MaxPayne 2.zip
- SHA256 39aa8a95d1b82da48efe909a7ec280b2864474e3a3f3b1c3a4c14967ec1c84e4
Overview
overview
4Static
static
3MaxPayne 2.zip
windows10-2004-x64
1MaxPayne 2...32.exe
windows10-2004-x64
3MaxPayne 2...UP.dll
windows10-2004-x64
4MaxPayne 2...32.dll
windows10-2004-x64
4mspclock.sys
windows10-2004-x64
1mspqm.sys
windows10-2004-x64
1mstee.sys
windows10-2004-x64
1mswebdvd.dll
windows10-2004-x64
3pid.dll
windows10-2004-x64
3pid.dll
windows10-2004-x64
3qasf.dll
windows10-2004-x64
3qcap.dll
windows10-2004-x64
3qdv.dll
windows10-2004-x64
3qdvd.dll
windows10-2004-x64
3qedit.dll
windows10-2004-x64
3qedwipes.dll
windows10-2004-x64
1quartz.dll
windows10-2004-x64
3quartz.dll
windows10-2004-x64
3stream.dll
windows10-2004-x64
3swenum.sys
windows10-2004-x64
1MaxPayne 2...up.exe
windows10-2004-x64
4MaxPayne 2...op.htm
windows10-2004-x64
3MaxPayne 2...me.htm
windows10-2004-x64
3MaxPayne 2...er.url
windows10-2004-x64
1MaxPayne 2...rt.url
windows10-2004-x64
1MaxPayne 2...ll.exe
windows10-2004-x64
3DotNetInstaller.exe
windows10-2004-x64
3IScript.dll
windows10-2004-x64
3IUser.dll
windows10-2004-x64
3ctor.dll
windows10-2004-x64
3ikernel.dll
windows10-2004-x64
3objectps.dll
windows10-2004-x64
3Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
MaxPayne 2.zip
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
MaxPayne 2/Bin/demo32.exe
Resource
win10v2004-20260513-es
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
MaxPayne 2/DirectX9/DSETUP.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral4
Sample
MaxPayne 2/DirectX9/dsetup32.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
mspclock.sys
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
mspqm.sys
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
mstee.sys
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
mswebdvd.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
pid.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral10
Sample
pid.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral11
Sample
qasf.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral12
Sample
qcap.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
qdv.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral14
Sample
qdvd.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
qedit.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral16
Sample
qedwipes.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
quartz.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
quartz.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral19
Sample
stream.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral20
Sample
swenum.sys
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
MaxPayne 2/DirectX9/dxsetup.exe
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral22
Sample
MaxPayne 2/Help/html/top.htm
Resource
win10v2004-20260513-es
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral23
Sample
MaxPayne 2/Help/readme.htm
Resource
win10v2004-20260513-es
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral24
Sample
MaxPayne 2/Help/register.url
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
MaxPayne 2/Help/support.url
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
MaxPayne 2/Install.exe
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral27
Sample
DotNetInstaller.exe
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral28
Sample
IScript.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral29
Sample
IUser.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral30
Sample
ctor.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral31
Sample
ikernel.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral32
Sample
objectps.dll
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
General
- Target MaxPayne 2.zip
- Size 694.3MB
- Sample260704-3dapfaax8l
- SHA256 39aa8a95d1b82da48efe909a7ec280b2864474e3a3f3b1c3a4c14967ec1c84e4
- MD5 b5fd519f42321f5a945a42007fd29ba0
- SHA1 45a7270ef01807bef7d945c2964dad0a43ddcf0f
- SHA512 61b4909dc5843dd42c403c354fc5d90cc587d8e6e35c3324eb553a90b8d4a14476791296a2a1138dfe513e5f0682b461e619425c4469b47e3c40725818da512e
- SSDEEP 12582912:6LUtc070D9YIDfnSdDq9k+U2hi7w2lxY8pC6ejTgrVYUtqGNZriPuEZgaw0qI/ir:64f7ezfnwDq9FSplxXcjTgrVltZivZhs
- TLSH T1EA79339A05396C9B9C81785402B8AF527190065132BDDD7AFBD7FFC13660AE2E604F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned MSI 1 IoCs
Checks for missing Authenticode signature.
resource unpack006/mdxredist.msi - Unsigned PE 259 IoCs
Checks for missing Authenticode signature.
resource unpack001/MaxPayne 2/Bin/demo32.exe unpack002/MSDvbNP.ax unpack002/MSVidCtl.dll unpack002/Mpeg2Data.ax unpack002/bdaplgin.ax unpack002/bdasup.sys unpack002/ccdecode.sys unpack002/ipsink.ax unpack002/kstvtune.ax unpack002/kswdmcap.ax unpack002/ksxbar.ax unpack002/mpe.sys unpack002/msdv.sys unpack002/msdv98se.sys unpack002/msyuv.dll unpack002/nabtsfec.sys unpack002/ndisip.sys unpack002/psisdecd.dll unpack002/psisrndr.ax unpack002/slip.sys unpack002/streamip.sys unpack002/vbisurf.ax unpack002/wstcodec.sys unpack002/wstdecod.dll unpack003/MSDvbNP.ax unpack003/MSVidCtl.dll unpack003/MSVidCtl.w2k unpack003/Mpeg2Data.ax unpack003/bdaplgin.ax unpack003/bdasup.sys unpack003/ccdecode.sys unpack003/ipsink.ax unpack003/kstvtune.ax unpack003/kswdmcap.ax unpack003/ksxbar.ax unpack003/mpe.sys unpack003/msdv.sys unpack003/msyuv.dll unpack003/nabtsfec.sys unpack003/ndisip.sys unpack003/psisdecd.dll unpack003/psisrndr.ax unpack003/slip.sys unpack003/streamip.sys unpack003/vbisurf.ax unpack003/wstcodec.sys unpack003/wstdecod.dll unpack004/BdaSup.sys unpack004/MSDvbNP.ax unpack004/MSVidCtl.dll unpack004/Mpeg2Data.ax unpack004/bdaplgin.ax unpack004/ccdecode.sys unpack004/ipsink.ax unpack004/kstvtune.ax unpack004/kswdmcap.ax unpack004/ksxbar.ax unpack004/mpe.sys unpack004/msdv.sys unpack004/msyuv.dll unpack004/nabtsfec.sys unpack004/ndisip.sys unpack004/psisdecd.dll unpack004/psisrndr.ax unpack004/slip.sys unpack004/streamip.sys unpack004/vbisurf.ax unpack004/wstcodec.sys unpack004/wstdecod.dll unpack001/MaxPayne 2/DirectX9/DSETUP.dll unpack005/amstream.dll unpack005/d3d8.dll unpack005/d3d9.dll unpack005/d3dim.dll unpack005/d3dim700.dll unpack005/d3dpmesh.dll unpack005/d3dramp.dll unpack005/d3drm.dll unpack005/d3dxof.dll unpack005/ddhelp.exe unpack005/ddraw.dll unpack005/ddrawex.dll unpack005/devenum.dll unpack005/diactfrm.dll unpack005/dimap.dll unpack005/dinput.dll unpack005/dinput8.dll unpack005/dmband.dll unpack005/dmcompos.dll unpack005/dmime.dll unpack005/dmloader.dll unpack005/dmscript.dll unpack005/dmstyle.dll unpack005/dmsynth.dll unpack005/dmusic.dll unpack005/dmusic32.dll unpack005/dplaysvr.exe unpack005/dplayx.dll unpack005/dpmodemx.dll unpack005/dpnaddr.dll unpack005/dpnet.dll unpack005/dpnhpast.dll unpack005/dpnhupnp.dll unpack005/dpnlobby.dll unpack005/dpnsvr.exe unpack005/dpvacm.dll unpack005/dpvoice.dll unpack005/dpvsetup.exe unpack005/dpvvox.dll unpack005/dpwsockx.dll unpack005/dsdmo.dll unpack005/dsdmoprp.dll unpack005/dsound.dll unpack005/dsound3d.dll unpack005/dswave.dll unpack005/dx7vb.dll unpack005/dx8vb.dll unpack005/dxapi.sys unpack005/dxdiag.exe unpack005/dxdiagn.dll unpack005/dxdllreg.exe unpack005/dxtmsft.dll unpack005/dxtrans.dll unpack005/encapi.dll unpack005/gameenum.sys unpack005/gcdef.dll unpack005/gchand.dll unpack005/hidgame.sys unpack005/joy.cpl unpack005/ks.sys unpack005/ks98.sys unpack005/ksolay.ax unpack005/ksproxy.ax unpack005/ksse.sys unpack005/ksuser.dll unpack005/l3codecx.ax unpack005/mciqtz32.dll unpack005/migrate.dll unpack005/mpg2splt.ax unpack005/msdmo.dll unpack005/mskssrv.sys unpack005/mspclock.98 unpack005/mspclock.se unpack005/mspclock.sys unpack005/mstee.sys unpack005/mswebdvd.dll unpack005/pid.dll unpack005/qasf.dll unpack005/qcap.dll unpack005/qdv.dll unpack005/qdvd.dll unpack005/qedit.dll unpack005/qedwipes.dll unpack005/quartz.dll unpack005/stream.sys unpack005/stream98.sys unpack005/swenum.sys unpack005/swenum98.sys unpack005/swenumse.sys unpack001/MaxPayne 2/DirectX9/dsetup32.dll unpack007/amstream.dll unpack007/d3d8.dll unpack007/d3d8thk.dll unpack007/d3d8thk.w2k unpack007/d3d9.dll unpack007/d3dim.dll unpack007/d3dim.xpg unpack007/d3dim700.dll unpack007/d3dpmesh.dll unpack007/d3dpmesh.xpg unpack007/d3dramp.dll unpack007/d3dramp.xpg unpack007/d3drm.dll unpack007/d3drm.xpg unpack007/d3dxof.dll unpack007/d3dxof.xpg unpack007/ddraw.dll unpack007/ddrawex.dll unpack007/devenum.dll unpack007/diactfrm.dll unpack007/diactfrm.xpg unpack007/dimap.dll unpack007/dimap.xpg unpack007/dinput.dll unpack007/dinput.xpg unpack007/dinput8.dll unpack007/dinput8.xpg unpack007/dmband.dll unpack007/dmcompos.dll unpack007/dmime.dll unpack007/dmloader.dll unpack007/dmscript.dll unpack007/dmstyle.dll unpack007/dmsynth.dll unpack007/dmusic.dll unpack007/dplaysvr.exe unpack007/dplayx.dll unpack007/dpmodemx.dll unpack007/dpnaddr.dll unpack007/dpnet.dll unpack007/dpnhpast.dll unpack007/dpnhupnp.dll unpack007/dpnlobby.dll unpack007/dpnsvr.exe unpack007/dpvacm.dll unpack007/dpvoice.dll unpack007/dpvsetup.exe unpack007/dpvvox.dll unpack007/dpwsockx.dll unpack007/dsdmo.dll unpack007/dsdmoprp.dll unpack007/dsound.dll unpack007/dsound3d.dll unpack007/dswave.dll unpack007/dx7vb.dll unpack007/dx8vb.dll unpack007/dxapi.sys unpack007/dxapi.xpg unpack007/dxdiag.exe unpack007/dxdiagn.dll unpack007/dxdllreg.exe unpack007/encapi.dll unpack007/gcdef.dll unpack007/gcdef.xpg unpack007/joy.w2k unpack007/joy.xpg unpack007/ks.sys unpack007/ksolay.ax unpack007/ksproxy.ax unpack007/ksuser.dll unpack007/l3codecx.ax unpack007/mciqtz32.dll unpack007/mpg2splt.ax unpack007/msdmo.dll unpack007/mskssrv.sys unpack007/mspclock.sys unpack007/mspqm.sys unpack007/mstee.sys unpack007/mswebdvd.dll unpack007/pid.dll unpack007/pid.xpg unpack007/qasf.dll unpack007/qcap.dll unpack007/qdv.dll unpack007/qdvd.dll unpack007/qedit.dll unpack007/qedwipes.dll unpack007/quartz.dll unpack007/quartz.w2k unpack007/stream.sys unpack007/swenum.sys unpack001/MaxPayne 2/DirectX9/dxsetup.exe unpack001/MaxPayne 2/Install.exe unpack008/DotNetInstaller.exe unpack008/IScript.dll unpack008/IUser.dll unpack008/ctor.dll unpack008/ikernel.dll unpack008/objectps.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/MaxPayne 2/setup.exe
File Explorer
-
MaxPayne 2.zip.zip 694.3MB
-
MaxPayne 2/Bin/MaxPayne2.ico12KB
-
MaxPayne 2/Bin/demo32.exe.exe 484KB
-
MaxPayne 2/Bin/mp2inst.dbd214KB
-
MaxPayne 2/DirectX9/BDA.cab.cab 679KB
-
MSDvbNP.ax.dll 51KB
-
MSVidCtl.dll.dll 470KB
-
Mpeg2Data.ax.dll 55KB
-
bda.inf9KB
-
bdaplgin.ax.dll 16KB
-
bdasetup.inf6KB
-
bdasup.sys.dll 11KB
-
ccdecode.inf3KB
-
ccdecode.sys.sys 16KB
-
dx9bda.cat11KB
-
ipsink.ax.dll 14KB
-
kstvtune.ax.dll 268KB
-
kswdmcap.ax.dll 221KB
-
ksxbar.ax.dll 39KB
-
mpe.inf3KB
-
mpe.sys.sys 14KB
-
msdv.sys.sys 45KB
-
msdv98se.sys.sys 55KB
-
msyuv.dll.dll 16KB
-
nabtsfec.inf4KB
-
nabtsfec.sys.sys 82KB
-
ndisip.inf6KB
-
ndisip.sys.sys 8KB
-
psisdecd.dll.dll 346KB
-
psisrndr.ax.dll 29KB
-
slip.inf3KB
-
slip.sys.sys 10KB
-
streamip.inf5KB
-
streamip.sys.sys 14KB
-
vbisurf.ax.dll 27KB
-
wst_czec.fon18KB
-
wst_engl.fon18KB
-
wst_fren.fon18KB
-
wst_germ.fon18KB
-
wst_ital.fon18KB
-
wst_span.fon18KB
-
wst_swed.fon18KB
-
wstcodec.inf3KB
-
wstcodec.sys.sys 18KB
-
wstdecod.dll.dll 46KB
-
MaxPayne 2/DirectX9/BDANT.cab.cab 1.1MB
-
MSDvbNP.ax.dll 51KB
-
MSVidCtl.dll.dll 1.2MB
-
MSVidCtl.w2k.dll 469KB
-
Mpeg2Data.ax.dll 56KB
-
bda.inf9KB
-
bdaplgin.ax.dll 16KB
-
bdasup.sys.dll 11KB
-
ccdecode.inf3KB
-
ccdecode.sys.sys 16KB
-
dx9bda.cat17KB
-
dxbda.inf6KB
-
ipsink.ax.dll 14KB
-
kstvtune.ax.dll 268KB
-
kswdmcap.ax.dll 221KB
-
ksxbar.ax.dll 38KB
-
mpe.inf3KB
-
mpe.sys.sys 14KB
-
msdv.sys.sys 55KB
-
msyuv.dll.dll 16KB
-
nabtsfec.inf4KB
-
nabtsfec.sys.sys 82KB
-
ndisip.inf6KB
-
ndisip.sys.sys 9KB
-
psisdecd.dll.dll 346KB
-
psisrndr.ax.dll 29KB
-
slip.inf3KB
-
slip.sys.sys 10KB
-
streamip.inf5KB
-
streamip.sys.sys 14KB
-
vbisurf.ax.dll 27KB
-
wst_czec.fon18KB
-
wst_engl.fon18KB
-
wst_fren.fon18KB
-
wst_germ.fon18KB
-
wst_ital.fon18KB
-
wst_span.fon18KB
-
wst_swed.fon18KB
-
wstcodec.inf3KB
-
wstcodec.sys.sys 18KB
-
wstdecod.dll.dll 46KB
-
MaxPayne 2/DirectX9/BDAXP.cab.cab 945KB
-
BdaSup.sys.dll 11KB
-
MSDvbNP.ax.dll 51KB
-
MSVidCtl.dll.dll 1.2MB
-
Mpeg2Data.ax.dll 56KB
-
bda.inf9KB
-
bdaplgin.ax.dll 16KB
-
ccdecode.inf3KB
-
ccdecode.sys.sys 16KB
-
dx9bdaxp.cat15KB
-
dxbda.inf6KB
-
ipsink.ax.dll 14KB
-
kstvtune.ax.dll 268KB
-
kswdmcap.ax.dll 221KB
-
ksxbar.ax.dll 38KB
-
mpe.inf3KB
-
mpe.sys.sys 14KB
-
msdv.sys.sys 50KB
-
msyuv.dll.dll 16KB
-
nabtsfec.inf4KB
-
nabtsfec.sys.sys 82KB
-
ndisip.inf6KB
-
ndisip.sys.sys 9KB
-
psisdecd.dll.dll 346KB
-
psisrndr.ax.dll 29KB
-
slip.inf3KB
-
slip.sys.sys 10KB
-
streamip.inf5KB
-
streamip.sys.sys 14KB
-
vbisurf.ax.dll 27KB
-
wstcodec.inf3KB
-
wstcodec.sys.sys 18KB
-
wstdecod.dll.dll 46KB
-
MaxPayne 2/DirectX9/DSETUP.dll.dll 59KB
-
MaxPayne 2/DirectX9/DirectX.cab.cab 14.7MB
-
ACTC094.ini3KB
-
ACT_RS.ini2KB
-
ACT_RS.png.png 94KB
-
GR3001.ini4KB
-
GR3001.png.png 36KB
-
GR3001_G.ini3KB
-
GR4001.ini15KB
-
GR4001.png.png 30KB
-
GR4001_G.ini14KB
-
GR4001_G.png.png 26KB
-
GR4003.ini3KB
-
GR4003.png.png 29KB
-
GR4005.ini2KB
-
GR4005.png.png 33KB
-
GlmDA.ini13KB
-
GlmDA.png.png 72KB
-
GlmDA_G.ini13KB
-
GlmDGP_G.ini11KB
-
GlmDigGP.ini11KB
-
GlmDigGP.png.png 72KB
-
Hammer.ini18KB
-
IA3002.ini11KB
-
IA3002_1.png.png 57KB
-
IA3002_2.png.png 49KB
-
IA3002_G.ini10KB
-
LGC202.ini5KB
-
LGC202.png.png 30KB
-
LGC207.ini13KB
-
LGC207.png.png 35KB
-
LGC209.ini3KB
-
LGC209.png.png 37KB
-
LGC20A.ini6KB
-
LGC20A.png.png 38KB
-
LGC291.ini2KB
-
LGC291.png.png 28KB
-
MS1B.ini14KB
-
MS1B.png.png 49KB
-
MS1B_01.png.png 1KB
-
MS1B_02.png.png 739B
-
MS1B_03.png.png 581B
-
MS1B_04.png.png 788B
-
MS1B_05.png.png 380B
-
MS1B_06.png.png 406B
-
MS1B_07.png.png 575B
-
MS1B_08.png.png 576B
-
MS1B_09.png.png 645B
-
MS1B_10.png.png 641B
-
MS26.ini8KB
-
MS26.png.png 64KB
-
MS26_01.png.png 3KB
-
MS26_02.png.png 1KB
-
MS26_03.png.png 1KB
-
MS26_04.png.png 1KB
-
MS26_05.png.png 1KB
-
MS26_06.png.png 1KB
-
MS26_07.png.png 962B
-
MS26_08.png.png 910B
-
MS27.ini4KB
-
MS27.png.png 61KB
-
MS27_1.png.png 3KB
-
MS27_2.png.png 1KB
-
MS27_3.png.png 1KB
-
MS27_4.png.png 1KB
-
MS27_5.png.png 1KB
-
MS28.ini3KB
-
MS28.png.png 66KB
-
MS28_1.png.png 790B
-
MS28_2.png.png 932B
-
MS28_3.png.png 883B
-
MS28_4.png.png 1014B
-
MS28_5.png.png 1KB
-
MS28_6.png.png 1KB
-
MS28_7.png.png 1KB
-
MS28_8.png.png 4KB
-
MS34.ini6KB
-
MS34.png.png 56KB
-
MS34_01.png.png 4KB
-
MS34_02.png.png 3KB
-
MS34_03.png.png 595B
-
MS34_04.png.png 1006B
-
MS34_05.png.png 1KB
-
MS34_06.png.png 575B
-
MS34_07.png.png 592B
-
MS34_08.png.png 585B
-
MS34_G.ini3KB
-
MS3B.ini2KB
-
MS3B.png.png 42KB
-
MS3B_1.png.png 3KB
-
MS3B_2.png.png 2KB
-
MS3B_3.png.png 2KB
-
MS3B_4.png.png 2KB
-
MS3B_a.png.png 4KB
-
MS3B_c.png.png 7KB
-
MS3B_m.png.png 3KB
-
MS3B_t.png.png 3KB
-
MS56.ini5KB
-
MS56.png.png 58KB
-
MS56_1.png.png 2KB
-
MS56_10.png.png 885B
-
MS56_2.png.png 862B
-
MS56_3.png.png 990B
-
MS56_4.png.png 937B
-
MS56_5.png.png 523B
-
MS56_6.png.png 496B
-
MS56_7.png.png 846B
-
MS56_8.png.png 743B
-
MS56_9.png.png 864B
-
MS6.ini5KB
-
MS6.png.png 57KB
-
MS6_1.png.png 1KB
-
MS6_10.png.png 1KB
-
MS6_2.png.png 681B
-
MS6_3.png.png 510B
-
MS6_4.png.png 511B
-
MS6_5.png.png 792B
-
MS6_6.png.png 753B
-
MS6_7.png.png 774B
-
MS6_8.png.png 757B
-
MS6_9.png.png 2KB
-
MS6_G.ini4KB
-
MS7.ini3KB
-
MS7.png.png 64KB
-
MS7_1.png.png 4KB
-
MS7_2.png.png 1KB
-
MS7_3.png.png 1KB
-
MS7_4.png.png 1KB
-
MS7_5.png.png 963B
-
MS7_6.png.png 982B
-
MS7_7.png.png 1KB
-
MS7_8.png.png 829B
-
MS7_9.png.png 1KB
-
MS7_G.ini2KB
-
MS8.ini5KB
-
MS8.png.png 54KB
-
MS8_1.png.png 2KB
-
MS8_10.png.png 1KB
-
MS8_2.png.png 681B
-
MS8_3.png.png 1KB
-
MS8_4.png.png 450B
-
MS8_5.png.png 495B
-
MS8_6.png.png 715B
-
MS8_7.png.png 748B
-
MS8_8.png.png 769B
-
MS8_9.png.png 769B
-
MS8_G.ini5KB
-
MSE.ini4KB
-
MSE.png.png 67KB
-
MSE_1.png.png 3KB
-
MSE_10.png.png 1KB
-
MSE_2.png.png 1KB
-
MSE_3.png.png 1KB
-
MSE_4.png.png 1KB
-
MSE_5.png.png 1KB
-
MSE_6.png.png 1KB
-
MSE_7.png.png 1KB
-
MSE_8.png.png 892B
-
MSE_9.png.png 1KB
-
MSE_G.ini5KB
-
MSF1F.ini5KB
-
MSF1F.png.png 59KB
-
MSF1F_1.png.png 1KB
-
MSF1F_10.png.png 832B
-
MSF1F_2.png.png 1KB
-
MSF1F_3.png.png 891B
-
MSF1F_4.png.png 639B
-
MSF1F_5.png.png 646B
-
MSF1F_6.png.png 947B
-
MSF1F_7.png.png 850B
-
MSF1F_8.png.png 870B
-
MSF1F_9.png.png 765B
-
MSPRW.ini3KB
-
MSPRW.png.png 50KB
-
MSPRW_1.png.png 3KB
-
MSPRW_2.png.png 5KB
-
MSPRW_3.png.png 1KB
-
MSPRW_4.png.png 1KB
-
MSPRW_5.png.png 1KB
-
MSPRW_6.png.png 1KB
-
MSPRW_7.png.png 1KB
-
MSPRW_8.png.png 1KB
-
RaiderPD.ini23KB
-
SV-262E1.png.png 51KB
-
SV-262E3.png.png 51KB
-
SV-262E4.png.png 90KB
-
SV2511.png.png 41KB
-
SV2512.png.png 88KB
-
amstream.dll.dll 63KB
-
d3d.inf1KB
-
d3d8.dll.dll 1.2MB
-
d3d9.dll.dll 1.6MB
-
d3dim.dll.dll 611KB
-
d3dim700.dll.dll 871KB
-
d3dpmesh.dll.dll 85KB
-
d3dramp.dll.dll 576KB
-
d3drm.dll.dll 426KB
-
d3drm.inf693B
-
d3dxof.dll.dll 105KB
-
ddhelp.exe.exe 32KB
-
ddraw.dll.dll 375KB
-
ddraw.inf4KB
-
ddraw.vxd29KB
-
ddraw16.dll27KB
-
ddrawex.dll.dll 23KB
-
devenum.dll.dll 131KB
-
diactfrm.dll.dll 456KB
-
diactfrm.inf936B
-
dijoy.hlp19KB
-
dijoybrz.hlp12KB
-
dijoychs.hlp11KB
-
dijoycht.hlp22KB
-
dijoycze.hlp22KB
-
dijoydut.hlp12KB
-
dijoyfrn.hlp12KB
-
dijoyger.hlp20KB
-
dijoyitn.hlp12KB
-
dijoyjpn.hlp11KB
-
dijoykor.hlp19KB
-
dijoypol.hlp20KB
-
dijoyrus.hlp12KB
-
dijoyspa.hlp12KB
-
dijoyswe.hlp11KB
-
dimap.dll.dll 92KB
-
dimaps.inf15KB
-
dinput.dll.dll 652KB
-
dinput.inf24KB
-
dinput.vxd10KB
-
dinput8.dll.dll 676KB
-
directx.inf22KB
-
dmband.dll.dll 26KB
-
dmcompos.dll.dll 56KB
-
dmime.dll.dll 167KB
-
dmloader.dll.dll 32KB
-
dmscript.dll.dll 74KB
-
dmstyle.dll.dll 96KB
-
dmsynth.dll.dll 98KB
-
dmusic.dll.dll 112KB
-
dmusic.inf41KB
-
dmusic16.dll10KB
-
dmusic32.dll.dll 28KB
-
dplay.inf14KB
-
dplaysvr.exe.exe 40KB
-
dplayx.dll.dll 224KB
-
dpmodemx.dll.dll 88KB
-
dpnaddr.dll.dll 16KB
-
dpnet.dll.dll 704KB
-
dpnhpast.dll.dll 44KB
-
dpnhupnp.dll.dll 72KB
-
dpnlobby.dll.dll 16KB
-
dpnsvr.exe.exe 28KB
-
dpvacm.dll.dll 32KB
-
dpvoice.dll.dll 376KB
-
dpvoice.inf113B
-
dpvsetup.exe.exe 84KB
-
dpvvox.dll.dll 120KB
-
dpwsockx.dll.dll 84KB
-
dsdmo.dll.dll 182KB
-
dsdmoprp.dll.dll 478KB
-
dsetup.inf1KB
-
dsound.dll.dll 464KB
-
dsound.inf34KB
-
dsound.vxd46KB
-
dsound3d.dll.dll 1.3MB
-
dswave.dll.dll 17KB
-
dx7vb.dll.dll 588KB
-
dx8vb.dll.dll 1.1MB
-
dx9w9x.cat42KB
-
dxapi.sys.dll 2KB
-
dxdiabrz.chm.chm 24KB
-
dxdiachs.chm.chm 25KB
-
dxdiacht.chm.chm 25KB
-
dxdiacze.chm.chm 25KB
-
dxdiadut.chm.chm 34KB
-
dxdiafrn.chm.chm 24KB
-
dxdiag.chm.chm 24KB
-
dxdiag.exe.exe 904KB
-
dxdiager.chm.chm 31KB
-
dxdiagn.dll.dll 1.6MB
-
dxdiaitn.chm.chm 25KB
-
dxdiajpn.chm.chm 27KB
-
dxdiakor.chm.chm 26KB
-
dxdiapol.chm.chm 26KB
-
dxdiarus.chm.chm 26KB
-
dxdiaspa.chm.chm 23KB
-
dxdiaswe.chm.chm 23KB
-
dxdllreg.exe.exe 43KB
-
dxdllreg.inf2KB
-
dxmigr.dll15KB
-
dxtmsft.dll.dll 351KB
-
dxtrans.dll.dll 194KB
-
dxver.inf234B
-
dxw9xbrz.cat42KB
-
dxw9xchs.cat42KB
-
dxw9xcht.cat42KB
-
dxw9xcze.cat42KB
-
dxw9xdut.cat42KB
-
dxw9xfrn.cat42KB
-
dxw9xger.cat42KB
-
dxw9xitn.cat42KB
-
dxw9xjpn.cat42KB
-
dxw9xkor.cat42KB
-
dxw9xmig.inf3KB
-
dxw9xpol.cat42KB
-
dxw9xrus.cat42KB
-
dxw9xspa.cat42KB
-
dxw9xswe.cat42KB
-
encapi.dll.dll 18KB
-
gameenum.sys.sys 10KB
-
gcdef.dll.dll 480KB
-
gchand.dll.dll 6KB
-
gm16.dls3.3MB
-
gmreadme.txt576B
-
hidgame.sys.sys 8KB
-
joy.cpl.dll 432KB
-
joyhid.vxd12KB
-
joystick.inf4KB
-
jystkbrz.inf4KB
-
jystkchs.inf4KB
-
jystkcht.inf4KB
-
jystkcze.inf4KB
-
jystkdut.inf4KB
-
jystkfrn.inf4KB
-
jystkger.inf4KB
-
jystkitn.inf4KB
-
jystkjpn.inf4KB
-
jystkkor.inf4KB
-
jystkpol.inf4KB
-
jystkrus.inf4KB
-
jystkspa.inf4KB
-
jystkswe.inf4KB
-
ks.inf36KB
-
ks.sys.dll 124KB
-
ks98.inf36KB
-
ks98.sys.dll 123KB
-
kscaptur.inf20KB
-
ksfilt98.inf9KB
-
ksfilter.inf9KB
-
ksolay.ax.dll 12KB
-
ksproxy.ax.dll 115KB
-
ksse.sys.dll 123KB
-
kssetup.inf2KB
-
ksuser.dll.dll 4KB
-
l3codecx.ax.dll 81KB
-
license.txt1KB
-
mciqtz.drv11KB
-
mciqtz32.dll.dll 33KB
-
migrate.dll.dll 72KB
-
mpg2splt.ax.dll 132KB
-
msanalog.vxd12KB
-
msdmo.dll.dll 12KB
-
msjstick.drv2KB
-
mskssrv.sys.sys 7KB
-
mspclock.98.sys 5KB
-
mspclock.se.sys 5KB
-
mspclock.sys.sys 5KB
-
mstee.sys.sys 5KB
-
mswebdvd.dll.dll 317KB
-
pid.dll.dll 40KB
-
qasf.dll.dll 169KB
-
qcap.dll.dll 251KB
-
qdv.dll.dll 304KB
-
qdvd.dll.dll 435KB
-
qedit.dll.dll 1.7MB
-
qedwipes.dll.dll 716KB
-
quartz.dll.dll 1.8MB
-
quartz.vxd5KB
-
stream.sys.dll 45KB
-
stream98.sys.dll 45KB
-
swenum.sys.sys 4KB
-
swenum98.sys.sys 4KB
-
swenumse.sys.sys 4KB
-
vidx16.dll10KB
-
vjoyd.vxd33KB
-
MaxPayne 2/DirectX9/ManagedDX.CAB.cab 1.1MB
-
mdxredist.msi.msi 1.1MB
-
MaxPayne 2/DirectX9/dsetup32.dll.dll 1.9MB
-
MaxPayne 2/DirectX9/dxnt.cab.cab 12.6MB
-
ACTC094.ini3KB
-
ACT_RS.ini2KB
-
ACT_RS.png.png 94KB
-
GR3001.ini4KB
-
GR3001.png.png 36KB
-
GR3001_G.ini3KB
-
GR4001.ini15KB
-
GR4001.png.png 30KB
-
GR4001_G.ini14KB
-
GR4001_G.png.png 26KB
-
GR4003.ini3KB
-
GR4003.png.png 29KB
-
GR4005.ini2KB
-
GR4005.png.png 33KB
-
GlmDA.ini13KB
-
GlmDA.png.png 72KB
-
GlmDA_G.ini13KB
-
GlmDGP_G.ini11KB
-
GlmDigGP.ini11KB
-
GlmDigGP.png.png 72KB
-
Hammer.ini18KB
-
IA3002.ini11KB
-
IA3002_1.png.png 57KB
-
IA3002_2.png.png 49KB
-
IA3002_G.ini10KB
-
LGC202.ini5KB
-
LGC202.png.png 30KB
-
LGC207.ini13KB
-
LGC207.png.png 35KB
-
LGC209.ini3KB
-
LGC209.png.png 37KB
-
LGC20A.ini6KB
-
LGC20A.png.png 38KB
-
LGC291.ini2KB
-
LGC291.png.png 28KB
-
MS1B.ini14KB
-
MS1B.png.png 49KB
-
MS1B_01.png.png 1KB
-
MS1B_02.png.png 739B
-
MS1B_03.png.png 581B
-
MS1B_04.png.png 788B
-
MS1B_05.png.png 380B
-
MS1B_06.png.png 406B
-
MS1B_07.png.png 575B
-
MS1B_08.png.png 576B
-
MS1B_09.png.png 645B
-
MS1B_10.png.png 641B
-
MS26.ini8KB
-
MS26.png.png 64KB
-
MS26_01.png.png 3KB
-
MS26_02.png.png 1KB
-
MS26_03.png.png 1KB
-
MS26_04.png.png 1KB
-
MS26_05.png.png 1KB
-
MS26_06.png.png 1KB
-
MS26_07.png.png 962B
-
MS26_08.png.png 910B
-
MS27.ini4KB
-
MS27.png.png 61KB
-
MS27_1.png.png 3KB
-
MS27_2.png.png 1KB
-
MS27_3.png.png 1KB
-
MS27_4.png.png 1KB
-
MS27_5.png.png 1KB
-
MS28.ini3KB
-
MS28.png.png 66KB
-
MS28_1.png.png 790B
-
MS28_2.png.png 932B
-
MS28_3.png.png 883B
-
MS28_4.png.png 1014B
-
MS28_5.png.png 1KB
-
MS28_6.png.png 1KB
-
MS28_7.png.png 1KB
-
MS28_8.png.png 4KB
-
MS34.ini6KB
-
MS34.png.png 56KB
-
MS34_01.png.png 4KB
-
MS34_02.png.png 3KB
-
MS34_03.png.png 595B
-
MS34_04.png.png 1006B
-
MS34_05.png.png 1KB
-
MS34_06.png.png 575B
-
MS34_07.png.png 592B
-
MS34_08.png.png 585B
-
MS34_G.ini3KB
-
MS3B.ini2KB
-
MS3B.png.png 42KB
-
MS3B_1.png.png 3KB
-
MS3B_2.png.png 2KB
-
MS3B_3.png.png 2KB
-
MS3B_4.png.png 2KB
-
MS3B_a.png.png 4KB
-
MS3B_c.png.png 7KB
-
MS3B_m.png.png 3KB
-
MS3B_t.png.png 3KB
-
MS56.ini5KB
-
MS56.png.png 58KB
-
MS56_1.png.png 2KB
-
MS56_10.png.png 885B
-
MS56_2.png.png 862B
-
MS56_3.png.png 990B
-
MS56_4.png.png 937B
-
MS56_5.png.png 523B
-
MS56_6.png.png 496B
-
MS56_7.png.png 846B
-
MS56_8.png.png 743B
-
MS56_9.png.png 864B
-
MS6.ini5KB
-
MS6.png.png 57KB
-
MS6_1.png.png 1KB
-
MS6_10.png.png 1KB
-
MS6_2.png.png 681B
-
MS6_3.png.png 510B
-
MS6_4.png.png 511B
-
MS6_5.png.png 792B
-
MS6_6.png.png 753B
-
MS6_7.png.png 774B
-
MS6_8.png.png 757B
-
MS6_9.png.png 2KB
-
MS6_G.ini4KB
-
MS7.ini3KB
-
MS7.png.png 64KB
-
MS7_1.png.png 4KB
-
MS7_2.png.png 1KB
-
MS7_3.png.png 1KB
-
MS7_4.png.png 1KB
-
MS7_5.png.png 963B
-
MS7_6.png.png 982B
-
MS7_7.png.png 1KB
-
MS7_8.png.png 829B
-
MS7_9.png.png 1KB
-
MS7_G.ini2KB
-
MS8.ini5KB
-
MS8.png.png 54KB
-
MS8_1.png.png 2KB
-
MS8_10.png.png 1KB
-
MS8_2.png.png 681B
-
MS8_3.png.png 1KB
-
MS8_4.png.png 450B
-
MS8_5.png.png 495B
-
MS8_6.png.png 715B
-
MS8_7.png.png 748B
-
MS8_8.png.png 769B
-
MS8_9.png.png 769B
-
MS8_G.ini5KB
-
MSE.ini4KB
-
MSE.png.png 67KB
-
MSE_1.png.png 3KB
-
MSE_10.png.png 1KB
-
MSE_2.png.png 1KB
-
MSE_3.png.png 1KB
-
MSE_4.png.png 1KB
-
MSE_5.png.png 1KB
-
MSE_6.png.png 1KB
-
MSE_7.png.png 1KB
-
MSE_8.png.png 892B
-
MSE_9.png.png 1KB
-
MSE_G.ini5KB
-
MSF1F.ini5KB
-
MSF1F.png.png 59KB
-
MSF1F_1.png.png 1KB
-
MSF1F_10.png.png 832B
-
MSF1F_2.png.png 1KB
-
MSF1F_3.png.png 891B
-
MSF1F_4.png.png 639B
-
MSF1F_5.png.png 646B
-
MSF1F_6.png.png 947B
-
MSF1F_7.png.png 850B
-
MSF1F_8.png.png 870B
-
MSF1F_9.png.png 765B
-
MSPRW.ini3KB
-
MSPRW.png.png 50KB
-
MSPRW_1.png.png 3KB
-
MSPRW_2.png.png 5KB
-
MSPRW_3.png.png 1KB
-
MSPRW_4.png.png 1KB
-
MSPRW_5.png.png 1KB
-
MSPRW_6.png.png 1KB
-
MSPRW_7.png.png 1KB
-
MSPRW_8.png.png 1KB
-
RaiderPD.ini23KB
-
SV-262E1.png.png 51KB
-
SV-262E3.png.png 51KB
-
SV-262E4.png.png 90KB
-
SV2511.png.png 41KB
-
SV2512.png.png 88KB
-
amstream.dll.dll 63KB
-
d3d8.dll.dll 1.1MB
-
d3d8thk.dll.dll 8KB
-
d3d8thk.w2k.dll 7KB
-
d3d9.dll.dll 1.6MB
-
d3dim.dll.dll 435KB
-
d3dim.xpg.dll 426KB
-
d3dim700.dll.dll 778KB
-
d3dpmesh.dll.dll 36KB
-
d3dpmesh.xpg.dll 34KB
-
d3dramp.dll.dll 577KB
-
d3dramp.xpg.dll 576KB
-
d3drm.dll.dll 356KB
-
d3drm.xpg.dll 342KB
-
d3dxof.dll.dll 48KB
-
d3dxof.xpg.dll 46KB
-
ddraw.dll.dll 277KB
-
ddrawex.dll.dll 23KB
-
devenum.dll.dll 129KB
-
diactfrm.dll.dll 448KB
-
diactfrm.inf936B
-
diactfrm.xpg.dll 457KB
-
dijoy.hlp19KB
-
dijoybrz.hlp12KB
-
dijoychs.hlp11KB
-
dijoycht.hlp22KB
-
dijoycze.hlp22KB
-
dijoydut.hlp12KB
-
dijoyfrn.hlp12KB
-
dijoyger.hlp20KB
-
dijoyitn.hlp12KB
-
dijoyjpn.hlp11KB
-
dijoykor.hlp19KB
-
dijoypol.hlp20KB
-
dijoyrus.hlp12KB
-
dijoyspa.hlp12KB
-
dijoyswe.hlp11KB
-
dimap.dll.dll 43KB
-
dimap.xpg.dll 43KB
-
dimaps.inf15KB
-
dinput.dll.dll 630KB
-
dinput.inf24KB
-
dinput.xpg.dll 633KB
-
dinput8.dll.dll 649KB
-
dinput8.xpg.dll 652KB
-
dmband.dll.dll 26KB
-
dmcompos.dll.dll 57KB
-
dmime.dll.dll 167KB
-
dmloader.dll.dll 32KB
-
dmscript.dll.dll 75KB
-
dmstyle.dll.dll 96KB
-
dmsynth.dll.dll 98KB
-
dmusic.dll.dll 114KB
-
dmusic.inf41KB
-
dplay.inf14KB
-
dplaysvr.exe.exe 27KB
-
dplayx.dll.dll 212KB
-
dpmodemx.dll.dll 76KB
-
dpnaddr.dll.dll 3KB
-
dpnet.dll.dll 707KB
-
dpnhpast.dll.dll 32KB
-
dpnhupnp.dll.dll 66KB
-
dpnlobby.dll.dll 3KB
-
dpnsvr.exe.exe 16KB
-
dpvacm.dll.dll 19KB
-
dpvoice.dll.dll 373KB
-
dpvoice.inf113B
-
dpvsetup.exe.exe 79KB
-
dpvvox.dll.dll 109KB
-
dpwsockx.dll.dll 75KB
-
dsdmo.dll.dll 182KB
-
dsdmoprp.dll.dll 480KB
-
dsound.dll.dll 347KB
-
dsound.inf34KB
-
dsound.vxd81B
-
dsound3d.dll.dll 1.2MB
-
dswave.dll.dll 18KB
-
dx7vb.dll.dll 588KB
-
dx8vb.dll.dll 1.1MB
-
dx9w2k.cat24KB
-
dxapi.sys.sys 9KB
-
dxapi.xpg.sys 10KB
-
dxdiabrz.chm.chm 24KB
-
dxdiachs.chm.chm 25KB
-
dxdiacht.chm.chm 25KB
-
dxdiacze.chm.chm 25KB
-
dxdiadut.chm.chm 34KB
-
dxdiafrn.chm.chm 24KB
-
dxdiag.chm.chm 24KB
-
dxdiag.exe.exe 916KB
-
dxdiager.chm.chm 31KB
-
dxdiagn.dll.dll 1.6MB
-
dxdiaitn.chm.chm 25KB
-
dxdiajpn.chm.chm 27KB
-
dxdiakor.chm.chm 26KB
-
dxdiapol.chm.chm 26KB
-
dxdiarus.chm.chm 26KB
-
dxdiaspa.chm.chm 23KB
-
dxdiaswe.chm.chm 23KB
-
dxdllreg.exe.exe 43KB
-
dxdllreg.inf2KB
-
dxnetsrv.cat28KB
-
dxnetsrv.inf4KB
-
dxnt.inf3KB
-
dxntunp.inf22KB
-
dxver.inf304B
-
dxxp.cat32KB
-
dxxp.inf4KB
-
encapi.dll.dll 18KB
-
gcdef.dll.dll 201KB
-
gcdef.xpg.dll 218KB
-
joy.w2k.dll 318KB
-
joy.xpg.dll 204KB
-
ks.inf36KB
-
ks.sys.dll 127KB
-
kscaptur.inf20KB
-
ksfilter.inf9KB
-
ksolay.ax.dll 12KB
-
ksproxy.ax.dll 114KB
-
ksreg.inf36KB
-
ksuser.dll.dll 4KB
-
l3codecx.ax.dll 81KB
-
mciqtz32.dll.dll 33KB
-
mpg2splt.ax.dll 133KB
-
msdmo.dll.dll 13KB
-
mskssrv.sys.sys 7KB
-
mspclock.sys.sys 5KB
-
mspqm.sys.sys 4KB
-
mstee.sys.sys 5KB
-
mswebdvd.dll.dll 316KB
-
pid.dll.dll 31KB
-
pid.xpg.dll 31KB
-
qasf.dll.dll 169KB
-
qcap.dll.dll 251KB
-
qdv.dll.dll 304KB
-
qdvd.dll.dll 438KB
-
qedit.dll.dll 1.7MB
-
qedwipes.dll.dll 716KB
-
quartz.dll.dll 1.9MB
-
quartz.w2k.dll 1.9MB
-
stream.sys.dll 44KB
-
swenum.sys.sys 4KB
-
MaxPayne 2/DirectX9/dxsetup.exe.exe 456KB
-
MaxPayne 2/Help/html/graphics.htm.html .js 11KB
-
MaxPayne 2/Help/html/input.htm.html .js 4KB
-
MaxPayne 2/Help/html/install.htm.html .js 3KB
-
MaxPayne 2/Help/html/intro.htm.html .js 2KB
-
MaxPayne 2/Help/html/perform.htm.html .js 5KB
-
MaxPayne 2/Help/html/playing.htm.html .js 11KB
-
MaxPayne 2/Help/html/side.htm.html .js 1KB
-
MaxPayne 2/Help/html/side_ie.css877B
-
MaxPayne 2/Help/html/side_ns.css827B
-
MaxPayne 2/Help/html/sound.htm.html .js 4KB
-
MaxPayne 2/Help/html/style_ie.css571B
-
MaxPayne 2/Help/html/style_ns.css733B
-
MaxPayne 2/Help/html/top.htm.html 704B
-
MaxPayne 2/Help/html/troubles.htm.html .js 4KB
-
MaxPayne 2/Help/images/1x1pix.gif.gif 43B
-
MaxPayne 2/Help/images/maxbg.gif.gif 46KB
-
MaxPayne 2/Help/images/maxlogo.gif.gif 3KB
-
MaxPayne 2/Help/images/menu1x80.gif.gif 71B
-
MaxPayne 2/Help/images/rmdlogo.gif.gif 1KB
-
MaxPayne 2/Help/images/rockstarlogo.gif.gif 1KB
-
MaxPayne 2/Help/readme.htm.html 1013B
-
MaxPayne 2/Help/register.url131B
-
MaxPayne 2/Help/support.url126B
-
MaxPayne 2/Install.exe.exe 124KB
-
MaxPayne 2/Install.ini380B
-
MaxPayne 2/autorun.inf53B
-
MaxPayne 2/data1.cab302KB
-
MaxPayne 2/data1.hdr18KB
-
MaxPayne 2/data2.cab661.7MB
-
MaxPayne 2/engine32.cab.cab 410KB
-
DotNetInstaller.exe.exe 5KB
-
IScript.dll.dll 232KB
-
IUser.dll.dll 152KB
-
IsProBE9x.tlb92KB
-
IsProBENT.tlb83KB
-
ctor.dll.dll 56KB
-
iKernel.rgs25KB
-
ikernel.dll.dll 680KB
-
objectps.dll.dll 32KB
-
MaxPayne 2/layout.bin500B
-
MaxPayne 2/setup.boot334KB
-
MaxPayne 2/setup.exe.exe 104KB
-
MaxPayne 2/setup.ini430B
-
MaxPayne 2/setup.inx183KB
MaxPayne 2/Bin/MaxPayne2.ico
- SHA256 0fd62df63b2aa6c8ec74ff0f7109a305db72f54ea9e5a72d6acaa0748e49fdd4
- MD5 4f6ed14c9dd3e1cad99ccca957446ff1
- SHA1 efee2b6bd294d94a220618aef12f3ce245efc7b8
- SHA512 68b1ba8077a07bc9a6d57c4040c780737780b50a22bcdb93bc3078751aadb44c4034cb9ca05bdfede40d9c041897caf3dcf1dbb6d511c42467be9e9c9c589d3c
- SSDEEP 192:0KKDR8OKDx3has5vKDiCrTJxXRqqfdIRF2:0KKDFKD7KD9FhGT2
- TLSH T1E042AB2B2524E498DAC8C436998AC8FD1465FC23948B766972C07FDFFE33F46D1041AA
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/Bin/demo32.exe
- IMPHASH b9e3ca47dd15137a3c1f392c7deca80d
- SHA256 cfdc746632ec796f803c1b3762b7f44bc742358a83da1bc9ae4211c7899f7fcd
- MD5 9e7765d90f26703ab659c122e708d10a
- SHA1 cee1c93a6d1898cd00fd0077b897d6636665a1af
- SHA512 06ddd4ca5fb8fb7f1e76e752faed6a93fbab5c75e205c0f0ea99b7174a61e465a4901b5eccfaa1e44882dce434a25b3cbcadb07edd0bfa2dad337f800fa8fac5
- SSDEEP 6144:+L6NObfQX54zDZ0aomMK5/yjpELO/4TqpnrUpzJ7hlud3HNne68AJmAo+NHWOdiK:xObuCHk5/iCzrFLQaivHO8XMdJNPruG
- TLSH T109B49D01B690C43BDAE180709AD5E772E3F99E318DE94DC3FBD47E8879B1186B761212
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
313121
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleA
HeapDestroy
HeapFree
HeapAlloc
SetCurrentDirectoryA
GetEnvironmentVariableA
QueryPerformanceFrequency
GetCurrentDirectoryA
CreateEventA
SetEndOfFile
CopyFileA
SetFilePointer
MapViewOfFile
CompareStringA
CreateFileMappingA
GetModuleFileNameA
UnmapViewOfFile
GetFileAttributesA
InterlockedDecrement
lstrcmpA
IsDBCSLeadByte
CreateProcessA
GetProcAddress
InterlockedIncrement
SetLastError
Sleep
WideCharToMultiByte
GetTempPathA
WritePrivateProfileStringA
CreateDirectoryA
GetPrivateProfileSectionA
GetTempFileNameA
WriteFile
MultiByteToWideChar
DeleteFileA
VerLanguageNameA
GetVersion
CreateFileA
GetLocalTime
FindFirstFileA
GetVersionExA
GetSystemInfo
GetLastError
GetSystemDirectoryA
FindClose
lstrcpynA
lstrcmpiA
GetTickCount
GetPrivateProfileStringA
GetWindowsDirectoryA
lstrcatA
SizeofResource
lstrcpyA
lstrlenA
FindResourceA
GlobalSize
GetUserDefaultLCID
FreeResource
LoadResource
LockResource
HeapCreate
GetCurrentThreadId
GlobalAlloc
DeleteCriticalSection
SystemTimeToFileTime
QueryPerformanceCounter
ResetEvent
SetEvent
WaitForSingleObject
SearchPathA
VirtualProtect
VirtualQuery
SetEnvironmentVariableA
CompareStringW
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapSize
HeapReAlloc
VirtualFree
CloseHandle
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
FreeLibrary
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileSize
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsAlloc
TlsSetValue
GetSystemTime
GetTimeZoneInformation
ExitProcess
GetCommandLineA
GetStartupInfoA
RtlUnwind
CreateThread
GetDriveTypeA
RaiseException
InterlockedExchange
LocalAlloc
LoadLibraryA
ReadFile
SetErrorMode
GlobalUnlock
GlobalFree
GlobalLock
user32
MoveWindow
GetDlgItem
SetWindowPos
GetSystemMetrics
BeginPaint
EndPaint
PostMessageA
wsprintfA
MessageBoxA
PostQuitMessage
DefWindowProcA
CreateDialogParamA
DialogBoxIndirectParamA
GetDC
ReleaseDC
FindWindowA
SendMessageA
RegisterClassA
CreateWindowExA
IsWindow
DestroyCursor
GetWindowRect
GetClientRect
GetSysColor
DialogBoxParamA
KillTimer
FillRect
SetTimer
SetCursorPos
GetCursorPos
DispatchMessageA
GetDesktopWindow
InvalidateRect
GetForegroundWindow
CharNextA
SetRectEmpty
GetMessageA
DestroyWindow
ValidateRect
WindowFromPoint
SetScrollRange
GetScrollRange
SetScrollPos
LoadBitmapA
EndDialog
RegisterWindowMessageA
CharUpperA
SetWindowLongA
GetClassInfoA
GetWindowLongA
PeekMessageA
GetKeyState
SetFocus
GetParent
SendDlgItemMessageA
SetWindowTextA
LoadIconA
IsRectEmpty
SubtractRect
EqualRect
IntersectRect
CopyRect
UnionRect
PtInRect
LoadStringA
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
SetDlgItemTextA
SetClassLongA
LoadCursorFromFileA
ScreenToClient
VkKeyScanA
MapVirtualKeyA
MessageBeep
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
UnregisterClassA
TrackPopupMenu
ClientToScreen
TranslateMessage
GetWindow
GetClassInfoExA
DrawFocusRect
EnumChildWindows
IsIconic
IsWindowVisible
ShowWindow
GetScrollPos
SetCaretPos
CharUpperBuffA
CharLowerBuffA
CreateCaret
SetCaretBlinkTime
ShowCaret
DestroyCaret
IsCharAlphaNumericA
IsCharAlphaA
DrawFrameControl
DrawTextA
InflateRect
SetParent
SetForegroundWindow
RegisterClassExA
WaitForInputIdle
UpdateWindow
GetMessagePos
GetMessageTime
MsgWaitForMultipleObjects
CharLowerA
EnableWindow
GetDlgItemTextA
DestroyMenu
GetFocus
IsDlgButtonChecked
CheckRadioButton
GetWindowTextA
CreatePopupMenu
AppendMenuA
SetRect
ShowScrollBar
GetSystemMenu
gdi32
CreatePalette
BitBlt
RealizePalette
SelectPalette
CreateDIBitmap
GetSystemPaletteEntries
DeleteObject
GetDeviceCaps
SelectObject
UnrealizeObject
DeleteDC
CreateSolidBrush
SetTextColor
CreateCompatibleDC
GetStockObject
GetObjectA
SetBkMode
AddFontResourceA
RestoreDC
RemoveFontResourceA
CombineRgn
CreateRectRgnIndirect
SelectClipRgn
SaveDC
Rectangle
CreateRectRgn
CreateHatchBrush
DeleteEnhMetaFile
SetBkColor
CreateBitmap
CreateCompatibleBitmap
StretchBlt
PlayEnhMetaFile
SetEnhMetaFileBits
SetStretchBltMode
CreatePen
LineTo
SetWinMetaFileBits
SetPixel
GetPixel
MoveToEx
SetTextAlign
TextOutA
ExtTextOutA
Arc
Ellipse
SetTextCharacterExtra
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polygon
Polyline
RoundRect
GetTextMetricsA
GetTextExtentPoint32A
StretchDIBits
EnumFontFamiliesExA
CreateFontIndirectA
EnumFontsA
CreatePatternBrush
CreateEllipticRgnIndirect
CreateDCA
PatBlt
comdlg32
GetOpenFileNameA
advapi32
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegOpenKeyA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
winmm
timeGetDevCaps
mciSendCommandA
timeGetTime
timeBeginPeriod
timeSetEvent
timeKillEvent
oleaut32
SysFreeString
SysAllocStringLen
shell32
ShellExecuteA
AppEnumWindows
CaptureHookProc
DemoClosingDialog
DemoMenuDialog
DemoSplashDialog
EnumFontExProc
EventProcDll
JournalPlayHookProc
JournalRecordHookProc
KeyboardHookProc
LaunchAppProc
MouseHookProc
PlayerAbout
ServerWndProc
WinSupBackWndProc
WinSupWndProc
Name
.text
Size
364KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=19, version=8022,
count=39, id=14, version=7299,
count=19, id=19, version=8034,
count=346, id=1, productName=Unmarked objects,
count=145, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=20, productName=Unmarked objects (old),
count=97, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
MaxPayne 2/Bin/mp2inst.dbd
- SHA256 473d731fa4fa560e304b81e49dc6909c3f0607be9ce83bcc1689559c27457bdc
- MD5 26fe45bff833e6dda4a0251f23d65343
- SHA1 9e9d4588b23474cec9d50b6e620e8d8a7fbcfdd2
- SHA512 0936a206dd37ffa59ad12a1202c3ee111460349fb976c2cdefecec4863dffa6774829f77c90b1da1ec5844a13ad3220567cf76e64cee9c2a049530e777f4c5d7
- SSDEEP 6144:H4LSktSSb5e5FeTOXVrqlgz/ED4+Ab3o1hVJfDw:HiSuSS1sjXglgz/vDQprw
- TLSH T1422401D069B3B188D561E536CCE8E6208282675B246BACDDCC0B7A7F86D513736DBF10
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/DirectX9/BDA.cab
- SHA256 47acfa0dd8b6697fe711f3c8ea17396fc9dfffa0ef996877fc3ddd75d4d20f5d
- MD5 8900f15a6bb4e88a40e61dff0383904c
- SHA1 31713f533548833af5e5b91ae9e87fde3e24a59c
- SHA512 8f11a78654660e72e4f7c12dc2bef36fb76091c6216a75b4b3895664d9247680fbc2de02bc6429c8a30e1ae56b7871a04fe189fb4a31b43f67d2103ded0dee96
- SSDEEP 12288:U8x3bZrT95c4NXJOdpOMBMqZP6MBTYZ7FlQxqCNKT43o5W9FJ788a+khcicB4K8O:U8xtrB5cOopBB1NYZFZEFoyFJmze/BwQ
- TLSH T11AE423B3A42F58127C2F39352E94EB100AF17686E688098F5EB4E37A302D4B33D76655
- MD5 SHA1 SHA512 SSDEEP TLSH
MSDvbNP.ax
- IMPHASH bd61e5a03c0af93c60b30cf39184a4a7
- SHA256 3b6737deb5ff8e688ab0d4fdcad830ad59bb33dbc8ff2a92c5fb34b5dd3168d9
- MD5 92aa046c550b641e0c88b8e34228699a
- SHA1 4f5815b3a27295b7099523c70cdb7f990fad6a82
- SHA512 6485a02003b187e8d37fdb4c9c76896b6746b648db4f7c9aafeab172b4eceec7123414388ce930cdf5c8e105c27a9225523ff7f91c1146d29fa1744ec2b211af
- SSDEEP 768:gHanLi78wwyADfvpn1hD13+9R/zMlACDh1WZkiHcsgQ4w5gkPlG2e:5LQ8wwDfvpn1hDg9Rrmh1WZt8d0GkN
- TLSH T122332A5637F3C07AD2A322B2872AF7D97AB6D30905159D015B041E0A6F7428BD7BCB4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
37083
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetEvent
CloseHandle
CreateThread
CreateEventA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
IsBadWritePtr
GetCurrentProcess
IsBadReadPtr
GetLastError
ResetEvent
WaitForSingleObject
SleepEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
TerminateProcess
InitializeCriticalSection
GetModuleFileNameA
MultiByteToWideChar
lstrlenA
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExA
msvcrt
wcscmp
??2@YAPAXI@Z
swscanf
memmove
??3@YAXPAX@Z
advapi32
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegCreateKeyA
user32
wsprintfA
PeekMessageA
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageA
ole32
CoFreeUnusedLibraries
StringFromCLSID
CoCreateInstance
CoGetMalloc
CoUninitialize
CoInitialize
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
SysAllocString
VariantClear
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=84, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
MSVidCtl.dll
- IMPHASH 4cab68af3a9d463423ff5188da351b39
- SHA256 d041ce868c0dd6271813d6eb37ade31da6bac6b9363aa418fb4ac0bf722bf425
- MD5 c87caca611eddc4aa2cb6acf93441949
- SHA1 a4aa2f7cac3a97ca1386968dd5130aeac79ef0a6
- SHA512 540ae2d492f5703862e7999a70827161102a53efa5567a5d18cc25d417d45e5c77faeab86c08b97954eb3e9a22cc5bbdb08b46fa565a8a342e5b9aa7e6311061
- SSDEEP 6144:pOnqJibxKYFhKIPX0DKm7+RNpBYXUC36gw7TUkJewWvCm:pOjbwoK4E1qNQO7g
- TLSH T10DA43C12BBC8C672D1A601354D37A7DE2BBDBD072F2286073388271E2FF2B885656755
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
192081
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WideCharToMultiByte
DisableThreadLibraryCalls
lstrcpyA
lstrcatA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
lstrcmpiA
lstrcpynA
GetShortPathNameA
GetModuleHandleA
FormatMessageA
CreateEventA
WaitForSingleObject
ReleaseMutex
CloseHandle
GetLastError
LockResource
LoadResource
FindResourceA
CreateMutexA
SetEvent
ResetEvent
WaitForMultipleObjects
CreateThread
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
VirtualQuery
lstrlenA
VirtualProtect
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
HeapSize
IsBadWritePtr
VirtualAlloc
GetCPInfo
GetOEMCP
SetUnhandledExceptionFilter
WriteFile
VirtualFree
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
ExitProcess
HeapReAlloc
HeapFree
MultiByteToWideChar
DeleteCriticalSection
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrlenW
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetSystemInfo
InterlockedExchange
HeapAlloc
RaiseException
GetCommandLineA
TlsSetValue
Sleep
ntdll
RtlUnwind
ole32
StringFromCLSID
CoCreateFreeThreadedMarshaler
ProgIDFromCLSID
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CoUninitialize
StringFromGUID2
oleaut32
LoadRegTypeLi
VARIANT_UserMarshal
VARIANT_UserSize
SysAllocString
LoadTypeLi
RegisterTypeLi
VariantClear
VariantCopy
SysAllocStringByteLen
VarUI4FromStr
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantChangeType
SysStringByteLen
SysStringLen
SysAllocStringLen
SetErrorInfo
CreateErrorInfo
VariantInit
VARIANT_UserFree
BSTR_UserSize
SysFreeString
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
VARIANT_UserUnmarshal
user32
CharNextA
LoadStringA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjectsEx
DispatchMessageA
advapi32
RegQueryValueA
RegSetValueA
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExA
rpcrt4
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
NdrDllRegisterProxy
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrStubCall2
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
NdrOleFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
241KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
297B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=37, version=8755,
count=16, id=64, version=9210,
count=1, id=11, version=8397,
count=11, id=25, version=9210,
count=180, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=90, id=28, version=9178,
count=53, id=29, version=9178,
count=1, id=61, version=9210,
Mpeg2Data.ax
- IMPHASH 244f9b8f61fbb054334418ba678d871c
- SHA256 83fb90aa279a519fb55ddca9ea1b62f076f42e1a6d1d3cfa64b52fed7dff2a28
- MD5 761b386810f361f2ba35fe2f915d889b
- SHA1 bfb056270ca5493a37b5e4123bd4dd6a851f4aa6
- SHA512 46bcff4a979c15ecc53edac419e684c9f7fa378fe705bb4f60c76018dc80f6deb6d3c33d844abe96a7405aa5b6ac486227bb0094dde12927130e061101807be1
- SSDEEP 1536:We/9MIOf5FDSBBUvMGqrFRev8OADFlds0Fm+F1kDN:rkfn+BcvtADyim+PkDN
- TLSH T1EC437D427FD290B2C3523173DE793BA6F7FAEA480923DE265B0825865E71143B476B07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ResetEvent
WaitForMultipleObjects
LocalAlloc
LocalFree
CreateThread
LocalReAlloc
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
CreateEventA
GetThreadPriority
SetThreadPriority
GetModuleFileNameA
GetLastError
MultiByteToWideChar
SetEvent
CloseHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
GetCurrentProcess
lstrlenA
LoadLibraryA
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExA
GetCurrentThread
msvcrt
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
malloc
free
winmm
timeKillEvent
timeBeginPeriod
timeEndPeriod
timeSetEvent
advapi32
RegSetValueExA
RegCreateKeyA
RegSetValueA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
user32
GetQueueStatus
wsprintfA
MsgWaitForMultipleObjects
DispatchMessageA
PeekMessageA
PostThreadMessageA
RegisterWindowMessageA
ole32
CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=11, id=25, version=9210,
count=84, id=1, productName=Unmarked objects,
count=4, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
bda.inf
- SHA256 8e12de31f46f9ea64ba2a235cba60c3a00fc8d67ea9cdab0a54b5107e9d83a7e
- MD5 a9906b5145e151b6fcd89abe8d0cfe10
- SHA1 e3ef77ca35166e22fce6a991f670f997dd591ca7
- SHA512 22892195ad285c248f9df5d09b8db2cea1322089498b3eb71c8524df3addd6c64ec110aff9f78b28585cf42e9865230186384acc8666bd95fd12b6aca2dcc71b
- SSDEEP 192:00a9Qh3X9Rsh3dkQ2J5s9Qh3VD9Rsh31flRlXodpxE4uHjNuxcr:M9U9RHa989RWflRlXodpxeCI
- TLSH T17222955E432F5923A391109DFBC12DC7B2B18464E4C6408F72BDCF196A5AC99011AFFB
- MD5 SHA1 SHA512 SSDEEP TLSH
bdaplgin.ax
- IMPHASH 1dbce2677ed0e9df3b7a82b88863a3d4
- SHA256 7b51275a4e959f15b1436eef26835dcab7f4b9d7d72202712e0d0433b0e42bdb
- MD5 ddd0da38c23b32b84f3d7e384960b5f5
- SHA1 129d521d651e1a2debea5b2b53fa7060c0734387
- SHA512 a67bda31a63bebef934aa9c71e8dc95bc927347836dcbdcd200183e9cab2eb607c2f5ca0f89bb969ff1578ad4d9c6ef7042dcca4ebda3ad3ed7cf423c79a7636
- SSDEEP 384:aVUBot8PYxyMVm57zBK1TGter7igTVXfMkhKTKWNy/WKN:rB/PYx/VkhK1TkeKgCk0EJ
- TLSH T12A722B12EBE248B3E2D346325BF7268722FAD96863D5AC09974016071E765C3E17634F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11555
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExA
msvcrt
??3@YAXPAX@Z
_vsnwprintf
??2@YAPAXI@Z
advapi32
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyA
user32
wsprintfA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
StringFromGUID2
CoFreeUnusedLibraries
ksproxy.ax
KsSynchronousDeviceControl
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=73, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=14, id=29, version=9178,
count=1, id=61, version=9210,
bdasetup.inf
- SHA256 5d53cd698232e64362e1197a90eabcbb3106857e3d272365a70d39bdfca54b31
- MD5 bcc67174e5c0a8b8699ce39460a6e5f5
- SHA1 db7e1c7a084159f53c01a449b82a97117d230b56
- SHA512 e83215df70c2a34a54003b5ff3f38becc8397562dbc8c3dc896283835f7789e7f00b288465c0fd2e74089e3b07bfb620717ae67662f32e3ff96b72053cbcc267
- SSDEEP 192:62pPXOFcssVHSVyVdwaVEegWa7za0myx0FDj2v6HJod+Cg:fpPXD4myxAPq6pod+H
- TLSH T17FD197444723D21BA9D8203C05A35BCBD6214079623AC85A79DAC98CDF0DC2E7B776BA
- MD5 SHA1 SHA512 SSDEEP TLSH
bdasup.sys
- IMPHASH 6b2b65bafa0dd0cf733b55e44cdea375
- SHA256 90753b4fc2b47e1ed6805510b40d51875ab934e21e837b25a1b21b501baa0617
- MD5 a9ebbf24a7801b101647dafae3875e1b
- SHA1 2dec49095baa61b9efc3f4a932583658767839b6
- SHA512 ab21d58a66a5473ba16b9a5edde84590a465488afe09a40323573a2d1d6681abc727c78faa24eeb1a76fab6e7dd551a49efe4bf5facdb264025649c2034807f9
- SSDEEP 192:KEoUlGuDpAhrnzECZBgb3k5781k4oTSPZCyDg/qIYfWDvtWxU:2UGuDCLhTgLkx8ZoT0BfIYfWDvtWx
- TLSH T17E321B8076D44F36E4EF4DF0CD8711BE667FA2115875A35E063A164A3C65E903E3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BdaSup.pdb
hal
KfReleaseSpinLock
KfAcquireSpinLock
ntoskrnl.exe
ExFreePool
KeInitializeSpinLock
KeTickCount
ExAllocatePoolWithTag
memmove
ks.sys
KsGetParent
KsAddItemToObjectBag
KsRemoveItemFromObjectBag
KsFreeObjectCreateItemsByContext
_KsEdit
KsCreateFilterFactory
KsMergeAutomationTables
KsFilterFactoryUpdateCacheData
KsGetFilterFromIrp
KsPinGetParentFilter
KsFilterAddTopologyConnections
KsGetPinFromIrp
KsFilterCreatePinFactory
BdaCheckChanges
BdaCommitChanges
BdaCreateFilterFactory
BdaCreateFilterFactoryEx
BdaCreatePin
BdaCreateTopology
BdaDeletePin
BdaFilterFactoryUpdateCacheData
BdaGetChangeState
BdaInitFilter
BdaMethodCreatePin
BdaMethodCreateTopology
BdaMethodDeletePin
BdaPropertyGetControllingPinId
BdaPropertyGetPinControl
BdaPropertyNodeDescriptors
BdaPropertyNodeEvents
BdaPropertyNodeMethods
BdaPropertyNodeProperties
BdaPropertyNodeTypes
BdaPropertyPinTypes
BdaPropertyTemplateConnections
BdaStartChanges
BdaUninitFilter
BdaValidateNodeProperty
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256B
Virtual Size
211B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
896B
Virtual Size
834B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGECONS
Size
768B
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
768B
Virtual Size
674B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
278B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
ccdecode.inf
- SHA256 01a55e7e46078b922d5acadf0dd523bf8dc0b5d911be9ec57d890f37c27ca1d0
- MD5 72be12ea26bf6649482166af3fdd0cc6
- SHA1 31ae26d3ecd44391bc93ff5ddce1d1b0f597d60e
- SHA512 0476540cf9d54be6dddf961151cdd90b85b0893a3e373aa56cab3b1bb9c238446228faeb02deff98999ad2c0432101e9b659a7781d827585d2ef3395440e81ec
- TLSH T194716679CD0F91326386E12E7BD21EC2EA095CF2856A0510F55D860427BAD8C531FDDE
- MD5 SHA1 SHA512 TLSH
ccdecode.sys
- IMPHASH d5977c633dbdac9c68f7e446e09a0a9d
- SHA256 c2f53f4e5636f1e742a601db006f735afdcc42d7c56b6a247094b4cd5e1a562b
- MD5 3ad2f721d02d28d8f8c42f3c1145824d
- SHA1 c3e27ad216f9ec57b02614e7c1e1de9a189e0d7a
- SHA512 efde7da34eb0db5892dd3c81511857873299e4df74802d28cd401d3793581b3fb8c7bffd349a01081ff30626df02abf87e122f30b997ee32eda108c57f8ede27
- SSDEEP 384:/iFWZsvzcfhWGR6/xPoH6ZhhiW75Xyn2VvnEsg2WIIW:/c+sgDjW975XfJEpg
- TLSH T119721B84B3C04DB1ED471CB1446B770927B3EB121B2693EB9110EDAA7C2B2D0AD7D6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ccdecode.pdb
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
KeInitializeSpinLock
ExFreePool
KeInitializeEvent
ExAllocatePoolWithTag
KeTickCount
KefAcquireSpinLockAtDpcLevel
hal
ExAcquireFastMutex
KeQueryPerformanceCounter
ExReleaseFastMutex
KfReleaseSpinLock
KfAcquireSpinLock
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
761B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
640B
Virtual Size
554B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=2, id=64, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
dx9bda.cat
- SHA256 0a30442fe1ef6688ee47bf22abc83b94c9f606cdb8b4820e216551f33d3a0f12
- MD5 6fec0a32755386ff0a4c90c11da06a83
- SHA1 81eb18a380054977c3ea3562646aa7e5c10d50f9
- SHA512 99db6385da13c53c5fa175c9df516705ee2df257a8df1b7e17590118ace5291ffb8e3942629fbd9cd3e8cec25b56eb1d490c76cba7f99aeac4aa188c7523c10a
- SSDEEP 192:bbaSONovuAQPQQHpA6SHScEEQQvuYpaErlnkTN2+goM8+J54Kn4dlIDnSm:brIbsnThe1MiDWnSm
- TLSH T1D232C58705AD0192E4678E7097E5F88BB832FBA7AC215D3E316373964883792F31D81D
- MD5 SHA1 SHA512 SSDEEP TLSH
ipsink.ax
- IMPHASH 9c828b85bafb7d0f5f2d6ab092d5473d
- SHA256 a1fdbb9b976abd4b8d40259be09f5d3a1b6d954139e91c984d89caf8f1ee479f
- MD5 98212069d4c937a397049c1a520be394
- SHA1 ed88ecb565cab7281feae33ac489040b699afd96
- SHA512 70310f2a431b948b17cc7df77966bfa360f4b9edc1ac6bb61fdc1d65c1ec9b5e428da79380878c963c8e12496a1248e6e09f012d4f3b0ea10d6159b9135d330c
- SSDEEP 384:1CQH7RI/FGBxuzr+I/IrxCg8lucMkX6VWA6Wv:PbRI9YQzr+UIIglkX6Zr
- TLSH T16F623C1273D144A3D497863609F51A1AB7F9EB299A3DEE06C7050A0F29B9983D2F434F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9669
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
ReleaseMutex
WaitForSingleObject
GetVersionExA
ResetEvent
WaitForMultipleObjects
CreateThread
CreateMutexA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
SetEvent
GetModuleHandleA
TerminateProcess
GetCurrentProcess
WaitForSingleObjectEx
CreateEventA
GetLastError
Sleep
IsBadReadPtr
IsBadWritePtr
GetProcAddress
MultiByteToWideChar
GetModuleFileNameA
lstrlenA
InterlockedDecrement
FreeLibrary
InterlockedIncrement
msvcrt
rand
??3@YAXPAX@Z
??2@YAPAXI@Z
free
malloc
_snprintf
advapi32
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyA
user32
wsprintfA
ole32
CoCreateInstance
CoInitialize
StringFromGUID2
CoTaskMemAlloc
CoFreeUnusedLibraries
CoUninitialize
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
ksproxy.ax
KsSynchronousDeviceControl
iphlpapi
GetUniDirectionalAdapterInfo
GetIpAddrTable
wsock32
htons
WSAStartup
ioctlsocket
setsockopt
bind
closesocket
ws2_32
WSASocketA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=19, id=25, version=9210,
count=93, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
kstvtune.ax
- IMPHASH 373218214f1164b605815211c9b37c65
- SHA256 d7cee0060dfb887138c5cf220e64eb1f853eb2b38ec09a1077ccca80f659bdd0
- MD5 f9a890fd536d2aeb0d809c3a2f92eb3d
- SHA1 18919330dca1d8c9d02d7fd90920084986cff917
- SHA512 e12e9bc4a97464194b5a346499347292b1a295c22b56d2e49c490f4c19f05ef302af4048ff457a0ee5aca5f9ffd4ce47cdefade633c3871f79c3e5e47c5d7264
- SSDEEP 6144:De5h7K/8OJMv9iixiiiCaaii66mizDDDDDDDDDDDDDDDDkkkkkkkkkkkkkkkkkVq:wh7a8D9iixiiiCaaii66mizDDDDDDDDP
- TLSH T14644F81093E24131FA739B7C2B729F92EB79F80867F741C635487666ADA1240AC36F71
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
28494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadResource
FindResourceA
GetLastError
SizeofResource
InterlockedCompareExchange
Sleep
CreateFileA
InterlockedExchange
GetProfileIntA
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LockResource
GetACP
MultiByteToWideChar
CreateMutexA
WaitForSingleObject
ReleaseMutex
CloseHandle
IsBadWritePtr
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExA
InitializeCriticalSection
msvcrt
_purecall
??2@YAPAXI@Z
strtol
??3@YAXPAX@Z
advapi32
RegCreateKeyExA
RegOpenKeyExA
RegEnumValueA
RegCloseKey
RegQueryValueExA
RegDeleteValueA
RegSetValueExA
user32
DestroyWindow
DefWindowProcA
wvsprintfA
LoadStringW
GetWindowRect
ShowWindow
GetWindowLongA
GetDlgItemInt
wsprintfA
KillTimer
MessageBoxA
LoadStringA
CheckRadioButton
SetDlgItemTextA
SetDlgItemInt
InvalidateRect
SetWindowLongA
MoveWindow
CreateDialogParamA
GetDesktopWindow
SendMessageA
GetDlgItem
GetAsyncKeyState
PostMessageA
SetTimer
EnableWindow
SetWindowTextA
UpdateWindow
comctl32
ord17
ole32
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoFreeUnusedLibraries
oleaut32
VariantInit
VariantClear
ksproxy.ax
KsSynchronousDeviceControl
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=15, id=25, version=9210,
count=112, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
kswdmcap.ax
- IMPHASH 95d6690a876714b701968430fd31ed5a
- SHA256 9e4e9600df4099ed9b09c69a612c54cc467b7f2a73a105db48506b7f6a19dd99
- MD5 70d6bccb193de30c5ede4ad2fe1e88a0
- SHA1 26f8ff5c3c80fbc19e29ac16747964b9bc50d3d5
- SHA512 1b3e04833304d1ba38870c86b2aa6f73be8e1e08b272c2f8f89ce046a52f1253088a3b5cd22212f52753bc8dac7728c75f8e026cda5b2ead472323654f15e2e5
- SSDEEP 3072:voMCye3+GyCzX3aR1s9XP9k/WsP438ZHbdEcGnnwM4fjqhi9T+zm:gMCyehFO1s9/9k
- TLSH T16D243E0053F5C511F0F70A745DB69BD26E6A7C966820C90EFEAD624F2870E04DD3AB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
52241
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
WaitForMultipleObjects
VirtualFree
VirtualAlloc
SetLastError
CreateThread
InitializeCriticalSection
ExitThread
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
WaitForSingleObjectEx
GetCurrentProcess
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetModuleFileNameA
Sleep
lstrcmpA
lstrcpyA
lstrcpynA
CreateEventA
GetLastError
DeviceIoControl
GetOverlappedResult
MultiByteToWideChar
lstrlenA
GetVersionExA
TerminateProcess
CloseHandle
mfc42
ord823
ord825
msvcrt
sprintf
_purecall
_ftol
__CxxFrameHandler
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
atoi
strtod
advapi32
RegSetValueExA
RegCreateKeyA
RegSetValueA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
user32
SetTimer
KillTimer
wsprintfA
LoadImageA
ShowWindow
SetDlgItemTextA
GetWindowLongA
SetWindowLongA
CreateDialogParamA
MoveWindow
InvalidateRect
DestroyWindow
LoadStringA
LoadStringW
GetWindowRect
GetDesktopWindow
EnableWindow
SetDlgItemInt
MessageBoxA
IsWindowEnabled
GetDlgItemInt
SetRect
IsRectEmpty
SendMessageA
GetWindowTextA
SetWindowTextA
GetDlgItem
comctl32
InitCommonControlsEx
ole32
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FilterHandleFromPin
PerformDataIntersection
PinFactoryIDFromPin
RedundantKsGetMultiplePinFactoryItems
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=2, id=4, version=8450,
count=1, id=11, version=8012,
count=13, id=25, version=9210,
count=118, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=34, id=29, version=9178,
count=1, id=61, version=9210,
ksxbar.ax
- IMPHASH 5116cc2556341d796c2a80b165186825
- SHA256 807003d27df6650c1f25d599425861211deee6157a9b17063fa2ee33f5f2ce44
- MD5 fb0f0963a85eab06cfd553d9627ccbc9
- SHA1 f657642c3fcb5cdd7b776bb00e7761866d881e33
- SHA512 404c72539fd5b7afe1849a9e7b2ac92278110007346fab77cca5345d2bd43e8631b84188a76ad55dc4e5a05768af5d16894a9fb03acf12f3dc6c565719c5a08b
- SSDEEP 768:ATaLR3XyiRktV34p9/rEvNGIoHRGXz+gxpwD+LBuESF2JBFnuG:cSR3XyxzU/gNoHkzPq2uzF2n5B
- TLSH T1E6037DA137E28072D3B3E237897137B9B6FAF6141639E43A034469C92F7054AD57A307
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
23716
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
WaitForSingleObject
GetLastError
DeviceIoControl
CreateEventA
IsBadWritePtr
CreateFileA
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetACP
MultiByteToWideChar
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExA
msvcrt
_purecall
swprintf
wcstombs
??2@YAPAXI@Z
wcslen
??3@YAXPAX@Z
user32
LoadStringA
LoadStringW
GetWindowRect
wvsprintfA
MessageBoxA
SetRect
SetDlgItemTextA
SendMessageA
GetDlgItem
CheckRadioButton
EnableWindow
ShowWindow
DestroyWindow
GetDesktopWindow
InvalidateRect
MoveWindow
CreateDialogParamA
SetWindowLongA
GetWindowLongA
ole32
CoFreeUnusedLibraries
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
oleaut32
VariantInit
VariantClear
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=90, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
mpe.inf
- SHA256 162c1dd3539436eaaadbb008e3cd275369cdfb51382a04bf8889d9f2a9f0e10c
- MD5 d866dd33fe0269cec6d201c35be34750
- SHA1 4655d7a2e8ccc9b46b0c8ccd6fc5ffc6897cea1b
- SHA512 ef076e9b9a1e8e945f3889f3e8125381de2103c6e6f8ab4635dc9c4327a7bdf49acb4eb2020863c734a11b7eee0817108f181f7297440973d09ee62bba2d96da
- TLSH T12361A56C8C4384B38356E36A5BCB1EC3EB165097C6660508316D4703A79AD1EF31E8EE
- MD5 SHA1 SHA512 TLSH
mpe.sys
- IMPHASH b709125e5196d69f577afdd8423729ff
- SHA256 5e496781069a5bd99debc3ca07e0db03aaf7a377f6cc878fb06d4130d53acc09
- MD5 83eff7b976ae24f1a496ca94a8a19919
- SHA1 b15cea5264d59e659f1b39e7bd0d790a75458a41
- SHA512 d8fe806cf026dfbfb2da2f41f78116755067ac0a7330e9367cf43ca383ea512247dc1ca49060889bd2e92e3309ea0e326e48f31de1595da50062568675650d9c
- SSDEEP 384:IbqWaXa0dcTMWOsH380tdA+RbCWhlrwWv:IbqWaaqWOsH3ttdAuD
- TLSH T10E629448E79D45B3ED5AA5BCE3C30F94EDFB541542234BC98BA966042D117C3DC28BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpe.pdb
ntoskrnl.exe
KeTickCount
KeQuerySystemTime
KeInitializeSpinLock
ExAllocatePoolWithTag
ExFreePool
KeBugCheckEx
DbgPrint
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassStreamNotification
StreamClassDeviceNotification
StreamClassRegisterAdapter
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
640B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
640B
Virtual Size
630B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=5, id=28, version=9178,
count=1, id=61, version=9210,
msdv.sys
- IMPHASH 86f2d51aaa296b59194197c28572822e
- SHA256 bdb107d7eea2a0e77db9439c0a1d5e770d0b59c01c64c833e2cc1da80ad1be8b
- MD5 348a7f225eb0253da62ec098bf19fa08
- SHA1 6305094f100b95897d103cbda8cb435c7b4e9215
- SHA512 802bcd03350bc0f7fa861c587efa22ac3d2a5f9fd4a27085fac78ddd1b8b42c5cec840e0a40fb8cb438be8bcaeeed654657ac26cc58dd842aeca81f7a851b461
- SSDEEP 384:cCOT2GNkxNwcLPYSVaZUjBCq2Lj0bUmsVmaVDrOR/BLQjB6IVcvFlQ0WJGEWs:pKCpL5au2LrMODrOFBLQ96IV6MS+
- TLSH T12E236C01B790C871C11142B08E9BA3F467F7B6265F2AA76373B4572F1F39250BE616A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
17422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
MSDV.pdb
ntoskrnl.exe
IofCallDriver
ExAllocatePoolWithTag
IoFreeIrp
IoAllocateIrp
KeWaitForSingleObject
KeSetEvent
ExFreePool
KeInitializeEvent
KeReleaseMutex
KeInitializeSpinLock
KeInitializeMutex
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeResetEvent
InterlockedExchange
ExQueueWorkItem
KeClearEvent
ObfDereferenceObject
MmMapLockedPages
PsTerminateSystemThread
KeSetPriorityThread
KeGetCurrentThread
IoCancelIrp
wcscpy
KeTickCount
KeBugCheckEx
KeDelayExecutionThread
hal
KfReleaseSpinLock
KeQueryPerformanceCounter
KeGetCurrentIrql
KfAcquireSpinLock
stream.sys
StreamClassStreamNotification
StreamClassRegisterAdapter
StreamClassGetNextEvent
StreamClassQueryMasterClockSync
StreamClassDeviceNotification
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
902B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=4, id=64, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
msdv98se.sys
- IMPHASH c44f46939591a6629aae6b9d01b9dae7
- SHA256 9dbb45724a5136a6e7487660cbedf6051d1b398e1c4be20bc47c8426413d0c06
- MD5 f75a35e8f4331a875d3ff8ab4eadef9b
- SHA1 bfc3cf16e4765a597325342599d8facbe6d3df78
- SHA512 a2cb07be4e28dae1b0d39ce8e8edaa8478f6173b57c8f2f634ec87834aee323bf24bcb628702f1de3b25e74ef8f6beef6369501fb7143d9d6617e5487324d261
- SSDEEP 1536:j9krdmj4yXc50WJx7scHLvWbdGiAv1UN:jCdmj4ucxJ1HL06v2
- TLSH T17D436D0173508837C46F83708D5FB775A2B3B9365A2A66AB7F0067683E74551FF28263
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
53376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msdv98se.pdb
ntoskrnl.exe
IoFreeIrp
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
ExAllocatePoolWithTag
IoAllocateIrp
KeInitializeMutex
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoFreeMdl
KeReleaseMutex
ExFreePool
KeSetEvent
KeClearEvent
KeInitializeSpinLock
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
MmMapLockedPages
InterlockedDecrement
InterlockedIncrement
KeResetEvent
wcscpy
KeTickCount
KeBugCheckEx
KeDelayExecutionThread
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
KeGetCurrentIrql
stream.sys
StreamClassStreamNotification
StreamClassDeviceNotification
StreamClassGetNextEvent
StreamClassQueryMasterClockSync
StreamClassRegisterAdapter
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=4, id=64, version=9210,
count=1, id=69, version=9111,
count=10, id=28, version=9178,
count=1, id=61, version=9210,
msyuv.dll
- IMPHASH 317bb2a83416a509406d650a33ce001a
- SHA256 34bf7e2c8072f7f74cd8f96ec6dcaf0cc1a2266752f28a01bfc3247ffd6dcab6
- MD5 bf66ae458e457e425e7fbb0769ea0f39
- SHA1 d98f187d9dd127107d93baa0bf9c384e984d0120
- SHA512 0d340c11efd75a1ef030d0343ee3e4fe7949d25a6f85cc6a0e207da2b092bc5e6ae8ce97c5441083971044c1d5845438bafe05f2d71e12918ed40c5e5c23da4f
- SSDEEP 192:8olj0Y6wnT1v08JzPLPdoKo9yTYlAU1Wo+Ijuo+Ijpo+Ij2JIGC7qIGC7tIGC7ET:8oV6gtzLL1jWyTYlAsDTZI1WactW
- TLSH T1517283827FAB1D52C0D1093548A7C63B53BE9F7052F7469A4F2515AEF820A61C63BF13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12804
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
VirtualFree
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
LocalFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalAlloc
msvcrt
_ftol
wcscpy
gdi32
GetSystemPaletteEntries
user32
GetDesktopWindow
MessageBoxW
ReleaseDC
GetDC
winmm
DefDriverProc
GetDriverModuleHandle
DriverProc
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=64, version=9210,
count=11, id=25, version=9210,
count=23, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
nabtsfec.inf
- SHA256 eee3641785da56dd4646a4dc5aeb5827828a3218bd5635491da1ec70608ac604
- MD5 187630b45b902dfa52d13f11c69d36e2
- SHA1 5c2ca522286b99f8859f6c719d15468c89644a92
- SHA512 2fc8220fe6bcdb99a874e3f80937f30aa1b7f733e7148a079a7db075b37005f5c862909d87f69dbfe940489f69456f4d3669cf063f482fce47a0b83c95be24b4
- SSDEEP 48:xbcXc68yEhpOD8HK7k38O770g3kc4CqldXcZZx8+wu5S70xjUCdgn9WK13EdbsP2:t00pIfxcZZLiCApt1UhsP2
- TLSH T19E818419CE1B803663E9D11E5BD73E83DB2A30F28D6640C0379C5A08278798C932EDDE
- MD5 SHA1 SHA512 SSDEEP TLSH
nabtsfec.sys
- IMPHASH 49970d1ef884a17567a446f9fea4d52c
- SHA256 c8221eea1a3da78c05de59b395642ca0f4ac97ddc77b0ca6915e8671a227ef81
- MD5 7866b154e876bffbdb7d2351f1d5d6f7
- SHA1 86e22a7ac075a4e8cba6c016c06ceeae65478335
- SHA512 e5b0aff15f6908984978240d2575bf286c9b1a059ac1a6d977fc4cf349ac53c631bb5f8a68dd3f2795a56cfaa2f5e01f55b3dd66be197823f8a2e44ea3d988fb
- SSDEEP 768:7oQ7ZoFgMU7KbBPYTDjujwIhkHZHVMV+mpY3jl6myuq2CeaGSOKWi+6mywyRE4Zu:kQ7kgMUiSTDjG9k8DFO3Us
- TLSH T1F2836B00E782BB7BF4EB50F691AB7A4E11B49F110B4982CB6AD47C46AF385D16F32153
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
37401
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
nabtsfec.pdb
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
KeInitializeSpinLock
KefAcquireSpinLockAtDpcLevel
ExFreePool
ObfDereferenceObject
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
RtlInitUnicodeString
ExAllocatePoolWithTag
KeRestoreFloatingPointState
KeSaveFloatingPointState
KeTickCount
KeBugCheckEx
KeInitializeEvent
hal
KfReleaseSpinLock
KfAcquireSpinLock
ExReleaseFastMutex
KeQueryPerformanceCounter
ExAcquireFastMutex
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
1007B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
896B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=2, id=64, version=9210,
count=1, id=69, version=9111,
count=11, id=28, version=9178,
count=1, id=61, version=9210,
ndisip.inf
- SHA256 6239cda249f35baa9ba1848ebe3df414afa27be38fb8fee79fcdd8dd00dbf907
- MD5 3675a3e175c1b4a9a0397d80b6cdfafb
- SHA1 5eb1d87943f40a205c9b1a65b880417d1c5ff8aa
- SHA512 7ce64105634e7dcb4250a972bf303f4474622ccc61ef07e1742daee8e32ebaff6991bce31c68d782b8f0b31b9c069755548dfd80ac6e4a5c63adcd7484d74299
- SSDEEP 96:4VNZ3J6Ep5c2cQHSsK1GMDSsKv/edvZ0EL6OjkiDk9ozMZ/XydUWb:EH3oEI27SsWtDSssedhTLFYig9ov
- TLSH T160D12E194F42AE352BCBD1799B030F43DA36029B891A154435AD5BC02B7F68E632DE8D
- MD5 SHA1 SHA512 SSDEEP TLSH
ndisip.sys
- IMPHASH 0a8485ddb79fcd7268b3706841e511d5
- SHA256 3fde8e6902ddcd0cd2b8821a9faf38181a4ee155adea54077e78a3d3cc29ebc9
- MD5 17919678746a35660a06ff329c08cf22
- SHA1 d7e8acf345e46c6a74308bfeed2bd747f9877c53
- SHA512 49dd42acc4126803e518ff78a36b753f3de33e475e3480316e25d5b27557f4c324d14a72ca8fae3547e2f56a20a9689ba874d751964b03a13c1be83b355dc7f5
- SSDEEP 192:dVcVaJbQPAW52P/8Owb2cnFRXeTkrppOA5QPWgZFWd:dKVQSAfP/8gcnnCILMWgZFW
- TLSH T135021B0237D50A7BF0131DF685B7176F6436AA302F6B629B1211D88FAD359D0AA34B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
6272
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ndisip.pdb
ntoskrnl.exe
KeBugCheckEx
KeTickCount
IoCreateDevice
IoCreateSymbolicLink
RtlInitUnicodeString
IofCompleteRequest
ndis.sys
NdisFreePacketPool
NdisMSetAttributesEx
NdisAllocateMemory
NdisFreeMemory
NdisAllocatePacket
NdisAdjustBufferLength
NdisAllocateSpinLock
NdisReleaseSpinLock
NdisAcquireSpinLock
NdisFreePacket
NdisMRegisterMiniport
NdisInitializeWrapper
NdisFreeBufferPool
NdisAllocateBuffer
NdisFreeBuffer
NdisAllocatePacketPool
NdisAllocateBufferPool
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
384B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
768B
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
psisdecd.dll
- IMPHASH a63eb4bfb67dc3602cfc27e862114741
- SHA256 0e851dbd5a7a9cb0efd317ad169842263b3f1b97211dfbb3da9c89a6dabf9ba6
- MD5 f548c2cee7755685d943ec9951067db7
- SHA1 c1acf0470bf73d803aa2f97b3e2c2927957c1e0e
- SHA512 6506e8eb1d8838d76c66107aa5571d50e71bb39bfacb19d6ec80708d6e1c2f3271e78a21c74a301a591e04f57430508dd045f50e107e42bcb8e06b68e5cc0db2
- SSDEEP 6144:4djJAO5i8ux63PSnuc7lyunaq0sZLyXockJ6cXnEUjz/ZnCf5:4313KnuilyfsZGXocncXnEUjz/Znw5
- TLSH T1D8748E103FF6C036C7A56175CA7B6BAAF7B8DB094D600A670B0D162C6F38942D166B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
248870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcmpiA
IsDBCSLeadByte
lstrcpynA
HeapDestroy
lstrcpyA
lstrcatA
GetModuleFileNameA
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
LoadLibraryA
SizeofResource
LoadResource
FindResourceA
GetLastError
LoadLibraryExA
lstrlenW
LockResource
GetModuleHandleA
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
FlushFileBuffers
WideCharToMultiByte
MultiByteToWideChar
Sleep
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
LeaveCriticalSection
GetShortPathNameA
EnterCriticalSection
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetCPInfo
GetOEMCP
GetACP
LocalFree
InterlockedExchange
TlsSetValue
GetCommandLineA
GetVersionExA
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
ExitProcess
TlsFree
SetLastError
TlsGetValue
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
HeapSize
SetUnhandledExceptionFilter
ntdll
RtlUnwind
winmm
timeGetTime
advapi32
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
user32
CharNextA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoCreateFreeThreadedMarshaler
oleaut32
SysStringByteLen
SysAllocStringByteLen
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
VariantCopy
VariantInit
SysAllocString
SysFreeString
VariantChangeType
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
300KB
Virtual Size
299KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=26, id=64, version=9210,
count=1, id=11, version=8397,
count=11, id=25, version=9210,
count=135, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=124, id=28, version=9178,
count=56, id=29, version=9178,
count=1, id=61, version=9210,
psisrndr.ax
- IMPHASH 89452c43805800f5fc649a24f8bcf44d
- SHA256 26d0258f5ca8b7c0012087bbbe59c1fc06e42564a05ab64f8d56b1a3ba2ea3d9
- MD5 94869cee1dfc25f2749f0ed10a94437d
- SHA1 94116e06dcbfb3866728ac229dbff640eb0082aa
- SHA512 91064989414206585a66c285540ecf6ef7eceeb8099df6583b1c48a6e23d927dc50548ebcf1dc5d1b24c27599ece937ec1d307f883be068b737f03a09012af65
- SSDEEP 768:TOQa4TlzjGJ96Jg//atAUutO8YmkEHCT:e4Rzjc96CKtAUuHTkYC
- TLSH T152D24B033BD660F2C6B35233C92137ABE7FEEA581A39DE145A0819452A71143F17A78F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13764
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetACP
WideCharToMultiByte
GetModuleFileNameA
GetLastError
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
lstrlenA
LoadLibraryA
FreeLibrary
GetVersionExA
msvcrt
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z
advapi32
RegSetValueA
RegSetValueExA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
user32
wsprintfA
wvsprintfA
ole32
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoFreeUnusedLibraries
CoInitialize
CoTaskMemAlloc
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=73, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=8, id=28, version=9178,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
slip.inf
- SHA256 418040f2b05a196c48fceae77afaa9e58ca87b10269dc084be493db377c82a31
- MD5 a42a3419a484b82e752b850cd13bfdd3
- SHA1 fdb7a19707b7ea6e349c6559152cb5f1c02483e4
- SHA512 eda1f7ead98530284ee850dffae35073f22c3399cb98b6e25dd62d3ec175b4d160d1841ccde5c4261b76bf301feb5417446a30779cf276d778f5c2ba68a4acaa
- TLSH T1757186ACCD0B09636389D1558BE63DC3EF980053C19B0B89306D8A1663C9A9D5E1DDEF
- MD5 SHA1 SHA512 TLSH
slip.sys
- IMPHASH 3f9db7809b38aa51c5daad51c58fe7a9
- SHA256 6abbd6a3398a8bf7f733730784cda73d94ef90cee9d17a344a758c9f6b82eb88
- MD5 e9a03c85ae0000132f5e6815e054e66f
- SHA1 f5e09359ba3321222596a6de38bfa864b14e186c
- SHA512 160935db2bb55ec2ccc417618277e94fa4c483b115b1c3bae41de75cccec2f2fc57e00039bf4f448d8ef4d04ae33f559529e1d0fce08221b17d39936b3edf5b0
- SSDEEP 192:EEYCqlIwfHkLPhw22AsALyp2rn4kY0FUSZVx4TWxzyWE:EPZImHkLPhw2H5x4krFUSZAWxzyW
- TLSH T163224A1137E40F75F0D74BB1AE8B27264677E81C9A11E33E02A53D891D3CD00BA2C7A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
slip.pdb
ntoskrnl.exe
KeTickCount
ExFreePool
ExAllocatePoolWithTag
DbgBreakPoint
KeQuerySystemTime
KeInitializeSpinLock
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassStreamNotification
StreamClassDeviceNotification
StreamClassRegisterAdapter
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
263B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
206B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
streamip.inf
- SHA256 1e06c2c3eeb9cfd1938b73e70cb3b841b1da89b97ab6acadde5c136e0b336bf6
- MD5 885e850809bc928ee802f13e28449efd
- SHA1 39f8ff6d6cfc300b61e6a52f647b05382c4b365b
- SHA512 1b660a1eb54b6e1bce2902a260ae95def2eec32af8c06a666138456ad85f5299d9286d588f90fa9c4d938ccee06960d19c2a3ecbed539e41811e89533526c6e8
- SSDEEP 96:d0KuUqnZK8hQ+B8ljiFjZMaH1XNgaAgaPRIWKTAidudNjKJ:d0K4Yt+SljiFjSyGyVIKJ
- TLSH T141C173494D2B5473937FF23D9B870F92E6257813D18F414830BCCA161B9AD58922EF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
streamip.sys
- IMPHASH 024e69c1aa1ed511e6751546ba958390
- SHA256 d6844877e94eeb2da058ef304d826fc93de739eb2e76573508f7fc95b080367c
- MD5 a44c9b312a08d5728d228bf3e6a57522
- SHA1 94ec08f5d19b5e230cbaede6bec8ea941ea4df46
- SHA512 fb33d94dfa03d12affaedcf9c37a58466c4f52bbc81444aa066f345c2069770d97b0d1373623025ab84d132bd449629c99290e72e4003ecac2006203f8af10a3
- SSDEEP 384:BzjX998FhVnN5Jav/38cjQDu5WhcxLQVcSJcmcViQj/Wg1RW:FjX998Fhb5Ivk3RhcxpgcZi0
- TLSH T1DA52C38D62960473F63F01B41EB2E791EDAFEE156E12C2EA87F25DE50C0264279247F1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
streamip.pdb
ntoskrnl.exe
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObfReferenceObject
ObfDereferenceObject
KeInitializeSpinLock
RtlInitUnicodeString
DbgPrint
ExFreePool
KeTickCount
ExAllocatePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassDeviceNotification
StreamClassGetNextEvent
StreamClassStreamNotification
StreamClassRegisterAdapter
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
640B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
640B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
640B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
640B
Virtual Size
594B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
vbisurf.ax
- IMPHASH ae48a05a15c768aaec63afcf3810c760
- SHA256 018887564193bb5630f794185fcd1ea4f2c4c35e79f8ff349746ad553cb80292
- MD5 cfa4143beb81a867693ce22f95a68749
- SHA1 f07b80522bc2eed677650d2d89ccae44615138a3
- SHA512 6dae611eb56ef7eabe6e89a3331f796bfa6c0e58f300b969300fd7cf8dd3709c00c93657ac028cc59be2a76375cad0fc2def012bf67a96a9f6ea2ed31527829d
- SSDEEP 384:ToCh/XXq0MS0FGt4qz25ilACjFhdkgdUt0VqPL+eGEpw2ygSuaBGMk0KJ8W1jWA7:ToiPoUuqzRlAChUgzM+1FQekNJfjW
- TLSH T1D1C26D12BBD780BADA6355334F793FAAE2B2DB141A3C9C160B1069463A611C3D1FB357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
FreeLibrary
GetTickCount
InterlockedExchange
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
SetErrorMode
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ResetEvent
SetEvent
CreateEventA
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameA
GetLastError
MultiByteToWideChar
lstrlenA
GetVersionExA
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
ddraw
DirectDrawCreateEx
DirectDrawEnumerateExA
advapi32
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyA
user32
wsprintfA
ole32
CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
344B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=74, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
wst_czec.fon
- SHA256 29549f4d2e29b73200087e0484b31ca87dfa0cb22c7a1cfe1258d0750eb44027
- MD5 554df997c4b3cd9c7ab9b4da17f1b9cb
- SHA1 a321c7c1355e62d1bbb18512b93ec9399b415011
- SHA512 40c7909fc84699a1ae971a0de87c5f47fb5dd2eddb012ff1f866faaf0b0a03f4595ad983210a2970da6c832709f6b8cc1b5d6271038e875074954962cb5308f4
- SSDEEP 192:q3IojXHKiSpP/vH3f/3f68lrg83nXn3nX:q3IorypP/vH3f/3fprj3nXn3nX
- TLSH T11582F0455CBF7EE1C49409389E4B9B2448B06E82B852CD92DB712EADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_engl.fon
- SHA256 7ab2b68a88ac69c806df7bb5a1fb4220777233f80501afe64766b84b22d0a8dd
- MD5 5a414bcd0da476df205db8941fd095fc
- SHA1 d62e9dfafeb1b6d74b5d9aca9e1e1c9232068dd0
- SHA512 13fd2b56b72302dfcff291927c1372eab267af07b730dd55f159688d34bc548cbb8e7a4580752c22b3e8c5ca144a1f16ff563bf5bcd0416ce3ff08240fcfe8e0
- SSDEEP 192:qPIojXHjyCyP/vH3f/3fn8lDIg3nXn3nX:qPIor+CyP/vH3f/3fMD/3nXn3nX
- TLSH T1568214455CBF6EE2D49409388E4B9B2448B06E82B852CD92DF712DADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_fren.fon
- SHA256 be473acc9c748899f906901dcc35adfb00f36d9d923052d991fa3f9042d7b3bf
- MD5 f48eabb60de7a2d478c3e720337052f1
- SHA1 11685c48a30b1da1b4679685fac1a616ff566891
- SHA512 1b7b3aa5a516a8e159a3ef056d144a771082bfd286da63c8bc644592652515daba9c5dd9b4d4989b5176d51cd1ce18824762576f3dc9bbaaa6f00be9c543ef21
- SSDEEP 192:45IojXHZvlXP/vH3f/3f88lX4a3nXn3nX:45Ior5lXP/vH3f/3fTXd3nXn3nX
- TLSH T11B82F0451CBF6EE1C49409388E4B9B2448B06E82B812CD92DF716EADEDF7350E297C5C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_germ.fon
- SHA256 78002bc6f1780107f545ff8f9346478add8cc1907f620dec6fc780bde1e38c8c
- MD5 96ab323e35f83a7f6cd47f3890906cae
- SHA1 a2228a7d236c831e2a0827dd78bfc4ffc1515e90
- SHA512 76dbffe05f17c43387005aca1bdc767a7ce830e7c46d3a824bc00997cee3da6a53fd102d017f99bf075a22f9bc319332d594e11f0d9eb6bc481f2326d68fef72
- SSDEEP 192:ByIojXHOjNP/vH3f/3fu8lH2/m3nXn3nX:ByIor4NP/vH3f/3fNHD3nXn3nX
- TLSH T19782E0452CBF7DA1D49409389E4B9B2448B06E82B852CD92DF712EADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_ital.fon
- SHA256 a866dfd73415a75025625941c462d76e46ce980259eb0eefc8c4fb109e060c64
- MD5 8faee3b19e9c365e383194b34b05de85
- SHA1 8bf5d4687b1e5575c91eca0f0193971693889b4d
- SHA512 162d27b32a4d7119eea673da80692a78c9a7cf00f17c1edfd6260ddeb378c69d98a633b817c3e4ef1a83a412d6fc0e56276de21bf792d89849bbaae544ab5d33
- SSDEEP 192:NuIojXHITKnP/vH3f/3fz8lDSE3nXn3nX:NuIorYKnP/vH3f/3foDV3nXn3nX
- TLSH T10C8202455CBF7EE1C49409388A4B9B2448B06E82B852CD92DF716EADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_span.fon
- SHA256 d41768876a1ab65191001a2988f2e61bb44fb35b9ea8fa94d169893a3dab77e6
- MD5 8d16c368d2e9dd5b0cb21ca6fe5820f5
- SHA1 fdaf1425128d7095a3b2ef98f0367293bacbf400
- SHA512 8f4a5529aa7dacb447610df0b6d0d1027e07c9d946c4120a9a23ad7c9754ab1f135d1940fadc30aabf35617b74164261ec0a48cd363043597f9e547801aeaf43
- SSDEEP 192:vIIojXH7vkEP/vH3f/3fn8ljMO3nXn3nX:vIIor7sEP/vH3f/3fMj93nXn3nX
- TLSH T14182F0452CBF7EA1C49409389E4B9B2448706E82B852CD92DF716EADEDF7350E287C5C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_swed.fon
- SHA256 adf1915b3faa31a5d0826d90f464bda32216b5ead9b5c6bd871df401c82a7c60
- MD5 3d37c5768207c09dfaf20fb876a121d5
- SHA1 f776e69aa0365ae692f6b16640a6aa6012fb6364
- SHA512 9f6813b4d12b8c95794c232867c6164240a696091b4488af5e2f5d4657faca1394909b18f21c1c27326a150e0d2a883872664a7cf85f617be29c2c99b52d87a7
- SSDEEP 192:+BBLIojXHBmkP/vH3f/3f48l/A+3nXn3nX:+bLIorUkP/vH3f/3fv/Z3nXn3nX
- TLSH T19E82EF455CBF7EA1C49409389E4B9B2448B06E82B852CD92DF712EADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wstcodec.inf
- SHA256 6edd2203dd2fae09442e9afec57738ebc37364d27c84d76bed633e122ca33313
- MD5 d0ba27ccb5958090755e939a01ce8cd4
- SHA1 7e9ec073086dda1d6bad3f572e041cd482877fc6
- SHA512 583d43a959af8ca13d0a215143ddec8c78d0e079c06707dd23a093dcf0bf7039b60a802539c364db769ebe065a3f805d86fb3bae0a0f1b453325a0635e1a52cc
- TLSH T1857123CD8D0B87BF7344D11E7A522E82EB1971F281CE0A043D9D7E143796DC8621E89E
- MD5 SHA1 SHA512 TLSH
wstcodec.sys
- IMPHASH 5e94d6115bae4fe6e2b87706af1a8293
- SHA256 c06580fb07bc31e4a7647fc14bf596840e854a84fa0423d51f82e67633ae1a2b
- MD5 399530e6494bad5cd769eeddb1266ed1
- SHA1 bc7ce4065ba7e3c78d9728e60bebc2b8d898d763
- SHA512 bd3a004b4343c7dbe060cb29b98ff1f011069de0cbb5cfe648cea8c02c92382d18aa4eba0c9b1f23810e484917e948747153dab02fe9992601ad7bc404970ece
- SSDEEP 384:1s+CEbgqEcQzr9wa8eiLXpYs9+7NPHeWQyWoS:u+pnQzEY80Qs
- TLSH T153827EC53BC02DBBE9254B355AFB23155BF7D7191662D3838210ED5C3D26E408DB6A23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wstcodec.pdb
