lstrcpyW
LockResource
ReadFile
LocalFileTimeToFileTime
FindFirstFileW
GetModuleFileNameW
SetFilePointer
lstrlenW
WriteFile
GlobalUnlock
GetTempPathW
GlobalAlloc
FindResourceW
GetSystemDirectoryW
LoadResource
WideCharToMultiByte
FindNextFileW
LoadLibraryExW
SizeofResource
FindClose
FormatMessageW
GetWindowsDirectoryW
GlobalLock
GetVersionExW
FileTimeToLocalFileTime
LocalFree
GetDateFormatW
GetTimeFormatW
GetTempFileNameW
GetFileAttributesW
DosDateTimeToFileTime
CreateFileMappingW
OpenProcess
DuplicateHandle
GetCurrentProcessId
MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
GetCurrentProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
GetCurrentDirectoryW
SetErrorMode
ExitProcess
ReadProcessMemory
Process32NextW
CreateToolhelp32Snapshot
Process32FirstW
EnumResourceTypesW
GetCurrentThreadId
HeapAlloc
OutputDebugStringA
GetVersionExA
LockFileEx
Sleep
EnterCriticalSection
QueryPerformanceCounter
GetDiskFreeSpaceW
HeapDestroy
HeapFree
GetFullPathNameW
LeaveCriticalSection
GetTempPathA
GetFileAttributesA
GetFullPathNameA
WaitForSingleObject
CreateFileMappingA
GetSystemTime
HeapCreate
AreFileApisANSI
InterlockedCompareExchange
DeleteFileA
HeapValidate
UnlockFile
HeapReAlloc
FlushViewOfFile
CreateFileA
GetDiskFreeSpaceA
LockFile
WaitForSingleObjectEx
CreateMutexW
GetSystemInfo
HeapCompact
user32
CreatePopupMenu
ReleaseDC
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
GetDC
SetDlgItemTextW
GetDlgItemTextW
GetSystemMetrics
GetWindowRect
GetWindowPlacement
GetDlgItemInt
DeferWindowPos
SetDlgItemInt
SetWindowPlacement
CreateWindowExW
BeginPaint
EndPaint
GetWindow
GetClientRect
SendDlgItemMessageW
DrawFrameControl
EndDialog
SetWindowLongW
GetDlgItem
SetWindowTextW
UpdateWindow
SendMessageW
InvalidateRect
SetMenu
SetWindowPos
LoadAcceleratorsW
DefWindowProcW
PostMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
LoadImageW
LoadIconW
GetSysColor
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetParent
GetFocus
KillTimer
SetTimer
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
CheckMenuItem
GetCursorPos
GetSubMenu
GetMenu
EnableWindow
MapWindowPoints
InsertMenuItemW
FillRect
EnableMenuItem
GetClassNameW
GetMenuStringW
ScreenToClient
MoveWindow
GetMenuItemCount
CheckMenuRadioItem
EnumChildWindows
DestroyWindow
LoadStringW
GetDesktopWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
GetKeyState
SetMenuItemInfoW
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
DrawTextExW
DispatchMessageW
InsertMenuW
RemoveMenu
IsDialogMessageW
TranslateMessage
PeekMessageW
GetMonitorInfoW
MonitorFromWindow
ReleaseCapture
SetCapture
gdi32
SetBkColor
GetTextExtentPoint32W
SetStretchBltMode
CreateSolidBrush
StretchBlt
PatBlt
GetStockObject
SetPixel
GetObjectW
GetPixel
SetDIBits
DeleteDC
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
SetTextColor
CreateFontIndirectW
GetDeviceCaps
SetBkMode
comdlg32
FindTextW
GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
advapi32
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
shell32
ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetMalloc
SHBrowseForFolderW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
SysFreeString
Name
.text
Size
548KB
Virtual Size
547KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=64, version=9210,
count=11, id=28, version=9178,
count=2, id=25, version=9210,
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=364, id=1, productName=Unmarked objects,
count=45, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Decache Exporter/bin/history/ChromeHistoryView.exe
- SHA256 2c1590d687a8609fb3107f454bbbabe12b63e2fd84f63e4cfbef44be3a810223
- MD5 853406ad48646e2ac2069c69882ca7b8
- SHA1 64652560c73677696537ecbeeee64bd032b69c1b
- SHA512 421d37f8f6f39753679129d1566629f345d7e2cd731815b8c6a4df58ec86cc5a7e5d19dbc6f064fd688602caebd988ce36bb52dceaaf640fe4a62381a582bc39
- SSDEEP 6144:RcCDbGfc8sg2LcBD1o9pDjNaazqpDbqjuNlPwJ32I:dbGU8sg2oN1SWl2juAJmI
- TLSH T191241206FA458EBAFED3963BD2C20319F504311483FE9746F246EFFA7A14690A055D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
406416
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
209KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=18, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=64, version=9210,
count=11, id=28, version=9178,
count=334, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=26, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 3afb9951dd8a26153b0f54281006f5f11ff05ef92890f9108c2ef771b12efcfb
