Autoruns.zip
- SHA256 bbb5c1126a0a0600ff09a9517141378e4df573260264351000f65163123c134a
Overview
overview
3Static
static
1Autoruns.exe
windows10-2004-x64
3Autoruns.exe
windows11-21h2-x64
3Autoruns64.exe
windows10-2004-x64
3Autoruns64.exe
windows11-21h2-x64
3Autoruns64a.exe
windows10-2004-x64
Autoruns64a.exe
windows11-21h2-x64
autoruns.chm
windows10-2004-x64
1autoruns.chm
windows11-21h2-x64
1autorunsc.exe
windows10-2004-x64
3autorunsc.exe
windows11-21h2-x64
3autorunsc64.exe
windows10-2004-x64
3autorunsc64.exe
windows11-21h2-x64
3autorunsc64a.exe
windows10-2004-x64
autorunsc64a.exe
windows11-21h2-x64
Static task
static1
Behavioral task
behavioral1
Sample
Autoruns.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Autoruns.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Autoruns64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Autoruns64.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
Autoruns64a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Autoruns64a.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
autoruns.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
autoruns.chm
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
autorunsc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
autorunsc.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
autorunsc64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
autorunsc64.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
autorunsc64a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
autorunsc64a.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target Autoruns.zip
- Size 2.9MB
- Sample260602-phtffsc16s
- SHA256 bbb5c1126a0a0600ff09a9517141378e4df573260264351000f65163123c134a
- MD5 b9be44234a8fb45f7e1c1dd6a63a66ac
- SHA1 39fae35a502e9591c73ee7091b2f315ca8bcf822
- SHA512 af1e2352b194dfa3f418635b8fc8f37a0f1328323769b32270c50add20f823e8acd2887ba5a8ca9351678109d48a7766b2284166ea7e52ff34ea0901c6ac4cac
- SSDEEP 49152:oOkHu/nMaYE2+lmMPX60pQ0A3AALDXtSD8RWaORbatXaI53/MzLwaXyIHSGOPopA:JkHYMaY6XCn37DdSD8vMb7IJMXriIy0q
- TLSH T163D53342E755B3815006189219B3597BD68767AB8F078A3D4A7238E5C6F32BECE10F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
Autoruns.zip.zip 2.9MB
-
Autoruns.exe.exe 1.7MB
-
Autoruns64.exe.exe 1.9MB
-
Autoruns64a.exe2.0MB
-
Eula.txt7KB
-
autoruns.chm.chm 24KB
-
autorunsc.exe.exe 716KB
-
autorunsc64.exe.exe 794KB
-
autorunsc64a.exe814KB
Autoruns.exe
- IMPHASH 9b939eaf0a15aa0800f31cfedcf5fc33
- SHA256 80ca238c3fbbf5fde0677d1acaf31088e69c4203c0d25d883abbccc27dbb6819
- MD5 41713d923e3d5487d81c7ba11669f174
- SHA1 24f98b8e5dbb0745498291b41538bb70fc4a9419
- SHA512 a77e34ba69d48968571bc2485dfba8292cf43687da8b04ddccc2bd69463acf65d12a11a770a438e90d9ebe3905d093edc737828cd9bbae7a50877d79b101c34b
- SSDEEP 24576:JCDBANOeUUsZeV4eV30BM/9c+fxuANgIXMcdHqZ:AANOcsZegMVvfxuANpXRHqZ
- TLSH T1688538E326D9852AC9BE0530116492BE06EF6D3E4BE388CBE2C77D1D67304CD5A32657
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:58:6a:7e:6e:c5:21:df:c4:5f:5a:a4:14:ea:f9:13:dc:f1:7f:9c:b9:77:ca:ff:b3:ef:1a:23:a9:07:e4:bb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 7, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
543280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\__w\1\s\Win32\Release\Autoruns.pdb
kernel32
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetConsoleCP
ExitProcess
VirtualProtect
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WakeAllConditionVariable
GetCPInfo
GetSystemTimeAsFileTime
FlushFileBuffers