hal
KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter
ntoskrnl.exe
IoCreateSymbolicLink
ExFreePool
KeInitializeSpinLock
KeTickCount
ExAllocatePoolWithTag
RtlInitUnicodeString
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
512B
Virtual Size
484B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=3, id=64, version=9210,
count=1, id=28, version=9178,
count=1, id=69, version=9111,
count=6, id=29, version=9178,
count=1, id=61, version=9210,
wstdecod.dll
- IMPHASH af4f8f6981ea7fd495566925fe5b0cf2
- SHA256 989afa7b916b81458420d7a66a6da44dacd21b2be4b5e8f548b32564d9e2ebff
- MD5 44721c56391ae9a79e6e40a9f77d9d89
- SHA1 e1b18acbb5365dfee5e6fcd58c0fcb267dbc65ee
- SHA512 accca5ea55dd9c3d12477e37a2ef751b2779ed1cfa9fb9ab4c57ec6f44614e5d207bfd97c7a530bc0ea234625ead1bb98843c28d48bec6077fb721de9616818f
- SSDEEP 768:cYDY8arY72ooeftaUnHzFFZ3gGFkO//mgTMvM95QK3DpCBfgJUtkR4+c6L:cm54YioRftvTFFZHFJ/6M9qw0B7tkeM
- TLSH T1AC237DF773D640F3C2E341725A3173A6B2F6E648192EA4235710394E2BA165AC63F637
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
27838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
TerminateProcess
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLastError
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameA
MultiByteToWideChar
lstrlenA
GetVersionExA
GetModuleHandleA
MulDiv
IsBadReadPtr
IsBadWritePtr
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
msvcrt
free
malloc
??2@YAPAXI@Z
sprintf
sscanf
??3@YAXPAX@Z
gdi32
CreateCompatibleDC
DeleteDC
CreateFontIndirectA
SetBkMode
DeleteObject
CreateDIBSection
SelectObject
SetTextColor
ExtTextOutA
SetBkColor
GetTextMetricsA
GetSystemPaletteEntries
GetDeviceCaps
GetTextColor
user32
LoadStringA
LoadStringW
GetWindowRect
GetDesktopWindow
DestroyWindow
InvalidateRect
CreateDialogParamA
SetWindowLongA
wsprintfA
SetRect
SetTimer
KillTimer
IsRectEmpty
ReleaseDC
GetDC
UnregisterClassA
SendMessageTimeoutA
DefWindowProcA
ShowWindow
CreateWindowExA
GetWindowLongA
GetWindowTextA
MessageBeep
IsDlgButtonChecked
GetDlgItem
SendMessageA
SetWindowTextA
CheckDlgButton
RegisterClassA
MoveWindow
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegSetValueA
RegCreateKeyA
RegDeleteKeyA
ole32
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
CoCreateInstance
CoInitialize
CoTaskMemAlloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=124, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=19, id=29, version=9178,
count=1, id=61, version=9210,
MaxPayne 2/DirectX9/BDANT.cab
- SHA256 d83c0089cdfe14c1b008b27257c1950ac86b7df56c03803b84a3422928701eab
- MD5 08938174a6e3174795d6f173da953e7c
- SHA1 69d8da84ab833958aa4c5a7db3f717dc6599da0f
- SHA512 e77148362aac19b82ddf91f329c0bbb4ee2b7759c5a01aea6dded866ca62352a08c549b600d760c57fd947152477e929f2b7820404b0543d7be8a4d4f9784a57
- SSDEEP 24576:ZHDdj5+1THImM/OX92BwOnMOecgZ5KGjrIzaq28tgiK3eiKQtz7j9TS:Zj0tM/m9Z2MogLnIJRyehQtBe
- TLSH T1FF3533EAEA86D1351210F53F789F7B7333C7D220457A696B25AD13E882370F036B4995
- MD5 SHA1 SHA512 SSDEEP TLSH
MSDvbNP.ax
- IMPHASH 8d46331ee3af79cade97e0eb594f6089
- SHA256 bf81f612413b69096874a6834c0286983f5440b0ec411120de28364aa0cb2de7
- MD5 ddb9b5c1ce074274d74b8a7910c97208
- SHA1 593bf280d571733cbfff9b79cbfba043f46de9ce
- SHA512 fabe9ae67a1cd850cd36db58f9834b8fc35e1ad2d06ec5b5587e6dc1bacbcda0038c347721c18696fe215f3b0c0f9221c76a416e75e30b339556f89470dc716d
- SSDEEP 768:UqC9FJqBx8YBYuPWAcsK6fxeC+AqbiJfeg6LFlixhA+tl7WwJ:ULF8n8YBXPWAe6sAqOdv0ixDJ
- TLSH T19733185733F7C17AD2A362B2862AF7D9BAB6D30906159D011B040E0A1F7468BD37DB4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
37440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetEvent
CloseHandle
CreateThread
CreateEventW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
IsBadWritePtr
GetCurrentProcess
lstrcmpW
IsBadReadPtr
GetLastError
ResetEvent
WaitForSingleObject
SleepEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
TerminateProcess
InitializeCriticalSection
lstrcpynW
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
lstrlenW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
msvcrt
wcscmp
??2@YAPAXI@Z
swscanf
memmove
??3@YAXPAX@Z
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
user32
DispatchMessageW
MsgWaitForMultipleObjectsEx
wsprintfW
PeekMessageW
TranslateMessage
ole32
StringFromCLSID
CoInitialize
CoTaskMemAlloc
StringFromGUID2
CoFreeUnusedLibraries
CoTaskMemFree
CoCreateInstance
CoGetMalloc
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=88, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
MSVidCtl.dll
- IMPHASH 0467516a475941daa18bfa5b1573ef90
- SHA256 940689990d3abc736654d4d4a4f3ad3b09e20b9c2e61de3e1bb6231f6d1e1ca2
- MD5 f22f1f4f67597d5da36b9cecbbb9bc6e
- SHA1 995552cfcd548aebdc3f3ed0f08d3395312b53eb
- SHA512 6815328e6f4ad9faefffef2a4e6f9222d154f8fad244421f5261f6a059ec2b705aa3291f904a22e162f04d1c593669d861df8a99d80d7eaef2e9be5bb294d427
- SSDEEP 24576:MhHKWxn2j5IH3LrCI/In2QGIlXaPHO0ayY:nQn2j503LGZn23GK
- TLSH T1C3454B0277F2C134CA6360328E6BEB9863BDEB155F11450727882B4E1FF1F498656FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
676204
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLocaleInfoW
WideCharToMultiByte
GetTickCount
GetDriveTypeW
GetSystemDirectoryW
Sleep
IsValidLocale
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentProcessId
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetLocalTime
GlobalMemoryStatus
GetDiskFreeSpaceA
GetComputerNameA
LocalFree
LocalAlloc
CreateMutexA
VirtualQuery
GetSystemInfo
VirtualProtect
ReadFile
SetStdHandle
LCMapStringW
SetThreadExecutionState
FormatMessageW
IsBadReadPtr
GetOEMCP
GetStringTypeW
GetStringTypeA
GetCPInfo
FlushFileBuffers
SetFilePointer
HeapSize
IsBadWritePtr
VirtualAlloc
SetUnhandledExceptionFilter
WriteFile
VirtualFree
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
ExitProcess
HeapReAlloc
RaiseException
GetVersionExA
GetCommandLineA
TlsSetValue
DelayLoadFailureHook
CreateThread
WaitForMultipleObjects
ResetEvent
SetEvent
CreateMutexW
FindResourceW
LoadResource
LockResource
GetLastError
lstrlenA
MultiByteToWideChar
CloseHandle
ReleaseMutex
WaitForSingleObject
LCMapStringA
CreateEventW
GetModuleHandleW
GetShortPathNameW
lstrcpynW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
lstrlenW
LoadLibraryW
GetProcAddress
DeviceIoControl
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameW
lstrcatW
DeleteCriticalSection
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrcpyW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
IsBadCodePtr
InterlockedExchange
ntdll
RtlUnwind
ole32
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoGetMalloc
CoUninitialize
ProgIDFromCLSID
StringFromCLSID
StringFromGUID2
GetRunningObjectTable
CLSIDFromString
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
HDC_UserSize
HDC_UserMarshal
HDC_UserUnmarshal
HDC_UserFree
HWND_UserSize
HWND_UserMarshal
HWND_UserUnmarshal
HWND_UserFree
CreateItemMoniker
CoCreateFreeThreadedMarshaler
oleaut32
SysFreeString
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysAllocString
LoadTypeLi
RegisterTypeLi
VariantClear
VariantCopy
SysAllocStringByteLen
VarUI4FromStr
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantChangeType
SysStringByteLen
LoadRegTypeLi
SysStringLen
SysAllocStringLen
SetErrorInfo
CreateErrorInfo
VariantInit
OleCreatePictureIndirect
OleCreatePropertyFrame
user32
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
MapWindowPoints
EqualRect
ReleaseDC
GetDC
IsWindow
CopyRect
SystemParametersInfoW
FillRect
SendMessageW
PostMessageW
GetWindowLongW
GetClientRect
SetTimer
KillTimer
GetKeyState
SetCursor
LoadImageW
RegisterClassExW
wsprintfW
LoadCursorW
PtInRect
IntersectRect
GetWindowRect
ReleaseCapture
SetCapture
GetDesktopWindow
DestroyWindow
SetFocus
IsChild
GetFocus
GetParent
ShowWindow
InvalidateRect
DefWindowProcW
SetWindowLongW
CreateWindowExW
BeginPaint
EndPaint
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
CallWindowProcW
CharNextW
GetClassInfoExW
advapi32
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegSetValueW
RegQueryValueW
RegQueryValueExW
RegCreateKeyW
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
GetUserNameA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueW
gdi32
CreateDIBitmap
SelectObject
CreateCompatibleDC
GetDeviceCaps
CreateSolidBrush
DeleteObject
DeleteMetaFile
CloseMetaFile
RestoreDC
SetWindowExtEx
SetWindowOrgEx
SaveDC
CreateMetaFileW
CreateRectRgnIndirect
DeleteDC
rpcrt4
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubCall2
NdrStubForwardingFunction
NdrCStdStubBuffer_Release
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
903KB
Virtual Size
902KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
1024B
Virtual Size
693B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=37, version=8755,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=23, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=8, productName=Unmarked objects (old),
count=3, id=14, version=7299,
count=2, id=96, version=2067,
count=31, id=64, version=9210,
count=1, id=10, version=8397,
count=7, id=11, version=8397,
count=13, id=25, version=9210,
count=298, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=54, id=29, version=9178,
count=163, id=28, version=9178,
count=1, id=61, version=9210,
MSVidCtl.w2k
- IMPHASH aa2c799825b6370b37645be920a8c847
- SHA256 4ec7d7011c22ee0ed2eaa089a43c1e46bd14db36c9728c0763041d7825ffbcd4
- MD5 9fde3d1ff660330702a339c3645bffb3
- SHA1 b9e762f9f93eb29657b7111088037a7c5f4f817e
- SHA512 4ed64b04bb067373f2c58182ec3bbb5552c6c2e88c58003a7f67c7efe51cc0b647c5ea43fee667be39aa558db17bfb2b29b3b44571e1df9947042bb684727e88
- SSDEEP 6144:/H9T5zUAE5eMJQTxvb/D0XUC36gw7TUkJewWvCIkr:ltzUMRTxvbgO7gXk
- TLSH T15CA45C12BBD8C635D09641354DB7A7AD37BDBC061F16860733883B1E1EF2B885A537A8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
191170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FreeLibrary
GetProcAddress
LoadLibraryW
DisableThreadLibraryCalls
lstrlenW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
lstrcpynW
GetShortPathNameW
GetModuleHandleW
FormatMessageW
CreateEventW
WaitForSingleObject
ReleaseMutex
CloseHandle
MultiByteToWideChar
lstrlenA
GetLastError
LockResource
LoadResource
FindResourceW
CreateMutexW
SetEvent
ResetEvent
WaitForMultipleObjects
CreateThread
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
VirtualQuery
GetModuleFileNameW
VirtualProtect
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetCPInfo
GetOEMCP
HeapSize
IsBadWritePtr
VirtualAlloc
SetUnhandledExceptionFilter
WriteFile
VirtualFree
HeapCreate
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
lstrcatW
DeleteCriticalSection
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrcpyW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
GetSystemInfo
InterlockedExchange
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
RaiseException
GetVersionExA
GetCommandLineA
TlsSetValue
Sleep
ntdll
RtlUnwind
ole32
StringFromCLSID
CoCreateFreeThreadedMarshaler
ProgIDFromCLSID
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CoUninitialize
StringFromGUID2
oleaut32
LoadRegTypeLi
VARIANT_UserMarshal
VARIANT_UserSize
SysAllocString
LoadTypeLi
RegisterTypeLi
VariantClear
VariantCopy
SysAllocStringByteLen
VarUI4FromStr
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantChangeType
SysStringByteLen
SysStringLen
SysAllocStringLen
SetErrorInfo
CreateErrorInfo
VariantInit
VARIANT_UserFree
BSTR_UserSize
SysFreeString
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
VARIANT_UserUnmarshal
user32
CharNextW
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
advapi32
RegQueryValueW
RegSetValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
rpcrt4
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrStubCall2
CStdStubBuffer_QueryInterface
NdrOleFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
239KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
297B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=37, version=8755,
count=16, id=64, version=9210,
count=1, id=11, version=8397,
count=11, id=25, version=9210,
count=183, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=88, id=28, version=9178,
count=53, id=29, version=9178,
count=1, id=61, version=9210,
Mpeg2Data.ax
- IMPHASH fcd4181f9417f53d1b10aa6fcfd706a8
- SHA256 886516c87c44b3f5724aca16e946b122a0527cc3177b3bf42ba1eba788f15b7a
- MD5 c15a32f56e3fe83ad6ab9f0dedcaa9da
- SHA1 53434fe6a7db9304b3f7d5d811f6f8591c268ddc
- SHA512 d789854d9166674d6c835116ff4b03f0a401b6a4df604a5ee24ca31589d42123b4c9f6849d2dbdb02a5047ce681e92483f2926f08915c731d64c73f4bc83ee1b
- SSDEEP 1536:P3dQ9MItf5FvSBB14TULwi2oKixe24dTKlwKwyoxlVBbO8:/sfnqBgoPe5ew1xlVBq
- TLSH T107437D427BD2A0B2C3523173DEB937A6F3BEE6081927DE225B0829455F31643B475B07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33657
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ResetEvent
WaitForMultipleObjects
LocalAlloc
LocalFree
CreateThread
LocalReAlloc
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
CreateEventW
GetThreadPriority
SetThreadPriority
lstrcpynW
lstrcpyW
lstrcmpW
SetEvent
CloseHandle
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
GetModuleFileNameA
GetLastError
lstrlenA
MultiByteToWideChar
lstrlenW
LoadLibraryW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
GetCurrentThread
msvcrt
malloc
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
free
_purecall
winmm
timeBeginPeriod
timeEndPeriod
timeSetEvent
timeKillEvent
advapi32
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
user32
GetQueueStatus
PostThreadMessageW
wsprintfW
MsgWaitForMultipleObjects
PeekMessageW
RegisterWindowMessageW
DispatchMessageW
ole32
CoFreeUnusedLibraries
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
StringFromGUID2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=11, id=25, version=9210,
count=88, id=1, productName=Unmarked objects,
count=4, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
bda.inf
- SHA256 8e12de31f46f9ea64ba2a235cba60c3a00fc8d67ea9cdab0a54b5107e9d83a7e
- MD5 a9906b5145e151b6fcd89abe8d0cfe10
- SHA1 e3ef77ca35166e22fce6a991f670f997dd591ca7
- SHA512 22892195ad285c248f9df5d09b8db2cea1322089498b3eb71c8524df3addd6c64ec110aff9f78b28585cf42e9865230186384acc8666bd95fd12b6aca2dcc71b
- SSDEEP 192:00a9Qh3X9Rsh3dkQ2J5s9Qh3VD9Rsh31flRlXodpxE4uHjNuxcr:M9U9RHa989RWflRlXodpxeCI
- TLSH T17222955E432F5923A391109DFBC12DC7B2B18464E4C6408F72BDCF196A5AC99011AFFB
- MD5 SHA1 SHA512 SSDEEP TLSH
bdaplgin.ax
- IMPHASH 2d0c35dab4bdadc34717c640b941494f
- SHA256 18870378c79d899d08e27fc15b189a390b5f6e945080fb2ca80088c7f3efed2c
- MD5 fec7c0214fe562e4f844b1c9ad7b764e
- SHA1 0a001e8930321000aada1ea4642d811d27cc0fad
- SHA512 ae7fb745daa28b3a9739ee2f152237539b5b57691a398414e4bea7092eecc6b51e0411ea2a509167da89941c57d9f1bfbb9e5d683bebcc611b5e75be9f1d9eb8
- SSDEEP 384:xbqT9AkpIxJfizW/zBKSZMItir5mg663xtKG7KWNy/WKN:xbqTXpIxJiaFKKMqisgrxYbJ
- TLSH T13F722C45E7E298B3E6D246335BF6268772BACA255386DC04174026072E37982F1B678F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11603
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
GetLastError
lstrlenA
MultiByteToWideChar
lstrlenW
GetVersionExW
InterlockedIncrement
FreeLibrary
InterlockedDecrement
msvcrt
??3@YAXPAX@Z
_vsnwprintf
??2@YAPAXI@Z
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
user32
wsprintfW
ole32
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
CoInitialize
ksproxy.ax
KsSynchronousDeviceControl
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=77, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=14, id=29, version=9178,
count=1, id=61, version=9210,
bdasup.sys
- IMPHASH 6b2b65bafa0dd0cf733b55e44cdea375
- SHA256 2da3191b54c898c490533808dcc4b034af699ee25c18bdf08d76d27041f24fc0
- MD5 ac3c7cbf6151d7b8db66357fbfad3f31
- SHA1 359812a732b7c96114d68552631adf027c5620e4
- SHA512 c79030267f6509bae3b857824510f8f0a400d2ee5f33eef1e9f54e8b466b1def838ff2a66d5ea7449420f3d6c6eb79b98c4580f537fcaa5a7aadc75ff69739db
- SSDEEP 192:KbTUlGuDpAhrnzECZBgb3k5781k4oTSPm9aDg/qIYfWDvtWxU:AUGuDCLhTgLkx8ZoT0lfIYfWDvtWx
- TLSH T1A0321A80B6D44E36E5EF4DF0CD8711BE667FA2115875A36E063A164A3C25E803E3A31B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BdaSup.pdb
hal
KfReleaseSpinLock
KfAcquireSpinLock
ntoskrnl.exe
ExFreePool
KeInitializeSpinLock
KeTickCount
ExAllocatePoolWithTag
memmove
ks.sys
KsGetParent
KsAddItemToObjectBag
KsRemoveItemFromObjectBag
KsFreeObjectCreateItemsByContext
_KsEdit
KsCreateFilterFactory
KsMergeAutomationTables
KsFilterFactoryUpdateCacheData
KsGetFilterFromIrp
KsPinGetParentFilter
KsFilterAddTopologyConnections
KsGetPinFromIrp
KsFilterCreatePinFactory
BdaCheckChanges
BdaCommitChanges
BdaCreateFilterFactory
BdaCreateFilterFactoryEx
BdaCreatePin
BdaCreateTopology
BdaDeletePin
BdaFilterFactoryUpdateCacheData
BdaGetChangeState
BdaInitFilter
BdaMethodCreatePin
BdaMethodCreateTopology
BdaMethodDeletePin
BdaPropertyGetControllingPinId
BdaPropertyGetPinControl
BdaPropertyNodeDescriptors
BdaPropertyNodeEvents
BdaPropertyNodeMethods
BdaPropertyNodeProperties
BdaPropertyNodeTypes
BdaPropertyPinTypes
BdaPropertyTemplateConnections
BdaStartChanges
BdaUninitFilter
BdaValidateNodeProperty
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256B
Virtual Size
210B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
896B
Virtual Size
834B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGECONS
Size
768B
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
768B
Virtual Size
674B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
278B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
ccdecode.inf
- SHA256 01a55e7e46078b922d5acadf0dd523bf8dc0b5d911be9ec57d890f37c27ca1d0
- MD5 72be12ea26bf6649482166af3fdd0cc6
- SHA1 31ae26d3ecd44391bc93ff5ddce1d1b0f597d60e
- SHA512 0476540cf9d54be6dddf961151cdd90b85b0893a3e373aa56cab3b1bb9c238446228faeb02deff98999ad2c0432101e9b659a7781d827585d2ef3395440e81ec
- TLSH T194716679CD0F91326386E12E7BD21EC2EA095CF2856A0510F55D860427BAD8C531FDDE
- MD5 SHA1 SHA512 TLSH
ccdecode.sys
- IMPHASH d5977c633dbdac9c68f7e446e09a0a9d
- SHA256 7c38d16644c0e1ae93c4cb5222226b59c94b847033db0e69186467471062dff9
- MD5 1478e6a09512235b9e119d2920477021
- SHA1 6ee21c7cc6c007e317cdd5c3562219d1ec23230e
- SHA512 e7beb36d455aa9af5e3feab6bb9d0b631efb4cf90d47c53cc14ff1b447c101f824b7e33fc7bc1c1058fa6e46a37cbe18410b7bbabfa26d9a9b9df8ff648b00d5
- SSDEEP 384:/bFWZsvzcfhWGR6/xPoH6ZhhiW75XBn2VvnEsg2WIIW:/x+sgDjW975XoJEpg
- TLSH T198721B84B3C04DB1EC471CB1446B770927B3EB121B2693E75110EDAA7C2B6D0AD7D6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ccdecode.pdb
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
KeInitializeSpinLock
ExFreePool
KeInitializeEvent
ExAllocatePoolWithTag
KeTickCount
KefAcquireSpinLockAtDpcLevel
hal
ExAcquireFastMutex
KeQueryPerformanceCounter
ExReleaseFastMutex
KfReleaseSpinLock
KfAcquireSpinLock
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
640B
Virtual Size
554B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=2, id=64, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
dx9bda.cat
- SHA256 14f0ecaa25320bc1d3a717b16d09cb957f93618b581b57b3c93634955a4f8e70
- MD5 c688dd507686c4d40b9068e08177fc86
- SHA1 de4cf806ead56f36b3b04268968030611e9b3a3a
- SHA512 018be6efd5a1144238ebfd5a0f2bdbca762ef2121023071232ffafd757a8d6698d739dc409a262e15a0634ff96299638d959982d6cce3d23189825f4cacd9e7b
- SSDEEP 192:bMOBi/814ip9AJ+CejiwgrqNhdJf8Zn2Gw+N+nJc51NZIn3b4Jw501Nq6aErlnkL:6+gerk5n11wkLhe1OHrDS7J
- TLSH T1F182F05B09AC41635119D9B1CFF9EC8FB432E6B6A8125D3E105373D44683BA2738F92D
- MD5 SHA1 SHA512 SSDEEP TLSH
dxbda.inf
- SHA256 ced775d3dfef4ea699a5569cb0b62b036188ce8bb44705bb56afe31e15af3a2f
- MD5 2d4646b7b32230944e5517963d4a0527
- SHA1 cdc607dc34d13925407088bff1a526b51f844fbc
- SHA512 5177e9ed6bf1bd2b2f4ad8bf1c04fcfcba2541e4307a36a9493d4461cd4ef6561c2ca54810b385b11f359352b030ffc7e93b0c768c3ccf4d1f1f3db6305c2919
- SSDEEP 192:72+PXOFcssVHSVyVdwaVEegWa7za0myx02Dj2v6HJod+Qg:K+PXD4myxVPq6pod+p
- TLSH T195D1B8444723D20BA9D8203C05A35FC7D6220079627AC85A75EAC9CCDF5DC2E7B776BA
- MD5 SHA1 SHA512 SSDEEP TLSH
ipsink.ax
- IMPHASH 628f6874f78df4a7257166f9144f8a03
- SHA256 2cb2c9a8dc6901528a757ae5f1908c2f189d449e9eedc2085a3e7f1c730dc804
- MD5 9ec3f1b9a34e3ac4bffa6f99df0430dd
- SHA1 a771d3248763873069c97f114bff602f43d53779
- SHA512 e4efebe730cf377b6c1315dd5c665c4a45812cef2ba0da4dd4d5dfb4f1d9346fb66bed25cf3976d474cbe3d52f6b1b22469f7e2e9c615abc0a6e525638eb1abc
- SSDEEP 384:ZfUMIj91qKGSSjPCm/Yrm6gTu53xkaFWA6W:Z83Z1vvSjqKYng+xkaJ
- TLSH T1F5623C1273D19453D4A383361AF92E6777FDEB24A6399E03C6041A4F3A79983E1B470B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9717
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
ReleaseMutex
WaitForSingleObject
GetVersionExA
ResetEvent
WaitForMultipleObjects
CreateThread
CreateMutexA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
SetEvent
GetModuleHandleA
TerminateProcess
GetCurrentProcess
WaitForSingleObjectEx
CreateEventA
GetLastError
Sleep
IsBadReadPtr
IsBadWritePtr
GetProcAddress
MultiByteToWideChar
GetModuleFileNameA
lstrlenA
lstrlenW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
msvcrt
free
_snprintf
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
rand
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
user32
wsprintfW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
CoFreeUnusedLibraries
StringFromGUID2
CoTaskMemAlloc
oleaut32
SysFreeString
SysStringLen
SysAllocStringLen
ksproxy.ax
KsSynchronousDeviceControl
iphlpapi
GetUniDirectionalAdapterInfo
GetIpAddrTable
wsock32
closesocket
bind
setsockopt
htons
WSAStartup
ioctlsocket
ws2_32
WSASocketA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=19, id=25, version=9210,
count=99, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
kstvtune.ax
- IMPHASH ea59e0fa6299a58362f0aeae0af3aa43
- SHA256 6f9fdf51a16d8a14b2d1194d336f53cb293f9010a4cb632e627e874e3769b754
- MD5 f5a59e8905fc16a74d9e21cfe06fedd7
- SHA1 193653935bbd202dad0a75ffa57aea48c0e6907c
- SHA512 21ed1450323422a0edd3c1f9981cd508f2fa10580a7a293f9435c5b58f27d007808ec158dc42d3049e1f1d0f703e3f6c74de24cd9b33c3259f4635bf7b84ef73
- SSDEEP 6144:A/ArOLmLDuB7v9iixiiiCaaii66mizDDDDDDDDDDDDDDDDkkkkkkkkkkkkkkkkkY:XGmLDE9iixiiiCaaii66mizDDDDDDDD5
- TLSH T16744081093E24131FB739B7C27729F92E779F80867FB41C625487666ADA1240AC36F71
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
29135
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadResource
FindResourceW
GetLastError
SizeofResource
InterlockedCompareExchange
Sleep
CreateFileW
InterlockedExchange
GetProfileIntW
lstrcpyW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LockResource
CreateMutexW
WaitForSingleObject
ReleaseMutex
CloseHandle
IsBadWritePtr
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrcmpW
lstrlenW
lstrcpynW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
InitializeCriticalSection
msvcrt
_purecall
??2@YAPAXI@Z
wcstol
??3@YAXPAX@Z
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
user32
GetWindowRect
GetDesktopWindow
MoveWindow
CreateDialogParamW
wsprintfW
KillTimer
MessageBoxW
LoadStringW
CheckRadioButton
SetDlgItemTextW
SetDlgItemInt
DefWindowProcW
DestroyWindow
ShowWindow
InvalidateRect
SendMessageW
GetDlgItem
SetWindowLongW
GetWindowLongW
GetAsyncKeyState
UpdateWindow
PostMessageW
SetTimer
EnableWindow
SetWindowTextW
GetDlgItemInt
comctl32
ord17
ole32
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoFreeUnusedLibraries
oleaut32
VariantInit
VariantClear
ksproxy.ax
KsSynchronousDeviceControl
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=15, id=25, version=9210,
count=115, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
kswdmcap.ax
- IMPHASH a4d2e6643818292a0d8fef1ab511db26
- SHA256 432b3032901140f654cecb6a6617c166fd78db658fa4317833868f5b03338e9b
- MD5 63087b5d39cedafaef62f9a885f4be6b
- SHA1 4d18896b121bd994a1f83cece2b1560c3d8fb98e
- SHA512 c0cfe5ea9d1b1515fd0ee6a745d74da1208cb0c1bb97eb0e2721221db8eea28dbbaf53aff231a687cd38707ab770ba1a278a066d51d03f614fe5fc8c11bedf86
- SSDEEP 3072:tnkB8Em3HerCa0Nt3fHfBExZRkdhx9JsP438ZHbdEcGnnwM4fjqhi9T+za:qB8EmEKhExZCdhx
- TLSH T15F244E0053F5C515F0B70A745DB69BD26E2A7CA66830C90FBEAD624F2870E04DD3AB76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
52638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WaitForSingleObjectEx
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
WaitForMultipleObjects
VirtualFree
VirtualAlloc
SetLastError
CreateThread
InitializeCriticalSection
ExitThread
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
lstrlenW
GetCurrentProcess
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetModuleFileNameA
Sleep
lstrcmpW
lstrcpyW
lstrcpynW
CreateEventW
GetLastError
DeviceIoControl
GetOverlappedResult
lstrlenA
MultiByteToWideChar
GetVersionExW
TerminateProcess
CloseHandle
mfc42
ord823
ord825
msvcrt
swprintf
_purecall
_ftol
__CxxFrameHandler
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
sprintf
_wtoi
wcstod
advapi32
RegSetValueExW
RegCreateKeyW
RegSetValueW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
user32
SetTimer
KillTimer
wsprintfW
LoadImageW
ShowWindow
SetDlgItemTextW
SetWindowTextA
GetWindowTextA
GetWindowLongW
SetWindowLongW
CreateDialogParamW
MoveWindow
InvalidateRect
DestroyWindow
LoadStringW
GetWindowRect
GetDesktopWindow
EnableWindow
SetDlgItemInt
MessageBoxW
IsWindowEnabled
GetDlgItemInt
SetRect
IsRectEmpty
SendMessageW
GetWindowTextW
GetDlgItem
SetWindowTextW
comctl32
InitCommonControlsEx
ole32
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FilterHandleFromPin
PerformDataIntersection
PinFactoryIDFromPin
RedundantKsGetMultiplePinFactoryItems
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=2, id=4, version=8450,
count=1, id=11, version=8012,
count=13, id=25, version=9210,
count=123, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=34, id=29, version=9178,
count=1, id=61, version=9210,
ksxbar.ax
- IMPHASH 86f7b1489e2283642a94ef3ffa08593e
- SHA256 e3d6d38cbdf5f6449c9080e4ad9e12dfdae3239cafa7c6569b880b93447d7132
- MD5 7c9cff0fbd4ac215f41cc5014f1da304
- SHA1 9f14c465a87b2ee8940c87a15827f49b0d892bb1
- SHA512 4a652cc0ba534060522b1cdcd4b2796b796a63608353281a3029782c28d56447c5e074c2a93fee6aacd930281c48a9e3719a5b09402e686e437e9b63ff00a725
- SSDEEP 768:AoGUTKN7+j3JyR9EEw4PbAWgvnK66ZBgM7laOM:AoGJ7CZbEw0bAHYZOSlB
- TLSH T167036D6537E28072D3B3E2378E2533B976F6FA14167CE43A078465892E7058AE5B9307
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
23720
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrcpynW
CloseHandle
WaitForSingleObject
GetLastError
DeviceIoControl
CreateEventW
IsBadWritePtr
CreateFileW
lstrcpyW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
lstrcmpW
lstrlenW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
msvcrt
swprintf
??2@YAPAXI@Z
wcslen
_purecall
??3@YAXPAX@Z
user32
LoadStringW
GetWindowRect
GetDesktopWindow
MessageBoxW
SetRect
SetDlgItemTextW
SendMessageW
GetDlgItem
CheckRadioButton
EnableWindow
DestroyWindow
ShowWindow
InvalidateRect
MoveWindow
CreateDialogParamW
SetWindowLongW
GetWindowLongW
wsprintfW
ole32
CoFreeUnusedLibraries
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
oleaut32
VariantInit
VariantClear
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=92, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
mpe.inf
- SHA256 162c1dd3539436eaaadbb008e3cd275369cdfb51382a04bf8889d9f2a9f0e10c
- MD5 d866dd33fe0269cec6d201c35be34750
- SHA1 4655d7a2e8ccc9b46b0c8ccd6fc5ffc6897cea1b
- SHA512 ef076e9b9a1e8e945f3889f3e8125381de2103c6e6f8ab4635dc9c4327a7bdf49acb4eb2020863c734a11b7eee0817108f181f7297440973d09ee62bba2d96da
- TLSH T12361A56C8C4384B38356E36A5BCB1EC3EB165097C6660508316D4703A79AD1EF31E8EE
- MD5 SHA1 SHA512 TLSH
mpe.sys
- IMPHASH b709125e5196d69f577afdd8423729ff
- SHA256 5e496781069a5bd99debc3ca07e0db03aaf7a377f6cc878fb06d4130d53acc09
- MD5 83eff7b976ae24f1a496ca94a8a19919
- SHA1 b15cea5264d59e659f1b39e7bd0d790a75458a41
- SHA512 d8fe806cf026dfbfb2da2f41f78116755067ac0a7330e9367cf43ca383ea512247dc1ca49060889bd2e92e3309ea0e326e48f31de1595da50062568675650d9c
- SSDEEP 384:IbqWaXa0dcTMWOsH380tdA+RbCWhlrwWv:IbqWaaqWOsH3ttdAuD
- TLSH T10E629448E79D45B3ED5AA5BCE3C30F94EDFB541542234BC98BA966042D117C3DC28BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpe.pdb
ntoskrnl.exe
KeTickCount
KeQuerySystemTime
KeInitializeSpinLock
ExAllocatePoolWithTag
ExFreePool
KeBugCheckEx
DbgPrint
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassStreamNotification
StreamClassDeviceNotification
StreamClassRegisterAdapter
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
640B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
640B
Virtual Size
630B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=5, id=28, version=9178,
count=1, id=61, version=9210,
msdv.sys
- IMPHASH e105f7c92aa2bef9bddfa3b3765e6022
- SHA256 f47115756bbae0c89074e6f7d561a7b8cf38fec6334ed686a69ba239ef8805ca
- MD5 18f91db630124c26f147fd41ea68394e
- SHA1 81694fb3a1d4f4446bad3af2292b25802f1389a5
- SHA512 7f19b55f696ff32e3ea57953b455bfd0f236138aba93bcccaf24bc62fd3a2bc8b7af0b8180cfb96adfdc2c7b47f6ef35ff37013fe38d3ba6cdb4daf1e04584ba
- SSDEEP 1536:f0k/kmjYyXtmWOnHs7F6LvWL6CihvxDi:f/kmjYutpOUF6LvnvJ
- TLSH T125435C0173508836C46F83B08D5FB375A2B3B9661A2AA65B7F006B683F74550FF28663
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
53376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msdv.pdb
ntoskrnl.exe
IoFreeIrp
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
ExAllocatePoolWithTag
IoAllocateIrp
KeInitializeMutex
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoFreeMdl
KeReleaseMutex
ExFreePool
KeSetEvent
KeClearEvent
KeInitializeSpinLock
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
MmMapLockedPagesSpecifyCache
InterlockedDecrement
InterlockedIncrement
KeResetEvent
wcscpy
KeTickCount
KeBugCheckEx
KeDelayExecutionThread
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
KeGetCurrentIrql
stream.sys
StreamClassStreamNotification
StreamClassDeviceNotification
StreamClassGetNextEvent
StreamClassQueryMasterClockSync
StreamClassRegisterAdapter
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=4, id=64, version=9210,
count=1, id=69, version=9111,
count=10, id=28, version=9178,
count=1, id=61, version=9210,
msyuv.dll
- IMPHASH 317bb2a83416a509406d650a33ce001a
- SHA256 34bf7e2c8072f7f74cd8f96ec6dcaf0cc1a2266752f28a01bfc3247ffd6dcab6
- MD5 bf66ae458e457e425e7fbb0769ea0f39
- SHA1 d98f187d9dd127107d93baa0bf9c384e984d0120
- SHA512 0d340c11efd75a1ef030d0343ee3e4fe7949d25a6f85cc6a0e207da2b092bc5e6ae8ce97c5441083971044c1d5845438bafe05f2d71e12918ed40c5e5c23da4f
- SSDEEP 192:8olj0Y6wnT1v08JzPLPdoKo9yTYlAU1Wo+Ijuo+Ijpo+Ij2JIGC7qIGC7tIGC7ET:8oV6gtzLL1jWyTYlAsDTZI1WactW
- TLSH T1517283827FAB1D52C0D1093548A7C63B53BE9F7052F7469A4F2515AEF820A61C63BF13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12804
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
VirtualFree
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
LocalFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalAlloc
msvcrt
_ftol
wcscpy
gdi32
GetSystemPaletteEntries
user32
GetDesktopWindow
MessageBoxW
ReleaseDC
GetDC
winmm
DefDriverProc
GetDriverModuleHandle
DriverProc
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=64, version=9210,
count=11, id=25, version=9210,
count=23, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
nabtsfec.inf
- SHA256 eee3641785da56dd4646a4dc5aeb5827828a3218bd5635491da1ec70608ac604
- MD5 187630b45b902dfa52d13f11c69d36e2
- SHA1 5c2ca522286b99f8859f6c719d15468c89644a92
- SHA512 2fc8220fe6bcdb99a874e3f80937f30aa1b7f733e7148a079a7db075b37005f5c862909d87f69dbfe940489f69456f4d3669cf063f482fce47a0b83c95be24b4
- SSDEEP 48:xbcXc68yEhpOD8HK7k38O770g3kc4CqldXcZZx8+wu5S70xjUCdgn9WK13EdbsP2:t00pIfxcZZLiCApt1UhsP2
- TLSH T19E818419CE1B803663E9D11E5BD73E83DB2A30F28D6640C0379C5A08278798C932EDDE
- MD5 SHA1 SHA512 SSDEEP TLSH
nabtsfec.sys
- IMPHASH 49970d1ef884a17567a446f9fea4d52c
- SHA256 5392c3c7129b4d7a16ed3d44cb33092f0faf92441b6181c0b042e2c07ad04d10
- MD5 bb1c45d114b6dab0babf6b2fb0336db2
- SHA1 0d7797a8e4f086cbf2cfc069ac69fd9d35316692
- SHA512 16ef512d2a4b41379dcf31a8039782674c6e3db4c286e5fb166e400b360f6035eebde6b852fd14fa08879a122cef282537dee7ae52e1eea959937794d11e1dd7
- SSDEEP 768:71Q7ZoFgMU7KbBPYTDjujwIhkHZHVMV+mpY3jl6myuq2CeaGSOKWi+6mywyRE4Fu:JQ7kgMUiSTDjG9kcDFO3Us
- TLSH T1A5836B00E782BB7BF4EB50F6916B764E11B49F110B4982CB6AD87C46AF385D16F32153
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
37401
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
nabtsfec.pdb
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
KeInitializeSpinLock
KefAcquireSpinLockAtDpcLevel
ExFreePool
ObfDereferenceObject
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
RtlInitUnicodeString
ExAllocatePoolWithTag
KeRestoreFloatingPointState
KeSaveFloatingPointState
KeTickCount
KeBugCheckEx
KeInitializeEvent
hal
KfReleaseSpinLock
KfAcquireSpinLock
ExReleaseFastMutex
KeQueryPerformanceCounter
ExAcquireFastMutex
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
1006B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
896B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=2, id=64, version=9210,
count=1, id=69, version=9111,
count=11, id=28, version=9178,
count=1, id=61, version=9210,
ndisip.inf
- SHA256 6239cda249f35baa9ba1848ebe3df414afa27be38fb8fee79fcdd8dd00dbf907
- MD5 3675a3e175c1b4a9a0397d80b6cdfafb
- SHA1 5eb1d87943f40a205c9b1a65b880417d1c5ff8aa
- SHA512 7ce64105634e7dcb4250a972bf303f4474622ccc61ef07e1742daee8e32ebaff6991bce31c68d782b8f0b31b9c069755548dfd80ac6e4a5c63adcd7484d74299
- SSDEEP 96:4VNZ3J6Ep5c2cQHSsK1GMDSsKv/edvZ0EL6OjkiDk9ozMZ/XydUWb:EH3oEI27SsWtDSssedhTLFYig9ov
- TLSH T160D12E194F42AE352BCBD1799B030F43DA36029B891A154435AD5BC02B7F68E632DE8D
- MD5 SHA1 SHA512 SSDEEP TLSH
ndisip.sys
- IMPHASH 85b9203fdd9c0bd977642878e7918927
- SHA256 e880da5ddd381abed5bf2c3b8cb387842301b52ebf29173383d618f5961f36f7
- MD5 abd7629cf2796250f315c1dd0b6cf7a0
- SHA1 9baaba6e47ec06871d944f19961ca3cc8132c782
- SHA512 a68483ac251df13566e48f202e9a6d305a90fbe69408aae232d4ebd399d53ed077de97ccc3c005f107dc560ee9bf6d4b070562761101d08858700865dee6aef2
- SSDEEP 192:++BarPS1JL8yvpeA1SbVMsflIGywVVXXPWgZFW:RBOyJ8yvpgVMsflIQ/WgZFW
- TLSH T15522F90273D41B3FF0930FF559B317AAD527B9157F65624E021314CEAD39AC5AA38623
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ndisip.pdb
ntoskrnl.exe
KeBugCheckEx
KeTickCount
KeInitializeSpinLock
IoFreeMdl
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
DbgPrint
ZwSetValueKey
ZwClose
RtlInitUnicodeString
IofCompleteRequest
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisAllocateMemory
NdisFreeMemory
NdisAllocatePacket
NdisAllocateBufferPool
NdisMSetAttributesEx
NdisAllocateBuffer
NdisFreeBufferPool
NdisFreePacketPool
NdisInitializeWrapper
NdisMRegisterMiniport
NdisAllocateSpinLock
NdisAllocatePacketPool
NdisReleaseSpinLock
NdisMDeregisterDevice
NdisAcquireSpinLock
NdisFreePacket
NdisMRegisterDevice
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
331B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
384B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
896B
Virtual Size
890B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
358B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
psisdecd.dll
- IMPHASH 030f2fd88c6befc4cc612bcee23289da
- SHA256 5108a9179e2b042eac111d926431e8fe37562c9f4422861ca3120b506b409b98
- MD5 5319bf20f48884e594f84097a600424b
- SHA1 1e4014a1df18c5c743e5567d768f8e37a97f9f09
- SHA512 a4a3b3127d5fb69fe1ba581d9051ae8d1d1626c38486abf1bc0e3b697e10f73127c97c7913cf6640ce6b937703cd18c600a021be5b1dc84fed078d4eba9cb4ee
- SSDEEP 6144:zAOuiRizjJTRcHV+oGC+1dnLSCkFUnru89Fos5FkYAloEcXnEUjz/ZnC5W:zU+VO1dnLSk6kqs5qYAlDcXnEUjz/ZnT
- TLSH T1C1748D107FF6C136C7A56175CA7B6BEAF778D7054D600A670B0C162C6F38A82E162B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
248728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpiW
lstrcpynW
HeapDestroy
lstrcatW
GetModuleFileNameW
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
LoadLibraryW
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
GetShortPathNameW
LockResource
lstrcpyW
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
FlushFileBuffers
lstrlenW
MultiByteToWideChar
Sleep
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
LeaveCriticalSection
GetModuleHandleW
EnterCriticalSection
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetCPInfo
GetOEMCP
WideCharToMultiByte
LocalFree
InterlockedExchange
TlsSetValue
GetCommandLineA
GetVersionExA
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
ExitProcess
TlsFree
SetLastError
TlsGetValue
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
HeapSize
SetUnhandledExceptionFilter
GetACP
ntdll
RtlUnwind
winmm
timeGetTime
advapi32
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
user32
CharNextW
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoCreateFreeThreadedMarshaler
oleaut32
SysStringByteLen
SysAllocStringByteLen
RegisterTypeLi
LoadTypeLi
VariantClear
VariantChangeType
VariantCopy
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
300KB
Virtual Size
299KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=26, id=64, version=9210,
count=1, id=11, version=8397,
count=11, id=25, version=9210,
count=137, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=123, id=28, version=9178,
count=56, id=29, version=9178,
count=1, id=61, version=9210,
psisrndr.ax
- IMPHASH b3fabccc88441525f3d8a97e7abf70a5
- SHA256 b0969c106bdd6e4b0ae2c252e9b4792532ca60b19eb04effba9e8adc1c41025f
- MD5 e93d7d262a33d14aef13398ab83fe08b
- SHA1 b7fb62de3c6521c3f71ff3a398cc6b97abe2392c
- SHA512 26db7045c57faba96b96e4dc6da3667122398a4a3517065854c9114ff78cc25ba3116e010f9d45ee2d1de3f4935345a53f5f407a1538eb29f013458baac9c1c7
- SSDEEP 768:F1mgRwKIvRcysV+ngpw1r8aQ4nMxBi7W:WVvRcVVDI8aTnMxg7W
- TLSH T1F1D22B137BE660B1C6A35233C92133A7B2BBEA586539DE154A1819462F32143F1BE74B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetModuleFileNameA
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
lstrlenA
MultiByteToWideChar
LoadLibraryW
FreeLibrary
lstrcmpW
lstrlenW
GetVersionExW
lstrcpynW
msvcrt
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z
advapi32
RegSetValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyW
user32
wsprintfW
ole32
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoFreeUnusedLibraries
CoInitialize
CoTaskMemAlloc
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=77, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=8, id=28, version=9178,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
slip.inf
- SHA256 418040f2b05a196c48fceae77afaa9e58ca87b10269dc084be493db377c82a31
- MD5 a42a3419a484b82e752b850cd13bfdd3
- SHA1 fdb7a19707b7ea6e349c6559152cb5f1c02483e4
- SHA512 eda1f7ead98530284ee850dffae35073f22c3399cb98b6e25dd62d3ec175b4d160d1841ccde5c4261b76bf301feb5417446a30779cf276d778f5c2ba68a4acaa
- TLSH T1757186ACCD0B09636389D1558BE63DC3EF980053C19B0B89306D8A1663C9A9D5E1DDEF
- MD5 SHA1 SHA512 TLSH
slip.sys
- IMPHASH 3f9db7809b38aa51c5daad51c58fe7a9
- SHA256 a1d24658b8e0610b5651aec36ecc4be1a2a8faa0a7f2164bf19ecb816298bd9d
- MD5 92723fbdd30771c293fe5ed266a31ca6
- SHA1 b2e1b9822e9113ec0cb2c7e44e8826d47941d388
- SHA512 2b563c98fc93db76ba2d1f05ba84121c2836f1c4e9a501460a17d46138449c95293f18345ce96838141a4618a83e6dca4d16947e5a09900b51e1c1995680c342
- SSDEEP 192:i0pCqlIwfHkLPhw22AsALyp2rn4kY0FUjZVx4TWxzyWE:iGZImHkLPhw2H5x4krFUjZAWxzyW
- TLSH T12A224A1137E40F75F0D74BB1AE9B272A8677D81C9A11E37E02A53D991D3CD00BA2C7A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
slip.pdb
ntoskrnl.exe
KeTickCount
ExFreePool
ExAllocatePoolWithTag
DbgBreakPoint
KeQuerySystemTime
KeInitializeSpinLock
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassStreamNotification
StreamClassDeviceNotification
StreamClassRegisterAdapter
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
262B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
206B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
streamip.inf
- SHA256 1e06c2c3eeb9cfd1938b73e70cb3b841b1da89b97ab6acadde5c136e0b336bf6
- MD5 885e850809bc928ee802f13e28449efd
- SHA1 39f8ff6d6cfc300b61e6a52f647b05382c4b365b
- SHA512 1b660a1eb54b6e1bce2902a260ae95def2eec32af8c06a666138456ad85f5299d9286d588f90fa9c4d938ccee06960d19c2a3ecbed539e41811e89533526c6e8
- SSDEEP 96:d0KuUqnZK8hQ+B8ljiFjZMaH1XNgaAgaPRIWKTAidudNjKJ:d0K4Yt+SljiFjSyGyVIKJ
- TLSH T141C173494D2B5473937FF23D9B870F92E6257813D18F414830BCCA161B9AD58922EF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
streamip.sys
- IMPHASH 937c5c9480c457813996610d24c3ca2e
- SHA256 34bce982e9d6dacec51f2c19bd5ac7ddc0fdc876eb4f910a1d667d3448d8f1d6
- MD5 4544fd0db39cb7b385a5392c068162cd
- SHA1 00a5b9b4a950bf52b02b9bed6a2e5bca0bd80746
- SHA512 c46495efb0d4ae1981630a72e93b893c1a0ec3977064b75ea5f1112fd9a51fc90201ea01107dd0cc6bec95b18856435be5c8691ad5669aae8e41ad8585711e1e
- SSDEEP 384:qBjX9oOlN5wQVEI7yjrDuL43KJpQVPk7cOe8NHiooytMWg1RW:2jX9oe5BVESSS46JsMcC9ioo0W
- TLSH T17262088DE3D50572F52F01B886829752E9BFDD056E1A82FA87FC8FE12C82552F4247E1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
streamip.pdb
ntoskrnl.exe
IoGetDeviceObjectPointer
ZwCreateFile
IoGetDeviceInterfaces
ObfReferenceObject
IoBuildDeviceIoControlRequest
KeTickCount
ZwClose
ObfDereferenceObject
KeInitializeSpinLock
RtlInitUnicodeString
DbgPrint
ExFreePool
IofCallDriver
ExAllocatePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassDeviceNotification
StreamClassGetNextEvent
StreamClassStreamNotification
StreamClassRegisterAdapter
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
647B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
640B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
768B
Virtual Size
674B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
640B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
vbisurf.ax
- IMPHASH 4ea881e9bc4888403a5e8628308bf315
- SHA256 3694636dd9a32923d5f7acfa84c53127ec6fa8d56b759e3ece41b204d251931c
- MD5 1c4496b1780be155c2d8d1b260118959
- SHA1 f5e4067171143c98de66efbf66bae07a5fa901f9
- SHA512 7edcc92e99b4f280fc2639aa91db233275a8fec4673acf5f80d682e5fdf3a0c05076c5be44179ff08df73b08e1e55e654f05a4d299defef03036f60ac5496399
- SSDEEP 384:if/mN0LqTy/FaX3Jq3en7CblOY5vgTRsceQ/L9ePFE0tpBL3x8KBW1jWVzG:iHEkn4HI3E7CJngvj/w1xVgoG
- TLSH T14CC25C12FBDB807ED6A355325F793FAAE2B2E7441A7C9C120B1059453A21183F2FA357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetModuleHandleW
GetTickCount
InterlockedExchange
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
SetErrorMode
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
lstrcmpW
CreateThread
ResetEvent
SetEvent
CreateEventW
InterlockedDecrement
InterlockedIncrement
lstrcpynW
GetModuleFileNameA
GetLastError
lstrlenA
MultiByteToWideChar
GetVersionExW
lstrlenW
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
ddraw
DirectDrawCreateEx
DirectDrawEnumerateExA
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
user32
wsprintfW
ole32
CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=78, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
wst_czec.fon
- SHA256 29549f4d2e29b73200087e0484b31ca87dfa0cb22c7a1cfe1258d0750eb44027
- MD5 554df997c4b3cd9c7ab9b4da17f1b9cb
- SHA1 a321c7c1355e62d1bbb18512b93ec9399b415011
- SHA512 40c7909fc84699a1ae971a0de87c5f47fb5dd2eddb012ff1f866faaf0b0a03f4595ad983210a2970da6c832709f6b8cc1b5d6271038e875074954962cb5308f4
- SSDEEP 192:q3IojXHKiSpP/vH3f/3f68lrg83nXn3nX:q3IorypP/vH3f/3fprj3nXn3nX
- TLSH T11582F0455CBF7EE1C49409389E4B9B2448B06E82B852CD92DB712EADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_engl.fon
- SHA256 7ab2b68a88ac69c806df7bb5a1fb4220777233f80501afe64766b84b22d0a8dd
- MD5 5a414bcd0da476df205db8941fd095fc
- SHA1 d62e9dfafeb1b6d74b5d9aca9e1e1c9232068dd0
- SHA512 13fd2b56b72302dfcff291927c1372eab267af07b730dd55f159688d34bc548cbb8e7a4580752c22b3e8c5ca144a1f16ff563bf5bcd0416ce3ff08240fcfe8e0
- SSDEEP 192:qPIojXHjyCyP/vH3f/3fn8lDIg3nXn3nX:qPIor+CyP/vH3f/3fMD/3nXn3nX
- TLSH T1568214455CBF6EE2D49409388E4B9B2448B06E82B852CD92DF712DADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_fren.fon
- SHA256 be473acc9c748899f906901dcc35adfb00f36d9d923052d991fa3f9042d7b3bf
- MD5 f48eabb60de7a2d478c3e720337052f1
- SHA1 11685c48a30b1da1b4679685fac1a616ff566891
- SHA512 1b7b3aa5a516a8e159a3ef056d144a771082bfd286da63c8bc644592652515daba9c5dd9b4d4989b5176d51cd1ce18824762576f3dc9bbaaa6f00be9c543ef21
- SSDEEP 192:45IojXHZvlXP/vH3f/3f88lX4a3nXn3nX:45Ior5lXP/vH3f/3fTXd3nXn3nX
- TLSH T11B82F0451CBF6EE1C49409388E4B9B2448B06E82B812CD92DF716EADEDF7350E297C5C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_germ.fon
- SHA256 78002bc6f1780107f545ff8f9346478add8cc1907f620dec6fc780bde1e38c8c
- MD5 96ab323e35f83a7f6cd47f3890906cae
- SHA1 a2228a7d236c831e2a0827dd78bfc4ffc1515e90
- SHA512 76dbffe05f17c43387005aca1bdc767a7ce830e7c46d3a824bc00997cee3da6a53fd102d017f99bf075a22f9bc319332d594e11f0d9eb6bc481f2326d68fef72
- SSDEEP 192:ByIojXHOjNP/vH3f/3fu8lH2/m3nXn3nX:ByIor4NP/vH3f/3fNHD3nXn3nX
- TLSH T19782E0452CBF7DA1D49409389E4B9B2448B06E82B852CD92DF712EADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_ital.fon
- SHA256 a866dfd73415a75025625941c462d76e46ce980259eb0eefc8c4fb109e060c64
- MD5 8faee3b19e9c365e383194b34b05de85
- SHA1 8bf5d4687b1e5575c91eca0f0193971693889b4d
- SHA512 162d27b32a4d7119eea673da80692a78c9a7cf00f17c1edfd6260ddeb378c69d98a633b817c3e4ef1a83a412d6fc0e56276de21bf792d89849bbaae544ab5d33
- SSDEEP 192:NuIojXHITKnP/vH3f/3fz8lDSE3nXn3nX:NuIorYKnP/vH3f/3foDV3nXn3nX
- TLSH T10C8202455CBF7EE1C49409388A4B9B2448B06E82B852CD92DF716EADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_span.fon
- SHA256 d41768876a1ab65191001a2988f2e61bb44fb35b9ea8fa94d169893a3dab77e6
- MD5 8d16c368d2e9dd5b0cb21ca6fe5820f5
- SHA1 fdaf1425128d7095a3b2ef98f0367293bacbf400
- SHA512 8f4a5529aa7dacb447610df0b6d0d1027e07c9d946c4120a9a23ad7c9754ab1f135d1940fadc30aabf35617b74164261ec0a48cd363043597f9e547801aeaf43
- SSDEEP 192:vIIojXH7vkEP/vH3f/3fn8ljMO3nXn3nX:vIIor7sEP/vH3f/3fMj93nXn3nX
- TLSH T14182F0452CBF7EA1C49409389E4B9B2448706E82B852CD92DF716EADEDF7350E287C5C
- MD5 SHA1 SHA512 SSDEEP TLSH
wst_swed.fon
- SHA256 adf1915b3faa31a5d0826d90f464bda32216b5ead9b5c6bd871df401c82a7c60
- MD5 3d37c5768207c09dfaf20fb876a121d5
- SHA1 f776e69aa0365ae692f6b16640a6aa6012fb6364
- SHA512 9f6813b4d12b8c95794c232867c6164240a696091b4488af5e2f5d4657faca1394909b18f21c1c27326a150e0d2a883872664a7cf85f617be29c2c99b52d87a7
- SSDEEP 192:+BBLIojXHBmkP/vH3f/3f48l/A+3nXn3nX:+bLIorUkP/vH3f/3fv/Z3nXn3nX
- TLSH T19E82EF455CBF7EA1C49409389E4B9B2448B06E82B852CD92DF712EADEDF7350E297C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
wstcodec.inf
- SHA256 6edd2203dd2fae09442e9afec57738ebc37364d27c84d76bed633e122ca33313
- MD5 d0ba27ccb5958090755e939a01ce8cd4
- SHA1 7e9ec073086dda1d6bad3f572e041cd482877fc6
- SHA512 583d43a959af8ca13d0a215143ddec8c78d0e079c06707dd23a093dcf0bf7039b60a802539c364db769ebe065a3f805d86fb3bae0a0f1b453325a0635e1a52cc
- TLSH T1857123CD8D0B87BF7344D11E7A522E82EB1971F281CE0A043D9D7E143796DC8621E89E
- MD5 SHA1 SHA512 TLSH
wstcodec.sys
- IMPHASH 5e94d6115bae4fe6e2b87706af1a8293
- SHA256 974d2c905f8093d4d5fb1e6ef46b4a3a4d25d9a93168b7febe8f27f99ddb48be
- MD5 04aca6442e639a794293828e8dda7a44
- SHA1 80bdb74d87ead65887331b38180d5f33c97f50de
- SHA512 93d3b8da80e0801b5e77c876ab398bbd71702154d1c4f331927dc582af12c7ccb393fd781ed205494519278f11146552c1cd7c2701f0e27338f947ac9f00b0f9
- SSDEEP 384:Gs+CEbgqEcQzr9wa8niLXpYs9+vNPHeWQyWoS:R+pnQzxY8kQs
- TLSH T147827EC57BC02DBBE9254B355AFB23145BF7DB191662D3838210ED5C3D26E408DB2A23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wstcodec.pdb
hal
KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter
ntoskrnl.exe
IoCreateSymbolicLink
ExFreePool
KeInitializeSpinLock
KeTickCount
ExAllocatePoolWithTag
RtlInitUnicodeString
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
512B
Virtual Size
484B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=3, id=64, version=9210,
count=1, id=28, version=9178,
count=1, id=69, version=9111,
count=6, id=29, version=9178,
count=1, id=61, version=9210,
wstdecod.dll
- IMPHASH b773ed61e5f2f5b7c57feede58a7f58c
- SHA256 34a4383b471143fa055062ca9484b98c5c3720d359c43abac4753105883b8be6
- MD5 dd7181ceb93b83bb2eff43e615eaecac
- SHA1 c1714ad48ca3b1fcaed2866bd031353a5aa5bc12
- SHA512 8dedc4e1474ec60317e46ca16c4a0e3a074e6868931e9765fb0927f3550efcf7ff7edd45d822c79b7610a0ff485ea2d6462153e4aec14461f06b805d67077e53
- SSDEEP 768:lY8V2X7YU3D90DlqEafnKYmTzTLGvj47cJBzgyUErCGZKLYphRxqh+cK+Lm:l5Vg820DoRfnsnTLGEiB0eDYYjRxQM+
- TLSH T122238EE573D240F3C2E30532AA3533A6B2F6F6181A2955234714760E6BA614ADA3F337
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
27843
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
TerminateProcess
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLastError
FreeLibrary
lstrcmpW
InterlockedDecrement
InterlockedIncrement
lstrcpynW
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
lstrlenW
GetVersionExW
GetModuleHandleA
MulDiv
IsBadReadPtr
IsBadWritePtr
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
msvcrt
free
malloc
??2@YAPAXI@Z
sprintf
sscanf
??3@YAXPAX@Z
gdi32
CreateCompatibleDC
DeleteDC
CreateFontIndirectA
SetBkMode
DeleteObject
CreateDIBSection
SelectObject
SetTextColor
ExtTextOutA
SetBkColor
GetTextMetricsA
GetSystemPaletteEntries
GetDeviceCaps
GetTextColor
user32
GetWindowRect
GetDesktopWindow
DefWindowProcW
InvalidateRect
LoadStringW
SetRect
SetTimer
KillTimer
IsRectEmpty
ReleaseDC
GetDC
UnregisterClassA
SendMessageTimeoutA
DefWindowProcA
ShowWindow
CreateWindowExA
MoveWindow
CreateDialogParamW
SetWindowLongW
GetWindowLongW
wsprintfW
GetWindowTextA
MessageBeep
IsDlgButtonChecked
GetDlgItem
SendMessageA
SetWindowTextA
CheckDlgButton
RegisterClassA
DestroyWindow
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegSetValueW
RegCreateKeyW
RegDeleteKeyW
ole32
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
CoCreateInstance
CoInitialize
CoTaskMemAlloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=129, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=19, id=29, version=9178,
count=1, id=61, version=9210,
MaxPayne 2/DirectX9/BDAXP.cab
- SHA256 a027e84d33b1bcc5d534de2d088d2bbc7d2186347e5f38742b1964133b07b871
- MD5 3d48496dd6669692bc69de5f1694b817
- SHA1 b5e24e7364e4a56f90c1c85427175f44144928ba
- SHA512 5da652fe597ff22f9faa30620f3a5c65de51d36212bed7fd64b718ef788ab6baec3a7d96444fe9e87f7e0c60ff3d6858d63e5a8d78144f4d7cf526c3408db69a
- SSDEEP 24576:VHzOVwrKjBN3pJWtm/D9BzYjhTnAhnghepn9sSPDfxZp3H/S:VTOVwWjRktmbATAZghedTfDp3H/S
- TLSH T1E12533E6D2FF2A50F33600883250D964D6211C94E231327666FE375935C3B9BF7EA998
- MD5 SHA1 SHA512 SSDEEP TLSH
BdaSup.sys
- IMPHASH 6b2b65bafa0dd0cf733b55e44cdea375
- SHA256 62e52129a2207cc610ee4e19312582a367f5a5e5fb8192feae432d2f6f375065
- MD5 61f8f3126d39a7eb2775fb1505469ee3
- SHA1 f5b564502d59cec39d831727d947d447beb29210
- SHA512 ae1c7b7079c08db1b2f78a6e8cd9a617401e33b5d86444cc4affc08b11418049107b54bcc259df9578fabc9863d8548a9a5becdd9e7d77f465d5c5512b8a3056
- SSDEEP 192:KsTUlGuDpAhrnzECZBgb3k5781k4oTSPo9JDg/qIYfWDvtWxU:RUGuDCLhTgLkx8ZoT0ufIYfWDvtWx
- TLSH T18F321A80B6D44F36F5EB4DF0CD8611BE667FA2115875A36E063A164A3C25E903E3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BdaSup.pdb
hal
KfReleaseSpinLock
KfAcquireSpinLock
ntoskrnl.exe
ExFreePool
KeInitializeSpinLock
KeTickCount
ExAllocatePoolWithTag
memmove
ks.sys
KsGetParent
KsAddItemToObjectBag
KsRemoveItemFromObjectBag
KsFreeObjectCreateItemsByContext
_KsEdit
KsCreateFilterFactory
KsMergeAutomationTables
KsFilterFactoryUpdateCacheData
KsGetFilterFromIrp
KsPinGetParentFilter
KsFilterAddTopologyConnections
KsGetPinFromIrp
KsFilterCreatePinFactory
BdaCheckChanges
BdaCommitChanges
BdaCreateFilterFactory
BdaCreateFilterFactoryEx
BdaCreatePin
BdaCreateTopology
BdaDeletePin
BdaFilterFactoryUpdateCacheData
BdaGetChangeState
BdaInitFilter
BdaMethodCreatePin
BdaMethodCreateTopology
BdaMethodDeletePin
BdaPropertyGetControllingPinId
BdaPropertyGetPinControl
BdaPropertyNodeDescriptors
BdaPropertyNodeEvents
BdaPropertyNodeMethods
BdaPropertyNodeProperties
BdaPropertyNodeTypes
BdaPropertyPinTypes
BdaPropertyTemplateConnections
BdaStartChanges
BdaUninitFilter
BdaValidateNodeProperty
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256B
Virtual Size
210B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
896B
Virtual Size
834B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGECONS
Size
768B
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
768B
Virtual Size
674B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
278B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
MSDvbNP.ax
- IMPHASH 8d46331ee3af79cade97e0eb594f6089
- SHA256 bf81f612413b69096874a6834c0286983f5440b0ec411120de28364aa0cb2de7
- MD5 ddb9b5c1ce074274d74b8a7910c97208
- SHA1 593bf280d571733cbfff9b79cbfba043f46de9ce
- SHA512 fabe9ae67a1cd850cd36db58f9834b8fc35e1ad2d06ec5b5587e6dc1bacbcda0038c347721c18696fe215f3b0c0f9221c76a416e75e30b339556f89470dc716d
- SSDEEP 768:UqC9FJqBx8YBYuPWAcsK6fxeC+AqbiJfeg6LFlixhA+tl7WwJ:ULF8n8YBXPWAe6sAqOdv0ixDJ
- TLSH T19733185733F7C17AD2A362B2862AF7D9BAB6D30906159D011B040E0A1F7468BD37DB4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
37440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetEvent
CloseHandle
CreateThread
CreateEventW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
IsBadWritePtr
GetCurrentProcess
lstrcmpW
IsBadReadPtr
GetLastError
ResetEvent
WaitForSingleObject
SleepEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
TerminateProcess
InitializeCriticalSection
lstrcpynW
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
lstrlenW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
msvcrt
wcscmp
??2@YAPAXI@Z
swscanf
memmove
??3@YAXPAX@Z
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
user32
DispatchMessageW
MsgWaitForMultipleObjectsEx
wsprintfW
PeekMessageW
TranslateMessage
ole32
StringFromCLSID
CoInitialize
CoTaskMemAlloc
StringFromGUID2
CoFreeUnusedLibraries
CoTaskMemFree
CoCreateInstance
CoGetMalloc
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=88, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
MSVidCtl.dll
- IMPHASH 0467516a475941daa18bfa5b1573ef90
- SHA256 940689990d3abc736654d4d4a4f3ad3b09e20b9c2e61de3e1bb6231f6d1e1ca2
- MD5 f22f1f4f67597d5da36b9cecbbb9bc6e
- SHA1 995552cfcd548aebdc3f3ed0f08d3395312b53eb
- SHA512 6815328e6f4ad9faefffef2a4e6f9222d154f8fad244421f5261f6a059ec2b705aa3291f904a22e162f04d1c593669d861df8a99d80d7eaef2e9be5bb294d427
- SSDEEP 24576:MhHKWxn2j5IH3LrCI/In2QGIlXaPHO0ayY:nQn2j503LGZn23GK
- TLSH T1C3454B0277F2C134CA6360328E6BEB9863BDEB155F11450727882B4E1FF1F498656FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
676204
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLocaleInfoW
WideCharToMultiByte
GetTickCount
GetDriveTypeW
GetSystemDirectoryW
Sleep
IsValidLocale
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentProcessId
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetLocalTime
GlobalMemoryStatus
GetDiskFreeSpaceA
GetComputerNameA
LocalFree
LocalAlloc
CreateMutexA
VirtualQuery
GetSystemInfo
VirtualProtect
ReadFile
SetStdHandle
LCMapStringW
SetThreadExecutionState
FormatMessageW
IsBadReadPtr
GetOEMCP
GetStringTypeW
GetStringTypeA
GetCPInfo
FlushFileBuffers
SetFilePointer
HeapSize
IsBadWritePtr
VirtualAlloc
SetUnhandledExceptionFilter
WriteFile
VirtualFree
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
ExitProcess
HeapReAlloc
RaiseException
GetVersionExA
GetCommandLineA
TlsSetValue
DelayLoadFailureHook
CreateThread
WaitForMultipleObjects
ResetEvent
SetEvent
CreateMutexW
FindResourceW
LoadResource
LockResource
GetLastError
lstrlenA
MultiByteToWideChar
CloseHandle
ReleaseMutex
WaitForSingleObject
LCMapStringA
CreateEventW
GetModuleHandleW
GetShortPathNameW
lstrcpynW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
lstrlenW
LoadLibraryW
GetProcAddress
DeviceIoControl
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameW
lstrcatW
DeleteCriticalSection
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrcpyW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
IsBadCodePtr
InterlockedExchange
ntdll
RtlUnwind
ole32
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoGetMalloc
CoUninitialize
ProgIDFromCLSID
StringFromCLSID
StringFromGUID2
GetRunningObjectTable
CLSIDFromString
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
HDC_UserSize
HDC_UserMarshal
HDC_UserUnmarshal
HDC_UserFree
HWND_UserSize
HWND_UserMarshal
HWND_UserUnmarshal
HWND_UserFree
CreateItemMoniker
CoCreateFreeThreadedMarshaler
oleaut32
SysFreeString
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysAllocString
LoadTypeLi
RegisterTypeLi
VariantClear
VariantCopy
SysAllocStringByteLen
VarUI4FromStr
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantChangeType
SysStringByteLen
LoadRegTypeLi
SysStringLen
SysAllocStringLen
SetErrorInfo
CreateErrorInfo
VariantInit
OleCreatePictureIndirect
OleCreatePropertyFrame
user32
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
MapWindowPoints
EqualRect
ReleaseDC
GetDC
IsWindow
CopyRect
SystemParametersInfoW
FillRect
SendMessageW
PostMessageW
GetWindowLongW
GetClientRect
SetTimer
KillTimer
GetKeyState
SetCursor
LoadImageW
RegisterClassExW
wsprintfW
LoadCursorW
PtInRect
IntersectRect
GetWindowRect
ReleaseCapture
SetCapture
GetDesktopWindow
DestroyWindow
SetFocus
IsChild
GetFocus
GetParent
ShowWindow
InvalidateRect
DefWindowProcW
SetWindowLongW
CreateWindowExW
BeginPaint
EndPaint
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
CallWindowProcW
CharNextW
GetClassInfoExW
advapi32
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegSetValueW
RegQueryValueW
RegQueryValueExW
RegCreateKeyW
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
GetUserNameA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueW
gdi32
CreateDIBitmap
SelectObject
CreateCompatibleDC
GetDeviceCaps
CreateSolidBrush
DeleteObject
DeleteMetaFile
CloseMetaFile
RestoreDC
SetWindowExtEx
SetWindowOrgEx
SaveDC
CreateMetaFileW
CreateRectRgnIndirect
DeleteDC
rpcrt4
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubCall2
NdrStubForwardingFunction
NdrCStdStubBuffer_Release
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
903KB
Virtual Size
902KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
1024B
Virtual Size
693B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=37, version=8755,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=23, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=8, productName=Unmarked objects (old),
count=3, id=14, version=7299,
count=2, id=96, version=2067,
count=31, id=64, version=9210,
count=1, id=10, version=8397,
count=7, id=11, version=8397,
count=13, id=25, version=9210,
count=298, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=54, id=29, version=9178,
count=163, id=28, version=9178,
count=1, id=61, version=9210,
Mpeg2Data.ax
- IMPHASH fcd4181f9417f53d1b10aa6fcfd706a8
- SHA256 886516c87c44b3f5724aca16e946b122a0527cc3177b3bf42ba1eba788f15b7a
- MD5 c15a32f56e3fe83ad6ab9f0dedcaa9da
- SHA1 53434fe6a7db9304b3f7d5d811f6f8591c268ddc
- SHA512 d789854d9166674d6c835116ff4b03f0a401b6a4df604a5ee24ca31589d42123b4c9f6849d2dbdb02a5047ce681e92483f2926f08915c731d64c73f4bc83ee1b
- SSDEEP 1536:P3dQ9MItf5FvSBB14TULwi2oKixe24dTKlwKwyoxlVBbO8:/sfnqBgoPe5ew1xlVBq
- TLSH T107437D427BD2A0B2C3523173DEB937A6F3BEE6081927DE225B0829455F31643B475B07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33657
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ResetEvent
WaitForMultipleObjects
LocalAlloc
LocalFree
CreateThread
LocalReAlloc
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
CreateEventW
GetThreadPriority
SetThreadPriority
lstrcpynW
lstrcpyW
lstrcmpW
SetEvent
CloseHandle
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
GetModuleFileNameA
GetLastError
lstrlenA
MultiByteToWideChar
lstrlenW
LoadLibraryW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
GetCurrentThread
msvcrt
malloc
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
free
_purecall
winmm
timeBeginPeriod
timeEndPeriod
timeSetEvent
timeKillEvent
advapi32
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
user32
GetQueueStatus
PostThreadMessageW
wsprintfW
MsgWaitForMultipleObjects
PeekMessageW
RegisterWindowMessageW
DispatchMessageW
ole32
CoFreeUnusedLibraries
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
StringFromGUID2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=11, id=25, version=9210,
count=88, id=1, productName=Unmarked objects,
count=4, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
bda.inf
- SHA256 8e12de31f46f9ea64ba2a235cba60c3a00fc8d67ea9cdab0a54b5107e9d83a7e
- MD5 a9906b5145e151b6fcd89abe8d0cfe10
- SHA1 e3ef77ca35166e22fce6a991f670f997dd591ca7
- SHA512 22892195ad285c248f9df5d09b8db2cea1322089498b3eb71c8524df3addd6c64ec110aff9f78b28585cf42e9865230186384acc8666bd95fd12b6aca2dcc71b
- SSDEEP 192:00a9Qh3X9Rsh3dkQ2J5s9Qh3VD9Rsh31flRlXodpxE4uHjNuxcr:M9U9RHa989RWflRlXodpxeCI
- TLSH T17222955E432F5923A391109DFBC12DC7B2B18464E4C6408F72BDCF196A5AC99011AFFB
- MD5 SHA1 SHA512 SSDEEP TLSH
bdaplgin.ax
- IMPHASH 2d0c35dab4bdadc34717c640b941494f
- SHA256 18870378c79d899d08e27fc15b189a390b5f6e945080fb2ca80088c7f3efed2c
- MD5 fec7c0214fe562e4f844b1c9ad7b764e
- SHA1 0a001e8930321000aada1ea4642d811d27cc0fad
- SHA512 ae7fb745daa28b3a9739ee2f152237539b5b57691a398414e4bea7092eecc6b51e0411ea2a509167da89941c57d9f1bfbb9e5d683bebcc611b5e75be9f1d9eb8
- SSDEEP 384:xbqT9AkpIxJfizW/zBKSZMItir5mg663xtKG7KWNy/WKN:xbqTXpIxJiaFKKMqisgrxYbJ
- TLSH T13F722C45E7E298B3E6D246335BF6268772BACA255386DC04174026072E37982F1B678F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11603
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
GetLastError
lstrlenA
MultiByteToWideChar
lstrlenW
GetVersionExW
InterlockedIncrement
FreeLibrary
InterlockedDecrement
msvcrt
??3@YAXPAX@Z
_vsnwprintf
??2@YAPAXI@Z
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
user32
wsprintfW
ole32
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
CoInitialize
ksproxy.ax
KsSynchronousDeviceControl
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=77, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=14, id=29, version=9178,
count=1, id=61, version=9210,
ccdecode.inf
- SHA256 01a55e7e46078b922d5acadf0dd523bf8dc0b5d911be9ec57d890f37c27ca1d0
- MD5 72be12ea26bf6649482166af3fdd0cc6
- SHA1 31ae26d3ecd44391bc93ff5ddce1d1b0f597d60e
- SHA512 0476540cf9d54be6dddf961151cdd90b85b0893a3e373aa56cab3b1bb9c238446228faeb02deff98999ad2c0432101e9b659a7781d827585d2ef3395440e81ec
- TLSH T194716679CD0F91326386E12E7BD21EC2EA095CF2856A0510F55D860427BAD8C531FDDE
- MD5 SHA1 SHA512 TLSH
ccdecode.sys
- IMPHASH d5977c633dbdac9c68f7e446e09a0a9d
- SHA256 94317dbe975a3ee918d3fc2c54b2d766fb4dbfec5f85dcba5f30baf449673ee0
- MD5 fdc06e2ada8c468ebb161624e03976cf
- SHA1 a030505ef28063fd9a2a97bc5de13286bca22f0b
- SHA512 552e3373b7d23d04b6379da758737187d9890b60e201f072bac3cc1c6a03a2ba45fc1c2951572aeedd411ffd8bdb8d6ea885932fbd74fb47c0136adb1a7bc144
- SSDEEP 384:/7FWZsvzcfhWGR6/xPoH6ZhhiW75Xfn2VvnEsg2WIIW:/R+sgDjW975XeJEpg
- TLSH T179721B84B3C04DB1EC471CB1446BB70927B3EB125B2693E79110EDAA7C2B2D0AD7D6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ccdecode.pdb
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
KeInitializeSpinLock
ExFreePool
KeInitializeEvent
ExAllocatePoolWithTag
KeTickCount
KefAcquireSpinLockAtDpcLevel
hal
ExAcquireFastMutex
KeQueryPerformanceCounter
ExReleaseFastMutex
KfReleaseSpinLock
KfAcquireSpinLock
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
640B
Virtual Size
554B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=2, id=64, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
dx9bdaxp.cat
- SHA256 0bec710d309abfbfb74c1cc04ece78e21e29a573b2cc66a578fc8d182932b8ed
- MD5 fa1a462e2f79aa2ff28185e5c859835d
- SHA1 fb4f6feb5be684c5bc539c321757e8aec1b2f965
- SHA512 c9eb2fbe1d7e95f51f3d34a72a6f55a30f03c7cffb5928f78e800f7b24d73534de0ec84531bfd2f42d606a83fb7854544c52e0b53d7473ec16960e3f1f2306b5
- SSDEEP 192:hR5ViO1HC983Dip9AXK+CI3n8jiwPhdhRMnZrHZ1NZI72w5ZNq6aErlnkTN2+goj:IhJ817w5Lhe1OHrD/LO
- TLSH T12262115B09AC4163552DD9B1CFF5EC8FB432D6B6A8125D3E109373940A83BA2738F92D
- MD5 SHA1 SHA512 SSDEEP TLSH
dxbda.inf
- SHA256 ced775d3dfef4ea699a5569cb0b62b036188ce8bb44705bb56afe31e15af3a2f
- MD5 2d4646b7b32230944e5517963d4a0527
- SHA1 cdc607dc34d13925407088bff1a526b51f844fbc
- SHA512 5177e9ed6bf1bd2b2f4ad8bf1c04fcfcba2541e4307a36a9493d4461cd4ef6561c2ca54810b385b11f359352b030ffc7e93b0c768c3ccf4d1f1f3db6305c2919
- SSDEEP 192:72+PXOFcssVHSVyVdwaVEegWa7za0myx02Dj2v6HJod+Qg:K+PXD4myxVPq6pod+p
- TLSH T195D1B8444723D20BA9D8203C05A35FC7D6220079627AC85A75EAC9CCDF5DC2E7B776BA
- MD5 SHA1 SHA512 SSDEEP TLSH
ipsink.ax
- IMPHASH 628f6874f78df4a7257166f9144f8a03
- SHA256 2cb2c9a8dc6901528a757ae5f1908c2f189d449e9eedc2085a3e7f1c730dc804
- MD5 9ec3f1b9a34e3ac4bffa6f99df0430dd
- SHA1 a771d3248763873069c97f114bff602f43d53779
- SHA512 e4efebe730cf377b6c1315dd5c665c4a45812cef2ba0da4dd4d5dfb4f1d9346fb66bed25cf3976d474cbe3d52f6b1b22469f7e2e9c615abc0a6e525638eb1abc
- SSDEEP 384:ZfUMIj91qKGSSjPCm/Yrm6gTu53xkaFWA6W:Z83Z1vvSjqKYng+xkaJ
- TLSH T1F5623C1273D19453D4A383361AF92E6777FDEB24A6399E03C6041A4F3A79983E1B470B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9717
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
ReleaseMutex
WaitForSingleObject
GetVersionExA
ResetEvent
WaitForMultipleObjects
CreateThread
CreateMutexA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
SetEvent
GetModuleHandleA
TerminateProcess
GetCurrentProcess
WaitForSingleObjectEx
CreateEventA
GetLastError
Sleep
IsBadReadPtr
IsBadWritePtr
GetProcAddress
MultiByteToWideChar
GetModuleFileNameA
lstrlenA
lstrlenW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
msvcrt
free
_snprintf
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
rand
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
user32
wsprintfW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
CoFreeUnusedLibraries
StringFromGUID2
CoTaskMemAlloc
oleaut32
SysFreeString
SysStringLen
SysAllocStringLen
ksproxy.ax
KsSynchronousDeviceControl
iphlpapi
GetUniDirectionalAdapterInfo
GetIpAddrTable
wsock32
closesocket
bind
setsockopt
htons
WSAStartup
ioctlsocket
ws2_32
WSASocketA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=19, id=25, version=9210,
count=99, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
kstvtune.ax
- IMPHASH ea59e0fa6299a58362f0aeae0af3aa43
- SHA256 6f9fdf51a16d8a14b2d1194d336f53cb293f9010a4cb632e627e874e3769b754
- MD5 f5a59e8905fc16a74d9e21cfe06fedd7
- SHA1 193653935bbd202dad0a75ffa57aea48c0e6907c
- SHA512 21ed1450323422a0edd3c1f9981cd508f2fa10580a7a293f9435c5b58f27d007808ec158dc42d3049e1f1d0f703e3f6c74de24cd9b33c3259f4635bf7b84ef73
- SSDEEP 6144:A/ArOLmLDuB7v9iixiiiCaaii66mizDDDDDDDDDDDDDDDDkkkkkkkkkkkkkkkkkY:XGmLDE9iixiiiCaaii66mizDDDDDDDD5
- TLSH T16744081093E24131FB739B7C27729F92E779F80867FB41C625487666ADA1240AC36F71
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
29135
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadResource
FindResourceW
GetLastError
SizeofResource
InterlockedCompareExchange
Sleep
CreateFileW
InterlockedExchange
GetProfileIntW
lstrcpyW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LockResource
CreateMutexW
WaitForSingleObject
ReleaseMutex
CloseHandle
IsBadWritePtr
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrcmpW
lstrlenW
lstrcpynW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
InitializeCriticalSection
msvcrt
_purecall
??2@YAPAXI@Z
wcstol
??3@YAXPAX@Z
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
user32
GetWindowRect
GetDesktopWindow
MoveWindow
CreateDialogParamW
wsprintfW
KillTimer
MessageBoxW
LoadStringW
CheckRadioButton
SetDlgItemTextW
SetDlgItemInt
DefWindowProcW
DestroyWindow
ShowWindow
InvalidateRect
SendMessageW
GetDlgItem
SetWindowLongW
GetWindowLongW
GetAsyncKeyState
UpdateWindow
PostMessageW
SetTimer
EnableWindow
SetWindowTextW
GetDlgItemInt
comctl32
ord17
ole32
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoFreeUnusedLibraries
oleaut32
VariantInit
VariantClear
ksproxy.ax
KsSynchronousDeviceControl
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=15, id=25, version=9210,
count=115, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
kswdmcap.ax
- IMPHASH a4d2e6643818292a0d8fef1ab511db26
- SHA256 432b3032901140f654cecb6a6617c166fd78db658fa4317833868f5b03338e9b
- MD5 63087b5d39cedafaef62f9a885f4be6b
- SHA1 4d18896b121bd994a1f83cece2b1560c3d8fb98e
- SHA512 c0cfe5ea9d1b1515fd0ee6a745d74da1208cb0c1bb97eb0e2721221db8eea28dbbaf53aff231a687cd38707ab770ba1a278a066d51d03f614fe5fc8c11bedf86
- SSDEEP 3072:tnkB8Em3HerCa0Nt3fHfBExZRkdhx9JsP438ZHbdEcGnnwM4fjqhi9T+za:qB8EmEKhExZCdhx
- TLSH T15F244E0053F5C515F0B70A745DB69BD26E2A7CA66830C90FBEAD624F2870E04DD3AB76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
52638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WaitForSingleObjectEx
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
WaitForMultipleObjects
VirtualFree
VirtualAlloc
SetLastError
CreateThread
InitializeCriticalSection
ExitThread
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
lstrlenW
GetCurrentProcess
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetModuleFileNameA
Sleep
lstrcmpW
lstrcpyW
lstrcpynW
CreateEventW
GetLastError
DeviceIoControl
GetOverlappedResult
lstrlenA
MultiByteToWideChar
GetVersionExW
TerminateProcess
CloseHandle
mfc42
ord823
ord825
msvcrt
swprintf
_purecall
_ftol
__CxxFrameHandler
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
sprintf
_wtoi
wcstod
advapi32
RegSetValueExW
RegCreateKeyW
RegSetValueW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
user32
SetTimer
KillTimer
wsprintfW
LoadImageW
ShowWindow
SetDlgItemTextW
SetWindowTextA
GetWindowTextA
GetWindowLongW
SetWindowLongW
CreateDialogParamW
MoveWindow
InvalidateRect
DestroyWindow
LoadStringW
GetWindowRect
GetDesktopWindow
EnableWindow
SetDlgItemInt
MessageBoxW
IsWindowEnabled
GetDlgItemInt
SetRect
IsRectEmpty
SendMessageW
GetWindowTextW
GetDlgItem
SetWindowTextW
comctl32
InitCommonControlsEx
ole32
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FilterHandleFromPin
PerformDataIntersection
PinFactoryIDFromPin
RedundantKsGetMultiplePinFactoryItems
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=2, id=4, version=8450,
count=1, id=11, version=8012,
count=13, id=25, version=9210,
count=123, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=34, id=29, version=9178,
count=1, id=61, version=9210,
ksxbar.ax
- IMPHASH 86f7b1489e2283642a94ef3ffa08593e
- SHA256 e3d6d38cbdf5f6449c9080e4ad9e12dfdae3239cafa7c6569b880b93447d7132
- MD5 7c9cff0fbd4ac215f41cc5014f1da304
- SHA1 9f14c465a87b2ee8940c87a15827f49b0d892bb1
- SHA512 4a652cc0ba534060522b1cdcd4b2796b796a63608353281a3029782c28d56447c5e074c2a93fee6aacd930281c48a9e3719a5b09402e686e437e9b63ff00a725
- SSDEEP 768:AoGUTKN7+j3JyR9EEw4PbAWgvnK66ZBgM7laOM:AoGJ7CZbEw0bAHYZOSlB
- TLSH T167036D6537E28072D3B3E2378E2533B976F6FA14167CE43A078465892E7058AE5B9307
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
23720
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrcpynW
CloseHandle
WaitForSingleObject
GetLastError
DeviceIoControl
CreateEventW
IsBadWritePtr
CreateFileW
lstrcpyW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
lstrcmpW
lstrlenW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
msvcrt
swprintf
??2@YAPAXI@Z
wcslen
_purecall
??3@YAXPAX@Z
user32
LoadStringW
GetWindowRect
GetDesktopWindow
MessageBoxW
SetRect
SetDlgItemTextW
SendMessageW
GetDlgItem
CheckRadioButton
EnableWindow
DestroyWindow
ShowWindow
InvalidateRect
MoveWindow
CreateDialogParamW
SetWindowLongW
GetWindowLongW
wsprintfW
ole32
CoFreeUnusedLibraries
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
oleaut32
VariantInit
VariantClear
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=92, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
mpe.inf
- SHA256 162c1dd3539436eaaadbb008e3cd275369cdfb51382a04bf8889d9f2a9f0e10c
- MD5 d866dd33fe0269cec6d201c35be34750
- SHA1 4655d7a2e8ccc9b46b0c8ccd6fc5ffc6897cea1b
- SHA512 ef076e9b9a1e8e945f3889f3e8125381de2103c6e6f8ab4635dc9c4327a7bdf49acb4eb2020863c734a11b7eee0817108f181f7297440973d09ee62bba2d96da
- TLSH T12361A56C8C4384B38356E36A5BCB1EC3EB165097C6660508316D4703A79AD1EF31E8EE
- MD5 SHA1 SHA512 TLSH
mpe.sys
- IMPHASH b709125e5196d69f577afdd8423729ff
- SHA256 5e496781069a5bd99debc3ca07e0db03aaf7a377f6cc878fb06d4130d53acc09
- MD5 83eff7b976ae24f1a496ca94a8a19919
- SHA1 b15cea5264d59e659f1b39e7bd0d790a75458a41
- SHA512 d8fe806cf026dfbfb2da2f41f78116755067ac0a7330e9367cf43ca383ea512247dc1ca49060889bd2e92e3309ea0e326e48f31de1595da50062568675650d9c
- SSDEEP 384:IbqWaXa0dcTMWOsH380tdA+RbCWhlrwWv:IbqWaaqWOsH3ttdAuD
- TLSH T10E629448E79D45B3ED5AA5BCE3C30F94EDFB541542234BC98BA966042D117C3DC28BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpe.pdb
ntoskrnl.exe
KeTickCount
KeQuerySystemTime
KeInitializeSpinLock
ExAllocatePoolWithTag
ExFreePool
KeBugCheckEx
DbgPrint
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassStreamNotification
StreamClassDeviceNotification
StreamClassRegisterAdapter
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
640B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
640B
Virtual Size
630B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=5, id=28, version=9178,
count=1, id=61, version=9210,
msdv.sys
- IMPHASH 9c8ab33b01f025da51e11dfc59464123
- SHA256 43c355a0ae8f3104d27e2f60b4e4a234434a3f4bafcc6d8efbcf941005d1703d
- MD5 8575d788395c4d6378d98d1ed7cdadb9
- SHA1 68acc396009b0f4423d64ecb49591d785cf1c150
- SHA512 8d4356dded57e33503a5810b3d94e27e07bdf7e11380b2f92d45c63e8a37e40335fa494541f6f80117e6cc35244de07618e73be0535b7af25188a9f0075dde1f
- SSDEEP 768:aVsHDMhUfVQtTTxzS5kuDdIHXjM9reONtrgVveVKLc/LgC:aEoh8Uxzwk9CeOj80Amg
- TLSH T16F332A00B35088B1C05A0270CC1FB36562B3A91D1FDA67A3737427AE2E397507F66767
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msdv.pdb
ntoskrnl.exe
KeInitializeEvent
IoFreeIrp
IoAllocateIrp
IofCallDriver
ExFreePool
KeWaitForSingleObject
KeSetEvent
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
ExAllocatePoolWithTag
KeReleaseMutex
KeInitializeSpinLock
KeInitializeMutex
InterlockedExchange
KeInitializeTimer
KeInitializeDpc
InterlockedIncrement
KeClearEvent
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
KeCancelTimer
KeSetTimerEx
ObfDereferenceObject
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
InterlockedDecrement
KeSetPriorityThread
KeGetCurrentThread
IoCancelIrp
wcscpy
KeDelayExecutionThread
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KeQueryPerformanceCounter
stream.sys
StreamClassStreamNotification
StreamClassRegisterAdapter
StreamClassGetNextEvent
StreamClassQueryMasterClockSync
StreamClassDeviceNotification
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=5, id=64, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
msyuv.dll
- IMPHASH 317bb2a83416a509406d650a33ce001a
- SHA256 3feff133489eca65922e1001885d3f98ad57e7d531b67b67c26027413b7fc95d
- MD5 985d12554a9d51e989d1712e299f7655
- SHA1 ed1300df0148fa3bbb754e384be09a98a1ee5664
- SHA512 b44d17ed9314e0c80d078a6e4d037aae072d8495e80f4b5239162db69a7e631eba0e7afd2572a3dcd4cf72fb8d857088e6913f57902c055103f6dbabb5932cec
- SSDEEP 192:8iNj0i6wnT1v08JzPLPdoKo9yTYlAU1Wo+Ijuo+Ijpo+Ij2JIGC7qIGC7tIGC7Eh:8ib6gtzLL1jWyTYlAsDTZK1WactW
- TLSH T1A07293827FAB1D52C0D1093548A7C63B53BE9F7056F7469A4F2511AEF820A61C63BF13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12804
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
VirtualFree
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
LocalFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalAlloc
msvcrt
_ftol
wcscpy
gdi32
GetSystemPaletteEntries
user32
GetDesktopWindow
MessageBoxW
ReleaseDC
GetDC
winmm
DefDriverProc
GetDriverModuleHandle
DriverProc
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=64, version=9210,
count=11, id=25, version=9210,
count=23, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
nabtsfec.inf
- SHA256 eee3641785da56dd4646a4dc5aeb5827828a3218bd5635491da1ec70608ac604
- MD5 187630b45b902dfa52d13f11c69d36e2
- SHA1 5c2ca522286b99f8859f6c719d15468c89644a92
- SHA512 2fc8220fe6bcdb99a874e3f80937f30aa1b7f733e7148a079a7db075b37005f5c862909d87f69dbfe940489f69456f4d3669cf063f482fce47a0b83c95be24b4
- SSDEEP 48:xbcXc68yEhpOD8HK7k38O770g3kc4CqldXcZZx8+wu5S70xjUCdgn9WK13EdbsP2:t00pIfxcZZLiCApt1UhsP2
- TLSH T19E818419CE1B803663E9D11E5BD73E83DB2A30F28D6640C0379C5A08278798C932EDDE
- MD5 SHA1 SHA512 SSDEEP TLSH
nabtsfec.sys
- IMPHASH 49970d1ef884a17567a446f9fea4d52c
- SHA256 fb000ea253475abc5b6938aaa3e7a0405e81d3a282485b7f74ea9a4e77563308
- MD5 ac31b352ce5e92704056d409834beb74
- SHA1 6164b8586598cef328a1d8d32e64622821340e55
- SHA512 c9eaf6d00e1821411f647d36341626024357b5b9b589bd83a69d05579a5c818add9774dff98c629a5463af623fab595ced60e8a517f62a93ad9593a989ade532
- SSDEEP 768:7NQ7ZoFgMU7KbBPYTDjujwIhkHZHVMV+mpY3jl6myuq2CeaGSOKWi+6mywyRE4Wu:BQ7kgMUiSTDjG9kDDFO3Us
- TLSH T158836B00E782BB3BF4EB50F6916B7A4E11B49F110B4982CB6AD87C46AF385D16F32153
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
37401
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
nabtsfec.pdb
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
KeInitializeSpinLock
KefAcquireSpinLockAtDpcLevel
ExFreePool
ObfDereferenceObject
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
RtlInitUnicodeString
ExAllocatePoolWithTag
KeRestoreFloatingPointState
KeSaveFloatingPointState
KeTickCount
KeBugCheckEx
KeInitializeEvent
hal
KfReleaseSpinLock
KfAcquireSpinLock
ExReleaseFastMutex
KeQueryPerformanceCounter
ExAcquireFastMutex
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
1006B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
256B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
896B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=2, id=64, version=9210,
count=1, id=69, version=9111,