- MD5 763730023fec6eb12244ab79cf4fb2f3
- SHA1 d72b6201d8e8f7098dc11f2cea1e734e0f4220ee
- SHA512 1442b0725e6c215b9a0e274324b73f4c54214928111ddc476724e27de03e13a0b812d8ff88a119b34ea13db526b5f5a32f578a6c43b991d5613eda22b6705ae2
- SSDEEP 6144:kXiNX6M+WFlUzAe6OT/84qxurjh7reN8Xooj0I3GajlsleMRBoO/2EEYva2oZI:k2XIWFoAv+/i4jQloj0IWeldMRBos2EF
- TLSH T1B184AE52F3E2C075D4A710B14A6B5F26AEBABB105231C85757C81C8A5FB12A1FB3E317
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
314892
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
306KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=18, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=64, version=9210,
count=11, id=28, version=9178,
count=334, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=26, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Decache Exporter/bin/history/MozillaHistoryView.exe
- SHA256 b38d79eed498d0aa6d310e86dc8044f9684f5b8d350e9bd7cacf79a881b873ab
- MD5 561621bd0386450c39ca65849482f6ac
- SHA1 d10cee5d89a6b42dfbc1203098f532b89cac58cf
- SHA512 f1d74a15d37cd36006a6ef22217fd459ee65a2b7f0659f75e11ee524a98e37753a0f8a2c9531a4ebe6737d0a09cff0a2cad6409b08feea24b9b2882785f1d777
- SSDEEP 6144:0kuGpIpLrh48KMY0sC/dmdiEkjPW0nWZy:TuGpSq8K70XVDdW0nWZy
- TLSH T18D2412E569D61756DC2F59784157CD323CF8B2D92EC281BA78A8D83A38B2B403F63017
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cc:59:f5:59:0b:7f:69:c7:67:e5:46:58:da:43:18:2d:e4:aa:6e:51:6a:ee:c4:37:8e:7e:94:19:8f:07:4e:1f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Chains
Nov 3, 2021
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Serial Number
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 9, 2019 - Sep 9, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
450736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
209KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=64, version=9210,
count=11, id=28, version=9178,
count=2, id=25, version=9210,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=327, id=1, productName=Unmarked objects,
count=30, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 b19d9b3e261a419f8cc1fd4472538481208c9e6cbb6d737457b110fd39757c2b
- MD5 5746af88dbfeb861728ef9e52ae12401
- SHA1 dc164bfceba7d9772c10a107ca22f57293bdf44d
- SHA512 f0a4e9f194d95a2947c76bc471dde90feb2ec1dbac51a14537326a26b488b616561d3dd391b55c47109f25fa3416ac341e78cdd2fb2af6cd229f856b29f50c07
- SSDEEP 6144:V/mt3qm7jY6AtkoZL60nHRrOWFYkGMiFrf53yB3srCG2MHhKYtwmZhpQ4NBcTzWp:Fm/FolO01KrgB37YwKh64bCIVHJ
- TLSH T10E94AF92EAD3E0F1E98661F965F76F3B5E314201231AC6C3EBD02D519E911E0B63E349
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
370998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
361KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=64, version=9210,
count=11, id=28, version=9178,
count=2, id=25, version=9210,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=327, id=1, productName=Unmarked objects,
count=30, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Decache Exporter/bin/history/scan_history.bat
- SHA256 c369d78c487b5517a07b84c7d1abbb7f4220d45fce706f546b8521a2ce2c1c0a
- MD5 00b40e07ff9e10363fb4a2dbbcb844ab
- SHA1 c38a8003aa4b860027cbb0a12b17cd04fbbef2f7
- SHA512 249b5407c5986338bbfd82bbdbbaae6cb8f4b67d1be0c5e233a5d0264b515c5058dcb4d5cd073511efb783e725e3cec98a01aac4ac12a6f81a85602ed45582f3
- TLSH T10241F00E600928F14CF643755E2881DFF78A91470102438C7DDE85DEBF3655292EAAF6
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/libcurl.dll
- IMPHASH 87c92c902645f25222a448cd96111ce1
- SHA256 aa270fa7f6afa157a876f1c07e7b4e1640d9090529772913191c64ace271782d
- MD5 59220af410d39688a82a8ab4c60ce52e
- SHA1 c70c9adaf720af2b5aa7c30f6863d1a701f4331f
- SHA512 22c3e0fd52bd11d483d068ea15176d481c67f7ac786907001fc5c7ff4933b0e1b8d47a601a3a87cdabf9840b7c8d181a10e978e32aa53d5667ec165d87b7ec83
- SSDEEP 24576:XZ3pjG1LYKxkRnHe7YIZBEMBIrrzUpsrixM4TGsjA5Dz:J7+FTTGJz
- TLSH T14025AF02BB8245B2D9870030E05E7BBBAF3D9615A60289C7EBE4DD589C52762F31F35D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
6f:5c:fd:20:9b:ee:db:20:65:df:67:65:5d:ab:88:29:26:4f:e8:fa:68:81:48:3b:98:20:77:55:4f:a5:82:bc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=curl-for-win Code Signing Authority,OU=curl-for-win Code Signing Authority,O=curl-for-win
Chains
May 27, 2026
CN=curl-for-win Code Signing Authority,OU=curl-for-win Code Signing Authority,O=curl-for-win
CN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-win