LCMapStringEx
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
FindPackagesByPackageFamily
GetFullPathNameW
GetNativeSystemInfo
IsWow64Process
GetFileTime
QueryDosDeviceW
GetLogicalDrives
SearchPathW
K32GetMappedFileNameW
WaitForMultipleObjects
CreateSemaphoreW
CreateEventW
SetEnvironmentVariableW
FindClose
FindNextFileW
FindFirstFileW
ReleaseSemaphore
SetEvent
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
FileTimeToLocalFileTime
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetSystemWindowsDirectoryW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
ReadFile
WriteConsoleW
LocalAlloc
GetFileType
GetStdHandle
GetVersionExW
GetTickCount64
GetSystemDirectoryW
TerminateThread
CreateThread
WaitForSingleObject
OpenProcess
Sleep
ExpandEnvironmentStringsW
GetStartupInfoW
CreateProcessW
GetCommandLineW
VerifyVersionInfoW
GetComputerNameW
lstrcmpW
LocalFree
VirtualQuery
GetCurrentProcessId
VerSetConditionMask
MoveFileW
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
GetNumberFormatEx
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetFileInformationByHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
MultiByteToWideChar
lstrcmpiW
GlobalAlloc
LoadLibraryExW
SetThreadPriority
GetCurrentThread
DecodePointer
SetCurrentDirectoryW
WideCharToMultiByte
FormatMessageW
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
ReadConsoleW
GetThreadId
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
GetModuleFileNameW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GlobalLock
GlobalUnlock
QueryPerformanceCounter
user32
SetClipboardData
EmptyClipboard
CloseClipboard
IsRectEmpty
SendMessageW
OpenClipboard
FindWindowExW
FindWindowW
SetForegroundWindow
WaitForInputIdle
IsDlgButtonChecked
CheckDlgButton
EnableWindow
GetDlgItemTextW
MonitorFromPoint
IsDialogMessageW
CheckMenuRadioItem
GetWindowThreadProcessId
GetDesktopWindow
SetRectEmpty
SetRect
WindowFromPoint
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
DestroyMenu
SetMenuItemInfoW
GetSysColor
LoadImageW
DrawIconEx
DialogBoxIndirectParamW
EnumDisplaySettingsW
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetFocus
GetFocus
SetTimer
KillTimer
DrawTextW
BeginPaint
EndPaint
InvalidateRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowLongW
MessageBeep
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenuEx
DeleteMenu
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
CreatePopupMenu
GetMenuStringW
SetMenu
GetMenu
TranslateAcceleratorW
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetActiveWindow
CharLowerW
GetDlgCtrlID
DialogBoxParamW
CreateDialogParamW
SetWindowPlacement
GetWindowPlacement
IsMenu
PostQuitMessage
GetMessagePos
DrawFrameControl
DrawEdge
TrackMouseEvent
RegisterWindowMessageW
LoadStringA
EnumChildWindows
MessageBoxW
LoadMenuW
LoadAcceleratorsW
CharNextW
DestroyWindow
IsWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
LoadIconW
GetDlgItem
GetWindow
MapWindowPoints
GetWindowRect
SetDlgItemTextW
EndDialog
GetAncestor
GetWindowModuleFileNameW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
SetClassLongW
PtInRect
OffsetRect
InflateRect
CopyRect
FrameRect
FillRect
DrawFocusRect
ScreenToClient
ShowScrollBar
SetScrollPos
RedrawWindow
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
GetSystemMetrics
IsWindowEnabled
IsZoomed
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
IsChild
PostMessageW
GetSysColorBrush
LoadCursorW
GetParent
SetWindowLongW
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