count=11, id=28, version=9178,
count=1, id=61, version=9210,
ndisip.inf
- SHA256 6239cda249f35baa9ba1848ebe3df414afa27be38fb8fee79fcdd8dd00dbf907
- MD5 3675a3e175c1b4a9a0397d80b6cdfafb
- SHA1 5eb1d87943f40a205c9b1a65b880417d1c5ff8aa
- SHA512 7ce64105634e7dcb4250a972bf303f4474622ccc61ef07e1742daee8e32ebaff6991bce31c68d782b8f0b31b9c069755548dfd80ac6e4a5c63adcd7484d74299
- SSDEEP 96:4VNZ3J6Ep5c2cQHSsK1GMDSsKv/edvZ0EL6OjkiDk9ozMZ/XydUWb:EH3oEI27SsWtDSssedhTLFYig9ov
- TLSH T160D12E194F42AE352BCBD1799B030F43DA36029B891A154435AD5BC02B7F68E632DE8D
- MD5 SHA1 SHA512 SSDEEP TLSH
ndisip.sys
- IMPHASH 85b9203fdd9c0bd977642878e7918927
- SHA256 e880da5ddd381abed5bf2c3b8cb387842301b52ebf29173383d618f5961f36f7
- MD5 abd7629cf2796250f315c1dd0b6cf7a0
- SHA1 9baaba6e47ec06871d944f19961ca3cc8132c782
- SHA512 a68483ac251df13566e48f202e9a6d305a90fbe69408aae232d4ebd399d53ed077de97ccc3c005f107dc560ee9bf6d4b070562761101d08858700865dee6aef2
- SSDEEP 192:++BarPS1JL8yvpeA1SbVMsflIGywVVXXPWgZFW:RBOyJ8yvpgVMsflIQ/WgZFW
- TLSH T15522F90273D41B3FF0930FF559B317AAD527B9157F65624E021314CEAD39AC5AA38623
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ndisip.pdb
ntoskrnl.exe
KeBugCheckEx
KeTickCount
KeInitializeSpinLock
IoFreeMdl
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
DbgPrint
ZwSetValueKey
ZwClose
RtlInitUnicodeString
IofCompleteRequest
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisAllocateMemory
NdisFreeMemory
NdisAllocatePacket
NdisAllocateBufferPool
NdisMSetAttributesEx
NdisAllocateBuffer
NdisFreeBufferPool
NdisFreePacketPool
NdisInitializeWrapper
NdisMRegisterMiniport
NdisAllocateSpinLock
NdisAllocatePacketPool
NdisReleaseSpinLock
NdisMDeregisterDevice
NdisAcquireSpinLock
NdisFreePacket
NdisMRegisterDevice
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
331B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
384B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
896B
Virtual Size
890B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
358B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
psisdecd.dll
- IMPHASH 030f2fd88c6befc4cc612bcee23289da
- SHA256 5108a9179e2b042eac111d926431e8fe37562c9f4422861ca3120b506b409b98
- MD5 5319bf20f48884e594f84097a600424b
- SHA1 1e4014a1df18c5c743e5567d768f8e37a97f9f09
- SHA512 a4a3b3127d5fb69fe1ba581d9051ae8d1d1626c38486abf1bc0e3b697e10f73127c97c7913cf6640ce6b937703cd18c600a021be5b1dc84fed078d4eba9cb4ee
- SSDEEP 6144:zAOuiRizjJTRcHV+oGC+1dnLSCkFUnru89Fos5FkYAloEcXnEUjz/ZnC5W:zU+VO1dnLSk6kqs5qYAlDcXnEUjz/ZnT
- TLSH T1C1748D107FF6C136C7A56175CA7B6BEAF778D7054D600A670B0C162C6F38A82E162B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
248728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpiW
lstrcpynW
HeapDestroy
lstrcatW
GetModuleFileNameW
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
LoadLibraryW
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
GetShortPathNameW
LockResource
lstrcpyW
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
FlushFileBuffers
lstrlenW
MultiByteToWideChar
Sleep
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
LeaveCriticalSection
GetModuleHandleW
EnterCriticalSection
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetCPInfo
GetOEMCP
WideCharToMultiByte
LocalFree
InterlockedExchange
TlsSetValue
GetCommandLineA
GetVersionExA
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
ExitProcess
TlsFree
SetLastError
TlsGetValue
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
HeapSize
SetUnhandledExceptionFilter
GetACP
ntdll
RtlUnwind
winmm
timeGetTime
advapi32
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
user32
CharNextW
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoCreateFreeThreadedMarshaler
oleaut32
SysStringByteLen
SysAllocStringByteLen
RegisterTypeLi
LoadTypeLi
VariantClear
VariantChangeType
VariantCopy
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
300KB
Virtual Size
299KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=26, id=64, version=9210,
count=1, id=11, version=8397,
count=11, id=25, version=9210,
count=137, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=123, id=28, version=9178,
count=56, id=29, version=9178,
count=1, id=61, version=9210,
psisrndr.ax
- IMPHASH b3fabccc88441525f3d8a97e7abf70a5
- SHA256 b0969c106bdd6e4b0ae2c252e9b4792532ca60b19eb04effba9e8adc1c41025f
- MD5 e93d7d262a33d14aef13398ab83fe08b
- SHA1 b7fb62de3c6521c3f71ff3a398cc6b97abe2392c
- SHA512 26db7045c57faba96b96e4dc6da3667122398a4a3517065854c9114ff78cc25ba3116e010f9d45ee2d1de3f4935345a53f5f407a1538eb29f013458baac9c1c7
- SSDEEP 768:F1mgRwKIvRcysV+ngpw1r8aQ4nMxBi7W:WVvRcVVDI8aTnMxg7W
- TLSH T1F1D22B137BE660B1C6A35233C92133A7B2BBEA586539DE154A1819462F32143F1BE74B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetModuleFileNameA
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
lstrlenA
MultiByteToWideChar
LoadLibraryW
FreeLibrary
lstrcmpW
lstrlenW
GetVersionExW
lstrcpynW
msvcrt
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z
advapi32
RegSetValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyW
user32
wsprintfW
ole32
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoFreeUnusedLibraries
CoInitialize
CoTaskMemAlloc
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=77, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=8, id=28, version=9178,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
slip.inf
- SHA256 418040f2b05a196c48fceae77afaa9e58ca87b10269dc084be493db377c82a31
- MD5 a42a3419a484b82e752b850cd13bfdd3
- SHA1 fdb7a19707b7ea6e349c6559152cb5f1c02483e4
- SHA512 eda1f7ead98530284ee850dffae35073f22c3399cb98b6e25dd62d3ec175b4d160d1841ccde5c4261b76bf301feb5417446a30779cf276d778f5c2ba68a4acaa
- TLSH T1757186ACCD0B09636389D1558BE63DC3EF980053C19B0B89306D8A1663C9A9D5E1DDEF
- MD5 SHA1 SHA512 TLSH
slip.sys
- IMPHASH 3f9db7809b38aa51c5daad51c58fe7a9
- SHA256 96cc96eebaad2782d8143db2b8889e9249c89dfb90875412e5f105c0ffb3c728
- MD5 1ffc44d6787ec1ea9a2b1440a90fa5c1
- SHA1 244264547bbad19cfe6a8d5d057db281f92095a9
- SHA512 c7ef4afd2af054452363bf082a2f2821c8944b24fc1c0f8f8ef97d96b3cafde20644f00985829bfbb7cd869d4a866d3f3fa39b93c050e3a27efaa258203addbe
- SSDEEP 192:NApCqlIwfHkLPhw22AsALyp2rn4kY0FUjoZVx4TWxzyWE:N6ZImHkLPhw2H5x4krFUjoZAWxzyW
- TLSH T124224A1137E40F75F0D74BB1EE8B271A867BE81C5A11E33E02A53D891D38D00BA2C7A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
slip.pdb
ntoskrnl.exe
KeTickCount
ExFreePool
ExAllocatePoolWithTag
DbgBreakPoint
KeQuerySystemTime
KeInitializeSpinLock
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassStreamNotification
StreamClassDeviceNotification
StreamClassRegisterAdapter
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
384B
Virtual Size
262B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
206B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=1, id=61, version=9210,
streamip.inf
- SHA256 1e06c2c3eeb9cfd1938b73e70cb3b841b1da89b97ab6acadde5c136e0b336bf6
- MD5 885e850809bc928ee802f13e28449efd
- SHA1 39f8ff6d6cfc300b61e6a52f647b05382c4b365b
- SHA512 1b660a1eb54b6e1bce2902a260ae95def2eec32af8c06a666138456ad85f5299d9286d588f90fa9c4d938ccee06960d19c2a3ecbed539e41811e89533526c6e8
- SSDEEP 96:d0KuUqnZK8hQ+B8ljiFjZMaH1XNgaAgaPRIWKTAidudNjKJ:d0K4Yt+SljiFjSyGyVIKJ
- TLSH T141C173494D2B5473937FF23D9B870F92E6257813D18F414830BCCA161B9AD58922EF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
streamip.sys
- IMPHASH 937c5c9480c457813996610d24c3ca2e
- SHA256 a06e4a105327fc76cf4697278d8144e83cad89fa4719fbe3f4c32f6027d802fd
- MD5 a9f9fd0212e572b84edb9eb661f6bc04
- SHA1 fa9de09db2df10e991588d2ab578251d11bcbbc7
- SHA512 1aced7a2cc33e493bed83cc52ac2b68dfd752acd2261750393c1b22ff2f0396d9d73c42e3b14295d8416a123e7c43fc329e012a661d8b74e31e41c8e42b624ac
- SSDEEP 384:mBjX9oOlN5wQVEI7yjrDuL43KJpQVPk7cOe8NHiboZtMWg1RW:yjX9oe5BVESSS46JsMcC9iboXW
- TLSH T18862F88DE3D50572F52F01B886929742E9BFDD056E1A82F987FC8FE12C82552F4247D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
streamip.pdb
ntoskrnl.exe
IoGetDeviceObjectPointer
ZwCreateFile
IoGetDeviceInterfaces
ObfReferenceObject
IoBuildDeviceIoControlRequest
KeTickCount
ZwClose
ObfDereferenceObject
KeInitializeSpinLock
RtlInitUnicodeString
DbgPrint
ExFreePool
IofCallDriver
ExAllocatePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
stream.sys
StreamClassDeviceNotification
StreamClassGetNextEvent
StreamClassStreamNotification
StreamClassRegisterAdapter
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
647B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
640B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGECONS
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
768B
Virtual Size
674B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
640B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
vbisurf.ax
- IMPHASH 4ea881e9bc4888403a5e8628308bf315
- SHA256 3694636dd9a32923d5f7acfa84c53127ec6fa8d56b759e3ece41b204d251931c
- MD5 1c4496b1780be155c2d8d1b260118959
- SHA1 f5e4067171143c98de66efbf66bae07a5fa901f9
- SHA512 7edcc92e99b4f280fc2639aa91db233275a8fec4673acf5f80d682e5fdf3a0c05076c5be44179ff08df73b08e1e55e654f05a4d299defef03036f60ac5496399
- SSDEEP 384:if/mN0LqTy/FaX3Jq3en7CblOY5vgTRsceQ/L9ePFE0tpBL3x8KBW1jWVzG:iHEkn4HI3E7CJngvj/w1xVgoG
- TLSH T14CC25C12FBDB807ED6A355325F793FAAE2B2E7441A7C9C120B1059453A21183F2FA357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetModuleHandleW
GetTickCount
InterlockedExchange
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
SetErrorMode
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
lstrcmpW
CreateThread
ResetEvent
SetEvent
CreateEventW
InterlockedDecrement
InterlockedIncrement
lstrcpynW
GetModuleFileNameA
GetLastError
lstrlenA
MultiByteToWideChar
GetVersionExW
lstrlenW
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
ddraw
DirectDrawCreateEx
DirectDrawEnumerateExA
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
user32
wsprintfW
ole32
CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=78, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
wstcodec.inf
- SHA256 6edd2203dd2fae09442e9afec57738ebc37364d27c84d76bed633e122ca33313
- MD5 d0ba27ccb5958090755e939a01ce8cd4
- SHA1 7e9ec073086dda1d6bad3f572e041cd482877fc6
- SHA512 583d43a959af8ca13d0a215143ddec8c78d0e079c06707dd23a093dcf0bf7039b60a802539c364db769ebe065a3f805d86fb3bae0a0f1b453325a0635e1a52cc
- TLSH T1857123CD8D0B87BF7344D11E7A522E82EB1971F281CE0A043D9D7E143796DC8621E89E
- MD5 SHA1 SHA512 TLSH
wstcodec.sys
- IMPHASH 5e94d6115bae4fe6e2b87706af1a8293
- SHA256 68348cdfe255471191f8ee5b522174c8b9bed9162359ec180076e19dd78005b7
- MD5 233cdd1c06942115802eb7ce6669e099
- SHA1 9ee4a786785fc2676efe1935704a44bccfde121c
- SHA512 7758c0c58939e90cc6a25c79bbd6fd5def9f1f2ede0d9063f2e707d033f91fc68cd8a5ec7674e180111963503e48a803a996ed4a0aaa0e3215274ec5131fcb0e
- SSDEEP 384:Gs+CEbgqEcQzr9wa8miLXpYs9+WNPHeWQyWoS:R+pnQzYY8hQs
- TLSH T132828EC53BC02DBBE9254B355AFB23146BF7D7191662E3838210ED5C3D26E408DB2A23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
wstcodec.pdb
hal
KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter
ntoskrnl.exe
IoCreateSymbolicLink
ExFreePool
KeInitializeSpinLock
KeTickCount
ExAllocatePoolWithTag
RtlInitUnicodeString
stream.sys
StreamClassDeviceNotification
StreamClassRegisterAdapter
StreamClassStreamNotification
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
512B
Virtual Size
484B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=3, id=64, version=9210,
count=1, id=28, version=9178,
count=1, id=69, version=9111,
count=6, id=29, version=9178,
count=1, id=61, version=9210,
wstdecod.dll
- IMPHASH b773ed61e5f2f5b7c57feede58a7f58c
- SHA256 9e785280c35b9915281c40f849837aec6b82e30cfb39982fea953203cfc6c8f4
- MD5 153f4ff0785753a1ad4985e41b3d6d00
- SHA1 5a709d5e98633c796ded01977904cb9f3cf05055
- SHA512 6e7e4e14793caa388922639ed86a9d411f4e3fed374a2a443806e78cc487ec80a2b705b5be75a1da6832b362e735a5351b0d43b56ab642789e1e1777ae33251d
- SSDEEP 768:lY8V2X7EU3D90DlqEafnKYmTzTLGvj47cJBzgyUErCGZKLYphRxqH+cK+Lm:l5Vg420DoRfnsnTLGEiB0eDYYjRxKM+
- TLSH T1C0238EE573D240F3C2F30172AA3533A6B2F6F6181A2955234714760E6BA654ADA3F337
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
27843
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
TerminateProcess
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLastError
FreeLibrary
lstrcmpW
InterlockedDecrement
InterlockedIncrement
lstrcpynW
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
lstrlenW
GetVersionExW
GetModuleHandleA
MulDiv
IsBadReadPtr
IsBadWritePtr
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
msvcrt
free
malloc
??2@YAPAXI@Z
sprintf
sscanf
??3@YAXPAX@Z
gdi32
CreateCompatibleDC
DeleteDC
CreateFontIndirectA
SetBkMode
DeleteObject
CreateDIBSection
SelectObject
SetTextColor
ExtTextOutA
SetBkColor
GetTextMetricsA
GetSystemPaletteEntries
GetDeviceCaps
GetTextColor
user32
GetWindowRect
GetDesktopWindow
DefWindowProcW
InvalidateRect
LoadStringW
SetRect
SetTimer
KillTimer
IsRectEmpty
ReleaseDC
GetDC
UnregisterClassA
SendMessageTimeoutA
DefWindowProcA
ShowWindow
CreateWindowExA
MoveWindow
CreateDialogParamW
SetWindowLongW
GetWindowLongW
wsprintfW
GetWindowTextA
MessageBeep
IsDlgButtonChecked
GetDlgItem
SendMessageA
SetWindowTextA
CheckDlgButton
RegisterClassA
DestroyWindow
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegSetValueW
RegCreateKeyW
RegDeleteKeyW
ole32
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
CoCreateInstance
CoInitialize
CoTaskMemAlloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=13, id=25, version=9210,
count=129, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=19, id=29, version=9178,
count=1, id=61, version=9210,
MaxPayne 2/DirectX9/DSETUP.dll
- IMPHASH f57b219515a7304b7cca4eea391181e3
- SHA256 edc9c0bdd3e1e445c9bd57fe8141f93c0be53d61d1f8c6355e6d53565028001d
- MD5 91865aec9c49bee70ed3ab5ec4365127
- SHA1 f561888fb9ac1eca6ab82a987348c0391a21f2de
- SHA512 bbbbc48cfaa16c66635f988e4e23726fbf83af001c2d111c8b3038ebf6ce5aa3a417ee671bb112cc0cbf9a58bbc3c1eccb84bf7380d908d017af7d3826c37cd5
- SSDEEP 1536:9MYLA6vhzACiyKpkiKUlmMUoHLsYTK1WcOe3C8YHQkrI3ECu3+LJrxPP:9MIA6vhzACiyKpkiKURUyoF49ej3ECu2
- TLSH T18F435D43FF708076D8D222FC18485611B6BFE9681ABC846B930583D96EB2786B63D753
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
26770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcatA
lstrcpyA
IsBadWritePtr
lstrlenA
GetModuleFileNameA
SetLastError
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcmpiA
WideCharToMultiByte
lstrcmpA
GetSystemDefaultLCID
IsBadStringPtrA
IsBadReadPtr
IsBadStringPtrW
lstrlenW
lstrcpynA
GetWindowsDirectoryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsSetValue
GetCommandLineA
HeapFree
HeapAlloc
HeapReAlloc
GetLocalTime
ExitProcess
TlsFree
TlsGetValue
TlsAlloc
Sleep
SetHandleCount
GetStdHandle
GetCurrentDirectoryA
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
SetFilePointer
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
SetStdHandle
FlushFileBuffers
CreateFileA
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo
VirtualQuery
SetEndOfFile
GetProcessHeap
ReadFile
GetSystemDirectoryA
SetCurrentDirectoryA
GetVersionExA
LoadLibraryA
GetProcAddress
OutputDebugStringA
CreateMutexA
GetLastError
CloseHandle
GetFileType
FreeLibrary
user32
wsprintfW
CharNextA
wsprintfA
GetKeyboardType
DestroyWindow
SetFocus
CreateDialogParamA
SetDlgItemTextA
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
winmm
mmioRead
mmioDescend
mmioOpenA
mmioClose
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
ole32
StringFromGUID2
DirectXDeviceDriverSetupA
DirectXDeviceDriverSetupW
DirectXLoadString
DirectXRegisterApplicationA
DirectXRegisterApplicationW
DirectXSetupA
DirectXSetupCallback
DirectXSetupGetEULAA
DirectXSetupGetEULAW
DirectXSetupGetFileVersion
DirectXSetupGetVersion
DirectXSetupIsEng
DirectXSetupIsJapan
DirectXSetupIsJapanNec
DirectXSetupSetCallback
DirectXSetupShowEULA
DirectXSetupW
DirectXUnRegisterApplication
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=103, productName=Unmarked objects (old),
count=15, id=64, version=9210,
count=1, id=29, version=9178,
count=3, id=25, version=9210,
count=42, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=100, id=28, version=9178,
count=1, id=61, version=9210,
MaxPayne 2/DirectX9/DirectX.cab
- SHA256 e8497df7ed6b47e7ae6a4a78eb10fd3c279224b50bfc9084ab67996ecbeb9517
- MD5 8395203fb63b22a35764e90868da5fd5
- SHA1 382163a4469a6ba63251d78c2d09d7da81ebce4b
- SHA512 4674f42d578e329b23cba994485f6f2321b5585a4893619b7a82f4c553370e80d6f55974626266aad8e0afbf893ce0b48bb5d2be76b1171bde13cb318f7ae37a
- SSDEEP 393216:1aCNwZi1uqToX/2fsZGorVVV3SYkgM21q12/Yg00Dx:1Ui1uqTMufX273M2w1YV
- TLSH T126F63367B3541B80B8BFAC64B4C7C65BE1A5277A111D9C0BFACDBB085C4C6D0687386B
- MD5 SHA1 SHA512 SSDEEP TLSH
ACTC094.ini
- SHA256 8cea0baed4097534d19c36633bece9c8f0e9864174cb292021b31450074406d0
- MD5 90e60c20df2541b20bb45811e024909d
- SHA1 3e88a5e65dac8ef4b85f1ad3c8f2887184f75ff8
- SHA512 8d922215411c8c0c4e6e4917203a691180adfcdfbb6996dcc05f53d51862bd3e97b89cdad1610dddc1526df03950c369266563cd35813f8be187bd2c40f22367
- TLSH T1F081ADAB857072BCF4BFB5BD324B00DD135124B789A2B067156731F8634385B3AB28E1
- MD5 SHA1 SHA512 TLSH
ACT_RS.ini
- SHA256 95de1d836d0b68a58dd459835c693da24503250304e8aa0bef58d27566843d35
- MD5 61fe9c4bfc75fdbfdec4f60136ee6dce
- SHA1 a9c6f2e21b4c129bea2a82415700f0f80fc05119
- SHA512 5fb6416d823c8404c5b607b7dd4ca12c0b6b63693c8e90f877973109edd65bc71270babe97cd62343bccf179071bbdbafe40fb4e56e1355928dec96ce592d70b
- TLSH T14F5137CE6F75A2DCE9B231495807D6EC0EA11AB21FD63EB9504519E47CE01312B2B9C3
- MD5 SHA1 SHA512 TLSH
ACT_RS.png
- SHA256 3904a6ef7aea6c5535aa7ff6495ee965a6ccabf7d593eabfbe0449fa56e5ff07
- MD5 7942a02676b8c1f40b2445a32ed30704
- SHA1 3f57fa332966337276e662d3ef76a1f0df87d7b9
- SHA512 e56555eeb01809c3ed71e0cc95e088b0adcd6a5da36ba61a94b6d7000e7d6023ef1d84fc4e8be92ca2af4bae9749b5db48e27617718af99fa0aad1e02e78d052
- SSDEEP 1536:FoonWm5kMGiQzAiLaAFcPjw/AeTXz2GOMDLCeeWDaU1/8MROWk:MlLNFt/AoXzzlja5ek
- TLSH T18B9312CBD1EEFF22956D7B4780D1E112038B03793F494AA97118B68403AB5C8E73A56F
- MD5 SHA1 SHA512 SSDEEP TLSH
GR3001.ini
- SHA256 c5b79fb29e3489b3e1789403c2e0585c646287c9a61a756b8c9876e9d0f6d77b
- MD5 47f6bce7d86f48f18ea82e97c10342a1
- SHA1 88322d488cda74bd04a207a81d9ea9cc6ef5c87a
- SHA512 d88582171208d686632e0d8f9845c9cd366cd3937b70f276de2be5f0f2114d919a9a0a0913fccc4dc07b844a365dadbf1d667d17a445734d86049da179cd0679
- SSDEEP 96:JUXiR9HMeaO+WYwPgotSkEYrDPth/wX7r4sPX:aK0w9/1yLr4sPX
- TLSH T1CCA1884E9F3032AC940BB13A334788E83A6914B189FDB558000F15DA66A19B477FF9E2
- MD5 SHA1 SHA512 SSDEEP TLSH
GR3001.png
- SHA256 0799b81ff6267914c697734fdd9f25a2f8f12867d7465bc7d0defabd7891777b
- MD5 1105dc7d16c1fc5712796441eb5c36ee
- SHA1 afad00275a6a63c9943aa0bc182ff4de2b3a061d
- SHA512 548de0bcc75eb4468f2800124bfd76d5659b256aa9d166091de619ecd6409b9403ac5f082da1e6556ffcd613a018a4fc7b80ad56c3437242aee439847f4cc17c
- SSDEEP 768:HMQ1wu+eLtWJDuqMFcbdM2JIn+HaPpZDtlfkg65MluLnZatlwcXvpxtPWHBhHXSU:HMQS7ekJabFCInCaPp9Tn6HVorhWhB
- TLSH T1F803F1A43292E876A99DA03A9C86F4E07533BD003AADADF1EC4BA74FD51B03DE310515
- MD5 SHA1 SHA512 SSDEEP TLSH
GR3001_G.ini
- SHA256 e13de488155683970f388a754266c87999678437a8dc2d69e1db5fbd6e936e02
- MD5 5ce0c65859ee3710ed9d9bb8f857a718
- SHA1 ad8500f016725fb8d889892dfa5624b1d257aae6
- SHA512 f6bf30bc0dc796f2882d0f10f97eacfe27f3746799a4797f5b9f5eda640cf858cfe70f52a8001fe9c4bf97207a047da9a36ee5311f9fa601660f210bde898f25
- TLSH T139819B4F2EA432ECD85BB16B374784E8266C10B188FDB4A8104F05DD9A5197477FFAC2
- MD5 SHA1 SHA512 TLSH
GR4001.ini
- SHA256 5961de03bf16540ffde3ef81be2834f16d7e8090482e91e5ae880576e07d0a4e
- MD5 85aadb0caa6d7d0b7be6e8fb1368c3eb
- SHA1 342355515af7b946083f3a1613c68896164d4e23
- SHA512 8cd6879021c5c2b86b864efc9c5340d06b5d4104dd8a6c5acf58244dc1e4c993fa001e2c6e33cda9624d7b418cfb9b69a075b0b11fa9de1a5f7b46d06434e94b
- SSDEEP 384:diSN6MbONlJ63d8Q4RZy6hD3xvGLRggrTNNERB/1Pz7+4x:d8
- TLSH T19172F06F1F6A76EC946AF577334DC4A0642C8291CCBDE4440A1F068D1A11A39A7FFEC6
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4001.png
- SHA256 fb64f0cea878dda22d68633c4aa5b99e79247ab01abaf66117fe556972061406
- MD5 25dbc13ffcc29a4cf1362ce8e9cf7e6b
- SHA1 9f86377f3c11ca1d9e8626c21aaa654aebbed814
- SHA512 4afff949318aef75103c449126f1ff0d1837164f02fd292fbda15424b441a465057fb6d7923d1fac421cb624f135621c654a580ed3ba37c3b010f456d2422b03
- SSDEEP 768:V+AR34iHJnMZISaScg5zOKJFjXZH1GKKoC3xRzyoy4:MS31HJnKxaS/jZMKs3bzyw
- TLSH T1B1E2D0AA683EF13912E50EB8AD0A60DB18D4724753F63E135C2F4DA41A57B2DCC2F532
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4001_G.ini
- SHA256 535a323d1001e57acf25021e96fbe132d56d284456a13c1d70cf478a98b99bfd
- MD5 9c5a69fa046c74499ec0746bb392c3eb
- SHA1 7663b1891f84c4e659e220e366988a55a2a4d4f3
- SHA512 a8f59c84a90502f2159351b2af0942b88688d226a1255a9ce9154126a089e8ae56cc20b31caa2609fc495ab9077b07eb26202398b975e28379b765b0d44e70ab
- SSDEEP 384:3Txu61k/lzwiPOYGjtG0D9DHfG/fCsXzndcFTTfPRdMM:3j
- TLSH T1DA52901F5F9AB2DA94A6F57B2709C5E0702C0162C1BDD8440D1F0B4E6A01A39E7FFAD6
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4001_G.png
- SHA256 32ab1d768c3d328483911898e9aa5923ec86c93802883ad5d06a325d0e928d81
- MD5 21116c9897067ae2059ad65a0b9ec7e5
- SHA1 f9bee25b1c4eaeb984a8d241e1fc4d0d80eec934
- SHA512 b98ce203949b2993c1d127d0a56ce0570582a7735ca92e050074d896184e0998a4ef061f1acbf9588d9dab6acf72d160f9ac44e9c89728b36f288a983dcbf6f6
- SSDEEP 384:C7GZK4bboCHQBRrzLyQa0IreXCUM7Go+Iz+ZuYM2S8+/tBQkbt0fNLThH8jwEvCV:tZ/xmRn4UCUMtYp8zQG61H8jXCqnO
- TLSH T163C2F145A8F5AE3A148A81C631AD159DBA0CD2995F73D64C0D2B3062FD0AB17FDD28C3
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4003.ini
- SHA256 fdf6288f43676c6c0567ebc33a525fdebf9d3a28eab4f25d5d1e03aac446ac34
- MD5 e5379f226be44d716a1450f6f2494f35
- SHA1 aa45f6875c80a2cc9cfb02b1e39bdd2a2a170034
- SHA512 c193c35ef94197bd9770341840517336c74a192abbbf57a2a1ef301d66c3089a4befbe6c821f97e41f34113bdb179f3aeda4d18de2dd109bae99ab5698d4fade
- TLSH T182719F1D6BB037BC584B367A330784D8369418764DEAB968606B12E97762DB033F94D1
- MD5 SHA1 SHA512 TLSH
GR4003.png
- SHA256 efdb3810c8c1e9f2e474e1674530a9b8c8268e4f2ebe0322ab859c7590bb4673
- MD5 11d4613e57c34fca41622e90c686c63d
- SHA1 b6b3ca15f373cfa15100e174723a0c4a2207450a
- SHA512 c9f7d874e3e62580d08e31cd2f38026e53369c3dd5ef707dd0ab7e2fcf89faedf098c1efb7e25f39f1e744a395c1319a72557aae37bac79cef2f5506fa6b58f8
- SSDEEP 768:6dk/AD2oy+LOOBWAbgXMyL7kLttBqRCrMiqzsy0Hqwa/E6q:6iImtfAbgXrS+RCrMjNDR/Zq
- TLSH T12AD2E010AA5454F7C74A8E7C154FEB87EFC368B57F136E0E101A70069D6E22B3B23295
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4005.ini
- SHA256 492614b01711e564a63d6d4084e1d8d9447d93eaf0c07f7cd053a7d1614a181b
- MD5 cb059e53e8de48164f88d185dd4df925
- SHA1 21766635ea8e3a1a97497aa38b4f03bb9190016c
- SHA512 f9959d9d764cb20584c21d04458fcdb6c6aa1733f20f47da76dab05a2610c8e407943894c90cc0b08068738395d836447f4200435684e1859fd4e2694772ec4b
- TLSH T1D1415B5E62B536BC498B763A324780E827E455720DFA7464602712E97772DB033F61D1
- MD5 SHA1 SHA512 TLSH
GR4005.png
- SHA256 1e26e506d71d2c80ef1cda68881c981aca6d564723008da98ed5548f6c353a82
- MD5 2784af4c286102874784b9ba0b999fe6
- SHA1 631b57e90db5442a50ef0adb80c871ea22b6a9b9
- SHA512 4dc2d3564acf0d484ee5b1cc60d27faea3adfe2994a0c8c9e0777bc432dadfd95f883106e9565d22252ad220e3af01d822d49fe524fc268d43039a2f65acdffe
- SSDEEP 768:6NY5L06wpe16Xhb0l/zEoJkLjwSt7vImYYaTmWCjaAFuun/c5:fL06z6XKbEEkH+TDCjxpnU5
- TLSH T1E1E2E16EC28E1A86F6715A779CC36B8B5CC40089FED597EB3CB710403A3904998D2EF4
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDA.ini
- SHA256 247c0041753ba2428dd8c9eaaa65b4807cde6a31a18685be4d05c27a712c3f4d
- MD5 7e6f847ac4672ec7a6d3dd511a33d879
- SHA1 1ed90dd3fcfe0f74170686756fd054326fb19b01
- SHA512 3acde080697ad3359956669745637a652ff50fef4e9b550925f15057ea8f82054be739137f141fd904d94cf2d0517bfc1523dfbbd681707aaeb0883c49c897ff
- SSDEEP 192:UbFe910LiM23tf0TmABuOY8YqBPBPy55tf5N:mo9CW3tf0TmABuOY8YqBPBPy55tf5N
- TLSH T18752DF9F2FA57088C879B4273B4AC4B8196C11B192BDFAA4111F09C94CC4679A6FFDC7
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDA.png
- SHA256 7bf774463f63147a90ba64c96da491eb835451b1cac4f31f20a24916c3a25312
- MD5 3a35f6f58aa8a264ed26df136334df35
- SHA1 f4fb5ba6425c9cbffd0b0886411849b5b352e416
- SHA512 460fc73fd6562ec5ea10cc4d5dc200740f1ffcf63e8ec3dbf75037e8714a1f1423891710914b7be8e31afb76a3b5b321de977257279aec7936f4d562f382972e
- SSDEEP 1536:FwmUklB5OinPEHIjFycH+Zu5chrbWDBUv4+1HwiluaG:rTzmIjzWfeALqJ
- TLSH T173730254057C19A8CDE26778223913974D2C6E8CF3C901EBCBE57EE512929529E43BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDA_G.ini
- SHA256 b6b6b1f262e25e6ac63ba79d454d44e6436dff796e7c4d88032dc3af04520b03
- MD5 dd260f56cced7b21efe61d60bb7e11b7
- SHA1 7e814ac17d6a47b3335c3b98d2d9b0f1fcb43026
- SHA512 b83041c34c20f6a4c148a7caedac1a77ae2b9c543d82f36526088185e2f0d52f601bf89cd2f8913ce379668a5e786ed2be02147f209a22bd903d2d856849d0b3
- SSDEEP 192:ylbFe910LiM23tf0TmABuOY8YqBPBPy55tf5N:ylo9CW3tf0TmABuOY8YqBPBPy55tf5N
- TLSH T1D752DF9B2FA57088C879B4273B4AC4B8196C11B192BDFAA4110F19C94CC4679A6FFDC7
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDGP_G.ini
- SHA256 b3984941869d1d3ecc73d0637de252da9da7ff02ed75f8fddbcb1c262d846dae
- MD5 485627acbf6e063a4ae991b7e0268007
- SHA1 2b88cfd2d830a4ff15e1f43a7c9ab04400ba063e
- SHA512 4624841e68f4741052b169d4344d6fdfdcf206bd11139146fc37a793b98e6abab197e7cd848581dfe57f6c3360f5784903d2f1c48a875b38ce3b2170ed6b990d
- SSDEEP 96:29d6UV/cqfS0jZzPk2rItsdn95PJGXIeJ9Kfw540hzDdKqBqH/Ke6SVSEmSu7o89:OQmo35jecytLeIhUx5Z3BkaZqKFEiN
- TLSH T1ED32E2AE1F25B4D9C876B136271BC2EA1928053182BCED45100F0BDE9E88535A7EF9D7
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDigGP.ini
- SHA256 ba2b1d325b81a8448720da625cdab6b44940dfc6a943036e7a7a30f6ecb44521
- MD5 8229ecd9da72ef23734ad9be63541001
- SHA1 ab557ab407a9a0ebc0806dd03dee45d08dbac6ec
- SHA512 eca55a3065ffe49d6a53c410f82206878dfcbdc3c88c90239d97ff28e3c6535269a9fb294f37e97a91a91e4c3efb84cb6c612a793d2f3bb9cb05f3a3266024a5
- SSDEEP 96:f9d6UV/cqfS0jZzPk2rItsdn95PJRIrlA9Jkp590CuWSK9GqHC8hSV1bm1/7o8j/:3QmoqLEcWk2UKTGJWcJwXYz427MAG
- TLSH T15332BF9F1FA57088C87AB4773A4BC0B9196C117192FDB9A4141F0ACC8C80639A6FBDC7
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDigGP.png
- SHA256 902cd892ab95892de9068ccf071cf68ecd79ac6d68cde2949967317b21be23d2
- MD5 7630e7bd10d814f4f98df439adb2d8f1
- SHA1 7eb1cf5d729dd4d1db301e17007553921955ec2d
- SHA512 8de39d2dd11e9e4876c05696a0a36db82284b8fca1436a604d81ce83a67cb0caafb2706a95e8c56aeaffe653f36c8a4dcd52f6e09b7218ed0f056f55ca2a8887
- SSDEEP 1536:ooG+cu4RChbnuwD6HmtuOagUdhZW0f/xrMq/WbztGl6R6L76i1w3zeAk:eCx+GtuOuhZW0hrMMQy6R6L75TT
- TLSH T17D7302B9E1EAB5F0F69A50323F3B61A7F12B7241F18007D7C9194068D0ABBF05694BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Hammer.ini
- SHA256 a723b21a3b6e738e6b7dc2911ed01a002c0ba6365fcd130c6490aad426de3323
- MD5 4936fa2204b885cff8b6db2dcf27d4c7
- SHA1 b8a3005a38d02239a58fe9735a6c66571e9cd3b5
- SHA512 75ff5497f40706df8f671cdb7eef3232bc0d9436535d6e92febc54568a4e7666197e0c34ea009bf2192eb1a61625f1af7f2d918b267b73acb48b3e0cf476eedc
- SSDEEP 384:7iVqi3uakko3nc8m9+EZlwTY2wPqYFyARCRAIRHMJBQA78Xygp:2XTG
- TLSH T11482777F0E20B7B8F57E353D234A05EB262900E34264B1C3482E36F4E94B5575E6B6B6
- MD5 SHA1 SHA512 SSDEEP TLSH
IA3002.ini
- SHA256 10500180ef412fc24d2eb6a9542e1830d9b3f87ac74b7c690afbdbe451d64f09
- MD5 a094d1e54a0fa3888f93fe2c061cfa38
- SHA1 a1bde9e1058960d355f73598b0e1598dda6e9e90
- SHA512 46a0ea5b18075ae9830dd163dae90a4b6d2b3d7009834c5093d3dd96b76ee338c1d12ea6a12a8c13e511e7a6882e66d793928588590955b0ea754a279ae8f432
- SSDEEP 192:62imXAQ5YnRK/CkQcwpcFuhliquR0s3mw0e07SUCl+PjKS:625w2YnRK/CkQcwpcQDiq20s3m7N7SU9
- TLSH T16332457F6E86BABD11A53678370A84F7BA3451E60075F0801B0E07C29E1B745AE7F1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
IA3002_1.png
- SHA256 a58404be8d6c04e7b046a9fd54c5d23825fc94bd3b0e7f740fdf3020329ab76b
- MD5 b54d3bf03c0ef33ed4316106a936bcc0
- SHA1 9d47dd81c303aa545bbd7bd4124ccd726b3c9557
- SHA512 8815bf0e4e81f4503ff386ac4460d04c5b56f453b654f57332c4a1b4ebcbe1f1a7c91b7eb932fc5da75755aabd02fd34a3f106d193568df93fae913675ca3448
- SSDEEP 1536:mqs+k3/AAsaetVomywW0GWWlkOJlA5o9n5c9NNQfNir:mqsjAASXomywWQeB7QNNkW
- TLSH T1A143F1809553A7CC1A1215DC3BF26EFEC87EADE5222B9C644E35558CB1D073AC61AD83
- MD5 SHA1 SHA512 SSDEEP TLSH
IA3002_2.png
- SHA256 a8d7a0fecd335a48c9c75f95d79c8a7505ad4cb001b7a7139666dba4a812c67e
- MD5 f11e210716300d4b24ff52126951fb5d
- SHA1 bc29870f3b9fd83f77336a3d89b4d126fc44913f
- SHA512 e44043447e83118c1a3291d665315324f12c4ff1d10a16d658ca269209cdb0861109d4c556435247a1a27559244a2c6e3c66f79e8a5428aff3ae257b05536e0a
- SSDEEP 768:7ze+YkGM1l83NOJqb+6MXQQqqdyr8OF1NynVZITOi2QAsUzNG1Dl96J9KH85lii:6oQQJqL7zqdyFHNynXW8NnzKHUlii
- TLSH T1F533D04BD8AB425BFE9627F837A16EF4B67FBA31437904884710149DA1C0BE4A107F87
- MD5 SHA1 SHA512 SSDEEP TLSH
IA3002_G.ini
- SHA256 d78a310fae1037240c38acf4d940a573844341f24143a0c8e1454eb36c1e5c35
- MD5 c68e524c8a32c6ac0c4ebf07223c94f9
- SHA1 61942728ff7f13ba2e9efe0d4ca8f2670491b33d
- SHA512 bf55f39f083a17e10f3748d5b31e4308b1ffba2aa4477f253b5e4f68892f22b71134160f2096e262e8870480c8343340290b7655e9080f0bc5aadde32892076c
- SSDEEP 192:Jg5okEUnnRK/CkQcwpcFuhliquR0s3mw0e07SUCl+PjKY:JgGkEUnnRK/CkQcwpcQDiq20s3m7N7S8
- TLSH T19F32367F6E86FABD11A536743B0684F7B93451EB0071A0811B0E07C29E2B745AE3F1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC202.ini
- SHA256 425f87aa6a1f6b7b56509b87a9fa376552f71e0f125e44e7d67ce9ebcace1b51
- MD5 b13bde4d5adf2bdb72cf04de4550185c
- SHA1 c779952b9be141a0f984dcd645ab7127954423b3
- SHA512 85e8da1fc79777a5aa57566e5457f0493acb881818f95473e5149a727f550ea8fa3a811be91d7390522ef6fbd566dc363e0e06697a539cc068a9d7a7ebf56d52
- SSDEEP 48:llOatTQidSDej4WdzOGkdo7NiMlGbm+X7p67K8rF8rC8r/8rgZ84b8pXmNIYplz4:lthQidMszaePBEriW+XgVHP6t
- TLSH T19DC1A3C92F3EA24CC9B835542D2BD3EF5F600A3143CD7EA821050CD5DED6579219B9AB
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC202.png
- SHA256 a99f9822c37a3b7dcc56a7cc4f90ee251363f5b162f37eec7c3ed3495c66ebe6
- MD5 176ea571764cb4240d47bc35b36531ea
- SHA1 d31cdbe2586abbabe92fefff519fe3cef135c8ce
- SHA512 47acca501b8ee8a89df91492d39ddd1c8bee8c5fc82e329cef4fe074b98e09397afe16fca7029637f5b4b1d1e18c8555161bdbd0e1893e229d2ee4de4d522b8a
- SSDEEP 384:3ujJhFFaJK6MfguJKZqq614nE+tfFo95v6oxcB+LMEEqUNVWvpMSR/35hwpOYYLS:aUKt14nDtwv6oxcBeqVWvSuA+WvA4x
- TLSH T185E2AEA2E06F85A93A5606FE37A20FF585BF7C24A3F92DE41B10388E6584B557047E43
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC207.ini
- SHA256 31b0e2d176383519c2cd153f48b4730dbfdac007b68a04c2c8e94aa645ff9a6b
- MD5 2cf5c969394e8419d9b32f2ebafa334e
- SHA1 3eaa2a97532ddb3d44045d0e64daabab2a67e387
- SHA512 7d3086adff8fab1d7448a84c3b9377e2f8e5a6b30ec6ee3c15401431ab5e83622f6c0e8b3282decae6e674d87aa2c7c5a4c2e31d76c913e08b2314708d6cecf6
- SSDEEP 384:ub4EnwfDP/G3xLsDQ09ZdQR2pV0SO/1AWvzDuJ49xAr8LE2g:j
- TLSH T1EE52049F0F3974C894A9F2BB2B0A8095746D1462D4BEE580051F06DC9494539AFFFFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC207.png
- SHA256 7cb705bbe4982c6325fceba0512aa7cba2350b2fb5aa2baa10ab4b081072a441
- MD5 caca23d40e779fd9c69cda7eb15c1aa2
- SHA1 60d86efd64ef9026e3b6ac7515d4fed330f26779
- SHA512 627e0951e8ec9216042c7061d83833cc6efe147be2af263db135a52f8f6568049e39865520cc1743343562e41eef90170f123809fce54a9e8cf77952fc5679e4
- SSDEEP 384:3cJgM6fFybFncjYKcdxT6m0BscKF+kcb0Kq20y72a1+j1k7aAIeaKNxUFH34k1oS:sK9aFcjVcP63iIBVyLnhXubRP68i+Fqz
- TLSH T109F2D0E7C16F4A22BB5646E2ABE71DE9A17F7C34A3DF14C14A9354ABF040AF13180853
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC209.ini
- SHA256 eb03234b6b2565db9d2153b4e1540e46596385c3dd9b57113fdecb6bdb569f9f
- MD5 fb613fb07444c72427e8a2503a76ebd1
- SHA1 d1d4aedce4acc215266db06fd718df6437228fe5
- SHA512 d9151a4b77617d4c37c64618c2453542101317ef69e8a8663cb5bc05325a4dbf17106c6360b14cc388d3974c2865434e9116b8745db28787129939a921c3c278
- TLSH T13A81995F4B34369C859BB67B3B46C0EA1BA900B688FEB404101F15DD8A11D38ABFEDC5
- MD5 SHA1 SHA512 TLSH
LGC209.png
- SHA256 7958624dd4aceed4988caa07a504e965cb90670f9af7863341c7b17a2ec2dace
- MD5 dbcf48114205d5e11a34cacf4b82cd2f
- SHA1 712f53fa73b7031b480098c4cf0f05844cf8dc8d
- SHA512 5f55667df2a52811d27c7c0707928459297cc2793b458afa32749ff84bdf7a555e4ce51ccf25b13207059a41a17ec25236d227676ab1a6d92bc9570a84d685b4
- SSDEEP 768:xiPSxHP2dYOa74lm7WK7t7EcrDtPijuBCk0A27n:MAveLm7R7EAFCtA2j
- TLSH T1A103E094C46F82B51E2956F837001EF1D75F6E38A3BA0ED48B4474FAE1C1BDA7611A83
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC20A.ini
- SHA256 079e82ea2421a686a1cfe35b556132b09deac5c33ee0e9ca7d4a20b680cbc96f
- MD5 b4c63a57204d65ecc16587913c9b9282
- SHA1 6139e8740c59390db606b5539c120956ddd50c79
- SHA512 819821c5e8037cc5c41d415fbbbd2baf802480b04efc2e61199e71cbafe90066c63ec628d4a0f351b12bcaa24b0b760ea2de9e55da10f62c25b5dae985a2cefc
- SSDEEP 96:M7oM6W5KZz5HydUojBtYCw4TuO8Px7gtcXAWHwrw82eels2xzb5KKdU0ot2EhtYp:M7mWtPtmAWp8tBXTRvRc
- TLSH T14CD1EB5F893033BCF1AB727E720B42DE235518BB88A970A2216734F95717C6936F50E9
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC20A.png
- SHA256 316ce20315e1f97aa9c0648870f42225d9ffff5657688eabb755f7e6c388af7d
- MD5 88e1024eb1d23a2324f1ed6b003c84cf
- SHA1 212cadc2c71cef2889d4e8d33ed51e36962b688d
- SHA512 73d85293b2af38bcc12b74f9f32a47ff631788de815db49329c58296e2618f344af43c01afd9aef29d7d276655d25a0029a2a396ce4cebd71a4b12a120aeb2a8
- SSDEEP 768:E3tK1NjUpA4qM8NYgxiLyXKV8OR06jCkVJqkBP9S0:E9K1NjP4hyYgILyu1R06BVkGD
- TLSH T13203CF51C057EBA4992209FBBBF51FF5D27F786402BA5CD4135439EEA0403B5A026FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC291.ini
- SHA256 de95342dc49749cdcdde4b76984eba91668f67b3247cac2d05a1cb7ed692e74d
- MD5 21e468f47c022da870dcd1b34464f652
- SHA1 5f48c1833c904abe4dd566e9407f9e6f3c1eeb97
- SHA512 85480acfaf25ede5145bf662d756df4cd6c79fb5b959b7ba1d6e9db442a888e5fbf2d70ece33fc0e0634efa57d89bb1b032e66a0815bd82a3dc668fcb2868bdc
- TLSH T1B841C94B4D3037BCE17F757E351705EE170610AB99A4B082196232F4924BC5A3EA61FA
- MD5 SHA1 SHA512 TLSH
LGC291.png
- SHA256 65b7a8fbb6f760af81fe65c694ab8bbf9a2604522856f4c098185ca396cec82c
- MD5 a148633f9cf01a0c225ebae0964573ac
- SHA1 216d1c2a0a14994489352c048f6297e6120e6417
- SHA512 621d358c0b90f763a89e654037d30b3dd0855a0b1b04f830e9f2335e7bffbdadaa85c34ae17c71ef1e5a3f69febc011e1771a932a037b099f0f232b0b6d934d0
- SSDEEP 384:34YLheOBKglgqyDl5re83QfcXz6nsYq2tJ66/hywG2f03M7F/qPhZrRuhS1/Y/C2:BNBKgCNiwCqYsYZHJVf2M7EJ7uhSq/d9
- TLSH T1E8D28C55D29F80DABBA505FE3BD15FF8926BBC2117BA2CD4A750249E6081BE4A143E03
- MD5 SHA1 SHA512 SSDEEP TLSH
MS1B.ini
- SHA256 8d9272635ed38767d18a7f7935f5a5d1db654a526a32903941523d305570e760
- MD5 dd8d4a00c271c12f229b5aac8a79a2f6
- SHA1 003ba733b109912fc3bd4f16cd1fb53902dda1d7
- SHA512 2dfc8aa83295ce2f441a1283ab4e07ba7628537d03f74b961d524b62e564a05a59ed2b0c2b23f5d26f6fe58fdbffa797489855b6722ca453b121b9073331ca4d
- SSDEEP 384:nosc8MidbNYG6HX6iSbuZc6BKsaMaHqqi1KgCeurNS2jSeL:oO
- TLSH T10B52E21F1E7670C990A6EABF7B49C4A2306D45A6E07EE5D0091F278C5520638A7FFEC1
- MD5 SHA1 SHA512 SSDEEP TLSH
MS1B.png
- SHA256 9cf4196499e5d248ab78baec2cf5cbd9aff7db2f84c0deac2074ee7a6dc0a7d6
- MD5 5daf37520490b5ba9545b222ddbe5d9a
- SHA1 c8e3c43a46eba15fb081b3a4bd254eba4c3b325a
- SHA512 9acf69ef6cad1dde9f62fb5aba96db8f5f10a5862add433a05b5d4ff0ec16a038000cf3e57af25ddc7cd325a875ea7abebc8d087401dba7f22dce320ca65d68d
- SSDEEP 1536:EZjmWv2bqpC9bGOdQEdCfUVqcSq6+lqnOytfqIwmU:EZbp6E+qHAlqOykmU
- TLSH T1523302BE4C090BEB6061BFEE727E546531CA42EDCD686DC0085EE04A59AE53BCC493D2
- MD5 SHA1 SHA512 SSDEEP TLSH
MS1B_01.png
- SHA256 a6186acb6712d5d5775d0627048c7eda59000eaf7795f2279bd5761f3ffae56a
- MD5 cd7fe02631a1218c481c59c76f7fd8db
- SHA1 2906acb04c557bfdefba3ae9ed2bc55daac972de
- SHA512 795d7e2debebad2e2a6d596e193232ee7a494dd3d467c852c02b4e18e4bee843287d21ea7fd9c1c947886286df15277dd848025ef6a0aafcff4669e56bdb0d2c
- TLSH T1A0414C52A441CAB956DFB77923E10F05AC24E5B17C312024E8450C13F5E528715FF3CE
- MD5 SHA1 SHA512 TLSH
MS1B_02.png
- SHA256 d2f37ea24d23bbaff0b0ef66be9b29af37cf5c05d402b8c594185e3af4715ef6
- MD5 303d50981c0e70766042bfbe9058c4c5
- SHA1 ad5d55b6eb4d6d0e58cc1d8cd1784d6a66601f2f
- SHA512 5b2808e82ce2eef66bf24490017860ff642df77f04247ae152dce97d6c511c0f114c8f7aa4da414743ea90b61ae47b62f34692801f5d2ad0873877ba91f296db
- TLSH T19B01E9F91620AD65C1076D80923BB332FC3EC54C8847030028950023DB12E8D8E90F37
- MD5 SHA1 SHA512 TLSH
MS1B_03.png
- SHA256 b93c8829a96c1f69a7751b2d089780cbf11d79ab27e5d2507c36ee2ad740ef08
- MD5 d3e103a4ffab645547915858b0fe6c9d
- SHA1 fd7374c5f90a0339b4a9eb185558ee1932cbb8e7
- SHA512 a905e23ce116e886b8d1b8a1a42821f4d88d35971465a2053defc085b639824de6df273618a163565b8086b714bb4c1be91c1989e195fac2d82fbfcb89debdc3
- TLSH T168F096E767FDE51AF9B37F02054616B618581B81CE4D05412106C03DFE0B7C939E0198
- MD5 SHA1 SHA512 TLSH
MS1B_04.png
- SHA256 1f99db0a7f66f913774e61a334281b60333e0a231267abf3c61f54ce9834a8f7
- MD5 020d6f6e6f9bbb45caa1fba1ef5f6179
- SHA1 ca689caee8a2ea7b622ff39639e19118d42d9206
- SHA512 9cc0bb6196391a8efec322f4c704bfc7a11c5b9b2df5416150b145e7878c66c428ebd4ee26cfa534d84dab7a16cb3c159e32e82d29b25ae058d149508f4001fd
- TLSH T18F01C5A39BD1CDC885AB0952682A292ECD245323C63A0EA4F2C20D5EB614109E9540B8
- MD5 SHA1 SHA512 TLSH
MS1B_05.png
- SHA256 43c182a3765a09368e09e6da8aaba45ff47798843605a32672eb1b7748eef5ec
- MD5 f0359cf4f01f9b61f9b6eed337b48f6b
- SHA1 6779e984e3627ac77a4ac1b24248826f88b76f20
- SHA512 acf50f5d73c657473604230651388686057398d0ff47ab358f02cc08ada28e2ffa1cff1fc1912bf982005b70510716aa3602e3e04cd3dbfd6771f7df5414bcbd
- TLSH T17DE060A436BF0C27E7DB068210910BB8C0325D3465D61B042CF19CAE4CD74C4B516282
- MD5 SHA1 SHA512 TLSH
MS1B_06.png
- SHA256 b18af49a8c6949786ef39e40257f2d8c7b07339115155e591fbbda0321b4522b
- MD5 90454d1e72dc7112c0665cf28d5c0f8e
- SHA1 cc9b2cb91d7b2f9c627cfc47393b50adc3a9c5cb
- SHA512 ff5ca00c767a11cf00912b1694632412011e4aa354f3e2fd6a202a175cda9c32bfc0b0150f73ca5d2529ce48dfab91440b9c93f2d1406d1dc3f64bd6191e1644
- TLSH T193E0F1D9251085B4C712B116115320AAAA33466E69677E9D236008568D7E6C89D8C1BF
- MD5 SHA1 SHA512 TLSH
MS1B_07.png
- SHA256 83d3a62a93cb1eb87c4a17b38c72cd01a809d9712394a443d17e5a99a78dbabe
- MD5 f560a2d3775cc8e8975eaa4c64ada238
- SHA1 cb0166c2fb38e413fd43f15a0a9cf064ae672a13
- SHA512 8877fcb2ada1193862efae3d9399df9b91ceb32f02e80fccd24545d65c5e20a7d80a902ae220ae10cf57a4d8b5d24901e63b37566dc53e08726d9e225dbdcfac
- TLSH T168F041D31BF9756DC166485722C60CABB0131E3364924B6EBE08862CFB402DF81F03C2
- MD5 SHA1 SHA512 TLSH
MS1B_08.png
- SHA256 4837bb63409c66764a8bc0948018f5d0444edcfeec15ffd02dff4f6acf63c3b9
- MD5 2b8b9e116228d8b35c126c0957fcb9b7
- SHA1 13b68fe346a4cb3054cbaa233c3a4b69f9f8ee7f
- SHA512 0d08fae681e17dcca46c0e3b4f0bbd121eb826b01f969841c8e80a19346f4b95ffb39e019180f693583afcb6f162827b092605bc045a7a1fdf3a6f97a1e390bc
- TLSH T144F041EBD7C023C927892221D28648B08C7C8F45C94E321C1CA2EE354C93AD4C39242A
- MD5 SHA1 SHA512 TLSH
MS1B_09.png
- SHA256 3ed70ae9480385da00e1ad6deec38951be66fde063431170f6294cba52dc1d98
- MD5 ca9ca0b2774db7c44427a11ac2aaac01
- SHA1 e4173e6f546fdc4e44b7fcc71a793bc21ac66607
- SHA512 f4a2174c9d78570cd9bd43e5bc39748002732b515ff2320251ca4b031ceaf0fc794d347a36495268f9605a50ce85184380e6ec0512b5f51306037f7caa192395
- TLSH T1D7F02DFB63463B39D9A838AB7A28039B5A940445FF660A3CB33350498DC30A280067CD
- MD5 SHA1 SHA512 TLSH
MS1B_10.png
- SHA256 1868bfd5b49322eac0386b78f964ad3d649bdef6b479da46f0a91be5e840664a
- MD5 379826d9e4f7dc62b185e48c3e56c398
- SHA1 0b533c5a195860a5d89e75b3eabb9db9b61642c5
- SHA512 1b11fce8b23a9a1137eb7bdbd9d8e9dbdebbccb3e4e2be7e755c9c5b53abbb3e57c882d4c3a912dbcb4dd689e746d6bcb6d1838b9332dc96aa0742ddc52536c5
- TLSH T1E5F0628342E1B89EE1BC3873000A1F7B9E7089EE8A646316E322C4A594C9E81D8C4A1D
- MD5 SHA1 SHA512 TLSH
MS26.ini
- SHA256 7a9feab7e0d241ca420934e6153b5db4d2db8b72b113fa5d010a6a417f06cf51
- MD5 a0b84b5ddb4e4dc1973bb666a8aca7a7
- SHA1 163df8af80d7c97a5659b83918b755566550be6d
- SHA512 004bc5a6a2287dab279531ae7d62de08c0579ffc0b10d86b75a90389fa2da819b283bb538a26fd1b539e4fb2cdc7179f9c38f3ef011bac224242b3edf02a1af8
- SSDEEP 96:/vhLw4RMr8MrzjLv+DlgzbzxNXhpCI4kJ8P0gew4fam:R45HRam
- TLSH T1150237C91F3AA14CD87234103D1BD2EE0F50257127DE3F9820201DE65CE46BA26ABDDB
- MD5 SHA1 SHA512 SSDEEP TLSH
MS26.png
- SHA256 752340a75972dbf504e3a9b7062dbb7670ac16ff32a837f7f1e82c630e39ec58
- MD5 67ab9342fc9eb9da30606a61fcd32508
- SHA1 f226347193ca2d72b3efcf870a3e67041fd25cc8
- SHA512 bc40c14068af8294c6c8113f59e618636e9982c67ca7f348e27c813c800e0701e5e0862e6c58d5a89dea138c046625f0773b23e1927942b9add6caad22a9fb68
- SSDEEP 1536:Iwfk/BApw7wp4U9H/ux3DO7ZESUIJelI0BT:IRmAwpHRmBDO9ESD+I0R
- TLSH T11853F186F30B8C59A598504E8AC09E6C352769FA442F2D2667C2BCD47FA5338FC156FC
- MD5 SHA1 SHA512 SSDEEP TLSH
MS26_01.png
- SHA256 ffceca61a0538931b531a1edbbcbe811a31c20a16f55fa84d7ded97c2fa4d81a
- MD5 c5037809fb65e778fbf01db617b5897f
- SHA1 31d9045253b945ce0abae30e6be5ec373774adbd
- SHA512 3052f0f6f45b3ccd017bdde918d21dc5ec12ba347e4591cb7c3a19821f0d5a623c4a553bd3a12375ea0646a38029e47513041510c9adbd8406c89c5e7494f4fa
- TLSH T102517DFE1706056DD5D0EC5B5D60E08646787C3A841449351FB4BA136EBDD4FF29E481
- MD5 SHA1 SHA512 TLSH
MS26_02.png
- SHA256 73befde90d57a6b36b461932d83b76fd84946f823b031d4e65ac53620709737d
- MD5 74d918030cb20094bddd02e674e99504
- SHA1 7adc2be2e57c9138accac18f7967323629c94d8a
- SHA512 4d4ba11a912efc5d4e1805a64dad751dd27248ab71706f4e75724e572aeb3b577091503fd8fcc807a195995ffc972a6971ae7e805aac697bbd00e54ea123d968
- TLSH T18831FC55AE8568B0833E0757173A1310FF675F2084609127262A35B2143DD58E2EF7ED
- MD5 SHA1 SHA512 TLSH
MS26_03.png
- SHA256 e1aafc9355bda37cfa4edaa3c1f03579103e4aa1869f07a1233613cc19c6a4dd
- MD5 495d8ba62ea9c15ee2fc4a188102375f
- SHA1 ce04324de77a02747e088a63d60d59ea2bceddb6
- SHA512 135c21f701cb83a3d40047152dc470fc097c97e73d2527144a3da0b76507f95fb3af496372f5bd21342da02400d4eb41527a699bc48dd07672632b03fcbbc680
- TLSH T1B821DA56B4DCAA0EDDD7943E7B091D14F438DC0C13D186851206BC9EF27CD4625E465D
- MD5 SHA1 SHA512 TLSH
MS26_04.png
- SHA256 39cd128ea4f0587985349369ac7eed7aa87b857701f7c1c9c7dc8b360b245900
- MD5 5edcbf8467793faa3ef7614b5c405447
- SHA1 92fbdd9e40aea92b59589085f6af0c955c04f812
- SHA512 83ecc14ca168a07df958d2fc4cf709379d292fd7e48e37b865fbd88a51f16fc74c07e783e7407307985475203f8dfac0175a31e2c510eddf4bbce2b4ec435bcf
- TLSH T13421B9B701883A559117A5D2B8B45A55DDB04D65A9F090B9F3DC7B91603FD30031B44F
- MD5 SHA1 SHA512 TLSH
MS26_05.png
- SHA256 5d0c5a14a4621b6120e632166eb55b8d73a81c3dec9afcc8a43a339a8b512e6f
- MD5 1102215157388c178f034d4f1566eba9
- SHA1 651c53f3a9ea9f07b37fff22ee54ecc367d5b9db
- SHA512 2a7b97446cf6c70c69895474733487dfafc450b78091e37c729258779a5c6c31dd07f69887fe72d38508fd24e1de361c2d4ddc5e1a6086a0434e8ae6cbe2d899
- TLSH T11C21C6E47100FA6ECCA21D9075B2CB0C1431AD781CCA842A6F4938746CBAC39D09A5D6
- MD5 SHA1 SHA512 TLSH
MS26_06.png
- SHA256 d9eddbc7181a65f5d10f8e90f8b1734e2092964fb86b8dc4fb54e6007b9d6013
- MD5 a7547e8b2f1b102c181beb8d0e2cf6af
- SHA1 dbd3c15cfb64986a510021ee4d5c81cc3160dad4
- SHA512 608ac200552444c36d5ef6379c277df6c070243b9dff7cbd6a64fd8f69aa038915c3cdac3ea4a4fb2aada6cc3f0ee188e849f8580aa55e98c654d3f8d0b08314
- TLSH T1C111E957A071895C0F08BC3849474C14B78FBE2D528AC0AABD9736B3387FE790424147
- MD5 SHA1 SHA512 TLSH
MS26_07.png
- SHA256 4613539063142a41048d99f58f3d7f097923fdcc6c96474938079250291cd767
- MD5 b9ab37e35b23258018fe5b063eed4246
- SHA1 2158912e4a816d45c7f685488ea2689aca0827c3
- SHA512 a6d0030be7660c3e746554677448b7cfdb759c498d7734c6c68eb9f0de506a03d8ec587eb60b99fa86d45127b5c376afaac8aafbb6ac34a638868f63c3e0ba32
- TLSH T1E2115412BBE0982FF51C03A919FF10A59CC45F292521B5439C25F57347BC28B107D207
- MD5 SHA1 SHA512 TLSH
MS26_08.png
- SHA256 14e9925a703833e27e70fe85046715f811821d212bfd553dcaa1883c5011f113
- MD5 fcf719597f25d7ef318f8e25152911aa
- SHA1 b86cc0380a8b4add245d5d14f9a42376eff90ac7
- SHA512 e27083f5c4b4a8d953bde3bd18e9bf4ef85e10354d4cb4674060990e14887929d27805ab0970a1c12635f5c2036db16d387640628f2bbf36770cb262c82ad612
- TLSH T1AF11E63CB006A97CF5A1786CFA894C023F481C2990D3204492A5FC249CFC1A48CB23AF
- MD5 SHA1 SHA512 TLSH
MS27.ini
- SHA256 8209765e68f761674e82f7e87ec2e08c7ca1ea229a1ee24168e00368c4e188dd
- MD5 61bda012004b5d587133afd04f82cc85
- SHA1 b48eaa593af3f605580fd8be42bd0089447b91d9
- SHA512 4bf1a510fa661455516ec500e6d9155e093db86f5b266e81b7c800646fcdb647930e70f631e1d056a297f420723c53cf83d9f5d6b24b073b5ca878575abebc0f
- SSDEEP 96:q1y6MGb/woTWV4jbMlf/ztEvifnL17MLyL17XL0L17hLTL17KLZ2L17NLkL17oLB:x78oCIBfN/qD684D5nM
- TLSH T166919D5F0B7930D9B5D7B12B334680A62A380877C8BDA49009AF06CD9D1163DA7FBDD9
- MD5 SHA1 SHA512 SSDEEP TLSH
MS27.png
- SHA256 558e50f1a9102bea5f7dcbbf585d4392e244ca9af0f0de3441ef61fb86066a57
- MD5 73b92d93ee5e6fc01a3308aa2aef6148
- SHA1 0ae0bfd93d30af1078fab02739984d2515ef46cb
- SHA512 112a26fdbb7a0d2154cfd64872ff4074396fab98b59fb9ac63ba9dcea1f57ebc71d3acc513a8e6742590884bca21a55fd472e3f1a8f9d45dbf96ba10c9190044
- SSDEEP 1536:/zzrDMD3VnTyCZRNNNtxIp7InZOCQuhMX08Ks1lxmjU2/GgVnA1G:/vrDMDRTycxiInUVuOX08Kem42/5VnYG
- TLSH T12253D054E631AE3E0EE44DAC3F92C8AD2984155ADB6B0F1477A18F40FEDD34B38146D9
- MD5 SHA1 SHA512 SSDEEP TLSH
MS27_1.png
- SHA256 028fd4ff11924c2fec0fc58eddb0e9f28a597cf704a1a09f893cf2abe273b762
- MD5 648c89f1454e9f4803e184b4c889f478
- SHA1 f2c0575009cb4b45a5f8ac5a00774808be818176
- SHA512 f063c0dac7cf55d5a5f113fed651d15b7e217698208b13ec4ed7af2ae7bf7e0b5b6169d683f7a2e6884a5b5873c55c70e61bfd1ac360c85dfc0d6bc76553eb56
- TLSH T133615E40F9DBF02F877947EAA5A503C064E00D255451F8D74E4EB3511335B70E7E5D0A
- MD5 SHA1 SHA512 TLSH
MS27_2.png
- SHA256 ce44eec7fd195d839891e152f418dce15e896e9c62fe706bc605a99f060e184e
- MD5 7d5870bad2ca0df89021cfc52df6b795
- SHA1 5de6f2840a47ef7f3433a7d31062b8403c46c0f7
- SHA512 60c3a582de8fc2ba3876f53151b71888bece64a60738c774928c45fbec34db2c73040ed3cb84bedc234833c5d883ff00ae9bb5bedf829701395d828d9ecef52f
- TLSH T14921D6DC1092E59DCE1AD2B8E6423F59A8224D0E462B8E2D6A18B6359EBD847C510386
- MD5 SHA1 SHA512 TLSH
MS27_3.png
- SHA256 51c4120a443c9b569faadf6a216276a6f7d95390e346bcbecb00ff041cd59b1f
- MD5 4edf3fd9dcb36a54b84c194cf544c41d
- SHA1 bcf58724140560262fa59258c75134f1ede86737
- SHA512 10999c32b9fd1fc729445155b159f434261dd5beae2e22240c7c3b491df9aa8e4a88c5d317e59c56f25cfba4a7641a3a287f6cf31e20a0ef64d66198b3d092da
- TLSH T1EC21D588624470588A9F11F6B7CC73AC2CAC3E7689E48494F67D7E35807D6CD0086D48
- MD5 SHA1 SHA512 TLSH
MS27_4.png
- SHA256 a499bfbb17593289a266d20e68c059be139add1bcd589bc49d620ae4b4065f2a
- MD5 eff1fee2e78d9d842f4432a47e97ba04
- SHA1 79685398ecf02fea1cfa90768be640ddce2f694e
- SHA512 f2cbb2cb1bc5da40f8028f3daa856078bb1eb0c5d48c50d45ee1d8d697f17890c89c8cfa2e22587634d006e67393b923c8ee3fa6328369c1a16eb7f1adb8c7ce
- TLSH T1EA21C6B3A255D14B15AC5C90FB892974925F8F15A035E52CC8CEF81C493F78048EB302
- MD5 SHA1 SHA512 TLSH
MS27_5.png
- SHA256 cc16974940e8dfdb41eeb863ae0e762ff38f890cd29c760aa8e67b882d5bbc27
- MD5 9422ab118d09909207e3cad08cdd331c
- SHA1 fda6c7ed94323c9215ffc052a00d7c3616fa8cb8
- SHA512 c81200d3c7aa74d107d05ef6753ce082374a8e0097d4e51c70bd876ee07d94ea79a4738c2e9db825b13a078cb5899734ab3ca78f3dbf903b44c224b6773b83d6
- TLSH T1F621B6EBA3F1E40EB5A32608E7220D4D8DF42D3809593A09150975A7AD3594A4E1C30B
- MD5 SHA1 SHA512 TLSH
MS28.ini
- SHA256 26aeeec2b294da0f38f4e17bf1b83f171b43c4b7d9e6c573908c6d3e6be87e77
- MD5 9626aaee7055048b8f2ab4d9dae14535
- SHA1 c79ed983d7f0fb5c67c8c07b6a4b4cfa3183c45b
- SHA512 6943d5a9ea10350a21ad890ea5b29f1c7f89ffd5798ae1be1ee5505f734e0da566a53e97f5ceaa45152ee7fe548dc271b86f39798deafb729e9160c0519f4484
- TLSH T1F361885F1739369C810B717A338780FA2B6805BA8CFDB848644F01DE2661D7477FA9C5
- MD5 SHA1 SHA512 TLSH
MS28.png
- SHA256 40bb262137fc58cae19519502e8e0f54ee0c1ea7105e725c4e2af1da4cb567b9
- MD5 76d6e896af57fb68ad0248e68389bb84
- SHA1 9683078d4ee9ee20232e29c94055870b877dc9a4
- SHA512 2c382ec0159efe0196f12c43f0c4c2d08110cbb96c440d8e62cd56ac820e4181cade396e1bb34663b6719ff689aa1389c61a46622e657f49cec039ebebe83e03
- SSDEEP 1536:FyB7Pakag0otsq0PDU0/3LOTFUx5vXZLPzW3RmUN6gjXf3VZQ:Fy4B1ryGbXRPzW3MUNbjXtZQ
- TLSH T1A963F1E4D321BE3A56C24F4D3EA3C8FD5D8615458F071910FB66AF10AEED21B3A140E5
- MD5 SHA1 SHA512 SSDEEP TLSH
MS28_1.png
- SHA256 f2532ff40b92ee29cc40c493c01213754ad832d4b4946a57119125e87fad0c87
- MD5 941e9b92ba33340d850d98026f81e94e
- SHA1 49c14658b73f025243971e9f228de2772bf50ad1
- SHA512 8e7fe385d81183ec61b48127b4f22c7329dbc68433179919e198937e794e19cfb3353067b4e7697176d4c574ce1a385a380dda8564991d4da5f74aa714021e33
- TLSH T12A0175D2D49A2A21C756CCF1156580390D791E9F5683EB07B4687C5CD43CB8057E4190
- MD5 SHA1 SHA512 TLSH
MS28_2.png
- SHA256 da00768a714154c1b8272846005736e0d2f5744e2c9ae85c3d046b42ea27d874
- MD5 d25057ec93265361cb4422704cf5a777
- SHA1 01f9df14d15d55b151844c158553473888aefab1
- SHA512 313c4eb373ab096eaeef98be165c29329ec7585ffd24c1d77ef07920f520de36e9eae14af065870a5d914e92909fde637e35c14667ac372903b267a2c6bdc3e2
- TLSH T1DF118873F114265BCA8D17558D1D15316EE58E0D25C0AFB82744B528CD391DD9426397
- MD5 SHA1 SHA512 TLSH
MS28_3.png
- SHA256 fd0404d5d5a1042d7930ce62a2f48e5c6f73e7811ad892b3096fca4429244fa1
- MD5 0be6e65e38eedca6293c05617320ec6c
- SHA1 a64bea3a89a0a7496891b9e66d307c4860714e4e
- SHA512 71606a3bb56c6402eccdc4171b6d592591f2c2e1c2e152c15148bd9ddf0666cb9eb7ad17bd25c5bc2444bc7b43170761b5dbeb5ca461e7f9f593bffb5207595e
- TLSH T1491163C522E5B2B5CAC502E12383CE11DE074E0C2B718649C289FC1714382D2806B399
- MD5 SHA1 SHA512 TLSH
MS28_4.png
- SHA256 bc8b7faf235f3e1d2c2c2b2057ee55668ed357224be64bd20755a69adb4817fd
- MD5 3114c453826aacc22f324aa0564e8ed0
- SHA1 7a4e7e15f5c7a0850724128a6dd881e1c9a51413
- SHA512 28f0e462ad055bf2d653c745a8fb9d1d0fb46cad3567114c0a5fd29915bd855d1c79a87fb366f39c6894b4becb97a2582a60d9ba3d9edcb53723b0817c13638b
- TLSH T18F1194842DC2EF56D50A49B86B16E5E1AD000C090D60EFCB9808B9769937153A64BADE
- MD5 SHA1 SHA512 TLSH
MS28_5.png
- SHA256 335d3ee9025661f7789640a834f1dead473fd364b1938be43383ba4b84af5f4d
- MD5 996b6bc98f9ccd77db4f437f68c4a22e
- SHA1 4e110358df6ea382076326f1980fda140a9a9aa2
- SHA512 0d983138cd4773beb16e62097e094d0a28957c4035f4511fca6077136016c897824eee573c414212f003754ba056a4e3889ea2194d543310624a669ecd110aac
- TLSH T12011B59CD5BA8D5A493A52C6CF83B32478E16C0468F3A010AD54F52B603D60AFCF0AE1
- MD5 SHA1 SHA512 TLSH
MS28_6.png
- SHA256 07a5399e8f11e0678b88e34f41632e4e347d1904ef23e485aa9c4a9f80122ea4
- MD5 c9c2783f5516396276745d0cbb417691
- SHA1 a94fef86bdf4a33d7970034297540cb5adb07e9a
- SHA512 dfcaa18bb6c5216342d80ef76a43ae21935136e05dba3881d75ee87dd5fbc55f745a47be5a05edda9059fc73315af8c0a7f2655df4abb77f27db9663946a2e10
- TLSH T1A1219353C314B821D85A9F5422877A2D45225E447C80A3DFA51C3D768BB66432B82B0A
- MD5 SHA1 SHA512 TLSH
MS28_7.png
- SHA256 33e96aba75cc0284d4dadc9b407810a717fe2dca54daa6bae1dfa9cf6ec6916f
- MD5 4a53d451b5a858c20985282c15ed913f
- SHA1 7a4ab80e20f525ee40b8c4dac7b6446ca3d3d10c
- SHA512 bbecbecbd3ebbb39194725a417a6b87856ddd12b5c436d3f4553e4f163ca15356bd40e4048aa9b816cea39192574bac82c854e760d2ff8ec3697fd777127e14d
- TLSH T18D2184D2154083BD9D9D81F85E17C89938691E5E2C2FC316160CF599793AA09C12A796
- MD5 SHA1 SHA512 TLSH
MS28_8.png
- SHA256 2aaca7b9d072b7e724fa7806e351fc2fa2b8c3733d5b0e8c0584b4ec2753e5bd
- MD5 65162b069a1f212d12e61076a8e3aded
- SHA1 97e75501862f9452450482fea0bae4e0bbe24084
- SHA512 ccf51630d8df4a3a0b7524fdf74e7b0b052864576b7c9245b735595e5f64b65ed73c8c5821a81d39c110236059400a3972c16a1ce765a389d353f704e32794a0
- SSDEEP 96:8uszmoFgnCzkTnbv2qcsiZ+xRlMHeIax8IU7/BZ:8uboF2bv29siZ+jmWC
- TLSH T1BA918D639272F088A4DFB0914881499DB97107F8D478F4317807B9B2313CD4EB86790D
- MD5 SHA1 SHA512 SSDEEP TLSH
MS34.ini
- SHA256 9730d685ba1ed46d561209dad8c7c0dd2abd167b1d9e21d3d7b938377c81cca7
- MD5 fdb35edd8e21e7ef2993e6bc22546d17
- SHA1 919a8118bd25eb409ea904fd3b2025cad4f889dd
- SHA512 5da6c75eaf1b81fb58059127089394829074b8bc61853dde836b20f04871694d8a5f2b4522be4486c523e9cb772b77ab1fab4062ec3654b5c97562d7b60f6e17
- SSDEEP 96:8HSYv01jtz/R1DosXZWB/NqyDIsNJy7qpOv1xCtOT3BvqBIPqIvyhWIkT2Gsg127:4pJyGIv1xCQ3l7KhXLyi38RM7
- TLSH T1C3D1AE9E573A3ADCD417B26A324B80AB176A14778CFDB480182F01DE2A2197477FBDC5
- MD5 SHA1 SHA512 SSDEEP TLSH
MS34.png
- SHA256 37e91e01caf3864054f13f07cc779029687063b48f3834cf44f2918436df9fe0
- MD5 d1b92cb9434cff56dde64ea44ae691bd
- SHA1 3fddf253d875476c5926c6291c086f309768bda0
- SHA512 6ad7aaac5f35b4374c807968aacf47655e13c356b5ca9dc94733e93637cf10c92c71286f5b4ae09ef0d6c3f96c5a50145a0eef4380c53396d74b1945c2b11722
- SSDEEP 1536:Qxe9bGDcXb/Vy9CgBWk38EGOdupyNUhtpQA1Uz:7icXb9pPkx7xEUAGz
- TLSH T18843025BC351E79C7A1796F3D697848881FA1C1207AF0CDC02801EC7EA45EE6621DBCB
- MD5 SHA1 SHA512 SSDEEP TLSH
MS34_01.png
- SHA256 3afea7013ed838c9db2716d24fef8ab48224f496cc994b16f87d8b991f3d8cee
- MD5 adef04e0fd11169c76ccc99419c61ae9
- SHA1 3362a1c971858faa88bada4ea400ecb9bfb3ffe8
- SHA512 35da7cec0cf08d0c034c1ec57b842c9795a8ad304a9e857654b36e6a90775af0d429f0443d1bdd9e13ad442982daf19f73bb361cfdc89930c9d27769969a181a
- SSDEEP 96:flmQ0a1cdMxtMwFx8C1znHXQXpZ68dweQ+L/fNMXrvsw97c7vDxVM:fsVfCxF1HX8pZ68cC/fi7swAvNi
- TLSH T150A17CBE40EB00C3BE9ADDE89780899BAA71FF7F0B4A021D1144441915F58C992A0BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
MS34_02.png
- SHA256 8af9390be5a6b935b59b3158b4b6bfb060e8b5ab03170b01d192a8c291af9bd5
- MD5 871773f364edaf43b54d317b4d4ff05e
- SHA1 88a16841cca60cad564bb7a4c254be5c07e11a90
- SHA512 8efc283751a66e47b643a2a674c3df48d92d65a84ab6080f999ebd09c1cc363c841af2e2ec1baf21e7a6d3e4337873b9102698acd189a472aa560dc2164e678c
- TLSH T15A613AAF2A21547D6F800E78C94405E5BE8D4788AFFA5C0DAA344847BEAD8C012DD2BD
- MD5 SHA1 SHA512 TLSH
MS34_03.png
- SHA256 33204f34e250e08d3990e8a15b954fed0657b7701c3e9d96bc6d6dde4702bf85
- MD5 6ca136338b1a53550d67efaf63ba6ee2
- SHA1 15f91a5cdce3665dbbe5fdccc925efd9a5831498
- SHA512 40c32bb9f8c31589829d164025dbc7f0d0615270037234be9dbc7a08ad260ecfc4aa83db30e12280a7d66cefd94b214267f88946668498773e100a6e443bd580
- TLSH T145F0479F1BC09F38C60C6B7153149E51F4B70F8919F64B9B4F3999E52E5135114C6351
- MD5 SHA1 SHA512 TLSH
MS34_04.png
- SHA256 54cb71b42aeacd3c613d8c78cb9a9f38d0a8cfadb2483da84fe7abab51902879
- MD5 b53c3953169e6c7ea3ac3302a8874a73
- SHA1 907cf4b1da550d75d3a3af48fe6686b779cc52c4
- SHA512 a8a61e5f6d1a3813c2d45d9f0994f4cac7a70f4e2ba69fc8c9048e53a06b833887fa2cb9449f65084f366c38ebc594304d5f6b5d95823a0e2369684977180a0d
- TLSH T1C111C844E488C851E40E293939963CDF9AB6480B47A916423F025104CBC37FD6AC53C4
- MD5 SHA1 SHA512 TLSH
MS34_05.png
- SHA256 6c2275740bd15478767e2547f755aac86b5973d97807a9e318a50a2289330618
- MD5 070e962a217453852a9a8d09f8cf9162
- SHA1 a6c40de21c0f0562edf42db4a7ce23e80cb6545f
- SHA512 c2878521521abc5837e8d0c5ee3d062a0d398f6b06856bd7fa2273fc8025adc89fe6638ddac5039d473b733adb42065c9013ba9e254729923f0a7cb9035d3a91
- TLSH T18221CAC896F99131E8743286619E4626AC2F855948D382577F371836EEE2F53044C7F1
- MD5 SHA1 SHA512 TLSH
MS34_06.png
- SHA256 0adf54dda35b7c5cee03b4557e0c7598a3a6bfd29a0e934ed4ae939b0e9fd819
- MD5 3c104344c40bf9bd7075392a229f2383
- SHA1 143d193cdcaff4df3a68bb1f1a999d267dd521a0
- SHA512 8f9535780efc98650cb089f8c8a516c82d0156a5cfaf927afa88cfaa421dbdeab35d1a0c8e5208721d482a86dcc59f3133a967c02808c3c96c193f15d1c04dd1
- TLSH T148F0E1C1D5C9555DD5E84915B53B0AA3F0526998790246B9F50D88FE5E40075E163F02
- MD5 SHA1 SHA512 TLSH
MS34_07.png
- SHA256 1be7577f7d7365ae3bf4f479ea90fdd5c626e782035a27f292abf1fc5b6aac02
- MD5 4b79b87e555e7fc65c2fed4ec4244c07
- SHA1 af4545e8cf1aa94991418f238cfac5f82bfce54b
- SHA512 6d0f72e9471cc8489a803042020d89d1db5061a494bf01a3ca0cb269bc3ceccb124665f827bfd0db4c09e2ee37793ad7535bf62a8903cd21996f3ef650f40db2
- TLSH T105F047D1C182A85B9574140C44491A55D3634AF7F6D336E7D12AB8341DC35B9BB04711
- MD5 SHA1 SHA512 TLSH
MS34_08.png
- SHA256 a19347eea0d56cfcd2400ce87559e263420251de67ee452b51263005df23dea8
- MD5 6fa6e9aff4f37bf66cf56d4cbc0c1609
- SHA1 0187c6ab914af176a6f3b97c7483e3c033d8bad6
- SHA512 4ccf027effefc1d0d3191c1f5116cfc73569ee9c7769426553e9994542afb92d5dbf876e70e1c0485f78f89af79d5b83c5989226eac7d54c26a5b5f151093196
- TLSH T183F00C8FC1D48E7A89CC41D816CB9191F4B3010AA555551CA85FB62299B2E85218314D
- MD5 SHA1 SHA512 TLSH
MS34_G.ini
- SHA256 fff555b12942e6fba029f144be31f1a0d43573e98b3e197fd68bee945c55d1b4
- MD5 7e2af9bee2b0d1ee10a237731a2e6c9b
- SHA1 76ca0038b1e158eed46cd961e8850affe2211adc
- SHA512 225e88f05ff372283ed7dcb1dcf40f8f8f13b23f77de78bde30ceddff507f0e2268a19420f99e7085b0653c91be9a9b8c039a1a076f9b787aa76839a9fd1ee98
- TLSH T1EA71D09E1B6935C8D052F6AB334784A3227A14ABCCFD54C0182F068D6A2063867FBDC9
- MD5 SHA1 SHA512 TLSH
MS3B.ini
- SHA256 a0566857ba12e8dac5a7bb9a6c2f40ed891427ae564f804a8c56714a273ea03f
- MD5 b78e90af1507b7afa4c669e4216b9899
- SHA1 737f5244065b8818a83bc316e61f0930e322818e
- SHA512 cb40a0eb0e06c5088a57a0837e6abc70c99988b64515359ca208f29c7ceae50b0d28c1281bcfe67dae0a2bdc8a06131f0ed0c74dd2dc31cee8df354c64b407bb
- TLSH T105418448173E259DC1277739308744F72FE124BB8CEABD49586B08EE3661A313B690D9
- MD5 SHA1 SHA512 TLSH
MS3B.png
- SHA256 2ba74c876be7e2670e9bb71b62334b39fec2b629cc6ea80721fbbaad1f27b5e9
- MD5 f0e8da1fad8c5f3972cd0014d90c1565
- SHA1 0a53206dcdb59708e6920a11ed7b619ce89b7c69
- SHA512 18f02470bbaa4a09d897476f1f43b6978ddeb4724e6a1629a1b7a8c4afe8f1a2a5d2a7ade97702dacf18b6d35b1e9c0accb73744f0bff86734abf8d2a737728d
- SSDEEP 768:i/42yC8l81WlrudXTXPqqLMnKuwUVc+hSl6Kbw7UFljH05qv7:i3N8sWM7SrKwm+gwurAi7
- TLSH T15513D08AC46B862E7D1605FEB7F12FB9F06F6E6073DD05C51254A5DA3041BC8E11AA83
- MD5 SHA1 SHA512 SSDEEP TLSH
MS3B_1.png
- SHA256 a34a561345d915d1a23928267f91caa2a1fe1c04d9524e0033a53f1adbf90c75
- MD5 e05370dfa01ee6b08030f6e44c1b1fc3
- SHA1 4bb1073ab8c4ea8911973a1b800145599f6f51b4
- SHA512 672f3218720b55d70aeff8088eb7d2378c2c32c0239fc06eac494988ec4d69ebf53cce68163c90abd524a1f3255d40ed7bea55adb8b2f6512706a7dfc1e33d95
- TLSH T141510AE1E201B868690A0461B60AE2EC61E31D746274503D6726B565C777BB980FD3EB
- MD5 SHA1 SHA512 TLSH
MS3B_2.png
- SHA256 49ced83d69e35115499c6bafe6572245d4683d07fb6a022511d70fe7f8c68d74
- MD5 d2ed6bc530aaf5efe0d63c80dfcb4f73
- SHA1 fa3ecd78612850405e7633ebc818349883acd819
- SHA512 b3586fb007ac48d4f92812b49f300442afc246e85a633f8391e69115b6700414968815396afaf00c0e5cb511f5bbb88e80e48cb04a095d94a9454bc294abcf4d
- TLSH T17B512AF6A4B1DCEEC98D2AA8E190F8940FC81D96E1541C0CD58871A4AC36B07789C6D5
- MD5 SHA1 SHA512 TLSH
MS3B_3.png
- SHA256 ce77b1b83f497abc028a8ee604e62848c17249a886139e085b013e6cb40ee4b4
- MD5 a81587ff7a0d8902df5c98cec14dd6da
- SHA1 ffe14f6fc0fba91723d75f75bf138f45b14e3a50
- SHA512 a686fac9fef5f416166f2da3a290c2480009183f8e8b0c534ff32c4371e770b2d559f0b441588a1068f5c45e9ac04b981635dc5124cc6c2a820cfeff1e43c177
- TLSH T1A7414B524F1E4E5BE85617E77A204E6BAF98CE9708637A60EEB4F225003661C1CCC765
- MD5 SHA1 SHA512 TLSH
MS3B_4.png
- SHA256 fdf05ef586988a54658de71548dc40b9dbf72735188346a688d38bc41994bce0
- MD5 741d5b186663a67975f3ca67ede70e12
- SHA1 e345f9a57dbde4b31370249de9a1b95f13e1b2af
- SHA512 4491b3a61c8687d8a847ceb843f1014b87af5db9963144ef60f7884051a600b89519f01334a26471d58393734d5169161edb2e9dae6472d7d560630e8b474425
- TLSH T15B415D06EF584C19CE5FC12036F6E80559A05CE7987CA1CD470E782A13FF681C3E6107
- MD5 SHA1 SHA512 TLSH
MS3B_a.png
- SHA256 afdfc6afebd04bef63438f64bab07895bf26a44972d2a4ed8856c4c4f118e9d6
- MD5 f59ba9c1a1dfa6a82c9b5e5a1aa41020
- SHA1 e51622289d28f9cdd9fb5a8166c5845f32244d30
- SHA512 d8561d5c037bff014eeba84edbf8274446a8dd51c55ea5f40d804faac938d45e6a9a503d1b3d258a862ea166f8573a19db86567d8d265c1f4cbcc014f593d4ec
- SSDEEP 96:n7ZfPrhL2R8eMeiLFYcFnhyen7swqlrH5H3NuKYxu6ChWf:n7ZnrhL3/TBphy072VNuKYx5ChWf
- TLSH T158918E9701D5E078D801A8942AF77E12E71C9FE455F7D80B481372CE8D3BFE8166A047
- MD5 SHA1 SHA512 SSDEEP TLSH
MS3B_c.png
- SHA256 a149e8f2a7920225a53eeebe82a68e0fdfdf41502e70ee772c1ebbf91f445486
- MD5 8be8ff94dcff80dc4fa29c500099d9b2
- SHA1 eb67cbc97d0690ae1fa43e2ae9a01cf0ca7d6f5e
- SHA512 26f294756062ebece1df00ed1380ec52e278539ea1e45614453166997883a84e5fa6c666c94c61ba39dfbf482f81d2b3759467abf32f6f5fb23fd15a3d86f65f
- SSDEEP 192:4SrHxCmUSB6o9m5RuD36n95PZocfDy6Dh2y+Ioq:DrUZSB6SMQKn95PfW61Teq
- TLSH T149F19F1265E48A11874A3E9108B161A974730F02E72EE13D9BAFB8076A7F70E4DDA721
- MD5 SHA1 SHA512 SSDEEP TLSH
MS3B_m.png
- SHA256 08fd13231fed79786744a8bf04b2cfba8f5649cbbe39f4c8060f8d9304a503e1
- MD5 4072fc451249b7679065741646a59d24
- SHA1 4d098d1cd121ff57f91ee66a6f9b674f9073078b
- SHA512 23829f26e466322ed8792f775fd1bbd4192e161506839f5c4dc937341ad3f3bcba5ef3d67a03be7558d0dde5b48e8ce00e3ea45b2c6218d7eadd2ab32b64ff3a
- TLSH T10F616DF60E5045F22256926980E3E27C3F772E100BF72367E46672ED943D94940C659B
- MD5 SHA1 SHA512 TLSH
MS3B_t.png
- SHA256 d4d62360c1c712ae6a5bba55e574b290d9c51f194b5f28b65f8f1a1628715f15
- MD5 f637c77f01d40c56dbb2fed373cb3bc3
- SHA1 ec310db383a8bee3712f2bf782a9a52852945963
- SHA512 d62833979fe866bd233dbb6359de44ee540c9857672e9cc2ea1b15547f0f375c80088e0f92be7a62efa9892e8acccb4f6914d5c51aa6c52d9e82a915d603e8f4
- TLSH T18A715C597BF0C9A0E51586F134C3AF30DD050E5F844CC4E03E4ABF0358751F8D099628
- MD5 SHA1 SHA512 TLSH
MS56.ini
- SHA256 272364ea344ea3a5fded6e57573aa1b121c268bdc6b93f6f8ce056022785ab26
- MD5 1d3b572d50f1f9d8d47455704db965c4
- SHA1 93024c801163607dc7051123488a3578901df522
- SHA512 839dcccd77f74bd92c9e3a968182b1ec5136ead159c082bf07c97054a7285590146a0520fdf77d934e8da905c82ce07246695a3b09c7c4d5e807aa676a8d3ff0
- SSDEEP 96:4yJM49Iy0y1BtDq5AMmz3ae2x5l20ui/0XRx0tMl0Rv20SS0rNQ0WX05F0t1:wgnPcEFMbBshuGS9bgRF9Ev
- TLSH T19BC16B1F1E3634DC9056F2BB3709C4E562AC09AAC4BDBA94085F06C86561634B7FFDC1
- MD5 SHA1 SHA512 SSDEEP TLSH
MS56.png
- SHA256 82bc4b094017cca2f32831406bc37897ce48e0d594ede0d99c57820f50c28917
- MD5 ab73e4f582d36b153ed92f6a51d6ba80
- SHA1 e8a3d290cb81641ebf49b39b307ccd07d17f2ca7
- SHA512 4f83e02c9ec195d69fab3c873737bcc756ed148de193256094523ae1cca80c9535acc8943be1bd19dfbda9d671dff52734539437f24da18d2b17462f3c60f40c
- SSDEEP 768:CilhxuveN5cwVDXLd7EREiyS0834ClbS4CUNq1oRey9QS7pGL0LnXMcdv/8o7Avg:Cqzuvs5cw1x7ER13tNnNq1qnc0/TZh
- TLSH T1A843E128FE190EB4DEE54C807997D85D4448458EDF1F4F48ABC28A169F76AB2FF801E0
- MD5 SHA1 SHA512 SSDEEP TLSH
MS56_1.png
- SHA256 9c3d0f54a8f9d7f62256fdfa492950691e2c43a8c0179bad38105dbf892a0a1f
- MD5 00196086731c19b2c10d279b2f964947
- SHA1 b66c4ab07f44c03c9ea95de2db20ed7b2a5d3c97
- SHA512 0b9f36cc6c1de9081e9bdbdfb35c5ccec0671253f7a53be72dc11d3c7810298d6fdec712efbf61218578c16d8ea2d000449d212f6e92b9a2dd270c2ac9db80ab
- TLSH T19A513B4DA9F5635DEF080CAA2C4F3382FCA0CC52260C031A18AFFE756939991A7E5750
- MD5 SHA1 SHA512 TLSH
MS56_10.png
- SHA256 1ef03914df89e5f3cbc127477fc9211862e14a8d8b1896d157bd69ce54641d18
- MD5 fa5ce40289b17ab3aaa6f26059acb391
- SHA1 c9158c54f4d7a3310ae41ab9c9bcc1cbbf0394f5
- SHA512 8252985f23a347a463036eefe6858a5798ed5a38b28a1fa4911a2ae5cf6538d74dcb5ae1d525eb1c22ef4e2e729625d53f5f2c81a1e16aeaa36f14262fb68920
- TLSH T1F711EB6364945CF5C53010179313B53185D24CD1BEE52AA3613FB04D08B553E420C382
- MD5 SHA1 SHA512 TLSH
MS56_2.png
- SHA256 d21f87d0ceca2ec2a93fb92215c93c4ae11076f206068cf4baa7202d7179db6e
- MD5 81ff19f82ab163cf83282e24f231534b
- SHA1 3bccaf4e0cbbb640525f4fd6fb4e1f8a2d200c4a
- SHA512 9014e398f9bab72c4b3d9a13f3f8b2c6584fdaa7a41809a8518597a7ab82165662abdaa09c7eea63f6e781947f06d5741e9a9ab48043fc576707ecdde6f15807
- TLSH T1261152CAB3039930FD684529929B70E0EA5C8E61716DD80D502AF85660B7968C484CD2
- MD5 SHA1 SHA512 TLSH
MS56_3.png
- SHA256 307079e3fd8143cf5b67d73a917ef033573589cb7ea38029a4b3fbda2eb9bbdc
- MD5 d7da3d7e4ac7cd40e7bf46191586c941
- SHA1 fd8fcd2a7f04a68d58744da869bfc0b23d08b932
- SHA512 5605e062647861fd160d62170c694c404f2f72bac2e38fe16826b4696982e38c2aaafa799bd143e83eddc9214e08c88727a35ce166f775bd56e8d8442ea32617
- TLSH T1E911987D35C87AA94F1F0C3B8AF6D8036B479E9110128585084B776C49BBEF91A02714
- MD5 SHA1 SHA512 TLSH
MS56_4.png
- SHA256 4f4b68409dac618e180121846c31fde7872cf1cadc51a8f55ae5618769426f14
- MD5 1a4dd2bd90e05416ba449abf30849cda
- SHA1 ff4465299baf063e55ef454155f4128f74c9654d
- SHA512 c702dcf46cabe6409ed05ddd8288e138fafa3c1d346c4b00f54838945a3011b2501de4b2f23e4502c77cacfe022d78166684ff4e9a18a426e2538a269a7c4f96
- TLSH T1D811B7A1510CB0E8CC8D1D650BCEC522EF387E2D67BA281C1748BDF0287C82952958C2
- MD5 SHA1 SHA512 TLSH
MS56_5.png
- SHA256 c17c8dceabc41b98e20268c86e79fd070f195151bab96e3f3640628001e14d39
- MD5 df17d6abe8ab458760116b58c3996b74
- SHA1 140e6d127fbb19b0e2994cfdfdc7a16ce68bdfca
- SHA512 eb388a259f8222384aaf4f0abac68702526666950dce0ffa5b4e10ea20a523e55f90efc59398074f3d155d3ebefbf9a101fd72f0508867def035a1d3f5106356
- TLSH T102F005C23D8A3714D0AD589172068524E9034FF11781B37E514FFC3847B9D8464D22CD
- MD5 SHA1 SHA512 TLSH
MS56_6.png
- SHA256 1b71f84322a83a51ce23949058583c0673bda36d02d94f9246b57a0a730b73e5
- MD5 5de958cbd5b8051b6dd732fda2659557
- SHA1 aa717c0e787b2b21a76447bfe6a76c232f709979
- SHA512 42762a77f3c82e34533002f5240bc5b683a797ca798e643370ff2c3f40f52fb303a0a9dde3d30ee24bbe910fdffe46242e54850088c22f88b5acf2667bd2ea18
- TLSH T1F4F054CAB6C05030C91AE5DA07332820FB57CDA38791620FDB0D371A003CD84EC61908
- MD5 SHA1 SHA512 TLSH
MS56_7.png
- SHA256 db626a5cc33b560ddd0acd96605bda16de04a946b1ec68c907aff931501cd09f
- MD5 ac83ccd302e3e4f9a149a4ebc7954da2
- SHA1 dd3cfe3f9bee0ec460ec8c8dd07937c73903d7cd
- SHA512 9f9ddf3faaa0f62556d790870a61023d9e150323008e3fdaa8ea0e2dfca82f81aa8b5d3ff3866fa758daf2be633da2efeb2de247e4d7e58a02f3f24b2ac9e8f1
- TLSH T13F01968962970760AC1660CA720960A05FA44F5088840E953907F4EC2A3DA8C7B14399
- MD5 SHA1 SHA512 TLSH
MS56_8.png
- SHA256 c13168ec436c7c7ea30192b953a54466b0eeb08bb4cab5b3e53ef8c238d891c6
- MD5 40db5fd87dd34e35a062a83d091b96da
- SHA1 8314c3ac66dfd560f06d83d2e641d3904c65e1b1
- SHA512 d2eb1e8f60d906e5715456a75835dff99b697cab5e91ff6dda0208fb9db895b6e7841c9b394c6ec15db58f3e1139d2b9efd04fd9bb643edb2bd7ed651628f774
- TLSH T1920165DA3B61CA20F95FA0E0AB2340519C750D927081C95C45487532A2376828D53FAE
- MD5 SHA1 SHA512 TLSH
MS56_9.png
- SHA256 397a3b956bb1bff3d638dcd4f7a07debb71b8ad181e97f075d9f12120a16c4c6
- MD5 c58b2b59e7e5ba4cc7d4eba67e2af1ce
- SHA1 6734a3cdae3e255ad6ee37a3d141376fa0269bd9
- SHA512 064711137b378d34777d132b5d4fd174918a9843be7b4357956046fd92dec947a8810c15d088f6744209bfa3e8b537d7db1d70080f89aa14742b2c37a1b2016d
- TLSH T19D118A7492E047D74439217073870916A331FD7949856D5693DB3F15237D82B60457C1
- MD5 SHA1 SHA512 TLSH
MS6.ini
- SHA256 35f63ba6710372726a6a329e3bf9d1fea5ee84af095daa8d797eb5ae5e52185f
- MD5 c089aad79a10d48b3b44914d5eb9e24a
- SHA1 976c7178fe9943573f66d873fea092d552059e4d
- SHA512 894251c37581de78271001f260b99ba7c6e92134106f9f5442a4637eea30d4731634e6732fbf95250fba6b20e7e6348120856ff17a05bb2cc33e2a4be09ac3d8
- SSDEEP 96:qZutZAuhBvvh+oiOXwy7FEMqlwq2WXSBmcTh/JTh7MTKzVTNeLoToqETzMq:2uTmnqZV1AURoLMNYAq
- TLSH T150B1BC5F0B6035DCE016F46E330B84E72768446BC8FEA4E518AF05D96662A7867FB8C0
- MD5 SHA1 SHA512 SSDEEP TLSH
MS6.png
- SHA256 ca5c24cd52821570fa2c200b0275d0a701ca2f98ea1b4fc36ee7243ee6a25c4c
- MD5 736a29dcd442eb97e79ba8beef3a5999
- SHA1 ace88c81298efedfaa2dfdec57fa5334564df520
- SHA512 23b5748c56dcfe4b30aa0474d1441b1113a236331c3ef0c744ac1db3656cdea47400e0ee8c35873492b51187aa8ee3859da5fe4605485039e7a47229cae2dec0
- SSDEEP 1536:26m+h8nKkiNiGpowp8vQTsCE/6F/aYx3/RgXObYb5FoBTiQb:U+KKbwoHpsbCRF/13JBQWb
- TLSH T12943DF58F751DABE29E00E0A7F42982E3619586DDF1F2EA4E341F852D8FE90BF4241C4
- MD5 SHA1 SHA512 SSDEEP TLSH
MS6_1.png
- SHA256 a591254d73df9dd959e6cd5b2d3b44e44294af118a9f94850be590fdcaade693
- MD5 c1dbebf3a704d69d654e10cbaea84c08
- SHA1 9180b91319f7fe04ada26e4ab96e0c4ea1e186f0
- SHA512 d5a6f24b3f7b4e516e54a14fada9fa8f679e89adcdae70a8931f84e982c898ea507bc1c5de850534fe1a46bf349c29956866aeaaf25de8e61dfa739b2a0d28da
- TLSH T13321B6E6517090AAE03A4C31834B44C8EA3D0DBC28E14C4DB1D97F9DB5FD2C0D84521A
- MD5 SHA1 SHA512 TLSH
MS6_10.png
- SHA256 840772c946e2e4d0dc92504827cc5f08389093e5da20d6a54fadea38d0381568
- MD5 b5eefe9c0f0b68ac104410cdd1c859af
- SHA1 6f379247181100b0df8e588c5e2569542bf33a4d
- SHA512 bc58e353b2c83b16c397352723a86ce521a9a2a0363abc4075eb99634639ca91e8ebaa30078c36833a567f8732bc91f854313db424a25294b31bfd2a68ad472f
- TLSH T1CF21B9409ED15AA28B3B162B1207AC095C81CE94AB937535674F7183157728C9C4EEDE
- MD5 SHA1 SHA512 TLSH
MS6_2.png
- SHA256 3876b2091ef093babbf7470f4f802d33789dc5c27d8960ad9927860dc72e0afa
- MD5 1ee4bd85860ce99c59b914a79acad2a2
- SHA1 1555a5c274c91e7f9d1112f4eaaea091cdb3cdac
- SHA512 10d8878d66318ea875574affdf14e13d0e193568c4243df2156f8079329718c7ca0f57a4981e21d12d192783a516285895cdb51f7b393ab995cdaa33a464785b
- TLSH T11401239113C14A13E459887A17EEAE605F909C4CD59F4808DB1579B1947EE8C952A2CC
- MD5 SHA1 SHA512 TLSH
MS6_3.png
- SHA256 59fec829f582d7c8b6adf47da5dacb2d44f249cfe7e3cb9bb52d5204afefa2b1
- MD5 f4f62a5501cb40e47c3a19b5ae3cc79e
- SHA1 452165b10a1627951b74f6c31b12fcc58d95a2f7
- SHA512 4485b30ef400a121d2e6fd8fab5a7bb5843809f87368b6accdc5ec9f9a13a231aebb0dbd57eb9cfb21db66121f43048aadf0cd4c93690233eaab0f5601fd3954
- TLSH T15FF005DB6640C439DE6D16A45F5B514C85B14F2D104A502F9058FDA5937C04D661D280
- MD5 SHA1 SHA512 TLSH
MS6_4.png
- SHA256 5e468c3558235e888eca1e331368662e12872527b0a191caf2134d80d785d078
- MD5 2997bda8d84e6b5fc18893d2a672ad46
- SHA1 dba19a50bc144b65ffd84326699724fd84f8d8be
- SHA512 4214c005d090998d22e0b3b43931902561a680ef57cce477ee33ea23ea2aab2430e0da6b8e1305b46917e0950ab50d6b273e87d810e40f68bd7cd18ff583ca80
- TLSH T18AF00EE3135D450D769E0DF89347F524E8001E220A6E8258B95DF81192FD0A0CAA63C1
- MD5 SHA1 SHA512 TLSH
MS6_5.png
- SHA256 fb501f6086105e189ececdd4120acf8d45258287f35e98689bf25dfe8b008880
- MD5 2ed9f87326575180b8515d01c40c3dc7
- SHA1 fefb7aed907cbd336493aec71e659015ba094acd
- SHA512 fa976b55a69eb86b26c0487cc3dbc94f43556840290acc7f517b8bc252bc4d5c0f3a3dc6e38028132c5729d400a251e1731e75b4c4dbf084ac658a3e4468e4da
- TLSH T1650170E73081D359E82886EBCBF8F53C60E10E97D06BCC8C382638881030940E8D039E
- MD5 SHA1 SHA512 TLSH
MS6_6.png
- SHA256 2c5ce3624b0dc15f9359a5eb89fc61d6e4c33fe1b87bad8bc19ba243fc20dbfd
- MD5 166b7955b7703a87f911d98d1203fe9f
- SHA1 54447e6ea889887ee022a04cb63094ef229930bf
- SHA512 3befa0cdb3aabceb614ddf353b9b11197a39dd74fb9b3811d9a484f7eb0094dcbf5c56a199ef4d0985ac5d65e9f18b12522ab5bf29b50b8e7ab0776886f4d786
- TLSH T195012047B29962A264A7755A47072D90B4860F62304F574C895FB83A473B0D5845B2DB
- MD5 SHA1 SHA512 TLSH
MS6_7.png
- SHA256 d89ab8c1de025651c71c1533aa1dcfdec71ef8470ba441452a965f7ff8a5df1c
- MD5 64ebbea89dd905b34a02892735c147c4
- SHA1 425e83ab23f0dd3a8d35e1135ba97b3becf409cd
- SHA512 8c9c16f55967075cdcc5834b342fd75ac24d89a818ab8097842d77e3579bd71860c6155a4202799b1eb3be14071ff4fbaa6401ecc05583361258a6ddb3926fe7
- TLSH T1C50165F6C0145F4748DECBBC019F1834AB442EB14AB9C1DA6899B039AF7CD10A5732A5
- MD5 SHA1 SHA512 TLSH
MS6_8.png
- SHA256 544aade4f917a43ac28a899c328a1d0769459f2c8bc04e4a0461a4fbb12ce984
- MD5 2a3e98879b65bfe0982ac7044147bf8c
- SHA1 ac47f4cf900dbee7c870d7293227073d7b397ed7
- SHA512 5616fffc5bb077365b50ecab96a715ea05859407907fb06faf23e799ce1c5e53c95bce1a7855f9ccd28a02741794cd8f4e09b1a8c61da8d69c109096c4e798c4
- TLSH T1640165D619C00DD9C6FD462A173C88115CE40E943536023CAD2B7A2CA63ED175AC8727
- MD5 SHA1 SHA512 TLSH
MS6_9.png
- SHA256 edca0b94d4017e55d73115457654cb92692c2821cc91e864177da3a954421a19
- MD5 4e8f3df83c47ce9a9e5562c6b4a95dcc
- SHA1 5ad5660573c923a4a897b62f4a6def3b21029bd4
- SHA512 496747fc75a0e55c20830ac50de241b95bc582e42426b956b37e93650ccb34f8f1c25962677f5b133fcb82a98ba15374d8083d5f52606d5739b5443333899e16
- TLSH T155413AD223D09A35EE6517326B309F7474005C5F640C292B5EB8745D053D260BC9BF15
- MD5 SHA1 SHA512 TLSH
MS6_G.ini
- SHA256 566fcb4be4eeb8106e1f2a38d06aa678205b882f993cd884f7b5d0495c2c0897
- MD5 b3984c4d5f59c7ad51e283b5275bc25a
- SHA1 38b3ffb1e5263f77d9cba2d0515a7e357dbbe894
- SHA512 f58b56dc511c8d2f91933d230c155815c55e5239f52795c1be7c8aab9afeac1131ab31d140c9187f5b13d6e8bce165352a9e4c9a1bb1f7dbf4d0a45687e3ea0d
- SSDEEP 96:qZuOZr3FX2819iryBwTh/JTh7MTKzVTNeLoToqETzMq:gVWrdZV1AURoLMNYAq
- TLSH T145A1F25F0A6435C8E122F46A331BC4A32A7D405BC8FEA8E1189F05D966A137C67FBDC1
- MD5 SHA1 SHA512 SSDEEP TLSH
MS7.ini
- SHA256 3d9ebdd04ac5cd4a4e9379b68be5e0c45fe93dd404941551997232802ac612a2
- MD5 12931a4a07d08a86119fa46ad59b3816
- SHA1 805856e9bfd726a4cc87653c2c488d2239d3f7ec
- SHA512 f49b7223f98bca232a2fd4f1a8e8984827ad7472adb1732b3706e9aa635a7ec67b893ed91a9f4501ae887d6431f54586926e93890d1ae07cf5bae6d68f10ddf8
- TLSH T10B71CD9E157626EC814776253257C0BB2B71047FCCF93D50246E01EE63A1E742BFA5CA
- MD5 SHA1 SHA512 TLSH
MS7.png
- SHA256 0898639590912f48e10e291ad0de92d889df98da5bbd956cb4f35a2e36b05645
- MD5 f8d9e55466fd1c6439d95527b6b37333
- SHA1 5bc7dcf3035189330e2cc9b08d8786a465762ce6
- SHA512 c0c073c0c613f78354e02c7089f9c7e67e1434199bd420319cddb78fa5cc04e90a1028c2fe15870d1ae2f1fe39dfd71455a3053b030284943b42dc7b440533f1
- SSDEEP 1536:nvAU2ZkoluxFwAHSo8YEw7FjDNF3A4AIn+2V:QkolurV35Ew7FXNFZY2V
- TLSH T15F53DF0291C69D1C96FD043E44E31A59C484AECFCCFA75299BBB2E904F35430BB6F684
- MD5 SHA1 SHA512 SSDEEP TLSH
MS7_1.png
- SHA256 878240473bc6acbb7650c5208c1100e716c7c500fc5b9ba9c5945b1b1c4016a4
- MD5 2c2da7ad7eb4d0195708ca37cd81ba25
- SHA1 7d1229e5dc9824c98878c0dd2235aba7ed25948c
- SHA512 8c5315a4d3bac578d27fbcce8d94a32d6aaabe2080d9362f72cf1e69ae5f286ed56751c4f28a1dfc544bdc0d992646abd8f1b8b52d2fbc3ed1fc505be67ef83b
- SSDEEP 96:2ESogOKtDs1NV5U3vqk7Fs8Xp2eEF2Y8gw9abf90:2E4U+vhFs8XpyFAQ0
- TLSH T1F9917D5BB72C4D6EC12AC3B9135D053CBCC64D6852A5074B5BBA78F6413CC9EFC41855
- MD5 SHA1 SHA512 SSDEEP TLSH
MS7_2.png
- SHA256 cb50d07e28903ff1bf96fb8ff8e12f6f494c2e6b1774aa971b56df76c6f89c3f
- MD5 55eb364ddf2d21d034dab3f6b64b7ac7
- SHA1 f16dca4f62f86c4a79afd6c99c1c754ce469fe18
- SHA512 907700a453dda62c1f47ab9834d659666e25953e94c9559a971218f6ea5a9737f53b30a1c0f472ad95d2ed649b027fbe09eadb8f1787c7a7f9ac81e9cb2126b6
- TLSH T1D82117AA30884E4AAD5223CFCBA144532C167C3286401B23991A3D2A4ABC86CB0FF087
- MD5 SHA1 SHA512 TLSH
MS7_3.png
- SHA256 e89633f3bf9c24a6aefaf740ee2ee5a60eaa98026f353c8b41571ef20a5e3552
- MD5 35fe919f0c199f1552bffae3d366f7a9
- SHA1 e116dffd7c63fb1176bb278bce2d10b5d99b0b60
- SHA512 e8bdc35ede28958385a4699d440cebc150adfc9477a8179a67db26f6597b531b7f754e17d0e73062bfe9627caef1c6451c01d5ea238391a89ff436774e2bc757
- TLSH T1BA2195D5D20795E1C6DEE9AD0ADA170C2C589E74984FA6EABD0934281C3D69EC308D26
- MD5 SHA1 SHA512 TLSH
MS7_4.png
- SHA256 d2bc15fc4a47b603ffe83128b1dc0704d14287f9239af173638e468aa0f64603
- MD5 afef3f3b2e9e0b0cc6b9276d0ac8444b
- SHA1 9bb1b917b62ac2626474d0e8d410c07084e72e62
- SHA512 24ca5c681a2d93eed9f5b2b906dcd0b0925e1f7a38acd099832bbcee178c9361e0e9b9c70a8d2b086dabec9d324fb0cd8c91ee6eb4137be0b73c67f2ab64dc86
- TLSH T1732195A128184012CEED0876A6325211DADA8D1794F9CBCB5F2B7331413C3AAF9E66F5
- MD5 SHA1 SHA512 TLSH
MS7_5.png
- SHA256 0c192383c9800fbdd4095227117df9305d9c61265c66e1a2dcbc9c1cde3af1b7
- MD5 494c8feb86dd9328ba819d16ecfe85fa
- SHA1 2542375a2056a556db78353fcca847c269e68bdf
- SHA512 eaa58a65a9668aeb476a70811193bd8d877c20dbe3e71912f0d4ea88be0c82887917533f1526270f17e56892340313fdd51cc4354c71466aff81644545bac48f
- TLSH T1F21194EDF5E67C1CCCAA709B4248665CF9649D06C82A4645608EF1EBEC3F80E2651040
- MD5 SHA1 SHA512 TLSH
MS7_6.png
- SHA256 c7b02a99a17461a6c8702b71495bde3185e9f264bd76363c39a3c2276fb643bf
- MD5 28ce8bcd5b1bbf4a72cb965fdd845937
- SHA1 c0f0205aab62445add7f982e90a94cf7f413afce
- SHA512 c479ef894d4a49111a693a7cc6e457101e39bf7183515980fdb42c1d13e66a074ef031fc0df2b146f5088330b09ca2dddf15991ef3bdc8140ac42ad66e0a0d0a
- TLSH T17211C4D53D294A02484FB4705AF84CE7CCE42F376885C12A20AEB84040BE31EA0884EA
- MD5 SHA1 SHA512 TLSH
MS7_7.png
- SHA256 5778de84b17557b66270010b5bd40e36c4a8078dfec09406df050d7a6ddb95e5
- MD5 889345d41eae04ed6a944954e88b7899
- SHA1 bffa2c04054ca31e36eef66ed2477b6fa96863a1
- SHA512 1078bd00dd776f9c500a0118fdc124c40fdf7eb4c1832d5f93205cd6d6c5835ded67cd29b0ce620239741175c328670ab32533a2c0af702a21ee9021f45ac1f6
- TLSH T14511E921BC106D58B4162A1FA7CF555688302C684164CC93E98930D0B2BDC0EAC84A87
- MD5 SHA1 SHA512 TLSH
MS7_8.png
- SHA256 0740f5310c8abd850910a3cc3ed8b52845957e9323c87b89abef797c0155ed9c
- MD5 293cd67c3464223a6f119ffab1904998
- SHA1 bf78125929e993184f4403334f2858a557a0be67
- SHA512 87f7609f5e0990cb67fc80cb2988e0d670b42ef764e29a8b76ed1f05b8fa76b3ab7f069cf40036e907947b61534498485099af4834584a4eef103541440ab8f6
- TLSH T15301568723D829EE87931696D25A9EA0C0151E42069973913689FC76E57F594009E741
- MD5 SHA1 SHA512 TLSH
MS7_9.png
- SHA256 d0a2b6d3fecd083cbf8aace4abc8aa79e4e210dec1c2fd3fb223f45140f8ec0d
- MD5 6261ee9c3cd24be1e6dbefd21c097cfe
- SHA1 64bad37e437caef488434e99ac2a57ba9cd3b5c8
- SHA512 c50ca4d64fdd82a0628305000a67552497d667d79712dd3a509714281471dadd70582c29bccb49b7f5c55201057c64657379e19e6d2daa18a38f9fe9d5503479
- TLSH T1F821B4E753D6CC6CBB02288641110F4DDF087C1874B72F2D8E8AB43AB079969828F282
- MD5 SHA1 SHA512 TLSH
MS7_G.ini
- SHA256 aac280cd90a9bd67e012a14a35027258a0bf76e8a4bce68253117869c82d53c4
- MD5 acdbd50f8a3e06723ba5517acc9d3258
- SHA1 435cd436510f7689b6796af8a0d39eff024e2801
- SHA512 fcdc74cc6eb581eca92481482baa1d86ce97bba8361e3061c980f9e2000d62de327c7c850b22b46cf1518995433ddfc58f785a32cf990b8c74447a8fa6b749d2
- TLSH T1E851BC9E25B626AD915775253347C0BB2B62047FCCFD3D80241E01EE2771A742BFA5C9
- MD5 SHA1 SHA512 TLSH
MS8.ini
- SHA256 23b46dcd2fe1f19831aeb1e2df57441dcaa185f31794f1ba704789dd539ade33
- MD5 d681d3c4f9d831e04ca4aab5271e99a3
- SHA1 5eebcf69e4a52913ab9ebbc995be94bffcefaa23
- SHA512 ecb04a424f4ceae1b574171a5c76bf1f7b6869ba95de89651d60bd676eb6bc8380bae06a2b0a525334afe9e7637e2c9200b4e17ab7d7222cc9a6bd796cc85621
- SSDEEP 96:qNW490vn0y4JjM+J+nzvAUyj2JM3ei4WhBlWMdWXoWhyhWNFBWo4Wz8W0tWVS:S9Miii3pL03/YgLA037Q
- TLSH T10CC1965F1F2234D8A446B17F330A88E7266904A7C4FEA894486F05CD1915A38ABFFDC5
- MD5 SHA1 SHA512 SSDEEP TLSH
MS8.png
- SHA256 5020da4b2f1c798026bcb5b9156fe8345e2ec6efe17a36a4cb36e4afa1bcb4e2
- MD5 b6e4629e00d7e1093cfe114e638a3705
- SHA1 8185cdcfb098b505719dd2951621c303fc4e9b2c
- SHA512 97007c58b661239b0098ee53ea145097c008cf837027dd3ed1276908f665e21cc512f32874ca218f0bbcf782d1ff1e51211e548d9adf9e3137f6f254639350d8
- SSDEEP 1536:rbSYFWDKvr7+icVL1vqkAxLNyigCn65xXMX8:i4Wus1ykOKCnps
- TLSH T1CC43E066EB685C3929AD0C8CBF57C88D58085E49CF1F8C615B80CF68FDE83963C495E9
- MD5 SHA1 SHA512 SSDEEP TLSH
MS8_1.png
- SHA256 7361ea5d0a06cc6e55fda23eac1ad4137649d482de9836b7d26653dde12de2b1
- MD5 235cabc5fc71a8a5a416d4387a9964c4
- SHA1 3e2fb094d188548f5e326cbfe9b2bea631fe1a3a
- SHA512 19e14463914331675b113ef0b9680860d13395167f5bcd6c335701e1f0b1313b565735585ce152af30db30db812a85f6647320af894b339b1c8ceef969b5acc3