Subject
CN=curl-for-win Code Signing Authority,OU=curl-for-win Code Signing Authority,O=curl-for-win
Serial Number
01
Issuer
CN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-win
Timespan
Aug 31, 2018 - Aug 30, 2021
Subject
CN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-win
Serial Number
af:42:e4:09:5d:94:1d:14
Issuer
CN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-win
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2018 - Aug 31, 2023
Minor OS version
0
Major OS version
4
Entry point
5040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
libcrypto-1_1
ASN1_OCTET_STRING_free
ASN1_STRING_get0_data
ASN1_STRING_length
ASN1_STRING_print
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_TIME_print
BIO_ctrl
BIO_free
BIO_new
BIO_new_file
BIO_new_mem_buf
BIO_printf
BIO_puts
BIO_s_file
BIO_s_mem
BN_CTX_free
BN_CTX_new
BN_bin2bn
BN_bn2bin
BN_clear_free
BN_div
BN_mod_exp
BN_new
BN_num_bits
BN_print
BN_rand
BN_set_word
BN_sub
BN_value_one
CRYPTO_free
CRYPTO_get_ex_new_index
CRYPTO_malloc
DES_ecb_encrypt
DES_set_key
DES_set_odd_parity
DH_get0_key
DH_get0_pqg
DSA_SIG_free
DSA_SIG_get0
DSA_SIG_new
DSA_SIG_set0
DSA_do_sign
DSA_do_verify
DSA_free
DSA_get0_key
DSA_get0_pqg
DSA_new
DSA_set0_key
DSA_set0_pqg
ECDH_compute_key
ECDSA_SIG_free
ECDSA_SIG_get0
ECDSA_SIG_new
ECDSA_SIG_set0
ECDSA_do_sign
ECDSA_do_verify
EC_GROUP_get_curve_name
EC_GROUP_get_degree
EC_KEY_free
EC_KEY_generate_key
EC_KEY_get0_group
EC_KEY_get0_public_key
EC_KEY_new_by_curve_name
EC_KEY_set_private_key
EC_KEY_set_public_key
EC_POINT_free
EC_POINT_new
EC_POINT_oct2point
EC_POINT_point2oct
ENGINE_by_id
ENGINE_ctrl
ENGINE_ctrl_cmd
ENGINE_finish
ENGINE_free
ENGINE_get_first
ENGINE_get_id
ENGINE_get_next
ENGINE_init
ENGINE_load_builtin_engines
ENGINE_load_private_key
ENGINE_register_all_complete
ENGINE_set_default
ERR_clear_error
ERR_error_string_n
ERR_get_error
ERR_peek_error
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_get_app_data
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_set_app_data
EVP_CIPHER_CTX_set_padding
EVP_CIPHER_meth_free
EVP_CIPHER_meth_new
EVP_CIPHER_meth_set_cleanup
EVP_CIPHER_meth_set_do_cipher
EVP_CIPHER_meth_set_init
EVP_CIPHER_meth_set_iv_length
EVP_Cipher
EVP_CipherInit
EVP_DigestFinal
EVP_DigestFinal_ex
EVP_DigestInit
EVP_DigestInit_ex
EVP_DigestSign
EVP_DigestSignInit
EVP_DigestUpdate
EVP_DigestVerify
EVP_DigestVerifyInit
EVP_EncryptInit
EVP_EncryptUpdate
EVP_MD_CTX_free
EVP_MD_CTX_new
EVP_PKEY2PKCS8
EVP_PKEY_CTX_free
EVP_PKEY_CTX_new
EVP_PKEY_CTX_new_id
EVP_PKEY_copy_parameters
EVP_PKEY_derive
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_free
EVP_PKEY_get0_DH
EVP_PKEY_get0_DSA
EVP_PKEY_get0_RSA
EVP_PKEY_get1_DSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_get1_RSA
EVP_PKEY_id
EVP_PKEY_keygen
EVP_PKEY_keygen_init
EVP_PKEY_new
EVP_PKEY_new_raw_private_key
EVP_PKEY_new_raw_public_key
EVP_PKEY_set1_DSA
EVP_PKEY_set1_EC_KEY
EVP_PKEY_set1_RSA
EVP_aes_128_cbc
EVP_aes_128_ecb
EVP_aes_192_cbc
EVP_aes_192_ecb
EVP_aes_256_cbc
EVP_aes_256_ecb
EVP_bf_cbc
EVP_cast5_cbc
EVP_des_ede3_cbc
EVP_get_digestbyname
EVP_md5
EVP_rc4
EVP_ripemd160
EVP_sha1
EVP_sha256
EVP_sha512
GENERAL_NAMES_free
HMAC_CTX_free
HMAC_CTX_new
HMAC_Final
HMAC_Init_ex
HMAC_Update
MD4_Final
MD4_Init
MD4_Update
MD5_Final
MD5_Init
MD5_Update
OCSP_BASICRESP_free
OCSP_RESPONSE_free
OCSP_basic_verify
OCSP_cert_status_str
OCSP_check_validity
OCSP_crl_reason_str
OCSP_resp_count
OCSP_resp_get0
OCSP_response_get1_basic
OCSP_response_status
OCSP_response_status_str
OCSP_single_get0_status
OPENSSL_load_builtin_modules
OPENSSL_sk_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_value
OpenSSL_version_num
PEM_read_bio_DSAPrivateKey
PEM_read_bio_ECPrivateKey
PEM_read_bio_PrivateKey
PEM_read_bio_RSAPrivateKey
PEM_read_bio_X509
PEM_write_bio_X509
PKCS12_PBE_add
PKCS12_free
PKCS12_parse
PKCS8_PRIV_KEY_INFO_free
PKCS8_pkey_get0
RAND_add
RAND_bytes
RAND_file_name
RAND_load_file
RAND_status
RSA_flags
RSA_free
RSA_get0_factors
RSA_get0_key
RSA_new
RSA_set0_crt_params
RSA_set0_factors
RSA_set0_key
RSA_sign
RSA_size
RSA_verify
SHA256_Final
SHA256_Init
SHA256_Update
UI_OpenSSL
UI_create_method
UI_destroy_method
UI_get0_user_data
UI_get_input_flags
UI_get_string_type
UI_method_get_closer
UI_method_get_opener
UI_method_get_reader
UI_method_get_writer
UI_method_set_closer
UI_method_set_opener
UI_method_set_reader
UI_method_set_writer
UI_set_result
X509V3_EXT_print
X509_EXTENSION_get_data