SetBkColor
ExtTextOutW
SetViewportOrgEx
CreateFontIndirectW
SetBkMode
SetTextColor
GetObjectW
CreateSolidBrush
CreatePen
GetDeviceCaps
GetStockObject
LineTo
Rectangle
SetTextAlign
MoveToEx
Polyline
CreateBitmap
CreatePatternBrush
ExcludeClipRect
GetCurrentObject
PatBlt
CreateDIBSection
Polygon
SetBrushOrgEx
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
GetTextExtentPoint32W
TextOutW
comdlg32
PrintDlgW
ChooseFontW
GetOpenFileNameW
FindTextW
GetSaveFileNameW
advapi32
RegOpenKeyW
RegCreateKeyW
RegRenameKey
RegEnumValueW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
CloseServiceHandle
ConvertStringSidToSidW
LookupAccountSidW
RegCopyTreeW
RegDeleteTreeW
RegQueryValueExW
ConvertSidToStringSidW
RegLoadKeyW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CryptDestroyHash
GetServiceDisplayNameW
RegGetValueW
QueryServiceConfig2W
AdjustTokenPrivileges
LookupPrivilegeValueW
RegLoadMUIStringW
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
shell32
SHGetKnownFolderPath
SHEvaluateSystemCommandTemplate
ExtractIconExW
ShellExecuteW
ExtractAssociatedIconW
CommandLineToArgvW
ShellExecuteExW
SHGetStockIconInfo
ole32
CoTaskMemFree
CoTaskMemRealloc
CLSIDFromString
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
StgCreateStorageEx
StgOpenStorageEx
StringFromGUID2
oleaut32
SysStringLen
SysAllocString
SysFreeString
VarUI4FromStr
VariantInit
VariantClear
shlwapi
SHAutoComplete
SHCreateStreamOnFileW
ord487
comctl32
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Duplicate
ImageList_GetImageCount
ImageList_Create
ImageList_WriteEx
ImageList_Read
ImageList_Draw
ImageList_GetIconSize
ImageList_GetIcon
ImageList_ReplaceIcon
InitCommonControlsEx
CreateStatusWindowW
ImageList_Destroy
ImageList_DrawEx
ImageList_DrawIndirect
ImageList_AddMasked
uxtheme
IsThemeActive
IsAppThemed
SetWindowTheme
msimg32
GradientFill
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
dwmapi
DwmSetWindowAttribute
DwmDefWindowProc
winhttp
WinHttpConnect
WinHttpOpen
WinHttpWriteData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
crypt32
CertGetNameStringW
Name
.text
Size
735KB
Virtual Size
735KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
31KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
742KB
Virtual Size
742KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=180, id=261, version=30795,
count=19, id=260, version=35207,
count=26, id=259, version=35207,
count=94, id=261, version=35207,
count=30, id=265, version=35226,
count=26, id=260, version=30795,
count=1, id=262, version=30795,
count=33, id=257, version=30795,
count=521, id=1, productName=Unmarked objects,
count=2, id=260, version=35226,
count=51, id=261, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,
Autoruns64.exe
- IMPHASH 2228ac56c5038770e6715cce856f577e
- SHA256 4679d24063c4deb08d6bc9adecd6d70716176d6df28b4f6640bbbe9d15933d08
- MD5 ebed72eff5e275df657b477837e0074c
- SHA1 15291f15c6d11382f8fb7f40895ec26d063bb6a2
- SHA512 7e4057d6c32a65af33511de9cb91e0bf77c6ad09693ae9957faa769e98ff4da1e998cd544b2d4d2464d1a0b1ce86207be0273e2954a1f2958a984413daa637ce
- SSDEEP 24576:wBBJNP2x9lJwRzprObDlDk5YtLgDSnpjHFzZTZScYQM2GC:mBJN+x2zsDlDBgDSnxFzZTZjZnj
- TLSH T1459549D312ED01A9D47E92318592457EDBF33C2E47E389DB8593BE191B37A8C1E36212
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9d:ba:43:1a:a2:e6:47:6e:e8:f9:2d:b4:b0:7c:98:ee:e7:a0:38:2e:33:1a:29:a3:1e:b5:53:b5:22:e4:d5:b0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 7, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