- TLSH T1C1413D53309DE6111C6180384CA66763606BEFA6CA65A0F9A38A7E972E7502D68233A5
- MD5 SHA1 SHA512 TLSH
MS8_10.png
- SHA256 f7a97198811345bca7b030d0dee6253849033e6bee55837bd942599fcb99057c
- MD5 80ab3f4129bc0503cdbc475c6b00cd97
- SHA1 23bb12b06d1cf61b1a5f2e9e9c7b9e138fe2ce4c
- SHA512 b21c908087942d796bf90a03afe6f1cb0a1efd95d9c4b56b5f878a1d42adcd9a7cc85172bb393d479bbdfe852b252d8f5ed87fdc7e79e1f37bc9db370ca79b6d
- TLSH T16A31FC46E3D99D31C34A84FCF3E2A427DDFD1C8953752A4947567076C1340042B5B45F
- MD5 SHA1 SHA512 TLSH
MS8_2.png
- SHA256 b51e3c17cf5ee6d384c560fedbb5466b206d88ffa85bedcf85473be59a64fa17
- MD5 932c3e2bae8204951dd9f68a1ad72dbb
- SHA1 d40d2e1bcb2ba1a6a62e6cee857ebf3e2ad0c88d
- SHA512 a34bdfff5af3098c4dc87574727270c61c09933695a53712e88876cbfb256cb4da6de3eccb19a76b9ade10e8c5317ae794d2761e23fa85dbff38c073b00ef278
- TLSH T19801284153B1DCEC5A457034356314305D4D6DDE2660721C651EFF6571BA2494545BD3
- MD5 SHA1 SHA512 TLSH
MS8_3.png
- SHA256 91441dc66d0f315ae7426d87ec98db77dceb39c0a8e10e731fc7ce5afaa5841c
- MD5 4e7be96be25c1168d9c04fb4a3260a76
- SHA1 633bf6dace7253534870f395e712050b08eda8f7
- SHA512 81f95635c10e58b350788ff1cbb01d5c6ced25e372264eb213f055a051b7016d7e2e6c0d38e0af8c5f7d3fe886d35d0edd3d2a0bb47a976e804d44d5bb0af4eb
- TLSH T17311B9C5B9507CD19BE450590327DA5D5C16AE563B89109DEC27F6A0183BB6CD302716
- MD5 SHA1 SHA512 TLSH
MS8_4.png
- SHA256 684414665c3e7df38aa21b918bada202ebed19e4899530c3afb4ae38896b1cd5
- MD5 74d897f706c293adcdee66e8ca5a31da
- SHA1 50fffb40a8e5ae121de89fe83c1f1ee27622b086
- SHA512 aeb48fab7f75c9755b9d3774e3bdb3eac3451c551722ce52f0c94dada15736c3d78913cf2f310cf2c2c8701ca4b976d70579579455c80d2878c2cfd0391b7155
- TLSH T1EDF0A353264D642DE05FE73013DA4D7EDCF4EC4C285D990EF15A79B2447E583A190389
- MD5 SHA1 SHA512 TLSH
MS8_5.png
- SHA256 b500a6cfb5e645bd7d345caa38ecd37195f95c327ac244edf248fe25cc743533
- MD5 7d94b85e2252f641bc320c32aaf9f31c
- SHA1 519e6367ae217146fb6fa9234ce4d944ac4e4170
- SHA512 e386d2b47cbcab235f6366696ee9e462e6d2dc329cc77764556500b229eb7f231eddf5328082fae72906c235d7479fee4c6c3234f77a7aaac9928b8a5c4647e1
- TLSH T111F00EC982809582242D906207158546DD292CD988E18782F16CFD320A3EACB92F82C8
- MD5 SHA1 SHA512 TLSH
MS8_6.png
- SHA256 360e1aae2d7dca2d31fad64fbe02de391b5c7d53d300995314674405d3dd0a40
- MD5 076eab6cc0e809ee6d1c5660289a99af
- SHA1 dbe2b15892a4831fe5658f3b0bc2012becde7e17
- SHA512 433fb6b4b53af842e6bf0f64ffbaec501347252c3b1d5de8639d69cc48eecbd2e1446e9850403a52c600637951cb86e4de7e5bebb72a17e817195cb2e125815b
- TLSH T1040194E1AD00804DDC235466314D91C67070BF4FBA999B1C529EFA0D0E3A803B0AA38E
- MD5 SHA1 SHA512 TLSH
MS8_7.png
- SHA256 f64d65f08c85e465e2223d5c5407d4e9a5f951ef4bb86eaee25d104e752eb2df
- MD5 37866ace0f1b6f36548840428c3f5e9a
- SHA1 e33353b3ede89ec798c493c84f1628e9f6b3f389
- SHA512 c465ee3865fdf2155b70227862bb7e76e6a24eef7ea4d38ff78e7cf0ad0100f5644baf1c9b9ba05f4acab60cac1662c1ddc9da509f6264e47959f78a4d2a8c2e
- TLSH T1D7016557A350EA55E02C8E3B1ACE9912EDD57E5F4165820C494CF90CA03A143BD0D392
- MD5 SHA1 SHA512 TLSH
MS8_8.png
- SHA256 32fa37ee459f5c9bf7c45da1d391d61b181a185aecf1d376230819f37fe44f31
- MD5 3846a3c66cded3e6d691f8dc3e47c62a
- SHA1 3e9127450a24a8ad1ffc38eeeb4efc65c96c3db0
- SHA512 ec6a963251cb6e38372056b92bd7b03cb379079efb88419a76c33df8a9b8fab963c26df8ba65a84d41a886d91f51488085e45c6fe7aef583382390b394be1026
- TLSH T1070165C2F02E5C31DA4546758309FC1D6B538FBDEE8361A9E689389D00BC14AD0912EA
- MD5 SHA1 SHA512 TLSH
MS8_9.png
- SHA256 ce0718b4bf06c727765d1a593d70d96d54f055b3aa8384d8663fdc95a2b71c62
- MD5 91635c9ab520f8dc9adbf1146f56b5f4
- SHA1 97bf341dc8f2b0b92985b27c29e8d51e8c97be72
- SHA512 fc6b03949ab377f1b5874fd408c2f9da7cfc473af6de8b38b62cf5632e9c85b7ef92d227a553c0adece6c0a97c78ccf32fadc7bd5ead5915d7a09b4b615176dd
- TLSH T14C016A9E20E192378519449D5307E1B0457C2D5217DEF476C775BC2F607E217F0C0754
- MD5 SHA1 SHA512 TLSH
MS8_G.ini
- SHA256 ddbf09826472c84dea57087df9b81e784a6775c6985e45ca83166101a7112de8
- MD5 9c2e1c02a96f47778f7495d99adfb007
- SHA1 76bd8be3da661a6ae43fe79f1c7601bc394b6ed4
- SHA512 b754f049202b697b9b2a5ea4c4134b0401197d59154abee2b44ade87fbd6f3521f92eb938350abe9da66ea59dba89320b3afcad32e743c0e585609a35dccad47
- SSDEEP 96:qEEmu8OBHgyoqlOU9FJLMk4z08DSt3/3G5XhrlXMKy5XXcTXh/3XK/VXNKEXoTg4:Lu8SF9N3K9FfyxsrRHWV0eAyURn
- TLSH T189C1BB5F0B2534DCA057F07B330A88E616AD046BC4FEE8A5486F08DD691663867FB9C5
- MD5 SHA1 SHA512 SSDEEP TLSH
MSE.ini
- SHA256 d7a9ef3712b81d4b0bc6f5140ff278fb323c94430b0846a4c78920105243cbf0
- MD5 48f522e214adc4717def49388aeadf79
- SHA1 6b698bf347444bf07efaae9b3b37a2575eedcdef
- SHA512 9b179233b0840271837036f3e4ebcc750c42c21c846b1eb299fc33493f6f4ebae399fdf07a8b77cd8ecb84c01d4c4a6bf87f222a04ac9d81b1836695d74e276e
- SSDEEP 96:qOITKFa2iRMTaac6cezRRsnFWyKlG1J9l83ur5hO5NCt5oR5VX:WWsAGT0uF00/Ql
- TLSH T10891A71F1B7539DCD457B53A734784A72B6904ABC8FEB894241F019E1B20A386BFB8C5
- MD5 SHA1 SHA512 SSDEEP TLSH
MSE.png
- SHA256 cfe0f506a5e5dedc90f3a544a74188b6ab743df8fe49da41c9d82b80367eb37c
- MD5 49edc52c50f657e58105c9a87a3674ee
- SHA1 c91c4ae04e8e841ae1ac026a36d6c02f6e18a5e6
- SHA512 8e7383a53ee0c8538736310eeee78df96a8cef3b1c3d4864803703b7f42740ac87e455005bdf334adf883137035f1e81235fe7407db558de2d00448bcf1dc934
- SSDEEP 1536:TjghwLwBPyEBLRBJe1rPu+q6RoFNExu+oyvMKDqEytWyT/:T2fBPPBLRBJIrGymFNEx9kAy4C/
- TLSH T1F263E050EA3DBE3B59D96CD93E9BCCED2E006495AF5F86819B809F10CDCC6863D001E9
- MD5 SHA1 SHA512 SSDEEP TLSH
MSE_1.png
- SHA256 5e7d9754924d461045b8c5e18195ac4721ca96a2e7ec5493ab27c236985cfc70
- MD5 03e100b663f1666041a1d4df586228c8
- SHA1 29a492dd29d4d070269f093ae933cfb77841f1f5
- SHA512 f8fd1ad16ffba92a13c6f545fa7a9c94e0a354cf30bdae92519cda4e8de4761e171c42168fc8b786286a3c0611859df67a360890f608d9f6e6a54058aed8076f
- TLSH T11E816CE102EF51093E7AAC0426BAA8C5C1948C1D2CF115E1908CF878B2BDE6732F526A
- MD5 SHA1 SHA512 TLSH
MSE_10.png
- SHA256 daebc75e610324c13f81845cc27755c4b85687960aba5ecac0783407ab492005
- MD5 13bd9c0ea52950d5194b701fed625a63
- SHA1 7240e09d0dcd68857454df0d14737ad2dd57e2d5
- SHA512 7a91616e6f5e82753de3584c6d1e4c402672d10a16aba7ad09b0df144ab8cfd054e42d69abc98f0fd70daee93fb9408ca7566e7d253abe5cd83cc19a07b930bb
- TLSH T1D8219392720B992D688FA2B9238A1484AA7B3D1ADC28104EE8047EA4353AD98E4C0F01
- MD5 SHA1 SHA512 TLSH
MSE_2.png
- SHA256 b4dc3b6dbdc547c374c7f9acb118dc2f50399514c1ff715f213ad92ace24b684
- MD5 2fe28301cf8966f81a05790d4e4e6eca
- SHA1 ff0ef57e241843896e527e2e545e1e06176bc028
- SHA512 b422bd8f2fd79c92be76b6c033f75e1bb95e71de8ef259a6ceb3dfe8e7a380624e0899e3c4cc6aa7c8e3d842d8941fe02d2931b3c4d4b6383ea3247e2565bbad
- TLSH T12221DA6190B215168F0BB9A137C64EFAD8744EF63C4540956208F54DD63EB8DE016EC5
- MD5 SHA1 SHA512 TLSH
MSE_3.png
- SHA256 3a2ba30486cc8588a41a16204fb6bbd63659e0e55a7b919179298ab1b959e5da
- MD5 9fc5950086c8f71b63e0852ae2e58eb5
- SHA1 6ed21c3cabcd0c8b3522aa291d1f898175f1a50c
- SHA512 9a03a63447801d4bca19431615d385fe268d49cb1f8d76d5854c8c3edcfc68769a66525b925c8703064d6656391193eed27ac2a53da039589ae7c3fd6ca0b408
- TLSH T1B721C5D334780C1DC68728E942A55F60BC316E9948437B98AA3CFE3E20B195A9A477D3
- MD5 SHA1 SHA512 TLSH
MSE_4.png
- SHA256 cbae8571363feac44160d07de7971052dabf6d3e182f42c6bc461de65d4b974b
- MD5 2a7621d83ed9c7d2ffe9032e84d76937
- SHA1 8b0c893f75f4d00e6d9459da03a0385835388b1c
- SHA512 a87b81f94ba720b198a8f1f722950579c1d0b97851ddd0bc44e813ebb05c9eba9422cc9fb2e7e076e894b8cc99919a329b6c09a9d0c2ff1058598b3306351834
- TLSH T13121A77916926C60B349D8665B1F229F6895CC09E19BA308519CFC2110352814726EEB
- MD5 SHA1 SHA512 TLSH
MSE_5.png
- SHA256 8bd1ac0d31b67e1e473c367737f26bed89ce981f43b88a354f172d2deabe7cea
- MD5 b03d902fcb14f45a39588e06a7ea7f9c
- SHA1 ffd77b941ec4d88980c2de7af3a98f2b4f8c81ff
- SHA512 4d053d2b65d97783f832b260e9ba5acec38604e17364e279beb338fe4d3edb2e1ab88ceac4d518ee0ca03432aa1680a82012f42408744ebae56ff0300a60ad19
- TLSH T17221A5DCA0FA3D3FC0166C51693A517849D90D1844D26204FE97BAB007374B39796995
- MD5 SHA1 SHA512 TLSH
MSE_6.png
- SHA256 a61223910e67bf775203e8bf68bf803c9567739e11f69804eb541c59a94a2933
- MD5 3556f300a698daff7238e2be9cf18b5d
- SHA1 0cfb874062632ad87216fda35258b7987bf388ff
- SHA512 f6f97914ac8bc2f2e47e997ed1e924f999925e14ab72ebbe03a9296fb16fad5a00dfcaed0dfca67187cd1fe4a4890e3069c44ddf10c48246174c60f441c5515a
- TLSH T17721E7E73288BE64DA9CC17510D3C321CCD1ED782AF4891D502CF4BB9E7D0A8B222263
- MD5 SHA1 SHA512 TLSH
MSE_7.png
- SHA256 47273efe143dc48ffe13001bbcf66e544cc3f1584590d01c1f13aa140d060744
- MD5 aadb9c710d90d0d3b5f235b9020495c9
- SHA1 18330bb1c360a3a25d29c33433f95351c3af1f09
- SHA512 9385524af898bf671f4f221159c376e484f53034cbf9d6ab633eb0bd041f8f2de799eb9bdeed113826d1fdf4fe0ba24c3c5b19a6639352a560c88797b5afe79a
- TLSH T19921B73052B2E2F9853BD19F33AAD4A664E00FF94BA24D43213ABD1542BA2003415799
- MD5 SHA1 SHA512 TLSH
MSE_8.png
- SHA256 d6d4386b815d221d14f30efe832f201002d74085689f58f6bc790d93b1c74ce3
- MD5 cdefa7cb0b4bfb5fd2bbae6beaad41a4
- SHA1 4017bb0f6d37db3c12bb55db3e7733a4b5e06e08
- SHA512 cec500b493d4bdb6207d9375ad62417a2be23d48829e71d290aefdd27fbfd4a15faad184a866df71f60529e0e741e8502b63e01c623699d558a2873a85aaa465
- TLSH T145116376B90B7969E84543D1BB1B2E0199304E7508F34E9C82A874234AF957CCD16BD4
- MD5 SHA1 SHA512 TLSH
MSE_9.png
- SHA256 b9d03b81749663e74f309cd2b0128a5de6c6ea884ca3a48afd78ea23849cc76e
- MD5 298aee8ebd545cd7a6762456b360bab1
- SHA1 a90d36fb1dfaeedd15537040790b564b85b31c4a
- SHA512 0dab82fb487f6cbab232cc1845b6288ef99f92415c9d559e71ceb43accf0e35b2335c78b7f0a6c360d077e9e1c3a6d2bbae798a669dc25395197b46f2536fd5f
- TLSH T1D031FAE170CAD65FDE7A15A07160CD040B6E7C15363B09074667F838957767FE104C27
- MD5 SHA1 SHA512 TLSH
MSE_G.ini
- SHA256 df28c935f0625d933a340bebbd686a21d57da94ebc949c917173718ae2799aeb
- MD5 1c524b7015ce78fac21d5ff64f174037
- SHA1 370544d5783491408a064a1f6c300953cee6bd33
- SHA512 7a8b44b58429bbed9a04299a10594f64202949c4b18a097b41f7fae9e8dadb5ddaac4e62ec47ea11d87fc833aab0e3e5d599f1bbd931bac9aae13f16a6008eb9
- SSDEEP 96:q7+SBHGBld6vSu6FTuojMKaHz2RsQGvkJo6tGs09lLEhM7eEMp7eEXFp2EKGpmES:AeuIsB0Grcmjkj1JDttaeddqU12
- TLSH T1A7C19B6F0B2535CCE192F12B374684E5276904A7C4FEB5A0286F049E1B6167CA7FF8C5
- MD5 SHA1 SHA512 SSDEEP TLSH
MSF1F.ini
- SHA256 f89a5db74fcd53eeed3557dd5e1a5a1b9a844bef3a1ecbbd0e9cb846ec659082
- MD5 ab7e553420fc8008e32526628e6f7534
- SHA1 1d39173f8099ef59626b852a1c2b34722f151444
- SHA512 ac3a47711b25ffcf51b6ce4b74f21a09268ffa21dd51dff971bceafb57e71b9807fa92a3daf272bbc6814d6928361573acacf7b02cf909dc58759560da1cc86a
- SSDEEP 96:qxzbHBtPsoteJhqFoUykgMdz0BYLHlNiKMbDKXzgKh+MKKIpKNdjKoANKzvxK0S+:WYnqmUXzLFRs2jxMdvYTW9MjAekwF
- TLSH T1E9C17A5F1B2438DCB447F66B370684E6262D046BC4FEE89449BF04895C616396BFF8D2
- MD5 SHA1 SHA512 SSDEEP TLSH
MSF1F.png
- SHA256 9470a1cf8baf775df9f7214d755a95131af9845a0bd2696e54d987b9ce87a648
- MD5 3452fdfcf6aa4037008a060afae3cdc1
- SHA1 517c75f9937bff0ea0ccfed6bfa8e6e0b4a88872
- SHA512 a8cd359193a4737c5d94879431e475e2c5d2783ff17f3d1dc7f8e2f677ec5c57d6754966d11c8a558c04f1de849103da70a80c3caed44da2a574992176241c1a
- SSDEEP 1536:sPZt1aQnVU6FbnbWwjHxF1sj7xqTgSOqS4ihwZr:sPZuQnVU0bTHPSVqTZshgr
- TLSH T11B43D0E4D1B7313D7AC92D0E7D62E6AC5A884268CD0F5B305B428E19B4AD7C3BB2D1D1
- MD5 SHA1 SHA512 SSDEEP TLSH
MSF1F_1.png
- SHA256 34636ca6f8be51021d0265cf5c671250e1f80e2899b4acc5a5e47a677702a8e8
- MD5 38a2b03dc0bce46607a4139b5c60714e
- SHA1 645de5d8b9e40838055292e2d458acdeaa5f2e95
- SHA512 6bba1f3210ba815cf937371472467d977b9be5ec1bfa0aec3e363a46939b76de6a16b8b965e557a42a289bb33c1edc256ef48c35a9531a1aa560de9bb8001a95
- TLSH T1A721F8862B3615C0CF5208D047CB2B248A3A7E2D08878DD86613FC7A4CBF79DE54158C
- MD5 SHA1 SHA512 TLSH
MSF1F_10.png
- SHA256 4a4844f31b0147f0cd50668c4dacd44505ada5351772f6a7818beeac8607b03b
- MD5 0c95abdb2284775517987e8d64157f73
- SHA1 bdec485a0604344c50c366d2f4673b0e52efc301
- SHA512 11fdd55b36c36d4e27a0896074ae1c0ef08c151522c469237d7678f82e4529cee04909fcc508f30b0a261dd95eace9c9301bdb506f2b3211201d1b859ba1faa1
- TLSH T1D3018611B714A188D61A84744A624D53C8992CA85FD045FE6CC974125CBC883E02D611
- MD5 SHA1 SHA512 TLSH
MSF1F_2.png
- SHA256 8c135a3ed0af4f79c2f485f384a3c69367cd8e2c2731decbe100ec6ad690f84c
- MD5 b3b7e58146bda074c4710542ad4fca16
- SHA1 3bc0d28863817226fe132ee1551061b431451907
- SHA512 dd23d4f402d2103a5116799e4c0e6078833edf1041f86096623996e81d34475faef2462625133a2271c4767f2b503e94ef890e83bdd931444b6b1a3b00da34b8
- TLSH T18521C6B24ABCB681968584CE4DC593ACD3A30FC76737022A216CBA013CBB1808AE9245
- MD5 SHA1 SHA512 TLSH
MSF1F_3.png
- SHA256 530118c41fa694172b135acf5d0848431b4464a5193b29ff1573994aba69592a
- MD5 a399972e01b79dabdd06f45b83492078
- SHA1 1433595e6f44c1bb1481c6e0428aa8ecef3d45cc
- SHA512 43315dca1f85a58ee34f3e1f5c7f6d3d211035ad08cab2f185287fd815fd0600fa1b1a3492a813a833ae1d0e2189a541a2a0d47ae67cc129b4d6ea8eafd68733
- TLSH T1C811B3C3C20A2CC4CD4FCBB22F5E541DAAB02CEA1E510B51641EF9201474242A8F0AC0
- MD5 SHA1 SHA512 TLSH
MSF1F_4.png
- SHA256 f19b6304143805a136324896e5062a9481d6a787ca24db44f0acc3b94e1c8ed3
- MD5 c9265498630b9609bcf4fb394cda1501
- SHA1 342cf73625908beab1e95a9e7b1bf877b1deff7e
- SHA512 8d3e19eafe3f4d0d190a8c74fd06990a75ead8b52056a0f7f6233fb923376f943460adcf4c2fc05bf6c4a90e010a155d35b8104e34ba36ed31e22a67ac859601
- TLSH T122F0B7F47660540CCAAB94B8A78353B856718E712080730C622FF876B83EF0E9F413E1
- MD5 SHA1 SHA512 TLSH
MSF1F_5.png
- SHA256 3ab78a74b7820d43252f60881e5569643c7119930d7cfd57f3f580f4b2d168af
- MD5 77bc008848e5e5cc9a27f7fca3e1b7d0
- SHA1 42f2d0c7f6286acd2cdcef004bbcaef05cbd3583
- SHA512 974c33c7df4be6946840c06405e99cb0912cfbf42a80d3f2f51cc81364dfc9a2bc6096fa1bd54f2ee08b3a6ec23fb7b0a70d74823e0506585cc1188a9417553c
- TLSH T149F062623AA18234E856E1BC8332A7500A2E4E014176004CD89CF6BB0E7F1F3848C247
- MD5 SHA1 SHA512 TLSH
MSF1F_6.png
- SHA256 ec52abae3eddfc4074d35ddcdf422a915572a9e7c870d720f1051b627d79596b
- MD5 c3deaa2904f2acedfdd7650665088194
- SHA1 111ab1056c3eca563557c8c16a4b3c361fd4a4e1
- SHA512 d3d112c58bdfe5999900bcc09d0cdb58302845d5337c8ea881aba218e9819e33871e2818cf2bda009fc0d50c54e6822332175ef5ef74f223d91d5b6e269d73ad
- TLSH T14811C8A467EDAC42C6FF7F1446A7C8003FDA0FC14798053652983C21507E0CA41317B3
- MD5 SHA1 SHA512 TLSH
MSF1F_7.png
- SHA256 4c86a3eee3994061f52a20768ea6cb99ee95d814e264a738e5dbd2d369926c43
- MD5 9c574212661b4cc831bcf3ae80e55465
- SHA1 b1ef9e688e4469b7767c05e42762e0cc30bd986c
- SHA512 04a7d50ea17b8d8a38548b6dc64fd91b375e8b7998659ccaaee55b7387d4cdbf1b9472def4b34f64a164b4dd4d6cabefffebe002c2aab202fe43663f474042bb
- TLSH T104018602A4796C11C8DE986BA3B7607C783E0E553E4A47C6ED07BCB2B0301528335F68
- MD5 SHA1 SHA512 TLSH
MSF1F_8.png
- SHA256 9ba437970712560e0500e75cd3238ae01a740e15747b7997756d74670a7ce31c
- MD5 932e7ab5e585e1dafc764d6e6f6ad357
- SHA1 32d9e8365698d5ec580bdfc11749ecc4e3d0a06a
- SHA512 48864fa61c77c6468ec4320999319ce85178bcce032f2c1e12df06824a0e6222e78615627b2fcf4564d1b65ebb18d4b669dc599fc2824f256c2d6f0d9bf1ba9a
- TLSH T1401156D0F2E06608AD560B57034D0126FF85FE9562BD1D24C4AE7E790674B46C87A352
- MD5 SHA1 SHA512 TLSH
MSF1F_9.png
- SHA256 f0b42b5997ec7990dc1029d41f3ccd70552be9f8ddae1b26189d799d831e19ab
- MD5 21c3aa26cb1f320ab680b15ff81f7eec
- SHA1 6aa2ecd7bce1dc03d89b2429502db462d2cc1f1d
- SHA512 c54e4624e8cbc0e5c86f50568eafc5fed14c7f2537c84ee57db54475aafa2e0600df17bd2f59fbbb6e1775ef5eecef5ecbe2db223aa3de1b25688a23fc093884
- TLSH T1310165DB34877C04D4664076564538754C6B9EA93C624D9D842EF47E313B3864585692
- MD5 SHA1 SHA512 TLSH
MSPRW.ini
- SHA256 19f038343e258c706d6aad9fe4adaeda07d3d0bf98f5fc8c49ded9dcba790e50
- MD5 d85325278c3fead60703571047962d46
- SHA1 ae33c1544836af9c21c8e059fac98a2c30ef03ec
- SHA512 6035336a65f60a59baaf26ce01a763fb3b90aa17233861a69959cd29758705ed5921e866e00ced92d1fcb2d2f699a86fbbc12117cab6cd42de279b5c189a7f7c
- TLSH T10981DE4F1A2A75DC8117F57B338B80EB27A8057A8CBDA8C4585F06C91621A3467FFDC1
- MD5 SHA1 SHA512 TLSH
MSPRW.png
- SHA256 f68ec92cacf935c1cf509c1620fb91b4fb1207d6bfbe2f6aed8268c8586c1a1e
- MD5 f4c6f2e296c3dd63c913fb4ddf2ec663
- SHA1 7b5249d60a438264f6f48e1fa9ecd1ee1a361dc9
- SHA512 6dfe0aeae9025abcecf58805002596d59c91a5296b2430bedda428186cc14cbc9f3925e66acb6d71f4c909ed59b246a6e0a9fafd6e30712206e3320eef183ab0
- SSDEEP 768:B+qLBhIIQux4tAmYSvu8UrUE0towbKXd7JtdLcQudrTU8awItckc7G83qbgN6ySE:BVhhgt5Huazqd7zJcPdivc7Gtu/S0rl
- TLSH T12833F18AB1DFCB77F96085EB07738AE8119B7928167FABC1D381F4DE91027D11181163
- MD5 SHA1 SHA512 SSDEEP TLSH
MSPRW_1.png
- SHA256 5cf65277377a247c5cd28ac8efe56ca72e0cc6c139a1eb37dee0c993851f4855
- MD5 a34131fb573d9fbfd13a2382d7bc0ca0
- SHA1 a74c02530ad0255b997c55c686d933db2bf841f1
- SHA512 7047dbba1aad635a0d02209a2e1e2b70ec4f08f76c40fa4f63d271120fa469ade6c720782bab3fd94d73af1ba6452ef65a774e62c136f70d77090757efe78cda
- TLSH T19F817D86F07CE3B5B893A8918646D01117794E2ED62FC9F56449B0563172B49CFC9A0A
- MD5 SHA1 SHA512 TLSH
MSPRW_2.png
- SHA256 941f5e6d8d8bfa6e5eb4c3caeb5ecf11a399d3e76d3f689d3abf8912254c9aea
- MD5 19ca01a49090756388201845fe57bd0e
- SHA1 3966fe344f398b316a35c2b9dec5f63b186a71d8
- SHA512 e2f2bcc7113991e0ba0df1564a0f51df8a5bbe43cf9f7aea38002853ec49b08147ba376d59f299f2ad0695ba4ec37347ffa42b634f3c7b44bc51f227d4181fce
- SSDEEP 96:cu7J7zzV8ZHCpjQiT8bNgPUNbQ42cB3BT1lSd0JGtjXd2T2nCVTkNTOZme6V1H8G:c67zpqHCOiT8uPUQey7t7d2injTox6wG
- TLSH T16AC19EC8B102FF7C644CA1D35DD15A7E45CC4CB41F965222898AB00B243B34AA83E315
- MD5 SHA1 SHA512 SSDEEP TLSH
MSPRW_3.png
- SHA256 f16ca151cadaaaea4af0f69a22f0365d3d21a5517646a062b733743ee033dda4
- MD5 3da1b9efe546bcf4852c2c9d35ce6d94
- SHA1 57ca7021cf1aef935bdc6ae5c54eb43a03229fcc
- SHA512 80c05e2565d8c7687cb113f9c480d4ee208ec530d5fb54db1f6cb2c1c9fa33d8e57410c08b9c6582b64601debe3d8efaea300d4934ca9e207005a4e885f96070
- TLSH T1BF3119C723468819A74AECF28694C405F8295E57392500BC69F2F4B8E23C40092D12A0
- MD5 SHA1 SHA512 TLSH
MSPRW_4.png
- SHA256 64d5a9fd45b00f61f7ee6e4a13833f3488dccc7057709cb7ad1ca0c9a08ec185
- MD5 21cf1daa6815a81825132c72f315d40a
- SHA1 f8d8fa8f29200460733d971ae7daa2705a5b7dca
- SHA512 20ad8c266712a1e66d34961f5bf5d9e29adeeac53763da9461eca0f26ab6bde4eaffa5ef9cdb879d39fb683f29e7d24aa9c24690d26eb3a968beaee1f0d872bb
- TLSH T1E321B8EB7D5A4C34558C76B92B3BE400A8554D4FB65E1D641C677819107C70378923D4
- MD5 SHA1 SHA512 TLSH
MSPRW_5.png
- SHA256 afa5bc7c2d947a3aba249b0f21c2e54ba27fb7ee9a1c81f8d6ee8084fcd84ed5
- MD5 4a21aa9e84757af80171a759f2cb48a6
- SHA1 920f111e2750445b8422fcbca51ba9ae06a8be85
- SHA512 1fc604f5ee720de1de6caf9f8ae71481fb5840ffb7fbaa2f6b4d570b6c722451bbf0bd6351c231187cd782a9418038840a37002ea0ecb500dac739cb7a40fe64
- TLSH T16921E9E9B125D37E0C9260B6E34FD95606010D8D06EA841230B9F88487F5D15FE16159
- MD5 SHA1 SHA512 TLSH
MSPRW_6.png
- SHA256 6ea85e9ab7fe3041d3b01e7c2a41e414dcacfa9f20f1cd17b55626b16a03563d
- MD5 8d5e0a32596501dadfdc8cdb3b5c4ba9
- SHA1 e32dcd716d2bd0e05a67a1d7631d2e0e18a1bbe3
- SHA512 056cd43196f4aa161119686e80bc8228c49d25d1ce409970aee14164c210a9da3d3d61b57d28c98c6524b227fe24bb58ef2784c76c04e81858a4ddf68f8ec56a
- TLSH T184212BB4B9A5E97C51EDE300402BF0FA5901BCCF4D9D0818409675B0F935647CD34F01
- MD5 SHA1 SHA512 TLSH
MSPRW_7.png
- SHA256 fcb8091f68f51a0a693359442384be49d61a585f99d9632fee6ef017bf78b1d9
- MD5 d3b8648ba452365bcd1fe541ab3e71ba
- SHA1 4a3e4955ee1c8adc0153556664852bba1c7ab888
- SHA512 481a3ced2f7d0a5dcd0ef55c9e952856c877a77f263dcb73a59dbadd2679d905eb811b43f745db26b6a12e7e72d8a57305f98795a924ac7c1d22d78ae0d361a0
- TLSH T136311AEF77C224E5904F8914677130500CDECCAA874544602F2EFA4A9A78932890B498
- MD5 SHA1 SHA512 TLSH
MSPRW_8.png
- SHA256 e51050e4613e8ff833a094261ef6a763cdbb239b0cb65f9152cdf9af59d8c8c3
- MD5 820777fcee84475f9965fd725ccfa90b
- SHA1 e01109482e593894b26ba69bc9fe637e85c98c48
- SHA512 947242c293e8ca2a6c4d05fdda9ccdd762a3ad4dbeabde505341d5ac4878b211298ba1a9139b6cb2cc0c5700495b157fcc18b277ddb71ab237ecab7f8e1d6385
- TLSH T1BC31E6AA7E9A2C63C8091071A4131EC87A39FC1EC5F0F80771AA31085872FBF064DDC0
- MD5 SHA1 SHA512 TLSH
RaiderPD.ini
- SHA256 dcc3ddde656f2f776569771aa74be69eddc5fc72ddc8f0edc036efdcc1c3e3cd
- MD5 067998ce27e135acf653abe6e1891a46
- SHA1 47ca350f7ba06f63186a613fedf862944c4f2a5c
- SHA512 c444a082530c1241d633c43189d754bee7bae730043a39873b668950982ea7709847b71a65d3fe51ccacee55d80047a6e74104805f80b09502e056c163c91857
- SSDEEP 384:gCTAqAT0Nj1djjSASgv7pfDTrFjUjAjWj0iHMAjiI6AxW6+qCGYcGx8GRClvXqvk:HAqo
- TLSH T1EFB26C7F5E6A74DA7A45E47F37C6C4E2682C14A2C0BEE942154F0A8DC94903687BFBC1
- MD5 SHA1 SHA512 SSDEEP TLSH
SV-262E1.png
- SHA256 56722850f46faccd86f27a01662a296d940d8b7e013867f66cfbc68019c3cd53
- MD5 0e6993d1f4d8721fc3d3dd761730632c
- SHA1 7348b5e71fbeac3d40c4edb770626ae6dc3ae2b5
- SHA512 4fc0e361a9027f4bbefbb1a419f7a19b3bbcc1b8e79818bb7c286e7b5f2a1a53c6cd460a4601663b6e203a93e005a6b0c61b74dbe1ef39918d7da5077d568658
- SSDEEP 768:U6Htxlds1wGKLPRlZ73fC5N487MT87WI7ngcasV/8Q7oV/+cnE0ovxpnxJVk98LF:JtGaGIL9Cf48oISI83sJRC4g8LxD3n
- TLSH T16633F1E3C1E755E89686C0ED7ACE0FF5677D39D897CC28990B406BAD58C0B814A93383
- MD5 SHA1 SHA512 SSDEEP TLSH
SV-262E3.png
- SHA256 5c17d224f226d25e7fdb447cd0baf9620d1329c700b3206845ae93a03ced9523
- MD5 6ad87fe53aa23c9332758a88d41bc77e
- SHA1 9e26d20a9e5ae9ae6e13cd9fd6cee2df136f69f9
- SHA512 2f3b5129490be7cfb2f599a9fafca67858614f070fa535d460bd8514a8598cf41c548059d57adeb144d18660ec89629ddb2445a0c80856eb798388065491e9c2
- SSDEEP 768:T2M/xzjIQuvy1fL6Z/5jyXZzKmpyVfMRbVa1eFOXjdKHeqqx1OdWV8v+DNl7Ti9:T2kjZuvyJL6ZgYm8p1TjdKHTqwXvObq
- TLSH T1B233D044C26BD8456B1562BC3B621FB1D77F382853391C8046A6749FE8F9FE8A243C97
- MD5 SHA1 SHA512 SSDEEP TLSH
SV-262E4.png
- SHA256 90944797a975e857f69934758e85cbbe258a7bf54be1d441e30e6f670d793f6e
- MD5 bb766076a2ec26491323c5d3f38ca479
- SHA1 d4a228493f1fb62b1aa39ee3a9bb3af9616e762a
- SHA512 610b19b6b77ebe6beec1734f06fc8efc1dd101009bcb86dc859d98a9dfdefb82cac146b7f272231d6295e551850dd8706bf6ca065ba344d4c70f03c933d9494a
- SSDEEP 1536:W2UzjPoLAd7WEqBnV+8wLPPa9+tiWY5FGg7ZNhjxxxCU2i:WNOAIEqxjw7Pa9EaVN9xxxD
- TLSH T13B9302E3832C2A60BDAC66E77FAD65B38774903A2113B05B300E60B64875ED857F9761
- MD5 SHA1 SHA512 SSDEEP TLSH
SV2511.png
- SHA256 4bac16344f6761b442acdc1e53debeca0679144007311bbbd3a047a4cc5302c9
- MD5 c2ae4c3ba0ed3cbe6140695972c94c87
- SHA1 bc22bc1ffc3b055f138e4317cdc1b17c063c649b
- SHA512 15a217edabe6b71d4875ab2c2d366c3e71e746a08f724d73703f6c6cda311303e54d4e5dc32c8ccc7dcea3e188d65fc1632571aecb89257ba69a77c3f494c214
- SSDEEP 768:eHX13Acz2+1AV5amIi/SVJTQpuXT1Iqb8DidlB/rfNS5:MXB/z2Frx/8RQAJ9bDTVbNS5
- TLSH T15F13D087D0F6DB6D33DE80F667720F939ABE1C5D544E25F78144A68F68266E168002C7
- MD5 SHA1 SHA512 SSDEEP TLSH
SV2512.png
- SHA256 e2e4db6858829b1f3bb0f006b3c7f009591f31e10770815b8fc95f1b2d9c805e
- MD5 08b87000db2f990dfbf2d3a7572788fc
- SHA1 42f00690944a7bc9eabd87c6a8b16a3727bb3dce
- SHA512 b9506a06cf32248402175aeccd10475b9a97e1a457292abd815b14c92997558f88390d45e88a05117b8160d6a29f0a8fe7ce6a10dc9528f2a85917374d9e8bbd
- SSDEEP 1536:A7MfDX8dI2Sjsi/okFhEddM48U9WUKePLf/pFeemikA6c/WXJE:9j8dRUrFMdMdSPDp4vi1z/F
- TLSH T1C093024C8AB2E698CC9D39D12A27AC83D7FD64E34979F7F5D188146E5406B71F09208B
- MD5 SHA1 SHA512 SSDEEP TLSH
amstream.dll
- IMPHASH daa0a1e803cad6b878538c4dbd14c8e3
- SHA256 a08fcd2bb4d5c7990ccab8ea1a1bc6c8aa33c3edda59cfe2d8c082044a59ebaf
- MD5 ca66998db59bdb94f2f277767d458f19
- SHA1 f47b14dcebaf1ad738cbf6cea75cbed618daccf5
- SHA512 f10f9a9b35a77f7ff83e035c7897baed8543e193c585c3dd03c33a23c9403ad388fb802a60e04ef01465c165b6b935d7a888098215bfdac86415a7d794442afb
- SSDEEP 1536:ksbwOSm2mkN++/Oi1wlA3yB+SEcSH47J:B6SkN+MOiOB+SEcSH47
- TLSH T1AC535A0333EAC07AD6E392328D263B9E76F9EF06151B510262123E4A1F71146DBFE647
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
17314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
TerminateProcess
QueryPerformanceCounter
DuplicateHandle
CreateThread
MulDiv
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
SetEvent
lstrcmpW
CreateEventA
DisableThreadLibraryCalls
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
lstrcpynA
GetCurrentThread
GetModuleFileNameA
lstrlenW
lstrcatA
lstrcpyA
HeapDestroy
WaitForSingleObject
GetCurrentProcess
CloseHandle
GetLastError
GetCurrentThreadId
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueueUserAPC
user32
IsRectEmpty
CharNextA
wsprintfA
advapi32
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteKeyA
RegDeleteValueA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
oleaut32
VarI4FromStr
LoadTypeLi
RegisterTypeLi
SetErrorInfo
LoadRegTypeLi
VariantChangeType
SysAllocString
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
ddraw
DirectDrawCreate
msvcrt
??3@YAXPAX@Z
_purecall
free
??2@YAPAXI@Z
realloc
malloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
460B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=11, id=25, version=9210,
count=134, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
d3d.inf
- SHA256 7107d8f5e9fd0688ee10f6dbc0c499f95c958ee4db1cc03539fb33b21ab2326b
- MD5 4bfc102ea72cd8de226bb36afaa4a563
- SHA1 ee0554b01602782c15da1d0579a681fa8fd5c975
- SHA512 a6459225f711b7551586c462f211ed5c4bdcccd72d92005c51d6b95cc0520fcf8c8b9f48ca2defed39641f6640ec758596af63ea198154ff37f1b9720c689077
- TLSH T16F318B42BBB2F217DDA1432780836B27F1ED5693A45FFB4D1ED1070E890D8C867A748A
- MD5 SHA1 SHA512 TLSH
d3d8.dll
- IMPHASH 3c40abb96bb64c93687561630db1cad9
- SHA256 7e9c769b083334a393da27699b88b876885ab28359caba3dca66b802078cd9d4
- MD5 b8f8f9a01df46e2b59b6812b7d3a23e2
- SHA1 2263cb2c9dcade186ca9bf0ac8c304e5881f31e8
- SHA512 021ed46317a8a73c999cce54eab3b81008f86e1780192cd965959cffa0ecfb60f5fd91e6cd618fbd096e68edfdf8dc0eb07e221b655d17bf2288cb1eebf1dea8
- SSDEEP 24576:ZsNXP7oCa+k9oWalp26TxwenjKC03DF7G7sU:ZQzTaVoHlpVTxwenG2
- TLSH T190458D01EBF740F5D8831670109FF7FBF3359B55422189A3AAD4DC2BED7A692A076242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
146531
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
SetCursor
GetCursor
CreateIconIndirect
GetWindowDC
GetDesktopWindow
GetSystemMetrics
GetIconInfo
SetCursorPos
GetCursorPos
DestroyIcon
SystemParametersInfoA
GetClientRect
SetForegroundWindow
IsWindow
IntersectRect
wsprintfA
GetDC
ReleaseDC
LoadStringA
advapi32
RegSetValueExA
RegCreateKeyA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyA
RegQueryValueExA
RegCloseKey
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
gdi32
GetNearestColor
GetDeviceCaps
CreateDCA
CreateDIBitmap
GetObjectA
DeleteDC
DeleteObject
CreateCompatibleDC
GetSystemPaletteEntries
ddraw
UnlockCB
DdEntry21
DdEntry18
LockCB
DdEntry19
DdEntry17
DdEntry7
DdEntry11
DdEntry12
DdEntry9
DdEntry10
DdEntry1
DdEntry6
DdEntry2
DdEntry3
DdEntry20
DdEntry8
DdEntry13
DdEntry16
kernel32
EnterCriticalSection
LeaveCriticalSection
GetLastError
InterlockedIncrement
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
FreeLibrary
LoadLibraryA
lstrcpynA
OutputDebugStringA
GetCurrentProcess
InterlockedDecrement
CloseHandle
CreateMutexA
DisableThreadLibraryCalls
GetCurrentProcessId
LocalAlloc
LocalFree
lstrcpyA
CreateFileA
SetFilePointer
ReadFile
MoveFileA
DebugBreak
WriteFile
GetFileSize
SetErrorMode
InitializeCriticalSection
OpenFile
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcmpiA
HeapAlloc
GetProcessHeap
ConnectNamedPipe
SetNamedPipeHandleState
DisconnectNamedPipe
SetEndOfFile
PeekNamedPipe
GetCommandLineA
GetVersionExA
RtlUnwind
HeapFree
RaiseException
HeapReAlloc
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
Sleep
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
IsBadWritePtr
SetUnhandledExceptionFilter
HeapSize
GetACP
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsBadReadPtr
IsBadCodePtr
SetStdHandle
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
DeleteCriticalSection
GetCurrentThreadId
_lclose
DeleteFileA
FlushFileBuffers
D3D8GetSWInfo
DebugSetMute
Direct3DCreate8
ValidatePixelShader
ValidateVertexShader
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=49, version=8876,
count=1, id=48, version=8876,
count=5, id=18, version=8444,
count=136, productName=Unmarked objects (old),
count=2, id=25, version=9412,
count=7, id=25, version=9210,
count=28, id=64, version=9210,
count=71, id=29, version=9178,
count=57, id=1, productName=Unmarked objects,
count=111, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3d9.dll
- IMPHASH 8f4408a5bfa9b84d8d76deadf603d450
- SHA256 ee8838a3526f20444ae162f4a41acf515a366e6bb7ec59159b232c42778b9ce9
- MD5 acddb9f4108d05f30306d7500d24768f
- SHA1 5edb452ff951bb0c76476fe61532a40c38a7d48c
- SHA512 b6adeb7249d5983140e6d6699da9549440dd9a749d66eb7c44db354ce5fa32725834f5a03c6b2e31ce51a6c3d9b7ec50433089d2a871494c9a14b372319592a2
- SSDEEP 24576:wHre6NuuXD0b9zTjCogccFVHfUY/imNwnFiqRMuP86exYj6PJv4mJMcxl9Q7w275:wHrR3D0b9PjCAY/imNa8hxYj6PJv4mF
- TLSH T13B759E42FABB44F1DC82257014AF777FB238EB0A47259AC3E6E0ED649D326915037297
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
319267
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
IsWindow
GetCursorPos
SetCursorPos
GetCursor
SetCursor
DestroyIcon
SystemParametersInfoA
GetSystemMetrics
GetDesktopWindow
GetWindowDC
CreateIconIndirect
GetClientRect
SetForegroundWindow
IntersectRect
wsprintfA
ReleaseDC
LoadStringA
GetDC
advapi32
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
gdi32
GetNearestColor
GetSystemPaletteEntries
CreateCompatibleDC
CreateDIBSection
DeleteObject
SelectObject
DeleteDC
CreateDCA
CreateDIBitmap
GetDeviceCaps
ddraw
DdEntry10
DdEntry19
DdEntry9
DdEntry21
LockCB
DdEntry18
DdEntry17
DdEntry12
DdEntry5
DdEntry4
DdEntry7
DdEntry11
UnlockCB
DdEntry20
DdEntry13
DdEntry16
DdEntry24
DdEntry8
DdEntry3
DdEntry22
DdEntry6
DdEntry23
kernel32
GetProcAddress
LoadLibraryA
InterlockedDecrement
GetSystemDirectoryA
GetModuleHandleA
lstrcpynA
OutputDebugStringA
GetCurrentProcess
CloseHandle
CreateMutexA
DisableThreadLibraryCalls
GetCurrentProcessId
LocalAlloc
LocalFree
SetErrorMode
_lclose
ReadFile
OpenFile
WideCharToMultiByte
GetVersionExA
CreateFileA
MultiByteToWideChar
SetFilePointer
MoveFileA
DeleteFileA
WriteFile
GetFileSize
lstrcmpiA
GetCommandLineA
FreeLibrary
RtlUnwind
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
LeaveCriticalSection
GetEnvironmentStringsW
GetProcessHeap
Sleep
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
HeapReAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
TlsAlloc
CreateEventA
CreateThread
WaitForSingleObject
ExitThread
SetEvent
WaitForMultipleObjects
DebugBreak
EnterCriticalSection
InitializeCriticalSection
GetEnvironmentVariableA
TlsSetValue
TlsGetValue
GetTempPathA
GetProcessAffinityMask
SetThreadAffinityMask
ResumeThread
SetThreadPriority
DeleteCriticalSection
GetCurrentThreadId
InterlockedIncrement
GetLastError
FreeEnvironmentStringsW
GetCurrentThread
SetEndOfFile
RaiseException
SetUnhandledExceptionFilter
winmm
timeBeginPeriod
timeEndPeriod
DebugSetLevel
DebugSetMute
Direct3DCreate9
Direct3DShaderValidatorCreate9
PSGPError
PSGPSampleTexture
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=113, productName=Unmarked objects (old),
count=3, id=18, version=8444,
count=2, id=25, version=9412,
count=9, id=25, version=9210,
count=26, id=64, version=9210,
count=145, id=29, version=9178,
count=61, id=1, productName=Unmarked objects,
count=102, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3dim.dll
- IMPHASH a8d3a8f00f292ed95b4bdd305d1511e7
- SHA256 bb954af553a3cfcdcf4a561647dfd93e263756bcb11a8cabc659734ff59d04ff
- MD5 aa2bce30745884eff2a987953098eb87
- SHA1 55a202047408dddabc457eab60b0fab475231fbd
- SHA512 91b2e1eee4bc8ed287bca805883c36144067d9c98d6dc3591358c8692f71ff82532dbac6fd7927f70e109391782c2691e7f5b3d43533e28b8ff1b62a5bf467dc
- SSDEEP 12288:QrCzjICYpX+ulw/4ZDg8R0hAQS7KtTnrvg:QA/6nR0hAEg
- TLSH T16FD4AE62E9E2C0FAD8875B33844E373EB67D438686118CE38FD42DA5AD50F91712625F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
132464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwind
user32
SetRect
IntersectRect
advapi32
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
ddraw
DDInternalUnlock
D3DParseUnknownCommand
DDInternalLock
GetAliasedVidMem
kernel32
GetCurrentProcess
VirtualFree
GetCPInfo
HeapCreate
OutputDebugStringA
FreeLibrary
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadCodePtr
IsBadReadPtr
ord98
ord97
GetCurrentProcessId
GetVersionExA
GetSystemInfo
ord93
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetCommandLineA
GetVersion
RaiseException
ExitProcess
TerminateProcess
DebugBreak
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapSize
HeapReAlloc
FlushFileBuffers
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
WriteFile
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
GetLastError
SetFilePointer
CloseHandle
VirtualAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
CreateFileA
ReadFile
SetEndOfFile
D3DFree
D3DMalloc
D3DRealloc
Direct3DCreate
Direct3DCreateDevice
Direct3DCreateTexture
Direct3DGetSWRastZPixFmts
Direct3D_HALCleanUp
FlushD3DDevices
FlushD3DDevices2
PaletteAssociateNotify
PaletteUpdateNotify
SurfaceFlipNotify
Name
.text
Size
533KB
Virtual Size
532KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
51KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=14, version=7299,
count=11, id=1, productName=Unmarked objects,
count=7, id=19, version=8152,
count=343, productName=Unmarked objects (old),
count=1, id=14, version=8204,
count=7, id=19, version=9049,
count=1, id=6, version=2051,
d3dim700.dll
- IMPHASH e3f2a1829330babefd2af5f7f12637dd
- SHA256 6651cb81c461e60dd323129d8c239e140f2589ecef2a09fb319de61f491e70da
- MD5 2d6910b215d7b114d4d991411dfa9491
- SHA1 6cd45c57ed207d08271d91d74f4cd1cbe0ee2d0a
- SHA512 da172d2e31729f217c5c92c70eff8cfe35aa7f1f091f4ed2689a2b2b3616847f73d5776e6acaa1f980500e4b7524466ab90c57f1e21ffd223cc683525f82d6b5
- SSDEEP 12288:XRXjYb+EgHeyO0VUV3bHnx95k7LDJrpXrXKkIFWUZZ+l:Ri+/lCFQ7LD7r6kdS+
- TLSH T1AF159ED1EFF545B6C9930531942F2FEF7CBE8302C45104A799D02EAABEB0B96752121B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
156379
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
IntersectRect
IsRectEmpty
advapi32
RegSetValueExA
RegCreateKeyA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
ddraw
DDInternalLock
DDInternalUnlock
GetAliasedVidMem
D3DParseUnknownCommand
kernel32
LocalReAlloc
GetEnvironmentStrings
LocalFree
EnterCriticalSection
LeaveCriticalSection
IsBadCodePtr
FreeLibrary
IsBadReadPtr
ord98
ord97
GetCurrentProcessId
GetVersionExA
GetSystemInfo
GetModuleFileNameA
GetModuleHandleA
ord93
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryA
GetCommandLineA
RtlUnwind
RaiseException
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
HeapSize
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
WriteFile
SetUnhandledExceptionFilter
HeapAlloc
SetFilePointer
FlushFileBuffers
CloseHandle
Sleep
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetStdHandle
CreateFileA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
GetProcessHeap
ReadFile
GetLocaleInfoA
VirtualProtect
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
LocalAlloc
CreateTexture
D3DBreakVBLock
D3DFree
D3DMalloc
D3DRealloc
D3DTextureUpdate
DestroyTexture
Direct3DCreate
Direct3DCreateDevice
Direct3D_HALCleanUp
FlushD3DDevices
GetLOD
GetPriority
PaletteAssociateNotify
PaletteUpdateNotify
SetLOD
SetPriority
SurfaceFlipNotify
Name
.text
Size
768KB
Virtual Size
767KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=49, version=8876,
count=6, id=18, version=8444,
count=2, id=25, version=9412,
count=5, id=25, version=9210,
count=132, productName=Unmarked objects (old),
count=24, id=64, version=9210,
count=92, id=29, version=9178,
count=18, id=1, productName=Unmarked objects,
count=94, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3dpmesh.dll
- IMPHASH b3086d42fa0bf235e36f93dd418c52d2
- SHA256 1836cc752212d28d6f04baef79068934f7c491f4fff3158a2a68aaa66c5d7051
- MD5 7f022ac4bea9683713ac385de6fbe576
- SHA1 b85ed3158152cd0246b5b28069032bcf904c40fc
- SHA512 1f9957533a8fa164e376da76df7a030298ad34b90908453334794677247d08650b268730933607ae54041879ed8245719bac8005eba4eae1c1a07413340cfb82
- SSDEEP 1536:8bkg97En8YgxLFatvK5S3McMbQgvPM7QEmb6S70TokS44sacYfxhA:YL9c6xLFaZK5S3MnbQ+E7QEQ6S70kkZ3
- TLSH T1A6839D81A99050FDD083533C59FABFB19BF95B5214394DCAC7A0E9295C722A1F63C23B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
40704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FreeEnvironmentStringsW
SetEvent
EnterCriticalSection
lstrlenA
lstrcmpA
lstrcpyA
HeapAlloc
HeapFree
HeapCreate
HeapDestroy
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
LeaveCriticalSection
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
VirtualFree
WriteFile
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
GetLocaleInfoA
FlushFileBuffers
CloseHandle
SetStdHandle
SetFilePointer
GetLocaleInfoW
CreateD3DRMPMeshVisual
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=1, productName=Unmarked objects,
count=3, id=19, version=8124,
count=1, id=19, version=8034,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=103, productName=Unmarked objects (old),
d3dramp.dll
- SHA256 7ea6c441cfbe9a293437a3abb1ce33c4fda5c8c90c7ce6af382f45923451cc13
- MD5 e506608ea77e42b6102ee5f7013502f1
- SHA1 1f97b93e30f154e5412bfe24b1f758f69094fc35
- SHA512 86d4dbd2dccbea6a9cd8a1f45ffab3b8ff72d6c63a55c1683120ce548dad7e9081a26adc61ad2ee0f8be5ba178f6b31d8b03dca379394a27d260716937a7e480
- SSDEEP 12288:8KADAXXzqwzqBw9djYJzKjENIZrDaFn8eMrk5ZUa60b6TtXkeg48UToD31zckANW:LyZZlzJpKQyrM
- TLSH T105C4C7A30F89C969CC52F67C642C3BD3E8DD17226514B8DCB6D824C66E1C293F5286DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
RampOldTri
g_RampOld_BeadTbl
Name
CSEG
Size
419KB
Virtual Size
419KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
512B
Virtual Size
453B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DSEG
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=19, version=9049,
count=1, id=6, version=2051,
count=43, productName=Unmarked objects (old),
d3drm.dll
- IMPHASH 7d187e631558c60627782494fbf69e5c
- SHA256 7191811425581d47015dc2a8cf8d4b459df9dd15a22e592cc31966bb4030424f
- MD5 cb72d672a72fea16395cc78bbeb3aa7c
- SHA1 c0cb0c7f30d5a80e76f97dd967761e60e8b87d8b
- SHA512 3941e8e4e4ecb4f0109f6084c8ae95b8e179c5517fb8c401f41d4ab82bf66ef832a12955b7bac9f5391476de1119a62d7e9923febc65dd3f1fdbc7794f27f211
- SSDEEP 12288:vBT4xQQGD3e5CA68dd/n+lpJP+aq9XInHrBY:vBTzQGD3gCsdd2lpJPdq9X2rBY
- TLSH T1E3947D1372D18039E0535372899777F9FBBA6B123875E48FAFCC89591F60542622E32B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
334464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwind
kernel32
DeleteCriticalSection
GetSystemInfo
IsBadReadPtr
IsBadWritePtr
CloseHandle
GetProcAddress
LoadLibraryA
LocalFree
lstrcpyA
lstrlenA
lstrcpynA
lstrcatA
CreateFileA
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
FreeLibrary
GetLastError
GlobalFree
GlobalLock
SetFilePointer
ReadFile
GetCurrentProcessId
DeleteFileA
SizeofResource
FreeResource
LockResource
LoadResource
GetTempFileNameA
GetTempPathA
FindResourceA
lstrcmpA
Sleep
GetProfileIntA
GlobalReAlloc
GlobalUnlock
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
HeapAlloc
HeapFree
HeapReAlloc
HeapCreate
HeapDestroy
GetCommandLineA
GetVersion
GetLocalTime
InterlockedExchange
CreateEventA
ResumeThread
CreateThread
TlsSetValue
ExitThread
ExitProcess
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
VirtualFree
WriteFile
GetModuleHandleA
VirtualAlloc
GetStringTypeA
GetStringTypeW
RaiseException
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
GetLocaleInfoW
EnterCriticalSection
SetEvent
WaitForSingleObject
LeaveCriticalSection
GetTimeZoneInformation
GetSystemTime
GetCurrentThreadId
user32
GetDC
SetRect
ClientToScreen
ReleaseDC
wsprintfA
GetSystemMetrics
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
gdi32
GetSystemPaletteEntries
GetDeviceCaps
ddraw
DirectDrawCreate
msvfw32
ICImageDecompress
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
D3DRMColorGetAlpha
D3DRMColorGetBlue
D3DRMColorGetGreen
D3DRMColorGetRed
D3DRMCreateColorRGB
D3DRMCreateColorRGBA
D3DRMMatrixFromQuaternion
D3DRMQuaternionFromRotation
D3DRMQuaternionMultiply
D3DRMQuaternionSlerp
D3DRMVectorAdd
D3DRMVectorCrossProduct
D3DRMVectorDotProduct
D3DRMVectorModulus
D3DRMVectorNormalize
D3DRMVectorRandom
D3DRMVectorReflect
D3DRMVectorRotate
D3DRMVectorScale
D3DRMVectorSubtract
Direct3DRMCreate
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
375KB
Virtual Size
375KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=19, version=8022,
count=125, id=1, productName=Unmarked objects,
count=15, id=19, version=8124,
count=4, id=19, version=8034,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=329, productName=Unmarked objects (old),
d3drm.inf
- SHA256 9c3fc116dba3efef31876ea2e723d2743187e8fdfbe57bb88f50326551563d3f
- MD5 eb0cefd4463bdbbbcccb6f90e495c8d4
- SHA1 d52b1740441975014e281f477bc8244dafc62ea2
- SHA512 d6bea354da713cba950832541639be82646bd4e56cf8b0d734479f299223a2c97a6becf23d5c7afe70dd64a9b509d28aa4784fd90568ee1b759cf768d45cfcae
- TLSH T11A01DB43F3E690CB64DCD60956ED0566A14D3D34B0C9ACBC17A5C300940DCBACD7E583
- MD5 SHA1 SHA512 TLSH
d3dxof.dll
- IMPHASH 16b7e072dd7adabb232ed23a07e8cada
- SHA256 497696218f5b348e7393485895cb6a49e934f0c6c43853718a96a264ba7df4b5
- MD5 b83454f89f85d169aec0f731273325a1
- SHA1 b696108e159b41d29603a5057f638f4167bb8297
- SHA512 8d29370e46737c2ad3fffa89e18a0336b14f911691c968e357177fa545e8864d91276ead4e79e9b10f7d5583ec6e6f268f901e9d4bb7b893c27d20e8b0825a36
- SSDEEP 3072:LQLziOcLGpgwjNiyJCyPa+fN7oWRXE/SSlWcUuY2z7+:zYg6iCCl+fNcWRXE6H
- TLSH T141B39E2178F290F2E011027D04E7FB729F3F5A615516CB678354EEA19EBE1A0A23D94F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
45120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThreadId
WaitForSingleObject
SetEvent
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
CreateEventA
CloseHandle
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
lstrcmpA
IsBadReadPtr
lstrlenA
IsBadWritePtr
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
WaitForMultipleObjects
CreateThread
GetProcAddress
LoadLibraryA
DeleteFileA
WriteFile
GetTempFileNameA
ReadFile
SetFilePointer
MoveFileA
HeapAlloc
HeapFree
HeapReAlloc
HeapCreate
HeapDestroy
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
LeaveCriticalSection
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
VirtualFree
GetModuleHandleA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
SetStdHandle
GetLocaleInfoA
FlushFileBuffers
GetLocaleInfoW
DirectXFileCreate
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=93, id=1, productName=Unmarked objects,
count=3, id=19, version=8124,
count=1, id=19, version=8034,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=133, productName=Unmarked objects (old),
ddhelp.exe
- IMPHASH b1c26122ccb7b48ddd747c1bca82f205
- SHA256 9776ee6d94a2c1c4745b59073723363a66c9fd574d6696d2c34cbfdb9d54ae0f
- MD5 0b59a22eea45a9032a3c4eca40d3ba93
- SHA1 93ea04a7ee1fcea68b83eab0df2edb0498458333
- SHA512 6959c22548c528b05cf73c534bc5a22cf86a077e7c76b9af07ffe02e8bb111054f7a1ca0ee4da579865dc23cbf628bc9ccc2c37dff781199121c02962be24d88
- SSDEEP 384:zFaAKTXn3hemY6G+pv2BR7wYpj+RiP13BIbzqc+Vrout65H+Sbs2WnZrW:TKTMmYrr13a/qcuMjbsR
- TLSH T155E25D017AE8D83FFC87413215B24B036736A90049B5A39F1BC4598B9F7BAF5A9343D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19133
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LeaveCriticalSection
EnterCriticalSection
CloseHandle
WaitForSingleObject
OpenProcess
SetThreadPriority
GetCurrentThread
ResetEvent
SetEvent
CreateThread
GetPriorityClass
UnmapViewOfFile
GetCurrentProcessId
MapViewOfFile
InitializeCriticalSection
CreateMutexA
ExitThread
CreateEventA
SetPriorityClass
SetCurrentDirectoryA
GetSystemDirectoryA
HeapAlloc
HeapFree
HeapReAlloc
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
GetCurrentProcess
TerminateProcess
FreeLibrary
CreateFileA
LoadLibraryA
GetProcAddress
lstrcmpiA
SetErrorMode
lstrlenA
CreateFileMappingA
lstrcpyA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
VirtualQuery
GetStringTypeW
GetStringTypeA
RtlUnwind
LCMapStringW
MultiByteToWideChar
LCMapStringA
VirtualAlloc
Sleep
GetCPInfo
GetOEMCP
GetACP
VirtualFree
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetLastError
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStdHandle
WriteFile
RegisterServiceProcess
GetCommandLineA
GetVersionExA
GetStartupInfoA
ExitProcess
gdi32
CreateFontA
SetTextColor
SetBkColor
ExtTextOutA
SelectObject
GetTextExtentPoint32A
GetStockObject
CreateDCA
DeleteDC
DeleteObject
user32
ReleaseDC
DefWindowProcA
DispatchMessageA
TranslateMessage
CreateWindowExA
RegisterClassA
RegisterWindowMessageA
GetSystemMetrics
ShowWindow
UpdateWindow
GetDC
GetClientRect
ScrollWindowEx
GetMessageA
BeginPaint
EndPaint
FillRect
KillTimer
PostQuitMessage
SetTimer
wsprintfA
winmm
timeSetEvent
waveOutClose
waveOutSetVolume
waveOutGetVolume
waveOutOpen
timeKillEvent
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=34, productName=Unmarked objects (old),
count=1, id=29, version=9178,
count=9, id=25, version=9210,
count=81, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=9, id=64, version=9210,
count=39, id=28, version=9178,
count=1, id=61, version=9210,
ddraw.dll
- IMPHASH 994fa478b419c1ced312e16ef1cf95e6
- SHA256 e8facaa20b0aa1a0c2d78cd8e225fa09e05f5a1aec66747a39d817be04b65f47
- MD5 9d898120222f68daf6931c84ef5e54c5
- SHA1 e11bb2b42d6adf376397c53efa6ac90b72e77176
- SHA512 80c94b4f4cff1d4b3e974fa67a7776fcb3f23485fc14b2359e8ee3e273a43dea66d7e5ebe0d12e8a35b9a26fb97526988b4329518410df6d8285a71aece5d6ee
- SSDEEP 6144:4eI5yze4QT7Lkcr0u9I7qB5pgun0cIbDjXvY3LZsHEjn331PyRqdsFItl:W5yzsT7LgqI7e0cGHfWZuELERqftl
- TLSH T18F849E21F7F09035E0F712F55A2D17693A7AFB208938999F3A450ED92E30B91BA31357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
92969
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwind
user32
GetForegroundWindow
GetDC
EqualRect
IntersectRect
ChangeDisplaySettingsA
RedrawWindow
UnionRect
GetClassInfoA
wsprintfA
GetDCEx
ClientToScreen
GetClientRect
GetWindowThreadProcessId
SetCursor
KillTimer
SetWindowLongA
SendMessageA
IsIconic
PostMessageA
CallWindowProcA
GetKeyState
SetFocus
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetLastActivePopup
GetAsyncKeyState
keybd_event
SystemParametersInfoA
SetForegroundWindow
SetWindowPos
OffsetRect
ShowWindow
IsZoomed
SetTimer
ClipCursor
GetDesktopWindow
GetWindow
GetWindowLongA
IsWindowVisible
IsWindowEnabled
GetParent
DefWindowProcA
RegisterClassA
CreateWindowExA
DestroyWindow
UnregisterClassA
GetKeyboardType
MessageBoxIndirectA
LoadStringA
GetSystemMetrics
EnumDisplaySettingsA
IsRectEmpty
CopyRect
SetRect
mouse_event
IsWindow
ReleaseDC
advapi32
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
kernel32
GetStdHandle
WriteFile
GetCPInfo
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
RaiseException
ExitProcess
LCMapStringW
LCMapStringA
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
GetACP
GetOEMCP
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleFileNameA
SetFilePointer
lstrcmpiA
GetPriorityClass
LocalAlloc
LocalFree
GetCurrentProcessId
GetLastError
GetSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryA
LeaveCriticalSection
EnterCriticalSection
MakeCriticalSectionGlobal
ReinitializeCriticalSection
InterlockedExchange
ord93
DisableThreadLibraryCalls
ord98
ord97
GetModuleHandleA
lstrcpyA
IsBadCodePtr
GlobalMemoryStatus
SetErrorMode
lstrcpynA
CloseHandle
GetExitCodeThread
WaitForSingleObject
CreateThread
IsBadWritePtr
GetSystemDefaultLCID
MapSLFix
OpenVxDHandle
UnMapLS
MapLS
IsBadReadPtr
GetProfileIntA
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetPrivateProfileIntA
DeviceIoControl
OutputDebugStringA
ThunkConnect32
FT_Thunk
FT_Exit4
FT_Exit20
SMapLS
SUnMapLS
SMapLS_IP_EBP_8
SUnMapLS_IP_EBP_8
SMapLS_IP_EBP_12
SUnMapLS_IP_EBP_12
SMapLS_IP_EBP_16
SUnMapLS_IP_EBP_16
SMapLS_IP_EBP_20
SUnMapLS_IP_EBP_20
MapSL
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
HeapCreate
GetVersionExA
CreateFileA
ReleaseMutex
SetEvent
UnmapViewOfFile
OpenMutexA
MapViewOfFile
CreateFileMappingA
CreateEventA
CreateProcessA
OpenEventA
GetCurrentProcess
lstrcatA
_lclose
ReadFile
OpenFile
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryA
lstrlenA
SetPriorityClass
gdi32
CreateDCA
SetStretchBltMode
StretchBlt
SetBkColor
ExtTextOutA
PatBlt
StretchDIBits
SetObjectOwner
GetObjectType
SaveDC
SetPaletteEntries
SelectPalette
RealizePalette
GetNearestColor
DeleteDC
CreateCompatibleBitmap
GetDIBits
CreateDIBSection
CreateCompatibleDC
SelectObject
GetSystemPaletteEntries
SetDIBColorTable
BitBlt
RestoreDC
GetDeviceCaps
CreatePalette
ResizePalette
DeleteObject
ExtEscape
GetStockObject
GetRegionData
GetDeviceGammaRamp
SetDeviceGammaRamp
SetSystemPaletteUse
AcquireDDThreadLock
D3DParseUnknownCommand
DDGetAttachedSurfaceLcl
DDHAL32_VidMemAlloc
DDHAL32_VidMemFree
DDInternalLock
DDInternalUnlock
DSoundHelp
DdEntry1
DdEntry10
DdEntry11
DdEntry12
DdEntry13
DdEntry16
DdEntry17
DdEntry18
DdEntry19
DdEntry2
DdEntry20
DdEntry21
DdEntry22
DdEntry23
DdEntry24
DdEntry3
DdEntry4
DdEntry5
DdEntry6
DdEntry7
DdEntry8
DdEntry9
DirectDrawCreate
DirectDrawCreateClipper
DirectDrawCreateEx
DirectDrawEnumerateA
DirectDrawEnumerateExA
DirectDrawEnumerateExW
DirectDrawEnumerateW
DllCanUnloadNow
DllGetClassObject
GetAliasedVidMem
GetDDSurfaceLocal
GetNextMipMap
GetOLEThunkData
GetSurfaceFromDC
HeapVidMemAllocAligned
InternalLock
InternalUnlock
LateAllocateSurfaceMem
LockCB
RegisterSpecialCase
ReleaseDDThreadLock
UnlockCB
VidMemAlloc
VidMemAmountFree
VidMemFini
VidMemFree
VidMemInit
VidMemLargestFree
thk1632_ThunkData32
thk3216_ThunkData32
Name
.text
Size
323KB
Virtual Size
323KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=162, productName=Unmarked objects (old),
count=2, id=25, version=9412,
count=5, id=25, version=9210,
count=12, id=29, version=9178,
count=35, id=64, version=9210,
count=71, id=1, productName=Unmarked objects,
count=123, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
ddraw.inf
- SHA256 7c01dd5b7aff7d677dc127b0d2a0123c999b8d02e724c8af4704a9ccceb79f51
- MD5 7bd4ae62cfc4ccb7b47fb8fc8da733cb
- SHA1 541b5f20e9803ac2093d77562b2e843c22ff3c49
- SHA512 9d0c6d49928d08a46aba71625d814537a69ff9c9833532911e81886a79c4f364b81ab734e4d5df73c8e68be7165ff616fcadf8cbd09a9dcc48e8051b951c6565
- SSDEEP 96:6UQBY65L1kF1kt1kN1k41kv1ky1ke1kz1ke1kP1k+1kW1kS1k91kr1km1k01kL1k:6UQBXJyU8zOPV6rQffrsOHLMJvX9sCF6
- TLSH T143A12541F365C103D44DB01A87947E12665C928724CAEF0E6DD6C7B88617EF9A33C94F
- MD5 SHA1 SHA512 SSDEEP TLSH
ddraw.vxd
- SHA256 42c17f57eacc22f5c57d195678d1f48717c69c11d510c51518f047a9bd2a6fe8
- MD5 ba327b445954d746c4b4f5d60c759baf
- SHA1 11020782e11b90b0e3ec1dc83c1a28f1421f4e38
- SHA512 d78e5cc276a08c7556c5f5823f920453813479032d57bea292ad5add876b398b55f085a2afb37ec4d0ab7db70c4979e000ec7c01501f363deb15833df8068455
- SSDEEP 384:x9i9UTTik9PS4THA7lmpK16NGeP+n0IS6U6f2XoeFlsldqVcQ:+9NJ47+lmp6UUZK6zeclYVcQ
- TLSH T132D23BD1A8B3D07BD8CA8371964FA70DCE3FAB3A0837551B733266913EB1956E501835
- MD5 SHA1 SHA512 SSDEEP TLSH
ddraw16.dll
- SHA256 b1563c5dae78ed18cf2561086523b1b6007e8a3edd4a18ef88f0cad1bcfb65d9
- MD5 687f775a9f1525cf2c371c82ff4ca553
- SHA1 2280c187d7e2fd093da22b33da98dac27b4fb03b
- SHA512 e1dc2477286c44a95523666aabb92da8489068a267e063f4ac3ce055ffab58e0adccbc922820d99dd2841455a1061a661ff312fddd584b04de01d0419934619c
- SSDEEP 384:YanygHn/L1yF9zVy8IKF95roCG5qybYUcPfUMqtHXk1uu39Ympcm7Opv0K:1hL1yDj95rWEBUYe5X8uu39Bpcmgs
- TLSH T1F4D25B23745DC1F1C969427082BAEB5687EFEF4A2B4925338F781A5F3D60796872F024
- MD5 SHA1 SHA512 SSDEEP TLSH
ddrawex.dll
- IMPHASH 84cac4e75ecba882b130d19c35d1f7bb
- SHA256 417875a29c9a51780bfac940992b5f12d6de7b7f820caa91133b6011ce69f0cd
- MD5 aa124e42bdf12becd03dd91bcff6cf80
- SHA1 e02173bb93958090c7c086a632e06146a1c386d7
- SHA512 08c47771a23740f2759aeffe69045dc3bf18c29e9b66d440af13c024846bac76be20a08df9f04a380fab8d9b5bfcfa173f640b4c00218b1293ec5dc716805b06
- SSDEEP 384:wf6xqK4R+yv5sdKqysXNA8UCKrOOwq3YevvKsekdjixz1+Esxd5uuTcUV7hr+2vl:wCEKje5sdBysXG8UXOzq3YjsFjix5Rsz
- TLSH T179B21B5333D32079C1EB73778D65754FF3A49F1418309A0A8BE65A0327F260AD998B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5572
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
ReleaseDC
GetDC
MessageBoxA
wsprintfA
kernel32
lstrlenA
LoadLibraryA
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
LocalFree
GetProfileStringA
FreeLibrary
GetVersionExA
GetProcAddress
LocalAlloc
SetErrorMode
DisableThreadLibraryCalls
advapi32
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegOpenKeyExA
RegCloseKey
gdi32
DeleteObject
CreateDIBSection
DeleteDC
CreateCompatibleDC
GetSystemPaletteEntries
SetDIBColorTable
SelectObject
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
ddraw
ReleaseDDThreadLock
AcquireDDThreadLock
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=1, productName=Unmarked objects,
count=11, id=19, version=8152,
count=5, id=19, version=9049,
count=1, id=6, version=2051,
count=8, productName=Unmarked objects (old),
devenum.dll
- IMPHASH 6b6b7f1fca7e48432d882e6d001c1d9b
- SHA256 117443ca187736e4cdb19cca188e0570cd6255790149ab95760015ab7892aad8
- MD5 f77515bef113d6a3a51d48fa7b43b198
- SHA1 beedab29b9fb916d746375242ad004531fa98a91
- SHA512 cd2bcbcf0a3280a9221e3d91460388141d3226885324c1a5f8b9d4d24c2d9e8d08687f67986cb5943654ebcb96c71b2376c1a69bf486033d12a65c41a9348fcb
- SSDEEP 3072:hzTHhQp4BXcrpBZLIijHGZbhiWU7tdVDd5ZnnKzs:xKKerp3NDA
- TLSH T1A5D3648177EF0559E5EE42B0297511E7856FE892C9F006F8A6AD9210A1F8F00E73CF97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
24319
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcatW
CreateMutexA
lstrcmpA
TerminateProcess
LoadLibraryA
GetProcAddress
DisableThreadLibraryCalls
GetVersionExA
ReleaseMutex
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
lstrcpynA
GetModuleFileNameA
lstrcatA
lstrcpyA
HeapDestroy
WaitForSingleObject
GetCurrentProcess
CloseHandle
GetLastError
lstrcmpiA
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenW
msvcrt
_purecall
free
??2@YAPAXI@Z
realloc
??3@YAXPAX@Z
_except_handler3
malloc
user32
LoadStringA
CharNextA
wsprintfA
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteValueA
RegEnumKeyA
ole32
CoCreateInstance
CreateBindCtx
StringFromGUID2
CLSIDFromString
CreateAntiMoniker
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VarI4FromStr
LoadTypeLi
RegisterTypeLi
SysAllocString
VariantClear
SysFreeString
winmm
midiOutGetDevCapsA
waveInGetDevCapsA
waveOutGetDevCapsA
waveInMessage
waveOutMessage
waveInGetNumDevs
midiOutGetNumDevs
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=11, id=25, version=9210,
count=162, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=20, id=29, version=9178,
count=1, id=61, version=9210,
diactfrm.dll
- IMPHASH 4858d3a4a4c5fc3b1e759ad75d7ca259
- SHA256 3510d00f14e60a4159c1ffb8e9af0e2324d56925158811ea965964ecca9edc73
- MD5 5f8c883e4c4d210d1eb855620353561f
- SHA1 3a55578c115e5df51420137ee2aeaeb1affce077
- SHA512 1912a951ba2273d5104e03a5eece398b27ff7ee0822a9a64478f87c16be5a401391a6a0514890a1e4e6a293e66847fe4d6b4b9881cf5b7c26354c1a1d6d14793
- SSDEEP 6144:b/SAOtN2pWJktzgNkt1sI9D22Mou3fgn2dvZKs6mLfQQeewQee2QeesQee2hQeep:mT2JDtH2XJ3kur6mdhTWcKB
- TLSH T11DA47C01B7F88136F0F36B3069BA276A6A7BBE429938C55F1B94056E1D30A45CE35373
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
114761
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
RaiseException
HeapSize
InitializeCriticalSection
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetFilePointer
SetUnhandledExceptionFilter
VirtualProtect
GetSystemInfo
VirtualAlloc
SetStdHandle
IsBadCodePtr
FlushFileBuffers
CloseHandle
EnterCriticalSection
LeaveCriticalSection
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsProcessorFeaturePresent
UnmapViewOfFile
CreateFileW
CreateFileA
CreateFileMappingA
MapViewOfFile
GetFileSize
GetEnvironmentStrings
lstrlenA
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
ExitProcess
MultiByteToWideChar
GetLastError
RtlUnwind
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
TlsSetValue
GetCurrentThreadId
GetModuleFileNameA
Sleep
WideCharToMultiByte
IsBadReadPtr
IsBadWritePtr
lstrcmpA
GetTickCount
MulDiv
lstrcpyA
GetModuleHandleA
InterlockedDecrement
InterlockedIncrement
lstrcmpiA
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualQuery
advapi32
RegOpenKeyA
RegCloseKey
RegQueryValueA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
ole32
CoTaskMemFree
StringFromCLSID
user32
WindowFromPoint
EndPaint
BeginPaint
IsWindowVisible
SetPropA
GetPropA
RegisterClassExA
EnumChildWindows
DispatchMessageA
TranslateMessage
GetMessageA
DefWindowProcA
ReleaseCapture
SetCapture
GetWindow
UnregisterClassA
GetClientRect
InvalidateRect
CreateWindowExA
DestroyWindow
LoadImageA
GetDesktopWindow
GetWindowDC
SetCursor
ValidateRect
LoadCursorA
GetIconInfo
DrawIcon
PostQuitMessage
ClipCursor
GetSystemMetrics
GetWindowRect
FillRect
GetUpdateRect
GetDoubleClickTime
SetFocus
SetParent
LoadStringA
IsWindow
MoveWindow
OffsetRect
GetDC
ReleaseDC
GetCursorPos
ScreenToClient
ClientToScreen
KillTimer
SetTimer
PtInRect
DrawTextA
InflateRect
ShowWindow
SendMessageA
SetWindowPos
GetParent
wsprintfA
PostMessageA
gdi32
SetBkColor
GetBkMode
GetBkColor
GetTextColor
CreateFontIndirectA
GetDeviceCaps
SetViewportOrgEx
OffsetViewportOrgEx
RestoreDC
SaveDC
CreateDIBSection
Polyline
DPtoLP
GetStockObject
GetObjectA
GetCurrentObject
LPtoDP
CreateCompatibleBitmap
StretchBlt
SetBrushOrgEx
SetStretchBltMode
GetBrushOrgEx
GetStretchBltMode
Polygon
ExcludeClipRect
IntersectClipRect
DeleteDC
CreateCompatibleDC
CreatePen
SelectObject
CreateSolidBrush
Rectangle
MoveToEx
LineTo
SetTextColor
SetBkMode
BitBlt
DeleteObject
dinput8
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
332KB
Virtual Size
331KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=8, productName=Unmarked objects (old),
count=13, id=25, version=9210,
count=211, id=1, productName=Unmarked objects,
count=33, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=126, id=28, version=9178,
count=116, id=29, version=9178,
count=1, id=61, version=9210,
diactfrm.inf
- SHA256 0fa10ec8733140fd48bd763e195c866029acfcc58869dc9b250f75d8ba080b30
- MD5 c981a5e3a834ae2f7be9b24fa12064c2
- SHA1 17ffd4b002fed95c17222aae988926e7cce502a5
- SHA512 5a039c0145c18ecc1f3f5bb638e27ad89c2cd8a2af27e80d144b640e691ad32a4948b27d21585b200ce6ebc3abe6cb1a2ecd8d02773db4c590465f576fcfbf20
- TLSH T13C1199BBCF3E4A9F19DD534FD8BA323241AC952AA0C1E18561D06102D84F4FCE45C5D9
- MD5 SHA1 SHA512 TLSH
dijoy.hlp
- SHA256 5fd8d8aa0201478bab648bc238bd62acb285fc6920093099b723f1bacbfa180f
- MD5 137415567983464456676fd31e6062cf
- SHA1 e3761e725a08fb9dc41484096c8efc163335cf71
- SHA512 eab0c78188fe7c8cb3f3705888d7c3fec80e72f18debf0e0f2431d011d752acac8cfe05f980af6fb60977c8447b15740fee33bea4b6e8cb40c1a06622b9199e1
- SSDEEP 192:rn86i/9CHs32dZd1xE9clDqjRmwMClDHpXF+r:rzs9sm2dZdvE9clKMClDHpXF+r
- TLSH T13A92316F395FC612D754CCB9D6F2B9B98E28DCE1EC704507F9023A0C94B1BA6D293648
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoybrz.hlp
- SHA256 ab933cd613b713ce5812db9832957d03a4aca976ba3e0b7cc1ca6dfd3d8d335d
- MD5 e56c0c19b188bc93bad580c9789a1ca9
- SHA1 d905fff0a3c4938636167e94f4da4a519c70d01c
- SHA512 cc12d77873c6cebf517d78a7a2f71484920013c8989c5a83298618b6b2f6b7d0a65e8e80e1e4be5e452f764ed98b3d8d4d05a59854b199357a72570ba2241eea
- SSDEEP 96:gZVmb1PBLJ3+NtFJvVzcxrDx+XDN0vUzO2VMSxXDb0uwJmIPtFC3kAtcv9MMMMJ:qsNJu51Od+bzbbxX30vXtNAtSj
- TLSH T11D42D540BD94CE73C9954B38DDEAA9ED2162BE4ADC544B43704D3F8C3C32149AA5A97C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoychs.hlp
- SHA256 a989146607cca03659d3e5cadee3fd9f92675e7f49233c9c926dd641d8323f49
- MD5 e2b12a7212974b373fb5cef7c16e2910
- SHA1 253503674d0078dfa80bcfd687190c30a339ea56
- SHA512 b54399cef70dccd029f20bb872ec1826cbce8b0de4ee34f12660aaa448f1a379174e29a249dc031a881550f09951c246c16be8a7d6286899f094d16c192467e7
- SSDEEP 96:bwZ02kGSkC2LZc6HjYa/4Ky+4sxnLCvEIafedWLajezW5/bSnUMMMMJ:blh2LZcCj31y+NLCM2WLER5/Ic
- TLSH T1D9329251BC54EA57E8410AB4ED96FBE9F426BC45CD508367380C3B1C7C33145AB5A87C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoycht.hlp
- SHA256 1a9eee00c310a19ceba3b867873350b2fd657fb5ad0a17f7dd897c4170816363
- MD5 4b068dac56444fe69c0a29f58593c414
- SHA1 d94da6d175e9c417dc7a32d2be499105e42e4551
- SHA512 4b1cfde3bff6a2bb0ed6dc222392fc280f0d3b110041e288d7d57ce578c39301936bddb84bcee30d33b8967e2e5408a99010ec75d5290083283cf27c1bb75995
- SSDEEP 192:sEDppRgEuwkafEorxNs9ZzmK6wMClDHpXF+r:skpvuwkafEorxNAzhfMClDHpXF+r
- TLSH T19DA202AA5D50865AE165E83DD5EB73FD4A30ED11ADE0460F761F2A4D24F3FC280A360E
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoycze.hlp
- SHA256 e54b683561ded2a33a9cb8ac880ca9d16bb3e9a385a7419547914937af7dccfe
- MD5 b24f65363c41999f491c42dfaaf68006
- SHA1 bb600555568ee35726694031f4608528e47b2551
- SHA512 b5dbec06cba3dd57dcfa5638e65f92bb86daa8364bc979802bdb27abd3433fc362472e4697c57d275f43673ebf856b7c4f01282d083f40c4395d70c5dbdffd28
- SSDEEP 192:2zlYYzxIvU58MqbFpvSLc0hVSIPgERX49zXqmwMClDHpXF+r:bY68NguLc0hV3g064MClDHpXF+r
- TLSH T18CA2AE1EAAD1C513E254EE3EEED772FA6E10DC41AD80C4077F66274E24F39978063A18
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoydut.hlp
- SHA256 3c6e39b2150de576234eabd114386b7e0c590344e478e5f466ddf9e6eba1e7de
- MD5 9cd3263bf30d9a8ee30e4c67b4618920
- SHA1 3cc9fda099838283b2069838e71b659eebc70351
- SHA512 5a54d4eeedc47516a1aab18ddeb2fc5f53faaa186df56db6e6e3182ee24839072a6ac80bed6b93499855e9b66040d7ddbe29cf9d3906d0364c80efcbf71bfbb0
- SSDEEP 192:aYchIP+0T5aBH4KWYe6jkm7n4SsA8h7wmhhx:aYcmmRBH42Jjkm7psB7F
- TLSH T1AA4208553D51DE13C9A80B38DCEA72ED35B2BC0A8E65474B345D3B2D3D32914B90A87C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyfrn.hlp
- SHA256 420a39d13d76208fb4945fbb50765f86a21a10a52636f2e6c9090ff2b4e80f5a
- MD5 bc2602451a67cd71e3235fee03a80e1d
- SHA1 04ac95bdf73a103a213151da1f5be2a9e4f3ff2c
- SHA512 0ef376aa4328952af14acad024d2c36692ec042b93e028b0ea0d0a8db0370cbc68ddeeaf3146793d9a1dcbb05886abf24aa953bef4ed4be9b797dc6145dd9385
- SSDEEP 192:sDiDSyd0l7T81cWesLa1gs6u/YdeUzRe0Z7+:sDEpGWP2196efUzReIK
- TLSH T1B642E4413D6AD6A3D5840A74DEE2B9ED2071BD08ED504F8374497B6C2C32359AA4F87C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyger.hlp
- SHA256 79f5403200d668c28eb612cf427399b675ca5e7dddc9ed6950f3d6d37ece8327
- MD5 a0b7f28be23af3fb2408fe16e129194b
- SHA1 c4c090b356ac72d27afd7e284cd961b860ff6353
- SHA512 a119fbc294a9fcf790b290507315280a8bc30ca15db60baa6128d4b9b131e09ee2fdb36dc373aa4212802557764ab29d1d3aa6d1761b9b06c12e06255d77a514
- SSDEEP 192:qbLEH4huJ9ytDTfuW5BGfCRsjFDI0FnJRh0g4qvCwMClDHpXF+r:qb7c7EmOkFDrn9v3MClDHpXF+r
- TLSH T17092101EBD94C913E164DD7ADEEB71DD5B21EC42ED80C00B76267B4E28F2A429053B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyitn.hlp
- SHA256 3d8fe49c80fc3c95944db5c3a2981ad6185b65005466d44115a38e5545daedca
- MD5 790a63022358d88838b75fdcebe0d117
- SHA1 d7bf4afe54bec452929c0c8bf7bfd865ac0f827d
- SHA512 ebf2d39bba567f67419d7abf1385b751e9d2b8df313a052f1d7f87f7dd99d2fe8e44240e4953661ce1ca6805717fa68865a1f784539f9ad01e2a70df54d32562
- SSDEEP 96:c/x8jt76wJu0owCknzvSjFS9YICxwKX1c7xUBzjhXsb9voBrVdMi9LkkSyT5mSL1:GejBQeqbQKX+7xUBzjhXEv2DMgF/Vv
- TLSH T111420710BDA9DE27CD9A0A749E9678EE3231FC85CC964B1735283B1CBC77090A61C87C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyjpn.hlp
- SHA256 82c877015c2991c295c91587cc72110bd5d60b82b395436bfe3f03378e3d651f
- MD5 860d56f398918504f7bf635cac90b1a8
- SHA1 0f9bf97ec06c6a9d6446b43d6b80e422bd12e172
- SHA512 b51057746685d8b6e2b128cda719fdbe89391f03d0404f7be1e96361e31635c05a38c59c4c477e9f2b2c82333cdb27c81b40c44aa056d90f678d21c0bca783b2
- SSDEEP 96:GjcNBGLt1TpRMijFlynTkQgZ8Mo9Swyi3Uw/7diN6LgOuma/BYHOutk1CBzh4oZH:7vWX3aTk31ISxikw/7GJ1KSYHWvqp
- TLSH T1974207543CA5DE23C8584AB5CCE9F9E9346BFE82CD128F4335253B0C6E72484568B9BC
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoykor.hlp
- SHA256 37c89ff5eb05509bb94fd65b07f7a00e797c0f0ca74a5dd3c7df5942739fb5ff
- MD5 7c71777a3efa0749bb57b29e2f696674
- SHA1 7f6b8c7d8bd35de23c957a30ca09f5ec80d0dfe7
- SHA512 ba0bb13635eef016153e6d06b9566c9a9701dfae0bae88f3a9d9b258e1340b0c098c7afd479e7f044ed5e6b2edb0c0d80feb27168df7f4c2467e09d9de56618f
- SSDEEP 192:Y6eF9MbwmylCRkwjwJdD1DfpNWJxfObB3J+Lk1CocwMClDHpXF+r:sMJyl3SwJdDxpIXfOt5FMClDHpXF+r
- TLSH T105925F1EADD1C513E6649C7AE9DBB1A95E21EC41FC80C40B371A3B4E28F2E966053F5C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoypol.hlp
- SHA256 78f5386903c55ce3e668ea6b1951d083f6b966d0bd7732def083f796bb5fc440
- MD5 eaa0f6e7220f0becb4f03d13a94898db
- SHA1 bf517524e7aac53108d623bd2f4b3a63e1221ec6
- SHA512 b65cae32346503ac1e54ab31484091debcf864b55bdb493cf6efa508fa88536867572a696e81fa9a0f58554766ab9372f6ae2f3f3a8de00a8d58485ccd2c6b4b
- SSDEEP 384:prpyZc0K4D1KJeUtAXknfPXUhMClDHpXF+r:prpyZdK4D1KJ1tAXkfPXx
- TLSH T12D92311E7D80C513E564AD3ADBEBB6ED5B24EC41FD80C40B37267B4E28F2A82605365C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyrus.hlp
- SHA256 83300151382c642a5c923429504ede2a9f5b85c1c90cf448db6f0d81e86fc3e8
- MD5 e24d0e58df91ba9dc49d3fa72705c431
- SHA1 f2cfb7faf7de946a95ed2a362fa15f03130a18d0
- SHA512 347250adfa27cb7585d0e8803e59062320aa7dfd8a1fbbfa2899e90f63f853fc421e2f31ff93915be3a2b9570bf0c6a3d8d91b0c6c3476fc371641422041f8d4
- SSDEEP 96:nZB9zpCtbqw4coli8GWF1HfXwHO4sM7h54+932Arm41YGvvRbzdES5BTJEw/MMMw:nZB99iqYAgEMoCI4mgFdEuJjN
- TLSH T14D42E755FCA8EAA7C8940E74ECD7A6ED3815FC51BC418B2375113F4D7C3204A6A1A47C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyspa.hlp
- SHA256 5708c8d5b7f66788501b41e95072bdcfc4f4a870669bed72522caf07f3e8ff32
- MD5 cc6fe8fb75fc04c142a555be4d58b045
- SHA1 8e42720e2b74afd73500e487c224ed27c26a77c1
- SHA512 985ebe210fd27170b76e94e6a5c151a0eb9ec2c30425b8a2f8813605f2104bb42e521e7f271fc4192f8b35c892a0c24b03ccab601901ad157dbea7699d3e4848
- SSDEEP 192:R0KBPPZApLQiMI/gUZOQT8KABedBowZsgq+4Z6x8:R0KBPPaBQiEQgQ1b8
- TLSH T122420846BD96EA7BC4944774CDEA69EC3072FC0AEC06478371193F2C7C76180AA2993C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyswe.hlp
- SHA256 24b9ccb7cbfdd39808025c1e40e39f73459419ab32a23f53e8f1b7411f90c030
- MD5 3939643e42362724cc79b10cbfed090d
- SHA1 78522d750ebac38913092eb91813fd694da58157
- SHA512 38b165e6642576f17dee54c733f1811f214d65475b3f0c82bfad0eec08ae891e50f91e319a97f1b785dbdaae5710ed16fc798c35ee3326293f4e56f3a1b18cb8
- SSDEEP 96:PUypMNALLx8G6paLKss/7bWxr/JOBHVinQtxTmpusARZX5ecZkJtPjAlkQ89WhMq:MyeNK9D7Ln47CxzcuQrCtA7tutLHfQ
- TLSH T1B342D650BC18ED57D4990678EEAFB9FD64667C89EE520B9332183B1C3C31049B58E17C
- MD5 SHA1 SHA512 SSDEEP TLSH
dimap.dll
- IMPHASH 4e9166a531644c5def658b728c82a383
- SHA256 ed5d8e59d1df84cdcaafd88680575c9d031296f07250abdec9a23ecf6a751d1b
- MD5 8427edc4bcaf087f78acc7c8ae787e3c
- SHA1 340dc00e89d5eab47a9021c3777fc1223b405585
- SHA512 a352d9718b5602a73a9373c69b83d94c647d1587ec24a9276e4feee795b59edd698293ad8e740b88861c4d1b16407fc829609a6ac14b2d06146d1820fb665d17
- SSDEEP 1536:Pb+/9PosvgraGUrGOr72/6a/QQMQKxeTtLcGAsoDvYyVJjcGEh:zCBeraGUrGO+/6ac6tLJb2VJjcGEh
- TLSH T1FA938C2370E0C6B2D5520534DAC47768BABAF4214D328DA7371CAA8D3F76A83F526357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
36852
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileIntA
CreateDirectoryA
GetPrivateProfileStringA
GetVersion
GetSystemTimeAsFileTime
GetModuleHandleA
GetCurrentThreadId
TlsSetValue
GetCommandLineA
GetVersionExA
RaiseException
RtlUnwind
ExitProcess
GetProcAddress
TlsFree
SetLastError
TlsGetValue
TlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
LeaveCriticalSection
WritePrivateProfileStringA
SetUnhandledExceptionFilter
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
HeapSize
VirtualAlloc
IsBadWritePtr
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsBadReadPtr
IsBadCodePtr
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
SetFilePointer
ReadFile
SetStdHandle
FlushFileBuffers
CloseHandle
GetLastError
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
advapi32
GetUserNameA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
user32
wsprintfA
CharUpperBuffA
ole32
StringFromGUID2
dinput8
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=25, version=9210,
count=94, id=1, productName=Unmarked objects,
count=1, id=11, version=8397,
count=18, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=93, id=28, version=9178,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
dimaps.inf
- SHA256 b762ccc6087e6089a923ac09134e19311e57d60e1cbdc4d1525576395d283c8d
- MD5 0545bc83300356cc68fdb44e0f90b774
- SHA1 0ea39abe3b95a3a4c73ac80ae1c5e36b13acd6bc
- SHA512 3557fae927a47db1293f50834236cc9bd1300902541eb742190a9d1695cb53d4363f482d40f1832af4271eed22dd86398d9b85a69b64d2f8f6b2fdcc2ba62621
- SSDEEP 192:D1XXRJO0FxTG5Q0U+y0J9zgR1FRPvdbxyNgBTTQai3a6ANIKZfZW8dvm/188OX63:DlhNxTG5Q0UGkOMs4BBKGS1V
- TLSH T13B62B9FA5D1ACE73D4E3D0C2E202AD17F54B9859D2A55DC4E8F1118ACB462A8803CBDA
- MD5 SHA1 SHA512 SSDEEP TLSH
dinput.dll
- IMPHASH 046ef65faa60d37c1d924c46c847304f
- SHA256 2a4774441b479dff353971f035cae61135ff7057f46b2a440ebf21d1b22bfccd
- MD5 a191f2f06e38852399395c3a967f9ea4
- SHA1 eceb766a856f01c5bb426f2afa4c9e25f809f628
- SHA512 4343bf709b524761ff4218729d52c1d6b66ebd83cd26d204916e0ca15206e22b5110bc17c200ae63eef58affd158140b3aa13defa671a86ab712a6924eb6d064
- SSDEEP 6144:o029v/CETjQks7tWBg/rrX6n1d121egnnnnnnnnnnnnnnnn:otnXsAS
- TLSH T127E40A01B3FD5629F2F3BB746EB916914E7BBDA2AA36C10D0250254E1D31F94DA20B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
110019
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
SetEvent
DeleteCriticalSection
ResetEvent
GetCurrentProcessId
IsBadReadPtr
IsBadWritePtr
WideCharToMultiByte
FreeLibraryAndExitThread
FreeLibrary
GetLastError
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventA
LoadLibraryA
GetTickCount
lstrcmpiA
ReadFileEx
DuplicateHandle
GetCurrentProcess
MultiByteToWideChar
lstrlenW
GetVersion
Sleep
ReleaseMutex
WaitForSingleObject
MulDiv
DeviceIoControl
LocalAlloc
LocalReAlloc
SleepEx
ResumeThread
GetProcAddress
DisableThreadLibraryCalls
UnmapViewOfFile
lstrcmpA
lstrcpyW
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetLocalTime
MapViewOfFile
CreateFileMappingA
CreateMutexA
LoadResource
FindResourceA
CreateProcessA
InitializeCriticalSection
GetVersionExA
IsBadCodePtr
GetCommandLineA
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
lstrlenA
CreateFileA
ReadFile
SetFilePointer
GetFileSize
lstrcpyA
CloseHandle
GetModuleHandleA
GetModuleFileNameA
GetFullPathNameA
InterlockedExchange
LocalFree
InterlockedDecrement
WriteFileEx
InterlockedIncrement
advapi32
RegCreateKeyExA
RegEnumKeyExA
RegQueryValueA
RegCreateKeyA
RegOpenKeyA
RegDeleteKeyA
RegQueryValueExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
user32
wsprintfA
CharUpperA
UnhookWindowsHookEx
GetWindowThreadProcessId
IsIconic
GetForegroundWindow
GetWindowLongA
CallNextHookEx
SetWindowsHookExA
PostThreadMessageA
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
GetInputState
SystemParametersInfoA
IntersectRect
GetWindowRect
GetDesktopWindow
MapWindowPoints
GetClientRect
ReleaseCapture
SetCursorPos
mouse_event
GetAsyncKeyState
SetCapture
ClipCursor
ShowCursor
GetMessageTime
SendNotifyMessageA
GetCursorPos
GetSystemMetrics
MapVirtualKeyA
LoadStringA
keybd_event
GetKeyboardType
IsRectEmpty
SubtractRect
SendMessageA
RegisterWindowMessageA
FindWindowA
SetWindowLongA
DefWindowProcA
GetPropA
SetPropA
RemovePropA
CallWindowProcA
IsWindow
winmm
mmioDescend
mmioCreateChunk
mmioRead
mmioWrite
mmioClose
mmioOpenA
mmioAscend
DirectInputCreateA
DirectInputCreateEx
DirectInputCreateW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
120KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
516KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=25, version=9210,
count=167, id=1, productName=Unmarked objects,
count=7, id=64, version=9210,
count=1, id=29, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=85, id=28, version=9178,
count=1, id=61, version=9210,
dinput.inf
- SHA256 b457f9d6bdc0319e9d25bfdf45894a2ff15450d4d9c15f9c7440d03bcce06c9f
- MD5 ccb9a9be27aff07fb568e8590337e530
- SHA1 f114e3d8ab09613d9005680b5b44006a75d9a09c
- SHA512 e64e41208546ec15e472c32815c96ac6c0cfeeed1663292beb35310e425bc8ee6229c3ec851561eab9f3781d4a0e1c6f3264b1def93555e32c3e7e83690e583b
- SSDEEP 384:ljp4nYxTmr/xHz79a/Yh7hjN7D0gt9z7lQv2l6noRV7R7pz7j:ljp4npF3U/ghjtQIplS2l531j
- TLSH T1ACB22486DF1C0611D0C3AB09BB06BD06D12E7B5951A0941FEA9C6F0EF7CE62484F6D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
dinput.vxd
- SHA256 bdf76be51f51af6dd26818a14001fd98dab38b00034cef928aa52b018fbf4339
- MD5 8ed144298add39d9dbbe1f42e05c78d5
- SHA1 706e67d8f9818c9f97f26c78dcc5592e6fb7ad86
- SHA512 14094f4bb99c8fef99ff21474f2b891a92c574974710798e127476086374a1a8dd11055d94fbc2e0d32c0a58893ae86fced0627d5e38ac908772fadebe2f32a3
- SSDEEP 96:t+lIUUp/5BCquU6VsMC7ooolrdizxei50BSjDczOjiBaGgDW+71DMg:wfUp/rCqF6VsydwQSnHi2d
- TLSH T12322C855DC219065C86052F086A7CF1D9E7CBAC64563020FB3B8771E2CFA2C67E971AC
- MD5 SHA1 SHA512 SSDEEP TLSH
dinput8.dll
- IMPHASH a54f5f32094867d71f38152da5912e90
- SHA256 b7ebba47de76ddd5011cdd119e09a35679b78f34bd192668a774b2a807454eda
- MD5 aeb78246ab62157ebc647fafcc70352f
- SHA1 9d3be2438b085c5aa26e79b9e637ec5983b8d724
- SHA512 816dc26a260b2b2daff4032fac2bfdb3c2dfb1b15a4db979e93ae6eca4567ce68102496a5012980078bf015ad4d7456218e78aa1caec45610bd20d8b22309989
- SSDEEP 6144:iZOgl5Jt2aoqo1l2iT1FuLiCCj+1r45zW1t121qARnnnnnnnnnnnnnnnnM:mju6mzoMj+1
- TLSH T1CBE41C01B3F95629F6F3BF746EB912954E3BBDA2AA35C10E4250254E1D31F94DA20B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
131870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LeaveCriticalSection
SetEvent
DeleteCriticalSection
ResetEvent
WideCharToMultiByte
GetCurrentProcessId
IsBadReadPtr
IsBadWritePtr
lstrlenW
FreeLibraryAndExitThread
FreeLibrary
GetLastError
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventA
LoadLibraryA
GetTickCount
lstrcmpiA
ReadFileEx
DuplicateHandle
GetCurrentProcess
MultiByteToWideChar
GetVersion
Sleep
ReleaseMutex
WaitForSingleObject
MulDiv
DeviceIoControl
LocalAlloc
LocalReAlloc
SleepEx
ResumeThread
GetProcAddress
DisableThreadLibraryCalls
UnmapViewOfFile
IsBadCodePtr
CompareFileTime
lstrcpyA
lstrcmpA
lstrcpyW
EnterCriticalSection
SystemTimeToFileTime
GetLocalTime
lstrcmpW
MapViewOfFile
CreateFileMappingA
CreateMutexA
LoadResource
FindResourceA
CreateProcessA
InitializeCriticalSection
GetVersionExA
GetCommandLineA
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
RtlUnwind
VirtualProtect
GetSystemInfo
VirtualQuery
GetLocaleInfoA
GetCurrentThreadId
lstrlenA
GetSystemTimeAsFileTime
CreateFileA
ReadFile
SetFilePointer
GetFileSize
CloseHandle
GetModuleHandleA
GetModuleFileNameA
GetFullPathNameA
InterlockedExchange
LocalFree
InterlockedDecrement
WriteFileEx
InterlockedIncrement
advapi32
RegCreateKeyExA
RegEnumKeyExA
GetUserNameA
RegCreateKeyA
RegOpenKeyA
RegDeleteKeyA
RegQueryValueA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
user32
PostMessageA
wsprintfA
CharUpperA
UnhookWindowsHookEx
GetWindowThreadProcessId
IsIconic
GetForegroundWindow
GetWindowLongA
CallNextHookEx
SetWindowsHookExA
PostThreadMessageA
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
GetInputState
SystemParametersInfoA
IntersectRect
GetWindowRect
GetDesktopWindow
MapWindowPoints
GetClientRect
ReleaseCapture
SetCursorPos
mouse_event
GetAsyncKeyState
SetCapture
ClipCursor
ShowCursor
GetMessageTime
SendNotifyMessageA
GetCursorPos
GetSystemMetrics
MapVirtualKeyA
LoadStringA
keybd_event
GetKeyboardType
IsRectEmpty
SubtractRect
SendMessageA
RegisterWindowMessageA
FindWindowA
SetWindowLongA
DefWindowProcA
GetPropA
SetPropA
RemovePropA
CallWindowProcA
IsWindow
ToAsciiEx
MapVirtualKeyExA
GetKeyboardLayout
GetActiveWindow
GetKeyNameTextA
GetKeyNameTextW
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
520KB
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=25, version=9210,
count=170, id=1, productName=Unmarked objects,
count=8, id=64, version=9210,
count=1, id=29, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=90, id=28, version=9178,
count=1, id=61, version=9210,
directx.inf
- SHA256 25c5a1a86bac23e511bf64c875ca6b9d6a6c802f1da8f94cff0e4b2c55c764f9
- MD5 e07937647bb67a8bf3dab3f10ec4e95e
- SHA1 d090c66fd6b5e23caa95eb094d888a9727aa56f0
- SHA512 3426fe36849b046cc1970e924ce0fbe05921f41999b8aed3d85a8cf2c82e991be8de61cc8cbba0857413d31c296a2901cd0c42d3af3300691632fea39fafac82
- SSDEEP 384:Mc4AP8UNj1NjReQPIYvFWOPOFrM9KMoGJAbK5kRez242v2T252Q2L2h2Z2MG:MaNj1NjjlvFWiOFrM9mGJAbK5kRez24c
- TLSH T168A2728DE1A245A1D0C871459A613E8E194DF26236DAFF4C61F8D2C401779FBD1A9E33
- MD5 SHA1 SHA512 SSDEEP TLSH
dmband.dll
- IMPHASH 2dd98eee91901e42aced29ca5eefb08b
- SHA256 beb2b89bb4d656489ea2515cb2d656660604e9c50f5214bed6bcaadcfe507a1d
- MD5 57afb20a5a2a646d539feda0e48f1f15
- SHA1 67730a8fe198363e08a435727603029bec7552e5
- SHA512 6f894d85345666075f14bf6c1070ca30bae8d17a3147bd10cba831b7063f33f9ab22d692ba4ae95f8707a83839f7560d4c2e4b9824c33d4cc417d85c1dadd746
- SSDEEP 384:Z+RFs49fj7nR2QbX8K8Iv9YFQNKaOb8CIvuV2A8dPCrofD7+pWIWhoeWD:Z+bHBnLv/iFmKrb8CIvuAA0PWa7ixD
- TLSH T1FCC23B63B3E1807AE96A1235EF65276933FBD720895A554213551F8E37B08C2E23EF07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
24716
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
MultiByteToWideChar
lstrcpynA
DisableThreadLibraryCalls
lstrlenA
lstrcatA
lstrcpyA
GetModuleFileNameA
QueryPerformanceCounter
InterlockedDecrement
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
Sleep
IsBadCodePtr
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
IsBadWritePtr
GetTickCount
IsBadReadPtr
msvcrt
_adjust_fdiv
_initterm
free
malloc
wcstombs
__CxxFrameHandler
wcsncpy
_purecall
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
ole32
StringFromCLSID
CoTaskMemFree
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=3, id=64, version=9210,
count=7, id=25, version=9210,
count=50, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=10, id=29, version=9178,
count=1, id=61, version=9210,
dmcompos.dll
- IMPHASH 968421b7ed4e42ca13de160c864b4ae6
- SHA256 2067ae35e1e64b8a79f9f97397888808666ceefb712d1bb8a50d64b33d70eaa4
- MD5 dae162392717b891e6253dfeede5bec9
- SHA1 1a6b68205b0c3eabebd1251217285ea4bbeeb376
- SHA512 0db45d3f61a42fac46b04dce83ba9d1cf433e2fe0587b40b56b56f998a8d7a546d0b98e5253f3426353bbbdc82abf1e16e0b9930231f09f404f655c29e5eae73