X509_EXTENSION_get_object
X509_LOOKUP_file
X509_NAME_ENTRY_get_data
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_NAME_print_ex
X509_PUBKEY_free
X509_PUBKEY_get0_param
X509_PUBKEY_new
X509_PUBKEY_set
X509_STORE_add_lookup
X509_STORE_set_flags
X509_check_issued
X509_free
X509_get0_extensions
X509_get0_notAfter
X509_get0_notBefore
X509_get0_signature
X509_get_X509_PUBKEY
X509_get_ext_d2i
X509_get_issuer_name
X509_get_pubkey
X509_get_serialNumber
X509_get_subject_name
X509_get_version
X509_load_crl_file
X509_verify_cert_error_string
d2i_ASN1_OCTET_STRING
d2i_OCSP_RESPONSE
d2i_PKCS12_bio
i2a_ASN1_OBJECT
i2d_X509_PUBKEY
i2t_ASN1_OBJECT
libssl-1_1
BIO_f_ssl
SSL_CIPHER_get_name
SSL_CTX_add_client_CA
SSL_CTX_check_private_key
SSL_CTX_ctrl
SSL_CTX_free
SSL_CTX_get_cert_store
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_sess_set_new_cb
SSL_CTX_set_alpn_protos
SSL_CTX_set_cipher_list
SSL_CTX_set_ciphersuites
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_keylog_callback
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_options
SSL_CTX_set_post_handshake_auth
SSL_CTX_set_srp_password
SSL_CTX_set_srp_username
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_SESSION_free
SSL_alert_desc_string_long
SSL_connect
SSL_ctrl
SSL_free
SSL_get0_alpn_selected
SSL_get_certificate
SSL_get_current_cipher
SSL_get_error
SSL_get_ex_data
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_privatekey
SSL_get_shutdown
SSL_get_verify_result
SSL_new
SSL_pending
SSL_read
SSL_set_bio
SSL_set_connect_state
SSL_set_ex_data
SSL_set_fd
SSL_set_session
SSL_shutdown
SSL_version
SSL_write
TLS_client_method
advapi32
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringA
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore
kernel32
CloseHandle
CreateFileA
CreateFileMappingA
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetFileSizeEx
GetFileType
GetLastError
GetModuleHandleA
GetProcAddress
GetStdHandle
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MoveFileExA
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepEx
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoA
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
_amsg_exit
_beginthreadex
_errno
_fstati64
_getpid
_initterm
_iob
_lock
_lseeki64
_stati64
_strtoi64
_sys_nerr
_unlock
_vsnprintf
abort
atoi
calloc
fclose
feof
fflush
fgets
fopen
fputc
fputs
fread
free
fseek
ftell
fwrite
islower
isspace
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
gmtime
difftime
qsort
realloc
rewind
setvbuf
sprintf
sscanf
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
tolower
vfprintf
time
wcslen
_write
_unlink
_strdup
_read
_open
_close
_access
normaliz
IdnToAscii
IdnToUnicode
user32
FindWindowA
SendMessageA
wldap32
ber_free
ldap_bind_s
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len
ws2_32
WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_version
curl_version_info
Name
.text
Size
647KB
Virtual Size
646KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
275KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Decache Exporter/bin/nirsoft/ChromeCacheView.exe
- SHA256 57f8e4e1d3339c0abadc0f64fc6a4abaff19cd138724cdbb3fae5f37905547c5
- MD5 690387324dc7c8704a9430cdabf22a7a
- SHA1 3d20c1f2f551dba4712f6dda43e87dd6cd32422b
- SHA512 9b44d2fee5fdb86dd3cd7a4aac74e6f984c4673130ad404c1ac22d58cb792f55ff1840264323bd27704bfaf9b0c32edb1db32a11d0cec03f965d97e180979605
- SSDEEP 6144:OaE1NFRBAaSMMuYPiBjlC3EkNdBbp247hZFM:sYanMXKBd2UO2
- TLSH T1D3442322EA369DD2D2714A351A9B0C358801FD63DE5B41964FB4795FBE362E8EE33C04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
579536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
324KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
238KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=126, version=50327,
count=51, id=110, productName=VS2005 build 50727, version=50727,
count=29, id=125, productName=VS2005 build 50727, version=50727,
count=164, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=316, id=1, productName=Unmarked objects,
count=81, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 04cbc94ebb5cf4380eb2e1d051382c1aeb6d5ed8527d73b0e65d5974e46fdd78
- MD5 17de3d09c1f6e7da317a5917d2304bf4
- SHA1 a89ac9619451654c29e8a713e77cead145f44546
- SHA512 803a70ea3fca271f2fc62993bc9d2512bf8eb46780bcfdbbfadc4747e3f18653e82107c353657be4aa64b130c6496b257d443e7a91f7974109bcd11aa22632ef