658528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\__w\1\s\x64\Release\Autoruns64.pdb
kernel32
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleCP
ExitProcess
VirtualProtect
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RtlPcToFileHeader
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WakeAllConditionVariable
GetCPInfo
GetSystemTimeAsFileTime
FlushFileBuffers
QueryPerformanceCounter
LCMapStringEx
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
FindPackagesByPackageFamily
GetFullPathNameW
GetNativeSystemInfo
IsWow64Process
GetFileTime
QueryDosDeviceW
GetLogicalDrives
SearchPathW
K32GetMappedFileNameW
WaitForMultipleObjects
CreateSemaphoreW
CreateEventW
SetEnvironmentVariableW
FindClose
FindNextFileW
FindFirstFileW
ReleaseSemaphore
SetEvent
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
FileTimeToLocalFileTime
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetSystemWindowsDirectoryW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
ReadFile
WriteConsoleW
LocalAlloc
GetFileType
GetStdHandle
GetVersionExW
GetTickCount64
GetSystemDirectoryW
TerminateThread
CreateThread
WaitForSingleObject
OpenProcess
Sleep
ExpandEnvironmentStringsW
GetStartupInfoW
CreateProcessW
GetCommandLineW
VerifyVersionInfoW
GetComputerNameW
lstrcmpW
LocalFree
VirtualQuery
GetCurrentProcessId
VerSetConditionMask
MoveFileW
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
GetNumberFormatEx
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetFileInformationByHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GlobalAlloc
MultiByteToWideChar
lstrcmpiW
LoadLibraryExW
SetThreadPriority
GetCurrentThread
DecodePointer
SetCurrentDirectoryW
WideCharToMultiByte
FormatMessageW
GetModuleHandleExW
ReadConsoleW
GetModuleFileNameA
DebugBreak
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
GetThreadId
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
GetModuleFileNameW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GlobalLock
GlobalUnlock
RtlUnwind
user32
OpenClipboard
CloseClipboard
DialogBoxIndirectParamW
IsRectEmpty
EnumDisplaySettingsW
FindWindowExW
FindWindowW
SetForegroundWindow
WaitForInputIdle
IsDlgButtonChecked
CheckDlgButton
EnableWindow
GetDlgItemTextW
MonitorFromPoint
IsDialogMessageW
CheckMenuRadioItem
GetWindowThreadProcessId
GetDesktopWindow
SetRectEmpty
SetClipboardData
EmptyClipboard
SendMessageW
DestroyMenu
SetMenuItemInfoW
GetSysColor
LoadImageW
DrawIconEx
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetFocus
GetFocus
SetTimer
KillTimer
DrawTextW
BeginPaint
EndPaint
InvalidateRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
SetRect
WindowFromPoint
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
MessageBeep
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenuEx
DeleteMenu
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
CreatePopupMenu
GetMenuStringW
SetMenu
GetMenu
TranslateAcceleratorW
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetActiveWindow
CharLowerW
GetDlgCtrlID
DialogBoxParamW
CreateDialogParamW
SetWindowPlacement
GetWindowPlacement
GetWindowLongPtrW
PostQuitMessage
GetMessagePos
DrawFrameControl
DrawEdge
TrackMouseEvent
RegisterWindowMessageW
LoadStringA
EnumChildWindows
MessageBoxW
LoadMenuW
LoadAcceleratorsW
CharNextW
DestroyWindow
IsWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
LoadIconW
GetDlgItem
GetWindow
MapWindowPoints
GetWindowRect
SetDlgItemTextW
EndDialog
GetAncestor