- SSDEEP 768:rpjWekfKuZSXp4aVPKRORsyHicwjoE2yjMdGtW7EQj274AMHezbMiHDzam:5kFSZZVPK4Rsya92TMQ7EQjpe5H3/
- TLSH T1C8436C53B3E3C0F6D1632172DA08A7EA17F99B2D583B858A67180F4E7B609C5973C50B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
53673
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
IsBadCodePtr
lstrlenA
lstrcatA
lstrcpyA
GetModuleFileNameA
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LeaveCriticalSection
InitializeCriticalSection
Sleep
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
IsBadWritePtr
MultiByteToWideChar
IsBadReadPtr
msvcrt
wcslen
malloc
free
_initterm
_adjust_fdiv
wcstombs
wcscpy
time
srand
wcsncpy
_purecall
__CxxFrameHandler
rand
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
ole32
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CreateStreamOnHGlobal
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=64, version=9210,
count=7, id=25, version=9210,
count=61, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
dmime.dll
- IMPHASH e84f92ef3e04403f433866f3a97f487c
- SHA256 7c214d5a1dfdf1632b14294d119970ddd1e1d1c71fdbf8221b510d76286d5d86
- MD5 9430c0c51facfe7b54684a36469418de
- SHA1 4a1dd226d778febe0375880790eb33a891ac02b8
- SHA512 1d3e8bb4d4877a1d408411b39047747c9b10ed9ae7080e7aa364b478f09bb2e34c96418c5d2bb5531a663a02a1d812dec89d031e215723b7044e99ef8b6b9e5b
- SSDEEP 3072:S4FYkXv4moqzj59neGyWi8M+43UXJVKBU5I/0qdOESz:VWqvcqzj59e1WNX97KBU5y
- TLSH T1F0F36C61B3E2C036D883A2328A0973BAF3F9DB291637565312541F1DFBB0596A73D607
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
157705
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WaitForSingleObject
SetEvent
GetCurrentThreadId
Sleep
SetThreadPriority
CreateEventA
CreateThread
DisableThreadLibraryCalls
lstrlenA
lstrcatA
lstrcpyA
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
InterlockedDecrement
InitializeCriticalSection
IsBadCodePtr
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
IsBadWritePtr
IsBadReadPtr
GetModuleFileNameA
msvcrt
__dllonexit
_onexit
_adjust_fdiv
_initterm
rand
_CIpow
malloc
wcstombs
wcscpy
__CxxFrameHandler
wcscmp
time
srand
_ftol
_purecall
wcslen
free
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
advapi32
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegCloseKey
ole32
CoTaskMemFree
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
StringFromCLSID
user32
GetForegroundWindow
IsWindow
GetDesktopWindow
dsound
ord11
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
154KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=13, id=25, version=9210,
count=75, id=1, productName=Unmarked objects,
count=12, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=29, id=29, version=9178,
count=1, id=61, version=9210,
dmloader.dll
- IMPHASH 8332206d5778356b1110b44f2e3cfdef
- SHA256 a55107fd8b5d263c0a4b908cab34ae2b80926eed23b1ee39f5e6b135b981eb9e
- MD5 d6fced04186f7418666117c651fd2d2d
- SHA1 3a6cfe7586d035489b25da95a190570b27a2c1c6
- SHA512 40b9be3790ad81a59764307ed486992e4dfc891bb461206c0a4c55364c83a7aaeba8b85c35a5e3e8b433c12a74fa9c2040dc8241cdb6be99bfd32f1b01242b95
- SSDEEP 768:53D/xJStMm6UB4kyVkxPzrueihLGP6/zUKpmMtfm/:t/xJKMU+87rXPQ4K8MA/
- TLSH T1A0E28C93B7E3D4BAE7939630A95A73DA23B997744A2810165B410B0F3E71A52E33C703
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
30152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
IsBadCodePtr
GetFileAttributesA
GetFileAttributesW
DeleteCriticalSection
InitializeCriticalSection
FindClose
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
lstrlenA
lstrcatA
IsBadWritePtr
GetModuleFileNameA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
IsBadReadPtr
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
Sleep
DisableThreadLibraryCalls
GetVersionExA
InterlockedIncrement
lstrcpyA
InterlockedDecrement
msvcrt
fclose
fread
fwrite
ftell
fseek
_strerror
_fsopen
_wfsopen
malloc
free
_initterm
_adjust_fdiv
wcsncat
wcsrchr
_wcsicmp
mbstowcs
wcslen
wcstombs
wcsncpy
_purecall
wcscpy
__CxxFrameHandler
wcscat
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueExW
ole32
StringFromCLSID
CoTaskMemFree
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=3, id=64, version=9210,
count=7, id=25, version=9210,
count=74, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=10, id=29, version=9178,
count=1, id=61, version=9210,
dmscript.dll
- IMPHASH 903e24e172a63cf62c8720d3d4074255
- SHA256 f8acba6ff2074e8eed00f7f618bab9fa5be7001a276f4ed5c563ef582d255c46
- MD5 2b31b719bd08bd650c8131abbc9a5437
- SHA1 044c6f7cb2cd235aac281ce28f6db628d4986cc0
- SHA512 9b9bfd4c6c58b179bde235091b853d55dafbe3c9a72328f3ca3838df82c15e92696eabb6f6943373bcbee1048a5111faff9c72c534a5419f2bbf9368a45b8a92
- SSDEEP 1536:eqnzhvqQa+ekgfjpNdvI4b7HYgRsqwCJhzVVXf4Kl3pBR:vSVD9pN9ZbdRs+hMK5pv
- TLSH T122736C2277E58032F77276764A307269A3FA99142D3ADE1613140B4D3EB1E83EA7C347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
69597
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryA
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
DisableThreadLibraryCalls
WaitForSingleObject
SetEvent
CreateEventA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetTickCount
InterlockedDecrement
GetCurrentThreadId
IsBadCodePtr
InterlockedIncrement
IsBadWritePtr
CloseHandle
IsBadReadPtr
Sleep
msvcrt
_CIpow
_ftol
wcsncpy
tolower
_stricmp
wcstombs
wcsstr
_ultow
wcstoul
_endthreadex
_beginthreadex
free
_initterm
_adjust_fdiv
__dllonexit
_onexit
_except_handler3
malloc
wcslen
wcscpy
wcscat
_wcsicmp
wcscmp
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumKeyA
RegCreateKeyExA
ole32
CLSIDFromProgID
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=7, id=25, version=9210,
count=73, id=1, productName=Unmarked objects,
count=13, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=36, id=29, version=9178,
count=1, id=61, version=9210,
dmstyle.dll
- IMPHASH 9b9b56669a52debf1b2dccbc03819e5c
- SHA256 ee281503a73a98239b3dd7f2ac2c3f313f2d1e2ec0f3ba39d6d177e97d9894ea
- MD5 6f6e5c08b164f4350b0f1c5110af3963
- SHA1 7ccbb74150f8bdf7b74e438e06cbff949d44c648
- SHA512 4ae3d4d0f5d889ee4c43bc808732c0cadc9a1d74bca47647dfddcffef8eae1695e916f23f438c75277c2d348c53fcc09de0b086e07d87352e1f0f52bb28377e5
- SSDEEP 1536:HgKTQGLwfvrhCqa7KcCiOIHzZtxwDl0L/pgupbATi7mV9FX2/FNm/+:HvTQG0fUKcMIvCDlsqCbQrVfG6/+
- TLSH T1F6A37C52B3DAC037E65651319A18B3EA73FAC718282AB5077B145E8DBBB04C1D3BD607
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
91279
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
lstrlenA
lstrcatA
lstrcpyA
GetModuleFileNameA
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
IsBadCodePtr
InterlockedIncrement
IsBadReadPtr
MultiByteToWideChar
IsBadWritePtr
msvcrt
wcstombs
wcscat
malloc
free
_initterm
_adjust_fdiv
time
srand
rand
wcslen
wcsncpy
wcscpy
_purecall
__CxxFrameHandler
_wcsicmp
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
ole32
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CreateStreamOnHGlobal
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=7, id=25, version=9210,
count=62, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=19, id=29, version=9178,
count=1, id=61, version=9210,
dmsynth.dll
- IMPHASH 7bc002e7c5147c1079569ca2d742d33d
- SHA256 f76ec4ae6e81cef2d0099d897f1424ce813d8a655a58f064c7a572b740119b91
- MD5 415235edaa4cee387bea7903847b1530
- SHA1 8d503ad58bcc233f97b2c9b067ae022cff04c60a
- SHA512 8de274ceb44412e4c177b4f74f941c9f124833b72b0a32d41c746253302e83733c6e9e8ca54df190e756cf1314ad282b675e79fa8a23526922bc9769a8334504
- SSDEEP 1536:tGjsOAIBRqtvWRbr6QsndNgL1ciyZR7TpbFcE8VfZ9roux2srOpaGOSk:t7IusJrNsnduL1KxOwwOpaGOSk
- TLSH T117A37E52FEA641FAEC82EA35940B73B397769F158515818393A0FF7C69302C1B97D322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
76374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcatA
lstrcpyA
DisableThreadLibraryCalls
IsBadCodePtr
SetEvent
WaitForSingleObject
SetThreadPriority
CreateThread
CreateEventA
CloseHandle
InterlockedIncrement
GetModuleFileNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
InterlockedDecrement
IsBadWritePtr
IsBadReadPtr
MulDiv
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
InitializeCriticalSection
msvcrt
_adjust_fdiv
_initterm
wcscpy
wcstombs
free
malloc
__CxxFrameHandler
_CIpow
_ftol
winmm
timeGetTime
advapi32
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ole32
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=9, id=25, version=9210,
count=59, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=28, version=9178,
count=17, id=29, version=9178,
count=1, id=61, version=9210,
dmusic.dll
- IMPHASH 77d2d936f6cd1eebccc76f28df624f39
- SHA256 80c9b618e67db7863dfba6895d7873b723224041335a04dcfce2e637d4650330
- MD5 5a0704e543161b977575cd7eff8af9cc
- SHA1 3680aae7054fee9e6ec0edf9bed41492c83f0735
- SHA512 8c16b3a7b3b6e15b18e28566d98efc6f5004dd161ad64317ba6674dc9fdcf5b9e091839f7e6f1230183681c9a8e54ac0b4d403cdba3b02346d6b6fb99825d5e7
- SSDEEP 3072:bvlmdkC70r6ln/Yn4/iq5PGNoVSyPs5+zNx1KdwrLT:jxhr6tYcfJb
- TLSH T186B33B4033F6503AF9E32A7059A663AB66BEFF255D36926E07000B0D3DF4941D539BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
80166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryA
GetVersionExA
DisableThreadLibraryCalls
IsBadCodePtr
InterlockedExchange
FreeLibrary
GetProcAddress
lstrlenA
lstrcatA
lstrcpyA
GetModuleFileNameA
ResetEvent
SetEvent
PulseEvent
MultiByteToWideChar
GetLastError
CreateEventA
DeviceIoControl
CreateFileA
LocalFree
LocalAlloc
GetOverlappedResult
SetLastError
GetCurrentProcessId
DuplicateHandle
GetCurrentProcess
OpenProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
WaitForMultipleObjects
CreateFileMappingA
MapViewOfFile
CreateMutexA
WaitForSingleObject
Sleep
ReleaseMutex
CloseHandle
UnmapViewOfFile
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
CreateThread
IsBadWritePtr
msvcrt
_stricmp
wcscmp
mbstowcs
wcstombs
wcscpy
_purecall
_strnicmp
free
memmove
__CxxFrameHandler
_adjust_fdiv
malloc
_initterm
_wcsicmp
winmm
waveOutMessage
timeGetTime
timeBeginPeriod
waveOutGetNumDevs
timeEndPeriod
waveOutGetDevCapsA
user32
wsprintfA
LoadStringA
IsWindow
GetDesktopWindow
GetForegroundWindow
wsprintfW
advapi32
RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyW
RegCreateKeyA
RegEnumKeyA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
rpcrt4
UuidCreate
ole32
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromString
msacm32
acmStreamOpen
acmStreamConvert
acmStreamUnprepareHeader
acmStreamClose
acmStreamSize
acmFormatSuggest
acmStreamPrepareHeader
dsound
ord11
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
728B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=17, id=25, version=9210,
count=104, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=32, id=29, version=9178,
count=1, id=61, version=9210,
dmusic.inf
- SHA256 d93e8faf798cd31f44d2ceb42506e00d26b2834aad77fe0915e906aaf543cbf6
- MD5 6e5ed8816a6182d57502b63c91a833af
- SHA1 7bd69ac6bb9d08756f00e34f4638b9b4f2cfdd8c
- SHA512 77efc0c1607a438ed273bbc2bbb2d5d87810606949255cc0e75f4feb3a09f0f947a7d225f731b227f87fb306cec9e732b62a00251269947a6e31a505c15a861f
- SSDEEP 384:b7reL4Pzs+0QMswKMAoyGtP5tD1nCfeCbmhvOzvqz0s7gs3kp70P7eRO+O2q+rZe:2W3r1oHE7yo6SfjctgW2h/ey+UG4q
- TLSH T195136A19FECEE09AEFDBE18558D41A61675C06A310CFFF6812DDA7680D0B9F5E02A053
- MD5 SHA1 SHA512 SSDEEP TLSH
dmusic16.dll
- SHA256 434177a11449014a0bf96fea458851b6aa268aaeef3bd09dd74a293fe42804dc
- MD5 3de0f0fe027c0347613e43850f01ebde
- SHA1 68c61d3fe7c4072df5f70bba4a2e39b6f05d97e6
- SHA512 b0997c630db2298b8748e3c01fedcf499a4d65019add64fb0c36eea4d7cbbaea9c4bf6ccb9c7a0a49e6e69d4ed0ae91fb2917a0e511ca9ff9935e090f1bf61c7
- SSDEEP 192:eG2ailZqZPJmBFshBqSPaBsoTEorTUiOp3nf39Dp4c3G1ZmF3:eG2aLdM6PaUorj6/va14J
- TLSH T1E932091B1885E0F9C8AF97B681A2D791A2B3EA504307D93B426C763F1D637DE63F1006
- MD5 SHA1 SHA512 SSDEEP TLSH
dmusic32.dll
- IMPHASH 1ccfadb4dbe74682899ff87a8270931e
- SHA256 d92b6406970df79d4fcf6aff341e3db02f4014768d09afc18c4132f5594edf39
- MD5 68167673b65d9f93eb3a693ecd9edc2d
- SHA1 4b3c6dad3371ed408475ec088619216020fbfd09
- SHA512 5e7eb07bee89c80f95fd967ffbfff2e75b4286391aaab8de647e19ab7cd65036c65bfcff44cf2cde0d855c5fa03dfbc5ba29ef6d7aa8c73f73823fbb82ae83b0
- SSDEEP 192:CivkCwh+a57Fnf+r3kLfK/c/478xmhdtm5dabCNaAwB9L46/fyVgKWae6CWSA:7Q+a5xnA0VQxm5EbUaAQcgKWa7CW
- TLSH T193D21A1263A98037E8E2013506E67B467775E634EF2166A309053B5DBD72BD1C93AB43
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12461
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersionExA
DisableThreadLibraryCalls
InterlockedIncrement
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
DeleteCriticalSection
WaitForSingleObject
SetEvent
InterlockedDecrement
GetLastError
DeviceIoControl
CreateThread
InitializeCriticalSection
CreateEventA
MultiByteToWideChar
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CloseHandle
WaitForMultipleObjects
Sleep
OpenVxDHandle
ThunkConnect32
SUnMapLS_IP_EBP_20
SMapLS_IP_EBP_20
SUnMapLS_IP_EBP_16
SMapLS_IP_EBP_16
CreateFileA
msvcrt
_initterm
_adjust_fdiv
malloc
_except_handler3
free
__CxxFrameHandler
_purecall
winmm
midiOutGetNumDevs
midiInGetNumDevs
midiOutGetDevCapsA
midiInGetDevCapsA
timeGetTime
advapi32
RegCreateKeyA
RegCloseKey
CreateCDirectMusicEmulatePort
EnumLegacyDevices
Name
.text
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
666B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=7, productName=Unmarked objects (old),
count=7, id=25, version=9210,
count=49, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=5, id=64, version=9210,
count=6, id=29, version=9178,
count=1, id=61, version=9210,
dplay.inf
- SHA256 89a14e722647aef89e8b5a36b8ac7e2b27f1398d35e4e401d411f823a5dfd1de
- MD5 798d1b276d1ed717bb32666141cab716
- SHA1 894a84a567bda05eb324f6d88e209677f72546ce
- SHA512 3433fd995e9e6268ad9c4b8fbdace4faaab8f0ecfa5d694955796eb276f937866faa68c1f6132874c598e96e970529f34c72396b7f3a765c920f934936d1d602
- SSDEEP 384:L09jzsEAqQCXXg8ouCR5zB7Bo0nRKBhBkRYTKB:vxQ4
- TLSH T12A62AB60BCDEB11131E275C07576A041687640F3580E82AC296643A7B39E6DEE3FE79F
- MD5 SHA1 SHA512 SSDEEP TLSH
dplaysvr.exe
- IMPHASH 0e2d56d5ee03e5e670b2f35982dccb42
- SHA256 097996391cc9526350fef83a619ff6e123a14bde4fe96dfdaa22dbdfb63c2d2f
- MD5 95b3e92debc8ce21f9be4a1aad5abecd
- SHA1 c6ed2aecc3726eae54a4f9620385fbc4a838363a
- SHA512 d59047e73443b6fd59ed56cc67e07e3d31357bfec79cf1130a31dd04ac710262f1d0ace55920174bb2e73a2d1cb2c6416795f2bd9662eb58174f9781efde6c6a
- SSDEEP 384:U6cqBAsuftzYypZXBEOZqaEg440qmcG7qknkdigoJUr+7bIGiJhT8i6j9g3AlG2l:Eq2swn/Ia+qmc7oJ4MxiJhuWwl3OYo
- TLSH T190036B0174A8C83FE1534674C574AB16D7BA5E000BB5B7CF8B84A85BAB363D4EA39353
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14977
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapFree
DeleteCriticalSection
UnmapViewOfFile
GetCurrentProcessId
MapViewOfFile
SetEvent
InitializeCriticalSection
CreateMutexA
CreateFileMappingA
CreateEventA
GetLastError
GetCurrentProcess
SetCurrentDirectoryA
GetSystemDirectoryA
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
OpenProcess
WaitForSingleObject
ExitThread
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetVersionExA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
RtlUnwind
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCommandLineA
GetStartupInfoA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
GetACP
GetOEMCP
GetCPInfo
Sleep
VirtualAlloc
VirtualQuery
advapi32
RegEnumKeyExA
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
gdi32
GetStockObject
user32
DefWindowProcA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
winmm
timeGetTime
Name
.text
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=8, id=64, version=9210,
count=1, id=29, version=9178,
count=9, id=25, version=9210,
count=88, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=41, id=28, version=9178,
count=1, id=61, version=9210,
dplayx.dll
- IMPHASH f7fb5ea3bc53027ead16ead96f019707
- SHA256 7b34ec8fe12ec73464176451f7e3805e9fea811bd325c796aaeeb69de3e3ceab
- MD5 29b06eee0438ee7d5aba9bd077a71dbc
- SHA1 8d22b5e12c61df8ed1f3a8d47bcd53acb5e6476f
- SHA512 98c524b9af9de566e95cbc6c10d03fc741674cde02e1033942c787594d58e69acb1b749007541e82279d912c8f1f017b5b8c18afc2dcbcec86e8ceaa31a71339
- SSDEEP 3072:y4F9P3vuhsq0BUjd0vTGNf3hP9TQK09AveWb/SfrKLt4U5T6Oh/T3u7:j9P/u+KlRB9w4tjT5u
- TLSH T17F245B02BBE00871CC571AB9899D335563A8CB8E4975D31B0B39187F2B15CF25BB9B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
74728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ReleaseMutex
SetEvent
WaitForSingleObject
GetTickCount
CreateThread
ResetEvent
lstrlenA
Sleep
FreeLibrary
GetVersionExA
DuplicateHandle
GetCurrentProcess
LoadLibraryW
LoadLibraryA
GetProcAddress
CreateEventW
CreateMutexW
CreateFileMappingW
OpenFileMappingW
OpenFileMappingA
CreateProcessW
CreateProcessA
CreateFileMappingA
GetCurrentDirectoryA
CompareStringW
CompareStringA
GetProfileIntA
InterlockedIncrement
InterlockedExchange
DisableThreadLibraryCalls
LocalFree
DebugBreak
WaitForMultipleObjects
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
GetCPInfo
GetLastError
MapViewOfFile
CreateEventA
CreateMutexA
GetCurrentProcessId
UnmapViewOfFile
IsBadCodePtr
IsBadReadPtr
GetModuleHandleA
GetModuleFileNameA
CreateFileA
CloseHandle
SetFilePointer
ReadFile
InterlockedDecrement
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetCurrentDirectoryW
LeaveCriticalSection
GetLocaleInfoA
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineW
GetCommandLineA
ExitThread
OpenProcess
ResumeThread
GlobalFree
GlobalAlloc
ReleaseSemaphore
CreateSemaphoreA
VirtualFree
VirtualAlloc
GetStringTypeW
rpcrt4
UuidCreate
user32
wsprintfW
wsprintfA
advapi32
RegDeleteKeyA
RegDeleteKeyW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteValueA
RegDeleteValueW
RegEnumValueA
RegEnumValueW
RegSetValueExA
RegSetValueExW
RegEnumKeyExA
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegQueryInfoKeyW
winmm
timeSetEvent
timeKillEvent
timeGetDevCaps
timeGetTime
DirectPlayCreate
DirectPlayEnumerate
DirectPlayEnumerateA
DirectPlayEnumerateW
DirectPlayLobbyCreateA
DirectPlayLobbyCreateW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
gdwDPlaySPRefCount
Name
.text
Size
200KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=8, id=64, version=9210,
count=1, id=29, version=9178,
count=9, id=25, version=9210,
count=120, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=91, id=28, version=9178,
count=1, id=61, version=9210,
dpmodemx.dll
- IMPHASH 11047f92afa1f1e11ff8e095545a3dd4
- SHA256 d534784f662aa9931720b0e98033ace7524c7bef57d5ccc8ab7b4dd19efd64f1
- MD5 8b2252f3f84baa481821d25f94561eba
- SHA1 73d427c5abcbdac7970fa9b7c21c37d7d12a7812
- SHA512 35381452f6b19aa9a74af22840be3dc179a3f76af459a3b2a1ce5bb8a235b8878e727ead84726d9dc01bd5ab0c092490f6caa6779d2bb63b430c40fcae425b6c
- SSDEEP 1536:zCyuZtSYke5V1Ct4pGRVWRs32dLzDGWjeWzohhYut/E:TuZAYkQi4pG721zDGWjeWzohhYut/E
- TLSH T1CD93011563F54612F0B39F7498F643E36A7EBC51BE36C31F9A40670E2831A949A20B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
PurgeComm
EscapeCommFunction
WaitForSingleObject
SetCommMask
SetEvent
CloseHandle
GetOverlappedResult
GetLastError
ReadFile
ClearCommError
WriteFile
GetCommState
ExitThread
WaitForMultipleObjects
WaitCommEvent
CreateEventA
ResumeThread
SetThreadPriority
CreateThread
InitializeCriticalSection
SetupComm
SetCommState
CreateFileA
lstrlenA
Sleep
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetCommTimeouts
DeleteCriticalSection
user32
DispatchMessageA
KillTimer
PeekMessageA
SetDlgItemTextA
GetParent
wsprintfA
SetTimer
GetWindowRect
GetDesktopWindow
SetWindowPos
GetDlgItemTextA
EnableWindow
GetForegroundWindow
DialogBoxParamA
GetWindowLongA
EndDialog
SetWindowLongA
GetDlgItem
SetFocus
TranslateMessage
SendDlgItemMessageA
LoadStringA
tapi32
lineInitialize
lineShutdown
lineDeallocateCall
lineOpen
lineNegotiateAPIVersion
lineGetID
lineGetCallInfo
lineGetDevCaps
lineAnswer
lineDrop
lineMakeCall
lineClose
lineConfigDialog
dplayx
gdwDPlaySPRefCount
SPInit
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=25, version=9210,
count=85, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=12, id=28, version=9178,
count=1, id=61, version=9210,
dpnaddr.dll
- IMPHASH 641a2dc94ce0a0b96209bc3eec8d3983
- SHA256 9cfe5ddb7e75abcf519d7154e1342d41ee6c7a4d0cfd6c5f85995ebdd2e66ec1
- MD5 0241a6a1d283bff0a322cf8898bf0d73
- SHA1 a9aa624be8bc5074a1d466d41db579bccd35ca28
- SHA512 f3e1ad9eaf8dbc5ebd7bdf571f68542c3a5bba18a84513a027cc8008079f6e19b4886b00b06f56182107147ae81a949e7da30e0f9a08c0948503dc887a2681bf
- SSDEEP 24:ev1GSMXLf0Rl+UEiU2FSlGa844ehJmlbZW0VMHG9NFfPoKC35Wgr9PYPNV:qMXFUEiDFSl1GeiBZWNHMtoB5WSPg
- TLSH T18572A901A7F84579F4B70B7019E60B2B617EBC20AEBAC61E0E68525D2D71A65CD30F73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
dpnet
ord1
DirectPlay8AddressCreate
Name
.text
Size
4KB
Virtual Size
383B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=25, version=9210,
count=1, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
dpnet.dll
- IMPHASH e360be635b983f3aa711f451096754da
- SHA256 5a81c4be82aefca0a3bd90f946b78434cced4e3328fb5a83cbc54798e9633a5f
- MD5 8b880d82126d8c56fae18458216e4262
- SHA1 29dd6500eaf32c82b39a12fdf169b56b31a9c719
- SHA512 c1353abb24b33363dd31f85e2e2170543e8a438fcdb10f8fcf5ecc256efa8d9cfb3c7636de22e1eca696f28fa39f0c5855a4978fc4830e0ebd461a517fbe3748
- SSDEEP 6144:45mvyNFq928DvFgkO6VZX2LQ+bkttC3fwjxJ3nOT+u85+BKjgdxNFzXJmOrSRvse:45tqckFg5bwooxhOT+R5TjgdZzipt
- TLSH T183E4810267F84219F6F37B306AB813655E7ABD91AD39C94E0281249D1DB0E42DFB4B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
124626
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateEventA
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
IsBadReadPtr
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
IsBadWritePtr
Sleep
GetCurrentThreadId
ResetEvent
InterlockedDecrement
SetEvent
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapFree
GetProcessHeap
GetCurrentProcessId
HeapAlloc
CreatePipe
InitializeCriticalSection
IsBadStringPtrA
GetLastError
GetVersionExA
FreeLibrary
LoadLibraryA
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
TlsFree
CreateSemaphoreA
TlsAlloc
TlsSetValue
WaitForSingleObject
TlsGetValue
WaitForMultipleObjects
ReleaseSemaphore
InterlockedExchange
WaitForSingleObjectEx
SetThreadPriority
GetCurrentThread
CreateThread
CancelIo
SetWaitableTimer
CreateWaitableTimerA
InterlockedExchangeAdd
InterlockedCompareExchange
GetModuleFileNameA
SetLastError
OpenEventA
CreateProcessA
GetSystemDirectoryA
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateMutexA
GetCommandLineA
OpenProcess
GetExitCodeProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateFileA
SleepEx
GetOverlappedResult
WaitForMultipleObjectsEx
SetCommMask
PurgeComm
SetCommTimeouts
SetCommState
ReadFile
FlushFileBuffers
WriteFile
lstrcpynA
FormatMessageA
GetStdHandle
DuplicateHandle
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoCreateGuid
StringFromGUID2
CLSIDFromString
msvcrt
malloc
_adjust_fdiv
_initterm
free
wcscpy
wcslen
_stricmp
wcsncpy
wcsrchr
_wcsnicmp
sprintf
strstr
strncpy
swprintf
srand
_ftol
wcscat
_wcsicmp
wcscmp
wcstoul
wcsncmp
_splitpath
memmove
strtol
_except_handler3
wsock32
WSASetLastError
sendto
setsockopt
shutdown
recvfrom
inet_ntoa
gethostbyaddr
inet_addr
bind
getsockname
select
WSAGetLastError
__WSAFDIsSet
socket
getsockopt
closesocket
ioctlsocket
gethostbyname
htons
ntohs
WSAStartup
WSACleanup
gethostname
user32
CharNextA
wsprintfA
PostMessageA
DialogBoxParamA
GetWindowLongA
EndDialog
SetWindowLongA
GetWindowTextA
GetDlgItem
SendMessageA
SetWindowTextA
LoadStringA
advapi32
CryptReleaseContext
RegCloseKey
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
DirectPlay8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
312KB
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
360KB
Virtual Size
358KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=3, id=64, version=9210,
count=13, id=25, version=9210,
count=172, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=158, id=29, version=9178,
count=1, id=61, version=9210,
dpnhpast.dll
- IMPHASH e688c48d8f962e056917b777bb5f3f5c
- SHA256 862751dd9a31bdaea59bac1b200f72b5d6c80964ff9c57211ad2fb38a90653a0
- MD5 c57592a4b6bd657f25b732488d51a933
- SHA1 d39380dc6c66859e04fc20628bf560a21aba37ca
- SHA512 511ed84cb07cd3017b6cd4445b61a5da86d41cb055fcb442ee796dc522c6a96a6d9326b13fbe398dcebb523ef53d586e23513d18c461ec7a0723c875351f776d
- SSDEEP 768:gKL21So71f0rSP2GmxjPoQ25YQ181BhE2Te:gKL2WA2Gmx7LUYQ181vXTe
- TLSH T1F6135C01EAE0C475D0A363F06D6C7352E6FBEA721A648D6B63012D892934793F3BD746
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
27433
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DuplicateHandle
GetCurrentProcess
CreateIoCompletionPort
InterlockedDecrement
PostQueuedCompletionStatus
SetEvent
FreeLibrary
Sleep
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
IsBadWritePtr
GetCurrentThreadId
IsBadReadPtr
InterlockedIncrement
HeapAlloc
DisableThreadLibraryCalls
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
HeapFree
GetProcessHeap
GetVersionExA
MultiByteToWideChar
lstrlenA
InitializeCriticalSection
GetLastError
WideCharToMultiByte
winmm
timeGetTime
advapi32
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
CryptGenRandom
CryptReleaseContext
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
msvcrt
malloc
_adjust_fdiv
_initterm
free
wcslen
srand
swprintf
_except_handler3
ole32
StringFromGUID2
DirectPlayNATHelpCreate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
332B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=1, id=64, version=9210,
count=9, id=25, version=9210,
count=63, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
dpnhupnp.dll
- IMPHASH 60ed152f260b1eac811f86cb69dc678d
- SHA256 2f0a5d4e64dba93cbe70a4651129832dcd4a0b015489e49af7f5a9bcfff7c0a9
- MD5 3c5c23b14969bad864adbebc8b2ba2d1
- SHA1 b5305b1b2f6b86e38bded03aa821b9c0144cd64a
- SHA512 5b174211d882875b6a29b3088501a0d257093f9e21b38187a9c1f61fb7919f0c78874ce1c3877461fe2f0997f642d47e5d4166b2df11e32ee3f61d0bd55a8162
- SSDEEP 1536:7p/XKy9vK3bCUVYVYB4OEdzsWyyTaLo/dF7:VluYVdOuO1o/dF7
- TLSH T1BA734AA6E9F15475EDB213B014283345F6F7BA151B209C9B3B015E8B077A6C3F2B921B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
54606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThreadId
ReleaseSemaphore
OpenEventA
IsBadWritePtr
DuplicateHandle
GetCurrentProcess
CreateIoCompletionPort
GetModuleFileNameA
Sleep
InterlockedDecrement
PostQueuedCompletionStatus
SetEvent
CreateEventA
FreeLibrary
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA
WaitForSingleObject
CloseHandle
CreateSemaphoreA
IsBadReadPtr
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
InterlockedIncrement
DisableThreadLibraryCalls
DeleteCriticalSection
WideCharToMultiByte
GetLastError
InitializeCriticalSection
lstrlenA
HeapAlloc
user32
wsprintfA
winmm
timeGetTime
advapi32
CryptReleaseContext
RegQueryValueExA
RegSetValueExA
RegEnumValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
CryptAcquireContextA
CryptGenRandom
RegDeleteKeyA
ole32
CoInitializeEx
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
msvcrt
_initterm
_adjust_fdiv
malloc
free
wcslen
_stricmp
_strnicmp
atoi
strncpy
swprintf
srand
_except_handler3
strstr
strtok
strchr
_splitpath
DirectPlayNATHelpCreate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=1, id=64, version=9210,
count=11, id=25, version=9210,
count=83, id=1, productName=Unmarked objects,
count=12, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
dpnlobby.dll
- IMPHASH 641a2dc94ce0a0b96209bc3eec8d3983
- SHA256 55546d20ab72753e0cc4bb53009c87d4a4a68e5293ce2f4cfb5848ade70535a8
- MD5 d8f07b526c2161b410ed55c9ac020299
- SHA1 73c018def2fde4ec99155f66b8b8ffe86bc54982
- SHA512 e4710c6c3c96b521392ab46d293c28e417223854cfafb72d62a57eaad2c61a589573c10d2714f5a6e0b3aa34a2883048162b72c0e10e12e1d58d01bc05ab2d11
- SSDEEP 24:ev1GSMXLf09lsiEvUJDqylGBlsuZ4uehJmlbZW0DHG5NfPRFC35Wgr9PYPNV:qMX0Ev4DqylO+ceiBZWAHI3RG5WSPg
- TLSH T1FA72AB01A3F84A79F4A70B7518E70F6B617EBC20ADA6826D0F54134D2C759258E30F73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4252
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
dpnet
ord1
DirectPlay8LobbyCreate
Name
.text
Size
4KB
Virtual Size
382B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=25, version=9210,
count=1, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
dpnsvr.exe
- IMPHASH baae137c778bcc5dcc0dd2e891a5e245
- SHA256 ae6fa382de9599b20de1241b2c3a58b51f56dec7989287f2f03b86895950dbb6
- MD5 a2b4bd6ed35827a0bee28f87513c0852
- SHA1 62b7baf523a7446cfc99ab14d290ee7807b38cfd
- SHA512 98b97997495db00fadf825a24d58d466574c7b8522e3eb9aebcbaddb4ca1cab484eaa59c96d4c062513aee09de5d3ab9bbba8ccad21872e90211b01c5127655a
- SSDEEP 384:oV1KKLMnvsylHuI2gWOX1GVMUx7NwGB6MWrYXW:M1lMvsI52g7KwGX
- TLSH T15ED25C42B7F688BFF49687300E962B1AF2FCA6904870971E5F444D8F1A7E5909535B13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
CreateMutexA
CreateEventA
ReleaseMutex
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
InterlockedDecrement
QueryPerformanceCounter
GetCurrentThreadId
SetEvent
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetTickCount
LeaveCriticalSection
EnterCriticalSection
OpenProcess
GetLastError
CloseHandle
InterlockedIncrement
OpenEventA
lstrlenA
CompareStringA
HeapFree
GetProcessHeap
GetCurrentProcessId
HeapAlloc
CreateSemaphoreA
ReleaseSemaphore
GetStartupInfoA
InitializeCriticalSection
GetVersionExA
FreeLibrary
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
ole32
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoUninitialize
CoInitializeEx
msvcrt
_except_handler3
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
srand
__setusermatherr
wcslen
advapi32
CryptReleaseContext
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
CryptAcquireContextA
user32
wsprintfA
winmm
timeGetTime
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=64, version=9210,
count=2, id=25, version=9412,
count=11, id=25, version=9210,
count=86, id=1, productName=Unmarked objects,
count=13, id=28, version=9178,
count=1, id=69, version=9111,
count=19, id=29, version=9178,
count=1, id=61, version=9210,
dpvacm.dll
- IMPHASH f981406e3d1ad54dccf4fecf9e46a444
- SHA256 0bd629d05fd0795c470e39ee317c578186f3979d6378c1c5491e19880e8bf945
- MD5 5a4295f7b02b5e0e9a7e5df2aa9224ab
- SHA1 6467da1566e19fdbcf82c03a8b7666c7986f81fd
- SHA512 05955a838daa03f63a8f194ea6be5d18b6df6d23bdcd46c8508a3337fda0b2b9183cbad79e78f024a2a9299c5b661915cd7d5bab5b5ffdf3509194ec54302beb
- SSDEEP 384:DzCYBmeq8qmjN4qHuSTbRUJJJ6LL97XhF0I/wUNpdEoKreWkTzWWhy1:DzCYBxq8hj5zZUJ761VF1/D+oKrmVy1
- TLSH T174E23B46BBE24577F4B246B009783762DAFEE6A16EA4CD0E530168C51871B03D9FDB23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16985
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
lstrlenA
GetVersionExA
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
FreeLibrary
DeleteCriticalSection
GetLastError
IsBadWritePtr
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
HeapFree
GetProcessHeap
HeapAlloc
Sleep
user32
LoadStringA
winmm
timeGetTime
msacm32
acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmDriverDetailsA
acmStreamClose
acmDriverID
acmStreamOpen
advapi32
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
ole32
CoCreateInstance
StringFromGUID2
msvcrt
srand
_purecall
free
swprintf
__dllonexit
_onexit
_except_handler3
malloc
wcslen
_adjust_fdiv
_initterm
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=2, id=25, version=9412,
count=13, id=25, version=9210,
count=71, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
dpvoice.dll
- IMPHASH 5aee207477294953954c51dc722e6c2a
- SHA256 408ece801253a05c86465e08aed1a12d3c59c9863c5e7475bdde1a41ee6904b4
- MD5 10de4a08f6cc0edd48d1ae1f336c83c0
- SHA1 71772f91716c6c01024be19ed28ba0a8c055b2e1
- SHA512 7348c8e962270cbc0053507363dad2d94f5fcdb780f8353729b23e9bb6cdf5be2b3f04112338798d614a86f10d6c059a4d595a267b74b47d15d58333598da364
- SSDEEP 3072:qMEVwFPzhKCUyuV/4SR2gAcCtqZwfqGSjIkX7oKnOE5knUic+CqDEN57Eg88UakV:W54pgdZhGSj1oHslYCS4dh
- TLSH T150849211E7F98221F8F37B7C6DB817926E367D529E34C50E6644228E1DF4A52EA20733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
71844
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
InterlockedCompareExchange
InterlockedExchange
SetThreadPriority
ResetEvent
IsBadReadPtr
Sleep
IsBadWritePtr
GetSystemInfo
CreateSemaphoreA
CreateEventA
GetProfileIntA
SetLastError
GetSystemDirectoryA
ReleaseMutex
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
lstrcpyA
DeleteCriticalSection
GetTickCount
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CloseHandle
SetEvent
WaitForSingleObject
CreateMutexA
TerminateThread
GetExitCodeThread
GetWindowsDirectoryA
GetExitCodeProcess
CreateProcessA
HeapFree
GetProcessHeap
CreateThread
InitializeCriticalSection
GetLastError
GetVersionExA
lstrlenA
FreeLibrary
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
HeapAlloc
msvcrt
swprintf
__dllonexit
_onexit
malloc
wcslen
_strnicmp
strncat
strncpy
_ftol
wcscat
_CIpow
_except_handler3
?terminate@@YAXXZ
_adjust_fdiv
_initterm
free
_beginthreadex
_endthreadex
sprintf
_purecall
wcscpy
__CxxFrameHandler
fclose
fflush
_vsnprintf
fputs
vfprintf
fopen
srand
user32
LoadStringA
MessageBoxA
LoadCursorA
GetSysColorBrush
RegisterClassA
InvalidateRgn
DefWindowProcA
IsWindow
GetClientRect
BeginPaint
EndPaint
UnregisterClassA
GetWindowLongA
EnableWindow
DialogBoxParamA
GetParent
GetDlgItem
EndDialog
LoadIconA
SendDlgItemMessageA
PostMessageA
SetWindowLongA
SystemParametersInfoA
GetDC
ReleaseDC
SendMessageA
EnumWindows
GetWindowRect
GetSystemMetrics
SetForegroundWindow
SetWindowPos
GetClassNameA
GetWindowThreadProcessId
winmm
mixerSetControlDetails
waveInGetDevCapsA
PlaySoundA
waveOutGetDevCapsA
waveOutSetVolume
waveOutGetVolume
mixerGetID
waveInGetDevCapsW
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
timeGetTime
waveOutGetDevCapsW
advapi32
RegFlushKey
RegEnumKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
ole32
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeEx
CoCreateInstance
comctl32
CreatePropertySheetPageA
PropertySheetA
gdi32
DeleteObject
LineTo
CreateFontIndirectA
GetDeviceCaps
CreatePen
CreateSolidBrush
GetStockObject
Rectangle
MoveToEx
SelectObject
DirectPlayVoiceCreate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
232KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=3, id=64, version=9210,
count=15, id=25, version=9210,
count=166, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=59, id=29, version=9178,
count=1, id=61, version=9210,
dpvoice.inf
- SHA256 6842ec89b0453e1ace1b62cac39a550abb8cc014136db7926388e19fd9921f15
- MD5 25887d6e6f3931813cab4ce5a9979b5d
- SHA1 048bc6aa7d3a297c1d91f66fa9d0420b035b1f65
- SHA512 d5212ad9a22f36bf07c2de4514e87df421232195a0f4fe64a14fdd2d66b42132f6a3d34f9593826e0cb9e09ca4c1c1574f45fd919501d03c0fce42871086552a
- TLSH T192B09294A98765242125A9388EA30299B6AA482192A8A14CBA9121288366608E15DBAF
- MD5 SHA1 SHA512 TLSH
dpvsetup.exe
- IMPHASH 10089713ee9a30e6ce6391ce7f2f267f
- SHA256 271e5fac1db07d6c9c739158298b80999b625fa2e312bbe9e401b79db5f511e3
- MD5 763017348c8c27c1e264d403c91e9ebd
- SHA1 76fe9a22b304fb9b00cf87a7da1b7c54a2189de2
- SHA512 71caf0d322b2fdd847fe07eb2f223e6f8c16ad446c7d77afd3a506581bd884172e2fd778c87842bdc702ec9c5f281fec0df2790d52bb1d0f90edc5334a1dbecf
- SSDEEP 1536:W5XB7N7fzj88/vUoWu2mMkOHccMQv0GCuKqEhYLYywBu3PB:4BZ7fzj88/vUoIc40HuKh72PB
- TLSH T101834902378486BFC14102344429CB79C6B9AD110B2593EF77A8BE1BBD786D3A93F756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14524
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetCommandLineA
FreeLibrary
LoadLibraryA
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
GetStartupInfoA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
Sleep
CreateProcessA
CloseHandle
GetExitCodeProcess
GetWindowsDirectoryA
GetExitCodeThread
TerminateThread
WaitForSingleObject
SetEvent
CreateMutexA
lstrcpyA
WaitForMultipleObjects
CreateThread
CreateEventA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ReleaseMutex
GetSystemDirectoryA
OpenFileMappingA
OpenEventA
msvcrt
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
__p__fmode
__p__commode
_XcptFilter
_exit
_c_exit
fopen
vfprintf
fputs
_vsnprintf
fflush
fclose
strncpy
strncat
sprintf
_strnicmp
wcslen
srand
_stricmp
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_cexit
exit
strtok
_acmdln
user32
GetSystemMetrics
LoadStringA
LoadCursorA
GetSysColorBrush
RegisterClassA
InvalidateRgn
DefWindowProcA
GetClientRect
BeginPaint
EndPaint
UnregisterClassA
GetDesktopWindow
GetWindowLongA
EnableWindow
DialogBoxParamA
IsWindow
GetParent
GetDlgItem
EndDialog
LoadIconA
SendDlgItemMessageA
MessageBoxA
PostMessageA
SetWindowLongA
SystemParametersInfoA
GetDC
ReleaseDC
SendMessageA
EnumWindows
GetWindowRect
SetForegroundWindow
GetWindowThreadProcessId
GetClassNameA
SetWindowPos
winmm
waveInGetDevCapsW
waveInGetDevCapsA
PlaySoundA
waveOutGetDevCapsA
waveOutSetVolume
waveOutGetVolume
mixerGetID
waveOutGetDevCapsW
timeGetTime
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
StringFromGUID2
advapi32
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegFlushKey
gdi32
CreateFontIndirectA
DeleteObject
GetDeviceCaps
CreatePen
SelectObject
MoveToEx
LineTo
Rectangle
GetStockObject
CreateSolidBrush
dsound
ord1
comctl32
PropertySheetA
CreatePropertySheetPageA
ord17
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=64, version=9210,
count=17, id=25, version=9210,
count=156, id=1, productName=Unmarked objects,
count=15, id=28, version=9178,
count=1, id=69, version=9111,
count=22, id=29, version=9178,
count=1, id=61, version=9210,
dpvvox.dll
- IMPHASH 9ca221c3a877565ad9bffec04d44c52e
- SHA256 b55a7babc9f61c41b681fa1d737f26beab08455033463b8d0c3391133f8cd422
- MD5 bd85e25caca6b99dbe5256a27afee494
- SHA1 cc84b4e9837d9b7db435a3df0ddd7b233eb27a1d
- SHA512 aeb260698bb9f668587b34ab53a8bb7864f7daf8b3a36791af6ef4e67336ed5fa488a0de3fe79b78f1acf7d3ff9fbdb59713490fff12ccd7e537e3476c93667f
- SSDEEP 3072:Z95+SLEHm5akkiAvqPKKsoD2JVaQCFMtkB:T5lfa1iAvBK92qw
- TLSH T14CC3AF427CD00079E7974738BD7632A4A3F89A226D74AE4DDF5818432D64987E2EDF0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
107803
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
lstrlenA
GetVersionExA
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
FreeLibrary
DeleteCriticalSection
GetLastError
IsBadWritePtr
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
HeapFree
GetProcessHeap
HeapAlloc
Sleep
user32
LoadStringA
winmm
timeGetTime
msacm32
acmStreamClose
acmStreamOpen
acmStreamUnprepareHeader
acmStreamConvert
acmStreamPrepareHeader
advapi32
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
ole32
CoCreateInstance
StringFromGUID2
msvcrt
_purecall
floor
_ftol
free
calloc
ceil
_except_handler3
malloc
_CIpow
srand
_CIexp
_CIasin
_initterm
_adjust_fdiv
__dllonexit
_onexit
swprintf
wcslen
_CIacos
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=127, id=28, version=9037,
count=2, id=25, version=9412,
count=13, id=25, version=9210,
count=74, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
dpwsockx.dll
- IMPHASH 09addee8b7ec4821384d561a5e591c40
- SHA256 3b080e509a75171b82b39b7e932239cce4f116f88ca7d6e8958207f3318d4594
- MD5 b8b466d78f1f455162d9be1ccde1aeb8
- SHA1 406d1a50abbc70d4f445d10193fc538881b64022
- SHA512 b009b3a86be9859a81f491ba4b66e914573f7cef18b4de53a42d57ef6573a6a3e518a6c0e0f1c71004647c5ef3d92e2ac0576abb1a06e77697e10b104acf0dc0
- SSDEEP 1536:XXC0ncastiEHj10W4pDqoId/MdugRAPQXOeCPOdPKhM0DdfK9mVefoxes:XutuW4RIdeeeCPORKhM0DdfK9mVefoxe
- TLSH T16D83E71177F50036F4A35B70D9F51BA2AA7EFD226A7A925F4B50264D2870D00EB30B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
38198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InterlockedExchange
Sleep
ResetEvent
SetEvent
SetThreadPriority
CreateThread
WaitForSingleObject
GetVersionExA
DisableThreadLibraryCalls
HeapAlloc
GetProcessHeap
ReleaseMutex
UnmapViewOfFile
OpenMutexA
MapViewOfFile
CreateFileMappingA
HeapFree
CreateProcessA
GetSystemDirectoryA
OpenEventA
GetCurrentProcessId
HeapReAlloc
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
GetCurrentProcess
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
VirtualAlloc
GetCPInfo
GetOEMCP
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
VirtualQuery
FreeEnvironmentStringsA
VirtualFree
HeapCreate
HeapDestroy
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
GetCommandLineA
FreeLibrary
GetProcAddress
ExitThread
WaitForMultipleObjectsEx
InterlockedDecrement
GetLastError
InterlockedIncrement
InitializeCriticalSection
CreateEventA
CloseHandle
DeleteCriticalSection
EnterCriticalSection
TerminateProcess
LeaveCriticalSection
user32
SetWindowLongA
GetForegroundWindow
SendMessageA
SetFocus
GetDlgItem
GetWindowLongA
GetDlgItemTextA
EndDialog
DialogBoxParamA
wsock32
select
__WSAFDIsSet
getpeername
recvfrom
gethostname
gethostbyname
send
sendto
listen
accept
getsockname
connect
setsockopt
inet_ntoa
WSAGetLastError
closesocket
inet_addr
getsockopt
WSACleanup
WSAStartup
socket
ntohs
bind
ioctlsocket
htons
recv
winmm
timeGetTime
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SetSecurityDescriptorDacl
FreeSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegEnumKeyExA
dplayx
gdwDPlaySPRefCount
DPWS_BuildIPMessageHeader
DPWS_GetEnumPort
SPInit
Name
.text
Size
48KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=8, id=64, version=9210,
count=1, id=29, version=9178,
count=11, id=25, version=9210,
count=123, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=46, id=28, version=9178,
count=1, id=61, version=9210,
dsdmo.dll
- IMPHASH 320f45a32628b35d761b69e505a2c544
- SHA256 d60164f66f45a3ee692180cf957f275ca8d32eea980aae48146524def9126d4b
- MD5 c10c18f0240b68e109f7105182bc4a36
- SHA1 34122ce596c5fae2d0d8befe4fcac9b51b102310
- SHA512 0212cb872fd21ad2c813ece9cfc5035328674feb408e1b42d30bede09da7184014a321414dd8aedff9519a0d7e6b6e4475a9dc1ed55f728fa0af851c1ea3018b
- SSDEEP 3072:UsyqAITGF1KTvloaTcHWCXV4BHJQtuVQt1GkBqBxrj19cJIYxIMOUmSx76klU3VQ:DyqAITGF1KTcZSj19cJIlMOUmStjxAeN
- TLSH T1A1042A52670B5CE2EB5A38F055BCBBFAD2348B41622158036EB0DF757167079B8AD3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
110994
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersionExA
DisableThreadLibraryCalls
CloseHandle
WaitForSingleObject
GetLastError
DeviceIoControl
CreateEventA
IsBadWritePtr
IsBadReadPtr
InterlockedDecrement
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
InterlockedIncrement
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameA
Sleep
QueryPerformanceCounter
lstrlenA
msvcrt
_initterm
_adjust_fdiv
malloc
free
wcslen
_vsnwprintf
_vsnprintf
_CIsinh
ceil
modf
__CxxFrameHandler
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
wcstombs
_CIpow
floor
_ftol
advapi32
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
ole32
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
msdmo
DMORegister
DMOUnregister
MoInitMediaType
MoFreeMediaType
MoCopyMediaType
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=9, id=25, version=9210,
count=66, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=13, id=28, version=9178,
count=25, id=29, version=9178,
count=1, id=61, version=9210,
dsdmoprp.dll
- IMPHASH 44c532b5aea3995196546902607fa520
- SHA256 27dc4a5fd56b26d5435d72e3a0248e101dc13c057b158fa7d873891d8ab59670
- MD5 811a253931005eaa806b86e97e90b466
- SHA1 88446b3a2421c362a2f316a91e5f57c50fe2315d
- SHA512 f0d9347198bf73652188d732fadd595978017bfe8d70efefdfb7ed83f39073865cd358012c8ce59dca992d74a7a0c409f1413ab74a117d143018e20327c4f4c9
- SSDEEP 3072:fdoLmLDLOOikjGGMHCfq14jQx1Y2ers2Eqq2T4duGgFp2:NDLOOlEx
- TLSH T1BEA40C653BD8C09AF1A746722DF01FD3AC66BC41AE18CE4FEE55730EA839900EF51619
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
36444
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcatA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceA
GetLastError
LoadLibraryExA
GetShortPathNameA
lstrcpyA
MulDiv
GetCurrentThreadId
HeapAlloc
FlushInstructionCache
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
lstrcpynA
IsDBCSLeadByte
lstrcmpiA
lstrlenA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetProcessHeap
HeapFree
lstrlenW
WideCharToMultiByte
LockResource
MultiByteToWideChar
msvcrt
_initterm
malloc
free
??3@YAXPAX@Z
realloc
??2@YAPAXI@Z
atoi
atof
_ftol
_vsnprintf
_purecall
_adjust_fdiv
gdi32
GetDeviceCaps
CreateFontIndirectA
SelectObject
GetTextMetricsA
GetTextExtentPointA
DeleteObject
oleaut32
SysFreeString
SysStringLen
SysAllocStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
VarUI4FromStr
user32
CheckDlgButton
IsDlgButtonChecked
GetDlgItem
GetDC
SendMessageA
CharNextA
ShowWindow
MoveWindow
IsDialogMessageA
SetWindowLongA
DestroyWindow
IsWindow
LoadStringA
GetDialogBaseUnits
ReleaseDC
CreateDialogParamA
WinHelpA
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
advapi32
RegCloseKey
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
438KB
Virtual Size
437KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=37, version=8755,
count=2, id=64, version=9210,
count=11, id=25, version=9210,
count=100, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
dsetup.inf
- SHA256 43d98a55b040eae4db199ac050522b733d02a299e3be2b05fffacbfd9770ab31
- MD5 a06b5275c3c861c55792b211b395f89b
- SHA1 a9c4acbc2c6d4087cd95172bd0cf29241b245a75
- SHA512 5fb77346484e19a237efd526ec1d94659f30bafdb5ba86faf7e49d003ac1d63e3f2a50452a25a474c4d3435b5fdc7517ef847a9fef3b11ccd426beb43d0eab47
- TLSH T14A313AA69115D45751AD6386E88D8806DE674E0B3500EFCC0C5C0A4CF76ADCBB6DE0FA
- MD5 SHA1 SHA512 TLSH
dsound.dll
- IMPHASH 126b58900e8d9ef3e39cf2dcd1f2d31e
- SHA256 c0306da0740cbfb32c36d12f824a59229c307ef99dbc431953ea0d5d3c057739
- MD5 4c0a02d02cc4ab2bc1d4808856c7abd9
- SHA1 aff2d62f15efcd4467297480d17a17fe21d8b392
- SHA512 a369b528fd12b9d8fd59c7d3c4c5e6a844f8fd82ad5f7efdca1785953419b8400429e93973326d8468e811557bb1428dec2ef44c5d0af561159c4162c5355dc0
- SSDEEP 6144:Wi5RZLLfsEAO6O229FYOuGfBmn/o/KS/8q3TSa7YZSZghD6We24hkj+Xy3m0UQ:75zsE029cG++JbSa7wG86WDAw+Q4
- TLSH T11FA47DA3BDE2C0F5F6B752F186257F1972EE9F90C9F9CD4A02D91C852926111F239223
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
160212
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
DuplicateHandle
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
SetThreadPriority
SetPriorityClass
GetThreadPriority
GetPriorityClass
GetCurrentProcessId
GetCurrentThread
DeviceIoControl
ReleaseMutex
SetEvent
WaitForSingleObject
UnmapViewOfFile
OpenMutexA
MapViewOfFile
CreateFileMappingA
CreateEventA
lstrcpyA
CreateProcessA
OpenEventA
SetLastError
GetWindowsDirectoryA
FindResourceA
CreateMutexA
DisableThreadLibraryCalls
GetCurrentThreadId
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
InterlockedDecrement
CreateThread
GetExitCodeThread
ReadFile
GetSystemDirectoryA
GetOverlappedResult
ResetEvent
GetTickCount
WaitForMultipleObjects
OpenFileMappingA
GetPrivateProfileStringA
MulDiv
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
OpenVxDHandle
ConvertToGlobalHandle
RtlUnwind
ExitProcess
HeapSize
RaiseException
LCMapStringA
LCMapStringW
HeapReAlloc
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoA
GetCPInfo
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
SetConsoleCtrlHandler
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetACP
GetOEMCP
SetFilePointer
GetFileSize
GetCommandLineA
GetFullPathNameA
CreateFileA
GetModuleHandleA
GetModuleFileNameA
OpenProcess
CloseHandle
user32
LoadStringA
EnumWindows
GetWindowThreadProcessId
IsWindow
GetForegroundWindow
GetParent
wsprintfA
CharUpperA
GetWindowPlacement
CharLowerBuffA
advapi32
RegCreateKeyA
RegCreateKeyW
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
RegSetValueExW
RegCloseKey
RegOpenKeyExA
ole32
CoCreateInstance
winmm
waveOutGetDevCapsA
waveInGetDevCapsA
waveOutGetVolume
waveOutSetVolume
waveOutMessage
waveInMessage
waveOutGetNumDevs
waveInGetNumDevs
waveOutOpen
waveOutClose
waveInOpen
waveInClose
mmioOpenA
timeGetTime
waveInUnprepareHeader
waveInReset
waveInGetPosition
waveInAddBuffer
waveInPrepareHeader
waveInStart
waveOutUnprepareHeader
waveOutReset
waveOutRestart
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutGetPosition
mixerClose
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerSetControlDetails
timeEndPeriod
timeBeginPeriod
waveInStop
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
rpcrt4
UuidFromStringA
DirectSoundCaptureCreate
DirectSoundCaptureCreate8
DirectSoundCaptureEnumerateA
DirectSoundCaptureEnumerateW
DirectSoundCreate
DirectSoundCreate8
DirectSoundEnumerateA
DirectSoundEnumerateW
DirectSoundFullDuplexCreate
DllCanUnloadNow
DllGetClassObject
GetDeviceID
Name
.text
Size
418KB
Virtual Size
418KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
435B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=108, productName=Unmarked objects (old),
count=22, id=64, version=9210,
count=5, id=25, version=9210,
count=69, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=81, id=28, version=9178,
count=53, id=29, version=9178,
count=1, id=61, version=9210,
dsound.inf
- SHA256 2e4258ad5fda79156740519a994d2f1bad2e0ce2bc50097b8091dffff662bf78
- MD5 7c9a09e48a3567f85d6856805c9f0bc2
- SHA1 c3fd6bd20b47dcd1102c415b6e2dbe49cdf29627
- SHA512 3d552d12a1953f261baf32b0a67369524ee5b513c70f18d44938258dca7b5971b4ea856e31f188f9d21ff819287b29c52a4025b0c35153136d29db0f4059370e
- SSDEEP 768:au1SdfDzvtiMAe0V1ZUrBNBCBsBgB+AVB1BVB5UnBhB2BoBcBiAxBJBhBlxO/nxs:mtDSoEdrLrGBPOMYRf3P3ZW7Wh3vpX
- TLSH T1D6F2D0AE378DA2D2A3CCC5E8ADD0BB19558C44B1E0C6BD5D36A0DED4190D1A423BC7DB
- MD5 SHA1 SHA512 SSDEEP TLSH
dsound.vxd
- SHA256 31fde40f0309d3e16c09b43f23c6ff4eb7b0fcd87037759c84a40d39d1fc1b04
- MD5 8e8c14918a5736f78211680c3c970476
- SHA1 f0a8d94cb4c0c22f22ee0e4f22b7ff1ad39a765e
- SHA512 bc875a5f0e66914ecc5d24313e19609ffe200632f77fe92cb8e6701f3160a62c149546342c0c67d620b8dffda77e2e7934979410d579f0f35cc48b0bd99d52b2
- SSDEEP 768:QHPvEvvRl9jcHR1JLlt5Gdjx+n/czgKGTfJMjJpFyAWdZ0sbn7g/XqQQdi2C:QHnEXRl9jcHR1JLlt5Ijx+n/czgPytrF
- TLSH T1DA236C522CB3E5B6D0677173551FA24BAFAE1B625E220B3D83182D145330230DBEE7DA
- MD5 SHA1 SHA512 SSDEEP TLSH
dsound3d.dll
- IMPHASH 03deea28c2baec368335052cd61db3aa
- SHA256 d258030efabc5d048700b029422ccff5a9bb87ffa204c9cdcd9105ab985b5469
- MD5 cbcaa27f84a4cc5257d2545859c91c7e
- SHA1 712d94699ed15fe31b20fe7c3e90b19f1e0e86cd
- SHA512 f72429d47f5a94f55ace397893bc9c821a30a3c05f80915dae072340ac875efa9f3326ed379eca8e86d61a60adb73841aa6b1cfe1a1fdc67f9b72539a96c499f
- SSDEEP 12288:c9gU5I4qC5iFvSLAJYEAg17b1F0UQyHhnBJn5uoMnQCH6BRURa15rm/VixUn3O0F:xvSLAJYEAg17b1F0U3xiMfQedyG9
- TLSH T132555BC8843F58AEFA9824FA50FDB88FA1FC19DD65F43B55808913897D7620076E90F9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1297015
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
WriteFile
Sleep
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
LoadLibraryA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
CafBiquadCoeffs
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, productName=Unmarked objects (old),
count=7, id=64, version=9210,
count=28, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=2, id=29, version=9178,
count=1, id=61, version=9210,
dswave.dll
- IMPHASH 53dde5acafd181deae6d47482f150b5b
- SHA256 86d8604ba2889e87e30fb183497e4dc23ac8d260cf161033651dcb9c85bfe6a1
- MD5 bbaa3fdf2438841dffc4580e194b0f20
- SHA1 bdbb6959f67dfa40e300233d9c2a0d2f071a1dcf
- SHA512 8f5d47ad5e504f6b6bb7d84e1be85e01f1f477b0aa5ee1bceb9a333ee54f488bce35a5e6025b59d708deaeaea0ec164d9952a43a76d3f010f5475c4de6251d39
- SSDEEP 384:QFP3nusjsTdybx6/KmH46S0KsidPygv10LRsAnnkpVWhyUW:y/usjwybaSBXdPygN0L6AIJ
- TLSH T1C4824B4177F148FAC453A7304AD6735323A2DB681D1C9D1A06201F593EB89D3EAFD647
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15692
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalUnlock
IsBadWritePtr
IsBadReadPtr
GlobalLock
GlobalAlloc
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GlobalFree
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GlobalHandle
DeleteCriticalSection
GetModuleFileNameA
DisableThreadLibraryCalls
GetVersionExA
Sleep
InterlockedIncrement
QueryPerformanceCounter
InterlockedDecrement
msvcrt
free
memmove
_initterm
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
wcstombs
_adjust_fdiv
_purecall
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
msacm32
acmStreamPrepareHeader
acmStreamConvert
acmStreamSize
acmStreamUnprepareHeader
acmStreamClose
acmFormatSuggest
acmStreamOpen
ole32
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
748B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=9, id=25, version=9210,
count=59, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
dx7vb.dll
- IMPHASH 1075cfd402ecf012fa24c5ee66bf0f31
- SHA256 f270c9de7da2627cb6984b44fc67022c183d8613c9aed6ab9b1d0c2c0fbdc0c2
- MD5 78d1da9a3e3f427755c9773d8192e52e
- SHA1 79223653ed1f10da7938139e55ff272515c4d55e
- SHA512 fc54f8df7d9986c396ed5da1402caaf299c1c3a7a7e25589a770ed9d62dd01fba298f47cb5468cca5d1910da4fc74399a59a06518a15c0dcc8083718383aa888
- SSDEEP 12288:rLpS9GAJhSDocJH0OsyUmScvjvA2/r1JHBp8HxGdlWsr+O1p3fRKKWdlqq1SCgnY:rGN4HG
- TLSH T192D4D5637381C9E3C9491630A817A74A9FF560063F06E7877385135E2E623D6BF0E6DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
35801
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LockResource
_lopen
_lread
_lclose
WriteFile
FindResourceW
OutputDebugStringA
GetModuleHandleA
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FindResourceA
LoadResource
SizeofResource
GetModuleFileNameA
lstrcatA
lstrcpyA
HeapDestroy
GetCurrentProcess
GetLastError
lstrlenA
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
LocalReAlloc
lstrcmpiA
LeaveCriticalSection
EnterCriticalSection
CreateEventA
CreateThread
ResumeThread
GetSystemDefaultLCID
WaitForSingleObject
CloseHandle
SetEvent
GetTickCount
GetProcAddress
lstrlenW
GetVersionExA
DisableThreadLibraryCalls
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
LocalFree
LocalAlloc
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
msvcrt
_except_handler3
wcslen
_wcsicmp
wcsncmp
_wcsupr
wcscpy
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
ole32
CoCreateGuid
OleInitialize
CoGetInterfaceAndReleaseStream
OleUninitialize
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
StringFromCLSID
gdi32
SetBkMode
SetBkColor
Polyline
CreateBrushIndirect
CreateSolidBrush
CreateHatchBrush
CreatePen
GetObjectA
CreateCompatibleDC
SelectObject
StretchBlt
DeleteObject
GetSystemPaletteEntries
CreateHalftonePalette
GetPaletteEntries
CreateICA
GetDeviceCaps
Rectangle
RoundRect
Ellipse
ExtTextOutW
SetTextColor
GetTextAlign
SetTextAlign
DeleteDC
msacm32
acmStreamSize
acmStreamUnprepareHeader
acmStreamConvert
acmStreamPrepareHeader
acmStreamOpen
acmStreamClose
user32
LoadStringA
CharNextA
GetWindowRect
GetDC
ReleaseDC
LoadImageA
wsprintfA
oleaut32
VariantChangeType
SysStringByteLen
VariantInit
VariantClear
SysFreeString
SysAllocString
RegisterTypeLi
LoadTypeLi
SysStringLen
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=13, id=25, version=9210,
count=181, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=90, id=29, version=9178,
count=1, id=61, version=9210,
dx8vb.dll
- IMPHASH d7478ded6c8775462f2d7c0c8f58d1d9
- SHA256 8fa336594a3282822338dcbe7e3b0ddcc44e89bc584c9e0b502c9eacceec32f8
- MD5 ca7c40cafe9cfb722545adf137cba0fc
- SHA1 7a13abbb74193a78bdccc0e00bc485c7ff6d9786
- SHA512 aad4edd8dae252dc4db10f20f83832ceeceb48e38874b9b05998a358d3907665765c7a3b344bd1be70a80a5200163885e46ece515642fe8f08e1871fc8b4b134
- SSDEEP 12288:5LoAAp8bHeb7fcoz3NcB23tKGCV6Hj2j7exFGnixvkNstVkEmakJTW/K9dCsGB+o:5cKtX9zqIKS/2eLGqeX+r7MoQ+/T
- TLSH T11B455B03B395D8E7C8071630A957A399AAF166437F06A6C77388172F5E633D07F2634A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
67726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetFilePointer
ReadFile
SetThreadPriority
GetTickCount
Sleep
lstrcmpA
WriteFile
FindResourceW
OutputDebugStringA
GetModuleHandleA
HeapValidate
LockResource
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FindResourceA
LoadResource
lstrlenA
SizeofResource
GetCurrentThread
GetModuleFileNameA
lstrcatA
lstrcpyA
HeapDestroy
GetCurrentProcess
GetLastError
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
CreateEventA
CreateThread
ResumeThread
GetSystemDefaultLCID
WaitForSingleObject
CloseHandle
SetEvent
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
lstrlenW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
GetProcessHeap
HeapFree
CreateFileW
IsProcessorFeaturePresent
GetVersionExA
IsDBCSLeadByte
GetTempPathA
GetTempFileNameA
DeleteFileA
InitializeCriticalSection
TerminateProcess
msvcrt
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
realloc
free
_CIacos
_finite
_ftol
wcslen
sprintf
wcscpy
ceil
?terminate@@YAXXZ
exit
floor
_CIpow
_setjmp3
longjmp
sscanf
isspace
isalnum
_except_handler3
_snprintf
__CxxFrameHandler
qsort
_controlfp
_wcsicmp
_strdup
setlocale
calloc
_vsnprintf
atoi
isdigit
isalpha
advapi32
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegSetValueExA
RegCloseKey
ole32
CoGetInterfaceAndReleaseStream
OleInitialize
CoCreateGuid
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoReleaseMarshalData
CoMarshalInterface
CreateStreamOnHGlobal
CoUnmarshalInterface
StringFromCLSID
CoUninitialize
CoInitializeEx
CoInitialize
OleUninitialize
gdi32
GetDeviceCaps
CreateICA
GetObjectA
SelectObject
CreateFontIndirectA
GetCurrentObject
GetOutlineTextMetricsA
DeleteObject
GetGlyphOutlineA
GetGlyphOutlineW
SetTextColor
SetBkColor
SetBkMode
CreateDIBSection
CreateCompatibleDC
DeleteDC
msacm32
acmStreamPrepareHeader
acmStreamOpen
acmStreamSize
acmStreamConvert
acmStreamUnprepareHeader
acmStreamClose
user32
DispatchMessageA
TranslateMessage
LoadStringA
CharNextA
wsprintfA
DrawTextA
DrawTextW
PeekMessageA
oleaut32
SafeArrayCreate
RegisterTypeLi
LoadTypeLi
SafeArrayDestroy
SysFreeString
SysAllocString
d3dxof
DirectXFileCreate
D3DIndexBuffer8GetData
D3DIndexBuffer8SetData
D3DVertexBuffer8GetData
D3DVertexBuffer8SetData
D3DXMeshIndexBuffer8GetData
D3DXMeshIndexBuffer8SetData
D3DXMeshVertexBuffer8GetData
D3DXMeshVertexBuffer8SetData
DXCopyMemory
DXLockArray8
DXUnlockArray8
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VB_AddDataToBuffer
VB_AddStringToBuffer
VB_D3DColorARGB
VB_D3DColorMake
VB_D3DColorRGBA
VB_D3DColorXRGB
VB_D3DXColorAdd
VB_D3DXColorAdjustContrast
VB_D3DXColorAdjustSaturation
VB_D3DXColorLerp
VB_D3DXColorModulate
VB_D3DXColorNegative
VB_D3DXColorScale
VB_D3DXColorSubtract
VB_D3DXMatrixAffineTransformation
VB_D3DXMatrixIdentity
VB_D3DXMatrixInverse
VB_D3DXMatrixIsIdentity
VB_D3DXMatrixLookAtLH
VB_D3DXMatrixLookAtRH
VB_D3DXMatrixMultiply
VB_D3DXMatrixOrthoLH
VB_D3DXMatrixOrthoOffCenterLH
VB_D3DXMatrixOrthoOffCenterRH
VB_D3DXMatrixOrthoRH
VB_D3DXMatrixPerspectiveFovLH
VB_D3DXMatrixPerspectiveFovRH
VB_D3DXMatrixPerspectiveLH
VB_D3DXMatrixPerspectiveOffCenterLH
VB_D3DXMatrixPerspectiveOffCenterRH
VB_D3DXMatrixPerspectiveRH
VB_D3DXMatrixReflect
VB_D3DXMatrixRotationAxis
VB_D3DXMatrixRotationQuaternion
VB_D3DXMatrixRotationX
VB_D3DXMatrixRotationY
VB_D3DXMatrixRotationYawPitchRoll
VB_D3DXMatrixRotationZ
VB_D3DXMatrixScaling
VB_D3DXMatrixShadow
VB_D3DXMatrixTransformation
VB_D3DXMatrixTranslation
VB_D3DXMatrixTranspose
VB_D3DXMatrixfDeterminant
VB_D3DXPlaneDot
VB_D3DXPlaneDotCoord
VB_D3DXPlaneDotNormal
VB_D3DXPlaneFromPointNormal
VB_D3DXPlaneFromPoints
VB_D3DXPlaneIntersectLine
VB_D3DXPlaneNormalize
VB_D3DXPlaneTransform
VB_D3DXQuaternionBaryCentric
VB_D3DXQuaternionConjugate
VB_D3DXQuaternionDot
VB_D3DXQuaternionExp
VB_D3DXQuaternionIdentity
VB_D3DXQuaternionInverse
VB_D3DXQuaternionIsIdentity
VB_D3DXQuaternionLength
VB_D3DXQuaternionLengthSq
VB_D3DXQuaternionLn
VB_D3DXQuaternionMultiply
VB_D3DXQuaternionNormalize
VB_D3DXQuaternionRotationAxis
VB_D3DXQuaternionRotationMatrix
VB_D3DXQuaternionRotationYawPitchRoll
VB_D3DXQuaternionSlerp
VB_D3DXQuaternionSquad
VB_D3DXQuaternionToAxisAngle
VB_D3DXVec2Add
VB_D3DXVec2BaryCentric
VB_D3DXVec2CCW
VB_D3DXVec2CatmullRom
VB_D3DXVec2Dot
VB_D3DXVec2Hermite
VB_D3DXVec2Length
VB_D3DXVec2LengthSq
VB_D3DXVec2Lerp
VB_D3DXVec2Maximize
VB_D3DXVec2Minimize
VB_D3DXVec2Normalize
VB_D3DXVec2Scale
VB_D3DXVec2Subtract
VB_D3DXVec2Transform
VB_D3DXVec2TransformCoord
VB_D3DXVec2TransformNormal
VB_D3DXVec3Add
VB_D3DXVec3BaryCentric
VB_D3DXVec3CatmullRom
VB_D3DXVec3Cross
VB_D3DXVec3Dot
VB_D3DXVec3Hermite
VB_D3DXVec3Length
VB_D3DXVec3LengthSq
VB_D3DXVec3Lerp
VB_D3DXVec3Maximize
VB_D3DXVec3Minimize
VB_D3DXVec3Normalize
VB_D3DXVec3Project
VB_D3DXVec3Scale
VB_D3DXVec3Subtract
VB_D3DXVec3Transform
VB_D3DXVec3TransformCoord
VB_D3DXVec3TransformNormal
VB_D3DXVec3Unproject
VB_D3DXVec4Add
VB_D3DXVec4BaryCentric
VB_D3DXVec4CatmullRom
VB_D3DXVec4Cross
VB_D3DXVec4Dot
VB_D3DXVec4Hermite
VB_D3DXVec4Length
VB_D3DXVec4LengthSq
VB_D3DXVec4Lerp
VB_D3DXVec4Maximize
VB_D3DXVec4Minimize
VB_D3DXVec4Normalize
VB_D3DXVec4Scale
VB_D3DXVec4Subtract
VB_D3DXVec4Transform
VB_GetDataFromBuffer
VB_GetStringFromBuffer
VB_NewBuffer
Name
.text
Size
605KB
Virtual Size
605KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
63KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
462KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=8, productName=Unmarked objects (old),
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, id=64, version=9210,
count=15, id=25, version=9210,
count=216, id=1, productName=Unmarked objects,
count=11, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=157, id=29, version=9178,
count=1, id=61, version=9210,
dx9w9x.cat
- SHA256 d1ce7289c997c0fbba52a52a98b9a87ff6fcd13a761266fdc8bb10f1693fd776
- MD5 42bdc7102bf0bbfe9f28408697264fe6
- SHA1 b36ea4a0796ecbb2b70c08c96634efa93de49830
- SHA512 9a1c95c5f13ac3e43f5677c9be7ab1bb4f6485181b1c39fe06d54a75d71e02864a97e384950fc97fd0190b0ce3bb87ca4937f6762b40b238a1bffd6cbf30241d
- SSDEEP 384:1K6StMMssRd+dmwwrXnjdBQxj5Akmhe1OHrD8:s6SjssBcj5AkmC
- TLSH T1A5130D6715ED0262D037C8B09FF5E45FE112FAABA8112DBD325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxapi.sys
- SHA256 493d22d2aa1363f2372dbc53d79c09ea9d4f21284fd31baf03db744f5763225f
- MD5 48eead1da71ad8462f9f5911b7b94184
- SHA1 4a1082989b8e586ef68e357aa7401a13066548d9
- SHA512 0c19f639d00a552146fda846859520c3771921080d0366a8d96012636949eba9fb80914289705f11cdd581a9dbc6f1a63bd79cf86173ac4c068e9a51bdf78962
- TLSH T112419911BBF81E6AF4B30F7469B727276679B8709B31D61E0690211D3C32E60D9B1B72
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
_DxApi@20
_DxApiGetVersion@0
Name
.text
Size
256B
Virtual Size
242B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
32B
Virtual Size
1B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
32B
Virtual Size
5B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
128B
Virtual Size
99B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
960B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32B
Virtual Size
14B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=19, version=9049,
count=1, id=6, version=2051,
count=2, productName=Unmarked objects (old),
dxdiabrz.chm
- SHA256 9ca5aee16796d8bcc7b8b540e5e205001ed8f9a83dc4a4a75da813048dd73838
- MD5 53c73ef6daffdb7c3730c1608777e1d5
- SHA1 4f26b1ccb0b2250377b848da5950bc10bf2f55cb
- SHA512 d69cb7fdad285c8da0c7d4a99a868b966eb31252f86534eeafbfa928ae15c0ce3a91c1d1bca2b077385c3e48d3c979a61eb892d0d38db4b28970ea130a18043e
- SSDEEP 384:6Dg65cgcal9pVJsRDy5vzPctpT5EMpkvRDja3etj5kk/CS:6Dg2cgx33sBmPctZSMpUi0bCS
- TLSH T1BAB2CFFB0590C02FC1C346F22EE542C6751D3D56DA921ACB12A9163D9BB368C8FB2D27
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiachs.chm
- SHA256 ae5417657ca355416d9d12e90f1e543c7518880e695c2cbfda7a15423c52349f
- MD5 73e82b73df5fadafad4b6769e629f785
- SHA1 b394d6d6e3dc8266710df5f36b35c308db7f03d7
- SHA512 8a4c80f3db5ac3171eea8dae5d9aa3d734b9fbfc26b8977b27527853b092c8373ba7d8b1f6c5e76ce53d816eaf64dd203d4a074a6d299775f3d14aae33d853e2
- SSDEEP 384:Lx9c2X4IusikWoiEAC/40BoYH5VAdUZxav5srqSCA+z6pISlXx0Vw3zxdT:Lx9Fssiih44oYH5VHVrSuXx0VE1V
- TLSH T1F8C2CF9133904420E685D83E7A858A43F04A3F17E2DAAA0DF052BBAD1673F0767619B7
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiacht.chm
- SHA256 5bbb6a9b1bdb2ec80f8c5fc4a373ec5c2539081e146decd35183bd2ff50b64f2
- MD5 024ad44006f8913db27a6dbf9914ca25
- SHA1 7201b5d91e77be5a893a9492a37d4c7d75dea054
- SHA512 75325fe6b535d26cfbc4d7804fa8623dd07c48f6c3c3b5b7a78cc697ac2e90de46d1337c55d702e455d2284f7e19aac6517b43b10ea8b6398dfc50104f177321
- SSDEEP 384:P0rp30rPMPpJild4RO1UfTA5613+IC1Gyjkumtx1MrMxSTuK1743RLmN:P0rpkwpJ+iO1X5e3iGypmtx1Mrf7743m
- TLSH T137C2C0E9636AA95BD80217B65AB8130A92633C08CC5063EFA274332F14F5F641F7495B
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiacze.chm
- SHA256 6d77211a660b988c5119b48003db33e990676d32633a37e93ff3f0b1d3e431f3
- MD5 144b2198a88cecece732e1ff04b4e124
- SHA1 47f84621c0721a8e94453fe5afa5e388edb87ed1
- SHA512 00a9e91ae54d1754ce25bf97d1af794ecba87f3945c6986d3ad4a5997f892d8385f9cdc9670492da01e1caa7255c7eb6b80c21b1fa84e01b98d9acfccff8bf9f
- SSDEEP 384:oFe5DsecRkWn7/VufDeH/9llasr/37n2wsgy/8bHCVvNuDZan4sgv:oFe5Lc+W79E293P/a5/8bO1uDZanRu
- TLSH T188C2E0B4BBE6A51DE215463153B0F1DFA70CECC4E568D4FC21AAD7A8372E246432C636
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiadut.chm
- SHA256 11f25e59793a2fb3860f27223dc8a981b49f4b154a28b4cf63d540ef22ed4d2c
- MD5 b0eef1fda652b64c59b113236bdaeea4
- SHA1 a5851331a3b2e791a6d5de4a426952ef8168d9c5
- SHA512 cf59892252684690608a45fd5e995cad07627afea9053cc88a6a6c7d5829a14b39d936fd837eb448d7b00ef47a49f230d0042f9bb8c304ecf376f632cb86f867
- SSDEEP 768:1pFUiogyVdft7K9rRoELdKKbtAWeXDYqEl63oN/ojrHX:1pFUi3wdF7KFRoEL1bCWeOlL/Ub
- TLSH T130F2D1ED3FC599D1D3021A3AA2C91EC57138E63829CB839FE110FD657B67D9C2A2140D
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiafrn.chm
- SHA256 05c1747926daad44bfc8e05f54b0d921e9690515c6898430aa665b629225ddc6
- MD5 5a14a2abef5adaa08c025365ef47faab
- SHA1 3f78e2c9ccc7d9ba62f41300bf197d8f05095daf
- SHA512 4936ee5f1cc1bde9dc211d2ca46e7186e533e58629faf179dbb8d6ab1f10f52c52e8c960e9978c8d57effa96ac5db39b7891497774fd9f21545a20847286cb90
- SSDEEP 384:JlgmbaNEcvpsUXk0Epc1LqY5kU9ahYxTIsALhKPkVF:JSmb3Up9k0NPkhKaLh0kT
- TLSH T1C7B2C07A23238314F4594A39BF9113A7A234AE5A8575D3D5F31BC6FC5BA7E88BB00061
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiag.chm
- SHA256 aa50e05ccb8ded699db5a8da1068afd8bfef1f8717e6004419d89f2cf5e5e506
- MD5 e4985c0c04a05d83da060409408d005a
- SHA1 6b61a545a26fcfbe7b92bcb2e5490f981c285e90
- SHA512 a0dbabf8db99d3603f12366ef0e2792cfbcfb4cf6504241b264e3a5504548a799f946a40fa387a5ef6ddf5e34b613301c4836951551126a8dbf93e5923c01da8
- SSDEEP 384:HZjB8bflvUSUP0BsEq6hglFidAEeJvmezSXMgUfe7t:HZjBGBBspHOwJvVCme7t
- TLSH T12EB2C0F05AA02B49DA4526708B600657346F5843D2B19985F63BA21E1EBAD5CCEF23F1
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiag.exe
- IMPHASH 6afdc72c2fb75b9c57b1310aa15524ec
- SHA256 118ded435d8fc3d11c68690e47c0492a967eddb48dca9f78786a9bee14797129
- MD5 4f3162002a3134b2a992e6c8b51e4482
- SHA1 a122169e1cc5098ed668b8b409dc28b4aa3979b7
- SHA512 eb2ca9ffac40e53cbbf6c0d34334a89e69f2d265fda7620453dac084b33ccb0f01a440ea905053f985c265766a3bd702ee48e48bc98e64ac7f0d7581f15914b6
- SSDEEP 12288:F9EPfJdRJ8APNjUyYjEtP2U1cLioZ1XvL/QQZq4vObhmwYC/YvvDIJmhnpxlTBPB:F9EPfJdRJhVj+Mm
- TLSH T13B15E91067FD962AF1F36B346EB912924E37BD55AE39C54F9A14314E4932F80DB20B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
139924
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetVersionExA
WaitForMultipleObjects
SetEvent
GetCurrentThreadId
FreeLibrary
LoadLibraryA
Sleep
WaitForSingleObject
GetCommandLineA
CreateEventA
GetSystemInfo
MultiByteToWideChar
GetFullPathNameA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CompareFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
lstrcmpA
lstrcpyA
GetProcessHeap
HeapAlloc
HeapFree
CloseHandle
DeleteCriticalSection
GetModuleFileNameA
GetFileAttributesA
InitializeCriticalSection
WideCharToMultiByte
GetCurrentDirectoryA
GetSystemDirectoryA
lstrlenW
GetProcAddress
GetWindowsDirectoryA
SetEndOfFile
ReadFile
CreateFileA
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
GetLocaleInfoA
SetFilePointer
IsBadCodePtr
IsBadReadPtr
RaiseException
SetUnhandledExceptionFilter
VirtualQuery
VirtualProtect
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
GetACP
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
TlsAlloc
SetLastError
TlsFree
GetFileType
SetHandleCount
GetEnvironmentStringsW
InterlockedDecrement
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
lstrlenA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
ExitProcess
CreateThread
GetLastError
TlsGetValue
TlsSetValue
ExitThread
RtlUnwind
HeapReAlloc
GetStartupInfoA
advapi32
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegNotifyChangeKeyValue
RegOpenKeyExA
RegFlushKey
RegDeleteKeyA
RegEnumKeyExA
RegEnumKeyA
RegQueryValueExA
RegCloseKey
gdi32
GetTextExtentPointA
user32
MessageBoxA
LoadStringA
EnableWindow
SendMessageA
GetDlgItem
wsprintfA
EndDialog
GetDesktopWindow
MsgWaitForMultipleObjects
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
SetWindowsHookExA
UnhookWindowsHookEx
PostQuitMessage
UpdateWindow
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetWindowPos
GetFocus
SetFocus
SetTimer
KillTimer
SetForegroundWindow
LoadIconA
CheckRadioButton
GetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
GetDC
ReleaseDC
SetWindowTextA
CheckDlgButton
ShowWindow
SetDlgItemTextA
DestroyWindow
GetKeyState
IsWindowEnabled
PostMessageA
CallNextHookEx
GetWindowLongA
DialogBoxParamA
CreateDialogParamA
comctl32
ImageList_ReplaceIcon
ImageList_Create
ord17
ImageList_Destroy
comdlg32
GetSaveFileNameA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeSecurity
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
Name
.text
Size
188KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
708KB
Virtual Size
706KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=21, id=64, version=9210,
count=15, id=25, version=9210,
count=177, id=1, productName=Unmarked objects,
count=126, id=28, version=9178,
count=1, id=69, version=9111,
count=17, id=29, version=9178,
count=1, id=61, version=9210,
dxdiager.chm
- SHA256 ecf4dc10f45af9ca9276d45aaa783b68df0e0450533c3993042ef3e530244dad
- MD5 8eddacb09e28fddf68c1d19fd20a7e39
- SHA1 944aff3867b30abb7a6b3b588a7766a7a88f0169
- SHA512 d228300471abe6eae963e34e49141f44cdfd286730d7ae3fdca7ce7017a061a3284e274a5234caa3ebdc4f5c6c86025f828e23c1c15e93dff5c6a47d64791973
- SSDEEP 768:LpuQJ5RzN2PXp4CblEsv655v7Cd6z7BEuim4:LpuQJzQh4Gv6zo6X+uim4
- TLSH T19BE2E0F002AE1111E8959C379BA269CAF2631EC6EF40DD87E0F63B188296C525FD50B7
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiagn.dll
- IMPHASH a438fabad246286c07f450a1005a2cb7
- SHA256 11347c58564a4cd96b8e82432985dea61675d5093600e9be591f9b31ca21e463
- MD5 005506ef420431ba1a25c083da22618e
- SHA1 d2e7cadd3c09fd2abed7f7f4fd26a0c6349b8d89
- SHA512 207cd9d3046f7e612944021ce3ee1e4f43b9903fdf69c935184900015eeb694578f7923f59b263ae5af2e0941d6123a219ecfa4ae552b1ee41e478d2704b51b7
- SSDEEP 12288:mFYsHYnWiBQPbyf7tN0LpA5znYqJt9qrZdlfC3e8p5DT5DCf6d1kf6d1EAqe:mF3HZXbyf0MkgqjZYDlDCf6fkf6fEAt
- TLSH T18D752802A3FD5225F5F36F306E7922A55A7ABD92AD38C00E1284755E1D72F90DA70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
355244
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
CloseHandle
CreateFileA
GetFullPathNameA
ExpandEnvironmentStringsA
lstrcmpiA
GetPrivateProfileStringA
CompareStringA
GetSystemInfo
Sleep
SetPriorityClass
GetPriorityClass
GetCurrentProcess
GetProfileIntA
GlobalMemoryStatus
GetSystemDefaultLCID
GetLocalTime
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceA
GetTempPathA
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
DeleteCriticalSection
CreateEventA
InitializeCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SystemTimeToFileTime
TerminateProcess
GetLocaleInfoA
GetCurrentDirectoryA
GetWindowsDirectoryA
OutputDebugStringA
GetModuleFileNameA
GetFileAttributesA
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetProcessHeap
FindResourceW
IsProcessorFeaturePresent
FlushFileBuffers
ReadFile
SetStdHandle
SetFilePointer
IsBadCodePtr
IsBadReadPtr
RaiseException
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
VirtualQuery
VirtualProtect
GetCPInfo
GetOEMCP
GetACP
HeapSize
SetEndOfFile
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
GetSystemDirectoryA
lstrcpyA
GetModuleHandleA
GetVersionExA
lstrcmpA
CompareStringW
GetLastError
lstrlenA
FreeLibrary
LoadLibraryA
GetProcAddress
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
TlsSetValue
advapi32
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegEnumKeyA
RegQueryValueExW
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyA
RegCloseKey
user32
GetWindowRect
GetSystemMetrics
CharNextA
GetDlgItemTextA
SystemParametersInfoA
IntersectRect
OffsetRect
EnumDisplaySettingsA
ReleaseDC
GetDC
CharLowerBuffA
LoadStringA
FindWindowA
GetKeyboardType
LoadImageA
ShowWindow
DialogBoxParamA
SetForegroundWindow
PostMessageA
KillTimer
SetTimer
EndDialog
IsDlgButtonChecked
GetWindowTextA
InvalidateRect
SetWindowTextA
CheckRadioButton
EnableWindow
GetDlgItem
InflateRect
SetWindowPos
GetCursorPos
SetCursorPos
ShowCursor
SendMessageA
MessageBoxA
SetRect
PeekMessageA
GetWindowLongA
DefWindowProcA
RegisterClassA
CreateWindowExA
gdi32
GetDCOrgEx
GetClipBox
DeleteDC
CreateDCA
GetDeviceCaps
DeleteObject
BitBlt
SelectObject
CreateCompatibleDC
GetObjectA
GetStockObject
winmm
waveOutMessage
mmioOpenA
mmioDescend
mmioClose
mmioRead
timeGetTime
waveOutGetDevCapsA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
ole32
CLSIDFromString
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantInit
SafeArrayAccessData
SysFreeString
SafeArrayUnaccessData
SysAllocString
VariantCopy
VariantClear
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
636KB
Virtual Size
635KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
880KB
Virtual Size
878KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=95, version=2067,
count=6, id=18, version=8444,
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=41, id=64, version=9210,
count=13, id=25, version=9210,
count=216, id=1, productName=Unmarked objects,
count=158, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=149, id=29, version=9178,
count=1, id=61, version=9210,
dxdiaitn.chm
- SHA256 38281c3e17b2d9c0485012ea200022d0036d3a68873d828f03ec1fa825314f81
- MD5 dafc6ee570887cefae4debe72b49650e
- SHA1 b1da18985d246b4aabf2872ebf70180afb821484
- SHA512 d8e1ed5f61625491d4a53dad42b1d18f60594f314f19a75dc1049ef601ff8cee8a17a62e1c6da345f518caba9cbe28ecf93c8a6f1c57271d9398d59ee106c874
- SSDEEP 384:ZxAkR2OekdPNjEePStyBDd5W/OTl9XKijfvIqe60Kf:ZxAUdPNwdcDd5z9XKi7Aqe6V
- TLSH T1FCC2D0C437108E0CCD0499F3F185E1887AB63F42AC50DF5AFB2D6E48BAB5F895B56152
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiajpn.chm
- SHA256 da682d976eaa8f066a4cd6ca96dc67abcddbff2715c7998f8a18298423c29370
- MD5 81f4ee6ba91a82ef3b435d93911a6873
- SHA1 8d4425cdc1f62eb6432cabe0dc4f497ecad6fab6
- SHA512 ddb0e4350b6f7e02b5c39ebe6271c8d41b83ae1b2fa8f74f06a5a8e9607386fe4e5f4abd5d4c3673b897489e96e4fcd307bf1c6039a97a5fbc0e2be228339ace
- SSDEEP 384:dVZvmyl49vMl/EMtxlGtU86d1uwI02PRyLIf6Ch75bdvLypkX8O4dtmmrJ:dzOyaulXlGtV6C02PRIISApvLfMORml
- TLSH T1DEC2D0831F210332E4266F35B99F2DC6BB594C06FC69BB168EA2B57C0EB7D491015A73
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiakor.chm
- SHA256 d9e0d7fcbb6210a8eb8675a37c72dd7fba95a0daa3dcd5eb06baae57bf5ff79a
- MD5 b49cd05759b11df66a9f6fd74e04b1a0
- SHA1 ddd408554d9701afdcc41b99e65a04ab71eda3af
- SHA512 5ba2df5370d2e39e4a9eaf10619f943646ced896c97bb3cc42f633566286fc9544a1493d8e3b1ededc530eb2d6988bdf46c5a2b59644cd967d729c55280f6f17
- SSDEEP 384:iGmCZvXVmIlW7kLXXzfkSbf5KdvDP0O+xYEXR3AHxh4o00qpYOs8i772N:iGmI8I5jfkSbfk0O6mHxhO0ELsN2N
- TLSH T15CC2D0745742D193E14E4533AFDE29E239127C107E3866D6F417DB3E8B77E5848E1421
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiapol.chm
- SHA256 7015d193adeace0a781ce065c7a53b11c1dbc54caa26e2c14b29ce9c857d5685
- MD5 e82515e43e735747d1953e61f02be720
- SHA1 1837c25922728ec14c47d75fd6fd39756aa3b988
- SHA512 9dfcebfaf8bfa11dc742bf833b5e3d7c0b70a5a9a188b77cc738a7540442cc1e078cfd6bb9437df01f695023c137a34ab4f75bbe122fe16320fffada2cfb8fd8
- SSDEEP 384:+TMeBMvZlZ0aASIkUm8orxybF14PtXjcRW2ta3pGTbhkBo2m+6pr:+TruZw7o8/5ktXjO+Gfhuoh+U
- TLSH T1C8C2C0C33302490CC5225F39B4E8EAE1F8E4AC37A150C25EF15CB5DDBB9BE1553459AA
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiarus.chm
- SHA256 7526376dcc365dd1e0f23ed1ea915e599005d153c64a6527edfb2b292ef1dae4
- MD5 b414edc29df6de61f3fce33b29a91b35
- SHA1 b1953e743ee41ffe255de89e4c4f6759f90ff52b
- SHA512 f40702046eedb885f13367362fcce7cb497df36cb349a6f710753977351b4a5c5e84e4753f8a23880f0b42f336bbe85a17b2e5d6b281fd66a976aaa934ddb737
- SSDEEP 384:jNLm8bF3tITeSD4equLmug7zMCddq6i9A6WdeOraN8qvo/xU:jNL33t0DDxmusACHXi9A6WwOr/7pU
- TLSH T186C2D1F036D6156FD2B49A71F99A24C0805B3E659862B2CF51548F2CE6F80164FF4F92
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiaspa.chm
- SHA256 e74077db52d39759c80ccbe7c79714c045e91d43917c2493259f1bbe98d729a3
- MD5 d7eb8554de9524e080fd9228e25e71c5
- SHA1 21a0cdd2da963b64ed2461a35db5018bc5035c69
- SHA512 65a768d19e3be7856ccf05d5e4da25151e1085856abd789643525c32421de2e218c9c19cc0524a8ade5458e9e6b241dc36700a29567df2d5b20386b2ede79f83
- SSDEEP 384:Qtoi5o60JWWIBPxzffOOvCQ+23H6BJOra5p90LlnuOUh+g:QtoewJWdvTfOe+wH6Ia8ndUf
- TLSH T152B2D0B823A1454CEC5046711BA886D7A4637E86A45CE196928CF33C1AB8F8F4384E72
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiaswe.chm
- SHA256 42f60e3ac4651d996cdfa14b2c869b41595ece1bf04ee47ba684c0fbb0846531
- MD5 b1acf7038845805fcf0d504d851429e9
- SHA1 6f48f1449b28a939e7be8dfc697b34da2a570c56
- SHA512 6b6831e801a57d008edfdf7f97ff87f589009bc92cd3a891e7f8f65c130d3b9f076e46b8c1c4f5c303bfab82b411931708ab8d33982ffcf18e723ce4812bbd14
- SSDEEP 384:UOOgdCUxJuREySovd1MoQbCJ/Ag6Ru7jMrlxxaUz4W:UOOgdCUxJlb4MoPJ6Rvrlxx7z4W