- SSDEEP 6144:OiNnnAPGzXnyecXz8dIUWTS4IIntzKssNDQBK4symzK7gmJ3N7Ct82CYpb9ik0jV:F2OjLkb/zz17HkphilUAHhlyG
- TLSH T163B4AE41F2E25230D96702B5CCBEAA31B6793D7C8221C85B63D47E0D78F2991D72A3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273435
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
326KB
Virtual Size
325KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=126, version=50327,
count=51, id=110, productName=VS2005 build 50727, version=50727,
count=29, id=125, productName=VS2005 build 50727, version=50727,
count=164, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=316, id=1, productName=Unmarked objects,
count=81, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Decache Exporter/bin/nirsoft/IECacheView.exe
- SHA256 9dd1f1f24504fb59f8719abf30b372686d8f7d1839e815901c1e55fc0d984d91
- MD5 d89faeb4effd5fdcabad93f323a34e02
- SHA1 8df43df5e063e2d1fb2d0ad3fde04d99662f598f
- SHA512 3e87e06e94661e7365e12e9f369bb6fcbff81c207207ba60faa60afaca2b4af1a9abed36ab9b894ea94c6eb03ef8390fd7dcd18dfae5e74c4545afaec68aea6e
- SSDEEP 768:HK/SaxeD3QFG2XIU1n6cVmGGv42DgRE4ZZxY9yFh1biWaiFQ/:TIIW/mbvBsY9OnbiW2
- TLSH T14D43E0C3D648AB40EA450AB051FBD631DE31F6A1FB54877A24AEC5AEBCC43E16E4404F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9e:75:08:7f:28:49:b4:0f:24:dd:35:91:cc:55:d4:b9:12:8f:08:8e:6a:94:90:03:56:13:b8:fe:67:f2:73:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Jun 4, 2016
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
a4:23:22:6a:38:17:cc:fe:b3:17:a1:8b:95:f6:4c:a0:29:59:5b:d7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Jun 4, 2016
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2014 - Sep 12, 2019
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Mar 30, 2016
Timespan
Mar 30, 2016 - Jun 30, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
100736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
39KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=273, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=30, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 117e945f4793e54bbff765773d2eeda77d78bfbc853da9e8dd6741d996178b95
- MD5 e50a1f756d2b30166d8401c6a04b08f2
- SHA1 8c39ca21f2025138b38e8fcf9badf588f2011fa4
- SHA512 3c6421c75a166b8c5fdf92b11c7f9b28fbe3a29fbb68b35db0ec5c3743179b8ed413f901c9266b35b7dde3b28ceede84d8bd9355a8da1647de078a87eb2c66e8
- SSDEEP 1536:orWi3BwoeL1DL74KqMbdHt3ilfLY9aP74l:oN/kemj/9aP74l
- TLSH T18A835B03B2E09072F6E316703E765F669AF9B9316638CA0F87411E0B6CB46C1DE25397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
60248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=273, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=30, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Decache Exporter/bin/nirsoft/MZCacheView.exe
- SHA256 00e2702a66819314becfc9b5b513470f3c3bceca2035844ed36ac6a0642ec29d
- MD5 277ed0d69127c7d69c465619612669b0
- SHA1 b97b1af35a5c319c84b9fd870fa451de2ed3fc10
- SHA512 f8ebf423d869057754ed47e0512081868b9ea0959238bc646e5fe771efd5f05c63fa04272563cc428c5646c526a2108095e73d1242632ff160dfbb739850bc4e
- SSDEEP 6144:6O57wM2RdrJFyFPoJ57JJjglY+3Eoq7znj89DvIlZkuC:xwRWFwJ57JJElHUxf4tgtC
- TLSH T1A634127ACBF818D2E225513065879234442EFE25B2EECFAFD6E539ABFE705202563501
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
569728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
237KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=126, version=50327,
count=56, id=110, productName=VS2005 build 50727, version=50727,
count=30, id=125, productName=VS2005 build 50727, version=50727,
count=154, id=109, productName=VS2005 build 50727, version=50727,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=301, id=1, productName=Unmarked objects,
count=81, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 15fc64cc007d398278f2d51c333d1e8838e8212d155306c9841a8695e5248a76
- MD5 c2231ed439c0e4f5ec28431456c81558
- SHA1 df89957375e21617efa5e4f55052c9623346e73e
- SHA512 63a35e1ba3382257fce9d4d2ca425a13b1841330038025b5194b085a8a356605715b296a795e66519e213f2c8b19f5ab5b9eb5461cdb4a2dfe4016641ef0d769
- SSDEEP 6144:V8y7SfBZzCt9eCNYB+XP3WJ4Y6ww9gqDj8ZjUsRJjKmgZmxBHfurS4AhdNorGvHQ:VB7OVBSPmuWwNGurjAHhlyr
- TLSH T1C1B4BF82F2D25231E55B02B5CCBDAB31B6783E784225C85B63D43E0D79F1990D72A3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
275531
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
324KB
Virtual Size
324KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=126, version=50327,
count=56, id=110, productName=VS2005 build 50727, version=50727,