GetWindowModuleFileNameW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
SetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
InflateRect
CopyRect
FrameRect
FillRect
DrawFocusRect
ScreenToClient
ShowScrollBar
SetScrollPos
RedrawWindow
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
GetSystemMetrics
IsWindowEnabled
IsZoomed
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
IsChild
PostMessageW
GetSysColorBrush
LoadCursorW
GetParent
SetWindowLongPtrW
IsMenu
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
SetBkColor
ExtTextOutW
SetViewportOrgEx
CreateFontIndirectW
SetBkMode
SetTextColor
GetObjectW
CreateSolidBrush
CreatePen
GetDeviceCaps
GetStockObject
GetTextExtentPoint32W
LineTo
Rectangle
SetTextAlign
MoveToEx
TextOutW
CreateBitmap
CreatePatternBrush
GetCurrentObject
PatBlt
CreateDIBSection
Polygon
SetBrushOrgEx
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
Polyline
ExcludeClipRect
comdlg32
GetOpenFileNameW
ChooseFontW
ReplaceTextW
FindTextW
GetSaveFileNameW
PrintDlgW
advapi32
RegEnumKeyExW
LookupPrivilegeValueW
RegLoadMUIStringW
CryptGetHashParam
CryptHashData
RegGetValueW
RegOpenKeyW
RegCreateKeyW
RegRenameKey
RegEnumValueW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
CloseServiceHandle
ConvertStringSidToSidW
LookupAccountSidW
RegCopyTreeW
RegDeleteTreeW
RegQueryValueExW
ConvertSidToStringSidW
RegLoadKeyW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
AdjustTokenPrivileges
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
QueryServiceConfig2W
GetServiceDisplayNameW
CryptDestroyHash
shell32
ShellExecuteExW
CommandLineToArgvW
SHGetKnownFolderPath
SHGetStockIconInfo
ExtractIconExW
SHEvaluateSystemCommandTemplate
ShellExecuteW
ExtractAssociatedIconW
ole32
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString
CoCreateInstance
CoInitializeEx
CoUninitialize
StgCreateStorageEx
StgOpenStorageEx
StringFromGUID2
CoTaskMemAlloc
oleaut32
SysStringLen
SysAllocString
VariantInit
SysFreeString
VarUI4FromStr
VariantClear
shlwapi
SHCreateStreamOnFileW
SHAutoComplete
ord487
comctl32
ImageList_DrawIndirect
ImageList_Draw
ImageList_GetImageCount
ImageList_Create
ImageList_Duplicate
CreateStatusWindowW
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_WriteEx
ImageList_BeginDrag
ImageList_Read
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_AddMasked
InitCommonControlsEx
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy
uxtheme
IsThemeActive
IsAppThemed
SetWindowTheme
msimg32
GradientFill
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
dwmapi
DwmDefWindowProc
DwmSetWindowAttribute
winhttp
WinHttpConnect
WinHttpOpen
WinHttpWriteData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpReadData
crypt32
CertGetNameStringW
Name
.text
Size
849KB
Virtual Size
848KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
273KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
37KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
742KB
Virtual Size
742KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=181, id=261, version=30795,
count=17, id=260, version=35207,
count=10, id=259, version=35207,
count=97, id=261, version=35207,
count=30, id=265, version=35226,
count=10, id=259, version=30795,
count=22, id=260, version=30795,
count=1, id=262, version=30795,
count=33, id=257, version=30795,
count=532, id=1, productName=Unmarked objects,
count=2, id=260, version=35226,
count=51, id=261, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,
Autoruns64a.exe