- TLSH T10EB2C0BCF7A0126DE1866E3A73E1E0D7B486BC43D060D947755A17232FF498E239A022
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdllreg.exe
- IMPHASH 7808fd325bf451cda117496280bd1fac
- SHA256 81aefdb0459c6cc4c26ff98a3ee8e3a858aaa9eb9f53026d3f8c269a324e6fcf
- MD5 5081f2fd42a97c2d8885f1de109f7b39
- SHA1 e5531a7eb27e14f92ac7c4c6686ba90b1bba7b9d
- SHA512 77a4cef3e8727d6b074f97d7d2338aedb5009119d326ee3c314bd8191cb9bbca1c8b44de1dede5df1366ca39670234de3e6ba35120de19a0c27b1d1b3e497b0b
- SSDEEP 768:I42N/LzVSpZQ5zfovWKIvT5dI33zDIP75z0DiCbBkHunij6Ja6OVC/:J2N/LzVSpoZKITazG75QDiCbBkHuFJjv
- TLSH T192137D027360C17FD0C567780576CB25ABB6F4101AB1578F5B548A8EAFA37D0AF39392
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
FindClose
FindFirstFileA
lstrcpyA
lstrlenA
GetPrivateProfileSectionA
FreeLibrary
GetProcAddress
LoadLibraryExA
GetPrivateProfileStringA
GetSystemDirectoryA
lstrcmpiA
CreateMutexA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetVersionExA
GetWindowsDirectoryA
OutputDebugStringA
lstrcmpA
lstrcpynA
VirtualQuery
GetSystemInfo
VirtualProtect
ReadFile
GetProcessHeap
SetEndOfFile
RtlUnwind
GetCommandLineA
GetStartupInfoA
GetLocalTime
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsFree
SetLastError
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
Sleep
InitializeCriticalSection
SetStdHandle
FlushFileBuffers
CreateFileA
SetFilePointer
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
advapi32
RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
setupapi
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextA
SetupFindFirstLineA
SetupOpenInfFileA
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
ole32
CoInitialize
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=64, version=9210,
count=2, id=25, version=9412,
count=9, id=25, version=9210,
count=108, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=99, id=28, version=9178,
count=4, id=29, version=9178,
count=1, id=61, version=9210,
dxdllreg.inf
- SHA256 a424ebc884e0c9bb227c1e58d205b1aaf4d5495a5f50fc38e7e6c323e619fa6c
- MD5 22e034aff6264e9ae75d57caac38a2c7
- SHA1 7a89a59e0b629d1f08c8ca448c39f17003664bab
- SHA512 5fe42a0c0b339e6d9dd4923e439042715ebad9ce5b77cb0f6a9e203be6857998106145ebe107ffea0d4ebb35dd6b735ad657cdd6cb74e6a525bce2f5a019b78f
- TLSH T12451AA9EE5B2402658D7B04DB810ACCF641224063B5EB7D9B39937D43AB394FACA403E
- MD5 SHA1 SHA512 TLSH
dxmigr.dll
- SHA256 493aa1fd4f2b508cfef2e465312d49a6f9282bdfb07c576d11f9cf29dd6f08ad
- MD5 5856b96199c3db16faed3fa5f00fddd6
- SHA1 05f9ff2ebc0993b374bd24bac8d5ca85de64e4ea
- SHA512 228f4c26221605cc41fbf9133529f5f23cf41e709cd290f9194dcd1cce71b3598f460655ace803f5750169ca144ac33de42fdf9078a7d83c1e5eb06e018d3c6c
- SSDEEP 384:4tL3+Z3SYIU85wkVpmQnK16tioa+z/kAuJQ:E383SxVorUsg7uJ
- TLSH T1E7625B8B27108AEFE21CBEB00F47C55BA9DFCD0A15B04B1358C1C55FD65D16B912ABB2
- MD5 SHA1 SHA512 SSDEEP TLSH
dxtmsft.dll
- IMPHASH c9cd26ae7abe9c1c280dbbd1211522a6
- SHA256 9216b072c445c33b029f5c458277f3ba55e917ece96b098d17cf73590dcfa429
- MD5 5226f5200dcf5ca0d5be361b19cbd272
- SHA1 fd4f06ee86df3d62c597f53626b9c52337048efd
- SHA512 0d35f4c748571a2a9e6d88e074b4df2f4d983effc3f818cca0088d9a6b5762fd4e34113bac8440c322eda4134691dfe42779eb85a2a698eea9d3d55440ec5817
- SSDEEP 6144:sd8rKvpaLGrBdIXiYjSy9YZ+sNrRFaaP5zkMMssVfi7kimUmb9:48QIy1y9YZ+mnLT7kBb
- TLSH T12C747D8373C580F4E59716B249662FBB672DAB014C38D1A67B99C30F2FF2795A10DB06
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
164274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_purecall
_onexit
__dllonexit
_adjust_fdiv
_initterm
labs
sqrt
_wcsicmp
wcslen
strcmp
_controlfp
malloc
pow
_ftol
sin
cos
free
??2@YAPAXI@Z
realloc
??3@YAXPAX@Z
memcpy
memcmp
_clearfp
_CIasin
_CIpow
_CIacos
wcscmp
memmove
kernel32
LoadResource
FindResourceA
SizeofResource
FreeLibrary
LoadLibraryExA
GetLastError
CloseHandle
GetVersion
GetSystemInfo
GetProcessHeap
GlobalFree
GlobalHandle
GlobalSize
GlobalAlloc
IsBadWritePtr
IsBadCodePtr
lstrcatA
IsBadReadPtr
GetModuleFileNameA
lstrcpyA
HeapDestroy
lstrlenA
DisableThreadLibraryCalls
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenW
lstrcmpiA
CreateEventA
lstrcpynA
user32
CharNextA
GetSystemMetrics
GetAsyncKeyState
GetSysColor
GetDC
ReleaseDC
IntersectRect
ole32
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
VariantChangeType
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
LoadTypeLi
VarI4FromStr
SysStringByteLen
SysAllocString
SafeArrayAccessData
SafeArrayCreate
UnRegisterTypeLi
VariantCopyInd
VariantClear
VariantInit
SafeArrayUnaccessData
advapi32
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
gdi32
GetDeviceCaps
dxtrans
?DXDitherArray@@YGXPBUDXDITHERDESC@@@Z
?DXOverArrayMMX@@YGXPAVDXPMSAMPLE@@PBV1@K@Z
?DXOverArray@@YGXPAVDXPMSAMPLE@@PBV1@K@Z
shell32
ShellExecuteA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
213KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=227, id=1, productName=Unmarked objects,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=14, version=7299,
count=17, id=37, version=8755,
count=1, id=6, version=2080,
count=12, id=28, version=8830,
count=89, id=29, version=8830,
dxtrans.dll
- IMPHASH d82b48d8792288ce391cff15677c8590
- SHA256 8f65be7d10279ca7ddb91f7c4cd08312868d9e6d40b72e3abdb7c30da4ffd0dc
- MD5 fcd4a19736956f437283f2835c1c94c1
- SHA1 3aca57c15e924fa8caaf2f591e02b6f530fa048e
- SHA512 96b09e13d09f66d609b940f13ae3d4469537f86965a1198b5ec8290f033b02629f727849f9b56931bcd7d9b2b18691cd1a3abca2e03ab64e77b9f9341ecc16fb
- SSDEEP 3072:7QYrBVQ75R7hvTyN5Qa4bOMjdjh2fbjFTyz6zWmgMkzDiZw276GTwIY:7QYrw5XyTQDbO986zWmZkzDiewL
- TLSH T11314AF12B3E390F0D4872679841A7737D13D9F0A872FD7936BA8DD922E21621D07DE1A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
141993
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetLastError
TlsGetValue
TlsFree
TlsAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetStdHandle
GetEnvironmentStrings
GetEnvironmentVariableA
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapSize
ExitProcess
TerminateProcess
CreateThread
GetEnvironmentStringsW
ExitThread
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
TlsSetValue
RtlUnwind
RaiseException
HeapAlloc
GetProcAddress
lstrcmpiA
UnhandledExceptionFilter
HeapFree
InterlockedIncrement
DisableThreadLibraryCalls
HeapReAlloc
GetCurrentDirectoryA
GetVersion
GetCommandLineA
ResetEvent
GetSystemInfo
CreateIoCompletionPort
QueueUserAPC
GetQueuedCompletionStatus
SetEvent
GetCPInfo
GetVersionExA
PostQueuedCompletionStatus
CreateSemaphoreA
WaitForMultipleObjects
GetACP
GetOEMCP
LoadLibraryA
InterlockedDecrement
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
GetCurrentThreadId
GetLastError
CloseHandle
GetCurrentProcess
WaitForSingleObject
HeapDestroy
lstrcpyA
lstrcatA
GetModuleFileNameA
IsBadReadPtr
lstrlenW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleA
IsBadWritePtr
FreeLibrary
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
lstrcpynA
ReleaseSemaphore
CreateEventA
GetCurrentThread
IsBadCodePtr
ole32
CreateBindCtx
CreateFileMoniker
CoCreateFreeThreadedMarshaler
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
oleaut32
SysFreeString
SysAllocString
UnRegisterTypeLi
VarI4FromStr
LoadTypeLi
RegisterTypeLi
user32
GetDesktopWindow
GetDC
ReleaseDC
IntersectRect
LoadStringA
CharNextA
advapi32
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
gdi32
DeleteDC
GetGlyphOutlineA
PolyBezierTo
LineTo
MoveToEx
DeleteObject
BeginPath
GetPaletteEntries
StrokePath
StrokeAndFillPath
FillPath
CreateBrushIndirect
SelectObject
SetPolyFillMode
CreateFontIndirectA
GetObjectA
ExtCreatePen
GetKerningPairsA
GetTextMetricsA
SetMapMode
CreateCompatibleDC
BitBlt
EndPath
ddraw
DirectDrawCreate
?DXConstOverArray@@YGXPAVDXPMSAMPLE@@ABV1@K@Z
?DXConstUnderArray@@YGXPAVDXPMSAMPLE@@ABV1@K@Z
?DXDitherArray@@YGXPBUDXDITHERDESC@@@Z
?DXLinearInterpolateArray@@YGXPBVDXBASESAMPLE@@PAUDXLIMAPINFO@@PAV1@K@Z
?DXOverArray@@YGXPAVDXPMSAMPLE@@PBV1@K@Z
?DXOverArrayMMX@@YGXPAVDXPMSAMPLE@@PBV1@K@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=213, id=1, productName=Unmarked objects,
count=21, id=14, version=7299,
count=3, id=11, version=8397,
count=89, id=10, version=8397,
count=16, id=37, version=8755,
count=1, id=6, version=2080,
count=13, id=28, version=8830,
count=19, id=29, version=8830,
dxver.inf
- SHA256 e89e0edd20bda7b55fa98c0fea8a30bb3d8608f16435f2a82a1045fcb949a950
- MD5 9930742214dec401f16fb01e91fee8c7
- SHA1 7a50594af260080a34934e05ec2f8137ec0d8d3f
- SHA512 0d5e03f5782f14567ca63cc07036a2de594dbf1e7468d9c6ed2af23e2c1a13f03e6a94148ef3cb428be7c5ee9eaeda2adb156c705c3bbffc8e5b29338e1ca88b
- TLSH T141D0A754A855F223E4149332CA070A57FFEDCE53114AF34CBAD439164612584A21E6AA
- MD5 SHA1 SHA512 TLSH
dxw9xbrz.cat
- SHA256 cb670be74338e39801dce7694bcf868c88be92a3993418ef98f7b6090decdd88
- MD5 d9e67d9a2cf9b127bf4b3814a718dd99
- SHA1 6c01a9be84ac05adfb2480f10317a1c761b2b11c
- SHA512 38d5e60e75acf033301643c409994dc5dfd422a5c4c8e00c34a9abbe943d704eacf8dc7196787b3fb14735c818b4f98a6d35ff775a30fc64a0d4478e384e3044
- SSDEEP 384:jK6StMMssh+dmwwrQnjdBQxj5Akmhe1OHrD6f:W6SjsgWcj5AkmC
- TLSH T102130D6715ED02629037C8B09FF5E44FE112FAABA8112DBD325333618543A52F3ADD2E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xchs.cat
- SHA256 3e6807433eca494812110dad6dc802847e214c5c6804757a5caebc6701ab7aaf
- MD5 26234355ffe75157dbe6da09dcec86c7
- SHA1 56273c33a849c13b7014891b82dd90d2b63a70da
- SHA512 65e2647cf9789485f8da9425babd95b4b42c938417bfadd7b626070b46864ea3a1ae9f7309a151eae6ca3171d18c813ab418b914772454c1e57a639cd433f232
- SSDEEP 384:WK6StMMssh+dmwwrXnjdBQxj55kmhe1OHrDQ:b6SjsgBcj55kmy
- TLSH T1D1130D6715ED0262D037C8B09FF5E49FE112FAABA8112D7D325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xcht.cat
- SHA256 e96ec8088d3819c0b91c9454cb8410ec4323bf03c45f60474a5b548a9f60df3a
- MD5 abf84cd3e2322d1569a5afc577246b31
- SHA1 e1053b162f759c7e7b406b43c4427632d8f0da63
- SHA512 2f43879403e1d313d44911861ca6833723ccd081b348ec9041145c110ec724ccddb29553f78467155a4609fdc1ceaaca731f9f505e076b9d590040cc57cb73aa
- SSDEEP 384:KqK6StMMssh+dmwwrXnjdBQxj5AImhe1OHrD2h:K/6SjsgBcj5AImg
- TLSH T1EC130D6715ED0262D037C8B09FF5E45FE112FAABA8112DBD325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xcze.cat
- SHA256 0cbb7bfbb78444832ac21b5333506e115986961dc880ccae6c4be13df0b983c9
- MD5 08755d16da879194a2154e17a7e940e5
- SHA1 fcbdd4f4e0fd508f67ea830dc1d34201f4d89e20
- SHA512 f998373bcba6b7a86e9abecbf728888d6875964467f5f3e6e44fd4b76d43bc10edd3138fa4105fe7b836473d0f4d0119ab80dd049b22d26c3693570528c7ad2f
- SSDEEP 384:kK6StMMCsh+dmwwrXnjdBQxj5Akmhe1OHrDCX82+:V6SjCgBcj5Akm8+
- TLSH T1FE130D6715ED0262D037C8B09FF9E45FE112FAABA8112D7D325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xdut.cat
- SHA256 94780125dba0665f8c02df035d93d1cc702bf15924d36725a92c761d867bd915
- MD5 e46a603851abc19d4aa2494ce8d27ca6
- SHA1 885f762dd8bb3e0ea1fa615e483a679ad379030b
- SHA512 831fe0585af3ee9d7d533240cf0ba9a7d76a75c64b14e838f401508cea590bf647039eb48e7a8243696a991096af595ad47fcb72bd93714328613b0eb6995db7
- SSDEEP 384:hK6StMMssh+dmwwrXnjdBFxj5Akmhe1OHrDW:I6SjsgBPj5AkmY
- TLSH T147130D6715ED02629037C8B09FF5E45FE112FEABA8112DBD325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xfrn.cat
- SHA256 f2d0835b590147d3c45f16c83a4421bc8b7d82e278eeb18e077948fe281de186
- MD5 f80c9a5b529507b0c47e85a883f6878f
- SHA1 efd2031905e9db4a18e7092ca50fa591f89647e5
- SHA512 84c0ed63b9dc8df96d1def65edabc1b8e353b40b7a7f3cecb004e7c1cd7868b217a24e817afaec6d942e130a6859a06fcd4f2ed41aa5643e602a3caec30e6ece
- SSDEEP 384:hK6StMMssh+dmww8XnjdBQxj5Akmhe1OHrDhR:I6Sjsg8cj5AkmV
- TLSH T12A130D6715ED0262D037C8B09FF5E45FE112FAABA8112DBD325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xger.cat
- SHA256 2331a6d677c934e0b67b0cbd733b780e5686f0faa7602415a05816692f55bcbb
- MD5 a0eaf912b5a7c76a1782f17ea1147258
- SHA1 591fcaa360a250ed7f03955d98fc942034c9d5ad
- SHA512 7ad3721d08c807d923ca01875a1ba0c7222279dd8bdd8f3e50cacd0e8834741525f9f6cd2a71cdba7ad417fae704c35241a630665ef58fd0f39147c1f0449f88
- SSDEEP 384:NK6StMMssh+dmwwrXzjdBQxj5Akmhe1OHrDyCrqn:U6SjsgB4j5AkmRq
- TLSH T101130D6715ED02629037C8B09FF5E45FE112FEABA8112DBD325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xitn.cat
- SHA256 1d9f5b8a625f8b9b6cf1b7940c14032c253ac2a7350241ce48f4476de0044218
- MD5 9d29b172b0beca576856abf3c74b4a2c
- SHA1 5a24a90c62801a42390a48c9e1afe4119384fff1
- SHA512 6b5a55b1f1373ecdc79525ddae9abd04ac5ef9034951dde30cd2308bb5358c698e3f92ce0888302b9488c496dcae213c09b8c9fa6603135a23454a36efb2a651
- SSDEEP 384:+K6StMMssh+dmwwrMnjdBQxj5Akmhe1OHrDEgkN:z6Sjsg2cj5AkmKN
- TLSH T131130D6715ED0262D037C8B09FF9E45FE112FAABA8112D7D325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xjpn.cat
- SHA256 c79bf3529bc79b7da38bed8b15c44cae985e9f42d8a7e496194ea1a1f5a0f435
- MD5 a2a780b6004628f50e6da87c841c8fb5
- SHA1 dfc5cfb1fa6c6c1a460836c2e9e3ef5ff2cf925b
- SHA512 469436c08f882fd8e20cd56c19dd387afe34b14c4751da1f848727ab14611dbefa1d01f4d5817307f56a640a9b0f86b81fd3474637ebcb0bbb58536f981e60a1
- SSDEEP 384:rK6StMM0sh+dmwwrXnjdBQxj5Akmhe1OHrDPgg:u6Sj0gBcj5Akmp
- TLSH T117130D6715ED02629037C8B09FF5E45FE112FEABA8112D7D325333618543A52F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xkor.cat
- SHA256 a8e77bb8e165f7adc5fec30088ba6555a75c9764e617d4a79b11da0d3aec8ca3
- MD5 bb6727f5edbd83817aff8f13a5392f23
- SHA1 14893cb8a600e81dd22af67ef879f9a52acbc17e
- SHA512 039bf51ff9aedb434eb6af69a54220fb054e6e702ddf95542180199f7fe91dc466aa6ca8daa29409aec359eb8b0c48799ae83601d427b7fd92d2d64aadd0ae5d
- SSDEEP 384:iK6StMMssh+dmwwrXejdBQxj5Akmhe1OHrDdN:H6SjsgBNj5Akmh
- TLSH T137130D6715ED0262D037C8B09FF5E45FE112FAABA8112D7D325333618543A12F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xmig.inf
- SHA256 7646e6ca3eb2359367bee35bb20792e67d5fab09ea5053add41b9402f28bcd5d
- MD5 6669cd12a456fb6e1591c4728e5e3ab3
- SHA1 91bcd3fc170c63b569d3dea180ac45b7f262ee66
- SHA512 d9f440b36b2087db1baf79f57e7a4d4f4fb922021b86b2833353c3fb5edba652c411ba929adecdc6434a044153a543d646f6d3c9a8c308ba724817e8c67b158d
- TLSH T1B37101DDCE92486331AA7DC105480ECFE96B68547B3A1B6D54AF68C9802753F87A0939
- MD5 SHA1 SHA512 TLSH
dxw9xpol.cat
- SHA256 39e834a14cf3b90d115b2975cfe6711675d164374d025f6a4e6430ed83bbf28f
- MD5 19baab004f2ffef5637092ea8245cd63
- SHA1 c0ae8e2dfd574def657580b59f3f036404100a78
- SHA512 61bfa30578041fcdabb92aeccf3492fe85e38950eef6a579015c81cef65b4de4c5e0bf43b15da8e0faef838573acc45bae9b2f2394fa6d8e6a88de8597533efa
- SSDEEP 384:hK6StMMssh+d7wwrXnjdBQxj5Akmhe1OHrDCbc:I6SjsNBcj5Akm4c
- TLSH T124130E6715ED0262D037C8B09FF5E49FE112FAABA8112D7D325333618543A12F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xrus.cat
- SHA256 70b1831f7418f3be3109d9fd4c176f4d067dd18aa96b39c0f728d6bf1480a429
- MD5 2c9a3e62df85bfd6049afff313b0169f
- SHA1 98aaa4e00a158700ddc1ff1767417293a2126ced
- SHA512 9fe8f3cdf52ca45a1b951e0b95e4a4ae52fc96f8612e08015770a922f4701aeec5c57426b19c7893ff1c90dcaf2fc8c40521d353570b4d81281f9bb5d1a54caa
- SSDEEP 384:zK6StMMssh+dmwwrXnjdBQ2Tj5Akmhe1OHrDmt:m6SjsgBhj5Akmot
- TLSH T1A2130D6715ED02629037C8B09FF9E45FE112FEABA8112D7D325333618543A12F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xspa.cat
- SHA256 8d5d62923411c8df3eb99246407b0be366a6e1b49df6edaee1e4475db89100e7
- MD5 adc54e6add6a432579766f8a2b5d0e2c
- SHA1 e2688d33bbdd8f6c3a5878a2f08bf7f7542bd6bc
- SHA512 2523e736ebf2711c83da3aef1e2402b215b66054a22fc4a4bde9c4e81fec13160af10bdb9deb0ec6394fb92ba009e259643bf7d68711bf37f8a00894c2f60933
- SSDEEP 384:5K6StMMWsh+dmwwrXnjdBQxj5Akmhe1OHrDO:Q6SjWgBcj5Akmk
- TLSH T15D130E6715ED0262D037C8B09FF9E45FE112FAABA8112DBD325333618543652F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
dxw9xswe.cat
- SHA256 598f18168a4020d741da27362ad51cbf8c6c2c50ccb66e1aebfac79a2bcfe61a
- MD5 5a50af15c08c1588c6885c9b5a3b95cf
- SHA1 0733272abd71321f2f2af9e6f7e48ad566959634
- SHA512 3ad1a445615d0d42a6ce4f4033ec6c9350fa8646934c51139fcec89e751496ea58077c7f9ed01430b285f118cac3e2af0e001e94781a8a96fddbfa3a976f018d
- SSDEEP 384:ZK6StMMssh+dmwwrXnh9dBQxj5Akmhe1OHrDg:w6SjsgBhij5Akmi
- TLSH T1CE130D6715ED0262D037C8B09FF5E45FE112FAABA8112DBD325333618583652F3AD92E
- MD5 SHA1 SHA512 SSDEEP TLSH
encapi.dll
- IMPHASH 7b51e9d3677f401a528065d95fdb10ee
- SHA256 7bcad0821a0a296bf3fb1003b366f5b7f1120040cc87d6469a134f3896ed413d
- MD5 932f661280ad438b1afa6623754edf0d
- SHA1 6480a8f64fe91041fdb40a48827cd4f2ff7b80b4
- SHA512 a96cceb542b34d8ec2a76509659749bd42a77f3750ec2cefea8a955175b23cd56ff42fae296c74c5a42cf9d6955259bd67d303b9fc5358ff77b1b6d65f3d645d
- SSDEEP 384:YZEXbgyptTRxHVf7i1wnrCggwx4MkdquWVZWi:YZqbgyppRFd7i+n1gUkAln
- TLSH T1CC822A433FE19837D2A243B20EB03A1563FEEA294A75CE5587541D4A2DFD9C382B9713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
CreateEventA
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
DeviceIoControl
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetOverlappedResult
CloseHandle
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetProcAddress
InitializeCriticalSection
CreateThread
InterlockedExchange
MultiByteToWideChar
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExA
msvcrt
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
advapi32
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyA
user32
wsprintfA
ole32
StringFromGUID2
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
IIDFromString
CoFreeUnusedLibraries
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
SysStringByteLen
SysStringLen
SysAllocString
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
264B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=76, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
gameenum.sys
- IMPHASH 6ec049c91ee0bab4ea8f0a7d19b52943
- SHA256 4395af0b45946afc70730797e01dee4c5100aa9f0f89e1ce37b297f2a4996f40
- MD5 cd12549b7c6399c2f4df0d12b0d98547
- SHA1 7b8220d0e5eafaaaef19586bf1cd68af0f0f5b65
- SHA512 7d20e22b824334a84d959befc808c2253eb0ee0490a194a55226588dec45da843880b911f37be899b181bf5fd9f43dfeb62c2cfd18645e57d2f0ae70bb697914
- SSDEEP 192:vcY0P/A+everAWaqvOFqq9iVbO9FSR+0c3eEgeEHWWSzWk:Zj0AWa0qgN2sR8JgeE2WSzW
- TLSH T10E22284327F65476E9A307F248061B596177B7348B30D77B06BC881E2A3EE21B81A727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
InterlockedDecrement
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
IoDeleteDevice
KeSetEvent
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoCreateDevice
ExFreePool
ObfReferenceObject
ExAllocatePoolWithTag
MmUnmapIoSpace
IoSetDeviceInterfaceState
IofCallDriver
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
IoRegisterDeviceInterface
IofCompleteRequest
READ_REGISTER_UCHAR
WRITE_REGISTER_UCHAR
MmMapIoSpace
ObfDereferenceObject
swprintf
wcslen
RtlInitUnicodeString
RtlWriteRegistryValue
ZwQueryValueKey
ZwClose
ZwCreateKey
IoOpenDeviceInterfaceRegistryKey
IoInvalidateDeviceRelations
PoCallDriver
PoStartNextPowerIrp
PoSetPowerState
PoRequestPowerIrp
IoDetachDevice
hal
WRITE_PORT_UCHAR
READ_PORT_UCHAR
ExAcquireFastMutex
ExReleaseFastMutex
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
960B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
416B
Virtual Size
414B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=19, version=8152,
count=1, id=6, version=2051,
count=2, productName=Unmarked objects (old),
gcdef.dll
- IMPHASH 658a2c8d831730c6656a96194ef0fa1d
- SHA256 c418adc86fbb7495694b1812af031cac82977ca2c19665cff336bce66070db60
- MD5 07c6d6b3e0ee85c8fa2e2b379a897dea
- SHA1 2ff23ba31a8bc03dbbb87abc08c8198c38666062
- SHA512 d20840582351b01637b37c8ef105c8a020d56cb85e0a8baa04c5d7d72cd753df58004f36733635bae1d3b7e64f46624474cc23f4068ee59de9fb9eae9446b5b3
- SSDEEP 3072:2EGK94sk0w6CVnhg5WqlxtVmSPB9SDxhcftc8NTfzo7V6SGswoB78POmHOoz/YHb:tGe4t6CA/nB0uqWY
- TLSH T180A42011A3F8D229F1F32B30997647A54F3ABC51AE39820E67443A5E6D70B44DE61B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
38510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
BringWindowToTop
IsIconic
UnpackDDElParam
ReuseDDElParam
SetMenu
LoadMenuA
ReleaseCapture
TranslateAcceleratorA
LoadAcceleratorsA
SetRectEmpty
FindWindowA
DestroyMenu
GetSysColorBrush
PostQuitMessage
GrayStringA
DrawTextA
TabbedTextOutA
SetCursor
ShowOwnedPopups
GetDesktopWindow
ClientToScreen
PtInRect
GetClassNameA
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
SystemParametersInfoA
MapWindowPoints
PeekMessageA
DispatchMessageA
GetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
IsWindowVisible
ScreenToClient
ScrollWindow
SetScrollInfo
ShowScrollBar
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetCapture
GetClassInfoA
RegisterClassA
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetMenu
GetWindowTextA
GetDlgCtrlID
GetKeyState
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
SetPropA
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetWindow
GetWindowRect
SetWindowPos
RegisterWindowMessageA
GetNextDlgTabItem
GetActiveWindow
SetActiveWindow
IsWindow
GetSystemMetrics
DestroyWindow
IsWindowEnabled
UnhookWindowsHookEx
SendDlgItemMessageA
IsDlgButtonChecked
CheckDlgButton
LoadCursorA
RegisterClassExA
DefWindowProcA
BeginPaint
EndPaint
LoadBitmapA
GetSysColor
GetDC
GetClientRect
FillRect
ReleaseDC
LoadIconA
DestroyIcon
MessageBoxA
DialogBoxParamA
GetParent
GetWindowLongA
PostMessageA
KillTimer
EndDialog
WinHelpA
SetWindowLongA
SetTimer
LoadStringA
wsprintfA
ShowWindow
EnableWindow
SetFocus
SetWindowTextA
GetDlgItem
UpdateWindow
InvalidateRect
SendMessageA
gdi32
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
RestoreDC
SaveDC
GetDeviceCaps
CreateBitmap
SetBkColor
SetTextColor
SetWindowExtEx
SetViewportExtEx
SetViewportOrgEx
Ellipse
CreateSolidBrush
PaintRgn
GetRgnBox
CreatePolygonRgn
CreateCompatibleDC
GetMapMode
SetMapMode
GetObjectA
DPtoLP
BitBlt
DeleteDC
CreatePen
GetStockObject
SelectObject
MoveToEx
LineTo
DeleteObject
kernel32
WriteFile
GetVersionExA
GetProcessVersion
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalFlags
MulDiv
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalAlloc
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
lstrcpynA
GetLastError
GetModuleFileNameA
GlobalAddAtomA
GlobalGetAtomNameA
GetCommandLineA
RtlUnwind
HeapAlloc
HeapFree
RaiseException
HeapSize
HeapReAlloc
ExitProcess
GetModuleHandleA
GetACP
GetOEMCP
GetCPInfo
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GlobalUnlock
GetStringTypeA
GetStringTypeW
VirtualProtect
GetSystemInfo
VirtualQuery
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoA
GlobalLock
GetCurrentThreadId
lstrcatA
GetVersion
lstrlenA
lstrcpyA
FormatMessageA
OutputDebugStringA
InterlockedDecrement
InterlockedIncrement
LocalAlloc
LocalFree
lstrcmpiA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
SetLastError
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteValueA
comctl32
ord17
ImageList_Destroy
winmm
joyGetPosEx
joyGetDevCapsA
joyGetNumDevs
joyConfigChanged
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
shell32
DragFinish
DragQueryFileA
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
348KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=25, version=9210,
count=410, id=1, productName=Unmarked objects,
count=25, id=64, version=9210,
count=96, id=28, version=9178,
count=45, productName=Unmarked objects (old),
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
gchand.dll
- IMPHASH b94d3cce6eac29903c18cbe135eaf1e2
- SHA256 c0a9a90dc70841cf7099d89390d8033a1092366c8aa89e6ebefadc011032a898
- MD5 2c847e43683c47ad2cf097c0ee15a321
- SHA1 6057b11a0fee8ee364abff562bafcbd344bd93d1
- SHA512 951ff18046f953d16d233da1e2c46d03c55c04ce4a8a5b6be0bceabddeb2f77730c8099e24411d66780860539840b19bae9cafa0034356f993e8bd688c2c9aeb
- SSDEEP 96:8xhMMxphF4i8ENpAYzuF/TjlgoPKCkDMRL3CJ9MLPW7bJ+lWWyx:GMS5/N3zuF/KbXDMRr3WHslWW
- TLSH T13CD1C74373F4567EF36B5A3426A616079276B820CBB8E24F570507296E3B900D731B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mfc42
ord823
ord1574
ord825
msvcrt
?terminate@@YAXXZ
??1type_info@@UAE@XZ
malloc
wcslen
free
_except_handler3
ole32
CoGetClassObject
kernel32
InterlockedDecrement
lstrlenW
InterlockedIncrement
user32
ExitWindowsEx
comctl32
PropertySheetA
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=28, version=9178,
count=2, id=64, version=9210,
count=10, id=25, version=9210,
count=3, id=4, version=8450,
count=15, id=1, productName=Unmarked objects,
count=1, id=11, version=8012,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=3, id=29, version=9178,
count=1, id=61, version=9210,
gm16.dls
- SHA256 3229b09b9d7d9f3f4793b0d9b34fe6abc75cfa4a2503c0c90f43ff651ba7f2c0
- MD5 7f29903cb8f5590d52db0c9f97049a25
- SHA1 57145f5f449624a10a357d64c982c6eaa7ebc1d9
- SHA512 98f3e9de9ac17d8397e59a37accf102f2e4e76ddd1bab0c0452518098c2fd91e4b8e4a956cab2e4134a0e4a80f1ac1c8475a4fddad2fb8371102cbc0b1a74fce
- SSDEEP 49152:kl98eiQV5ekZQQNgW3F+IEANa58DrQaPdqsL3/tdEguV+kGgnq1q:kfvTEc7SrIEPCIsL3Fdt3tWH
- TLSH T17BF5F122F7930E62E86D9137D5CD97C22132F8987BC2C70776B69E54BC8A7604E43939
- MD5 SHA1 SHA512 SSDEEP TLSH
gmreadme.txt
- SHA256 ca6ce6a87482434d985f1b375a1cc2c3ec95329a96bef508b4d9d1b8fa906d0d
- MD5 d5ed4c6de9dfa4bfe85384efa0c25392
- SHA1 e62fa8f703c3e21714436c61e9e21337862f17a3
- SHA512 20ca63a489d3e7abe9ce6c1b4e5cad6bc7a06feedc91a92e6339158065d1ec5d68772bc244562f20334e63db6ca9b50000225dd32a76417193f8b70e5528fd3b
- TLSH T1CEF05CAF8FDF805E15B0C9F6558C8C08E22E575214668B18AC59D0480E4A21557DF175
- MD5 SHA1 SHA512 TLSH
hidgame.sys
- IMPHASH 94c56b96139675e3e5ea28d6ec4d6e0e
- SHA256 4378ead90ac12f4a910714c74bbf6a2fe0ab7cfa394c8c4a97d7cdcff1edc205
- MD5 253c6f5fb9c4009e56ee54f80a501b1b
- SHA1 406444f8406a70e2e9b61a2c5012a0a0ae618c4a
- SHA512 cfc4b21e5ec93d6ec6b93b27226aa3184d1e4324f138e28f567f40d3f2b5e9663aa2fc92d0eb0cea655aefa3e4187489c076461c8c7d2242a6229289752bf47f
- SSDEEP 192:yK7OX3A7n28/lQ6HM4Ee4YucbTqrmBb0W3oiwWv:3uYbHM4EBQqrm+W3oiwWv
- TLSH T17C021B8343E94BFAE8EB1B72B8AA1F67406F7910EB34C16E44B4401536BA741B932F51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6560
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
hal
KeQueryPerformanceCounter
KfAcquireSpinLock
ExReleaseFastMutex
ExAcquireFastMutex
KfReleaseSpinLock
ntoskrnl.exe
KeWaitForSingleObject
KeInitializeSpinLock
PoCallDriver
PoStartNextPowerIrp
InterlockedIncrement
InterlockedDecrement
KeTickCount
KeSetEvent
IofCompleteRequest
KeInitializeEvent
KeQueryTimeIncrement
IofCallDriver
hidclass.sys
HidRegisterMinidriver
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
96B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
832B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
960B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=1, productName=Unmarked objects,
count=24, id=19, version=8152,
count=1, id=6, version=2051,
count=9, productName=Unmarked objects (old),
joy.cpl
- IMPHASH c9a6a8528ed9c23f72acaa44d74df204
- SHA256 816810b8116386c8805f45ee5404d333f5825db7af6dcd99aa224da5e2fd7a35
- MD5 ae196c1a5407bdd44bbe206b299b3c3c
- SHA1 b8e2e69b8e9a859d090155c15d480a4e99b82b75
- SHA512 b5f736ac69369b63c03e60ff233dd2babb6d95088c091d8f1a8ac1fe0cc3e167b2dd0ba52efd84cdc07e3042c3ad85b0d48c65cb414974273f9b1e60f439c6e2
- SSDEEP 3072:SBZnouHavSFnzM56bqgjIZcXV5ihxzkYNshcyRTsWUxXu6fYEXj9SRG+ViGsCRe/:DKFnw505ihprNsBsTxExaU5VRvCiGz
- TLSH T12A943D21B3F98219F1F3AB34AEB917915E7ABC52AE35C60E5740624E1C70E54DE24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
55225
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ole32
CoCreateInstance
CoInitialize
CoGetClassObject
CoFreeUnusedLibraries
CoUninitialize
advapi32
RegEnumKeyExA
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExA
RegCreateKeyExA
dinput
DirectInputCreateA
kernel32
GetCommandLineA
HeapFree
RtlUnwind
HeapAlloc
RaiseException
HeapSize
HeapReAlloc
ExitProcess
GetModuleHandleA
GlobalGetAtomNameA
GetOEMCP
GetCPInfo
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
VirtualProtect
GetSystemInfo
VirtualQuery
GetLocaleInfoA
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GlobalAddAtomA
GetModuleFileNameA
FlushFileBuffers
SetFilePointer
WriteFile
lstrcpyA
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
Sleep
GlobalAlloc
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
GlobalFlags
lstrcmpA
lstrcmpiA
lstrcpynA
SetLastError
GlobalFree
GlobalLock
GlobalUnlock
MulDiv
lstrcatA
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
CreateMutexA
GetLastError
GetVersion
ReleaseMutex
DisableThreadLibraryCalls
CreateProcessA
CloseHandle
lstrlenA
lstrlenW
GetACP
user32
GetTopWindow
SetScrollPos
GetScrollPos
SetScrollRange
ShowScrollBar
SetScrollInfo
ScrollWindow
EndDeferWindowPos
CopyRect
BeginDeferWindowPos
DeferWindowPos
EqualRect
AdjustWindowRectEx
SetActiveWindow
DispatchMessageA
PeekMessageA
GetSysColor
SystemParametersInfoA
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
GetClassNameA
PtInRect
GetDesktopWindow
PostQuitMessage
GetSysColorBrush
ShowOwnedPopups
FindWindowA
SetRectEmpty
LoadAcceleratorsA
TranslateAcceleratorA
ReleaseCapture
LoadMenuA
SetMenu
ReuseDDElParam
UnpackDDElParam
IsIconic
BringWindowToTop
IsChild
GetCapture
GetClassInfoA
RegisterClassA
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetMenu
DefWindowProcA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
SetPropA
UnhookWindowsHookEx
GetLastActivePopup
GetForegroundWindow
GetPropA
RemovePropA
GetMessageTime
GetMessagePos
GetWindow
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextA
SetDlgItemTextA
LoadIconA
GetWindowTextA
EnableWindow
GetDC
ScreenToClient
SetForegroundWindow
GetKeyState
MessageBeep
UpdateWindow
RegisterWindowMessageA
KillTimer
SetTimer
IsWindowEnabled
ExitWindowsEx
MapWindowPoints
IsDlgButtonChecked
GetSystemMetrics
GetWindowRect
CreatePopupMenu
AppendMenuA
GetClientRect
ClientToScreen
TrackPopupMenu
DestroyMenu
WinHelpA
GetParent
DialogBoxParamA
IsWindowVisible
DestroyWindow
InvalidateRect
CheckRadioButton
SetWindowPos
GetDlgItemTextA
SetFocus
LoadImageA
EndDialog
DestroyIcon
GetWindowDC
ReleaseDC
GetWindowLongA
SetWindowLongA
RedrawWindow
IsWindow
PostMessageA
SendDlgItemMessageA
GetDlgItem
SendMessageA
LoadCursorA
SetCursor
LoadStringA
wsprintfA
MessageBoxA
CallWindowProcA
GetFocus
gdi32
GetStockObject
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SaveDC
SelectObject
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateBitmap
DeleteDC
GetObjectA
SetBkColor
DeleteObject
RestoreDC
SetTextColor
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
comctl32
ord17
ImageList_Create
ImageList_ReplaceIcon
ImageList_Destroy
CreatePropertySheetPageA
PropertySheetA
shell32
DragFinish
DragQueryFileA
ExtractIconExA
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
CPlApplet
ShowJoyCPL
Name
.text
Size
124KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
276KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=25, version=9210,
count=426, id=1, productName=Unmarked objects,
count=22, id=64, version=9210,
count=48, productName=Unmarked objects (old),
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=127, id=28, version=9178,
count=20, id=29, version=9178,
count=1, id=61, version=9210,
joyhid.vxd
- SHA256 9d0d77fc545ff837f2a568e1a7b2ac42c888e5c25579ee030780f78451b6415b
- MD5 9d9d3ca8ff4718d13b44bc9bc0fc4acd
- SHA1 d047ac766b38e412caea34e25e799b1beb58c55b
- SHA512 3bfbe44472ae5505fc6c2028c4a2dd324b438722972a48e366f7f012e5595a8e7d96443a16de622b5a5d195da64feb9651801151b7653ab8592a5b6840774a0b
- SSDEEP 384:nAT/npxPc6OuHNad0nKAjhX8v6Ye/uxkp+nDA06:ATPpxPXOuHC0nNN8vi/uA+kt
- TLSH T19E422951E9A0C978C4919B7DB24E1B0CD83C956439B34E5BF3A43EC02C305B4EB9B58C
- MD5 SHA1 SHA512 SSDEEP TLSH
joystick.inf
- SHA256 af7ac7057a13906b3d5f76bc6fb62864bf2af17fda12c03206c6d3f48d815ebf
- MD5 c3ddc7d0084996d5e14db8451e875165
- SHA1 7deda8f5abebc439193009129e08373172c235b3
- SHA512 457a2e90754c9bee92f476261603838eadaa0f91c1cef6451f74cda5f6792e1a11d5ee32519cf47045055b2de5955285430c3017dd9fe8957f14e621cdedd2e8
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zaYrjC4Lf:J1KT2Eh2T+KPCuz0zntHl99zCCf
- TLSH T1E391232B978881936B6671D6CCD383A417CD85D4D439F9132A0FA2614F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkbrz.inf
- SHA256 0b39060c6314185bac8cf29fff5296bfb23a7bbdb0d4d34218e7fdf2b45c5c96
- MD5 dca49d7bf62bf295a4538c0aa2e999b1
- SHA1 a2328c9624670abd44078576255fe46d5e905baf
- SHA512 73be0238fbf0b735044f75e2ef838d9a292de58dacf9f0545f1dd4be884ae4d3a9842b46843708e53ad91634d739f7ed3b07e3b68739fa379eb9efa283a8a032
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99ztXGEYb0Cr:J1KT2Eh2T+KPCuz0zntHl99zt2rr
- TLSH T15991212B978881936B6671DBCCD783A417CD85D4D438F9122A0BA2614F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkchs.inf
- SHA256 ce2c1d4df85b6e93c8ea7b01e30bb5632cf3840b552acbe272c7c9d7ff37138d
- MD5 3a70a732e238b81b6b104dd401c79b05
- SHA1 f165e6ac3d377770a71c69e24020ddc684c5aa0b
- SHA512 e250c174f6cca98fb560661ea649bf81614c5b0468f7edab13a8398607d19c4a9ac9055cbf225bb46a2135c4b7b7b35a140744cd2f2b8d992f9568e13c7aa00f
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zibYyOwd:J1KT2Eh2T+KPCuz0zntHl99ziawd
- TLSH T13F91202B978880936B6671DBCCD783A417CD85D4D439A9032A0BA2614F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkcht.inf
- SHA256 0bfb92e53b1ba23c2e099ed6dd6a00109da2be4bbdaa2750e664a49a72df3e4c
- MD5 fc103cec0985fce8dc7d2558f9e3c7e2
- SHA1 fef5b5d770757d0ccaa1fdec810a4669c1d2af37
- SHA512 5eab24cdb7fe841c1275c96e153c5551cd3feed182e5a02f9d82501a6c963f1e1311235735fdb51d6bfab2c97071ba16126450de44244c6d118d830a4ab07f83
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zNYxzmAn:J1KT2Eh2T+KPCuz0zntHl99zC
- TLSH T10891312B978881D36B6671DBCCD743A417CD85D4D439BA022A0BA2614F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkcze.inf
- SHA256 4a48403729ac3861ce8f8f21b39ef69c4aea4715e21035e5b5b51b4c2d4b0184
- MD5 c1dd3f255b8a85544a9bfc3596124f78
- SHA1 328e8e446553366d9f8e4bd9e0d6abbb5d954348
- SHA512 6cd600feea1a32be25141d922d4b70597acbf1a4ca5140079d27755b96c6e2fed83573152108ac664af9f160dbd2ec2b4c19e106ef68d3ac01ce8c6289248cda
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zfYwk6y:J1KT2Eh2T+KPCuz0zntHl99z9y
- TLSH T1A59123279788C0936B6671EBCCD783A417CD85D4D439B9122A0BA3614F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkdut.inf
- SHA256 8d4213360fa40bea3ce8d8183026878a5f9a6fd6847c0f3a5a6caa309ed4d0de
- MD5 50cab236dab17ab83ee772d723d305f5
- SHA1 bd261ea94992d1f1cb6690d42b9b8d4b4de1ba38
- SHA512 f0dc6916c835464bc150f3c666672ef95de52b32ff7f4f92b1853ec8b5f4c3208508f984094c27510994dcdccf87312b66addcbc4aad512ea3bfd59cdf49adec
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99z3YAnKB/:J1KT2Eh2T+KPCuz0zntHl99zmh
- TLSH T19591322B978980936B6671DBCCD383A417CD85D4D439B9032A0BB2614F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkfrn.inf
- SHA256 3aca8fa41d730da5054dd6811b12dd0c246341a2922de47b1f522c2789e23b0a
- MD5 538d929bac0e92a4fe87c1e00f8d0bb6
- SHA1 a020b38b8c0b6b7a9042753706dde3f2dbf2143b
- SHA512 0c5680de0807bce006292aa79cf5be8dc790969087272c6bcf8fb3f5ecde2a6930320682d45a17f05a4835beea9ae075ee5934532c172bfa5ba13bcc85f8ae74
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zuYEED:J1KT2Eh2T+KPCuz0zntHl99zB
- TLSH T1C491332B978881936B6671E7CCD383A417CD85D4D439FA132A0BA2614F8D7DCB6C9C36
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkger.inf
- SHA256 e4055a3ea4d33794cc5f730d0776a497e216743d1dbb3d2f4d675bfa50f36468
- MD5 1a99ac54797010f5418e93775d174e14
- SHA1 75254a95ede5d418bc2038437df73615c87dd571
- SHA512 b2a04bde8ad0ef13ed78618b4cb27ba5551b8a3b98b104a397097d9a259e79406f45dd7ca098554c780adb35f1ba094152cfcfe47e7663133bf5cd19cfea6c73
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zmiYYdjv:J1KT2Eh2T+KPCuz0zntHl99zb
- TLSH T1DD91322B978880936B6671DBCCD783A417CD85D4D439BA032A0BA2614F8D7DCB6C9C36
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkitn.inf
- SHA256 a662029b968f27236253add2b47e7a02489cfadaf661178813b6b57d911e6612
- MD5 7847ecbbf3181542e7fc244bc92b4eaa
- SHA1 a641dbde089ce14bada800ca87dc356ec0e31586
- SHA512 4104f46a260ee519092bc7d607508ef605ec845ea3b3a143c24e8dd229fa9a57e0397dc7aac8061f1b862aeacee1fa29dcd9efa05c8ecea6e1da7b2cd7648692
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zIYCzvS:J1KT2Eh2T+KPCuz0zntHl99zGvS
- TLSH T1C091232B978881936B6771D7CCD743A417CD85D4D439BA032A0BA2614F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkjpn.inf
- SHA256 eaf469ce5522f70a108d15f752998aa48d0cad0431d0559f1c9ae16ccd4f4f92
- MD5 a7e30514a22bdf88158c9feb4d076890
- SHA1 41b5bbccb86a5ba48fecd6f09e5be657e97af6f6
- SHA512 24e291e4aae446b49fef1d71adc04ae23b4299bc33a96ae4af3277d5ea1d40a76635a74a39e867ac3428a608d58c321ca0893a70aca6627f5ca76e5d0ba984ef
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zZzY6s:J1KT2Eh2T+KPCuz0zntHl99zZE
- TLSH T1DD91312B978881D36F6772D7CCC383A417DD85D4D439BA122A0BA2614F4D79CB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkkor.inf
- SHA256 1285a92e4c53cafcb4326abec7ec2822f5bcf5e98970b87a0e5188d54f091146
- MD5 a69ecbc1802761838b24a6196ece492e
- SHA1 ccfee6402eb2c26cc5e1afc018b16530a542b6bb
- SHA512 6783b91db090fedb724c353d32ae1a7912a7048538ea64372234fea84f97778dcbbf8b3aa901ba8c49ff5827dd8aeea7831e51a98b2746ea353be1be4924047a
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zcuSYVf:J1KT2Eh2T+KPCuz0zntHl99zcw
- TLSH T13791222B978880D36B6671D7CCD743A417CD85D4D439FA122A0BA2614F4D7DCB6C9C36
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkpol.inf
- SHA256 97d58ac78cb0d445b4ec5cbc091825637cbd72cf9d328d765e82d51430496a1d
- MD5 6cfc6ff3a448ea52639a3dc53d4929fa
- SHA1 8fda30c3a4e7ddb1574ba0572be01b740972aabb
- SHA512 fa2bb2aa20ec6a76ea563556f658f5fe5cedd2659dd414e65601d471aabc451f17b78ac8df26e926f6b6f7f4a2a301e9dbddd10604e59d6a3cd8b81272753f85
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zC9Yi4:J1KT2Eh2T+KPCuz0zntHl99zCk
- TLSH T1B9912417978881936B6671D7CCD743A417CD85D4D438B9132A0BA2614F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkrus.inf
- SHA256 0ef0de5995e9eda33a7a4f34ecec334baee2fc05b186313cf0775f3ce8eed259
- MD5 d41d9a465db8efccde5ac188a179a3fb
- SHA1 ef69742e8262d29db021de5441cbb036836208a5
- SHA512 c4500eef8a7f9ad3b1bc91e5de959a8454ed2d511bd4cc4a359dc7aebfd4215da3fd93b5b1e780b6f94a6d001625b908c7811710a14203b45960702fc143d669
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99z/TYAkS:J1KT2Eh2T+KPCuz0zntHl99z/Hl
- TLSH T11291221B9788C1936B6A71D7CCD743A417CD85D4D438BA132A0BA2624F8D7DCB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkspa.inf
- SHA256 ee0cdec1d51793134f7b78a2991355c984c348367b285702e2e2da35fd22de27
- MD5 4069deb9ddec09d0d011784294d49655
- SHA1 65e186e4b9cf451b376a12c31d3814332b14a46d
- SHA512 2fd5aab861d8a44ad2e20d5acb71c918517579e87ba2141b949457d1dc7b0d28f82a4e4d7840071f41fe0e291da8797878d4a6d6f65d757c50f5fda4e2978688
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99ztWYs2F:J1KT2Eh2T+KPCuz0zntHl99zth
- TLSH T1AB91225B978880936B6671DBCCD783A417CD85D4D438F9032A0BB2614F8D79CB6C9C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
jystkswe.inf
- SHA256 e935e346be56186caf463d65945f499461179f78e439020739b0003fae11ca78
- MD5 9000d2dff493b883380ce0a9b92c50a0
- SHA1 d03fc0ebf930870d8131a7f69ce9e1fd38bbefc3
- SHA512 a2ae3d0436636546100bde9554d07594d955be9d7d986b99b16fa35dd84e9b58a2143a8113d954cf7bb167cfb9aa371ff1849e2e486f301c894aa805b9ea03f4
- SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zAYFhG:J1KT2Eh2T+KPCuz0zntHl99zVG
- TLSH T16591212B978880D36B6671DBCCD343A417CD85D4D438BA132A0BA6614F8D7DCB6C9C36
- MD5 SHA1 SHA512 SSDEEP TLSH
ks.inf
- SHA256 bbde11d65bd385aa0a428c077ce38977edca633eeebd63e6f940d9e2b78855a1
- MD5 258faf25cb76e6ddeb70749502ebe204
- SHA1 7cc0dbe040988f10e8b4157008acd496917cdd0f
- SHA512 c575d928860b440bd8eb3acc5ecae775d2cac1fd7f70312cd9697242e4e42aa3c2b42c2651336e4023439515807fd6add55e0eaeb1b0116378746559900b94e6
- SSDEEP 384:3AEvRGpiNcJxGMDhX1erbBZjJlUVyl3ntoLswYOV8Wzzpbt3KD/uO5E1BBeyQQ:3ATGMDhX1eJZjMLswJHRGuJP0yF
- TLSH T1EDF2C01E930D8913E20C32C0F7D12DC7709A509ED4E052AE7B26DA9E685ED96451CFBF
- MD5 SHA1 SHA512 SSDEEP TLSH
ks.sys
- IMPHASH 21a59e474a5dc891708dc0b0ea65fe46
- SHA256 e5cb82d9b6ec8abcad0a11e89ed50623d92e82d416292daee47abff4a48ff83e
- MD5 cdf73dddf71475d1c3bc249304751983
- SHA1 577d666c9aacd928c9fea98c0c37a0f7e38901ae
- SHA512 0d8adb6a46060b4aed5f991a33f566b29ca8cf9f67cdd2f1191bbbd5935026e535347dbacfca94b1fbd5e278e65a3b4e78db77eac462f10c7951c8f6251701b3
- SSDEEP 3072:93WrRRvmrpzVP6iJaOsd2JQL+IkRnS/WhHpcb92xwrUl7:RDrpdEiJiIFZJG9KwrU
- TLSH T13AC3AD22B2C1447AD58B12F1CF0F772FB37722231766B6574A60AE912B78910FA2D357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
117543
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ks.pdb
ntoskrnl.exe
KeInitializeEvent
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExDeletePagedLookasideList
ExFreeToPagedLookasideList
ExAllocateFromPagedLookasideList
ExInitializePagedLookasideList
KeInitializeSpinLock
ProbeForRead
IofCallDriver
IoBuildSynchronousFsdRequest
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
RtlFreeUnicodeString
wcscat
wcscpy
RtlStringFromGUID
IoGetRelatedDeviceObject
ObfReferenceObject
IoBuildDeviceIoControlRequest
ExGetPreviousMode
ZwEnumerateValueKey
ZwSetValueKey
RtlCompareMemory
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
ZwCreateKey
RtlAppendUnicodeToString
RtlCopyUnicodeString
ExQueueWorkItem
swprintf
wcslen
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
IoSetDeviceInterfaceState
InterlockedExchange
KeSetTimer
IoInvalidateDeviceRelations
ExAllocatePoolWithQuotaTag
ProbeForWrite
IoGetDeviceProperty
DbgBreakPoint
DbgPrint
ZwEnumerateKey
ZwQueryKey
IoRegisterDeviceInterface
RtlGUIDFromString
_wcsicmp
IoDeleteDevice
IoCreateDevice
ZwDeleteKey
IoDetachDevice
IoAttachDeviceToDeviceStack
KeInitializeDpc
KeSetEvent
_wcsnicmp
KeCancelTimer
KeSetTimerEx
ExInterlockedCompareExchange64
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeQueryTimeIncrement
KeInitializeTimerEx
KeReleaseMutex
KeSynchronizeExecution
ObfDereferenceObject
KeRemoveQueueDpc
InterlockedCompareExchange
KeReleaseSemaphore
KeInsertQueueDpc
ExEventObjectType
ObReferenceObjectByHandle
ExSemaphoreObjectType
KeBugCheckEx
PoCallDriver
PoStartNextPowerIrp
KeGetCurrentThread
RtlCompareUnicodeString
IoCreateFile
MmMapLockedPages
KeClearEvent
ExRaiseStatus
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
ExfInterlockedRemoveHeadList
ExfInterlockedInsertTailList
KeInitializeMutex
IoFileObjectType
IoGetDeviceInterfaces
IoAllocateDriverObjectExtension
IoGetDriverObjectExtension
IoOpenDeviceRegistryKey
IoFreeIrp
IoAllocateIrp
_snwprintf
PoUnregisterSystemState
PoRegisterSystemState
IoIsWdmVersionAvailable
PoRequestPowerIrp
PoSetPowerState
IoOpenDeviceInterfaceRegistryKey
memmove
KeResetEvent
KeQuerySystemTime
_except_handler3
KeTickCount
KeWaitForSingleObject
IofCompleteRequest
InterlockedIncrement
InterlockedDecrement
ExFreePool
ExAllocatePoolWithTag
ExInterlockedPushEntrySList
KeInitializeTimer
ExInterlockedPopEntrySList
hal
KfLowerIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
KfRaiseIrql
??0CBaseUnknown@@QAE@ABU_GUID@@PAUIUnknown@@@Z
??0CBaseUnknown@@QAE@PAUIUnknown@@@Z
??1CBaseUnknown@@UAE@XZ
??_FCBaseUnknown@@QAEXXZ
?IndirectedAddRef@CBaseUnknown@@UAGKXZ
?IndirectedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?IndirectedRelease@CBaseUnknown@@UAGKXZ
?NonDelegatedAddRef@CBaseUnknown@@UAGKXZ
?NonDelegatedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?NonDelegatedRelease@CBaseUnknown@@UAGKXZ
DllInitialize
KoCreateInstance
KoDeviceInitialize
KoDriverInitialize
KoRelease
KsAcquireControl
KsAcquireDevice
KsAcquireDeviceSecurityLock
KsAcquireResetValue
KsAddDevice
KsAddEvent
KsAddIrpToCancelableQueue
KsAddItemToObjectBag
KsAddObjectCreateItemToDeviceHeader
KsAddObjectCreateItemToObjectHeader
KsAllocateDefaultClock
KsAllocateDefaultClockEx
KsAllocateDeviceHeader
KsAllocateExtraData
KsAllocateObjectBag
KsAllocateObjectCreateItem
KsAllocateObjectHeader
KsCacheMedium
KsCancelIo
KsCancelRoutine
KsCompletePendingRequest
KsCopyObjectBagItems
KsCreateAllocator
KsCreateBusEnumObject
KsCreateClock
KsCreateDefaultAllocator
KsCreateDefaultAllocatorEx
KsCreateDefaultClock
KsCreateDefaultSecurity
KsCreateDevice
KsCreateFilterFactory
KsCreatePin
KsCreateTopologyNode
KsDecrementCountedWorker
KsDefaultAddEventHandler
KsDefaultDeviceIoCompletion
KsDefaultDispatchPnp
KsDefaultDispatchPower
KsDefaultForwardIrp
KsDereferenceBusObject
KsDereferenceSoftwareBusObject
KsDeviceGetBusData
KsDeviceRegisterAdapterObject
KsDeviceSetBusData
KsDisableEvent
KsDiscardEvent
KsDispatchFastIoDeviceControlFailure
KsDispatchFastReadFailure
KsDispatchInvalidDeviceRequest
KsDispatchIrp
KsDispatchQuerySecurity
KsDispatchSetSecurity
KsDispatchSpecificMethod
KsDispatchSpecificProperty
KsEnableEvent
KsEnableEventWithAllocator
KsFastMethodHandler
KsFastPropertyHandler
KsFilterAcquireProcessingMutex
KsFilterAddTopologyConnections
KsFilterAttemptProcessing
KsFilterCreateNode
KsFilterCreatePinFactory
KsFilterFactoryAddCreateItem
KsFilterFactoryGetSymbolicLink
KsFilterFactorySetDeviceClassesState
KsFilterFactoryUpdateCacheData
KsFilterGetAndGate
KsFilterGetChildPinCount
KsFilterGetFirstChildPin
KsFilterRegisterPowerCallbacks
KsFilterReleaseProcessingMutex
KsForwardAndCatchIrp
KsForwardIrp
KsFreeDefaultClock
KsFreeDeviceHeader
KsFreeEventList
KsFreeObjectBag
KsFreeObjectCreateItem
KsFreeObjectCreateItemsByContext
KsFreeObjectHeader
KsGenerateDataEvent
KsGenerateEvent
KsGenerateEventList
KsGenerateEvents
KsGetBusEnumIdentifier
KsGetBusEnumParentFDOFromChildPDO
KsGetBusEnumPnpDeviceObject
KsGetDefaultClockState
KsGetDefaultClockTime
KsGetDevice
KsGetDeviceForDeviceObject
KsGetFilterFromIrp
KsGetFirstChild
KsGetNextSibling
KsGetNodeIdFromIrp
KsGetObjectFromFileObject
KsGetObjectTypeFromFileObject
KsGetObjectTypeFromIrp
KsGetOuterUnknown
KsGetParent
KsGetPinFromIrp
KsHandleSizedListQuery
KsIncrementCountedWorker
KsInitializeDevice
KsInitializeDriver
KsInstallBusEnumInterface
KsIsBusEnumChildDevice
KsMergeAutomationTables
KsMethodHandler
KsMethodHandlerWithAllocator
KsMoveIrpsOnCancelableQueue
KsNullDriverUnload
KsPinAcquireProcessingMutex
KsPinAttachAndGate
KsPinAttachOrGate
KsPinAttemptProcessing
KsPinDataIntersection
KsPinGetAndGate
KsPinGetAvailableByteCount
KsPinGetConnectedFilterInterface
KsPinGetConnectedPinDeviceObject
KsPinGetConnectedPinFileObject
KsPinGetConnectedPinInterface
KsPinGetCopyRelationships
KsPinGetFirstCloneStreamPointer
KsPinGetLeadingEdgeStreamPointer
KsPinGetNextSiblingPin
KsPinGetParentFilter
KsPinGetReferenceClockInterface
KsPinGetTrailingEdgeStreamPointer
KsPinPropertyHandler
KsPinRegisterFrameReturnCallback
KsPinRegisterHandshakeCallback
KsPinRegisterIrpCompletionCallback
KsPinRegisterPowerCallbacks
KsPinReleaseProcessingMutex
KsPinSetPinClockTime
KsPinSubmitFrame
KsPinSubmitFrameMdl
KsProbeStreamIrp
KsProcessPinUpdate
KsPropertyHandler
KsPropertyHandlerWithAllocator
KsQueryDevicePnpObject
KsQueryInformationFile
KsQueryObjectAccessMask
KsQueryObjectCreateItem
KsQueueWorkItem
KsReadFile
KsRecalculateStackDepth
KsReferenceBusObject
KsReferenceSoftwareBusObject
KsRegisterAggregatedClientUnknown
KsRegisterCountedWorker
KsRegisterFilterWithNoKSPins
KsRegisterWorker
KsReleaseControl
KsReleaseDevice
KsReleaseDeviceSecurityLock
KsReleaseIrpOnCancelableQueue
KsRemoveBusEnumInterface
KsRemoveIrpFromCancelableQueue
KsRemoveItemFromObjectBag
KsRemoveSpecificIrpFromCancelableQueue
KsServiceBusEnumCreateRequest
KsServiceBusEnumPnpRequest
KsSetDefaultClockState
KsSetDefaultClockTime
KsSetDevicePnpAndBaseObject
KsSetInformationFile
KsSetMajorFunctionHandler
KsSetPowerDispatch
KsSetTargetDeviceObject
KsSetTargetState
KsStreamIo
KsStreamPointerAdvance
KsStreamPointerAdvanceOffsets
KsStreamPointerAdvanceOffsetsAndUnlock
KsStreamPointerCancelTimeout
KsStreamPointerClone
KsStreamPointerDelete
KsStreamPointerGetIrp
KsStreamPointerGetMdl
KsStreamPointerGetNextClone
KsStreamPointerLock
KsStreamPointerScheduleTimeout
KsStreamPointerSetStatusCode
KsStreamPointerUnlock
KsSynchronousIoControlDevice
KsTerminateDevice
KsTopologyPropertyHandler
KsUnregisterWorker
KsUnserializeObjectPropertiesFromRegistry
KsValidateAllocatorCreateRequest
KsValidateAllocatorFramingEx
KsValidateClockCreateRequest
KsValidateConnectRequest
KsValidateTopologyNodeCreateRequest
KsWriteFile
KsiDefaultClockAddMarkEvent
KsiPropertyDefaultClockGetCorrelatedPhysicalTime
KsiPropertyDefaultClockGetCorrelatedTime
KsiPropertyDefaultClockGetFunctionTable
KsiPropertyDefaultClockGetPhysicalTime
KsiPropertyDefaultClockGetResolution
KsiPropertyDefaultClockGetState
KsiPropertyDefaultClockGetTime
KsiQueryObjectCreateItemsPresent
_KsEdit
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=129, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=5, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=28, version=9178,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
ks98.inf
- SHA256 eb32a8d0e9a6708b5d0d9d323a6ef80de30efb760b7b5711d7f56f788a9b92c2
- MD5 67febf0d2bea724f472128f4d448204c
- SHA1 72bb3a96b6fff2bb9f11d6a48ecca1788e07865f
- SHA512 fd308c5ef9f739aee1a8e159f67a727e1a88eb82e85da9df318401932b893d52d0229008554e0ffa1e6c73a5d4988774ceb2b5c66be97423272fe5dcfb6becf3
- SSDEEP 384:3AEvRGpiNcJxGMDhX1erbBZjJlUVyl3ntoDwYOV8Wzzpbt3KD/uO5E1BBeyQQ:3ATGMDhX1eJZjMDwJHRGuJP0yF
- TLSH T1A0F2C11E930D8913E20C32C0F7D12DC7709A509ED0E052AEBB26DA9E685ED96451CF7F
- MD5 SHA1 SHA512 SSDEEP TLSH
ks98.sys
- IMPHASH 35f91fb82ef1dedbe8e11940592e982b
- SHA256 eb45ccb9fec740807b8d1fc422017a3882f22236d11d92373f9d8c19ec58f92b
- MD5 0fd481c5a18b05be839941e3c7ed0d15
- SHA1 2019660f8b2278e6f2f842753201862b06fd24b6
- SHA512 e3317c914a548d0f76e07712c68af3d91030479cf69e72022d988cd3b31f3d87866d1e0d743ce4ac021835a3926547019bc7d383e2a7d008b114fea20580bc87
- SSDEEP 3072:wZva7uUTvbloVPCe12XNru+KOf6wk1SeVRyMpprlo3Lz0IraXW6:wVkbl409zKUcogpybz0Ir0
- TLSH T1EAC39D23B2C1447AD58B22F1CF0A772FB37722235769B6874A249E652BB4840F93D357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
117132
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ks.pdb
ntoskrnl.exe
KeInitializeEvent
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExDeletePagedLookasideList
ExFreeToPagedLookasideList
ExAllocateFromPagedLookasideList
ExInitializePagedLookasideList
KeInitializeSpinLock
ProbeForRead
IofCallDriver
IoBuildSynchronousFsdRequest
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
RtlFreeUnicodeString
wcscat
wcscpy
RtlStringFromGUID
IoGetRelatedDeviceObject
ObfReferenceObject
IoBuildDeviceIoControlRequest
ExGetPreviousMode
ZwEnumerateValueKey
ZwSetValueKey
RtlCompareMemory
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
ZwCreateKey
RtlAppendUnicodeToString
RtlCopyUnicodeString
ExQueueWorkItem
swprintf
wcslen
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
IoSetDeviceInterfaceState
InterlockedExchange
KeSetTimer
IoInvalidateDeviceRelations
ExAllocatePoolWithQuotaTag
ProbeForWrite
IoGetDeviceProperty
DbgPrint
ZwEnumerateKey
ZwQueryKey
IoRegisterDeviceInterface
RtlGUIDFromString
_wcsicmp
IoDeleteDevice
IoCreateDevice
ZwDeleteKey
IoDetachDevice
IoAttachDeviceToDeviceStack
KeSetEvent
KeInitializeTimer
_wcsnicmp
KeCancelTimer
KeSetTimerEx
ExInterlockedCompareExchange64
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeQueryTimeIncrement
KeInitializeTimerEx
KeReleaseMutex
KeSynchronizeExecution
ObfDereferenceObject
KeRemoveQueueDpc
InterlockedCompareExchange
KeReleaseSemaphore
KeInsertQueueDpc
ExEventObjectType
ObReferenceObjectByHandle
ExSemaphoreObjectType
KeBugCheckEx
PoCallDriver
PoStartNextPowerIrp
KeGetCurrentThread
RtlCompareUnicodeString
IoCreateFile
MmMapLockedPages
KeClearEvent
ExRaiseStatus
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
ExfInterlockedRemoveHeadList
ExfInterlockedInsertTailList
KeInitializeMutex
IoFileObjectType
IoGetDeviceInterfaces
IoAllocateDriverObjectExtension
IoGetDriverObjectExtension
IoOpenDeviceRegistryKey
IoFreeIrp
IoAllocateIrp
_snwprintf
IoIsWdmVersionAvailable
PoRequestPowerIrp
PoSetPowerState
IoOpenDeviceInterfaceRegistryKey
memmove
KeResetEvent
KeQuerySystemTime
_except_handler3
KeTickCount
KeWaitForSingleObject
IofCompleteRequest
InterlockedIncrement
InterlockedDecrement
ExFreePool
ExAllocatePoolWithTag
ExInterlockedPushEntrySList
KeInitializeDpc
ExInterlockedPopEntrySList
hal
KfLowerIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
KfRaiseIrql
??0CBaseUnknown@@QAE@ABU_GUID@@PAUIUnknown@@@Z
??0CBaseUnknown@@QAE@PAUIUnknown@@@Z
??1CBaseUnknown@@UAE@XZ
??_FCBaseUnknown@@QAEXXZ
?IndirectedAddRef@CBaseUnknown@@UAGKXZ
?IndirectedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?IndirectedRelease@CBaseUnknown@@UAGKXZ
?NonDelegatedAddRef@CBaseUnknown@@UAGKXZ
?NonDelegatedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?NonDelegatedRelease@CBaseUnknown@@UAGKXZ
DllInitialize
KoCreateInstance
KoDeviceInitialize
KoDriverInitialize
KoRelease
KsAcquireControl
KsAcquireDevice
KsAcquireDeviceSecurityLock
KsAcquireResetValue
KsAddDevice
KsAddEvent
KsAddIrpToCancelableQueue
KsAddItemToObjectBag
KsAddObjectCreateItemToDeviceHeader
KsAddObjectCreateItemToObjectHeader
KsAllocateDefaultClock
KsAllocateDefaultClockEx
KsAllocateDeviceHeader
KsAllocateExtraData
KsAllocateObjectBag
KsAllocateObjectCreateItem
KsAllocateObjectHeader
KsCacheMedium
KsCancelIo
KsCancelRoutine
KsCompletePendingRequest
KsCopyObjectBagItems
KsCreateAllocator
KsCreateBusEnumObject
KsCreateClock
KsCreateDefaultAllocator
KsCreateDefaultAllocatorEx
KsCreateDefaultClock
KsCreateDefaultSecurity
KsCreateDevice
KsCreateFilterFactory
KsCreatePin
KsCreateTopologyNode
KsDecrementCountedWorker
KsDefaultAddEventHandler
KsDefaultDeviceIoCompletion
KsDefaultDispatchPnp
KsDefaultDispatchPower
KsDefaultForwardIrp
KsDereferenceBusObject
KsDereferenceSoftwareBusObject
KsDeviceGetBusData
KsDeviceRegisterAdapterObject
KsDeviceSetBusData
KsDisableEvent
KsDiscardEvent
KsDispatchFastIoDeviceControlFailure
KsDispatchFastReadFailure
KsDispatchInvalidDeviceRequest
KsDispatchIrp
KsDispatchQuerySecurity
KsDispatchSetSecurity
KsDispatchSpecificMethod
KsDispatchSpecificProperty
KsEnableEvent
KsEnableEventWithAllocator
KsFastMethodHandler
KsFastPropertyHandler
KsFilterAcquireProcessingMutex
KsFilterAddTopologyConnections
KsFilterAttemptProcessing
KsFilterCreateNode
KsFilterCreatePinFactory
KsFilterFactoryAddCreateItem
KsFilterFactoryGetSymbolicLink
KsFilterFactorySetDeviceClassesState
KsFilterFactoryUpdateCacheData
KsFilterGetAndGate
KsFilterGetChildPinCount
KsFilterGetFirstChildPin
KsFilterRegisterPowerCallbacks
KsFilterReleaseProcessingMutex
KsForwardAndCatchIrp
KsForwardIrp
KsFreeDefaultClock
KsFreeDeviceHeader
KsFreeEventList
KsFreeObjectBag
KsFreeObjectCreateItem
KsFreeObjectCreateItemsByContext
KsFreeObjectHeader
KsGenerateDataEvent
KsGenerateEvent
KsGenerateEventList
KsGenerateEvents
KsGetBusEnumIdentifier
KsGetBusEnumParentFDOFromChildPDO
KsGetBusEnumPnpDeviceObject
KsGetDefaultClockState
KsGetDefaultClockTime
KsGetDevice
KsGetDeviceForDeviceObject
KsGetFilterFromIrp
KsGetFirstChild
KsGetNextSibling
KsGetNodeIdFromIrp
KsGetObjectFromFileObject
KsGetObjectTypeFromFileObject
KsGetObjectTypeFromIrp
KsGetOuterUnknown
KsGetParent
KsGetPinFromIrp
KsHandleSizedListQuery
KsIncrementCountedWorker
KsInitializeDevice
KsInitializeDriver
KsInstallBusEnumInterface
KsIsBusEnumChildDevice
KsMergeAutomationTables
KsMethodHandler
KsMethodHandlerWithAllocator
KsMoveIrpsOnCancelableQueue
KsNullDriverUnload
KsPinAcquireProcessingMutex
KsPinAttachAndGate
KsPinAttachOrGate
KsPinAttemptProcessing
KsPinDataIntersection
KsPinGetAndGate
KsPinGetAvailableByteCount
KsPinGetConnectedFilterInterface
KsPinGetConnectedPinDeviceObject
KsPinGetConnectedPinFileObject
KsPinGetConnectedPinInterface
KsPinGetCopyRelationships
KsPinGetFirstCloneStreamPointer
KsPinGetLeadingEdgeStreamPointer
KsPinGetNextSiblingPin
KsPinGetParentFilter
KsPinGetReferenceClockInterface
KsPinGetTrailingEdgeStreamPointer
KsPinPropertyHandler
KsPinRegisterFrameReturnCallback
KsPinRegisterHandshakeCallback
KsPinRegisterIrpCompletionCallback
KsPinRegisterPowerCallbacks
KsPinReleaseProcessingMutex
KsPinSetPinClockTime
KsPinSubmitFrame
KsPinSubmitFrameMdl
KsProbeStreamIrp
KsProcessPinUpdate
KsPropertyHandler
KsPropertyHandlerWithAllocator
KsQueryDevicePnpObject
KsQueryInformationFile
KsQueryObjectAccessMask
KsQueryObjectCreateItem
KsQueueWorkItem
KsReadFile
KsRecalculateStackDepth
KsReferenceBusObject
KsReferenceSoftwareBusObject
KsRegisterAggregatedClientUnknown
KsRegisterCountedWorker
KsRegisterFilterWithNoKSPins
KsRegisterWorker
KsReleaseControl
KsReleaseDevice
KsReleaseDeviceSecurityLock
KsReleaseIrpOnCancelableQueue
KsRemoveBusEnumInterface
KsRemoveIrpFromCancelableQueue
KsRemoveItemFromObjectBag
KsRemoveSpecificIrpFromCancelableQueue
KsServiceBusEnumCreateRequest
KsServiceBusEnumPnpRequest
KsSetDefaultClockState
KsSetDefaultClockTime
KsSetDevicePnpAndBaseObject
KsSetInformationFile
KsSetMajorFunctionHandler
KsSetPowerDispatch
KsSetTargetDeviceObject
KsSetTargetState
KsStreamIo
KsStreamPointerAdvance
KsStreamPointerAdvanceOffsets
KsStreamPointerAdvanceOffsetsAndUnlock
KsStreamPointerCancelTimeout
KsStreamPointerClone
KsStreamPointerDelete
KsStreamPointerGetIrp
KsStreamPointerGetMdl
KsStreamPointerGetNextClone
KsStreamPointerLock
KsStreamPointerScheduleTimeout
KsStreamPointerSetStatusCode
KsStreamPointerUnlock
KsSynchronousIoControlDevice
KsTerminateDevice
KsTopologyPropertyHandler
KsUnregisterWorker
KsUnserializeObjectPropertiesFromRegistry
KsValidateAllocatorCreateRequest
KsValidateAllocatorFramingEx
KsValidateClockCreateRequest
KsValidateConnectRequest
KsValidateTopologyNodeCreateRequest
KsWriteFile
KsiDefaultClockAddMarkEvent
KsiPropertyDefaultClockGetCorrelatedPhysicalTime
KsiPropertyDefaultClockGetCorrelatedTime
KsiPropertyDefaultClockGetFunctionTable
KsiPropertyDefaultClockGetPhysicalTime
KsiPropertyDefaultClockGetResolution
KsiPropertyDefaultClockGetState
KsiPropertyDefaultClockGetTime
KsiQueryObjectCreateItemsPresent
_KsEdit
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=126, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=5, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=28, version=9178,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
kscaptur.inf
- SHA256 8e277c581c0562401fb8551875a11b5498fcf41b98e27d592c14ae5e6b75bfb4
- MD5 d9eee85cf7e9d861c91ba68fba82e3c7
- SHA1 01cdae51360a2c2f0c6d29cccf6d119862819870
- SHA512 e06c8ae3f79230b79484ed8466114181367d5e29b3ee196c1f127a0e0bc1e977f624f5307179dafc658dd20211bba1a5d7386b809f2874097cbac327b337c873
- SSDEEP 384:tbPDGYVv871qlvsuPrk1agj6o5aOO0Bs9Ck3omF8Fw7tvy0AeSyaLQ:tbPDGulvsuDk0ZOO0Bswsh6cSy+Q
- TLSH T1DDA2660B831B8963D18592B8F7931EC77084719B41F1916E3B75CA1A34DFDF4882E9EA
- MD5 SHA1 SHA512 SSDEEP TLSH
ksfilt98.inf
- SHA256 bec9d8662fbe96b83303d668e00cc98bae53f1acbc276a2c5ba5d5b9018e0987
- MD5 e2d3e266bb2f48f8988c61d13464abd8
- SHA1 3c12a99b8a348c8271938ece69c0c8405677ac64
- SHA512 f8b2352162d88d024048d146cca7f0dfd347f079b95323a95c4cf02a475699472b5b9c0daec4fff9af801cf31b9d7e933f8f8427d339a9b0b5187b55ad2bab7f
- SSDEEP 192:s0fk0Qo80OcIMNOwSltwd76wgolFwrYKynddTylQwtXsLUhI:2o80OcIMNOZ7Q76UbCYlnddTyCOsLUhI
- TLSH T15E12025E4E570876B149E3BC98D72BD3E6053063B2CC09143C4AE9457DCA9D8A23DAFD
- MD5 SHA1 SHA512 SSDEEP TLSH
ksfilter.inf
- SHA256 adb323c722db57e00e6154812d989ebd96210fa1f38bcac261fa608f0f4316c8
- MD5 1a7ab501fe7b9054c7f7649239260dc3
- SHA1 c11efd706ea9105d427260ec0ab89361b5e5c44a
- SHA512 3676b551f24275ba771d4c4ea86af48e13041f03e7a94dcfa6e2af9dda38a177099fdf9499f59e3e3eb34937037e800f03e340fff3596cf045f42852875e2baf
- SSDEEP 192:s0fo0Qo80OcIMNOwSltw3/RwN76wgolFwrYKynddTylQwtXsLBhI:Ko80OcIMNOZ72/RC76UbCYlnddTyCOs0
- TLSH T10222125E4E870876B148E7ACA8D76BC3E6053063B2CC09143D4BE9457DCA9D8623DAFC
- MD5 SHA1 SHA512 SSDEEP TLSH
ksolay.ax
- IMPHASH 96a838db2ca9c5febf5b77f383b5f7ab
- SHA256 d5f765cfd0c40d47e21a47f0ecd59dbc8770fe13e64e95a98d8d2085a2efd132
- MD5 a47a7a5fcfba3f278d970347fe326586
- SHA1 8a519c67f4b0571d4f0ed24f52ea3a3c8b25ec72
- SHA512 c6b011ce689504a58a433a56b566e0830fe2667691c704893ce5789bd9e1965e805488afdb96fc9ce32a9bee94aa15a10a4aac10d4576234761973e3449e5ebf
- SSDEEP 192:nDXtk7UINJJnDnMqG2uwtTudv1W6jRg8M/NMk+l12ZCAeWWfWGUgq:xo1nG0RudXgf/NMk6c8WWfWGUgq
- TLSH T152421B1263DD48B2E3734A7199F11BAB32A9A93C5F7F73468910050E2EF4D56C93171B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7363
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetModuleFileNameA
lstrlenA
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExA
QueryPerformanceCounter
GetLastError
MultiByteToWideChar
ksproxy.ax
KsSynchronousDeviceControl
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
advapi32
RegSetValueA
RegCloseKey
RegEnumKeyExA
RegCreateKeyA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
user32
DefWindowProcA
ShowCursor
EndPaint
ReleaseDC
GetDC
GetClientRect
UnregisterClassA
BeginPaint
wsprintfA
GetMonitorInfoA
EnumDisplaySettingsA
EnumDisplayDevicesA
SendMessageA
DestroyWindow
RegisterClassExA
CreateWindowExA
gdi32
SetBkColor
ExtTextOutA
ole32
CoCreateInstance
CoInitialize
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=15, id=25, version=9210,
count=89, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
ksproxy.ax
- IMPHASH 8a9244974f0e29124f9a788299082510
- SHA256 64217ea53d50a04f256ec0e29fa681f6c74145530cf493e866be8237527bbe69
- MD5 faa856908340dcf6d936ed7128bc2119
- SHA1 8a929b52241c20e5898241ccb34d4c813559306a
- SHA512 7adfc78da2a51245666b013dfc82fdc7b0b4323ed0a07a32cda70e0d002f8bd20ea9b47e62e89a3bd429efd64d1f76364eef2a7030f632c013713d7f1bf9c99a
- SSDEEP 3072:VmjKuN04JipzMwH8eH4/9+M7uMOz9y/pCkRH:A1N0guzf8eY/4iOzkYkN
- TLSH T176B34C0373FB80F7C25302B299B5B3F9B2FAD215197A960657150F093F61852EB39A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
85667
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
??3@YAXPAX@Z
wcslen
_CIpow
swscanf
swprintf
_ftol
sprintf
_purecall
_except_handler3
??2@YAPAXI@Z
memmove
wcscpy
kernel32
GetACP
InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetLastError
CreateEventA
CloseHandle
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CreateThread
CreateFileA
WideCharToMultiByte
ReleaseSemaphore
InterlockedExchange
CreateSemaphoreA
InterlockedDecrement
DeviceIoControl
InterlockedIncrement
ResetEvent
GetOverlappedResult
MultiByteToWideChar
CreateMutexA
ReleaseMutex
GetHandleInformation
GetVersionExA
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryA
lstrlenA
GetModuleFileNameA
WaitForMultipleObjects
WaitForSingleObject
GetSystemInfo
VirtualFree
VirtualAlloc
GetProcAddress
ResumeThread
SetThreadPriority
advapi32
RegEnumKeyExA
RegQueryValueExA
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyA
user32
wsprintfA
wvsprintfA
ole32
CoUninitialize
IIDFromString
CoCreateInstance
CoTaskMemAlloc
CoFreeUnusedLibraries
CoInitialize
CoTaskMemFree
StringFromGUID2
oleaut32
SysFreeString
setupapi
SetupDiOpenDeviceInterfaceA
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceInterfaceAlias
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiOpenDeviceInterfaceRegKey
SetupDiCreateDeviceInfoListExA
SetupDiGetClassDevsA
ksuser
KsCreatePin
KsCreateTopologyNode
KsCreateAllocator
KsCreateClock
ntdll
RtlNtStatusToDosError
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
KsGetMediaType
KsGetMediaTypeCount
KsGetMultiplePinFactoryItems
KsOpenDefaultDevice
KsResolveRequiredAttributes
KsSynchronousDeviceControl
Name
.text
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
364B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=102, id=1, productName=Unmarked objects,
count=17, id=25, version=9210,
count=5, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=23, id=29, version=9178,
count=1, id=61, version=9210,
ksse.sys
- IMPHASH 21a59e474a5dc891708dc0b0ea65fe46
- SHA256 ccb128d5ca835cf4b097d857134f7ac3d241c0304f566869e3d61a3ae958e941
- MD5 5bf76f7aaf92df4bd77c3fabca2038e5
- SHA1 797e8b79d55590cc97e8ae134b29ecbee5829e9d
- SHA512 9de00308294471da885f11c6b3f6015e0f50934d18f5b50c1ecaa5f8944ed4f2b0920ec070ae10614a37183d29590b6c4b1653d38a86bb8a4dbbdbfa720828ee
- SSDEEP 3072:nBZWrShRa3pJVP6kJaFVYMQy+ITZ9RsGeoMgzwTBUIre7XlL:nLW3pD20MTXZ9mecdUIreR
- TLSH T118C39E23B2C1447AD58726F1CF0F372FB37722231726A6574A606E912B79901FE29367
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
117031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ks.pdb
ntoskrnl.exe
KeInitializeEvent
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExDeletePagedLookasideList
ExFreeToPagedLookasideList
ExAllocateFromPagedLookasideList
ExInitializePagedLookasideList
KeInitializeSpinLock
ProbeForRead
IofCallDriver
IoBuildSynchronousFsdRequest
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
RtlFreeUnicodeString
wcscat
wcscpy
RtlStringFromGUID
IoGetRelatedDeviceObject
ObfReferenceObject
IoBuildDeviceIoControlRequest
ExGetPreviousMode
ZwEnumerateValueKey
ZwSetValueKey
RtlCompareMemory
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
ZwCreateKey
RtlAppendUnicodeToString
RtlCopyUnicodeString
ExQueueWorkItem
swprintf
wcslen
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
IoSetDeviceInterfaceState
InterlockedExchange
KeSetTimer
IoInvalidateDeviceRelations
ExAllocatePoolWithQuotaTag
ProbeForWrite
IoGetDeviceProperty
DbgBreakPoint
DbgPrint
ZwEnumerateKey
ZwQueryKey
IoRegisterDeviceInterface
RtlGUIDFromString
_wcsicmp
IoDeleteDevice
IoCreateDevice
ZwDeleteKey
IoDetachDevice
IoAttachDeviceToDeviceStack
KeInitializeDpc
KeSetEvent
_wcsnicmp
KeCancelTimer
KeSetTimerEx
ExInterlockedCompareExchange64
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeQueryTimeIncrement
KeInitializeTimerEx
KeReleaseMutex
KeSynchronizeExecution
ObfDereferenceObject
KeRemoveQueueDpc
InterlockedCompareExchange
KeReleaseSemaphore
KeInsertQueueDpc
ExEventObjectType
ObReferenceObjectByHandle
ExSemaphoreObjectType
KeBugCheckEx
PoCallDriver
PoStartNextPowerIrp
KeGetCurrentThread
RtlCompareUnicodeString
IoCreateFile
MmMapLockedPages
KeClearEvent
ExRaiseStatus
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
ExfInterlockedRemoveHeadList
ExfInterlockedInsertTailList
KeInitializeMutex
IoFileObjectType
IoGetDeviceInterfaces
IoAllocateDriverObjectExtension
IoGetDriverObjectExtension
IoOpenDeviceRegistryKey
IoFreeIrp
IoAllocateIrp
_snwprintf
PoUnregisterSystemState
PoRegisterSystemState
IoIsWdmVersionAvailable
PoRequestPowerIrp
PoSetPowerState
IoOpenDeviceInterfaceRegistryKey
memmove
KeResetEvent
KeQuerySystemTime
_except_handler3
KeTickCount
KeWaitForSingleObject
IofCompleteRequest
InterlockedIncrement
InterlockedDecrement
ExFreePool
ExAllocatePoolWithTag
ExInterlockedPushEntrySList
KeInitializeTimer
ExInterlockedPopEntrySList
hal
KfLowerIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
KfRaiseIrql
??0CBaseUnknown@@QAE@ABU_GUID@@PAUIUnknown@@@Z
??0CBaseUnknown@@QAE@PAUIUnknown@@@Z
??1CBaseUnknown@@UAE@XZ
??_FCBaseUnknown@@QAEXXZ
?IndirectedAddRef@CBaseUnknown@@UAGKXZ
?IndirectedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?IndirectedRelease@CBaseUnknown@@UAGKXZ
?NonDelegatedAddRef@CBaseUnknown@@UAGKXZ
?NonDelegatedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?NonDelegatedRelease@CBaseUnknown@@UAGKXZ
DllInitialize
KoCreateInstance
KoDeviceInitialize
KoDriverInitialize
KoRelease
KsAcquireControl
KsAcquireDevice
KsAcquireDeviceSecurityLock
KsAcquireResetValue
KsAddDevice
KsAddEvent
KsAddIrpToCancelableQueue
KsAddItemToObjectBag
KsAddObjectCreateItemToDeviceHeader
KsAddObjectCreateItemToObjectHeader
KsAllocateDefaultClock
KsAllocateDefaultClockEx
KsAllocateDeviceHeader
KsAllocateExtraData
KsAllocateObjectBag
KsAllocateObjectCreateItem
KsAllocateObjectHeader
KsCacheMedium
KsCancelIo
KsCancelRoutine
KsCompletePendingRequest
KsCopyObjectBagItems
KsCreateAllocator
KsCreateBusEnumObject
KsCreateClock
KsCreateDefaultAllocator
KsCreateDefaultAllocatorEx
KsCreateDefaultClock
KsCreateDefaultSecurity
KsCreateDevice
KsCreateFilterFactory
KsCreatePin
KsCreateTopologyNode
KsDecrementCountedWorker
KsDefaultAddEventHandler
KsDefaultDeviceIoCompletion
KsDefaultDispatchPnp
KsDefaultDispatchPower
KsDefaultForwardIrp
KsDereferenceBusObject
KsDereferenceSoftwareBusObject
KsDeviceGetBusData
KsDeviceRegisterAdapterObject
KsDeviceSetBusData
KsDisableEvent
KsDiscardEvent
KsDispatchFastIoDeviceControlFailure
KsDispatchFastReadFailure
KsDispatchInvalidDeviceRequest
KsDispatchIrp
KsDispatchQuerySecurity
KsDispatchSetSecurity
KsDispatchSpecificMethod
KsDispatchSpecificProperty
KsEnableEvent
KsEnableEventWithAllocator
KsFastMethodHandler
KsFastPropertyHandler
KsFilterAcquireProcessingMutex
KsFilterAddTopologyConnections
KsFilterAttemptProcessing
KsFilterCreateNode
KsFilterCreatePinFactory
KsFilterFactoryAddCreateItem
KsFilterFactoryGetSymbolicLink
KsFilterFactorySetDeviceClassesState
KsFilterFactoryUpdateCacheData
KsFilterGetAndGate
KsFilterGetChildPinCount
KsFilterGetFirstChildPin
KsFilterRegisterPowerCallbacks
KsFilterReleaseProcessingMutex
KsForwardAndCatchIrp
KsForwardIrp
KsFreeDefaultClock
KsFreeDeviceHeader
KsFreeEventList
KsFreeObjectBag
KsFreeObjectCreateItem
KsFreeObjectCreateItemsByContext
KsFreeObjectHeader
KsGenerateDataEvent
KsGenerateEvent
KsGenerateEventList
KsGenerateEvents
KsGetBusEnumIdentifier
KsGetBusEnumParentFDOFromChildPDO
KsGetBusEnumPnpDeviceObject
KsGetDefaultClockState
KsGetDefaultClockTime
KsGetDevice
KsGetDeviceForDeviceObject
KsGetFilterFromIrp
KsGetFirstChild
KsGetNextSibling
KsGetNodeIdFromIrp
KsGetObjectFromFileObject
KsGetObjectTypeFromFileObject
KsGetObjectTypeFromIrp
KsGetOuterUnknown
KsGetParent
KsGetPinFromIrp
KsHandleSizedListQuery
KsIncrementCountedWorker
KsInitializeDevice
KsInitializeDriver
KsInstallBusEnumInterface
KsIsBusEnumChildDevice
KsMergeAutomationTables
KsMethodHandler
KsMethodHandlerWithAllocator
KsMoveIrpsOnCancelableQueue
KsNullDriverUnload
KsPinAcquireProcessingMutex
KsPinAttachAndGate
KsPinAttachOrGate
KsPinAttemptProcessing
KsPinDataIntersection
KsPinGetAndGate
KsPinGetAvailableByteCount
KsPinGetConnectedFilterInterface
KsPinGetConnectedPinDeviceObject
KsPinGetConnectedPinFileObject
KsPinGetConnectedPinInterface
KsPinGetCopyRelationships
KsPinGetFirstCloneStreamPointer
KsPinGetLeadingEdgeStreamPointer
KsPinGetNextSiblingPin
KsPinGetParentFilter
KsPinGetReferenceClockInterface
KsPinGetTrailingEdgeStreamPointer
KsPinPropertyHandler
KsPinRegisterFrameReturnCallback
KsPinRegisterHandshakeCallback
KsPinRegisterIrpCompletionCallback
KsPinRegisterPowerCallbacks
KsPinReleaseProcessingMutex
KsPinSetPinClockTime
KsPinSubmitFrame
KsPinSubmitFrameMdl
KsProbeStreamIrp
KsProcessPinUpdate
KsPropertyHandler
KsPropertyHandlerWithAllocator
KsQueryDevicePnpObject
KsQueryInformationFile
KsQueryObjectAccessMask
KsQueryObjectCreateItem
KsQueueWorkItem
KsReadFile
KsRecalculateStackDepth
KsReferenceBusObject
KsReferenceSoftwareBusObject
KsRegisterAggregatedClientUnknown
KsRegisterCountedWorker
KsRegisterFilterWithNoKSPins
KsRegisterWorker
KsReleaseControl
KsReleaseDevice
KsReleaseDeviceSecurityLock
KsReleaseIrpOnCancelableQueue
KsRemoveBusEnumInterface
KsRemoveIrpFromCancelableQueue
KsRemoveItemFromObjectBag
KsRemoveSpecificIrpFromCancelableQueue
KsServiceBusEnumCreateRequest
KsServiceBusEnumPnpRequest
KsSetDefaultClockState
KsSetDefaultClockTime
KsSetDevicePnpAndBaseObject
KsSetInformationFile
KsSetMajorFunctionHandler
KsSetPowerDispatch
KsSetTargetDeviceObject
KsSetTargetState
KsStreamIo
KsStreamPointerAdvance
KsStreamPointerAdvanceOffsets
KsStreamPointerAdvanceOffsetsAndUnlock
KsStreamPointerCancelTimeout
KsStreamPointerClone
KsStreamPointerDelete
KsStreamPointerGetIrp
KsStreamPointerGetMdl
KsStreamPointerGetNextClone
KsStreamPointerLock
KsStreamPointerScheduleTimeout
KsStreamPointerSetStatusCode
KsStreamPointerUnlock
KsSynchronousIoControlDevice
KsTerminateDevice
KsTopologyPropertyHandler
KsUnregisterWorker
KsUnserializeObjectPropertiesFromRegistry
KsValidateAllocatorCreateRequest
KsValidateAllocatorFramingEx
KsValidateClockCreateRequest
KsValidateConnectRequest
KsValidateTopologyNodeCreateRequest
KsWriteFile
KsiDefaultClockAddMarkEvent
KsiPropertyDefaultClockGetCorrelatedPhysicalTime
KsiPropertyDefaultClockGetCorrelatedTime
KsiPropertyDefaultClockGetFunctionTable
KsiPropertyDefaultClockGetPhysicalTime
KsiPropertyDefaultClockGetResolution
KsiPropertyDefaultClockGetState
KsiPropertyDefaultClockGetTime
KsiQueryObjectCreateItemsPresent
_KsEdit
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=129, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=5, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=28, version=9178,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
kssetup.inf
- SHA256 d94726e6f8d519a5f445084f154da0da79eaff3721e82eff83d531155756e86d
- MD5 df574e8bd81430a095b7bd6edc5fadc8
- SHA1 5996a7c76fa35541119432a0d28e041de0de9ed1
- SHA512 6f3f69b21f0c00bf746f6b8bad38dc400025c4c8e815e964036152ef21957f6d58a5df2ba78f18956cb2483bbdd3d72c4a46e313ab6f960a0ad822a39788c2f8
- TLSH T19741AF5AE771C24B60DEF599160CCED3D15C61768A39447C39AED594EA8DD0C833AB30
- MD5 SHA1 SHA512 TLSH
ksuser.dll
- IMPHASH 407f14f3ab3229ce994109fc31901c00
- SHA256 62ee25b5739eda45156d4232843a696a5bf638202a203908f360957e04159686
- MD5 3b90d72e2acb62c39e064ed5b4362cf6
- SHA1 b6d4efba2ff8a2bd57f20f623883beef0d9f9da8
- SHA512 62453182ebf2fb0299e85baf990036640d8ba953c23497b40941c96f09fc5637c6e6e58309cfd2800cb04f30965ee0a1ca724054bed926cf401c1143749ec022
- TLSH T11181621953F80536F0FB8B30DAF20757A17A7C10AA698A590590171B3C76A15CA31F2A
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapAlloc
GetProcessHeap
HeapFree
ntdll
NtCreateFile
RtlNtStatusToDosError
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
50B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=25, version=9210,
count=5, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=1, id=61, version=9210,
l3codecx.ax
- IMPHASH d7e8a0cc68dc418d56e7942bed824e2d
- SHA256 b5c87e6604585feff04e67f82a5a2e562f51efbf21d49841e6077790cd4ab2c7
- MD5 938b396850b318cae7ffb7380091ccbe
- SHA1 469403f7cb3b35ae1bc6944d874ec5cb19bcce06
- SHA512 8af1f6a5ead49176590daaaa1ad7d63bcab4fd7d6cc039f191b5e85bd1082d8d32e90018017a7c38c3122e19ad03b95656f127a8a635963c360e350401acf145
- SSDEEP 1536:znO7U7L8+AkxhnMOejOIOAZM2nrREegqB7v9lCDLU:DiUE+hnMOejOIOAGMrRHgqN9lULU
- TLSH T1D5836B42BAC346B1EABF65B504EB2237E738EA412514CD277B1CC5663833160ABD735E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36687
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_CIpow
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
kernel32
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
GetVersionExA
FreeLibrary
InterlockedDecrement
GetLastError
MulDiv
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
advapi32
RegEnumKeyExA
RegSetValueA
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegCreateKeyA
RegOpenKeyExA
user32
SetDlgItemTextA
wsprintfA
GetSysColor
KillTimer
SetTimer
SetDlgItemInt
GetWindowLongA
SetWindowLongA
CreateDialogParamA
MoveWindow
InvalidateRect
DestroyWindow
DefWindowProcA
CheckRadioButton
LoadStringA
LoadStringW
GetWindowRect
GetDesktopWindow
GetDlgItem
ShowWindow
EnableWindow
gdi32
DeleteObject
SetTextColor
CreateSolidBrush
SetBkColor
ole32
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoFreeUnusedLibraries
CoInitialize
CoTaskMemFree
StringFromGUID2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=167, productName=Unmarked objects (old),
count=1, id=6, version=1668,
count=8, id=2, version=7303,
license.txt
- SHA256 e76173bcf900501328a990f5ec03ee55a2e5ab98d23b44512c5335c669d298a0
- MD5 17c6063103ec787cb3d9e76b8f1cb6e9
- SHA1 70694ff93d8750b1536684754050e1cf174d4aa7
- SHA512 e8044140d7edbbdefa4ed51bfcfd7ad1a84b55e430a3b39d564ecb5754011e3ef18d4f52fed16573f066941a7b1c4dde1f40b03ba03278d079bed92bbd293d61
- TLSH T19A2145FEE1055BF65EE01595384DAEE2A5AC40AE1D219AB004F5C0CC661F16DC27FE70
- MD5 SHA1 SHA512 TLSH
mciqtz.drv
- SHA256 ba7edc45da2b5433077185762ae7ca3103bcb69730139a25c83f4de88780b853
- MD5 b5d7471e38ed6d03145d5e6dcb368715
- SHA1 fb10eec2eb24b3ecb7c0f1c3e83d08c28982941e
- SHA512 f819eb4d1881eadbd01691bf7619ba4cd1ed18c3905b1ecdcf122721450199c757fdf437b905fc07b36847245ad51f96eac55271287ad9143dbb6a366cc4bdf2
- SSDEEP 192:VF59Tv6AaBuwiDuid/Xy92sd+80KnsQDoKqzXXbkmFQi5O:VF5/aB/BipX82sdlsQ0KiJc
- TLSH T15932710BC7B59A86C1CC0B31DFC24B017975E9FD93BBDE0ABD86106D1A057881B607E6
- MD5 SHA1 SHA512 SSDEEP TLSH
mciqtz32.dll
- IMPHASH 6f7fd37396bca471f8c746fbbf6b8d0b
- SHA256 87b518179b2bbca11d9ece65dba01e76112dd67e459d8bb2e12b981a0e628a30
- MD5 0baf3df01fd34ed1ee9ae92f67cbd683
- SHA1 9ad1c86156066d66ddca3f02c501410473e90534
- SHA512 5d74b2289cc34007d279fe2a20b3866c2c80935e8bf4c30c23a698a960376802532d581a6d7f9bba15777e266618a76be58acaf97c392a23efc56d19f5bc1cca
- SSDEEP 768:NGo1b250zLcJnlIWZeOfeO6p2ioNx9X5:i5IcJlV5feNgDRX5
- TLSH T163F26052A7F84637F1F30F718876662132BABCB5AA37D24F1A45024D1E727818E74B27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
20047
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LocalAlloc
GetProcAddress
MulDiv
MultiByteToWideChar
lstrlenA
GetModuleHandleA
LocalFree
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateEventA
CreateThread
WaitForMultipleObjects
CloseHandle
SetEvent
WideCharToMultiByte
ResetEvent
DisableThreadLibraryCalls
WaitForSingleObject
user32
GetWindowLongA
GetSystemMetrics
SetWindowTextA
SetForegroundWindow
UnregisterClassA
DestroyWindow
WindowFromDC
EndPaint
BeginPaint
DefWindowProcA
SetWindowLongA
RegisterClassA
LoadCursorA
SetRectEmpty
PostMessageA
LoadStringW
InSendMessage
GetWindowTextA
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
GetClientRect
CreateWindowExA
GetWindowRect
AdjustWindowRect
IsWindow
IsIconic
IsZoomed
ShowWindow
IsWindowVisible
SetWindowPos
SendMessageA
ScreenToClient
winmm
mciFreeCommandResource
GetDriverModuleHandle
DefDriverProc
mciGetDriverData
mciLoadCommandResource
mciSetDriverData
mciDriverYield
ole32
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
gdi32
CreatePalette
GetObjectType
SetStretchBltMode
SelectPalette
RealizePalette
StretchDIBits
GetStockObject
DeleteObject
quartz
DBToAmpFactor
AmpFactorToDB
DriverProc
MCIEntry32