count=30, id=125, productName=VS2005 build 50727, version=50727,
count=154, id=109, productName=VS2005 build 50727, version=50727,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=301, id=1, productName=Unmarked objects,
count=81, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Decache Exporter/bin/nirsoft/OperaCacheView.exe
- SHA256 3102c695318771c93a94fa8910d4de2b52d126df549bfa8f3248faf0baf29238
- MD5 ade37fb974703e236c1de47785b9b633
- SHA1 69de604b03e52a93cb1ce873b3e45c67a1e27314
- SHA512 e685b3d96f4c5830b99743d6193cb59e223610e72b22757306f2edc92b91817c9d59096435e767636062f3cc21486bdd675a2aa7a108444f085e307620a47ac8
- SSDEEP 768:L8QQiGS8vw5BJ5IXU+sya9q977GGvajbsmilYAjMtQOgROQ:L8QQij8Gr5IE+xvpuYOQ
- TLSH T11D13D085FF9486ABC5A3CAB041F766329B19FD1812721B2F53846F4FBD26B501D0E838
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
33KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=260, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=25, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 bf55f00dc3a380aae3f5d9eac50af20eeacc9042268e9266ff4eb51b4f33ab2c
- MD5 32c9d7846c81e59eb71a5436b415ee8c
- SHA1 a19c954bc211281e3dc860481b0b2b8b9b57d034
- SHA512 a68ea02f0e0a4c5af49851e07dfbae7430ac8119f5d75b6bba7bd3ed550d15c85f70c509e92887338047cb897aa2243daad8debd03cf24c26f5612074dec3140
- SSDEEP 768:DDoom1mj+gza5EcuOzF+xRWOVhN37betkeWl/9srqWoqL1komn+23NQOgROQ8trI:hjI55zF0pn3fe4FsrqQWsOQJB7Z
- TLSH T1937328037BE08072E9B35A706E776A219EBEFC319934CA0F9751590FACB5690D936313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=260, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=25, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Decache Exporter/bin/nirsoft/read_cache.bat
- SHA256 0476f4f8873327c15afab300b1e990c307bdd156e407f0900f9d75584fc32b8a
- MD5 385491be851e5fbfbd819a88cdd86eb0
- SHA1 30e57595e763f88b21fbfcb9fa0407765845b4f1
- SHA512 98fe6435e7762b118c82954a79218717fe88ca0c8a88e767b7df566b2673a313c53bc060bec5a103dcf3c04aab83810f5a0b6e3879e72d0d5abb7104afa67e74
- SSDEEP 192:zn3HcTlSIhTKnmh4h/fhwhDhAhIhAhNhxhJh+hph4hphShehIhWhBhbhMh8h5Chy:JIxOpC5yWWP/vcTWX8kCUHtK+qYLu+B9
- TLSH T1F5323304611864A11CBFC7F76D99C18EF35E8087029093DC3A4DC1EA7F7A19746EADE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Decache Exporter/bin/perm_error.bat
- SHA256 27972b366b5c0ab11cf9fe075fc7e0b4e5e14d22ad527a4d2969a43f4e80a5b2
- MD5 73bc68ea40df7392d6258d414bbab426
- SHA1 5a89c97edbc0428e7f04842b552ffc19d49a4a98
- SHA512 5781873c4a57226e1f2cc20b6fa8d286e6e31869c72ef508915c26525dba7fa69e2d6f8074b7efe80a9d75b1e2e79542c9b3e46456b77dcd9cf6a79cd3cc056b
- TLSH T1F17163197804629119BF07B39C6B4385E3EF51DF4224A38C385EA5F92F3102796E55F9
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/phash.exe
- IMPHASH 0bb2ca3a0936e4931a897ce76a6a0bfc
- SHA256 bd1ee01a2cd1d26b1054b89720ca6d2531a6d2d2411266703cbc5fd38c1fa9a2
- MD5 ff0edce11f33ff1fecaa2808bc746944
- SHA1 4de0b7bbe2d6737278b2bf3e2d77d12fb8bf3d86
- SHA512 e51965297b66ddf8169ccdf9a225df86c8ce859e358c4c071da6624f86f0e854aab09e8ca7c7090c0281c6eac67357cf3ae5ce5d6fc40886904b417955869a23
- SSDEEP 24576:i+JpappjTCjx8Wpir6xRhLhuCTXfxhvxyxLx/NGvia1GarN9PBwO5OVhuD:i+Jc/mLTBxsLfGviwbrNAO+
- TLSH T154353A2AE60215F4C41753B1858FDBBB9614BB798032AEBFFF5DCE04B1336422859297
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4138
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
msvcrt
__getmainargs
__p___initenv
__p___mb_cur_max
__p__commode
__p__iob
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_beginthreadex
_cexit
_endthreadex
_errno
_filelengthi64
_fileno
_fstati64
_get_osfhandle
_initterm
_fileno
_fdopen
_lock
_lseeki64
_read
_setjmp3
_strdup
_unlock
_vsnprintf
_vsnwprintf
_wfopen
abort
_write
atexit
atoi
calloc
exit
fclose
fflush
fgetpos
fgetwc
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
isdigit
islower
isspace
isupper
iswctype
isxdigit
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
realloc
setlocale
setvbuf
signal
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
Name
.text
Size
795KB
Virtual Size
794KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
240KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Decache Exporter/bin/vbs/askforname.vbs
- SHA256 64970fe64058fd3a81bd59650d895e171facc04425cc201e1ba1b2ad2fbb4851
- MD5 e75335ea1c301684157410870b60512e
- SHA1 e9ed677b09c978f6a25ef8e609d43b5e052aba5d