- SHA256 33654c07d4c5db86e55aa03c3b4be0ddcda718e70e29b67022b82f38b50a2c26
- MD5 d1efd8aa560bfdcf73065446060ecefe
- SHA1 c90fde5f80f1a6338de8bed97972879970a3dbd7
- SHA512 3614c396825206202179b6e2d27c390f9d3e5cf6938fa9112909c21bc09758492247805e2aba55a0a3b66a22a539307a9cfa501ac6a249de90a1f1e2aa886dae
- SSDEEP 12288:tiFvn/bYEgP1G6LFKm9cAd7NHkAtMTzNHP1jKMLEbx4Szo3ZFr3Ozu7IKlgdrfZ0:tE41JJtu51jVR7HcYt
- TLSH T197A55BD316CD5854E6DDD33899758ABC26FBBC6C93F38287B4572E1CAFA24CC4911222
- MD5 SHA1 SHA512 SSDEEP TLSH
Eula.txt
- SHA256 8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a
- MD5 8c24c4084cdc3b7e7f7a88444a012bfc
- SHA1 5ab806618497189342722d42dc382623ac3e1b55
- SHA512 6c74bed85638871fd834b30183e1536e48512dd0f8471624732ac1b487f0eba34dec99f88d2d583335f66df543d5fabf4b8c9456255df2248a4c086f111f0baa
- SSDEEP 192:RCVPxjERdQe/lb9iLbRvhSXH3DsDw3zF55Mz6h:RcFERdXlRiLbujuw3zF55jh
- TLSH T1CDF1C8AF32CA176205D203A27A0AD1C7FB298574329BD615BDA981281346D28937F3ED
- MD5 SHA1 SHA512 SSDEEP TLSH
autoruns.chm
- SHA256 ecb58342290940a5eb6b72be6faa1d0afeec9df5898df3e026d75b7b08bd8f9a
- MD5 2c099793584365b8897fca7a4fa397e8
- SHA1 50eaf2f529b1e923f7d0238ea8d3eb2187ad19cf
- SHA512 ae407cd6b2d6ddf033f04b19ddf168423f819a4a42834afe03b7c35f86dd7b6572ced6c325fd9a56eacc9613944c4f3d17831d15713a35f0ea24f4c4c14af0ce
- SSDEEP 384:h2Svimo+ByfYV9H27NbyQhxEj4sbHxQpHgQkOx:h2Svimo+h8RrSjnHupAQkE
- TLSH T1E4B2D0723689DBB1E1A1407C3FD6A2DE38B220944D80022B67FEF30612753756DA2C97
- MD5 SHA1 SHA512 SSDEEP TLSH
autorunsc.exe
- IMPHASH 3f98566655bece87e6fd597d33aac6d8
- SHA256 b66f927165a8e2616d7a48d8bd6bdad254bac480411a8590fd3961ba94d61c93
- MD5 bb7700f33ffea091843153da9dbad977
- SHA1 c1b107578b9765b217e026e8840d96a8d4ed8793
- SHA512 65385918dd0014ea7ff405fcbf2f69af6d4c87d77898334061f9be8d85d0e1f6fb13db7849b6a045505398522526777b45c2dda65e9f8ad1af6a54ced83c91f3
- SSDEEP 12288:ZN9dECHGm0+pAKT9uFkFgl5sG8h4bwdVyD:rEC30+tTfFgla9aEdVyD
- TLSH T1CBF4390076A8A025F2F296B06A398771383ABD715B348CCF93D4696D1DB5AC19B3473F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:c7:26:43:3e:ba:92:84:9b:a5:c5:b1:47:63:79:d8:1b:7c:84:c1:84:e2:80:39:96:a8:2e:dd:4d:ee:65:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 7, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
270784
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\__w\1\s\Win32\Console_Release\autorunsc.pdb
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
comctl32
ImageList_ReplaceIcon
ImageList_Add
crypt32
CryptSIPLoad
CryptSIPRetrieveSubjectGuidForCatalogFile
CertGetNameStringW
CertDuplicateCertificateContext
wintrust
CryptCATAdminCalcHashFromFileHandle
ntdll
RtlUnwind
NtOpenKey
NtCreateKey
kernel32
GetSystemWow64DirectoryW
FormatMessageA
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
FreeLibrary
MultiByteToWideChar
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
SetThreadPriority
CreateThread
GetTimeFormatW
FindResourceExW
LoadResource
LockResource
IsWow64Process
FindResourceW
SetUnhandledExceptionFilter
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetStringTypeW
SetFilePointerEx
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetFileTime
FlushFileBuffers
LCMapStringW
CompareStringW
GetCommandLineA
FreeLibraryAndExitThread
SetStdHandle
GetConsoleCP
GetModuleHandleExW
ExitProcess
TlsFree
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
OutputDebugStringW
WideCharToMultiByte
GetSystemWindowsDirectoryW
GetVersion
OpenProcess
TlsSetValue
TlsAlloc
ExitThread
GetCurrentProcess
InitializeCriticalSection
SetErrorMode