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=13, id=25, version=9210,
count=85, id=1, productName=Unmarked objects,
count=5, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=8, id=29, version=9178,
count=1, id=61, version=9210,
migrate.dll
- IMPHASH e568bbf24d2aa3e154a6757caa3c62f4
- SHA256 e762246f4bf64e7e066cf09276d5e50087311ea26f3e04cf2a9a2b5d89df5987
- MD5 7d162d4625ea26e2a103c365b02bf512
- SHA1 118c91478d51ef4706e0b2ec875a7a20fbaca1a6
- SHA512 e80dfd8242b46330956b94465264959d9ca1474eb416db64eea36abbf60510ed2c039a076c4cfce5236b781ba05bade008c7f268dde3b33e8fee69daa3313f7e
- SSDEEP 768:7X6sQ5ZcnZwfyWHuYTZFiMJNOmRpPFzqdxw8gq8rX9uMGxG3s:y5BzHu8NJNOGFzqdxw8gq8rX9uMGxG3
- TLSH T1FA735F056BFA0226F0F35E3456F027965A7EBE23AD35D26E8B50224D1970F158AB0F73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10352
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
GetWindowsDirectoryA
lstrcmpiA
DeleteFileA
lstrlenA
GetLastError
GetFileAttributesA
HeapFree
GetPrivateProfileSectionA
HeapReAlloc
HeapAlloc
HeapCreate
FindClose
FindNextFileA
WritePrivateProfileStringA
FindFirstFileA
GetSystemDirectoryA
MoveFileA
lstrcatA
lstrcpyA
HeapDestroy
DisableThreadLibraryCalls
GetModuleFileNameA
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
RtlUnwind
GetCommandLineA
GetVersionExA
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteFile
CloseHandle
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
Sleep
LoadLibraryA
SetStdHandle
FlushFileBuffers
SetFilePointer
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
LoadStringA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
shell32
SHFileOperationA
Initialize9x
InitializeNT
MigrateSystem9x
MigrateSystemNT
MigrateUser9x
MigrateUserNT
QueryVersion
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=64, version=9210,
count=9, id=25, version=9210,
count=78, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=69, id=28, version=9178,
count=4, id=29, version=9178,
count=1, id=61, version=9210,
mpg2splt.ax
- IMPHASH 7506cadb3101234ca71464cd166661ff
- SHA256 e6c49ffcd011c26da76ca764b741395807dfd5d56d42e4736b9e56fccce835b8
- MD5 f4c9e40fada73a7c7325640b11544926
- SHA1 27d147dc5e20bfecaaa6cc26ee72fc5e37b0554a
- SHA512 bd148325c8b509bbca9d37ca24b842b05d79ab90cef53bb36d827c27f48a2405d1224ebf4415075b89507ff0f7b52076869bded066534588be7475e6d64f7358
- SSDEEP 3072:iGm2Wa0prDKtLsM1xVzauO1IfkFL9cM7sv4u1k6/:iGmpaCMbsze46k
- TLSH T168D39DA773D680B6C39332324E39377AA3EAC711093D966747213C495B6542AE33FA53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12783
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
MulDiv
CreateThread
SetThreadPriority
InterlockedExchange
GetACP
WideCharToMultiByte
VirtualAlloc
CreateSemaphoreA
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ResetEvent
SetEvent
CreateEventA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceFrequency
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetModuleFileNameA
GetLastError
MultiByteToWideChar
GetVersionExA
lstrlenA
msvcrt
free
??2@YAPAXI@Z
_purecall
wcscpy
wcslen
_wcsicmp
_except_handler3
_itow
malloc
??3@YAXPAX@Z
_ftol
qsort
memmove
user32
wvsprintfA
wsprintfA
advapi32
RegCreateKeyExA
RegQueryValueExA
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
ole32
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
CoTaskMemFree
winmm
timeBeginPeriod
timeGetDevCaps
timeGetTime
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=8, id=64, version=9210,
count=11, id=25, version=9210,
count=97, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=38, id=29, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
msanalog.vxd
- SHA256 fd0dcf9f8d049386f5e221277e1962607508f95339157ba9cc4d2e189fd14aa5
- MD5 014cec45fa7b59ce0b4639ae613a9fd3
- SHA1 529d950aa425f4711e0de89056235f1b9c9219d5
- SHA512 61e8ccce8773d60fa87ab6091bc5b002ac22b94571fa8287376626dcaae5eb6d2456dbc33678c31340d4c4700ae9ac18d54673a9104e383f5048a50aff2e336c
- SSDEEP 192:Vci1WypnW9TFeN7C7fI1ymoXvxIw+AbsAhr4:VciMypW9TFw7CDITzAhk
- TLSH T16A4219E0DC60D371C74522B35EFE0F1D69BC87DE0A678A07E685294238A194245CBDFC
- MD5 SHA1 SHA512 SSDEEP TLSH
msdmo.dll
- IMPHASH 9dc9c166118bb224232425dd36ebb31e
- SHA256 d03764bfbd888c0c52e4b3d182f7be655283b983aff37e3c8784bfb5062206a2
- MD5 19c1fdfd3c4ac6146f4a50aad64a115f
- SHA1 4673f8cfa510facf5ede9af6d5b7c170b4e7ec3a
- SHA512 fb04f3abd3fbdd277464564ba0dbf1d52447039b1038acdee924063cf1e0c51615220f6c53bf24f594876e7ab3fdfc52e740db26b5dce7a018a4c5b5e425a356
- SSDEEP 384:+qNkbyKUwWmjLtaN7fAlYbUKVxL8kdZuJXCVjX/kOKWVY:+qN+bWaLc4MUKUkdZuJXKvk0Y
- TLSH T132420942B7E402ABD1E34D74A6B1136BA3BDC110CC32CD56C611094F3AB5A93ABF5B03
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
TerminateProcess
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
Sleep
lstrlenA
GetCurrentProcess
WideCharToMultiByte
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
_adjust_fdiv
_initterm
swprintf
sprintf
wcslen
wcscpy
realloc
free
malloc
sscanf
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
advapi32
RegDeleteKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegOpenKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegSetValueA
RegQueryValueA
RegCloseKey
user32
wsprintfA
DMOEnum
DMOGetName
DMOGetTypes
DMOGuidToStrA
DMOGuidToStrW
DMORegister
DMOStrToGuidA
DMOStrToGuidW
DMOUnregister
MoCopyMediaType
MoCreateMediaType
MoDeleteMediaType
MoDuplicateMediaType
MoFreeMediaType
MoInitMediaType
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
568B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=9, id=25, version=9210,
count=46, id=1, productName=Unmarked objects,
count=11, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=4, id=29, version=9178,
count=1, id=61, version=9210,
msjstick.drv
- SHA256 7384681819baf9a3ad1056ad560df7eefe94441b04074d6e9fcedabea18c5f91
- MD5 39d11f5783891a92dfd15ab7da2b7204
- SHA1 6327f381c51b8cc7c07a790b05fc7879da2de204
- SHA512 337ee0e692516e9c6aa2dd7bae1162c22e6aa1383b175a3fcb64709f15308581890235510fa84fdecd90f4e6ac4ab3bbec1e3293da4420d44e4260ba511c7e11
- TLSH T19841C903CB64F8C3D93D06751553A762B3FEEB45130B2F0B45D49B1B4ED1180CB56495
- MD5 SHA1 SHA512 TLSH
mskssrv.sys
- IMPHASH ae7af65c91def368b78cf6daaa295831
- SHA256 56bf6e6f9353f51e72508b6bf9d54163d797508b0136fbfc161e259c7d9cb912
- MD5 9e85272966c72ea3be6762e015f9f683
- SHA1 d118fd57259bfffc4e0bef8a5a7c7d6ec60eb070
- SHA512 15d104b4618c1c6432f17725acffb9a11d2a42377cade5f86d1cd531e0bdf9411a8bd09ece6687eb12894fd6098d9ce3eaab214d26860d2e4d82d9f8f786486a
- SSDEEP 192:MoZtI70NLd7mWoaSFI9NJ5ca13xHO1IIl5bymoWPJWdW:MoUWmvaSFIvJya1t25WFWPJW
- TLSH T1E3E1B952F7F85626E0B20AF49997452BD2E3A91199B0870E59501B4E29BCB04BF32F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4949
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mskssrv.pdb
ntoskrnl.exe
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
ExFreePool
ExAllocatePoolWithTag
memmove
RtlCompareMemory
ObfDereferenceObject
ZwSetValueKey
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
ZwQueryValueKey
IoOpenDeviceInterfaceRegistryKey
RtlInitUnicodeString
IofCompleteRequest
KeTickCount
KeBugCheckEx
ks.sys
KsQueryDevicePnpObject
KsSetDevicePnpAndBaseObject
KsAllocateDeviceHeader
KsSynchronousIoControlDevice
KsCacheMedium
KsDereferenceSoftwareBusObject
KsAllocateObjectHeader
KsReferenceSoftwareBusObject
KsFreeObjectHeader
KsPropertyHandler
KsNullDriverUnload
KsSetMajorFunctionHandler
KsDefaultForwardIrp
KsDefaultDispatchPower
KsDefaultDispatchPnp
Name
.text
Size
384B
Virtual Size
316B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=1, id=61, version=9210,
mspclock.98
- IMPHASH a38e3fcf8a1b447f8cb1c7fe185f87bf
- SHA256 a30cff767f3c21b89b5b092288a8bf0da8c4f4b11ae95ced8c1e63df72da71cf
- MD5 7526a982f686abaed3c35f3dbbcdb436
- SHA1 66a93076e659a6aed3d5628e648283df9d658fd1
- SHA512 fdedc77df17297788c238e8a15b5b562516ae232ba883ffe3a4b47c04a9e53f7b6ac794f0bfb4d371e87e420b0b78b155314d2a7ac42316cc9cdf2bfd59bb2e7
- SSDEEP 96:zE+0dwJpQ6K6wF5BcklFraJowKOW3GWiQ:jncr6wvD52W3GWiQ
- TLSH T130B1629273EC2E51E0FA25B04D9F671762772C128D34EB0603845BAD2D2A810BE59B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2645
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mspclock.pdb
ntoskrnl.exe
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
IofCompleteRequest
ExFreePool
KeInitializeEvent
ExAllocatePoolWithTag
KeTickCount
ks.sys
KsiDefaultClockAddMarkEvent
KsiPropertyDefaultClockGetFunctionTable
KsiPropertyDefaultClockGetState
KsiPropertyDefaultClockGetResolution
KsiPropertyDefaultClockGetCorrelatedPhysicalTime
KsiPropertyDefaultClockGetCorrelatedTime
KsiPropertyDefaultClockGetPhysicalTime
KsiPropertyDefaultClockGetTime
KsSetDevicePnpAndBaseObject
KsAllocateDeviceHeader
KsSetDefaultClockTime
KsSetDefaultClockState
KsDereferenceSoftwareBusObject
KsAllocateObjectHeader
KsAllocateDefaultClock
KsReferenceSoftwareBusObject
KsFreeObjectHeader
KsFreeDefaultClock
KsFreeEventList
KsPropertyHandler
KsEnableEvent
KsDisableEvent
KsNullDriverUnload
KsSetMajorFunctionHandler
KsDefaultForwardIrp
KsDefaultDispatchPower
KsDefaultDispatchPnp
Name
.text
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=1, id=61, version=9210,
mspclock.se
- IMPHASH 80ceafa87487c2a1e5e0a913df0055d1
- SHA256 0f663036bde76e786e3b069dff27d6a6e544cbc97a02ba22ef1fcb17f8b11859
- MD5 942eb6ee5fd88da98e742cf07f996311
- SHA1 0cbfbd61eea0db95d0269f9c2ec982774a65f416
- SHA512 c5c1f02d2201dfbbcef81dafdedcc730c3208d47f0ec601fc81f34cdeb0d9a7558065b187b78770c083f9cd777f4a03c7c9733c254c6b804b63a511f77fdc165
- SSDEEP 96:Hi0d6JH2pXqLumCF5BcklFraJowqOW3GWqos7:C9Ep6LumevD52W3GWqr7
- TLSH T1BDB174A2B3E86E05E0B62AB14CDF6617A2373C119D74EB020744477D3D2A910BD95B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2645
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mspclock.pdb
ntoskrnl.exe
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
IofCompleteRequest
ExFreePool
KeInitializeEvent
ExAllocatePoolWithTag
KeTickCount
ks.sys
KsiDefaultClockAddMarkEvent
KsiPropertyDefaultClockGetFunctionTable
KsiPropertyDefaultClockGetState
KsiPropertyDefaultClockGetResolution
KsiPropertyDefaultClockGetCorrelatedPhysicalTime
KsiPropertyDefaultClockGetCorrelatedTime
KsiPropertyDefaultClockGetPhysicalTime
KsiPropertyDefaultClockGetTime
KsSetDevicePnpAndBaseObject
KsAllocateDeviceHeader
KsSetDefaultClockTime
KsSetDefaultClockState
KsDereferenceSoftwareBusObject
KsAllocateObjectHeader
KsAllocateDefaultClock
KsReferenceSoftwareBusObject
KsFreeObjectHeader
KsFreeDefaultClock
KsFreeEventList
KsPropertyHandler
KsEnableEvent
KsDisableEvent
KsNullDriverUnload
KsSetMajorFunctionHandler
KsDefaultForwardIrp
KsDefaultDispatchPower
KsDefaultDispatchPnp
Name
.text
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=1, id=61, version=9210,
mspclock.sys
- IMPHASH 80ceafa87487c2a1e5e0a913df0055d1
- SHA256 0f663036bde76e786e3b069dff27d6a6e544cbc97a02ba22ef1fcb17f8b11859
- MD5 942eb6ee5fd88da98e742cf07f996311
- SHA1 0cbfbd61eea0db95d0269f9c2ec982774a65f416
- SHA512 c5c1f02d2201dfbbcef81dafdedcc730c3208d47f0ec601fc81f34cdeb0d9a7558065b187b78770c083f9cd777f4a03c7c9733c254c6b804b63a511f77fdc165
- SSDEEP 96:Hi0d6JH2pXqLumCF5BcklFraJowqOW3GWqos7:C9Ep6LumevD52W3GWqr7
- TLSH T1BDB174A2B3E86E05E0B62AB14CDF6617A2373C119D74EB020744477D3D2A910BD95B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2645
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mspclock.pdb
ntoskrnl.exe
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
IofCompleteRequest
ExFreePool
KeInitializeEvent
ExAllocatePoolWithTag
KeTickCount
ks.sys
KsiDefaultClockAddMarkEvent
KsiPropertyDefaultClockGetFunctionTable
KsiPropertyDefaultClockGetState
KsiPropertyDefaultClockGetResolution
KsiPropertyDefaultClockGetCorrelatedPhysicalTime
KsiPropertyDefaultClockGetCorrelatedTime
KsiPropertyDefaultClockGetPhysicalTime
KsiPropertyDefaultClockGetTime
KsSetDevicePnpAndBaseObject
KsAllocateDeviceHeader
KsSetDefaultClockTime
KsSetDefaultClockState
KsDereferenceSoftwareBusObject
KsAllocateObjectHeader
KsAllocateDefaultClock
KsReferenceSoftwareBusObject
KsFreeObjectHeader
KsFreeDefaultClock
KsFreeEventList
KsPropertyHandler
KsEnableEvent
KsDisableEvent
KsNullDriverUnload
KsSetMajorFunctionHandler
KsDefaultForwardIrp
KsDefaultDispatchPower
KsDefaultDispatchPnp
Name
.text
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=1, id=61, version=9210,
mstee.sys
- IMPHASH ba17250f7c9c0536bc777562ff599d7c
- SHA256 80ca6e69a8cc523b7920b2cff39c69e206fcf0393f3df5bd9cc45beed6ecbccd
- MD5 153781f3de3bafc3bad1db4da12206f4
- SHA1 7435bff27c6322ffba034cfb0c70dde27019ca3d
- SHA512 d251dd85e704ace4c99cb0ee5e01d695dd885f409f4ab091fb5ea540807b197b4bfa9214bf0d3bca73c2058fb2e46f57fb8fdc375cb220c1fba5e57428f5ded6
- SSDEEP 96:T/bd1iILzpAjlDG3Dp7eG8AvC7RTXiWJCW:rB1iILzpAjlDG3Dp7eG8AvKeWJCW
- TLSH T18FB17213B7F91E14F8E34A701CAB4B86A376FE615D32CB0B1554165E1E36984FC34B62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
3606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mstee.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
RtlCompareMemory
KeTickCount
ExFreePool
ks.sys
KsInitializeDriver
KsFilterGetFirstChildPin
_KsEdit
KsPinGetConnectedPinInterface
KsPinGetNextSiblingPin
KsPinGetParentFilter
KsFilterGetChildPinCount
Name
.rdata
Size
256B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
190B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=5, id=28, version=9178,
count=1, id=61, version=9210,
mswebdvd.dll
- IMPHASH 4d11507e5097e6d710ceb3f05f186072
- SHA256 f48981b54f788ca26791ac697191fe6204fe2de14fba8d6a7baa030142054065
- MD5 4bf36b57a5007ee3ab091580f3f5ee20
- SHA1 40e7ef92103bfa9e50d2937de90e167bc6422058
- SHA512 e8e497f7848b443dac728ceaaa7454b57f5423febe291aae96f6b5d2a2dfce7bf0b7c27f62ebcec7e3215d885820e8628fbcd162678a8b0b6b477b348f1f30b5
- SSDEEP 6144:qxhukzppcWReZks4eNkh2XWuV7FgxzszEH:VkzXcW8KsDNkh2m3h
- TLSH T1B864C301B3E9C226F1F32B345EBA539A5A77FD409E36811F2688131D1D72E84EA24777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
82583
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
GetCurrentProcessId
WaitForSingleObject
TerminateProcess
lstrcpynA
GetModuleHandleA
GetUserDefaultLangID
IsValidLocale
GetCurrentThreadId
GetShortPathNameA
CloseHandle
lstrcpyA
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetLocaleInfoA
LoadLibraryA
GetProcAddress
FreeLibrary
InterlockedIncrement
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
LoadLibraryExA
GetLastError
FindResourceA
LoadResource
SizeofResource
DisableThreadLibraryCalls
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameA
lstrcatA
HeapDestroy
IsDBCSLeadByte
lstrcmpiA
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
lstrlenW
EnterCriticalSection
LeaveCriticalSection
Sleep
GetVersionExA
GetSystemDirectoryA
SetEvent
ResetEvent
GetDriveTypeA
GetTickCount
FlushInstructionCache
WideCharToMultiByte
GetSystemTimeAsFileTime
msvcrt
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_vsnprintf
fwrite
fclose
_ui64tow
malloc
realloc
??3@YAXPAX@Z
??2@YAPAXI@Z
_CxxThrowException
wcslen
_ftol
__CxxFrameHandler
free
fopen
_purecall
gdi32
GetClipBox
GetDCOrgEx
CreateMetaFileA
SetWindowExtEx
CloseMetaFile
DeleteMetaFile
CreateDCA
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetTextColor
DeleteDC
RestoreDC
CreateSolidBrush
SelectObject
Rectangle
DeleteObject
GetNearestColor
GetDeviceCaps
GetSystemPaletteEntries
CreateRectRgnIndirect
SetBkColor
SetViewportOrgEx
user32
SetTimer
CharNextA
GetDC
PtInRect
UnionRect
GetKeyState
DestroyAcceleratorTable
SetWindowLongA
CallWindowProcA
EndPaint
BeginPaint
IsChild
GetFocus
RegisterClassExA
wsprintfA
GetClassInfoExA
SetFocus
ShowWindow
GetParent
SystemParametersInfoA
SetRect
GetSystemMetrics
IsIconic
GetWindowRect
InvalidateRgn
RegisterClassA
GetClassInfoA
PostMessageA
IsWindowVisible
GetWindowDC
ReleaseDC
KillTimer
DestroyCursor
DestroyWindow
LoadStringA
InvalidateRect
ShowCursor
GetWindow
CreateWindowExA
GetClientRect
IsWindow
GetDesktopWindow
MapWindowPoints
ClipCursor
LoadCursorA
IntersectRect
EqualRect
DrawTextA
SetCursor
DefWindowProcA
GetWindowLongA
SendMessageA
SetWindowPos
SetWindowRgn
OffsetRect
advapi32
RegDeleteKeyA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptGetHashParam
RegCreateKeyA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
ole32
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
ProgIDFromCLSID
oleaut32
SysAllocString
SysFreeString
SysAllocStringLen
SysStringLen
VariantClear
VariantCopy
VariantInit
SetErrorInfo
CreateErrorInfo
OleTranslateColor
VariantChangeTypeEx
LoadRegTypeLi
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
VariantChangeType
SysStringByteLen
OleCreatePropertyFrame
SysAllocStringByteLen
comctl32
ord17
comdlg32
GetSaveFileNameA
shell32
SHGetSpecialFolderPathA
winmm
mixerSetControlDetails
mixerGetLineControlsA
mixerGetLineInfoA
mciSendCommandA
mixerGetControlDetailsA
mixerGetNumDevs
mixerOpen
mixerClose
ddraw
DirectDrawCreate
quartz
AMGetErrorTextA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
135KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=23, id=25, version=9210,
count=218, id=1, productName=Unmarked objects,
count=12, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=19, id=29, version=9178,
count=1, id=61, version=9210,
pid.dll
- IMPHASH c187922ee464a7248fc84c24ac38332b
- SHA256 77a43acfab4facb9cb2b007fd9728fbbf3d3b2eaa40de49d09ad65b954830821
- MD5 fd482c36948bf9c3a771df499db42ccd
- SHA1 9d28d35436aad5fa8937ff1f0beaa7d2821077b4
- SHA512 a419f4778c621ff486768c3b5a5ef958bdecde499ea8e21dded6c170319346ea27a3ca5893b20154740eae62bda3446b1b25a90e798a4f231cfa79818de3d1f5
- SSDEEP 384:wFThZ3AECW5r6vxw5ky9yD5/jQdTZsf+bxgOQ1Mw5FUClfTNDGpOWuCeW:uT/3vt5rWxwbI6s2UJDDat
- TLSH T117033B00FDFD95F7E2B2567059C27BB2B37C46280634A98A57D41C467CB0DA1A73B683
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7233
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetEvent
ResetEvent
WaitForMultipleObjects
MulDiv
ReleaseMutex
WaitForSingleObject
FreeLibrary
LoadLibraryA
CreateThread
CreateEventA
WriteFile
CreateFileA
Sleep
GetVersionExA
GetVersion
IsBadReadPtr
WriteFileEx
ReadFileEx
FreeLibraryAndExitThread
RtlUnwind
GetLastError
UnmapViewOfFile
DeleteCriticalSection
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
InitializeCriticalSection
CreateMutexA
CreateFileMappingA
CloseHandle
MapViewOfFile
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
lstrlenA
lstrcpyA
LocalReAlloc
LocalAlloc
GetModuleFileNameA
LocalFree
advapi32
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
user32
PeekMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
wsprintfA
MsgWaitForMultipleObjectsEx
hid
HidP_GetSpecificValueCaps
HidP_GetSpecificButtonCaps
HidP_SetUsageValueArray
HidP_GetUsages
HidP_SetUsageValue
HidP_GetCaps
HidD_GetPreparsedData
HidD_GetAttributes
HidD_FreePreparsedData
HidP_SetScaledUsageValue
HidD_SetFeature
HidP_GetScaledUsageValue
HidD_GetFeature
HidP_GetLinkCollectionNodes
HidP_SetUsages
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
950B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=25, version=9210,
count=68, id=1, productName=Unmarked objects,
count=3, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=17, id=28, version=9178,
count=1, id=61, version=9210,
qasf.dll
- IMPHASH 8f4c83c3afc22965cc8f4de6d7a2646e
- SHA256 dbe75bc63d87a31400eda171474a77184cb3e2a63a29d25890cc3ab63a867945
- MD5 1ed1d6f8ebbfea5dfa67c132d1ee4de0
- SHA1 95be91a97cd57f01ef0a1a8b4eb1e687e4643517
- SHA512 eb4670f4463b5cc9c7c97a75e00a6cfb10c16bb8285a8d61e5fa61e93e63ceb1e6db1ddadd46c4f9bc9967e7fe606a5e7be7bcafef62a230f5cc87f612a9ce70
- SSDEEP 3072:Ief8RCkl8QrkCLJUc6mxbgS5hPrjDlXuo83e7wpVrmVepAZ/NRFJkgzef8BOaQec:IDziQrkmVgS5FjDlXBeWwpYVeInJk6u
- TLSH T199045C02B3F6B075E1F3623ADA79B33FB379BB255621D61A06044F192E71680E92C717
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13504
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetDiskFreeSpaceA
TerminateProcess
GetSystemTimeAsFileTime
GlobalMemoryStatus
QueryPerformanceCounter
CreateThread
GetTickCount
GetLocalTime
GetComputerNameA
DeviceIoControl
GetModuleHandleW
LocalAlloc
LocalFree
GetCurrentProcessId
DisableThreadLibraryCalls
SetThreadPriority
InterlockedExchange
GetACP
WideCharToMultiByte
GetModuleHandleA
GetProcAddress
VirtualAlloc
CreateSemaphoreA
GetCurrentThreadId
GetCurrentProcess
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
ResetEvent
SetEvent
CreateEventA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetModuleFileNameA
GetLastError
MultiByteToWideChar
lstrlenA
GetVersionExA
RaiseException
msvcrt
wcslen
wcscpy
wcscat
_purecall
swprintf
_ftol
_except_handler3
??2@YAPAXI@Z
_wtoi
??3@YAXPAX@Z
gdi32
GetTextExtentPointA
user32
wsprintfA
wvsprintfA
GetDesktopWindow
GetWindowRect
LoadStringW
DefWindowProcA
DestroyWindow
ShowWindow
InvalidateRect
MoveWindow
CreateDialogParamA
SetWindowLongA
GetWindowLongA
GetDlgItem
GetDC
ReleaseDC
SendMessageA
LoadStringA
advapi32
RegCreateKeyExA
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryValueExA
GetUserNameA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
oleaut32
SysAllocStringLen
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=3, id=29, version=8923,
count=7, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=23, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=14, version=7299,
count=8, productName=Unmarked objects (old),
count=13, id=25, version=9210,
count=143, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=24, id=29, version=9178,
count=1, id=61, version=9210,
qcap.dll
- IMPHASH 3337a976f7a833f6793dfd25785c3a1b
- SHA256 c1904469e7205e5b4df76852fc9d19a6ca0a5f4027b80b189687ffd73b77a14c
- MD5 cd010950bfcdc2d8e54aaeb6ad9a883a
- SHA1 1d426c8b5d0fc95ead0ebeeb0b2b15b7f8190a50
- SHA512 8532a4041b121b3bdbdd4fbf54d66f3d4a27422c4263242067b44e13ac52e8910f921b26e5c437fa41658193a0e4654b8a9a405309e375b3301eaa537cd93387
- SSDEEP 6144:KzsODAYsFv9ts0Ya2o8eGorvMExxKog6/s:zODA719tlYgrvMEz8
- TLSH T135443A01A3F5C03BF1F31B355EF977A65A7AFD005A28C80F9A82278D1975A04DA29737
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19012
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TerminateProcess
GetCurrentProcess
GetProcAddress
GetDiskFreeSpaceA
ReadFile
GetFileSize
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
CreateIoCompletionPort
DeleteFileA
GetFullPathNameA
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateFileA
GetModuleHandleA
WriteFile
SetEndOfFile
lstrcmpA
IsBadCodePtr
IsBadHugeReadPtr
lstrcpynW
GetFileAttributesW
IsBadWritePtr
HeapFree
GetProcessHeap
HeapAlloc
lstrcmpiW
lstrcpyW
GetPrivateProfileStringW
IsBadReadPtr
GlobalMemoryStatus
GetProfileIntA
GlobalAlloc
GlobalLock
GlobalHandle
GlobalFree
GlobalUnlock
MulDiv
GetModuleFileNameA
lstrcpyA
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
lstrlenA
WideCharToMultiByte
SetFilePointer
MultiByteToWideChar
VirtualAlloc
VirtualFree
GetSystemInfo
ReleaseSemaphore
InterlockedDecrement
FreeLibrary
InterlockedIncrement
CreateSemaphoreA
CreateThread
GetLastError
WaitForMultipleObjects
GetCurrentThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
ResetEvent
SetEvent
GetACP
CloseHandle
CreateEventA
GetVersionExA
msvcrt
_ftol
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
_except_handler3
gdi32
GetObjectA
GetPaletteEntries
GetStockObject
SelectObject
PatBlt
GetTextExtentPoint32A
user32
GetDlgItemInt
GetDesktopWindow
IsRectEmpty
SetDlgItemTextA
EnableWindow
GetDlgItem
SetDlgItemInt
ReleaseDC
ClientToScreen
GetClientRect
GetDC
IsWindowVisible
IsWindow
wsprintfW
SetCursor
LoadCursorA
GetAsyncKeyState
CheckRadioButton
CheckDlgButton
SendMessageA
wsprintfA
wvsprintfA
GetWindowRect
LoadStringW
DefWindowProcA
DestroyWindow
ShowWindow
InvalidateRect
MoveWindow
CreateDialogParamA
SetWindowLongA
GetWindowLongA
PeekMessageA
DispatchMessageA
TranslateMessage
LoadStringA
advapi32
RegEnumKeyW
RegOpenKeyW
RegCreateKeyW
RegCreateKeyA
RegSetValueA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryValueExW
ole32
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
CoInitialize
StringFromGUID2
CoFreeUnusedLibraries
CoTaskMemFree
oleaut32
SafeArrayAccessData
VariantClear
SysAllocString
SafeArrayUnaccessData
SysFreeString
SysStringLen
msvfw32
ICCompress
ICDecompress
ICGetInfo
ICOpen
ICClose
ICSendMessage
ICLocate
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
mixerOpen
mixerClose
waveInStop
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInUnprepareHeader
mixerSetControlDetails
mixerGetID
mixerGetLineInfoA
mixerGetLineControlsA
waveInGetDevCapsA
waveInReset
waveInClose
waveInOpen
CloseDriver
OpenDriver
SendDriverMessage
mixerGetControlDetailsA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
155KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=10, id=64, version=9210,
count=17, id=25, version=9210,
count=213, id=1, productName=Unmarked objects,
count=11, id=28, version=9178,
count=1, id=63, version=9210,
count=37, id=29, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
qdv.dll
- IMPHASH 97b9a2e3ba597b131681d3171e64a371
- SHA256 47260a466e2707d7ccbaf19af3da194d6e1204686f370381259d067efe2fbe3a
- MD5 447e0133931b0f3add968778eabfc749
- SHA1 f2e560d9abd86da9d8b1cf2e4d84a726eaee2d2d
- SHA512 a80b9ef489d6a22ddb896600d4c3b00238076bd44bdc09cdfa4c5e2412399c1128449723083f4bbc3fa48b90195073ccc49e2819062ae1b1bec55cc3e440988b
- SSDEEP 6144:22dbHypRQkaUGpjN0koa+ASweo2wbItweo1weorB3LzlwF1IXuZJyzOGk1hPFqBI:22tHypCKkkB3OI+f+6N
- TLSH T1D5648E6363A6D62BE0A1447A95FF237D2AB9BF20C615988787C1357D3C706428B3335B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10397
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
??2@YAPAXI@Z
_purecall
_ftol
_except_handler3
??3@YAXPAX@Z
user32
LoadStringW
GetDesktopWindow
GetWindowLongA
LoadStringA
IsRectEmpty
IsDlgButtonChecked
SendDlgItemMessageA
CheckRadioButton
wvsprintfA
wsprintfA
SetWindowLongA
CreateDialogParamA
MoveWindow
InvalidateRect
ShowWindow
DestroyWindow
DefWindowProcA
GetWindowRect
advapi32
RegEnumKeyExA
RegQueryValueExA
RegCreateKeyExA
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
ole32
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
msvfw32
StretchDIB
winmm
timeGetTime
kernel32
GetACP
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetVersionExA
DisableThreadLibraryCalls
lstrlenA
MultiByteToWideChar
GetLastError
GetModuleFileNameA
InterlockedIncrement
FreeLibrary
InterlockedDecrement
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateEventA
SetEvent
ResetEvent
WaitForSingleObject
ReleaseSemaphore
GetCurrentProcess
GetCurrentThreadId
CreateSemaphoreA
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
InterlockedExchange
SetThreadPriority
GetTickCount
CreateThread
MulDiv
lstrcpyA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
226KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=95, version=2122,
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, id=64, version=9210,
count=15, id=25, version=9210,
count=139, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=27, id=29, version=9178,
count=1, id=61, version=9210,
qdvd.dll
- IMPHASH a260af3493591a91b9363a8954d4c9a7
- SHA256 f35494be95ef2d5fd010812d74e610bddb1d1a76361e985c52d2242c70cf4d63
- MD5 12b5dd2309b2f3b8f81f1dad4c377cfe
- SHA1 9b5e4993afa4855de8d5691d824c5be0c68a0171
- SHA512 6e73d9245e8d5a8ce7f64193f4b154031dbc3012ec4fd67db196db4a1ed9e639b90af9cebe188422eb2a5681637514bea038415b73ad987f01b3080235c6a1e2
- SSDEEP 6144:zD1iTijdQqnQspPn98cmYlKyxkd5iJBacLMvD/6zK/8PJfnwVprYdbF:fbXQsE9YGi7ac4vDSC8Kh
- TLSH T17D947D22B3FAD036E5F323348D7D677666BAB910163C8809B3450A4D3A71A11D62F7B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
41438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVolumeInformationA
SetWaitableTimer
CreateWaitableTimerA
SetFilePointer
ReadFile
FindCloseChangeNotification
GetLocaleInfoA
IsValidLocale
FindNextFileA
DeviceIoControl
GetOverlappedResult
TerminateProcess
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
FindFirstFileA
FindClose
GetDriveTypeA
GetFileAttributesA
GetUserDefaultLCID
GetComputerNameA
VirtualAlloc
VirtualFree
GetSystemInfo
ReleaseSemaphore
CreateSemaphoreA
CreateThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
GetACP
IsBadReadPtr
IsBadWritePtr
HeapFree
SetLastError
GetVersionExA
WaitForMultipleObjects
ResetEvent
CreateEventA
lstrcmpA
SetEvent
Sleep
GetFullPathNameA
SetErrorMode
LoadLibraryA
MulDiv
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
CreateFileA
GetFileSize
CreateFileMappingA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
lstrcpynA
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThread
GetModuleFileNameA
lstrcatA
lstrcpyA
GlobalFree
HeapDestroy
WaitForSingleObject
CloseHandle
GetLastError
GetCurrentThreadId
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
GetProcessHeap
HeapAlloc
GetCurrentProcess
FlushInstructionCache
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
msvcrt
??3@YAXPAX@Z
realloc
??2@YAPAXI@Z
free
_purecall
_ftol
qsort
_except_handler3
malloc
gdi32
CreateCompatibleBitmap
GetDIBits
SetBkMode
ExtTextOutW
CreateFontIndirectA
GetTextMetricsA
EnumFontFamiliesExA
GetSystemPaletteEntries
SetBkColor
CreateRectRgnIndirect
CreateDCA
GetDeviceCaps
DeleteMetaFile
CloseMetaFile
RestoreDC
SetWindowExtEx
SetWindowOrgEx
SaveDC
CreateMetaFileA
DeleteDC
SetViewportOrgEx
SetMapMode
LPtoDP
SetPixel
GetPixel
GetStockObject
GetObjectA
CreateDIBSection
DeleteObject
StretchBlt
BitBlt
SelectObject
StretchDIBits
SetDIBitsToDevice
GetRegionData
FillRgn
OffsetRgn
CreateSolidBrush
CombineRgn
GdiFlush
SetStretchBltMode
CreateCompatibleDC
CreateRectRgn
GetDCOrgEx
GetClipBox
SetTextColor
user32
SetDlgItemInt
SetDlgItemTextA
CheckRadioButton
EnableWindow
DrawTextA
IsIconic
GetWindowPlacement
GetQueueStatus
PostThreadMessageA
SetRectEmpty
RegisterWindowMessageA
PostMessageA
ScreenToClient
FillRect
SetRect
ClientToScreen
IsWindowVisible
IsRectEmpty
InvalidateRect
IsWindow
DestroyWindow
ShowWindow
SetFocus
LoadStringA
UnionRect
PtInRect
CheckDlgButton
CreateWindowExA
GetWindowLongA
CallWindowProcA
CharNextA
PeekMessageA
DispatchMessageA
TranslateMessage
MsgWaitForMultipleObjects
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
EndPaint
GetClientRect
BeginPaint
ReleaseDC
GetDC
GetDlgItem
SendMessageA
MapWindowPoints
SystemParametersInfoA
GetWindowRect
GetParent
GetSystemMetrics
GetDlgItemInt
IsDlgButtonChecked
KillTimer
SetTimer
GetWindowThreadProcessId
UnregisterClassA
SendMessageTimeoutA
RegisterClassA
GetClassInfoA
wvsprintfA
GetDesktopWindow
LoadStringW
MoveWindow
DefWindowProcA
CreateDialogParamA
SetWindowLongA
RegisterClassExA
wsprintfA
LoadCursorA
GetClassInfoExA
advapi32
RegDeleteKeyA
RegQueryInfoKeyA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyA
RegSetValueA
GetUserNameA
RegOpenKeyA
ole32
CoCreateInstance
CreateOleAdviseHolder
WriteClassStm
OleLoadFromStream
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
StringFromCLSID
IIDFromString
CoUninitialize
CoInitialize
StringFromGUID2
CoFreeUnusedLibraries
OleSaveToStream
oleaut32
VarI4FromStr
SetErrorInfo
LoadRegTypeLi
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
VariantInit
SysFreeString
GetActiveObject
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
winmm
timeKillEvent
timeSetEvent
timeGetTime
timeEndPeriod
timeBeginPeriod
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
321KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=10, id=64, version=9210,
count=15, id=25, version=9210,
count=322, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=102, id=29, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
qedit.dll
- IMPHASH 51e14b0e14b99f0d308a0f89a9c28b0f
- SHA256 49119166b29bd381f1fc032493a53e6d5cc1a8820c8a74f69e15613788b44fd9
- MD5 8f32b2b0a0949d6d1d2edf94ff484037
- SHA1 fcafbf4e36cf2d61833e73aa1a167f30caeb2403
- SHA512 f336a7a13b822b145587e2208bd57a728fad32d75fcb5c01f2db9f6afe1741cd0d0ba6e7cb8f5e214d5f6687d8ee4fb0a66eab617f656d093d4a55846338ea45
- SSDEEP 12288:8Q2if/l89jLqQdJRM6Mh8IN1mk/3EyY5svTd7m+BBBBBBBBBBBBBBBBSoJNWjOV:z3SRL7V3I1l/3EyisvT0LoJUi
- TLSH T17D850952F3C6C5A3C05E02304C7B6BD62F71B9015E26AB1B7B09578E2EB23D5B6057E2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
52978
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteFileA
GetSystemDirectoryA
GetFileTime
GetFileType
GetCurrentDirectoryA
TerminateProcess
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
MulDiv
LockResource
GetModuleHandleA
CreateFileA
GetFileSize
GetFullPathNameA
WriteFile
GlobalFree
CompareStringA
SetFilePointer
ReadFile
Sleep
lstrcatW
VirtualAlloc
VirtualFree
GetSystemInfo
ReleaseSemaphore
LoadLibraryA
CreateSemaphoreA
CreateThread
GetVersionExA
WaitForMultipleObjects
GetThreadPriority
SetThreadPriority
InterlockedExchange
ResetEvent
SetEvent
GetACP
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
lstrcpynA
CreateMutexA
DisableThreadLibraryCalls
CreateEventA
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThread
ReleaseMutex
GetModuleFileNameA
lstrcatA
lstrcpyA
HeapDestroy
WaitForSingleObject
CloseHandle
GetLastError
GetCurrentThreadId
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
msvcrt
??2@YAPAXI@Z
malloc
wcspbrk
wcstoul
wcsncmp
wcscat
srand
rand
_vsnwprintf
_splitpath
_wsplitpath
wcscmp
sprintf
_iob
fprintf
exit
fread
_setjmp3
fopen
fclose
longjmp
_purecall
free
_wtoi
realloc
??3@YAXPAX@Z
atof
_ftol
wcscpy
wcslen
gdi32
DeleteObject
CreateCompatibleDC
SetStretchBltMode
StretchBlt
CreateDIBSection
GetObjectA
CreateFontIndirectA
SelectObject
GetTextMetricsA
GetTextExtentPointA
DeleteDC
GetDeviceCaps
user32
LoadStringA
EndDialog
DefWindowProcA
wsprintfA
GetWindowTextLengthA
GetWindowTextA
SetWindowLongA
GetWindowRect
GetDesktopWindow
LoadStringW
GetWindowLongA
CharNextA
ShowWindow
DispatchMessageA
MsgWaitForMultipleObjects
SetWindowPos
ReleaseDC
GetDC
GetDlgItem
DestroyWindow
IsWindow
InvalidateRect
MoveWindow
WinHelpA
IsDialogMessageA
CreateDialogParamA
GetDialogBaseUnits
wvsprintfA
PostThreadMessageA
RegisterWindowMessageA
GetQueueStatus
MessageBoxA
GetDlgItemTextA
SetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
CheckRadioButton
IsDlgButtonChecked
IsRectEmpty
CharPrevA
PeekMessageA
advapi32
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteKeyA
RegSetValueExA
RegEnumKeyExA
RegDeleteValueA
RegSetValueA
RegCreateKeyA
RegQueryValueA
RegOpenKeyA
RegEnumValueA
RegOpenKeyExA
ole32
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
OleLoadFromStream
CreateStreamOnHGlobal
CreateBindCtx
StringFromGUID2
StringFromCLSID
CoUninitialize
CoInitialize
CoFreeUnusedLibraries
CLSIDFromString
StgCreateDocfile
CoCreateFreeThreadedMarshaler
StgOpenStorage
oleaut32
VariantChangeTypeEx
VarI4FromStr
LoadTypeLi
SetErrorInfo
LoadRegTypeLi
SysAllocString
VariantCopy
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
RegisterTypeLi
msvfw32
DrawDibOpen
DrawDibDraw
DrawDibClose
winmm
timeGetTime
timeSetEvent
timeEndPeriod
timeBeginPeriod
timeKillEvent
comdlg32
GetOpenFileNameA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
405KB
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, id=64, version=9210,
count=17, id=25, version=9210,
count=294, id=1, productName=Unmarked objects,
count=42, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=89, id=29, version=9178,
count=1, id=61, version=9210,
qedwipes.dll
- SHA256 d8e42d2bd31683d65590bd0ecfd20ec922d5a880165971ea3f6a035be7659db8
- MD5 ac7f9f480735199ccaeb1ad627de39f7
- SHA1 ece73ce8d1f5ddc1a355245a9dd2d2e36c52a308
- SHA512 6b866bf265e627a2e7252b3e6148ebe04c51ebf3783ef76bb7d309581753747246876efa1c76cd6ddd93a55f9bdc0146bb2c7811e1ef7db9144abb2972816bd8
- SSDEEP 12288:SHHhsO4j/aBz5ge6BbeZ2gnzM6MNCTs17pfST8iypSovFLBs5nrSi/7F:SHH6GzaD5Fi5rSi/7F
- TLSH T1B6F4CF0FAF725C56CCE8433006A93275D7189A76AFEFD68C7469AB3E5C1044B947A02E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
715KB
Virtual Size
714KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=69, version=9111,
count=1, id=61, version=9210,
quartz.dll
- IMPHASH 362d13b1fcdff8b6b203ca20e4836ecd
- SHA256 a37c3091e59e7665350750984bd3212b18ea33b5ad86f295a482cab7e4b33610
- MD5 4bbc9e6c937b7a2655a0b9ad7db5fb88
- SHA1 19c2a5cde492886b9eec42e7b69ab697153ff085
- SHA512 5bbea8666774f067df0e6ebe766bb4160f96b5f1cd49867f7f1281da029e5fd9e03c5fcfbfab472b775d01d70f27ebc38aae8e627f25fa2ee1d51eee78c58fb8
- SSDEEP 24576:HVWdrcT/FiqYpmb4EgitdR2JWbW3K0NkISLtT:1WGTNiqYY8ditgK0y5pT
- TLSH T17885D60237FA8166F1F36B35687953A25E3A7D91A939D20D5380A25E2DB1E50CE31F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
343617
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetShortPathNameA
GetExitCodeProcess
GetFullPathNameA
WriteFile
QueryPerformanceFrequency
ReleaseMutex
CreateMutexA
HeapDestroy
FreeLibraryAndExitThread
Sleep
CreateFileA
lstrcpyA
lstrcatA
MulDiv
ReadFile
FormatMessageA
FormatMessageW
CreateThread
GetCurrentThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
GetACP
WideCharToMultiByte
LoadLibraryA
FreeLibrary
GetLastError
lstrlenA
GetVersionExA
VirtualAlloc
CreateSemaphoreA
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
SetEvent
CreateEventA
CloseHandle
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MapViewOfFileEx
GetProfileIntA
GetProfileStringA
GetPrivateProfileStringA
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
LocalAlloc
LocalFree
RaiseException
HeapAlloc
GetProcessHeap
HeapFree
WriteProfileStringA
GetDiskFreeSpaceA
CompareStringA
lstrcmpA
lstrcpynA
IsBadWritePtr
IsBadReadPtr
GetDriveTypeA
GetFileSize
SetErrorMode
LocalUnlock
LocalLock
LocalReAlloc
SetFilePointer
DeviceIoControl
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleFileNameA
MultiByteToWideChar
OpenProcess
lstrcmpiA
msvcrt
??3@YAXPAX@Z
_ftol
free
_initterm
??2@YAPAXI@Z
_adjust_fdiv
__dllonexit
_ltow
wcslen
towupper
memmove
atoi
getenv
sscanf
_except_handler3
sprintf
wcscpy
malloc
_onexit
_wtoi
_strdup
gdi32
GdiFlush
SetPixel
GetPixel
ExtTextOutA
SetBkColor
SelectPalette
FillRgn
CombineRgn
CreateRectRgnIndirect
CreatePalette
GetStockObject
GetTextExtentPoint32A
SetTextColor
SetBkMode
BitBlt
CreateDIBSection
EnumFontFamiliesExA
ExtTextOutW
SetTextCharacterExtra
StretchBlt
RealizePalette
GetObjectA
StretchDIBits
SetDIBColorTable
SetStretchBltMode
GetDeviceCaps
DeleteObject
GetDCOrgEx
EqualRgn
ExtCreateRegion
CreateRectRgn
CreateFontIndirectA
GetSystemPaletteEntries
GetDIBits
PatBlt
CreateSolidBrush
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
SetDIBitsToDevice
GetClipBox
user32
SendMessageA
GetWindowThreadProcessId
LoadStringA
SetTimer
KillTimer
IsWindow
InSendMessage
SetRect
GetDC
GetSystemMetrics
IsWindowVisible
IsRectEmpty
SendDlgItemMessageA
EndDialog
DialogBoxParamA
GetDlgItem
MessageBoxA
SystemParametersInfoA
GetDlgItemInt
EnableWindow
GetWindowRect
UnhookWindowsHookEx
InvalidateRect
SetWindowsHookExA
GetWindowPlacement
IsIconic
IntersectRect
OffsetRect
ClientToScreen
GetClientRect
SetRectEmpty
MapWindowPoints
ScreenToClient
GetParent
GetWindowLongA
GetDesktopWindow
EndPaint
BeginPaint
SetCursor
DestroyCursor
ReleaseDC
GetMessageA
TranslateMessage
DestroyWindow
PostMessageA
ReplyMessage
CharNextA
DispatchMessageA
GetQueueStatus
RegisterWindowMessageA
PostThreadMessageA
wvsprintfA
MsgWaitForMultipleObjects
PeekMessageA
wsprintfA
AdjustWindowRectEx
DefWindowProcA
CreateWindowExA
RegisterClassA
LoadCursorA
GetClassInfoA
LoadStringW
EqualRect
CreateDialogParamA
SetDlgItemTextA
SetParent
IsZoomed
SetWindowLongA
FillRect
ChangeDisplaySettingsExA
GetWindowTextA
SetWindowTextA
MoveWindow
SetForegroundWindow
ShowWindow
GetForegroundWindow
SetWindowPos
UpdateWindow
GetKeyboardState
SetKeyboardState
LoadImageA
advapi32
RegFlushKey
RegCreateKeyExA
RegQueryInfoKeyA
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegQueryValueA
ole32
CLSIDFromString
CreateBindCtx
CoCreateFreeThreadedMarshaler
MkParseDisplayName
CreateStreamOnHGlobal
StgOpenStorage
StgIsStorageFile
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
CoCreateInstance
oleaut32
LoadRegTypeLi
VariantChangeType
VariantCopy
VariantInit
SysAllocStringLen
SysStringLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysReAllocString
SetErrorInfo
winmm
waveOutGetVolume
waveOutSetVolume
waveOutWrite
waveOutUnprepareHeader
waveOutRestart
waveOutReset
waveOutPrepareHeader
waveOutPause
waveOutOpen
waveOutGetPosition
waveOutGetErrorTextA
waveOutGetDevCapsA
waveOutClose
waveOutGetNumDevs
midiOutReset
midiStreamOpen
midiStreamProperty
midiOutGetNumDevs
mixerGetNumDevs
mixerGetLineInfoA
mixerGetDevCapsA
mixerGetLineControlsA
mixerSetControlDetails
mixerGetControlDetailsA
midiStreamOut
midiOutUnprepareHeader
midiStreamRestart
midiOutPrepareHeader
midiStreamPause
midiStreamPosition
midiOutGetErrorTextA
midiStreamClose
timeKillEvent
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeSetEvent
timeGetTime
rpcrt4
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleAllocate
NdrClientCall2
NdrOleFree
AMGetErrorTextA
AMGetErrorTextW
AmpFactorToDB
DBToAmpFactor
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
902KB
Virtual Size
902KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
503B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
73KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
772KB
Virtual Size
772KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, productName=Unmarked objects (old),
count=12, id=64, version=9210,
count=15, id=25, version=9210,
count=399, id=1, productName=Unmarked objects,
count=92, id=28, version=9178,
count=1, id=63, version=9210,
count=166, id=29, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
quartz.vxd
- SHA256 6a9c8114aec8c5030ba843ca06c802f91fbe2201e492dd844b67f92ebb3c2a3f
- MD5 f318e151801f7eb505894718e03bc438
- SHA1 7e5127e0e188d33f1010710381121c4b7b103fe0
- SHA512 53f72e9f6e6709bde2a53ac12902198eb23db9ad14f018673a64dc733324249ee96866dd1851f48f25260f0d03ae95bc6e8d162684096160c75afac3125afc4b
- SSDEEP 24:etGSf+r0totnjnnSfj/PfWjwxdADCRmDXojRzNIjiZfNm:6mwtqjcDPKwxWDCRmDcZIjKVm
- TLSH T12FC1F095B324AD5BC10E53BA06E35B407B30FB4A0707CFCB5481D2646E316D89BB647E
- MD5 SHA1 SHA512 SSDEEP TLSH
stream.sys
- IMPHASH c1134fdb9e503ad5d0b7e607ebcafde9
- SHA256 3799b51c0e3047d42e614f93e80e95d46b8f4afa9d4ed6fe60b2a664a804787c
- MD5 e2e88ac2200da5b39d97dc5adc862ddb
- SHA1 7b39819afc077a15c777e64740cb723bf1601d3b
- SHA512 cc3fc33d84229cc331df3cf861db749322952a905bc21e4510f709996e3a1fffd8354b4543871ada45cbea58e394018498a3a06649607bfe21e8bb6c532c1cc0
- SSDEEP 768:yam5moq9Zwo36rJhuhf9bTZ7ZrKMiU2w9VNFJ8UbXLfjtspK6R1m:y5k9GM6V0B9BZn2qVvJr/5spB1m
- TLSH T1F3236D13B3D404B6D5E312F0AA1A272BF37B3F03561EE77B42704D652B69950BD292A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
39429
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
stream.pdb
ntoskrnl.exe
MmMapLockedPages
KefAcquireSpinLockAtDpcLevel
IoFreeMdl
ExAllocatePoolWithTag
IoAllocateMdl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeSetEvent
InterlockedDecrement
IoFreeIrp
IofCompleteRequest
IoCancelIrp
ZwQueryValueKey
RtlInitUnicodeString
KeWaitForSingleObject
ExFreePool
IoBuildSynchronousFsdRequest
KeInitializeEvent
MmResetDriverPaging
KeSetTimer
KeCancelTimer
ExQueueWorkItem
PoRequestPowerIrp
InterlockedIncrement
PoCallDriver
MmMapIoSpace
ZwClose
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
sprintf
IoOpenDeviceRegistryKey
IoAllocateIrp
MmBuildMdlForNonPagedPool
InterlockedExchange
IofCallDriver
MmPageEntireDriver
IoGetDriverObjectExtension
IoBuildDeviceIoControlRequest
KeResetEvent
PoStartNextPowerIrp
ZwSetValueKey
IoOpenDeviceInterfaceRegistryKey
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
IoStopTimer
MmUnmapIoSpace
IoDisconnectInterrupt
wcscpy
wcslen
IoCreateDevice
ObfReferenceObject
ZwEnumerateKey
ZwOpenKey
_snwprintf
swprintf
IoGetDeviceProperty
RtlIntegerToUnicodeString
IoStartTimer
IoConnectInterrupt
KeSynchronizeExecution
IoGetDmaAdapter
KeInitializeTimer
KeInitializeDpc
KeInitializeSpinLock
IoDetachDevice
IoDeleteDevice
IoInitializeTimer
IoAttachDeviceToDeviceStack
IoAllocateDriverObjectExtension
DbgBreakPoint
IoGetDeviceInterfaces
KeDelayExecutionThread
ObfDereferenceObject
ProbeForRead
KeInsertQueueDpc
IoReleaseCancelSpinLock
memmove
ObReferenceObjectByHandle
IoFileObjectType
ExGetPreviousMode
IoGetRelatedDeviceObject
KeTickCount
KeBugCheckEx
KefReleaseSpinLockFromDpcLevel
RtlUnwind
hal
KfLowerIrql
KeQueryPerformanceCounter
KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
ks.sys
KsUnserializeObjectPropertiesFromRegistry
KsDiscardEvent
KsAllocateExtraData
KsProbeStreamIrp
KsFreeObjectHeader
KsAllocateObjectHeader
KsUnregisterWorker
KsRegisterWorker
KsDispatchIrp
KsAddIrpToCancelableQueue
KsRemoveIrpFromCancelableQueue
KsFreeDeviceHeader
KsAllocateDeviceHeader
KsNullDriverUnload
KsGenerateEventList
KsGenerateEvent
KsCacheMedium
KsDispatchFastReadFailure
KsDispatchFastIoDeviceControlFailure
KsDispatchInvalidDeviceRequest
KsPropertyHandler
KsEnableEvent
KsDisableEvent
KsMethodHandler
KsPinPropertyHandler
KsCreateDefaultAllocator
KsSynchronousIoControlDevice
KsTopologyPropertyHandler
KsStreamIo
KsQueueWorkItem
KsSetTargetDeviceObject
KsFreeEventList
KsValidateClockCreateRequest
KsValidateConnectRequest
KsPinDataIntersection
DllInitialize
DllUnload
StreamClassAbortOutstandingRequests
StreamClassCallAtNewPriority
StreamClassCompleteRequestAndMarkQueueReady
StreamClassDebugAssert
StreamClassDebugPrint
StreamClassDeviceNotification
StreamClassFilterReenumerateStreams
StreamClassGetDmaBuffer
StreamClassGetNextEvent
StreamClassGetPhysicalAddress
StreamClassLogError
StreamClassPnPAddDeviceWorker
StreamClassQueryMasterClock
StreamClassQueryMasterClockSync
StreamClassReadWriteConfig
StreamClassReenumerateStreams
StreamClassRegisterAdapter
StreamClassRegisterFilterWithNoKSPins
StreamClassScheduleTimer
StreamClassStreamNotification
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
896B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=126, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=6, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
stream98.sys
- IMPHASH c1134fdb9e503ad5d0b7e607ebcafde9
- SHA256 d36075272be0910a5c82b853528ccb8b31a904bd4d52dd1579cdb54986392437
- MD5 921f01b01aee083e9979b4738441c314
- SHA1 64459a521edf7abd5c13f47e7bdd02d3439070c3
- SHA512 b45a6c3bad62064fb7c829b0349b91b2c2f3dc75d4a87189fd6aaa474a4c523b92e656b1d11eb5ae6b1fd47ab3a2170163a544ecfa628e21553a290d36556105
- SSDEEP 768:lqm5Wo9pwo36UDOJmJ69bbZKrKMiX2Y9VNt23UpDHwfDPspK6Rc4z:D5X92M6CO0Q90U2SVn2EpcrspBd
- TLSH T16B237D12B3D404B6D5E302F0AA1A272BF3BB7F03561EE77B42704D652B699507D292A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
39429
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
stream.pdb
ntoskrnl.exe
MmMapLockedPages
KefAcquireSpinLockAtDpcLevel
IoFreeMdl
ExAllocatePoolWithTag
IoAllocateMdl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeSetEvent
InterlockedDecrement
IoFreeIrp
IofCompleteRequest
IoCancelIrp
ZwQueryValueKey
RtlInitUnicodeString
KeWaitForSingleObject
ExFreePool
IoBuildSynchronousFsdRequest
KeInitializeEvent
MmResetDriverPaging
KeSetTimer
KeCancelTimer
ExQueueWorkItem
PoRequestPowerIrp
InterlockedIncrement
PoCallDriver
MmMapIoSpace
ZwClose
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
sprintf
IoOpenDeviceRegistryKey
IoAllocateIrp
MmBuildMdlForNonPagedPool
InterlockedExchange
IofCallDriver
MmPageEntireDriver
IoGetDriverObjectExtension
IoBuildDeviceIoControlRequest
KeResetEvent
PoStartNextPowerIrp
ZwSetValueKey
IoOpenDeviceInterfaceRegistryKey
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
IoStopTimer
MmUnmapIoSpace
IoDisconnectInterrupt
wcscpy
wcslen
IoCreateDevice
ObfReferenceObject
ZwEnumerateKey
ZwOpenKey
_snwprintf
swprintf
IoGetDeviceProperty
RtlIntegerToUnicodeString
IoStartTimer
IoConnectInterrupt
KeSynchronizeExecution
IoGetDmaAdapter
KeInitializeTimer
KeInitializeDpc
KeInitializeSpinLock
IoDetachDevice
IoDeleteDevice
IoInitializeTimer
IoAttachDeviceToDeviceStack
IoAllocateDriverObjectExtension
DbgBreakPoint
IoGetDeviceInterfaces
KeDelayExecutionThread
ObfDereferenceObject
ProbeForRead
KeInsertQueueDpc
IoReleaseCancelSpinLock
memmove
ObReferenceObjectByHandle
IoFileObjectType
ExGetPreviousMode
IoGetRelatedDeviceObject
KeTickCount
KeBugCheckEx
KefReleaseSpinLockFromDpcLevel
RtlUnwind
hal
KfLowerIrql
KeQueryPerformanceCounter
KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
ks.sys
KsUnserializeObjectPropertiesFromRegistry
KsDiscardEvent
KsAllocateExtraData
KsProbeStreamIrp
KsFreeObjectHeader
KsAllocateObjectHeader
KsUnregisterWorker
KsRegisterWorker
KsDispatchIrp
KsAddIrpToCancelableQueue
KsRemoveIrpFromCancelableQueue
KsFreeDeviceHeader
KsAllocateDeviceHeader
KsNullDriverUnload
KsGenerateEventList
KsGenerateEvent
KsCacheMedium
KsDispatchFastReadFailure
KsDispatchFastIoDeviceControlFailure
KsDispatchInvalidDeviceRequest
KsPropertyHandler
KsEnableEvent
KsDisableEvent
KsMethodHandler
KsPinPropertyHandler
KsCreateDefaultAllocator
KsSynchronousIoControlDevice
KsTopologyPropertyHandler
KsStreamIo
KsQueueWorkItem
KsSetTargetDeviceObject
KsFreeEventList
KsValidateClockCreateRequest
KsValidateConnectRequest
KsPinDataIntersection
DllInitialize
DllUnload
StreamClassAbortOutstandingRequests
StreamClassCallAtNewPriority
StreamClassCompleteRequestAndMarkQueueReady
StreamClassDebugAssert
StreamClassDebugPrint
StreamClassDeviceNotification
StreamClassFilterReenumerateStreams
StreamClassGetDmaBuffer
StreamClassGetNextEvent
StreamClassGetPhysicalAddress
StreamClassLogError
StreamClassPnPAddDeviceWorker
StreamClassQueryMasterClock
StreamClassQueryMasterClockSync
StreamClassReadWriteConfig
StreamClassReenumerateStreams
StreamClassRegisterAdapter
StreamClassRegisterFilterWithNoKSPins
StreamClassScheduleTimer
StreamClassStreamNotification
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
896B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=126, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=6, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
swenum.sys
- IMPHASH 2b29cc5a8e62f78b659fb1c44e574507
- SHA256 7f499111dc4b863113ddea34e89cfc4b7d5c0ab9e7444a26b30e8fff4fb112b8
- MD5 96ef0a67d073871301fd3dcaac47073b
- SHA1 5c8339a36a7faa1bfc2735c139d3c6b54d7a5698
- SHA512 b440a10650e2c10d5d84f975cfba33ec9a54f0774e1db2af8d77a165bee37a3293823c3f23e0451f3af2d72606f55ba8278963e20f2116d231adc0712947fd2d
- TLSH T17F81751283F81976F1BB1B312CA35A23627BB8109871CA1D7628479F1C6AE40F986723
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2253
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
swenum.pdb
ntoskrnl.exe
IofCompleteRequest
IoDeleteDevice
IoCreateDevice
IofCallDriver
PoCallDriver
PoStartNextPowerIrp
KeTickCount
ks.sys
KsCreateBusEnumObject
KsGetBusEnumPnpDeviceObject
KsServiceBusEnumPnpRequest
KsIsBusEnumChildDevice
KsServiceBusEnumCreateRequest
KsInstallBusEnumInterface
KsRemoveBusEnumInterface
KsGetBusEnumIdentifier
Name
.text
Size
384B
Virtual Size
298B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256B
Virtual Size
202B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
640B
Virtual Size
556B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
640B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
128B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=1, id=61, version=9210,
swenum98.sys
- IMPHASH 09fe4b4792d84920852bac7bb5c7981f
- SHA256 3c528e8a715eb2d82020adf9264eb8a46209abd793599e62e5a22faeb52095b5
- MD5 a974c877e4e212a8bcbb149bff5f1236
- SHA1 0914c1654a58565f7f377f9241965452d6d217c7
- SHA512 5877c2aa8d9ee3fc75c7816ca6e8e69d1b3d3286a4b1a1ade03e67f2d5885cd9a1af0f052fe4665ee51e507c0077d0733fd2cca20f376044dbbfae767a752c09
- SSDEEP 48:SSzLVvos33sF/KJwSua1BfImFsxSRp5PFTt4zYYTZWX8pws8ehp5WDAJo:f57sF/8JHfPldFOdW63W8Jo
- TLSH T12F91840283F91E76F4BB2F356CE34A13527BB8108D75CB5D62654A8F1CAAA10F941B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2359
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
swenum.pdb
ntoskrnl.exe
IofCompleteRequest
IoDeleteDevice
IoCreateDevice
IofCallDriver
PoCallDriver
PoStartNextPowerIrp
ExAllocatePoolWithTag
KeTickCount
ks.sys
KsCreateBusEnumObject
KsGetBusEnumPnpDeviceObject
KsServiceBusEnumPnpRequest
KsIsBusEnumChildDevice
KsServiceBusEnumCreateRequest
KsInstallBusEnumInterface
KsRemoveBusEnumInterface
KsGetBusEnumIdentifier
Name
.text
Size
384B
Virtual Size
298B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256B
Virtual Size
203B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
640B
Virtual Size
556B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
768B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
128B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=1, id=61, version=9210,
swenumse.sys
- IMPHASH 2b29cc5a8e62f78b659fb1c44e574507
- SHA256 7f499111dc4b863113ddea34e89cfc4b7d5c0ab9e7444a26b30e8fff4fb112b8
- MD5 96ef0a67d073871301fd3dcaac47073b
- SHA1 5c8339a36a7faa1bfc2735c139d3c6b54d7a5698
- SHA512 b440a10650e2c10d5d84f975cfba33ec9a54f0774e1db2af8d77a165bee37a3293823c3f23e0451f3af2d72606f55ba8278963e20f2116d231adc0712947fd2d
- TLSH T17F81751283F81976F1BB1B312CA35A23627BB8109871CA1D7628479F1C6AE40F986723
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2253
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
swenum.pdb
ntoskrnl.exe
IofCompleteRequest
IoDeleteDevice
IoCreateDevice
IofCallDriver
PoCallDriver
PoStartNextPowerIrp
KeTickCount
ks.sys
KsCreateBusEnumObject
KsGetBusEnumPnpDeviceObject
KsServiceBusEnumPnpRequest
KsIsBusEnumChildDevice
KsServiceBusEnumCreateRequest
KsInstallBusEnumInterface
KsRemoveBusEnumInterface
KsGetBusEnumIdentifier
Name
.text
Size
384B
Virtual Size
298B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256B
Virtual Size
202B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
640B
Virtual Size
556B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
640B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
128B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=1, id=61, version=9210,
vidx16.dll
- SHA256 dda333e15d7bae20e0b24f4f2f42f566c6a148b3d1770b7c50c193ded2433c76
- MD5 550ba20df6c08e628ca9abd0f6e917b8
- SHA1 f08997db0ade4d7bc1e621e27f19a90b037eedbd
- SHA512 c6bf8448e8f9d397a2f7553fb008b546c5f7027c2b51e969dd504fc2f6b24ceafd92d0afb4ad9baf48e22e3401d9e90fdc157466f005f60ed7b6b4a2559c4041
- SSDEEP 96:92BdUXI5O5ywVJEZsos4Z+ZB4SYAG9bg6aAKspjyvvEIgWQD5Vyd8BYdXmMl/n95:04I8usnMHSBoq4WQibFdOvzuU2b
- TLSH T1BA22F7B75688F2AFC0AD6DB94CD5C6AB92ADDD4F9EC1271B07D012032E8F0F025178A5
- MD5 SHA1 SHA512 SSDEEP TLSH
vjoyd.vxd
- SHA256 91d32e3d1321381a0aa9c5b6468ce734a0e13dcbabde8ab3347c6aa8e8b7bfaa
- MD5 cce0cbf20b83db0412af588084f2e834
- SHA1 1416dbd268db8ff1155dee3deb7c26bb655075f6
- SHA512 83589e1b0c5b6d96aaa3f032d1c88f8a965d0737b1e878e442d569d333e5a19c92153ffab2be744828bb677475ba01122103a1f2164813bf057596d10e9130dd
- SSDEEP 768:6rwEd4BFWVraFM8yBw1Wt+Ycf0LK1kXBnTT5x:6k64T9FM8+/w3kRn7
- TLSH T1A5E22B50ECB5C0B2DED55371606F0F2CDDB59B9990B7884BD3392CA12AB0661CB6363E
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/DirectX9/ManagedDX.CAB
- SHA256 a05cde5ab21d65c6040b3183f8ac493548cf1456ce792fc44377fb97b305b86f
- MD5 4f35b8a97ecb14ee8bda8e8b7aa626fd
- SHA1 ec1d45664ad98215c8c1288f555341194b455e6b
- SHA512 09b53ad15beedac9613283486ba8fa9376c01f0066b109a0278ae404c9c1980fd9dea60d428b18460c492684aebb432fc173d7ac70739ac84cda80d70f00fbe9
- SSDEEP 24576:6UB18Psveu+t5t+BFR0hzE0BaTx7ar7fNodQXNj3f3T7GQEV1qpm6j+Q4://8EvvmtE0ETxK7f6+NTHG1gk6j+Q4
- TLSH T1083533B24DE3335FD6A1F7BE54F231727B9116318E53C26D30559CEC1CA24A8BA7AA40
- MD5 SHA1 SHA512 SSDEEP TLSH
mdxredist.msi
- SHA256 896805fa53c890615d12c6476af8baf4ee95088a6c3f63b61adf6fbd8cbb50be
- MD5 ff9252312b1a32ee095060878d9e67e8
- SHA1 c5c21bb7612c7a9838ebda81c896fe5e4b2993cf
- SHA512 5799afc9a2b99e52b20abda13743f6f43454db9cb2658c4b09e4d1c9490be67d00754f48b1b862ba7a70f972310df9f72ee482beba6efbd77d18fd710491c028
- SSDEEP 24576:haJqkP0NJeAgOT+tpt+BmR8hz60B4SshrqrOfeoLTXL2Z9HLzebxUSo:haJqkP06A9Es60eSshCOfZjLm1ubeV
- TLSH T18B3523D6FDD10B27C4C3F93C05A3277823BA1C52AB9A901B115AB790387DAF560BB9C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned MSI
Checks for missing Authenticode signature.
MaxPayne 2/DirectX9/dsetup32.dll
- IMPHASH 826e66365e06d75f7914f0ec89b4d2f9
- SHA256 8957cca723307720687283fa50df6b06883a90bac350be8d599544320b405c65
- MD5 54a2e8e8b8672ab0921017b704d0eec7
- SHA1 e50a789a57c3cbff71237d8f3fed98a8f053396d
- SHA512 b996da13757ed86e1bd46e08b931a4484c9657d730cd4ba200da79f1b5afe25a13a827437d703abc278e9a3792482fbf69ae876c08c974ad322fa6d490c45237
- SSDEEP 12288:3nXmBDofbzEWv/GGGGGGGGGGGGGGGGzUUUUUUUUUUUUUUUUt222222222222222w:GWDUUUUUUUUUUUUUUUU
- TLSH T163959F7D9AC201D4FB1AAFB217313ED7393C914BB826DE2071B5528841B779CC36AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
87753
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteFileA
lstrlenA
GetLastError
GetFileAttributesA
FindClose
FindFirstFileA
lstrcpyA
GetPrivateProfileSectionA
CloseHandle
CreateFileA
SetFileAttributesA
CreateDirectoryA
lstrcatA
GetSystemDefaultLCID
GetCurrentProcess
GetSystemDirectoryA
GetShortPathNameA
GetModuleFileNameA
GetPrivateProfileSectionNamesA
GetSystemInfo
GetPrivateProfileStringA
WideCharToMultiByte
GetDiskFreeSpaceA
GetModuleHandleA
CopyFileA
ReadFile
GetFileSize
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFileTimeToFileTime
SystemTimeToFileTime
FindNextFileA
WaitForSingleObject
CreateProcessA
LoadLibraryExA
lstrcmpA
GetTempFileNameA
GetDriveTypeA
GetCurrentDirectoryA
ExpandEnvironmentStringsA
GetTempPathA
MultiByteToWideChar
MoveFileExA
CompareStringA
SetFileTime
GetFileTime
Sleep
CreateMutexA
LoadResource
FindResourceA
IsBadWritePtr
LockResource
SizeofResource
SetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
lstrcmpiA
TerminateProcess
TlsSetValue
GetCommandLineA
GetLocalTime
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
TlsFree
TlsGetValue
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualProtect
VirtualQuery
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
SetStdHandle
FlushFileBuffers
SetFilePointer
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
SetEndOfFile
GetProcessHeap
LoadLibraryA
GetVersionExA
GetProcAddress
FreeLibrary
GetWindowsDirectoryA
OutputDebugStringA
GetSystemTimeAsFileTime
lstrcpynA
gdi32
GetDeviceCaps
user32
SetDlgItemTextA
ShowWindow
GetDlgItem
SendMessageA
wsprintfA
MessageBoxA
CreateDialogParamA
SetFocus
DestroyWindow
DialogBoxParamA
SetWindowPos
PeekMessageA
GetDC
GetWindowRect
GetDesktopWindow
SendDlgItemMessageA
EndDialog
TranslateMessage
DispatchMessageA
LoadStringA
GetKeyboardType
CharLowerA
CharNextA
ReleaseDC
GetMessageA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
winmm
mmioOpenA
mmioRead
mmioClose
mmioDescend
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
shell32
SHFileOperationA
ole32
StringFromGUID2
DirectXLoadString
DirectXSetupCallback
DirectXSetupSetCallback
DirectXSetupShowEULA
iDirectXSetup
iDirectXSetupGetEULA
Name
.text
Size
113KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=111, productName=Unmarked objects (old),
count=16, id=64, version=9210,
count=3, id=25, version=9210,
count=69, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=109, id=28, version=9178,
count=10, id=29, version=9178,
count=1, id=61, version=9210,
MaxPayne 2/DirectX9/dxnt.cab
- SHA256 7f5236c8ed91e5b7c08045e309e3679b01bec42921fcecccb99be83ca7010f77
- MD5 1451b2aa63243bc6639694b6d472c41e
- SHA1 8fbea73a9e94d0bd2bb01fa37294f859787f6bb2
- SHA512 18e9eec9f42d5f03a0f394b275b9b0c000d40538ef8773bf226a3411fb18873c90ac5f4a95edc1a8d2e8eac80c6e46394a7bb32b65be3c742c669b59f129659d
- SSDEEP 393216:+J4XLRqXIP0EGh1GWS4m+JWokaFrvKRwQ0Sp11xNTofAmij:+J4ug0Pha41pk4RQ0QnjT/j
- TLSH T13AD63382E984E7836CA51307D6F98C9335912DF8B60BDD17E9AE13C631D3392167CE4A
- MD5 SHA1 SHA512 SSDEEP TLSH
ACTC094.ini
- SHA256 8cea0baed4097534d19c36633bece9c8f0e9864174cb292021b31450074406d0
- MD5 90e60c20df2541b20bb45811e024909d
- SHA1 3e88a5e65dac8ef4b85f1ad3c8f2887184f75ff8
- SHA512 8d922215411c8c0c4e6e4917203a691180adfcdfbb6996dcc05f53d51862bd3e97b89cdad1610dddc1526df03950c369266563cd35813f8be187bd2c40f22367
- TLSH T1F081ADAB857072BCF4BFB5BD324B00DD135124B789A2B067156731F8634385B3AB28E1
- MD5 SHA1 SHA512 TLSH
ACT_RS.ini
- SHA256 95de1d836d0b68a58dd459835c693da24503250304e8aa0bef58d27566843d35
- MD5 61fe9c4bfc75fdbfdec4f60136ee6dce
- SHA1 a9c6f2e21b4c129bea2a82415700f0f80fc05119
- SHA512 5fb6416d823c8404c5b607b7dd4ca12c0b6b63693c8e90f877973109edd65bc71270babe97cd62343bccf179071bbdbafe40fb4e56e1355928dec96ce592d70b
- TLSH T14F5137CE6F75A2DCE9B231495807D6EC0EA11AB21FD63EB9504519E47CE01312B2B9C3
- MD5 SHA1 SHA512 TLSH
ACT_RS.png
- SHA256 3904a6ef7aea6c5535aa7ff6495ee965a6ccabf7d593eabfbe0449fa56e5ff07
- MD5 7942a02676b8c1f40b2445a32ed30704
- SHA1 3f57fa332966337276e662d3ef76a1f0df87d7b9
- SHA512 e56555eeb01809c3ed71e0cc95e088b0adcd6a5da36ba61a94b6d7000e7d6023ef1d84fc4e8be92ca2af4bae9749b5db48e27617718af99fa0aad1e02e78d052
- SSDEEP 1536:FoonWm5kMGiQzAiLaAFcPjw/AeTXz2GOMDLCeeWDaU1/8MROWk:MlLNFt/AoXzzlja5ek
- TLSH T18B9312CBD1EEFF22956D7B4780D1E112038B03793F494AA97118B68403AB5C8E73A56F
- MD5 SHA1 SHA512 SSDEEP TLSH
GR3001.ini
- SHA256 c5b79fb29e3489b3e1789403c2e0585c646287c9a61a756b8c9876e9d0f6d77b
- MD5 47f6bce7d86f48f18ea82e97c10342a1
- SHA1 88322d488cda74bd04a207a81d9ea9cc6ef5c87a
- SHA512 d88582171208d686632e0d8f9845c9cd366cd3937b70f276de2be5f0f2114d919a9a0a0913fccc4dc07b844a365dadbf1d667d17a445734d86049da179cd0679
- SSDEEP 96:JUXiR9HMeaO+WYwPgotSkEYrDPth/wX7r4sPX:aK0w9/1yLr4sPX
- TLSH T1CCA1884E9F3032AC940BB13A334788E83A6914B189FDB558000F15DA66A19B477FF9E2
- MD5 SHA1 SHA512 SSDEEP TLSH
GR3001.png
- SHA256 0799b81ff6267914c697734fdd9f25a2f8f12867d7465bc7d0defabd7891777b
- MD5 1105dc7d16c1fc5712796441eb5c36ee
- SHA1 afad00275a6a63c9943aa0bc182ff4de2b3a061d
- SHA512 548de0bcc75eb4468f2800124bfd76d5659b256aa9d166091de619ecd6409b9403ac5f082da1e6556ffcd613a018a4fc7b80ad56c3437242aee439847f4cc17c
- SSDEEP 768:HMQ1wu+eLtWJDuqMFcbdM2JIn+HaPpZDtlfkg65MluLnZatlwcXvpxtPWHBhHXSU:HMQS7ekJabFCInCaPp9Tn6HVorhWhB
- TLSH T1F803F1A43292E876A99DA03A9C86F4E07533BD003AADADF1EC4BA74FD51B03DE310515
- MD5 SHA1 SHA512 SSDEEP TLSH
GR3001_G.ini
- SHA256 e13de488155683970f388a754266c87999678437a8dc2d69e1db5fbd6e936e02
- MD5 5ce0c65859ee3710ed9d9bb8f857a718
- SHA1 ad8500f016725fb8d889892dfa5624b1d257aae6
- SHA512 f6bf30bc0dc796f2882d0f10f97eacfe27f3746799a4797f5b9f5eda640cf858cfe70f52a8001fe9c4bf97207a047da9a36ee5311f9fa601660f210bde898f25
- TLSH T139819B4F2EA432ECD85BB16B374784E8266C10B188FDB4A8104F05DD9A5197477FFAC2
- MD5 SHA1 SHA512 TLSH
GR4001.ini
- SHA256 5961de03bf16540ffde3ef81be2834f16d7e8090482e91e5ae880576e07d0a4e
- MD5 85aadb0caa6d7d0b7be6e8fb1368c3eb
- SHA1 342355515af7b946083f3a1613c68896164d4e23
- SHA512 8cd6879021c5c2b86b864efc9c5340d06b5d4104dd8a6c5acf58244dc1e4c993fa001e2c6e33cda9624d7b418cfb9b69a075b0b11fa9de1a5f7b46d06434e94b
- SSDEEP 384:diSN6MbONlJ63d8Q4RZy6hD3xvGLRggrTNNERB/1Pz7+4x:d8
- TLSH T19172F06F1F6A76EC946AF577334DC4A0642C8291CCBDE4440A1F068D1A11A39A7FFEC6
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4001.png
- SHA256 fb64f0cea878dda22d68633c4aa5b99e79247ab01abaf66117fe556972061406
- MD5 25dbc13ffcc29a4cf1362ce8e9cf7e6b
- SHA1 9f86377f3c11ca1d9e8626c21aaa654aebbed814
- SHA512 4afff949318aef75103c449126f1ff0d1837164f02fd292fbda15424b441a465057fb6d7923d1fac421cb624f135621c654a580ed3ba37c3b010f456d2422b03
- SSDEEP 768:V+AR34iHJnMZISaScg5zOKJFjXZH1GKKoC3xRzyoy4:MS31HJnKxaS/jZMKs3bzyw
- TLSH T1B1E2D0AA683EF13912E50EB8AD0A60DB18D4724753F63E135C2F4DA41A57B2DCC2F532
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4001_G.ini
- SHA256 535a323d1001e57acf25021e96fbe132d56d284456a13c1d70cf478a98b99bfd
- MD5 9c5a69fa046c74499ec0746bb392c3eb
- SHA1 7663b1891f84c4e659e220e366988a55a2a4d4f3
- SHA512 a8f59c84a90502f2159351b2af0942b88688d226a1255a9ce9154126a089e8ae56cc20b31caa2609fc495ab9077b07eb26202398b975e28379b765b0d44e70ab
- SSDEEP 384:3Txu61k/lzwiPOYGjtG0D9DHfG/fCsXzndcFTTfPRdMM:3j
- TLSH T1DA52901F5F9AB2DA94A6F57B2709C5E0702C0162C1BDD8440D1F0B4E6A01A39E7FFAD6
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4001_G.png
- SHA256 32ab1d768c3d328483911898e9aa5923ec86c93802883ad5d06a325d0e928d81
- MD5 21116c9897067ae2059ad65a0b9ec7e5
- SHA1 f9bee25b1c4eaeb984a8d241e1fc4d0d80eec934
- SHA512 b98ce203949b2993c1d127d0a56ce0570582a7735ca92e050074d896184e0998a4ef061f1acbf9588d9dab6acf72d160f9ac44e9c89728b36f288a983dcbf6f6
- SSDEEP 384:C7GZK4bboCHQBRrzLyQa0IreXCUM7Go+Iz+ZuYM2S8+/tBQkbt0fNLThH8jwEvCV:tZ/xmRn4UCUMtYp8zQG61H8jXCqnO
- TLSH T163C2F145A8F5AE3A148A81C631AD159DBA0CD2995F73D64C0D2B3062FD0AB17FDD28C3
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4003.ini
- SHA256 fdf6288f43676c6c0567ebc33a525fdebf9d3a28eab4f25d5d1e03aac446ac34
- MD5 e5379f226be44d716a1450f6f2494f35
- SHA1 aa45f6875c80a2cc9cfb02b1e39bdd2a2a170034
- SHA512 c193c35ef94197bd9770341840517336c74a192abbbf57a2a1ef301d66c3089a4befbe6c821f97e41f34113bdb179f3aeda4d18de2dd109bae99ab5698d4fade
- TLSH T182719F1D6BB037BC584B367A330784D8369418764DEAB968606B12E97762DB033F94D1
- MD5 SHA1 SHA512 TLSH
GR4003.png
- SHA256 efdb3810c8c1e9f2e474e1674530a9b8c8268e4f2ebe0322ab859c7590bb4673
- MD5 11d4613e57c34fca41622e90c686c63d
- SHA1 b6b3ca15f373cfa15100e174723a0c4a2207450a
- SHA512 c9f7d874e3e62580d08e31cd2f38026e53369c3dd5ef707dd0ab7e2fcf89faedf098c1efb7e25f39f1e744a395c1319a72557aae37bac79cef2f5506fa6b58f8
- SSDEEP 768:6dk/AD2oy+LOOBWAbgXMyL7kLttBqRCrMiqzsy0Hqwa/E6q:6iImtfAbgXrS+RCrMjNDR/Zq
- TLSH T12AD2E010AA5454F7C74A8E7C154FEB87EFC368B57F136E0E101A70069D6E22B3B23295
- MD5 SHA1 SHA512 SSDEEP TLSH
GR4005.ini
- SHA256 492614b01711e564a63d6d4084e1d8d9447d93eaf0c07f7cd053a7d1614a181b
- MD5 cb059e53e8de48164f88d185dd4df925
- SHA1 21766635ea8e3a1a97497aa38b4f03bb9190016c
- SHA512 f9959d9d764cb20584c21d04458fcdb6c6aa1733f20f47da76dab05a2610c8e407943894c90cc0b08068738395d836447f4200435684e1859fd4e2694772ec4b
- TLSH T1D1415B5E62B536BC498B763A324780E827E455720DFA7464602712E97772DB033F61D1
- MD5 SHA1 SHA512 TLSH
GR4005.png
- SHA256 1e26e506d71d2c80ef1cda68881c981aca6d564723008da98ed5548f6c353a82
- MD5 2784af4c286102874784b9ba0b999fe6
- SHA1 631b57e90db5442a50ef0adb80c871ea22b6a9b9
- SHA512 4dc2d3564acf0d484ee5b1cc60d27faea3adfe2994a0c8c9e0777bc432dadfd95f883106e9565d22252ad220e3af01d822d49fe524fc268d43039a2f65acdffe
- SSDEEP 768:6NY5L06wpe16Xhb0l/zEoJkLjwSt7vImYYaTmWCjaAFuun/c5:fL06z6XKbEEkH+TDCjxpnU5
- TLSH T1E1E2E16EC28E1A86F6715A779CC36B8B5CC40089FED597EB3CB710403A3904998D2EF4
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDA.ini
- SHA256 247c0041753ba2428dd8c9eaaa65b4807cde6a31a18685be4d05c27a712c3f4d
- MD5 7e6f847ac4672ec7a6d3dd511a33d879
- SHA1 1ed90dd3fcfe0f74170686756fd054326fb19b01
- SHA512 3acde080697ad3359956669745637a652ff50fef4e9b550925f15057ea8f82054be739137f141fd904d94cf2d0517bfc1523dfbbd681707aaeb0883c49c897ff
- SSDEEP 192:UbFe910LiM23tf0TmABuOY8YqBPBPy55tf5N:mo9CW3tf0TmABuOY8YqBPBPy55tf5N
- TLSH T18752DF9F2FA57088C879B4273B4AC4B8196C11B192BDFAA4111F09C94CC4679A6FFDC7
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDA.png
- SHA256 7bf774463f63147a90ba64c96da491eb835451b1cac4f31f20a24916c3a25312
- MD5 3a35f6f58aa8a264ed26df136334df35
- SHA1 f4fb5ba6425c9cbffd0b0886411849b5b352e416
- SHA512 460fc73fd6562ec5ea10cc4d5dc200740f1ffcf63e8ec3dbf75037e8714a1f1423891710914b7be8e31afb76a3b5b321de977257279aec7936f4d562f382972e
- SSDEEP 1536:FwmUklB5OinPEHIjFycH+Zu5chrbWDBUv4+1HwiluaG:rTzmIjzWfeALqJ
- TLSH T173730254057C19A8CDE26778223913974D2C6E8CF3C901EBCBE57EE512929529E43BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDA_G.ini
- SHA256 b6b6b1f262e25e6ac63ba79d454d44e6436dff796e7c4d88032dc3af04520b03
- MD5 dd260f56cced7b21efe61d60bb7e11b7
- SHA1 7e814ac17d6a47b3335c3b98d2d9b0f1fcb43026
- SHA512 b83041c34c20f6a4c148a7caedac1a77ae2b9c543d82f36526088185e2f0d52f601bf89cd2f8913ce379668a5e786ed2be02147f209a22bd903d2d856849d0b3
- SSDEEP 192:ylbFe910LiM23tf0TmABuOY8YqBPBPy55tf5N:ylo9CW3tf0TmABuOY8YqBPBPy55tf5N
- TLSH T1D752DF9B2FA57088C879B4273B4AC4B8196C11B192BDFAA4110F19C94CC4679A6FFDC7
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDGP_G.ini
- SHA256 b3984941869d1d3ecc73d0637de252da9da7ff02ed75f8fddbcb1c262d846dae
- MD5 485627acbf6e063a4ae991b7e0268007
- SHA1 2b88cfd2d830a4ff15e1f43a7c9ab04400ba063e
- SHA512 4624841e68f4741052b169d4344d6fdfdcf206bd11139146fc37a793b98e6abab197e7cd848581dfe57f6c3360f5784903d2f1c48a875b38ce3b2170ed6b990d
- SSDEEP 96:29d6UV/cqfS0jZzPk2rItsdn95PJGXIeJ9Kfw540hzDdKqBqH/Ke6SVSEmSu7o89:OQmo35jecytLeIhUx5Z3BkaZqKFEiN
- TLSH T1ED32E2AE1F25B4D9C876B136271BC2EA1928053182BCED45100F0BDE9E88535A7EF9D7
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDigGP.ini
- SHA256 ba2b1d325b81a8448720da625cdab6b44940dfc6a943036e7a7a30f6ecb44521
- MD5 8229ecd9da72ef23734ad9be63541001
- SHA1 ab557ab407a9a0ebc0806dd03dee45d08dbac6ec
- SHA512 eca55a3065ffe49d6a53c410f82206878dfcbdc3c88c90239d97ff28e3c6535269a9fb294f37e97a91a91e4c3efb84cb6c612a793d2f3bb9cb05f3a3266024a5
- SSDEEP 96:f9d6UV/cqfS0jZzPk2rItsdn95PJRIrlA9Jkp590CuWSK9GqHC8hSV1bm1/7o8j/:3QmoqLEcWk2UKTGJWcJwXYz427MAG
- TLSH T15332BF9F1FA57088C87AB4773A4BC0B9196C117192FDB9A4141F0ACC8C80639A6FBDC7
- MD5 SHA1 SHA512 SSDEEP TLSH
GlmDigGP.png
- SHA256 902cd892ab95892de9068ccf071cf68ecd79ac6d68cde2949967317b21be23d2
- MD5 7630e7bd10d814f4f98df439adb2d8f1
- SHA1 7eb1cf5d729dd4d1db301e17007553921955ec2d
- SHA512 8de39d2dd11e9e4876c05696a0a36db82284b8fca1436a604d81ce83a67cb0caafb2706a95e8c56aeaffe653f36c8a4dcd52f6e09b7218ed0f056f55ca2a8887
- SSDEEP 1536:ooG+cu4RChbnuwD6HmtuOagUdhZW0f/xrMq/WbztGl6R6L76i1w3zeAk:eCx+GtuOuhZW0hrMMQy6R6L75TT
- TLSH T17D7302B9E1EAB5F0F69A50323F3B61A7F12B7241F18007D7C9194068D0ABBF05694BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Hammer.ini
- SHA256 a723b21a3b6e738e6b7dc2911ed01a002c0ba6365fcd130c6490aad426de3323
- MD5 4936fa2204b885cff8b6db2dcf27d4c7
- SHA1 b8a3005a38d02239a58fe9735a6c66571e9cd3b5
- SHA512 75ff5497f40706df8f671cdb7eef3232bc0d9436535d6e92febc54568a4e7666197e0c34ea009bf2192eb1a61625f1af7f2d918b267b73acb48b3e0cf476eedc
- SSDEEP 384:7iVqi3uakko3nc8m9+EZlwTY2wPqYFyARCRAIRHMJBQA78Xygp:2XTG
- TLSH T11482777F0E20B7B8F57E353D234A05EB262900E34264B1C3482E36F4E94B5575E6B6B6
- MD5 SHA1 SHA512 SSDEEP TLSH
IA3002.ini
- SHA256 10500180ef412fc24d2eb6a9542e1830d9b3f87ac74b7c690afbdbe451d64f09
- MD5 a094d1e54a0fa3888f93fe2c061cfa38
- SHA1 a1bde9e1058960d355f73598b0e1598dda6e9e90
- SHA512 46a0ea5b18075ae9830dd163dae90a4b6d2b3d7009834c5093d3dd96b76ee338c1d12ea6a12a8c13e511e7a6882e66d793928588590955b0ea754a279ae8f432
- SSDEEP 192:62imXAQ5YnRK/CkQcwpcFuhliquR0s3mw0e07SUCl+PjKS:625w2YnRK/CkQcwpcQDiq20s3m7N7SU9
- TLSH T16332457F6E86BABD11A53678370A84F7BA3451E60075F0801B0E07C29E1B745AE7F1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
IA3002_1.png
- SHA256 a58404be8d6c04e7b046a9fd54c5d23825fc94bd3b0e7f740fdf3020329ab76b
- MD5 b54d3bf03c0ef33ed4316106a936bcc0
- SHA1 9d47dd81c303aa545bbd7bd4124ccd726b3c9557
- SHA512 8815bf0e4e81f4503ff386ac4460d04c5b56f453b654f57332c4a1b4ebcbe1f1a7c91b7eb932fc5da75755aabd02fd34a3f106d193568df93fae913675ca3448
- SSDEEP 1536:mqs+k3/AAsaetVomywW0GWWlkOJlA5o9n5c9NNQfNir:mqsjAASXomywWQeB7QNNkW
- TLSH T1A143F1809553A7CC1A1215DC3BF26EFEC87EADE5222B9C644E35558CB1D073AC61AD83
- MD5 SHA1 SHA512 SSDEEP TLSH
IA3002_2.png
- SHA256 a8d7a0fecd335a48c9c75f95d79c8a7505ad4cb001b7a7139666dba4a812c67e
- MD5 f11e210716300d4b24ff52126951fb5d
- SHA1 bc29870f3b9fd83f77336a3d89b4d126fc44913f
- SHA512 e44043447e83118c1a3291d665315324f12c4ff1d10a16d658ca269209cdb0861109d4c556435247a1a27559244a2c6e3c66f79e8a5428aff3ae257b05536e0a
- SSDEEP 768:7ze+YkGM1l83NOJqb+6MXQQqqdyr8OF1NynVZITOi2QAsUzNG1Dl96J9KH85lii:6oQQJqL7zqdyFHNynXW8NnzKHUlii
- TLSH T1F533D04BD8AB425BFE9627F837A16EF4B67FBA31437904884710149DA1C0BE4A107F87
- MD5 SHA1 SHA512 SSDEEP TLSH
IA3002_G.ini
- SHA256 d78a310fae1037240c38acf4d940a573844341f24143a0c8e1454eb36c1e5c35
- MD5 c68e524c8a32c6ac0c4ebf07223c94f9
- SHA1 61942728ff7f13ba2e9efe0d4ca8f2670491b33d
- SHA512 bf55f39f083a17e10f3748d5b31e4308b1ffba2aa4477f253b5e4f68892f22b71134160f2096e262e8870480c8343340290b7655e9080f0bc5aadde32892076c
- SSDEEP 192:Jg5okEUnnRK/CkQcwpcFuhliquR0s3mw0e07SUCl+PjKY:JgGkEUnnRK/CkQcwpcQDiq20s3m7N7S8
- TLSH T19F32367F6E86FABD11A536743B0684F7B93451EB0071A0811B0E07C29E2B745AE3F1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC202.ini
- SHA256 425f87aa6a1f6b7b56509b87a9fa376552f71e0f125e44e7d67ce9ebcace1b51
- MD5 b13bde4d5adf2bdb72cf04de4550185c
- SHA1 c779952b9be141a0f984dcd645ab7127954423b3
- SHA512 85e8da1fc79777a5aa57566e5457f0493acb881818f95473e5149a727f550ea8fa3a811be91d7390522ef6fbd566dc363e0e06697a539cc068a9d7a7ebf56d52
- SSDEEP 48:llOatTQidSDej4WdzOGkdo7NiMlGbm+X7p67K8rF8rC8r/8rgZ84b8pXmNIYplz4:lthQidMszaePBEriW+XgVHP6t
- TLSH T19DC1A3C92F3EA24CC9B835542D2BD3EF5F600A3143CD7EA821050CD5DED6579219B9AB
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC202.png
- SHA256 a99f9822c37a3b7dcc56a7cc4f90ee251363f5b162f37eec7c3ed3495c66ebe6
- MD5 176ea571764cb4240d47bc35b36531ea
- SHA1 d31cdbe2586abbabe92fefff519fe3cef135c8ce
- SHA512 47acca501b8ee8a89df91492d39ddd1c8bee8c5fc82e329cef4fe074b98e09397afe16fca7029637f5b4b1d1e18c8555161bdbd0e1893e229d2ee4de4d522b8a
- SSDEEP 384:3ujJhFFaJK6MfguJKZqq614nE+tfFo95v6oxcB+LMEEqUNVWvpMSR/35hwpOYYLS:aUKt14nDtwv6oxcBeqVWvSuA+WvA4x
- TLSH T185E2AEA2E06F85A93A5606FE37A20FF585BF7C24A3F92DE41B10388E6584B557047E43
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC207.ini
- SHA256 31b0e2d176383519c2cd153f48b4730dbfdac007b68a04c2c8e94aa645ff9a6b
- MD5 2cf5c969394e8419d9b32f2ebafa334e
- SHA1 3eaa2a97532ddb3d44045d0e64daabab2a67e387
- SHA512 7d3086adff8fab1d7448a84c3b9377e2f8e5a6b30ec6ee3c15401431ab5e83622f6c0e8b3282decae6e674d87aa2c7c5a4c2e31d76c913e08b2314708d6cecf6
- SSDEEP 384:ub4EnwfDP/G3xLsDQ09ZdQR2pV0SO/1AWvzDuJ49xAr8LE2g:j
- TLSH T1EE52049F0F3974C894A9F2BB2B0A8095746D1462D4BEE580051F06DC9494539AFFFFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC207.png
- SHA256 7cb705bbe4982c6325fceba0512aa7cba2350b2fb5aa2baa10ab4b081072a441
- MD5 caca23d40e779fd9c69cda7eb15c1aa2
- SHA1 60d86efd64ef9026e3b6ac7515d4fed330f26779
- SHA512 627e0951e8ec9216042c7061d83833cc6efe147be2af263db135a52f8f6568049e39865520cc1743343562e41eef90170f123809fce54a9e8cf77952fc5679e4
- SSDEEP 384:3cJgM6fFybFncjYKcdxT6m0BscKF+kcb0Kq20y72a1+j1k7aAIeaKNxUFH34k1oS:sK9aFcjVcP63iIBVyLnhXubRP68i+Fqz
- TLSH T109F2D0E7C16F4A22BB5646E2ABE71DE9A17F7C34A3DF14C14A9354ABF040AF13180853
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC209.ini
- SHA256 eb03234b6b2565db9d2153b4e1540e46596385c3dd9b57113fdecb6bdb569f9f
- MD5 fb613fb07444c72427e8a2503a76ebd1
- SHA1 d1d4aedce4acc215266db06fd718df6437228fe5
- SHA512 d9151a4b77617d4c37c64618c2453542101317ef69e8a8663cb5bc05325a4dbf17106c6360b14cc388d3974c2865434e9116b8745db28787129939a921c3c278
- TLSH T13A81995F4B34369C859BB67B3B46C0EA1BA900B688FEB404101F15DD8A11D38ABFEDC5
- MD5 SHA1 SHA512 TLSH
LGC209.png
- SHA256 7958624dd4aceed4988caa07a504e965cb90670f9af7863341c7b17a2ec2dace
- MD5 dbcf48114205d5e11a34cacf4b82cd2f
- SHA1 712f53fa73b7031b480098c4cf0f05844cf8dc8d
- SHA512 5f55667df2a52811d27c7c0707928459297cc2793b458afa32749ff84bdf7a555e4ce51ccf25b13207059a41a17ec25236d227676ab1a6d92bc9570a84d685b4
- SSDEEP 768:xiPSxHP2dYOa74lm7WK7t7EcrDtPijuBCk0A27n:MAveLm7R7EAFCtA2j
- TLSH T1A103E094C46F82B51E2956F837001EF1D75F6E38A3BA0ED48B4474FAE1C1BDA7611A83
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC20A.ini
- SHA256 079e82ea2421a686a1cfe35b556132b09deac5c33ee0e9ca7d4a20b680cbc96f
- MD5 b4c63a57204d65ecc16587913c9b9282
- SHA1 6139e8740c59390db606b5539c120956ddd50c79
- SHA512 819821c5e8037cc5c41d415fbbbd2baf802480b04efc2e61199e71cbafe90066c63ec628d4a0f351b12bcaa24b0b760ea2de9e55da10f62c25b5dae985a2cefc
- SSDEEP 96:M7oM6W5KZz5HydUojBtYCw4TuO8Px7gtcXAWHwrw82eels2xzb5KKdU0ot2EhtYp:M7mWtPtmAWp8tBXTRvRc
- TLSH T14CD1EB5F893033BCF1AB727E720B42DE235518BB88A970A2216734F95717C6936F50E9
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC20A.png
- SHA256 316ce20315e1f97aa9c0648870f42225d9ffff5657688eabb755f7e6c388af7d
- MD5 88e1024eb1d23a2324f1ed6b003c84cf
- SHA1 212cadc2c71cef2889d4e8d33ed51e36962b688d
- SHA512 73d85293b2af38bcc12b74f9f32a47ff631788de815db49329c58296e2618f344af43c01afd9aef29d7d276655d25a0029a2a396ce4cebd71a4b12a120aeb2a8
- SSDEEP 768:E3tK1NjUpA4qM8NYgxiLyXKV8OR06jCkVJqkBP9S0:E9K1NjP4hyYgILyu1R06BVkGD
- TLSH T13203CF51C057EBA4992209FBBBF51FF5D27F786402BA5CD4135439EEA0403B5A026FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
LGC291.ini
- SHA256 de95342dc49749cdcdde4b76984eba91668f67b3247cac2d05a1cb7ed692e74d
- MD5 21e468f47c022da870dcd1b34464f652
- SHA1 5f48c1833c904abe4dd566e9407f9e6f3c1eeb97
- SHA512 85480acfaf25ede5145bf662d756df4cd6c79fb5b959b7ba1d6e9db442a888e5fbf2d70ece33fc0e0634efa57d89bb1b032e66a0815bd82a3dc668fcb2868bdc
- TLSH T1B841C94B4D3037BCE17F757E351705EE170610AB99A4B082196232F4924BC5A3EA61FA
- MD5 SHA1 SHA512 TLSH
LGC291.png
- SHA256 65b7a8fbb6f760af81fe65c694ab8bbf9a2604522856f4c098185ca396cec82c
- MD5 a148633f9cf01a0c225ebae0964573ac
- SHA1 216d1c2a0a14994489352c048f6297e6120e6417
- SHA512 621d358c0b90f763a89e654037d30b3dd0855a0b1b04f830e9f2335e7bffbdadaa85c34ae17c71ef1e5a3f69febc011e1771a932a037b099f0f232b0b6d934d0
- SSDEEP 384:34YLheOBKglgqyDl5re83QfcXz6nsYq2tJ66/hywG2f03M7F/qPhZrRuhS1/Y/C2:BNBKgCNiwCqYsYZHJVf2M7EJ7uhSq/d9
- TLSH T1E8D28C55D29F80DABBA505FE3BD15FF8926BBC2117BA2CD4A750249E6081BE4A143E03
- MD5 SHA1 SHA512 SSDEEP TLSH
MS1B.ini
- SHA256 8d9272635ed38767d18a7f7935f5a5d1db654a526a32903941523d305570e760
- MD5 dd8d4a00c271c12f229b5aac8a79a2f6
- SHA1 003ba733b109912fc3bd4f16cd1fb53902dda1d7
- SHA512 2dfc8aa83295ce2f441a1283ab4e07ba7628537d03f74b961d524b62e564a05a59ed2b0c2b23f5d26f6fe58fdbffa797489855b6722ca453b121b9073331ca4d
- SSDEEP 384:nosc8MidbNYG6HX6iSbuZc6BKsaMaHqqi1KgCeurNS2jSeL:oO
- TLSH T10B52E21F1E7670C990A6EABF7B49C4A2306D45A6E07EE5D0091F278C5520638A7FFEC1
- MD5 SHA1 SHA512 SSDEEP TLSH
MS1B.png
- SHA256 9cf4196499e5d248ab78baec2cf5cbd9aff7db2f84c0deac2074ee7a6dc0a7d6