- SHA512 6f687e89c2c927e6dddc8d8881abc17ca256093c9d4b6df498efd078eff379fe9f836382d6cc8d8b358d7ecbc5ff4eff7e17bd7dc28841f64f030081cd400c20
- TLSH T1E351356FE3021356CBF10503B0096A4AFB49413B1BA081A0B85D44551F3CEE7F9B6AE9
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/cleanse_ex.vbs
- SHA256 acf357e72a0bbdf1da136b5ee54e69d9c999989c46ecff81b8a010c1582bde83
- MD5 6ad31164ea918db929a722a35222e56a
- SHA1 07f002ed801f54ad10adc8590aba8b9111546a54
- SHA512 50c83bc644c8f82710589a45a3e3338db976f2db482872aa6cf0268299a34bb6a7770c6deb8dcc7a2fa81c8ac9907d1d432ce97fef372c7e50fc01366bfaae29
- TLSH T1C0F089AED8134FF34BAF615251E78C1F4750D029D83EE69735508CCA295D75B84124C3
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/date_to_unix.vbs
- SHA256 e0087b65a8855cc894cab287c1940b304dbcac85815fa7008aa4ecfbe5290da2
- MD5 81e653054a2ddef5f71b224594819ec8
- SHA1 dd20990c129ad484899f3bc2bf2a1112712b60c9
- SHA512 32c4c8554e840d1d18bfecdc24ddf53062235b64a7eb91c66eeada26c346f3e80a37ca6b0912809f173756a17a3fe493544afa47c1451373fbd3c5a17750a666
- TLSH T169F09EA89900C5F1133706832F9FC44FFF0894506C51D66C3EA3C8A5654E57ACD09046
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/decompress_error.vbs
- SHA256 884e86fe0af1969953f1f31f741371aa8f182f28a598f841aa01a38fbf247f71
- MD5 1d8a85ff13164e4d2862ee8285027a91
- SHA1 d1b4585d2e2985ba931c8bc05440ea762ab5d381
- SHA512 848bd53c717407c3b248cd406a8402b9011a50eb05476a4a821870f2ef973ac9f0153fe30617e2d4d5fd5964dc990b00da9586ac40e12ef354f234a5bc590ee5
- TLSH T1D5D022C9AFD0302896F08DC235807A3DEF0368B922801278E00646F953E4200780DCF6
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/error32.vbs
- SHA256 fa098264c1a24589af389b1dcd73b873b28aad861f85cb3a2a4a1c79d3fb4de9
- MD5 e72c52f853e7b7d627f83a720566aebb
- SHA1 8240b59d7f9a572f15f86d1028dd4723683cc5ac
- SHA512 3e9f0057fb6d4ddb84dcfa90bddb92b64c0a30101fcbaf2ef53416c10cc96b35ed52f65ad7ecdca3764857786514741e726fc2d1ee493169321d9db1f7805861
- TLSH T180E0C6CECE012320CFF04E8334509E7AEF090889839122AE70064ECC32A0DA8FC288D5
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/fixdir.vbs
- SHA256 5fde8382072f412f689ddde478936a7dd19cd851a0340bdee2c3cba4cf1a540b
- MD5 5b057266b31c4632c1fd32a96e4f2893
- SHA1 baa5a47a86cd02c2c7be3f7668b18b1b08cc5334
- SHA512 e9f13e28eac2f70a02f9e2c2b3d9433598350fad1499db8047d3ab13dfc38e5ff71533b624e1b3f833986fe5f649c1e89dbfa9bbac264fb7ffeab41f9b1adf91
- TLSH T1FCE02B748C03C883C1726141B3EA441ED251A3173C37756830658C45AF7EA559870CE0
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/hex.vbs
- SHA256 9404ae516569b35a924d5093fbed7ee93ee7dc3ff5ca5fa073a7dd0b2ab3558e
- MD5 e6ae7a6cf9d91ccb065082045d88bce9
- SHA1 7ff4347437e022518504f035b801228912649ff3
- SHA512 eb483de4ba7ebea879faece300518e633bfe64394815cb34dc6e8adf40787280ad445d9d0106a379b43e629dd118bbd133792ffe3f025d1f47214a447dd1d2c5
- TLSH T136F02E305543CD21533392969896850BA75AF403643BDCBD7FF5C89B2812B3EDA518F6
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/indiv_check.vbs
- SHA256 65bef7cf6b41b7a39840aa0d428a34f134bee7fde96dd8f4832cf6effcb543ea
- MD5 d08a2ff9148835b1c3154e57ffe9279d
- SHA1 f1e62ed2582f5fbadbb6624010adf621d8c42631
- SHA512 e8eeeb1edb718ccd0e917a7f0a77c0cbdcf3293cf709052a1befa75b2e9be1a0245bd094956e56d9a2a934b1a5422bc5f90f2f124fa154db580d4bff72d3bf3b
- TLSH T1B3E0E72358C1C0BB0613C64101538C1DF944D8078D64999CF8F0C44046263EBF55844F
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/likely_alert.vbs
- SHA256 31c729e1bd12b8ca690b492a0cc41ee756b40b328573f0f1914d8aac6504a53b
- MD5 ec4b9d1685156200a2805631bb90a3ee
- SHA1 5e9d3ea3f7eb343dfa2d4b970e2cc6f380308d9c
- SHA512 d327b7efb1881bdaf58489a79476a2138f24cc1603f90e0c6acb208e6e171bd9f25ccc5fb2bfa241866ffcaf0a5b8b8f189f3b613a6ba5b975b5c6a2ec42076d
- TLSH T18BF0D41EB90710234DC102437D11FDCF1BCCD23675E501AC7D278CE52141C5D5D014D0
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/limit_cache_dump.vbs
- SHA256 e8db2457ac5d9e8364fc2bbfaaa45d83ff8d2c6b4b059cefb29fcbbb9c409baa
- MD5 a576b1036541e50e1b4090f4318019f5
- SHA1 43944a2c41c34c3a21cee2bb5d6db76f8630f952
- SHA512 878ce5d54db2e15e02d87c77f81bd2f2d0f95d7177343421b89f80b1ec69055d04400d5a4214dd2d2abee3e5ef34d6a72ca448014be6efd112428cc938bedded
- TLSH T1981108306D47A9ADC771C3A0371C5026DE60C363EB1968B8369E4E92AF53A9D50F08D8
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/lowstorage.vbs
- SHA256 89326660e3fc5c5b9c05fc55863b0bbb9182a802b6f3245ee3fbe5e6df7b9be7
- MD5 f98172b68f345ecd49c009c1a521f529
- SHA1 b3261c89f0a03df67fdc07fd96927ec0db124a11