WriteFile
GetLongPathNameW
SizeofResource
GetFileSize
ExpandEnvironmentStringsW
UnhandledExceptionFilter
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
MulDiv
GetModuleHandleW
FileTimeToLocalFileTime
LoadLibraryW
GetProcAddress
Sleep
GetLastError
ReadFile
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CloseHandle
GetFileSizeEx
LoadLibraryExW
GetVersionExW
SetLastError
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetFullPathNameW
SetEnvironmentVariableW
TlsGetValue
GetModuleFileNameW
LocalFree
LocalAlloc
GetCommandLineW
GetFileType
GetConsoleOutputCP
GetStdHandle
SetEndOfFile
TerminateProcess
IsProcessorFeaturePresent
GetExitCodeThread
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
TryAcquireSRWLockExclusive
InitializeSListHead
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
user32
GetSysColorBrush
InflateRect
LoadCursorW
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetMenu
CheckMenuItem
GetSubMenu
InsertMenuW
SendMessageW
MessageBoxW
GetParent
SetDlgItemTextW
PostMessageW
LoadStringW
DestroyIcon
LoadIconW
DeleteMenu
gdi32
DeleteObject
EndPage
StartPage
EndDoc
StartDocW
SetMapMode
GetDeviceCaps
DeleteDC
CreateCompatibleDC
comdlg32
PrintDlgW
advapi32
CryptAcquireContextW
QueryServiceConfig2W
GetServiceDisplayNameW
RegQueryValueW
RegUnLoadKeyW
RegQueryInfoKeyW
RegLoadKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteKeyW
LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
shell32
SHGetFileInfoW
SHGetFolderPathW
ShellExecuteW
ole32
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SysAllocStringByteLen
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantClear
VariantChangeType
shlwapi
ord176
UrlUnescapeW
winhttp
WinHttpGetProxyForUrl
WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryHeaders
Name
.text
Size
418KB
Virtual Size
417KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=175, id=261, version=30795,
count=23, id=259, version=35207,
count=19, id=260, version=35207,
count=62, id=261, version=35207,
count=2, id=262, version=30795,
count=31, id=257, version=30795,
count=306, id=1, productName=Unmarked objects,
count=28, id=260, version=30795,
count=3, id=260, version=35226,
count=33, id=261, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,
autorunsc64.exe
- IMPHASH 66ffe08d5b1c9fb616840deac5505d83
- SHA256 feb3969365d85e01cfa9147c5c3046ba6da35e1b356da6481122aec99d77cb10
- MD5 5b100e0e08d529747cca346abe0a0063
- SHA1 bcdf2587f6a9f4187ca705fac0bbf56c1191adcb
- SHA512 2979510270771090556fc8c1cfd5e35d2f4194cfd0e2cc348d6d15e4bd14141837834da31910e23a73d1862e3b004d83be87a12915ce97ae40d4de04e84819bc
- SSDEEP 12288:pycZXoguGXSn4t1CjhDmh4m5snalIGa1bESe9qZs8cwdf:py6Xo8XSnqcEz5saq1dZdf
- TLSH T17F057D2567F803A4F1BAC6748A274912F9717C571B75AA8F039049AE1F33E98DD3C722
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7c:d8:73:df:2a:46:e2:76:2c:87:98:54:6d:13:6d:59:28:4e:17:ee:2f:f6:2a:61:8b:a1:1a:53:11:da:59:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 7, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
314144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\__w\1\s\x64\Console_Release\autorunsc64.pdb
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
comctl32
ImageList_ReplaceIcon
ImageList_Add
crypt32
CertGetNameStringW
CryptSIPLoad
CryptSIPRetrieveSubjectGuidForCatalogFile
CertDuplicateCertificateContext
wintrust
CryptCATAdminCalcHashFromFileHandle
ntdll
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlCaptureContext
NtOpenKey
NtCreateKey
RtlUnwind
kernel32
GetSystemWow64DirectoryW
FormatMessageA
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
FreeLibrary
MultiByteToWideChar
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
SetThreadPriority
CreateThread
GetExitCodeThread
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetCommandLineA
FreeLibraryAndExitThread
SetStdHandle
GetConsoleCP
GetModuleHandleExW
ExitProcess
TlsFree
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
OutputDebugStringW
WideCharToMultiByte
TryAcquireSRWLockExclusive
GetSystemWindowsDirectoryW
GetVersion
OpenProcess
TlsSetValue
TlsAlloc
ExitThread
GetCurrentProcess
InitializeCriticalSection
SetErrorMode
WriteFile
GetLongPathNameW
IsWow64Process
GetFullPathNameW
GetFileTime
GetFileSize
ExpandEnvironmentStringsW
SetEnvironmentVariableW
TlsGetValue
GetModuleFileNameW
InitializeSListHead
LocalFree
LocalAlloc
GetFileType
GetCommandLineW
GetStdHandle
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FormatMessageW
MulDiv
GetModuleHandleW
FileTimeToLocalFileTime
LoadLibraryW
GetProcAddress
Sleep
GetLastError
ReadFile
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CloseHandle
GetFileSizeEx
LoadLibraryExW
GetVersionExW
SetLastError
WriteConsoleW
SetEndOfFile
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetStringTypeW
SetFilePointerEx
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
FlsAlloc
user32
GetSubMenu
MessageBoxW
GetParent
SetDlgItemTextW
PostMessageW
LoadStringW
SendMessageW
DestroyIcon
LoadIconW
DeleteMenu
InsertMenuW
CheckMenuItem
GetMenu
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
gdi32
DeleteObject
EndPage
StartPage
EndDoc
StartDocW
SetMapMode
GetDeviceCaps
DeleteDC
CreateCompatibleDC
comdlg32
PrintDlgW
advapi32
CryptDestroyHash
CryptAcquireContextW
QueryServiceConfig2W
GetServiceDisplayNameW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CloseServiceHandle
OpenSCManagerW
RegQueryValueW
RegUnLoadKeyW
RegQueryInfoKeyW
RegLoadKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteKeyW
LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
OpenServiceW
shell32
ShellExecuteW
SHGetFolderPathW
SHGetFileInfoW
ole32
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeEx
oleaut32
VariantChangeType
VariantInit
SysAllocStringByteLen
SysStringLen
VariantClear
SysFreeString
SysAllocString
shlwapi
UrlUnescapeW
ord176
winhttp
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
Name
.text
Size
470KB
Virtual Size
470KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
177KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=173, id=261, version=30795,
count=8, id=259, version=35207,
count=17, id=260, version=35207,
count=65, id=261, version=35207,
count=2, id=262, version=30795,
count=31, id=257, version=30795,
count=315, id=1, productName=Unmarked objects,
count=10, id=259, version=30795,
count=18, id=260, version=30795,
count=3, id=260, version=35226,
count=33, id=261, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,
autorunsc64a.exe
- SHA256 a43613205721289dec3229307bb196ec2b530ab9cbcc9c2c18daf06a2350c6f3
- MD5 3fb830253117107342d4e764c14e1c8d
- SHA1 4f53f13874de81046b5fd5b6ee7f21925f3bbba5
- SHA512 dbb4a97fa97eb252700ea4303e1090f60dfec45ec291d8f09cfcdd9a6233b052584d69f01a47b70c2702431ec853844adbb0b50a02113f2a6351223049777299
- SSDEEP 12288:OiTVwU/rijM+a4OfE9vA4ny3MvM+EdKrpm2YnKlaywdr:OgFijRa89k3Mzdm2dlardr
- TLSH T1460528616F8D6AC1F2E6D73C6E360A20603FBC284A34C65B6656125DDEE7BD4C970323
- MD5 SHA1 SHA512 SSDEEP TLSH