- SHA512 8c00ea59e6d3fcbe5c249bd4762cff6a7ff8b2a2f05f8492572db0194fda48fccb95845669b374efb3b219978d92d08591a6cfe651409e809ed9a91bf0ef558b
- TLSH T185F0F6A82942E1DBC750841159A6F70FBE0DF960E0CBD6CD268D89F52DC481C8E46C40
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/md5.vbs
- SHA256 bd8277d4c57507394d7690e619d21f5244d79fcb120a77b90d414c737d5e9fa0
- MD5 e9f64ab85066ddf363f0de4075d0e134
- SHA1 52f9b8f459243a4963b0e92c111bca89781538da
- SHA512 e606341710437b53f88a5c9af8cb4d5c5ac7b40fef77111ac16db8cf97b95831e333159998347963ff075b60d46fd6b1748d5e0b825f597734c647e07890f932
- SSDEEP 384:TCSr24Zdklf2on+w9OwXaZ8TOcxGmktiQubQd:84ZClf2on+w8wXaZ8TOJmktiQubA
- TLSH T15B52AD1BFB5F6794CD10C1EA1A36AAA06DAAFCC13AF3CD21E6920915C79A1C0C554DFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Decache Exporter/bin/vbs/multitask.vbs
- SHA256 c9b83dfa438af910472c842c2727d1b44b406bb3b47573f62bc8ad356d14fe6d
- MD5 22c42e6a933c06bbac4147c9f9227a92
- SHA1 c3ad61098b89bea14a32b93ee465693545cb5e69
- SHA512 b5da0b5d3c385cc4b5b66e2e38ac4ee9fb1e7fbc0bf52b494c685c4941bf6e5f28a73fa4bab1b6fa5e57312985430f2f2a37a72f98ec8806100a32518965d967
- TLSH T13FE07DDBB7810320CFE006826512746ABF1DE87587B152A0891C9061434F4BFD47627C
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/nointernet.vbs
- SHA256 6a5832d795002298630d00e24bc6bffbd0fcf47a37426d98029939cfabdea086
- MD5 3aed7095b0de027c25fe0ba13e22fd9e
- SHA1 63d5998d0f00a9bf6f8adb7745b441417f53bd14
- SHA512 c2cd9745f9ffa42481b0f010611a7ce89cde14ed5bfcc517624c651ab7184e92dcc894a13ffe55eb05c645cbd94d3d3c0fc66ba051cbda1b29860374bcd21b8f
- TLSH T1D811CE4BD683D334CEF34E03320E1EEABA8802274A0645687A9808762769CF8F0767D5
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/perm_error.vbs
- SHA256 448a4ab53d0606c7d6530428f64d39e7a248d69ede9fb1b15f4b627869afbe89
- MD5 71d3318085f6527c9f8b60c1626887cc
- SHA1 e970e479e8d93d28e2e4afb43ab4da85283158da
- SHA512 a75bf6723bfde186d07258161af1a58d541b8c77d4c4d9b5d3b47bdd851a08d702f0727b7fe8a59bb6dea7c13ffcbf1874c5665364c6cd03cea2b27d4b40b9f4
- TLSH T197419BC7EF866B71CBF24D03355E9F27AE0CA01A7AD501C53A398A841B91DF9A9305E0
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/pickfolder.vbs
- SHA256 0f0b7425a31b9f385ef53c6fc5c57924c826aeaa9d6dcefb6380d8be9ea8c420
- MD5 4d3f00d2a4dd73c8bb5459955f7740f7
- SHA1 3e83934c288cb9a94e50e6ac598de63c7cb3762b
- SHA512 7694ba36878916a35aa96ecd10c3fc59fc3681d6bad29e97532e8a031a8304a220c3c597052040600bc3703af5b693f81ee29473fc908fb4a54190acdf0616bf
- TLSH T1C3E026E7B00602F241E1DF0615F94C1DE70DC0698DF99D847E0AC8CC231D9D9D695989
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/recursive_dir.vbs
- SHA256 68e60693f71ec2815bdaaffd5c3f4d4085f013a9ae21c240f77b10bca0eb33b6
- MD5 92e16acc9c8b64fc7b863cb1e2a550a7
- SHA1 dc2822e3c36fb2c138e68e364532f2e2716e1118
- SHA512 df4f0e1da10534dceb280265c40cd41421376e2c876ae4d2960dd093289ffb81b65ee4cbf54b76bc87036af7a5e15a1962b74a89c2da5be59c83cfff9ee08395
- TLSH T17611CE83E86262A98632D3411D796C5ED748C02B5B3D48983D9C44812F275DAFAE415C
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/regex.vbs
- SHA256 99974f1a3839b744cd08da7aae43ee22425a77c5ec5c97c3028d66315bdf6d3e
- MD5 e5e1a94aa9b28c4c68ee4470aa129e87
- SHA1 f509435d4b846c6b617561b4cf54c45c10d4a2ae
- SHA512 1c574d9bed579c43a667d704b27fa73dbf7c40102211840eb5c7340cf5c035f56331db2e0ef1a64b8d712ea12c099b37d0aa90cbc6309d3a090ff9df40b08fef
- TLSH T155019EB55D07C0520732C453D47BD45BDF42B066A43A98C8F7DE88851FA1B7ECC648E1
- MD5 SHA1 SHA512 TLSH
Decache Exporter/bin/vbs/unmodify_date.vbs
- SHA256 b409b662294904cc1aa479383e828af6e7ac2382fcbc2c420a69645b923b14e9
- MD5 0f4129fb35a310396632d4573da9c651
- SHA1 1ee7c9d243f6e1c1f7e14f635b2a839d3dc981ac
- SHA512 fde5e5f72f1780327a97b9a9653766384140417e0aa1abe2963c621a0b8f893ee19a87f9514a87372b15d931c29d46537d7324ee344961bd14af4aaf809a891c
- TLSH T1FBF028A89903C9DB5B87429254F9CA0F1F55D500BC3294BD3FE6CC981907F9E49298F1
- MD5 SHA1 SHA512 TLSH
Decache Exporter/start_decache.bat
- SHA256 43b7b8700274c2dcb11eb7ee448b238145bcd52fe43bec826e333b5092ea2002
- MD5 93f0d16f0fe6cb67fb3bdb3089044ea0
- SHA1 b38775dcbb60964f079493ed4fca08c34fe2b6fc
- SHA512 dd1a4b735e942119d7338d49e3d72bb27e5a264ef0b3233cbeb2a6ffbf30a1f1ede2e7cb8e533685f0f77e18d588fd3f1805b9c698f4172e4b5d3323a8afc477
- SSDEEP 384:DS2W/XcgAmi2ObY3qJjOJDztlrZieK9G2C:DS2W/XcgAmi2EYoadJlrZieK9pC
- TLSH T1B9F2C718250412A146CF99B2DD99E8D533CE819B01D04EBD35CEC2785F7DA249EFAEF0
- MD5 SHA1 SHA512 SSDEEP TLSH