- MD5 5daf37520490b5ba9545b222ddbe5d9a
- SHA1 c8e3c43a46eba15fb081b3a4bd254eba4c3b325a
- SHA512 9acf69ef6cad1dde9f62fb5aba96db8f5f10a5862add433a05b5d4ff0ec16a038000cf3e57af25ddc7cd325a875ea7abebc8d087401dba7f22dce320ca65d68d
- SSDEEP 1536:EZjmWv2bqpC9bGOdQEdCfUVqcSq6+lqnOytfqIwmU:EZbp6E+qHAlqOykmU
- TLSH T1523302BE4C090BEB6061BFEE727E546531CA42EDCD686DC0085EE04A59AE53BCC493D2
- MD5 SHA1 SHA512 SSDEEP TLSH
MS1B_01.png
- SHA256 a6186acb6712d5d5775d0627048c7eda59000eaf7795f2279bd5761f3ffae56a
- MD5 cd7fe02631a1218c481c59c76f7fd8db
- SHA1 2906acb04c557bfdefba3ae9ed2bc55daac972de
- SHA512 795d7e2debebad2e2a6d596e193232ee7a494dd3d467c852c02b4e18e4bee843287d21ea7fd9c1c947886286df15277dd848025ef6a0aafcff4669e56bdb0d2c
- TLSH T1A0414C52A441CAB956DFB77923E10F05AC24E5B17C312024E8450C13F5E528715FF3CE
- MD5 SHA1 SHA512 TLSH
MS1B_02.png
- SHA256 d2f37ea24d23bbaff0b0ef66be9b29af37cf5c05d402b8c594185e3af4715ef6
- MD5 303d50981c0e70766042bfbe9058c4c5
- SHA1 ad5d55b6eb4d6d0e58cc1d8cd1784d6a66601f2f
- SHA512 5b2808e82ce2eef66bf24490017860ff642df77f04247ae152dce97d6c511c0f114c8f7aa4da414743ea90b61ae47b62f34692801f5d2ad0873877ba91f296db
- TLSH T19B01E9F91620AD65C1076D80923BB332FC3EC54C8847030028950023DB12E8D8E90F37
- MD5 SHA1 SHA512 TLSH
MS1B_03.png
- SHA256 b93c8829a96c1f69a7751b2d089780cbf11d79ab27e5d2507c36ee2ad740ef08
- MD5 d3e103a4ffab645547915858b0fe6c9d
- SHA1 fd7374c5f90a0339b4a9eb185558ee1932cbb8e7
- SHA512 a905e23ce116e886b8d1b8a1a42821f4d88d35971465a2053defc085b639824de6df273618a163565b8086b714bb4c1be91c1989e195fac2d82fbfcb89debdc3
- TLSH T168F096E767FDE51AF9B37F02054616B618581B81CE4D05412106C03DFE0B7C939E0198
- MD5 SHA1 SHA512 TLSH
MS1B_04.png
- SHA256 1f99db0a7f66f913774e61a334281b60333e0a231267abf3c61f54ce9834a8f7
- MD5 020d6f6e6f9bbb45caa1fba1ef5f6179
- SHA1 ca689caee8a2ea7b622ff39639e19118d42d9206
- SHA512 9cc0bb6196391a8efec322f4c704bfc7a11c5b9b2df5416150b145e7878c66c428ebd4ee26cfa534d84dab7a16cb3c159e32e82d29b25ae058d149508f4001fd
- TLSH T18F01C5A39BD1CDC885AB0952682A292ECD245323C63A0EA4F2C20D5EB614109E9540B8
- MD5 SHA1 SHA512 TLSH
MS1B_05.png
- SHA256 43c182a3765a09368e09e6da8aaba45ff47798843605a32672eb1b7748eef5ec
- MD5 f0359cf4f01f9b61f9b6eed337b48f6b
- SHA1 6779e984e3627ac77a4ac1b24248826f88b76f20
- SHA512 acf50f5d73c657473604230651388686057398d0ff47ab358f02cc08ada28e2ffa1cff1fc1912bf982005b70510716aa3602e3e04cd3dbfd6771f7df5414bcbd
- TLSH T17DE060A436BF0C27E7DB068210910BB8C0325D3465D61B042CF19CAE4CD74C4B516282
- MD5 SHA1 SHA512 TLSH
MS1B_06.png
- SHA256 b18af49a8c6949786ef39e40257f2d8c7b07339115155e591fbbda0321b4522b
- MD5 90454d1e72dc7112c0665cf28d5c0f8e
- SHA1 cc9b2cb91d7b2f9c627cfc47393b50adc3a9c5cb
- SHA512 ff5ca00c767a11cf00912b1694632412011e4aa354f3e2fd6a202a175cda9c32bfc0b0150f73ca5d2529ce48dfab91440b9c93f2d1406d1dc3f64bd6191e1644
- TLSH T193E0F1D9251085B4C712B116115320AAAA33466E69677E9D236008568D7E6C89D8C1BF
- MD5 SHA1 SHA512 TLSH
MS1B_07.png
- SHA256 83d3a62a93cb1eb87c4a17b38c72cd01a809d9712394a443d17e5a99a78dbabe
- MD5 f560a2d3775cc8e8975eaa4c64ada238
- SHA1 cb0166c2fb38e413fd43f15a0a9cf064ae672a13
- SHA512 8877fcb2ada1193862efae3d9399df9b91ceb32f02e80fccd24545d65c5e20a7d80a902ae220ae10cf57a4d8b5d24901e63b37566dc53e08726d9e225dbdcfac
- TLSH T168F041D31BF9756DC166485722C60CABB0131E3364924B6EBE08862CFB402DF81F03C2
- MD5 SHA1 SHA512 TLSH
MS1B_08.png
- SHA256 4837bb63409c66764a8bc0948018f5d0444edcfeec15ffd02dff4f6acf63c3b9
- MD5 2b8b9e116228d8b35c126c0957fcb9b7
- SHA1 13b68fe346a4cb3054cbaa233c3a4b69f9f8ee7f
- SHA512 0d08fae681e17dcca46c0e3b4f0bbd121eb826b01f969841c8e80a19346f4b95ffb39e019180f693583afcb6f162827b092605bc045a7a1fdf3a6f97a1e390bc
- TLSH T144F041EBD7C023C927892221D28648B08C7C8F45C94E321C1CA2EE354C93AD4C39242A
- MD5 SHA1 SHA512 TLSH
MS1B_09.png
- SHA256 3ed70ae9480385da00e1ad6deec38951be66fde063431170f6294cba52dc1d98
- MD5 ca9ca0b2774db7c44427a11ac2aaac01
- SHA1 e4173e6f546fdc4e44b7fcc71a793bc21ac66607
- SHA512 f4a2174c9d78570cd9bd43e5bc39748002732b515ff2320251ca4b031ceaf0fc794d347a36495268f9605a50ce85184380e6ec0512b5f51306037f7caa192395
- TLSH T1D7F02DFB63463B39D9A838AB7A28039B5A940445FF660A3CB33350498DC30A280067CD
- MD5 SHA1 SHA512 TLSH
MS1B_10.png
- SHA256 1868bfd5b49322eac0386b78f964ad3d649bdef6b479da46f0a91be5e840664a
- MD5 379826d9e4f7dc62b185e48c3e56c398
- SHA1 0b533c5a195860a5d89e75b3eabb9db9b61642c5
- SHA512 1b11fce8b23a9a1137eb7bdbd9d8e9dbdebbccb3e4e2be7e755c9c5b53abbb3e57c882d4c3a912dbcb4dd689e746d6bcb6d1838b9332dc96aa0742ddc52536c5
- TLSH T1E5F0628342E1B89EE1BC3873000A1F7B9E7089EE8A646316E322C4A594C9E81D8C4A1D
- MD5 SHA1 SHA512 TLSH
MS26.ini
- SHA256 7a9feab7e0d241ca420934e6153b5db4d2db8b72b113fa5d010a6a417f06cf51
- MD5 a0b84b5ddb4e4dc1973bb666a8aca7a7
- SHA1 163df8af80d7c97a5659b83918b755566550be6d
- SHA512 004bc5a6a2287dab279531ae7d62de08c0579ffc0b10d86b75a90389fa2da819b283bb538a26fd1b539e4fb2cdc7179f9c38f3ef011bac224242b3edf02a1af8
- SSDEEP 96:/vhLw4RMr8MrzjLv+DlgzbzxNXhpCI4kJ8P0gew4fam:R45HRam
- TLSH T1150237C91F3AA14CD87234103D1BD2EE0F50257127DE3F9820201DE65CE46BA26ABDDB
- MD5 SHA1 SHA512 SSDEEP TLSH
MS26.png
- SHA256 752340a75972dbf504e3a9b7062dbb7670ac16ff32a837f7f1e82c630e39ec58
- MD5 67ab9342fc9eb9da30606a61fcd32508
- SHA1 f226347193ca2d72b3efcf870a3e67041fd25cc8
- SHA512 bc40c14068af8294c6c8113f59e618636e9982c67ca7f348e27c813c800e0701e5e0862e6c58d5a89dea138c046625f0773b23e1927942b9add6caad22a9fb68
- SSDEEP 1536:Iwfk/BApw7wp4U9H/ux3DO7ZESUIJelI0BT:IRmAwpHRmBDO9ESD+I0R
- TLSH T11853F186F30B8C59A598504E8AC09E6C352769FA442F2D2667C2BCD47FA5338FC156FC
- MD5 SHA1 SHA512 SSDEEP TLSH
MS26_01.png
- SHA256 ffceca61a0538931b531a1edbbcbe811a31c20a16f55fa84d7ded97c2fa4d81a
- MD5 c5037809fb65e778fbf01db617b5897f
- SHA1 31d9045253b945ce0abae30e6be5ec373774adbd
- SHA512 3052f0f6f45b3ccd017bdde918d21dc5ec12ba347e4591cb7c3a19821f0d5a623c4a553bd3a12375ea0646a38029e47513041510c9adbd8406c89c5e7494f4fa
- TLSH T102517DFE1706056DD5D0EC5B5D60E08646787C3A841449351FB4BA136EBDD4FF29E481
- MD5 SHA1 SHA512 TLSH
MS26_02.png
- SHA256 73befde90d57a6b36b461932d83b76fd84946f823b031d4e65ac53620709737d
- MD5 74d918030cb20094bddd02e674e99504
- SHA1 7adc2be2e57c9138accac18f7967323629c94d8a
- SHA512 4d4ba11a912efc5d4e1805a64dad751dd27248ab71706f4e75724e572aeb3b577091503fd8fcc807a195995ffc972a6971ae7e805aac697bbd00e54ea123d968
- TLSH T18831FC55AE8568B0833E0757173A1310FF675F2084609127262A35B2143DD58E2EF7ED
- MD5 SHA1 SHA512 TLSH
MS26_03.png
- SHA256 e1aafc9355bda37cfa4edaa3c1f03579103e4aa1869f07a1233613cc19c6a4dd
- MD5 495d8ba62ea9c15ee2fc4a188102375f
- SHA1 ce04324de77a02747e088a63d60d59ea2bceddb6
- SHA512 135c21f701cb83a3d40047152dc470fc097c97e73d2527144a3da0b76507f95fb3af496372f5bd21342da02400d4eb41527a699bc48dd07672632b03fcbbc680
- TLSH T1B821DA56B4DCAA0EDDD7943E7B091D14F438DC0C13D186851206BC9EF27CD4625E465D
- MD5 SHA1 SHA512 TLSH
MS26_04.png
- SHA256 39cd128ea4f0587985349369ac7eed7aa87b857701f7c1c9c7dc8b360b245900
- MD5 5edcbf8467793faa3ef7614b5c405447
- SHA1 92fbdd9e40aea92b59589085f6af0c955c04f812
- SHA512 83ecc14ca168a07df958d2fc4cf709379d292fd7e48e37b865fbd88a51f16fc74c07e783e7407307985475203f8dfac0175a31e2c510eddf4bbce2b4ec435bcf
- TLSH T13421B9B701883A559117A5D2B8B45A55DDB04D65A9F090B9F3DC7B91603FD30031B44F
- MD5 SHA1 SHA512 TLSH
MS26_05.png
- SHA256 5d0c5a14a4621b6120e632166eb55b8d73a81c3dec9afcc8a43a339a8b512e6f
- MD5 1102215157388c178f034d4f1566eba9
- SHA1 651c53f3a9ea9f07b37fff22ee54ecc367d5b9db
- SHA512 2a7b97446cf6c70c69895474733487dfafc450b78091e37c729258779a5c6c31dd07f69887fe72d38508fd24e1de361c2d4ddc5e1a6086a0434e8ae6cbe2d899
- TLSH T11C21C6E47100FA6ECCA21D9075B2CB0C1431AD781CCA842A6F4938746CBAC39D09A5D6
- MD5 SHA1 SHA512 TLSH
MS26_06.png
- SHA256 d9eddbc7181a65f5d10f8e90f8b1734e2092964fb86b8dc4fb54e6007b9d6013
- MD5 a7547e8b2f1b102c181beb8d0e2cf6af
- SHA1 dbd3c15cfb64986a510021ee4d5c81cc3160dad4
- SHA512 608ac200552444c36d5ef6379c277df6c070243b9dff7cbd6a64fd8f69aa038915c3cdac3ea4a4fb2aada6cc3f0ee188e849f8580aa55e98c654d3f8d0b08314
- TLSH T1C111E957A071895C0F08BC3849474C14B78FBE2D528AC0AABD9736B3387FE790424147
- MD5 SHA1 SHA512 TLSH
MS26_07.png
- SHA256 4613539063142a41048d99f58f3d7f097923fdcc6c96474938079250291cd767
- MD5 b9ab37e35b23258018fe5b063eed4246
- SHA1 2158912e4a816d45c7f685488ea2689aca0827c3
- SHA512 a6d0030be7660c3e746554677448b7cfdb759c498d7734c6c68eb9f0de506a03d8ec587eb60b99fa86d45127b5c376afaac8aafbb6ac34a638868f63c3e0ba32
- TLSH T1E2115412BBE0982FF51C03A919FF10A59CC45F292521B5439C25F57347BC28B107D207
- MD5 SHA1 SHA512 TLSH
MS26_08.png
- SHA256 14e9925a703833e27e70fe85046715f811821d212bfd553dcaa1883c5011f113
- MD5 fcf719597f25d7ef318f8e25152911aa
- SHA1 b86cc0380a8b4add245d5d14f9a42376eff90ac7
- SHA512 e27083f5c4b4a8d953bde3bd18e9bf4ef85e10354d4cb4674060990e14887929d27805ab0970a1c12635f5c2036db16d387640628f2bbf36770cb262c82ad612
- TLSH T1AF11E63CB006A97CF5A1786CFA894C023F481C2990D3204492A5FC249CFC1A48CB23AF
- MD5 SHA1 SHA512 TLSH
MS27.ini
- SHA256 8209765e68f761674e82f7e87ec2e08c7ca1ea229a1ee24168e00368c4e188dd
- MD5 61bda012004b5d587133afd04f82cc85
- SHA1 b48eaa593af3f605580fd8be42bd0089447b91d9
- SHA512 4bf1a510fa661455516ec500e6d9155e093db86f5b266e81b7c800646fcdb647930e70f631e1d056a297f420723c53cf83d9f5d6b24b073b5ca878575abebc0f
- SSDEEP 96:q1y6MGb/woTWV4jbMlf/ztEvifnL17MLyL17XL0L17hLTL17KLZ2L17NLkL17oLB:x78oCIBfN/qD684D5nM
- TLSH T166919D5F0B7930D9B5D7B12B334680A62A380877C8BDA49009AF06CD9D1163DA7FBDD9
- MD5 SHA1 SHA512 SSDEEP TLSH
MS27.png
- SHA256 558e50f1a9102bea5f7dcbbf585d4392e244ca9af0f0de3441ef61fb86066a57
- MD5 73b92d93ee5e6fc01a3308aa2aef6148
- SHA1 0ae0bfd93d30af1078fab02739984d2515ef46cb
- SHA512 112a26fdbb7a0d2154cfd64872ff4074396fab98b59fb9ac63ba9dcea1f57ebc71d3acc513a8e6742590884bca21a55fd472e3f1a8f9d45dbf96ba10c9190044
- SSDEEP 1536:/zzrDMD3VnTyCZRNNNtxIp7InZOCQuhMX08Ks1lxmjU2/GgVnA1G:/vrDMDRTycxiInUVuOX08Kem42/5VnYG
- TLSH T12253D054E631AE3E0EE44DAC3F92C8AD2984155ADB6B0F1477A18F40FEDD34B38146D9
- MD5 SHA1 SHA512 SSDEEP TLSH
MS27_1.png
- SHA256 028fd4ff11924c2fec0fc58eddb0e9f28a597cf704a1a09f893cf2abe273b762
- MD5 648c89f1454e9f4803e184b4c889f478
- SHA1 f2c0575009cb4b45a5f8ac5a00774808be818176
- SHA512 f063c0dac7cf55d5a5f113fed651d15b7e217698208b13ec4ed7af2ae7bf7e0b5b6169d683f7a2e6884a5b5873c55c70e61bfd1ac360c85dfc0d6bc76553eb56
- TLSH T133615E40F9DBF02F877947EAA5A503C064E00D255451F8D74E4EB3511335B70E7E5D0A
- MD5 SHA1 SHA512 TLSH
MS27_2.png
- SHA256 ce44eec7fd195d839891e152f418dce15e896e9c62fe706bc605a99f060e184e
- MD5 7d5870bad2ca0df89021cfc52df6b795
- SHA1 5de6f2840a47ef7f3433a7d31062b8403c46c0f7
- SHA512 60c3a582de8fc2ba3876f53151b71888bece64a60738c774928c45fbec34db2c73040ed3cb84bedc234833c5d883ff00ae9bb5bedf829701395d828d9ecef52f
- TLSH T14921D6DC1092E59DCE1AD2B8E6423F59A8224D0E462B8E2D6A18B6359EBD847C510386
- MD5 SHA1 SHA512 TLSH
MS27_3.png
- SHA256 51c4120a443c9b569faadf6a216276a6f7d95390e346bcbecb00ff041cd59b1f
- MD5 4edf3fd9dcb36a54b84c194cf544c41d
- SHA1 bcf58724140560262fa59258c75134f1ede86737
- SHA512 10999c32b9fd1fc729445155b159f434261dd5beae2e22240c7c3b491df9aa8e4a88c5d317e59c56f25cfba4a7641a3a287f6cf31e20a0ef64d66198b3d092da
- TLSH T1EC21D588624470588A9F11F6B7CC73AC2CAC3E7689E48494F67D7E35807D6CD0086D48
- MD5 SHA1 SHA512 TLSH
MS27_4.png
- SHA256 a499bfbb17593289a266d20e68c059be139add1bcd589bc49d620ae4b4065f2a
- MD5 eff1fee2e78d9d842f4432a47e97ba04
- SHA1 79685398ecf02fea1cfa90768be640ddce2f694e
- SHA512 f2cbb2cb1bc5da40f8028f3daa856078bb1eb0c5d48c50d45ee1d8d697f17890c89c8cfa2e22587634d006e67393b923c8ee3fa6328369c1a16eb7f1adb8c7ce
- TLSH T1EA21C6B3A255D14B15AC5C90FB892974925F8F15A035E52CC8CEF81C493F78048EB302
- MD5 SHA1 SHA512 TLSH
MS27_5.png
- SHA256 cc16974940e8dfdb41eeb863ae0e762ff38f890cd29c760aa8e67b882d5bbc27
- MD5 9422ab118d09909207e3cad08cdd331c
- SHA1 fda6c7ed94323c9215ffc052a00d7c3616fa8cb8
- SHA512 c81200d3c7aa74d107d05ef6753ce082374a8e0097d4e51c70bd876ee07d94ea79a4738c2e9db825b13a078cb5899734ab3ca78f3dbf903b44c224b6773b83d6
- TLSH T1F621B6EBA3F1E40EB5A32608E7220D4D8DF42D3809593A09150975A7AD3594A4E1C30B
- MD5 SHA1 SHA512 TLSH
MS28.ini
- SHA256 26aeeec2b294da0f38f4e17bf1b83f171b43c4b7d9e6c573908c6d3e6be87e77
- MD5 9626aaee7055048b8f2ab4d9dae14535
- SHA1 c79ed983d7f0fb5c67c8c07b6a4b4cfa3183c45b
- SHA512 6943d5a9ea10350a21ad890ea5b29f1c7f89ffd5798ae1be1ee5505f734e0da566a53e97f5ceaa45152ee7fe548dc271b86f39798deafb729e9160c0519f4484
- TLSH T1F361885F1739369C810B717A338780FA2B6805BA8CFDB848644F01DE2661D7477FA9C5
- MD5 SHA1 SHA512 TLSH
MS28.png
- SHA256 40bb262137fc58cae19519502e8e0f54ee0c1ea7105e725c4e2af1da4cb567b9
- MD5 76d6e896af57fb68ad0248e68389bb84
- SHA1 9683078d4ee9ee20232e29c94055870b877dc9a4
- SHA512 2c382ec0159efe0196f12c43f0c4c2d08110cbb96c440d8e62cd56ac820e4181cade396e1bb34663b6719ff689aa1389c61a46622e657f49cec039ebebe83e03
- SSDEEP 1536:FyB7Pakag0otsq0PDU0/3LOTFUx5vXZLPzW3RmUN6gjXf3VZQ:Fy4B1ryGbXRPzW3MUNbjXtZQ
- TLSH T1A963F1E4D321BE3A56C24F4D3EA3C8FD5D8615458F071910FB66AF10AEED21B3A140E5
- MD5 SHA1 SHA512 SSDEEP TLSH
MS28_1.png
- SHA256 f2532ff40b92ee29cc40c493c01213754ad832d4b4946a57119125e87fad0c87
- MD5 941e9b92ba33340d850d98026f81e94e
- SHA1 49c14658b73f025243971e9f228de2772bf50ad1
- SHA512 8e7fe385d81183ec61b48127b4f22c7329dbc68433179919e198937e794e19cfb3353067b4e7697176d4c574ce1a385a380dda8564991d4da5f74aa714021e33
- TLSH T12A0175D2D49A2A21C756CCF1156580390D791E9F5683EB07B4687C5CD43CB8057E4190
- MD5 SHA1 SHA512 TLSH
MS28_2.png
- SHA256 da00768a714154c1b8272846005736e0d2f5744e2c9ae85c3d046b42ea27d874
- MD5 d25057ec93265361cb4422704cf5a777
- SHA1 01f9df14d15d55b151844c158553473888aefab1
- SHA512 313c4eb373ab096eaeef98be165c29329ec7585ffd24c1d77ef07920f520de36e9eae14af065870a5d914e92909fde637e35c14667ac372903b267a2c6bdc3e2
- TLSH T1DF118873F114265BCA8D17558D1D15316EE58E0D25C0AFB82744B528CD391DD9426397
- MD5 SHA1 SHA512 TLSH
MS28_3.png
- SHA256 fd0404d5d5a1042d7930ce62a2f48e5c6f73e7811ad892b3096fca4429244fa1
- MD5 0be6e65e38eedca6293c05617320ec6c
- SHA1 a64bea3a89a0a7496891b9e66d307c4860714e4e
- SHA512 71606a3bb56c6402eccdc4171b6d592591f2c2e1c2e152c15148bd9ddf0666cb9eb7ad17bd25c5bc2444bc7b43170761b5dbeb5ca461e7f9f593bffb5207595e
- TLSH T1491163C522E5B2B5CAC502E12383CE11DE074E0C2B718649C289FC1714382D2806B399
- MD5 SHA1 SHA512 TLSH
MS28_4.png
- SHA256 bc8b7faf235f3e1d2c2c2b2057ee55668ed357224be64bd20755a69adb4817fd
- MD5 3114c453826aacc22f324aa0564e8ed0
- SHA1 7a4e7e15f5c7a0850724128a6dd881e1c9a51413
- SHA512 28f0e462ad055bf2d653c745a8fb9d1d0fb46cad3567114c0a5fd29915bd855d1c79a87fb366f39c6894b4becb97a2582a60d9ba3d9edcb53723b0817c13638b
- TLSH T18F1194842DC2EF56D50A49B86B16E5E1AD000C090D60EFCB9808B9769937153A64BADE
- MD5 SHA1 SHA512 TLSH
MS28_5.png
- SHA256 335d3ee9025661f7789640a834f1dead473fd364b1938be43383ba4b84af5f4d
- MD5 996b6bc98f9ccd77db4f437f68c4a22e
- SHA1 4e110358df6ea382076326f1980fda140a9a9aa2
- SHA512 0d983138cd4773beb16e62097e094d0a28957c4035f4511fca6077136016c897824eee573c414212f003754ba056a4e3889ea2194d543310624a669ecd110aac
- TLSH T12011B59CD5BA8D5A493A52C6CF83B32478E16C0468F3A010AD54F52B603D60AFCF0AE1
- MD5 SHA1 SHA512 TLSH
MS28_6.png
- SHA256 07a5399e8f11e0678b88e34f41632e4e347d1904ef23e485aa9c4a9f80122ea4
- MD5 c9c2783f5516396276745d0cbb417691
- SHA1 a94fef86bdf4a33d7970034297540cb5adb07e9a
- SHA512 dfcaa18bb6c5216342d80ef76a43ae21935136e05dba3881d75ee87dd5fbc55f745a47be5a05edda9059fc73315af8c0a7f2655df4abb77f27db9663946a2e10
- TLSH T1A1219353C314B821D85A9F5422877A2D45225E447C80A3DFA51C3D768BB66432B82B0A
- MD5 SHA1 SHA512 TLSH
MS28_7.png
- SHA256 33e96aba75cc0284d4dadc9b407810a717fe2dca54daa6bae1dfa9cf6ec6916f
- MD5 4a53d451b5a858c20985282c15ed913f
- SHA1 7a4ab80e20f525ee40b8c4dac7b6446ca3d3d10c
- SHA512 bbecbecbd3ebbb39194725a417a6b87856ddd12b5c436d3f4553e4f163ca15356bd40e4048aa9b816cea39192574bac82c854e760d2ff8ec3697fd777127e14d
- TLSH T18D2184D2154083BD9D9D81F85E17C89938691E5E2C2FC316160CF599793AA09C12A796
- MD5 SHA1 SHA512 TLSH
MS28_8.png
- SHA256 2aaca7b9d072b7e724fa7806e351fc2fa2b8c3733d5b0e8c0584b4ec2753e5bd
- MD5 65162b069a1f212d12e61076a8e3aded
- SHA1 97e75501862f9452450482fea0bae4e0bbe24084
- SHA512 ccf51630d8df4a3a0b7524fdf74e7b0b052864576b7c9245b735595e5f64b65ed73c8c5821a81d39c110236059400a3972c16a1ce765a389d353f704e32794a0
- SSDEEP 96:8uszmoFgnCzkTnbv2qcsiZ+xRlMHeIax8IU7/BZ:8uboF2bv29siZ+jmWC
- TLSH T1BA918D639272F088A4DFB0914881499DB97107F8D478F4317807B9B2313CD4EB86790D
- MD5 SHA1 SHA512 SSDEEP TLSH
MS34.ini
- SHA256 9730d685ba1ed46d561209dad8c7c0dd2abd167b1d9e21d3d7b938377c81cca7
- MD5 fdb35edd8e21e7ef2993e6bc22546d17
- SHA1 919a8118bd25eb409ea904fd3b2025cad4f889dd
- SHA512 5da6c75eaf1b81fb58059127089394829074b8bc61853dde836b20f04871694d8a5f2b4522be4486c523e9cb772b77ab1fab4062ec3654b5c97562d7b60f6e17
- SSDEEP 96:8HSYv01jtz/R1DosXZWB/NqyDIsNJy7qpOv1xCtOT3BvqBIPqIvyhWIkT2Gsg127:4pJyGIv1xCQ3l7KhXLyi38RM7
- TLSH T1C3D1AE9E573A3ADCD417B26A324B80AB176A14778CFDB480182F01DE2A2197477FBDC5
- MD5 SHA1 SHA512 SSDEEP TLSH
MS34.png
- SHA256 37e91e01caf3864054f13f07cc779029687063b48f3834cf44f2918436df9fe0
- MD5 d1b92cb9434cff56dde64ea44ae691bd
- SHA1 3fddf253d875476c5926c6291c086f309768bda0
- SHA512 6ad7aaac5f35b4374c807968aacf47655e13c356b5ca9dc94733e93637cf10c92c71286f5b4ae09ef0d6c3f96c5a50145a0eef4380c53396d74b1945c2b11722
- SSDEEP 1536:Qxe9bGDcXb/Vy9CgBWk38EGOdupyNUhtpQA1Uz:7icXb9pPkx7xEUAGz
- TLSH T18843025BC351E79C7A1796F3D697848881FA1C1207AF0CDC02801EC7EA45EE6621DBCB
- MD5 SHA1 SHA512 SSDEEP TLSH
MS34_01.png
- SHA256 3afea7013ed838c9db2716d24fef8ab48224f496cc994b16f87d8b991f3d8cee
- MD5 adef04e0fd11169c76ccc99419c61ae9
- SHA1 3362a1c971858faa88bada4ea400ecb9bfb3ffe8
- SHA512 35da7cec0cf08d0c034c1ec57b842c9795a8ad304a9e857654b36e6a90775af0d429f0443d1bdd9e13ad442982daf19f73bb361cfdc89930c9d27769969a181a
- SSDEEP 96:flmQ0a1cdMxtMwFx8C1znHXQXpZ68dweQ+L/fNMXrvsw97c7vDxVM:fsVfCxF1HX8pZ68cC/fi7swAvNi
- TLSH T150A17CBE40EB00C3BE9ADDE89780899BAA71FF7F0B4A021D1144441915F58C992A0BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
MS34_02.png
- SHA256 8af9390be5a6b935b59b3158b4b6bfb060e8b5ab03170b01d192a8c291af9bd5
- MD5 871773f364edaf43b54d317b4d4ff05e
- SHA1 88a16841cca60cad564bb7a4c254be5c07e11a90
- SHA512 8efc283751a66e47b643a2a674c3df48d92d65a84ab6080f999ebd09c1cc363c841af2e2ec1baf21e7a6d3e4337873b9102698acd189a472aa560dc2164e678c
- TLSH T15A613AAF2A21547D6F800E78C94405E5BE8D4788AFFA5C0DAA344847BEAD8C012DD2BD
- MD5 SHA1 SHA512 TLSH
MS34_03.png
- SHA256 33204f34e250e08d3990e8a15b954fed0657b7701c3e9d96bc6d6dde4702bf85
- MD5 6ca136338b1a53550d67efaf63ba6ee2
- SHA1 15f91a5cdce3665dbbe5fdccc925efd9a5831498
- SHA512 40c32bb9f8c31589829d164025dbc7f0d0615270037234be9dbc7a08ad260ecfc4aa83db30e12280a7d66cefd94b214267f88946668498773e100a6e443bd580
- TLSH T145F0479F1BC09F38C60C6B7153149E51F4B70F8919F64B9B4F3999E52E5135114C6351
- MD5 SHA1 SHA512 TLSH
MS34_04.png
- SHA256 54cb71b42aeacd3c613d8c78cb9a9f38d0a8cfadb2483da84fe7abab51902879
- MD5 b53c3953169e6c7ea3ac3302a8874a73
- SHA1 907cf4b1da550d75d3a3af48fe6686b779cc52c4
- SHA512 a8a61e5f6d1a3813c2d45d9f0994f4cac7a70f4e2ba69fc8c9048e53a06b833887fa2cb9449f65084f366c38ebc594304d5f6b5d95823a0e2369684977180a0d
- TLSH T1C111C844E488C851E40E293939963CDF9AB6480B47A916423F025104CBC37FD6AC53C4
- MD5 SHA1 SHA512 TLSH
MS34_05.png
- SHA256 6c2275740bd15478767e2547f755aac86b5973d97807a9e318a50a2289330618
- MD5 070e962a217453852a9a8d09f8cf9162
- SHA1 a6c40de21c0f0562edf42db4a7ce23e80cb6545f
- SHA512 c2878521521abc5837e8d0c5ee3d062a0d398f6b06856bd7fa2273fc8025adc89fe6638ddac5039d473b733adb42065c9013ba9e254729923f0a7cb9035d3a91
- TLSH T18221CAC896F99131E8743286619E4626AC2F855948D382577F371836EEE2F53044C7F1
- MD5 SHA1 SHA512 TLSH
MS34_06.png
- SHA256 0adf54dda35b7c5cee03b4557e0c7598a3a6bfd29a0e934ed4ae939b0e9fd819
- MD5 3c104344c40bf9bd7075392a229f2383
- SHA1 143d193cdcaff4df3a68bb1f1a999d267dd521a0
- SHA512 8f9535780efc98650cb089f8c8a516c82d0156a5cfaf927afa88cfaa421dbdeab35d1a0c8e5208721d482a86dcc59f3133a967c02808c3c96c193f15d1c04dd1
- TLSH T148F0E1C1D5C9555DD5E84915B53B0AA3F0526998790246B9F50D88FE5E40075E163F02
- MD5 SHA1 SHA512 TLSH
MS34_07.png
- SHA256 1be7577f7d7365ae3bf4f479ea90fdd5c626e782035a27f292abf1fc5b6aac02
- MD5 4b79b87e555e7fc65c2fed4ec4244c07
- SHA1 af4545e8cf1aa94991418f238cfac5f82bfce54b
- SHA512 6d0f72e9471cc8489a803042020d89d1db5061a494bf01a3ca0cb269bc3ceccb124665f827bfd0db4c09e2ee37793ad7535bf62a8903cd21996f3ef650f40db2
- TLSH T105F047D1C182A85B9574140C44491A55D3634AF7F6D336E7D12AB8341DC35B9BB04711
- MD5 SHA1 SHA512 TLSH
MS34_08.png
- SHA256 a19347eea0d56cfcd2400ce87559e263420251de67ee452b51263005df23dea8
- MD5 6fa6e9aff4f37bf66cf56d4cbc0c1609
- SHA1 0187c6ab914af176a6f3b97c7483e3c033d8bad6
- SHA512 4ccf027effefc1d0d3191c1f5116cfc73569ee9c7769426553e9994542afb92d5dbf876e70e1c0485f78f89af79d5b83c5989226eac7d54c26a5b5f151093196
- TLSH T183F00C8FC1D48E7A89CC41D816CB9191F4B3010AA555551CA85FB62299B2E85218314D
- MD5 SHA1 SHA512 TLSH
MS34_G.ini
- SHA256 fff555b12942e6fba029f144be31f1a0d43573e98b3e197fd68bee945c55d1b4
- MD5 7e2af9bee2b0d1ee10a237731a2e6c9b
- SHA1 76ca0038b1e158eed46cd961e8850affe2211adc
- SHA512 225e88f05ff372283ed7dcb1dcf40f8f8f13b23f77de78bde30ceddff507f0e2268a19420f99e7085b0653c91be9a9b8c039a1a076f9b787aa76839a9fd1ee98
- TLSH T1EA71D09E1B6935C8D052F6AB334784A3227A14ABCCFD54C0182F068D6A2063867FBDC9
- MD5 SHA1 SHA512 TLSH
MS3B.ini
- SHA256 a0566857ba12e8dac5a7bb9a6c2f40ed891427ae564f804a8c56714a273ea03f
- MD5 b78e90af1507b7afa4c669e4216b9899
- SHA1 737f5244065b8818a83bc316e61f0930e322818e
- SHA512 cb40a0eb0e06c5088a57a0837e6abc70c99988b64515359ca208f29c7ceae50b0d28c1281bcfe67dae0a2bdc8a06131f0ed0c74dd2dc31cee8df354c64b407bb
- TLSH T105418448173E259DC1277739308744F72FE124BB8CEABD49586B08EE3661A313B690D9
- MD5 SHA1 SHA512 TLSH
MS3B.png
- SHA256 2ba74c876be7e2670e9bb71b62334b39fec2b629cc6ea80721fbbaad1f27b5e9
- MD5 f0e8da1fad8c5f3972cd0014d90c1565
- SHA1 0a53206dcdb59708e6920a11ed7b619ce89b7c69
- SHA512 18f02470bbaa4a09d897476f1f43b6978ddeb4724e6a1629a1b7a8c4afe8f1a2a5d2a7ade97702dacf18b6d35b1e9c0accb73744f0bff86734abf8d2a737728d
- SSDEEP 768:i/42yC8l81WlrudXTXPqqLMnKuwUVc+hSl6Kbw7UFljH05qv7:i3N8sWM7SrKwm+gwurAi7
- TLSH T15513D08AC46B862E7D1605FEB7F12FB9F06F6E6073DD05C51254A5DA3041BC8E11AA83
- MD5 SHA1 SHA512 SSDEEP TLSH
MS3B_1.png
- SHA256 a34a561345d915d1a23928267f91caa2a1fe1c04d9524e0033a53f1adbf90c75
- MD5 e05370dfa01ee6b08030f6e44c1b1fc3
- SHA1 4bb1073ab8c4ea8911973a1b800145599f6f51b4
- SHA512 672f3218720b55d70aeff8088eb7d2378c2c32c0239fc06eac494988ec4d69ebf53cce68163c90abd524a1f3255d40ed7bea55adb8b2f6512706a7dfc1e33d95
- TLSH T141510AE1E201B868690A0461B60AE2EC61E31D746274503D6726B565C777BB980FD3EB
- MD5 SHA1 SHA512 TLSH
MS3B_2.png
- SHA256 49ced83d69e35115499c6bafe6572245d4683d07fb6a022511d70fe7f8c68d74
- MD5 d2ed6bc530aaf5efe0d63c80dfcb4f73
- SHA1 fa3ecd78612850405e7633ebc818349883acd819
- SHA512 b3586fb007ac48d4f92812b49f300442afc246e85a633f8391e69115b6700414968815396afaf00c0e5cb511f5bbb88e80e48cb04a095d94a9454bc294abcf4d
- TLSH T17B512AF6A4B1DCEEC98D2AA8E190F8940FC81D96E1541C0CD58871A4AC36B07789C6D5
- MD5 SHA1 SHA512 TLSH
MS3B_3.png
- SHA256 ce77b1b83f497abc028a8ee604e62848c17249a886139e085b013e6cb40ee4b4
- MD5 a81587ff7a0d8902df5c98cec14dd6da
- SHA1 ffe14f6fc0fba91723d75f75bf138f45b14e3a50
- SHA512 a686fac9fef5f416166f2da3a290c2480009183f8e8b0c534ff32c4371e770b2d559f0b441588a1068f5c45e9ac04b981635dc5124cc6c2a820cfeff1e43c177
- TLSH T1A7414B524F1E4E5BE85617E77A204E6BAF98CE9708637A60EEB4F225003661C1CCC765
- MD5 SHA1 SHA512 TLSH
MS3B_4.png
- SHA256 fdf05ef586988a54658de71548dc40b9dbf72735188346a688d38bc41994bce0
- MD5 741d5b186663a67975f3ca67ede70e12
- SHA1 e345f9a57dbde4b31370249de9a1b95f13e1b2af
- SHA512 4491b3a61c8687d8a847ceb843f1014b87af5db9963144ef60f7884051a600b89519f01334a26471d58393734d5169161edb2e9dae6472d7d560630e8b474425
- TLSH T15B415D06EF584C19CE5FC12036F6E80559A05CE7987CA1CD470E782A13FF681C3E6107
- MD5 SHA1 SHA512 TLSH
MS3B_a.png
- SHA256 afdfc6afebd04bef63438f64bab07895bf26a44972d2a4ed8856c4c4f118e9d6
- MD5 f59ba9c1a1dfa6a82c9b5e5a1aa41020
- SHA1 e51622289d28f9cdd9fb5a8166c5845f32244d30
- SHA512 d8561d5c037bff014eeba84edbf8274446a8dd51c55ea5f40d804faac938d45e6a9a503d1b3d258a862ea166f8573a19db86567d8d265c1f4cbcc014f593d4ec
- SSDEEP 96:n7ZfPrhL2R8eMeiLFYcFnhyen7swqlrH5H3NuKYxu6ChWf:n7ZnrhL3/TBphy072VNuKYx5ChWf
- TLSH T158918E9701D5E078D801A8942AF77E12E71C9FE455F7D80B481372CE8D3BFE8166A047
- MD5 SHA1 SHA512 SSDEEP TLSH
MS3B_c.png
- SHA256 a149e8f2a7920225a53eeebe82a68e0fdfdf41502e70ee772c1ebbf91f445486
- MD5 8be8ff94dcff80dc4fa29c500099d9b2
- SHA1 eb67cbc97d0690ae1fa43e2ae9a01cf0ca7d6f5e
- SHA512 26f294756062ebece1df00ed1380ec52e278539ea1e45614453166997883a84e5fa6c666c94c61ba39dfbf482f81d2b3759467abf32f6f5fb23fd15a3d86f65f
- SSDEEP 192:4SrHxCmUSB6o9m5RuD36n95PZocfDy6Dh2y+Ioq:DrUZSB6SMQKn95PfW61Teq
- TLSH T149F19F1265E48A11874A3E9108B161A974730F02E72EE13D9BAFB8076A7F70E4DDA721
- MD5 SHA1 SHA512 SSDEEP TLSH
MS3B_m.png
- SHA256 08fd13231fed79786744a8bf04b2cfba8f5649cbbe39f4c8060f8d9304a503e1
- MD5 4072fc451249b7679065741646a59d24
- SHA1 4d098d1cd121ff57f91ee66a6f9b674f9073078b
- SHA512 23829f26e466322ed8792f775fd1bbd4192e161506839f5c4dc937341ad3f3bcba5ef3d67a03be7558d0dde5b48e8ce00e3ea45b2c6218d7eadd2ab32b64ff3a
- TLSH T10F616DF60E5045F22256926980E3E27C3F772E100BF72367E46672ED943D94940C659B
- MD5 SHA1 SHA512 TLSH
MS3B_t.png
- SHA256 d4d62360c1c712ae6a5bba55e574b290d9c51f194b5f28b65f8f1a1628715f15
- MD5 f637c77f01d40c56dbb2fed373cb3bc3
- SHA1 ec310db383a8bee3712f2bf782a9a52852945963
- SHA512 d62833979fe866bd233dbb6359de44ee540c9857672e9cc2ea1b15547f0f375c80088e0f92be7a62efa9892e8acccb4f6914d5c51aa6c52d9e82a915d603e8f4
- TLSH T18A715C597BF0C9A0E51586F134C3AF30DD050E5F844CC4E03E4ABF0358751F8D099628
- MD5 SHA1 SHA512 TLSH
MS56.ini
- SHA256 272364ea344ea3a5fded6e57573aa1b121c268bdc6b93f6f8ce056022785ab26
- MD5 1d3b572d50f1f9d8d47455704db965c4
- SHA1 93024c801163607dc7051123488a3578901df522
- SHA512 839dcccd77f74bd92c9e3a968182b1ec5136ead159c082bf07c97054a7285590146a0520fdf77d934e8da905c82ce07246695a3b09c7c4d5e807aa676a8d3ff0
- SSDEEP 96:4yJM49Iy0y1BtDq5AMmz3ae2x5l20ui/0XRx0tMl0Rv20SS0rNQ0WX05F0t1:wgnPcEFMbBshuGS9bgRF9Ev
- TLSH T19BC16B1F1E3634DC9056F2BB3709C4E562AC09AAC4BDBA94085F06C86561634B7FFDC1
- MD5 SHA1 SHA512 SSDEEP TLSH
MS56.png
- SHA256 82bc4b094017cca2f32831406bc37897ce48e0d594ede0d99c57820f50c28917
- MD5 ab73e4f582d36b153ed92f6a51d6ba80
- SHA1 e8a3d290cb81641ebf49b39b307ccd07d17f2ca7
- SHA512 4f83e02c9ec195d69fab3c873737bcc756ed148de193256094523ae1cca80c9535acc8943be1bd19dfbda9d671dff52734539437f24da18d2b17462f3c60f40c
- SSDEEP 768:CilhxuveN5cwVDXLd7EREiyS0834ClbS4CUNq1oRey9QS7pGL0LnXMcdv/8o7Avg:Cqzuvs5cw1x7ER13tNnNq1qnc0/TZh
- TLSH T1A843E128FE190EB4DEE54C807997D85D4448458EDF1F4F48ABC28A169F76AB2FF801E0
- MD5 SHA1 SHA512 SSDEEP TLSH
MS56_1.png
- SHA256 9c3d0f54a8f9d7f62256fdfa492950691e2c43a8c0179bad38105dbf892a0a1f
- MD5 00196086731c19b2c10d279b2f964947
- SHA1 b66c4ab07f44c03c9ea95de2db20ed7b2a5d3c97
- SHA512 0b9f36cc6c1de9081e9bdbdfb35c5ccec0671253f7a53be72dc11d3c7810298d6fdec712efbf61218578c16d8ea2d000449d212f6e92b9a2dd270c2ac9db80ab
- TLSH T19A513B4DA9F5635DEF080CAA2C4F3382FCA0CC52260C031A18AFFE756939991A7E5750
- MD5 SHA1 SHA512 TLSH
MS56_10.png
- SHA256 1ef03914df89e5f3cbc127477fc9211862e14a8d8b1896d157bd69ce54641d18
- MD5 fa5ce40289b17ab3aaa6f26059acb391
- SHA1 c9158c54f4d7a3310ae41ab9c9bcc1cbbf0394f5
- SHA512 8252985f23a347a463036eefe6858a5798ed5a38b28a1fa4911a2ae5cf6538d74dcb5ae1d525eb1c22ef4e2e729625d53f5f2c81a1e16aeaa36f14262fb68920
- TLSH T1F711EB6364945CF5C53010179313B53185D24CD1BEE52AA3613FB04D08B553E420C382
- MD5 SHA1 SHA512 TLSH
MS56_2.png
- SHA256 d21f87d0ceca2ec2a93fb92215c93c4ae11076f206068cf4baa7202d7179db6e
- MD5 81ff19f82ab163cf83282e24f231534b
- SHA1 3bccaf4e0cbbb640525f4fd6fb4e1f8a2d200c4a
- SHA512 9014e398f9bab72c4b3d9a13f3f8b2c6584fdaa7a41809a8518597a7ab82165662abdaa09c7eea63f6e781947f06d5741e9a9ab48043fc576707ecdde6f15807
- TLSH T1261152CAB3039930FD684529929B70E0EA5C8E61716DD80D502AF85660B7968C484CD2
- MD5 SHA1 SHA512 TLSH
MS56_3.png
- SHA256 307079e3fd8143cf5b67d73a917ef033573589cb7ea38029a4b3fbda2eb9bbdc
- MD5 d7da3d7e4ac7cd40e7bf46191586c941
- SHA1 fd8fcd2a7f04a68d58744da869bfc0b23d08b932
- SHA512 5605e062647861fd160d62170c694c404f2f72bac2e38fe16826b4696982e38c2aaafa799bd143e83eddc9214e08c88727a35ce166f775bd56e8d8442ea32617
- TLSH T1E911987D35C87AA94F1F0C3B8AF6D8036B479E9110128585084B776C49BBEF91A02714
- MD5 SHA1 SHA512 TLSH
MS56_4.png
- SHA256 4f4b68409dac618e180121846c31fde7872cf1cadc51a8f55ae5618769426f14
- MD5 1a4dd2bd90e05416ba449abf30849cda
- SHA1 ff4465299baf063e55ef454155f4128f74c9654d
- SHA512 c702dcf46cabe6409ed05ddd8288e138fafa3c1d346c4b00f54838945a3011b2501de4b2f23e4502c77cacfe022d78166684ff4e9a18a426e2538a269a7c4f96
- TLSH T1D811B7A1510CB0E8CC8D1D650BCEC522EF387E2D67BA281C1748BDF0287C82952958C2
- MD5 SHA1 SHA512 TLSH
MS56_5.png
- SHA256 c17c8dceabc41b98e20268c86e79fd070f195151bab96e3f3640628001e14d39
- MD5 df17d6abe8ab458760116b58c3996b74
- SHA1 140e6d127fbb19b0e2994cfdfdc7a16ce68bdfca
- SHA512 eb388a259f8222384aaf4f0abac68702526666950dce0ffa5b4e10ea20a523e55f90efc59398074f3d155d3ebefbf9a101fd72f0508867def035a1d3f5106356
- TLSH T102F005C23D8A3714D0AD589172068524E9034FF11781B37E514FFC3847B9D8464D22CD
- MD5 SHA1 SHA512 TLSH
MS56_6.png
- SHA256 1b71f84322a83a51ce23949058583c0673bda36d02d94f9246b57a0a730b73e5
- MD5 5de958cbd5b8051b6dd732fda2659557
- SHA1 aa717c0e787b2b21a76447bfe6a76c232f709979
- SHA512 42762a77f3c82e34533002f5240bc5b683a797ca798e643370ff2c3f40f52fb303a0a9dde3d30ee24bbe910fdffe46242e54850088c22f88b5acf2667bd2ea18
- TLSH T1F4F054CAB6C05030C91AE5DA07332820FB57CDA38791620FDB0D371A003CD84EC61908
- MD5 SHA1 SHA512 TLSH
MS56_7.png
- SHA256 db626a5cc33b560ddd0acd96605bda16de04a946b1ec68c907aff931501cd09f
- MD5 ac83ccd302e3e4f9a149a4ebc7954da2
- SHA1 dd3cfe3f9bee0ec460ec8c8dd07937c73903d7cd
- SHA512 9f9ddf3faaa0f62556d790870a61023d9e150323008e3fdaa8ea0e2dfca82f81aa8b5d3ff3866fa758daf2be633da2efeb2de247e4d7e58a02f3f24b2ac9e8f1
- TLSH T13F01968962970760AC1660CA720960A05FA44F5088840E953907F4EC2A3DA8C7B14399
- MD5 SHA1 SHA512 TLSH
MS56_8.png
- SHA256 c13168ec436c7c7ea30192b953a54466b0eeb08bb4cab5b3e53ef8c238d891c6
- MD5 40db5fd87dd34e35a062a83d091b96da
- SHA1 8314c3ac66dfd560f06d83d2e641d3904c65e1b1
- SHA512 d2eb1e8f60d906e5715456a75835dff99b697cab5e91ff6dda0208fb9db895b6e7841c9b394c6ec15db58f3e1139d2b9efd04fd9bb643edb2bd7ed651628f774
- TLSH T1920165DA3B61CA20F95FA0E0AB2340519C750D927081C95C45487532A2376828D53FAE
- MD5 SHA1 SHA512 TLSH
MS56_9.png
- SHA256 397a3b956bb1bff3d638dcd4f7a07debb71b8ad181e97f075d9f12120a16c4c6
- MD5 c58b2b59e7e5ba4cc7d4eba67e2af1ce
- SHA1 6734a3cdae3e255ad6ee37a3d141376fa0269bd9
- SHA512 064711137b378d34777d132b5d4fd174918a9843be7b4357956046fd92dec947a8810c15d088f6744209bfa3e8b537d7db1d70080f89aa14742b2c37a1b2016d
- TLSH T19D118A7492E047D74439217073870916A331FD7949856D5693DB3F15237D82B60457C1
- MD5 SHA1 SHA512 TLSH
MS6.ini
- SHA256 35f63ba6710372726a6a329e3bf9d1fea5ee84af095daa8d797eb5ae5e52185f
- MD5 c089aad79a10d48b3b44914d5eb9e24a
- SHA1 976c7178fe9943573f66d873fea092d552059e4d
- SHA512 894251c37581de78271001f260b99ba7c6e92134106f9f5442a4637eea30d4731634e6732fbf95250fba6b20e7e6348120856ff17a05bb2cc33e2a4be09ac3d8
- SSDEEP 96:qZutZAuhBvvh+oiOXwy7FEMqlwq2WXSBmcTh/JTh7MTKzVTNeLoToqETzMq:2uTmnqZV1AURoLMNYAq
- TLSH T150B1BC5F0B6035DCE016F46E330B84E72768446BC8FEA4E518AF05D96662A7867FB8C0
- MD5 SHA1 SHA512 SSDEEP TLSH
MS6.png
- SHA256 ca5c24cd52821570fa2c200b0275d0a701ca2f98ea1b4fc36ee7243ee6a25c4c
- MD5 736a29dcd442eb97e79ba8beef3a5999
- SHA1 ace88c81298efedfaa2dfdec57fa5334564df520
- SHA512 23b5748c56dcfe4b30aa0474d1441b1113a236331c3ef0c744ac1db3656cdea47400e0ee8c35873492b51187aa8ee3859da5fe4605485039e7a47229cae2dec0
- SSDEEP 1536:26m+h8nKkiNiGpowp8vQTsCE/6F/aYx3/RgXObYb5FoBTiQb:U+KKbwoHpsbCRF/13JBQWb
- TLSH T12943DF58F751DABE29E00E0A7F42982E3619586DDF1F2EA4E341F852D8FE90BF4241C4
- MD5 SHA1 SHA512 SSDEEP TLSH
MS6_1.png
- SHA256 a591254d73df9dd959e6cd5b2d3b44e44294af118a9f94850be590fdcaade693
- MD5 c1dbebf3a704d69d654e10cbaea84c08
- SHA1 9180b91319f7fe04ada26e4ab96e0c4ea1e186f0
- SHA512 d5a6f24b3f7b4e516e54a14fada9fa8f679e89adcdae70a8931f84e982c898ea507bc1c5de850534fe1a46bf349c29956866aeaaf25de8e61dfa739b2a0d28da
- TLSH T13321B6E6517090AAE03A4C31834B44C8EA3D0DBC28E14C4DB1D97F9DB5FD2C0D84521A
- MD5 SHA1 SHA512 TLSH
MS6_10.png
- SHA256 840772c946e2e4d0dc92504827cc5f08389093e5da20d6a54fadea38d0381568
- MD5 b5eefe9c0f0b68ac104410cdd1c859af
- SHA1 6f379247181100b0df8e588c5e2569542bf33a4d
- SHA512 bc58e353b2c83b16c397352723a86ce521a9a2a0363abc4075eb99634639ca91e8ebaa30078c36833a567f8732bc91f854313db424a25294b31bfd2a68ad472f
- TLSH T1CF21B9409ED15AA28B3B162B1207AC095C81CE94AB937535674F7183157728C9C4EEDE
- MD5 SHA1 SHA512 TLSH
MS6_2.png
- SHA256 3876b2091ef093babbf7470f4f802d33789dc5c27d8960ad9927860dc72e0afa
- MD5 1ee4bd85860ce99c59b914a79acad2a2
- SHA1 1555a5c274c91e7f9d1112f4eaaea091cdb3cdac
- SHA512 10d8878d66318ea875574affdf14e13d0e193568c4243df2156f8079329718c7ca0f57a4981e21d12d192783a516285895cdb51f7b393ab995cdaa33a464785b
- TLSH T11401239113C14A13E459887A17EEAE605F909C4CD59F4808DB1579B1947EE8C952A2CC
- MD5 SHA1 SHA512 TLSH
MS6_3.png
- SHA256 59fec829f582d7c8b6adf47da5dacb2d44f249cfe7e3cb9bb52d5204afefa2b1
- MD5 f4f62a5501cb40e47c3a19b5ae3cc79e
- SHA1 452165b10a1627951b74f6c31b12fcc58d95a2f7
- SHA512 4485b30ef400a121d2e6fd8fab5a7bb5843809f87368b6accdc5ec9f9a13a231aebb0dbd57eb9cfb21db66121f43048aadf0cd4c93690233eaab0f5601fd3954
- TLSH T15FF005DB6640C439DE6D16A45F5B514C85B14F2D104A502F9058FDA5937C04D661D280
- MD5 SHA1 SHA512 TLSH
MS6_4.png
- SHA256 5e468c3558235e888eca1e331368662e12872527b0a191caf2134d80d785d078
- MD5 2997bda8d84e6b5fc18893d2a672ad46
- SHA1 dba19a50bc144b65ffd84326699724fd84f8d8be
- SHA512 4214c005d090998d22e0b3b43931902561a680ef57cce477ee33ea23ea2aab2430e0da6b8e1305b46917e0950ab50d6b273e87d810e40f68bd7cd18ff583ca80
- TLSH T18AF00EE3135D450D769E0DF89347F524E8001E220A6E8258B95DF81192FD0A0CAA63C1
- MD5 SHA1 SHA512 TLSH
MS6_5.png
- SHA256 fb501f6086105e189ececdd4120acf8d45258287f35e98689bf25dfe8b008880
- MD5 2ed9f87326575180b8515d01c40c3dc7
- SHA1 fefb7aed907cbd336493aec71e659015ba094acd
- SHA512 fa976b55a69eb86b26c0487cc3dbc94f43556840290acc7f517b8bc252bc4d5c0f3a3dc6e38028132c5729d400a251e1731e75b4c4dbf084ac658a3e4468e4da
- TLSH T1650170E73081D359E82886EBCBF8F53C60E10E97D06BCC8C382638881030940E8D039E
- MD5 SHA1 SHA512 TLSH
MS6_6.png
- SHA256 2c5ce3624b0dc15f9359a5eb89fc61d6e4c33fe1b87bad8bc19ba243fc20dbfd
- MD5 166b7955b7703a87f911d98d1203fe9f
- SHA1 54447e6ea889887ee022a04cb63094ef229930bf
- SHA512 3befa0cdb3aabceb614ddf353b9b11197a39dd74fb9b3811d9a484f7eb0094dcbf5c56a199ef4d0985ac5d65e9f18b12522ab5bf29b50b8e7ab0776886f4d786
- TLSH T195012047B29962A264A7755A47072D90B4860F62304F574C895FB83A473B0D5845B2DB
- MD5 SHA1 SHA512 TLSH
MS6_7.png
- SHA256 d89ab8c1de025651c71c1533aa1dcfdec71ef8470ba441452a965f7ff8a5df1c
- MD5 64ebbea89dd905b34a02892735c147c4
- SHA1 425e83ab23f0dd3a8d35e1135ba97b3becf409cd
- SHA512 8c9c16f55967075cdcc5834b342fd75ac24d89a818ab8097842d77e3579bd71860c6155a4202799b1eb3be14071ff4fbaa6401ecc05583361258a6ddb3926fe7
- TLSH T1C50165F6C0145F4748DECBBC019F1834AB442EB14AB9C1DA6899B039AF7CD10A5732A5
- MD5 SHA1 SHA512 TLSH
MS6_8.png
- SHA256 544aade4f917a43ac28a899c328a1d0769459f2c8bc04e4a0461a4fbb12ce984
- MD5 2a3e98879b65bfe0982ac7044147bf8c
- SHA1 ac47f4cf900dbee7c870d7293227073d7b397ed7
- SHA512 5616fffc5bb077365b50ecab96a715ea05859407907fb06faf23e799ce1c5e53c95bce1a7855f9ccd28a02741794cd8f4e09b1a8c61da8d69c109096c4e798c4
- TLSH T1640165D619C00DD9C6FD462A173C88115CE40E943536023CAD2B7A2CA63ED175AC8727
- MD5 SHA1 SHA512 TLSH
MS6_9.png
- SHA256 edca0b94d4017e55d73115457654cb92692c2821cc91e864177da3a954421a19
- MD5 4e8f3df83c47ce9a9e5562c6b4a95dcc
- SHA1 5ad5660573c923a4a897b62f4a6def3b21029bd4
- SHA512 496747fc75a0e55c20830ac50de241b95bc582e42426b956b37e93650ccb34f8f1c25962677f5b133fcb82a98ba15374d8083d5f52606d5739b5443333899e16
- TLSH T155413AD223D09A35EE6517326B309F7474005C5F640C292B5EB8745D053D260BC9BF15
- MD5 SHA1 SHA512 TLSH
MS6_G.ini
- SHA256 566fcb4be4eeb8106e1f2a38d06aa678205b882f993cd884f7b5d0495c2c0897
- MD5 b3984c4d5f59c7ad51e283b5275bc25a
- SHA1 38b3ffb1e5263f77d9cba2d0515a7e357dbbe894
- SHA512 f58b56dc511c8d2f91933d230c155815c55e5239f52795c1be7c8aab9afeac1131ab31d140c9187f5b13d6e8bce165352a9e4c9a1bb1f7dbf4d0a45687e3ea0d
- SSDEEP 96:qZuOZr3FX2819iryBwTh/JTh7MTKzVTNeLoToqETzMq:gVWrdZV1AURoLMNYAq
- TLSH T145A1F25F0A6435C8E122F46A331BC4A32A7D405BC8FEA8E1189F05D966A137C67FBDC1
- MD5 SHA1 SHA512 SSDEEP TLSH
MS7.ini
- SHA256 3d9ebdd04ac5cd4a4e9379b68be5e0c45fe93dd404941551997232802ac612a2
- MD5 12931a4a07d08a86119fa46ad59b3816
- SHA1 805856e9bfd726a4cc87653c2c488d2239d3f7ec
- SHA512 f49b7223f98bca232a2fd4f1a8e8984827ad7472adb1732b3706e9aa635a7ec67b893ed91a9f4501ae887d6431f54586926e93890d1ae07cf5bae6d68f10ddf8
- TLSH T10B71CD9E157626EC814776253257C0BB2B71047FCCF93D50246E01EE63A1E742BFA5CA
- MD5 SHA1 SHA512 TLSH
MS7.png
- SHA256 0898639590912f48e10e291ad0de92d889df98da5bbd956cb4f35a2e36b05645
- MD5 f8d9e55466fd1c6439d95527b6b37333
- SHA1 5bc7dcf3035189330e2cc9b08d8786a465762ce6
- SHA512 c0c073c0c613f78354e02c7089f9c7e67e1434199bd420319cddb78fa5cc04e90a1028c2fe15870d1ae2f1fe39dfd71455a3053b030284943b42dc7b440533f1
- SSDEEP 1536:nvAU2ZkoluxFwAHSo8YEw7FjDNF3A4AIn+2V:QkolurV35Ew7FXNFZY2V
- TLSH T15F53DF0291C69D1C96FD043E44E31A59C484AECFCCFA75299BBB2E904F35430BB6F684
- MD5 SHA1 SHA512 SSDEEP TLSH
MS7_1.png
- SHA256 878240473bc6acbb7650c5208c1100e716c7c500fc5b9ba9c5945b1b1c4016a4
- MD5 2c2da7ad7eb4d0195708ca37cd81ba25
- SHA1 7d1229e5dc9824c98878c0dd2235aba7ed25948c
- SHA512 8c5315a4d3bac578d27fbcce8d94a32d6aaabe2080d9362f72cf1e69ae5f286ed56751c4f28a1dfc544bdc0d992646abd8f1b8b52d2fbc3ed1fc505be67ef83b
- SSDEEP 96:2ESogOKtDs1NV5U3vqk7Fs8Xp2eEF2Y8gw9abf90:2E4U+vhFs8XpyFAQ0
- TLSH T1F9917D5BB72C4D6EC12AC3B9135D053CBCC64D6852A5074B5BBA78F6413CC9EFC41855
- MD5 SHA1 SHA512 SSDEEP TLSH
MS7_2.png
- SHA256 cb50d07e28903ff1bf96fb8ff8e12f6f494c2e6b1774aa971b56df76c6f89c3f
- MD5 55eb364ddf2d21d034dab3f6b64b7ac7
- SHA1 f16dca4f62f86c4a79afd6c99c1c754ce469fe18
- SHA512 907700a453dda62c1f47ab9834d659666e25953e94c9559a971218f6ea5a9737f53b30a1c0f472ad95d2ed649b027fbe09eadb8f1787c7a7f9ac81e9cb2126b6
- TLSH T1D82117AA30884E4AAD5223CFCBA144532C167C3286401B23991A3D2A4ABC86CB0FF087
- MD5 SHA1 SHA512 TLSH
MS7_3.png
- SHA256 e89633f3bf9c24a6aefaf740ee2ee5a60eaa98026f353c8b41571ef20a5e3552
- MD5 35fe919f0c199f1552bffae3d366f7a9
- SHA1 e116dffd7c63fb1176bb278bce2d10b5d99b0b60
- SHA512 e8bdc35ede28958385a4699d440cebc150adfc9477a8179a67db26f6597b531b7f754e17d0e73062bfe9627caef1c6451c01d5ea238391a89ff436774e2bc757
- TLSH T1BA2195D5D20795E1C6DEE9AD0ADA170C2C589E74984FA6EABD0934281C3D69EC308D26
- MD5 SHA1 SHA512 TLSH
MS7_4.png
- SHA256 d2bc15fc4a47b603ffe83128b1dc0704d14287f9239af173638e468aa0f64603
- MD5 afef3f3b2e9e0b0cc6b9276d0ac8444b
- SHA1 9bb1b917b62ac2626474d0e8d410c07084e72e62
- SHA512 24ca5c681a2d93eed9f5b2b906dcd0b0925e1f7a38acd099832bbcee178c9361e0e9b9c70a8d2b086dabec9d324fb0cd8c91ee6eb4137be0b73c67f2ab64dc86
- TLSH T1732195A128184012CEED0876A6325211DADA8D1794F9CBCB5F2B7331413C3AAF9E66F5
- MD5 SHA1 SHA512 TLSH
MS7_5.png
- SHA256 0c192383c9800fbdd4095227117df9305d9c61265c66e1a2dcbc9c1cde3af1b7
- MD5 494c8feb86dd9328ba819d16ecfe85fa
- SHA1 2542375a2056a556db78353fcca847c269e68bdf
- SHA512 eaa58a65a9668aeb476a70811193bd8d877c20dbe3e71912f0d4ea88be0c82887917533f1526270f17e56892340313fdd51cc4354c71466aff81644545bac48f
- TLSH T1F21194EDF5E67C1CCCAA709B4248665CF9649D06C82A4645608EF1EBEC3F80E2651040
- MD5 SHA1 SHA512 TLSH
MS7_6.png
- SHA256 c7b02a99a17461a6c8702b71495bde3185e9f264bd76363c39a3c2276fb643bf
- MD5 28ce8bcd5b1bbf4a72cb965fdd845937
- SHA1 c0f0205aab62445add7f982e90a94cf7f413afce
- SHA512 c479ef894d4a49111a693a7cc6e457101e39bf7183515980fdb42c1d13e66a074ef031fc0df2b146f5088330b09ca2dddf15991ef3bdc8140ac42ad66e0a0d0a
- TLSH T17211C4D53D294A02484FB4705AF84CE7CCE42F376885C12A20AEB84040BE31EA0884EA
- MD5 SHA1 SHA512 TLSH
MS7_7.png
- SHA256 5778de84b17557b66270010b5bd40e36c4a8078dfec09406df050d7a6ddb95e5
- MD5 889345d41eae04ed6a944954e88b7899
- SHA1 bffa2c04054ca31e36eef66ed2477b6fa96863a1
- SHA512 1078bd00dd776f9c500a0118fdc124c40fdf7eb4c1832d5f93205cd6d6c5835ded67cd29b0ce620239741175c328670ab32533a2c0af702a21ee9021f45ac1f6
- TLSH T14511E921BC106D58B4162A1FA7CF555688302C684164CC93E98930D0B2BDC0EAC84A87
- MD5 SHA1 SHA512 TLSH
MS7_8.png
- SHA256 0740f5310c8abd850910a3cc3ed8b52845957e9323c87b89abef797c0155ed9c
- MD5 293cd67c3464223a6f119ffab1904998
- SHA1 bf78125929e993184f4403334f2858a557a0be67
- SHA512 87f7609f5e0990cb67fc80cb2988e0d670b42ef764e29a8b76ed1f05b8fa76b3ab7f069cf40036e907947b61534498485099af4834584a4eef103541440ab8f6
- TLSH T15301568723D829EE87931696D25A9EA0C0151E42069973913689FC76E57F594009E741
- MD5 SHA1 SHA512 TLSH
MS7_9.png
- SHA256 d0a2b6d3fecd083cbf8aace4abc8aa79e4e210dec1c2fd3fb223f45140f8ec0d
- MD5 6261ee9c3cd24be1e6dbefd21c097cfe
- SHA1 64bad37e437caef488434e99ac2a57ba9cd3b5c8
- SHA512 c50ca4d64fdd82a0628305000a67552497d667d79712dd3a509714281471dadd70582c29bccb49b7f5c55201057c64657379e19e6d2daa18a38f9fe9d5503479
- TLSH T1F821B4E753D6CC6CBB02288641110F4DDF087C1874B72F2D8E8AB43AB079969828F282
- MD5 SHA1 SHA512 TLSH
MS7_G.ini
- SHA256 aac280cd90a9bd67e012a14a35027258a0bf76e8a4bce68253117869c82d53c4
- MD5 acdbd50f8a3e06723ba5517acc9d3258
- SHA1 435cd436510f7689b6796af8a0d39eff024e2801
- SHA512 fcdc74cc6eb581eca92481482baa1d86ce97bba8361e3061c980f9e2000d62de327c7c850b22b46cf1518995433ddfc58f785a32cf990b8c74447a8fa6b749d2
- TLSH T1E851BC9E25B626AD915775253347C0BB2B62047FCCFD3D80241E01EE2771A742BFA5C9
- MD5 SHA1 SHA512 TLSH
MS8.ini
- SHA256 23b46dcd2fe1f19831aeb1e2df57441dcaa185f31794f1ba704789dd539ade33
- MD5 d681d3c4f9d831e04ca4aab5271e99a3
- SHA1 5eebcf69e4a52913ab9ebbc995be94bffcefaa23
- SHA512 ecb04a424f4ceae1b574171a5c76bf1f7b6869ba95de89651d60bd676eb6bc8380bae06a2b0a525334afe9e7637e2c9200b4e17ab7d7222cc9a6bd796cc85621
- SSDEEP 96:qNW490vn0y4JjM+J+nzvAUyj2JM3ei4WhBlWMdWXoWhyhWNFBWo4Wz8W0tWVS:S9Miii3pL03/YgLA037Q
- TLSH T10CC1965F1F2234D8A446B17F330A88E7266904A7C4FEA894486F05CD1915A38ABFFDC5
- MD5 SHA1 SHA512 SSDEEP TLSH
MS8.png
- SHA256 5020da4b2f1c798026bcb5b9156fe8345e2ec6efe17a36a4cb36e4afa1bcb4e2
- MD5 b6e4629e00d7e1093cfe114e638a3705
- SHA1 8185cdcfb098b505719dd2951621c303fc4e9b2c
- SHA512 97007c58b661239b0098ee53ea145097c008cf837027dd3ed1276908f665e21cc512f32874ca218f0bbcf782d1ff1e51211e548d9adf9e3137f6f254639350d8
- SSDEEP 1536:rbSYFWDKvr7+icVL1vqkAxLNyigCn65xXMX8:i4Wus1ykOKCnps
- TLSH T1CC43E066EB685C3929AD0C8CBF57C88D58085E49CF1F8C615B80CF68FDE83963C495E9
- MD5 SHA1 SHA512 SSDEEP TLSH
MS8_1.png
- SHA256 7361ea5d0a06cc6e55fda23eac1ad4137649d482de9836b7d26653dde12de2b1
- MD5 235cabc5fc71a8a5a416d4387a9964c4
- SHA1 3e2fb094d188548f5e326cbfe9b2bea631fe1a3a
- SHA512 19e14463914331675b113ef0b9680860d13395167f5bcd6c335701e1f0b1313b565735585ce152af30db30db812a85f6647320af894b339b1c8ceef969b5acc3
- TLSH T1C1413D53309DE6111C6180384CA66763606BEFA6CA65A0F9A38A7E972E7502D68233A5
- MD5 SHA1 SHA512 TLSH
MS8_10.png
- SHA256 f7a97198811345bca7b030d0dee6253849033e6bee55837bd942599fcb99057c
- MD5 80ab3f4129bc0503cdbc475c6b00cd97
- SHA1 23bb12b06d1cf61b1a5f2e9e9c7b9e138fe2ce4c
- SHA512 b21c908087942d796bf90a03afe6f1cb0a1efd95d9c4b56b5f878a1d42adcd9a7cc85172bb393d479bbdfe852b252d8f5ed87fdc7e79e1f37bc9db370ca79b6d
- TLSH T16A31FC46E3D99D31C34A84FCF3E2A427DDFD1C8953752A4947567076C1340042B5B45F
- MD5 SHA1 SHA512 TLSH
MS8_2.png
- SHA256 b51e3c17cf5ee6d384c560fedbb5466b206d88ffa85bedcf85473be59a64fa17
- MD5 932c3e2bae8204951dd9f68a1ad72dbb
- SHA1 d40d2e1bcb2ba1a6a62e6cee857ebf3e2ad0c88d
- SHA512 a34bdfff5af3098c4dc87574727270c61c09933695a53712e88876cbfb256cb4da6de3eccb19a76b9ade10e8c5317ae794d2761e23fa85dbff38c073b00ef278
- TLSH T19801284153B1DCEC5A457034356314305D4D6DDE2660721C651EFF6571BA2494545BD3
- MD5 SHA1 SHA512 TLSH
MS8_3.png
- SHA256 91441dc66d0f315ae7426d87ec98db77dceb39c0a8e10e731fc7ce5afaa5841c
- MD5 4e7be96be25c1168d9c04fb4a3260a76
- SHA1 633bf6dace7253534870f395e712050b08eda8f7
- SHA512 81f95635c10e58b350788ff1cbb01d5c6ced25e372264eb213f055a051b7016d7e2e6c0d38e0af8c5f7d3fe886d35d0edd3d2a0bb47a976e804d44d5bb0af4eb
- TLSH T17311B9C5B9507CD19BE450590327DA5D5C16AE563B89109DEC27F6A0183BB6CD302716
- MD5 SHA1 SHA512 TLSH
MS8_4.png
- SHA256 684414665c3e7df38aa21b918bada202ebed19e4899530c3afb4ae38896b1cd5
- MD5 74d897f706c293adcdee66e8ca5a31da
- SHA1 50fffb40a8e5ae121de89fe83c1f1ee27622b086
- SHA512 aeb48fab7f75c9755b9d3774e3bdb3eac3451c551722ce52f0c94dada15736c3d78913cf2f310cf2c2c8701ca4b976d70579579455c80d2878c2cfd0391b7155
- TLSH T1EDF0A353264D642DE05FE73013DA4D7EDCF4EC4C285D990EF15A79B2447E583A190389
- MD5 SHA1 SHA512 TLSH
MS8_5.png
- SHA256 b500a6cfb5e645bd7d345caa38ecd37195f95c327ac244edf248fe25cc743533
- MD5 7d94b85e2252f641bc320c32aaf9f31c
- SHA1 519e6367ae217146fb6fa9234ce4d944ac4e4170
- SHA512 e386d2b47cbcab235f6366696ee9e462e6d2dc329cc77764556500b229eb7f231eddf5328082fae72906c235d7479fee4c6c3234f77a7aaac9928b8a5c4647e1
- TLSH T111F00EC982809582242D906207158546DD292CD988E18782F16CFD320A3EACB92F82C8
- MD5 SHA1 SHA512 TLSH
MS8_6.png
- SHA256 360e1aae2d7dca2d31fad64fbe02de391b5c7d53d300995314674405d3dd0a40
- MD5 076eab6cc0e809ee6d1c5660289a99af
- SHA1 dbe2b15892a4831fe5658f3b0bc2012becde7e17
- SHA512 433fb6b4b53af842e6bf0f64ffbaec501347252c3b1d5de8639d69cc48eecbd2e1446e9850403a52c600637951cb86e4de7e5bebb72a17e817195cb2e125815b
- TLSH T1040194E1AD00804DDC235466314D91C67070BF4FBA999B1C529EFA0D0E3A803B0AA38E
- MD5 SHA1 SHA512 TLSH
MS8_7.png
- SHA256 f64d65f08c85e465e2223d5c5407d4e9a5f951ef4bb86eaee25d104e752eb2df
- MD5 37866ace0f1b6f36548840428c3f5e9a
- SHA1 e33353b3ede89ec798c493c84f1628e9f6b3f389
- SHA512 c465ee3865fdf2155b70227862bb7e76e6a24eef7ea4d38ff78e7cf0ad0100f5644baf1c9b9ba05f4acab60cac1662c1ddc9da509f6264e47959f78a4d2a8c2e
- TLSH T1D7016557A350EA55E02C8E3B1ACE9912EDD57E5F4165820C494CF90CA03A143BD0D392
- MD5 SHA1 SHA512 TLSH
MS8_8.png
- SHA256 32fa37ee459f5c9bf7c45da1d391d61b181a185aecf1d376230819f37fe44f31
- MD5 3846a3c66cded3e6d691f8dc3e47c62a
- SHA1 3e9127450a24a8ad1ffc38eeeb4efc65c96c3db0
- SHA512 ec6a963251cb6e38372056b92bd7b03cb379079efb88419a76c33df8a9b8fab963c26df8ba65a84d41a886d91f51488085e45c6fe7aef583382390b394be1026
- TLSH T1070165C2F02E5C31DA4546758309FC1D6B538FBDEE8361A9E689389D00BC14AD0912EA
- MD5 SHA1 SHA512 TLSH
MS8_9.png
- SHA256 ce0718b4bf06c727765d1a593d70d96d54f055b3aa8384d8663fdc95a2b71c62
- MD5 91635c9ab520f8dc9adbf1146f56b5f4
- SHA1 97bf341dc8f2b0b92985b27c29e8d51e8c97be72
- SHA512 fc6b03949ab377f1b5874fd408c2f9da7cfc473af6de8b38b62cf5632e9c85b7ef92d227a553c0adece6c0a97c78ccf32fadc7bd5ead5915d7a09b4b615176dd
- TLSH T14C016A9E20E192378519449D5307E1B0457C2D5217DEF476C775BC2F607E217F0C0754
- MD5 SHA1 SHA512 TLSH
MS8_G.ini
- SHA256 ddbf09826472c84dea57087df9b81e784a6775c6985e45ca83166101a7112de8
- MD5 9c2e1c02a96f47778f7495d99adfb007
- SHA1 76bd8be3da661a6ae43fe79f1c7601bc394b6ed4
- SHA512 b754f049202b697b9b2a5ea4c4134b0401197d59154abee2b44ade87fbd6f3521f92eb938350abe9da66ea59dba89320b3afcad32e743c0e585609a35dccad47
- SSDEEP 96:qEEmu8OBHgyoqlOU9FJLMk4z08DSt3/3G5XhrlXMKy5XXcTXh/3XK/VXNKEXoTg4:Lu8SF9N3K9FfyxsrRHWV0eAyURn
- TLSH T189C1BB5F0B2534DCA057F07B330A88E616AD046BC4FEE8A5486F08DD691663867FB9C5
- MD5 SHA1 SHA512 SSDEEP TLSH
MSE.ini
- SHA256 d7a9ef3712b81d4b0bc6f5140ff278fb323c94430b0846a4c78920105243cbf0
- MD5 48f522e214adc4717def49388aeadf79
- SHA1 6b698bf347444bf07efaae9b3b37a2575eedcdef
- SHA512 9b179233b0840271837036f3e4ebcc750c42c21c846b1eb299fc33493f6f4ebae399fdf07a8b77cd8ecb84c01d4c4a6bf87f222a04ac9d81b1836695d74e276e
- SSDEEP 96:qOITKFa2iRMTaac6cezRRsnFWyKlG1J9l83ur5hO5NCt5oR5VX:WWsAGT0uF00/Ql
- TLSH T10891A71F1B7539DCD457B53A734784A72B6904ABC8FEB894241F019E1B20A386BFB8C5
- MD5 SHA1 SHA512 SSDEEP TLSH
MSE.png
- SHA256 cfe0f506a5e5dedc90f3a544a74188b6ab743df8fe49da41c9d82b80367eb37c
- MD5 49edc52c50f657e58105c9a87a3674ee
- SHA1 c91c4ae04e8e841ae1ac026a36d6c02f6e18a5e6
- SHA512 8e7383a53ee0c8538736310eeee78df96a8cef3b1c3d4864803703b7f42740ac87e455005bdf334adf883137035f1e81235fe7407db558de2d00448bcf1dc934
- SSDEEP 1536:TjghwLwBPyEBLRBJe1rPu+q6RoFNExu+oyvMKDqEytWyT/:T2fBPPBLRBJIrGymFNEx9kAy4C/
- TLSH T1F263E050EA3DBE3B59D96CD93E9BCCED2E006495AF5F86819B809F10CDCC6863D001E9
- MD5 SHA1 SHA512 SSDEEP TLSH
MSE_1.png
- SHA256 5e7d9754924d461045b8c5e18195ac4721ca96a2e7ec5493ab27c236985cfc70
- MD5 03e100b663f1666041a1d4df586228c8
- SHA1 29a492dd29d4d070269f093ae933cfb77841f1f5
- SHA512 f8fd1ad16ffba92a13c6f545fa7a9c94e0a354cf30bdae92519cda4e8de4761e171c42168fc8b786286a3c0611859df67a360890f608d9f6e6a54058aed8076f
- TLSH T11E816CE102EF51093E7AAC0426BAA8C5C1948C1D2CF115E1908CF878B2BDE6732F526A
- MD5 SHA1 SHA512 TLSH
MSE_10.png
- SHA256 daebc75e610324c13f81845cc27755c4b85687960aba5ecac0783407ab492005
- MD5 13bd9c0ea52950d5194b701fed625a63
- SHA1 7240e09d0dcd68857454df0d14737ad2dd57e2d5
- SHA512 7a91616e6f5e82753de3584c6d1e4c402672d10a16aba7ad09b0df144ab8cfd054e42d69abc98f0fd70daee93fb9408ca7566e7d253abe5cd83cc19a07b930bb
- TLSH T1D8219392720B992D688FA2B9238A1484AA7B3D1ADC28104EE8047EA4353AD98E4C0F01
- MD5 SHA1 SHA512 TLSH
MSE_2.png
- SHA256 b4dc3b6dbdc547c374c7f9acb118dc2f50399514c1ff715f213ad92ace24b684
- MD5 2fe28301cf8966f81a05790d4e4e6eca
- SHA1 ff0ef57e241843896e527e2e545e1e06176bc028
- SHA512 b422bd8f2fd79c92be76b6c033f75e1bb95e71de8ef259a6ceb3dfe8e7a380624e0899e3c4cc6aa7c8e3d842d8941fe02d2931b3c4d4b6383ea3247e2565bbad
- TLSH T12221DA6190B215168F0BB9A137C64EFAD8744EF63C4540956208F54DD63EB8DE016EC5
- MD5 SHA1 SHA512 TLSH
MSE_3.png
- SHA256 3a2ba30486cc8588a41a16204fb6bbd63659e0e55a7b919179298ab1b959e5da
- MD5 9fc5950086c8f71b63e0852ae2e58eb5
- SHA1 6ed21c3cabcd0c8b3522aa291d1f898175f1a50c
- SHA512 9a03a63447801d4bca19431615d385fe268d49cb1f8d76d5854c8c3edcfc68769a66525b925c8703064d6656391193eed27ac2a53da039589ae7c3fd6ca0b408
- TLSH T1B721C5D334780C1DC68728E942A55F60BC316E9948437B98AA3CFE3E20B195A9A477D3
- MD5 SHA1 SHA512 TLSH
MSE_4.png
- SHA256 cbae8571363feac44160d07de7971052dabf6d3e182f42c6bc461de65d4b974b
- MD5 2a7621d83ed9c7d2ffe9032e84d76937
- SHA1 8b0c893f75f4d00e6d9459da03a0385835388b1c
- SHA512 a87b81f94ba720b198a8f1f722950579c1d0b97851ddd0bc44e813ebb05c9eba9422cc9fb2e7e076e894b8cc99919a329b6c09a9d0c2ff1058598b3306351834
- TLSH T13121A77916926C60B349D8665B1F229F6895CC09E19BA308519CFC2110352814726EEB
- MD5 SHA1 SHA512 TLSH
MSE_5.png
- SHA256 8bd1ac0d31b67e1e473c367737f26bed89ce981f43b88a354f172d2deabe7cea
- MD5 b03d902fcb14f45a39588e06a7ea7f9c
- SHA1 ffd77b941ec4d88980c2de7af3a98f2b4f8c81ff
- SHA512 4d053d2b65d97783f832b260e9ba5acec38604e17364e279beb338fe4d3edb2e1ab88ceac4d518ee0ca03432aa1680a82012f42408744ebae56ff0300a60ad19
- TLSH T17221A5DCA0FA3D3FC0166C51693A517849D90D1844D26204FE97BAB007374B39796995
- MD5 SHA1 SHA512 TLSH
MSE_6.png
- SHA256 a61223910e67bf775203e8bf68bf803c9567739e11f69804eb541c59a94a2933
- MD5 3556f300a698daff7238e2be9cf18b5d
- SHA1 0cfb874062632ad87216fda35258b7987bf388ff
- SHA512 f6f97914ac8bc2f2e47e997ed1e924f999925e14ab72ebbe03a9296fb16fad5a00dfcaed0dfca67187cd1fe4a4890e3069c44ddf10c48246174c60f441c5515a
- TLSH T17721E7E73288BE64DA9CC17510D3C321CCD1ED782AF4891D502CF4BB9E7D0A8B222263
- MD5 SHA1 SHA512 TLSH
MSE_7.png
- SHA256 47273efe143dc48ffe13001bbcf66e544cc3f1584590d01c1f13aa140d060744
- MD5 aadb9c710d90d0d3b5f235b9020495c9
- SHA1 18330bb1c360a3a25d29c33433f95351c3af1f09
- SHA512 9385524af898bf671f4f221159c376e484f53034cbf9d6ab633eb0bd041f8f2de799eb9bdeed113826d1fdf4fe0ba24c3c5b19a6639352a560c88797b5afe79a
- TLSH T19921B73052B2E2F9853BD19F33AAD4A664E00FF94BA24D43213ABD1542BA2003415799
- MD5 SHA1 SHA512 TLSH
MSE_8.png
- SHA256 d6d4386b815d221d14f30efe832f201002d74085689f58f6bc790d93b1c74ce3
- MD5 cdefa7cb0b4bfb5fd2bbae6beaad41a4
- SHA1 4017bb0f6d37db3c12bb55db3e7733a4b5e06e08
- SHA512 cec500b493d4bdb6207d9375ad62417a2be23d48829e71d290aefdd27fbfd4a15faad184a866df71f60529e0e741e8502b63e01c623699d558a2873a85aaa465
- TLSH T145116376B90B7969E84543D1BB1B2E0199304E7508F34E9C82A874234AF957CCD16BD4
- MD5 SHA1 SHA512 TLSH
MSE_9.png
- SHA256 b9d03b81749663e74f309cd2b0128a5de6c6ea884ca3a48afd78ea23849cc76e
- MD5 298aee8ebd545cd7a6762456b360bab1
- SHA1 a90d36fb1dfaeedd15537040790b564b85b31c4a
- SHA512 0dab82fb487f6cbab232cc1845b6288ef99f92415c9d559e71ceb43accf0e35b2335c78b7f0a6c360d077e9e1c3a6d2bbae798a669dc25395197b46f2536fd5f
- TLSH T1D031FAE170CAD65FDE7A15A07160CD040B6E7C15363B09074667F838957767FE104C27
- MD5 SHA1 SHA512 TLSH
MSE_G.ini
- SHA256 df28c935f0625d933a340bebbd686a21d57da94ebc949c917173718ae2799aeb
- MD5 1c524b7015ce78fac21d5ff64f174037
- SHA1 370544d5783491408a064a1f6c300953cee6bd33
- SHA512 7a8b44b58429bbed9a04299a10594f64202949c4b18a097b41f7fae9e8dadb5ddaac4e62ec47ea11d87fc833aab0e3e5d599f1bbd931bac9aae13f16a6008eb9
- SSDEEP 96:q7+SBHGBld6vSu6FTuojMKaHz2RsQGvkJo6tGs09lLEhM7eEMp7eEXFp2EKGpmES:AeuIsB0Grcmjkj1JDttaeddqU12
- TLSH T1A7C19B6F0B2535CCE192F12B374684E5276904A7C4FEB5A0286F049E1B6167CA7FF8C5
- MD5 SHA1 SHA512 SSDEEP TLSH
MSF1F.ini
- SHA256 f89a5db74fcd53eeed3557dd5e1a5a1b9a844bef3a1ecbbd0e9cb846ec659082
- MD5 ab7e553420fc8008e32526628e6f7534
- SHA1 1d39173f8099ef59626b852a1c2b34722f151444
- SHA512 ac3a47711b25ffcf51b6ce4b74f21a09268ffa21dd51dff971bceafb57e71b9807fa92a3daf272bbc6814d6928361573acacf7b02cf909dc58759560da1cc86a
- SSDEEP 96:qxzbHBtPsoteJhqFoUykgMdz0BYLHlNiKMbDKXzgKh+MKKIpKNdjKoANKzvxK0S+:WYnqmUXzLFRs2jxMdvYTW9MjAekwF
- TLSH T1E9C17A5F1B2438DCB447F66B370684E6262D046BC4FEE89449BF04895C616396BFF8D2
- MD5 SHA1 SHA512 SSDEEP TLSH
MSF1F.png
- SHA256 9470a1cf8baf775df9f7214d755a95131af9845a0bd2696e54d987b9ce87a648
- MD5 3452fdfcf6aa4037008a060afae3cdc1
- SHA1 517c75f9937bff0ea0ccfed6bfa8e6e0b4a88872
- SHA512 a8cd359193a4737c5d94879431e475e2c5d2783ff17f3d1dc7f8e2f677ec5c57d6754966d11c8a558c04f1de849103da70a80c3caed44da2a574992176241c1a
- SSDEEP 1536:sPZt1aQnVU6FbnbWwjHxF1sj7xqTgSOqS4ihwZr:sPZuQnVU0bTHPSVqTZshgr
- TLSH T11B43D0E4D1B7313D7AC92D0E7D62E6AC5A884268CD0F5B305B428E19B4AD7C3BB2D1D1
- MD5 SHA1 SHA512 SSDEEP TLSH
MSF1F_1.png
- SHA256 34636ca6f8be51021d0265cf5c671250e1f80e2899b4acc5a5e47a677702a8e8
- MD5 38a2b03dc0bce46607a4139b5c60714e
- SHA1 645de5d8b9e40838055292e2d458acdeaa5f2e95
- SHA512 6bba1f3210ba815cf937371472467d977b9be5ec1bfa0aec3e363a46939b76de6a16b8b965e557a42a289bb33c1edc256ef48c35a9531a1aa560de9bb8001a95
- TLSH T1A721F8862B3615C0CF5208D047CB2B248A3A7E2D08878DD86613FC7A4CBF79DE54158C
- MD5 SHA1 SHA512 TLSH
MSF1F_10.png
- SHA256 4a4844f31b0147f0cd50668c4dacd44505ada5351772f6a7818beeac8607b03b
- MD5 0c95abdb2284775517987e8d64157f73
- SHA1 bdec485a0604344c50c366d2f4673b0e52efc301
- SHA512 11fdd55b36c36d4e27a0896074ae1c0ef08c151522c469237d7678f82e4529cee04909fcc508f30b0a261dd95eace9c9301bdb506f2b3211201d1b859ba1faa1
- TLSH T1D3018611B714A188D61A84744A624D53C8992CA85FD045FE6CC974125CBC883E02D611
- MD5 SHA1 SHA512 TLSH
MSF1F_2.png
- SHA256 8c135a3ed0af4f79c2f485f384a3c69367cd8e2c2731decbe100ec6ad690f84c
- MD5 b3b7e58146bda074c4710542ad4fca16
- SHA1 3bc0d28863817226fe132ee1551061b431451907
- SHA512 dd23d4f402d2103a5116799e4c0e6078833edf1041f86096623996e81d34475faef2462625133a2271c4767f2b503e94ef890e83bdd931444b6b1a3b00da34b8
- TLSH T18521C6B24ABCB681968584CE4DC593ACD3A30FC76737022A216CBA013CBB1808AE9245
- MD5 SHA1 SHA512 TLSH
MSF1F_3.png
- SHA256 530118c41fa694172b135acf5d0848431b4464a5193b29ff1573994aba69592a
- MD5 a399972e01b79dabdd06f45b83492078
- SHA1 1433595e6f44c1bb1481c6e0428aa8ecef3d45cc
- SHA512 43315dca1f85a58ee34f3e1f5c7f6d3d211035ad08cab2f185287fd815fd0600fa1b1a3492a813a833ae1d0e2189a541a2a0d47ae67cc129b4d6ea8eafd68733
- TLSH T1C811B3C3C20A2CC4CD4FCBB22F5E541DAAB02CEA1E510B51641EF9201474242A8F0AC0
- MD5 SHA1 SHA512 TLSH
MSF1F_4.png
- SHA256 f19b6304143805a136324896e5062a9481d6a787ca24db44f0acc3b94e1c8ed3
- MD5 c9265498630b9609bcf4fb394cda1501
- SHA1 342cf73625908beab1e95a9e7b1bf877b1deff7e
- SHA512 8d3e19eafe3f4d0d190a8c74fd06990a75ead8b52056a0f7f6233fb923376f943460adcf4c2fc05bf6c4a90e010a155d35b8104e34ba36ed31e22a67ac859601
- TLSH T122F0B7F47660540CCAAB94B8A78353B856718E712080730C622FF876B83EF0E9F413E1
- MD5 SHA1 SHA512 TLSH
MSF1F_5.png
- SHA256 3ab78a74b7820d43252f60881e5569643c7119930d7cfd57f3f580f4b2d168af
- MD5 77bc008848e5e5cc9a27f7fca3e1b7d0
- SHA1 42f2d0c7f6286acd2cdcef004bbcaef05cbd3583
- SHA512 974c33c7df4be6946840c06405e99cb0912cfbf42a80d3f2f51cc81364dfc9a2bc6096fa1bd54f2ee08b3a6ec23fb7b0a70d74823e0506585cc1188a9417553c
- TLSH T149F062623AA18234E856E1BC8332A7500A2E4E014176004CD89CF6BB0E7F1F3848C247
- MD5 SHA1 SHA512 TLSH
MSF1F_6.png
- SHA256 ec52abae3eddfc4074d35ddcdf422a915572a9e7c870d720f1051b627d79596b
- MD5 c3deaa2904f2acedfdd7650665088194
- SHA1 111ab1056c3eca563557c8c16a4b3c361fd4a4e1
- SHA512 d3d112c58bdfe5999900bcc09d0cdb58302845d5337c8ea881aba218e9819e33871e2818cf2bda009fc0d50c54e6822332175ef5ef74f223d91d5b6e269d73ad
- TLSH T14811C8A467EDAC42C6FF7F1446A7C8003FDA0FC14798053652983C21507E0CA41317B3
- MD5 SHA1 SHA512 TLSH
MSF1F_7.png
- SHA256 4c86a3eee3994061f52a20768ea6cb99ee95d814e264a738e5dbd2d369926c43
- MD5 9c574212661b4cc831bcf3ae80e55465
- SHA1 b1ef9e688e4469b7767c05e42762e0cc30bd986c
- SHA512 04a7d50ea17b8d8a38548b6dc64fd91b375e8b7998659ccaaee55b7387d4cdbf1b9472def4b34f64a164b4dd4d6cabefffebe002c2aab202fe43663f474042bb
- TLSH T104018602A4796C11C8DE986BA3B7607C783E0E553E4A47C6ED07BCB2B0301528335F68
- MD5 SHA1 SHA512 TLSH
MSF1F_8.png
- SHA256 9ba437970712560e0500e75cd3238ae01a740e15747b7997756d74670a7ce31c
- MD5 932e7ab5e585e1dafc764d6e6f6ad357
- SHA1 32d9e8365698d5ec580bdfc11749ecc4e3d0a06a
- SHA512 48864fa61c77c6468ec4320999319ce85178bcce032f2c1e12df06824a0e6222e78615627b2fcf4564d1b65ebb18d4b669dc599fc2824f256c2d6f0d9bf1ba9a
- TLSH T1401156D0F2E06608AD560B57034D0126FF85FE9562BD1D24C4AE7E790674B46C87A352
- MD5 SHA1 SHA512 TLSH
MSF1F_9.png
- SHA256 f0b42b5997ec7990dc1029d41f3ccd70552be9f8ddae1b26189d799d831e19ab
- MD5 21c3aa26cb1f320ab680b15ff81f7eec
- SHA1 6aa2ecd7bce1dc03d89b2429502db462d2cc1f1d
- SHA512 c54e4624e8cbc0e5c86f50568eafc5fed14c7f2537c84ee57db54475aafa2e0600df17bd2f59fbbb6e1775ef5eecef5ecbe2db223aa3de1b25688a23fc093884
- TLSH T1310165DB34877C04D4664076564538754C6B9EA93C624D9D842EF47E313B3864585692
- MD5 SHA1 SHA512 TLSH
MSPRW.ini
- SHA256 19f038343e258c706d6aad9fe4adaeda07d3d0bf98f5fc8c49ded9dcba790e50
- MD5 d85325278c3fead60703571047962d46
- SHA1 ae33c1544836af9c21c8e059fac98a2c30ef03ec
- SHA512 6035336a65f60a59baaf26ce01a763fb3b90aa17233861a69959cd29758705ed5921e866e00ced92d1fcb2d2f699a86fbbc12117cab6cd42de279b5c189a7f7c
- TLSH T10981DE4F1A2A75DC8117F57B338B80EB27A8057A8CBDA8C4585F06C91621A3467FFDC1
- MD5 SHA1 SHA512 TLSH
MSPRW.png
- SHA256 f68ec92cacf935c1cf509c1620fb91b4fb1207d6bfbe2f6aed8268c8586c1a1e
- MD5 f4c6f2e296c3dd63c913fb4ddf2ec663
- SHA1 7b5249d60a438264f6f48e1fa9ecd1ee1a361dc9
- SHA512 6dfe0aeae9025abcecf58805002596d59c91a5296b2430bedda428186cc14cbc9f3925e66acb6d71f4c909ed59b246a6e0a9fafd6e30712206e3320eef183ab0
- SSDEEP 768:B+qLBhIIQux4tAmYSvu8UrUE0towbKXd7JtdLcQudrTU8awItckc7G83qbgN6ySE:BVhhgt5Huazqd7zJcPdivc7Gtu/S0rl
- TLSH T12833F18AB1DFCB77F96085EB07738AE8119B7928167FABC1D381F4DE91027D11181163
- MD5 SHA1 SHA512 SSDEEP TLSH
MSPRW_1.png
- SHA256 5cf65277377a247c5cd28ac8efe56ca72e0cc6c139a1eb37dee0c993851f4855
- MD5 a34131fb573d9fbfd13a2382d7bc0ca0
- SHA1 a74c02530ad0255b997c55c686d933db2bf841f1
- SHA512 7047dbba1aad635a0d02209a2e1e2b70ec4f08f76c40fa4f63d271120fa469ade6c720782bab3fd94d73af1ba6452ef65a774e62c136f70d77090757efe78cda
- TLSH T19F817D86F07CE3B5B893A8918646D01117794E2ED62FC9F56449B0563172B49CFC9A0A
- MD5 SHA1 SHA512 TLSH
MSPRW_2.png
- SHA256 941f5e6d8d8bfa6e5eb4c3caeb5ecf11a399d3e76d3f689d3abf8912254c9aea
- MD5 19ca01a49090756388201845fe57bd0e
- SHA1 3966fe344f398b316a35c2b9dec5f63b186a71d8
- SHA512 e2f2bcc7113991e0ba0df1564a0f51df8a5bbe43cf9f7aea38002853ec49b08147ba376d59f299f2ad0695ba4ec37347ffa42b634f3c7b44bc51f227d4181fce
- SSDEEP 96:cu7J7zzV8ZHCpjQiT8bNgPUNbQ42cB3BT1lSd0JGtjXd2T2nCVTkNTOZme6V1H8G:c67zpqHCOiT8uPUQey7t7d2injTox6wG
- TLSH T16AC19EC8B102FF7C644CA1D35DD15A7E45CC4CB41F965222898AB00B243B34AA83E315
- MD5 SHA1 SHA512 SSDEEP TLSH
MSPRW_3.png
- SHA256 f16ca151cadaaaea4af0f69a22f0365d3d21a5517646a062b733743ee033dda4
- MD5 3da1b9efe546bcf4852c2c9d35ce6d94
- SHA1 57ca7021cf1aef935bdc6ae5c54eb43a03229fcc
- SHA512 80c05e2565d8c7687cb113f9c480d4ee208ec530d5fb54db1f6cb2c1c9fa33d8e57410c08b9c6582b64601debe3d8efaea300d4934ca9e207005a4e885f96070
- TLSH T1BF3119C723468819A74AECF28694C405F8295E57392500BC69F2F4B8E23C40092D12A0
- MD5 SHA1 SHA512 TLSH
MSPRW_4.png
- SHA256 64d5a9fd45b00f61f7ee6e4a13833f3488dccc7057709cb7ad1ca0c9a08ec185
- MD5 21cf1daa6815a81825132c72f315d40a
- SHA1 f8d8fa8f29200460733d971ae7daa2705a5b7dca
- SHA512 20ad8c266712a1e66d34961f5bf5d9e29adeeac53763da9461eca0f26ab6bde4eaffa5ef9cdb879d39fb683f29e7d24aa9c24690d26eb3a968beaee1f0d872bb
- TLSH T1E321B8EB7D5A4C34558C76B92B3BE400A8554D4FB65E1D641C677819107C70378923D4
- MD5 SHA1 SHA512 TLSH
MSPRW_5.png
- SHA256 afa5bc7c2d947a3aba249b0f21c2e54ba27fb7ee9a1c81f8d6ee8084fcd84ed5
- MD5 4a21aa9e84757af80171a759f2cb48a6
- SHA1 920f111e2750445b8422fcbca51ba9ae06a8be85
- SHA512 1fc604f5ee720de1de6caf9f8ae71481fb5840ffb7fbaa2f6b4d570b6c722451bbf0bd6351c231187cd782a9418038840a37002ea0ecb500dac739cb7a40fe64
- TLSH T16921E9E9B125D37E0C9260B6E34FD95606010D8D06EA841230B9F88487F5D15FE16159
- MD5 SHA1 SHA512 TLSH
MSPRW_6.png
- SHA256 6ea85e9ab7fe3041d3b01e7c2a41e414dcacfa9f20f1cd17b55626b16a03563d
- MD5 8d5e0a32596501dadfdc8cdb3b5c4ba9
- SHA1 e32dcd716d2bd0e05a67a1d7631d2e0e18a1bbe3
- SHA512 056cd43196f4aa161119686e80bc8228c49d25d1ce409970aee14164c210a9da3d3d61b57d28c98c6524b227fe24bb58ef2784c76c04e81858a4ddf68f8ec56a
- TLSH T184212BB4B9A5E97C51EDE300402BF0FA5901BCCF4D9D0818409675B0F935647CD34F01
- MD5 SHA1 SHA512 TLSH
MSPRW_7.png
- SHA256 fcb8091f68f51a0a693359442384be49d61a585f99d9632fee6ef017bf78b1d9
- MD5 d3b8648ba452365bcd1fe541ab3e71ba
- SHA1 4a3e4955ee1c8adc0153556664852bba1c7ab888
- SHA512 481a3ced2f7d0a5dcd0ef55c9e952856c877a77f263dcb73a59dbadd2679d905eb811b43f745db26b6a12e7e72d8a57305f98795a924ac7c1d22d78ae0d361a0
- TLSH T136311AEF77C224E5904F8914677130500CDECCAA874544602F2EFA4A9A78932890B498
- MD5 SHA1 SHA512 TLSH
MSPRW_8.png
- SHA256 e51050e4613e8ff833a094261ef6a763cdbb239b0cb65f9152cdf9af59d8c8c3
- MD5 820777fcee84475f9965fd725ccfa90b
- SHA1 e01109482e593894b26ba69bc9fe637e85c98c48
- SHA512 947242c293e8ca2a6c4d05fdda9ccdd762a3ad4dbeabde505341d5ac4878b211298ba1a9139b6cb2cc0c5700495b157fcc18b277ddb71ab237ecab7f8e1d6385
- TLSH T1BC31E6AA7E9A2C63C8091071A4131EC87A39FC1EC5F0F80771AA31085872FBF064DDC0
- MD5 SHA1 SHA512 TLSH
RaiderPD.ini
- SHA256 dcc3ddde656f2f776569771aa74be69eddc5fc72ddc8f0edc036efdcc1c3e3cd
- MD5 067998ce27e135acf653abe6e1891a46
- SHA1 47ca350f7ba06f63186a613fedf862944c4f2a5c
- SHA512 c444a082530c1241d633c43189d754bee7bae730043a39873b668950982ea7709847b71a65d3fe51ccacee55d80047a6e74104805f80b09502e056c163c91857
- SSDEEP 384:gCTAqAT0Nj1djjSASgv7pfDTrFjUjAjWj0iHMAjiI6AxW6+qCGYcGx8GRClvXqvk:HAqo
- TLSH T1EFB26C7F5E6A74DA7A45E47F37C6C4E2682C14A2C0BEE942154F0A8DC94903687BFBC1
- MD5 SHA1 SHA512 SSDEEP TLSH
SV-262E1.png
- SHA256 56722850f46faccd86f27a01662a296d940d8b7e013867f66cfbc68019c3cd53
- MD5 0e6993d1f4d8721fc3d3dd761730632c
- SHA1 7348b5e71fbeac3d40c4edb770626ae6dc3ae2b5
- SHA512 4fc0e361a9027f4bbefbb1a419f7a19b3bbcc1b8e79818bb7c286e7b5f2a1a53c6cd460a4601663b6e203a93e005a6b0c61b74dbe1ef39918d7da5077d568658
- SSDEEP 768:U6Htxlds1wGKLPRlZ73fC5N487MT87WI7ngcasV/8Q7oV/+cnE0ovxpnxJVk98LF:JtGaGIL9Cf48oISI83sJRC4g8LxD3n
- TLSH T16633F1E3C1E755E89686C0ED7ACE0FF5677D39D897CC28990B406BAD58C0B814A93383
- MD5 SHA1 SHA512 SSDEEP TLSH
SV-262E3.png
- SHA256 5c17d224f226d25e7fdb447cd0baf9620d1329c700b3206845ae93a03ced9523
- MD5 6ad87fe53aa23c9332758a88d41bc77e
- SHA1 9e26d20a9e5ae9ae6e13cd9fd6cee2df136f69f9
- SHA512 2f3b5129490be7cfb2f599a9fafca67858614f070fa535d460bd8514a8598cf41c548059d57adeb144d18660ec89629ddb2445a0c80856eb798388065491e9c2
- SSDEEP 768:T2M/xzjIQuvy1fL6Z/5jyXZzKmpyVfMRbVa1eFOXjdKHeqqx1OdWV8v+DNl7Ti9:T2kjZuvyJL6ZgYm8p1TjdKHTqwXvObq
- TLSH T1B233D044C26BD8456B1562BC3B621FB1D77F382853391C8046A6749FE8F9FE8A243C97
- MD5 SHA1 SHA512 SSDEEP TLSH
SV-262E4.png
- SHA256 90944797a975e857f69934758e85cbbe258a7bf54be1d441e30e6f670d793f6e
- MD5 bb766076a2ec26491323c5d3f38ca479
- SHA1 d4a228493f1fb62b1aa39ee3a9bb3af9616e762a
- SHA512 610b19b6b77ebe6beec1734f06fc8efc1dd101009bcb86dc859d98a9dfdefb82cac146b7f272231d6295e551850dd8706bf6ca065ba344d4c70f03c933d9494a
- SSDEEP 1536:W2UzjPoLAd7WEqBnV+8wLPPa9+tiWY5FGg7ZNhjxxxCU2i:WNOAIEqxjw7Pa9EaVN9xxxD
- TLSH T13B9302E3832C2A60BDAC66E77FAD65B38774903A2113B05B300E60B64875ED857F9761
- MD5 SHA1 SHA512 SSDEEP TLSH
SV2511.png
- SHA256 4bac16344f6761b442acdc1e53debeca0679144007311bbbd3a047a4cc5302c9
- MD5 c2ae4c3ba0ed3cbe6140695972c94c87
- SHA1 bc22bc1ffc3b055f138e4317cdc1b17c063c649b
- SHA512 15a217edabe6b71d4875ab2c2d366c3e71e746a08f724d73703f6c6cda311303e54d4e5dc32c8ccc7dcea3e188d65fc1632571aecb89257ba69a77c3f494c214
- SSDEEP 768:eHX13Acz2+1AV5amIi/SVJTQpuXT1Iqb8DidlB/rfNS5:MXB/z2Frx/8RQAJ9bDTVbNS5
- TLSH T15F13D087D0F6DB6D33DE80F667720F939ABE1C5D544E25F78144A68F68266E168002C7
- MD5 SHA1 SHA512 SSDEEP TLSH
SV2512.png
- SHA256 e2e4db6858829b1f3bb0f006b3c7f009591f31e10770815b8fc95f1b2d9c805e
- MD5 08b87000db2f990dfbf2d3a7572788fc
- SHA1 42f00690944a7bc9eabd87c6a8b16a3727bb3dce
- SHA512 b9506a06cf32248402175aeccd10475b9a97e1a457292abd815b14c92997558f88390d45e88a05117b8160d6a29f0a8fe7ce6a10dc9528f2a85917374d9e8bbd
- SSDEEP 1536:A7MfDX8dI2Sjsi/okFhEddM48U9WUKePLf/pFeemikA6c/WXJE:9j8dRUrFMdMdSPDp4vi1z/F
- TLSH T1C093024C8AB2E698CC9D39D12A27AC83D7FD64E34979F7F5D188146E5406B71F09208B
- MD5 SHA1 SHA512 SSDEEP TLSH
amstream.dll
- IMPHASH e81416c998ec81e16a6187579974e55b
- SHA256 0e87db588c7740c7c8e9d19af9b4843e497759300888445388ff915c5ccd145c
- MD5 f193d381bb6e9ef51c6bb581786aa3e9
- SHA1 0ec4660ea9cdf8c5565da9bbea5f0c2881932e33
- SHA512 4b792e63fce45fbe095a1e851cc1509625310ac132710e361176628665834b1bf504e142bc86928056ed5d14266dcd6bb7028869d02006910fdae1496cb55b2a
- SSDEEP 1536:NsocrtDASJV15DlF/rEtAeLtFjolD+SrBT:Nsr5DlNrwARD+SrB
- TLSH T1B9536C1333EAC07EC6F39232892B379A76EAEF16151B511562113E4E1F71182DBFD24A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
17159
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
ResetEvent
DuplicateHandle
CreateThread
MulDiv
ReleaseSemaphore
CreateSemaphoreW
TerminateProcess
SetEvent
lstrcmpW
CreateEventW
DisableThreadLibraryCalls
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
GetCurrentThread
lstrcpynW
GetModuleFileNameW
lstrlenW
lstrcatW
HeapDestroy
WaitForSingleObject
GetCurrentProcess
CloseHandle
GetLastError
GetCurrentThreadId
lstrlenA
MultiByteToWideChar
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcpyW
QueueUserAPC
user32
IsRectEmpty
CharNextW
wsprintfW
advapi32
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
oleaut32
VarI4FromStr
LoadTypeLi
RegisterTypeLi
SetErrorInfo
LoadRegTypeLi
VariantChangeType
SysAllocString
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
ddraw
DirectDrawCreate
msvcrt
??3@YAXPAX@Z
_purecall
free
??2@YAPAXI@Z
realloc
malloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
460B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=11, id=25, version=9210,
count=135, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=15, id=29, version=9178,
count=1, id=61, version=9210,
d3d8.dll
- IMPHASH 501fa1e56f916a9f948d746c479772ef
- SHA256 0a619df77235a3974ecdfc304558d78b7d376af879bed7b14f0b2afc840ac468
- MD5 cb1f190ceec0d7d2de02bfefa6931b4b
- SHA1 73a3feee9bcd7dd2d03c8662ac1282c0c066925b
- SHA512 f96dd6ee58df6e7c83d33da0a5cf7581149815cf18adbdeabda8a388fa4564391e47c1b9cd29aac1c9e8d4c07a9f69a34638b9262852f8460be89769f06e4e6c
- SSDEEP 24576:4IMhieJVAygtsF4x79Gy75Y9yO/2qWgxSx:4lgQVBrF4l9GyBzXx
- TLSH T182459E11E7AB00F5D8831670109FF7FBF3399F55822085A79AD4ED2FED7A692A035242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
161257
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d3d8thk
OsThunkDdQueryDirectDrawObject
OsThunkDdBlt
OsThunkDdReenableDirectDrawObject
OsThunkDdReleaseDC
OsThunkDdGetDC
OsThunkDdDeleteDirectDrawObject
OsThunkDdGetDriverInfo
OsThunkDdGetAvailDriverMemory
OsThunkDdFlipToGDISurface
OsThunkDdSetExclusiveMode
OsThunkDdGetScanLine
OsThunkDdWaitForVerticalBlank
OsThunkDdGetFlipStatus
OsThunkDdGetBltStatus
OsThunkDdUnlock
OsThunkDdDestroyD3DBuffer
OsThunkDdLock
OsThunkDdLockD3D
OsThunkDdResetVisrgn
OsThunkDdFlip
OsThunkD3dDrawPrimitives2
OsThunkD3dValidateTextureStageState
OsThunkDdGetDriverState
OsThunkD3dContextDestroyAll
OsThunkD3dContextDestroy
OsThunkD3dContextCreate
OsThunkDdCreateSurfaceEx
OsThunkDdCanCreateD3DBuffer
OsThunkDdCanCreateSurface
OsThunkDdCreateSurfaceObject
OsThunkDdAttachSurface
OsThunkDdCreateD3DBuffer
OsThunkDdCreateSurface
OsThunkDdSetGammaRamp
OsThunkDdDeleteSurfaceObject
OsThunkDdDestroySurface
OsThunkDdUnlockD3D
msvcrt
_except_handler3
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_adjust_fdiv
_initterm
realloc
_CIpow
_CxxThrowException
free
malloc
_ftol
sscanf
sprintf
_vsnprintf
__CxxFrameHandler
_purecall
_stricmp
_strlwr
wcsrchr
atoi
_snprintf
pow
memmove
fflush
fwrite
fprintf
fclose
fopen
exp
_errno
floor
user32
IntersectRect
wsprintfA
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
IsWindow
GetWindowThreadProcessId
SetWindowLongA
CallWindowProcA
SendMessageA
IsIconic
GetCursorPos
PostMessageA
GetWindowLongA
SetCursorPos
GetIconInfo
GetDesktopWindow
GetWindowDC
GetKeyState
SetWindowPos
GetForegroundWindow
IsWindowVisible
ShowWindow
IsZoomed
SystemParametersInfoA
SetRect
GetClientRect
ClientToScreen
OffsetRect
EnumDisplaySettingsA
GetSystemMetrics
GetMonitorInfoA
GetDC
ReleaseDC
LoadStringA
DefWindowProcA
SetForegroundWindow
DestroyIcon
SetCursor
GetCursor
CreateIconIndirect
GetThreadDesktop
advapi32
GetSidLengthRequired
RegQueryValueExA
RegEnumKeyA
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetSidSubAuthority
InitializeSid
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
gdi32
DeleteDC
GetNearestColor
CreateDCA
GdiEntry13
GetRegionData
DeleteObject
GetRandomRgn
CreateRectRgn
GetDIBits
CreateCompatibleBitmap
GdiEntry1
GetDeviceGammaRamp
StretchBlt
SetStretchBltMode
BitBlt
GetDeviceCaps
GetSystemPaletteEntries
CreateCompatibleDC
CreateDIBitmap
GetObjectA
kernel32
lstrcpynA
DebugBreak
GetModuleFileNameA
GetVersionExA
GetSystemInfo
IsProcessorFeaturePresent
OutputDebugStringA
GetCurrentProcess
InterlockedDecrement
CloseHandle
MultiByteToWideChar
lstrlenA
WaitForSingleObject
OpenMutexA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
lstrcatA
InterlockedIncrement
ReleaseMutex
GetLastError
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
PeekNamedPipe
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
CreateMutexA
DisableThreadLibraryCalls
GetCurrentProcessId
LocalAlloc
LocalFree
lstrcpyA
CreateFileA
SetFilePointer
ReadFile
MoveFileA
DeleteFileA
WriteFile
GetFileSize
SetErrorMode
WideCharToMultiByte
InterlockedCompareExchange
VerifyVersionInfoA
VerSetConditionMask
Sleep
GetTickCount
InterlockedExchange
lstrcmpA
HeapAlloc
FlushFileBuffers
GetProcessHeap
ConnectNamedPipe
SetNamedPipeHandleState
DisconnectNamedPipe
LoadLibraryA
DebugSetMute
Direct3DCreate8
ValidatePixelShader
ValidateVertexShader
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=49, version=8876,
count=1, id=48, version=8876,
count=5, id=18, version=8444,
count=33, productName=Unmarked objects (old),
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=64, id=29, version=9178,
count=13, id=25, version=9210,
count=218, id=1, productName=Unmarked objects,
count=15, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3d8thk.dll
- IMPHASH 65917657454922a46020cb10d9070c23
- SHA256 af4159a2d8241ed398c677ec806762e049561e0d6bf45bc036b19552ad3e83a7
- MD5 d6e38d3cde17a05ba6304917c80d6d3c
- SHA1 2e82a8df5668747ce1e66acba8f0e553ca6ecf09
- SHA512 a81c7585afad495002d123126e90cf3cd081e6e9735f06679b54b26053ad58abbae065bd60d9deae23cb6fd19fb20173ccee88d8d15b3c4225b3ae88afa8848e
- SSDEEP 192:E6vssJydHabRDNL4Rm0NSy1Wak6dWXWakudW:Eess4dHad52m0Iy1Wak6dWXWakudW
- TLSH T163F102C1B6E4BB2AE159C730C7BB050B77393412DC25C9F56C6C4B6925B270D87E0B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5029
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
gdi32
DdEntry1
DdEntry2
DdEntry3
DdEntry5
DdEntry4
DdEntry7
DdEntry8
DdEntry9
DdEntry10
DdEntry11
DdEntry13
DdEntry12
DdEntry14
DdEntry17
DdEntry15
DdEntry18
DdEntry16
DdEntry50
DdEntry19
DdEntry20
DdEntry21
DdEntry24
DdEntry22
DdEntry23
DdEntry25
DdEntry26
DdEntry27
DdEntry28
DdEntry29
DdEntry30
DdEntry31
DdEntry6
DdEntry32
DdEntry33
DdEntry34
DdEntry35
DdEntry37
DdEntry36
DdEntry38
DdEntry39
DdEntry40
DdEntry41
DdEntry42
DdEntry43
DdEntry44
DdEntry45
DdEntry46
DdEntry47
DdEntry48
DdEntry49
DdEntry51
DdEntry52
DdEntry53
DdEntry54
DdEntry55
DdEntry56
msvcrt
_adjust_fdiv
_initterm
malloc
free
kernel32
Sleep
DisableThreadLibraryCalls
OsThunkD3dContextCreate
OsThunkD3dContextDestroy
OsThunkD3dContextDestroyAll
OsThunkD3dDrawPrimitives2
OsThunkD3dValidateTextureStageState
OsThunkDdAddAttachedSurface
OsThunkDdAlphaBlt
OsThunkDdAttachSurface
OsThunkDdBeginMoCompFrame
OsThunkDdBlt
OsThunkDdCanCreateD3DBuffer
OsThunkDdCanCreateSurface
OsThunkDdColorControl
OsThunkDdCreateD3DBuffer
OsThunkDdCreateDirectDrawObject
OsThunkDdCreateMoComp
OsThunkDdCreateSurface
OsThunkDdCreateSurfaceEx
OsThunkDdCreateSurfaceObject
OsThunkDdDeleteDirectDrawObject
OsThunkDdDeleteSurfaceObject
OsThunkDdDestroyD3DBuffer
OsThunkDdDestroyMoComp
OsThunkDdDestroySurface
OsThunkDdEndMoCompFrame
OsThunkDdFlip
OsThunkDdFlipToGDISurface
OsThunkDdGetAvailDriverMemory
OsThunkDdGetBltStatus
OsThunkDdGetDC
OsThunkDdGetDriverInfo
OsThunkDdGetDriverState
OsThunkDdGetDxHandle
OsThunkDdGetFlipStatus
OsThunkDdGetInternalMoCompInfo
OsThunkDdGetMoCompBuffInfo
OsThunkDdGetMoCompFormats
OsThunkDdGetMoCompGuids
OsThunkDdGetScanLine
OsThunkDdLock
OsThunkDdLockD3D
OsThunkDdQueryDirectDrawObject
OsThunkDdQueryMoCompStatus
OsThunkDdReenableDirectDrawObject
OsThunkDdReleaseDC
OsThunkDdRenderMoComp
OsThunkDdResetVisrgn
OsThunkDdSetColorKey
OsThunkDdSetExclusiveMode
OsThunkDdSetGammaRamp
OsThunkDdSetOverlayPosition
OsThunkDdUnattachSurface
OsThunkDdUnlock
OsThunkDdUnlockD3D
OsThunkDdUpdateOverlay
OsThunkDdWaitForVerticalBlank
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=28, version=9178,
count=7, id=25, version=9210,
count=66, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3d8thk.w2k
- IMPHASH 423fd2aec57d2beb55ba046748fc0345
- SHA256 f85120b62cf8137ee414e470245fbffe2f80c88641cb10b7b8738880764407b6
- MD5 1ca0c329e7ad6bce089a1f08eb368353
- SHA1 5f0cf35c192efb7d94c612686446fed53d3983f2
- SHA512 5669764181126c18c558760f8016a9674029b069fb43a4e9e4bbaee052582feec36c9c395b84141e77cc99d8d44ce61f3ed03bf93211168c3faca1f5e52423fb
- SSDEEP 96:jrJBQjLoFjYL4R/fYAF35mqE0FHuZyYLEWak6dWwclWakudWw:vJBQ/o+L4R/3U0NSylWak6dWXWakudW
- TLSH T1CAE1BB41A3E57516F053E6320FBD150BB7F93403FD26C599E860AB281921B1D8FAEB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5237
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_adjust_fdiv
_initterm
malloc
free
kernel32
Sleep
DisableThreadLibraryCalls
OsThunkD3dContextCreate
OsThunkD3dContextDestroy
OsThunkD3dContextDestroyAll
OsThunkD3dDrawPrimitives2
OsThunkD3dValidateTextureStageState
OsThunkDdAddAttachedSurface
OsThunkDdAlphaBlt
OsThunkDdAttachSurface
OsThunkDdBeginMoCompFrame
OsThunkDdBlt
OsThunkDdCanCreateD3DBuffer
OsThunkDdCanCreateSurface
OsThunkDdColorControl
OsThunkDdCreateD3DBuffer
OsThunkDdCreateDirectDrawObject
OsThunkDdCreateMoComp
OsThunkDdCreateSurface
OsThunkDdCreateSurfaceEx
OsThunkDdCreateSurfaceObject
OsThunkDdDeleteDirectDrawObject
OsThunkDdDeleteSurfaceObject
OsThunkDdDestroyD3DBuffer
OsThunkDdDestroyMoComp
OsThunkDdDestroySurface
OsThunkDdEndMoCompFrame
OsThunkDdFlip
OsThunkDdFlipToGDISurface
OsThunkDdGetAvailDriverMemory
OsThunkDdGetBltStatus
OsThunkDdGetDC
OsThunkDdGetDriverInfo
OsThunkDdGetDriverState
OsThunkDdGetDxHandle
OsThunkDdGetFlipStatus
OsThunkDdGetInternalMoCompInfo
OsThunkDdGetMoCompBuffInfo
OsThunkDdGetMoCompFormats
OsThunkDdGetMoCompGuids
OsThunkDdGetScanLine
OsThunkDdLock
OsThunkDdLockD3D
OsThunkDdQueryDirectDrawObject
OsThunkDdQueryMoCompStatus
OsThunkDdReenableDirectDrawObject
OsThunkDdReleaseDC
OsThunkDdRenderMoComp
OsThunkDdResetVisrgn
OsThunkDdSetColorKey
OsThunkDdSetExclusiveMode
OsThunkDdSetGammaRamp
OsThunkDdSetOverlayPosition
OsThunkDdUnattachSurface
OsThunkDdUnlock
OsThunkDdUnlockD3D
OsThunkDdUpdateOverlay
OsThunkDdWaitForVerticalBlank
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
106B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=28, version=9178,
count=1, productName=Unmarked objects (old),
count=5, id=25, version=9210,
count=10, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3d9.dll
- IMPHASH 73d6655fde8a7f7d4855db21d50a427c
- SHA256 9f3c68a594c7f7b6894db388218a44f0954f1f91b8c308b83aa5017993e0f705
- MD5 7ba80564f369a96af84e3aa27e75e90b
- SHA1 2df7d2c4da063aa3d2521d81a9480c87135f1e7e
- SHA512 ad75977dd6896383b8185c1b3174cc01273af701f0f0289a34ec7a82a2ce7dec5eee6d83c4ef876efc81bdcd6ad59f7844e506ed0aa9b0c72a7ebc1a081bd7d8
- SSDEEP 49152:jHr7KWKVqD0b/0D9mKqL3QABykkWHNv5+8w:PD0b/26
- TLSH T1EE759D42F7AF04F2D8821970146F777FB238EB0A47259AC7E6E0ED54AD326919037297
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
449957
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d3d8thk
OsThunkDdSetGammaRamp
OsThunkDdCreateSurfaceEx
OsThunkDdCreateSurface
OsThunkDdCreateD3DBuffer
OsThunkDdAttachSurface
OsThunkDdCreateSurfaceObject
OsThunkDdCanCreateSurface
OsThunkDdCanCreateD3DBuffer
OsThunkD3dContextCreate
OsThunkD3dContextDestroy
OsThunkD3dContextDestroyAll
OsThunkDdGetDriverState
OsThunkDdDestroySurface
OsThunkDdQueryDirectDrawObject
OsThunkDdBlt
OsThunkDdReenableDirectDrawObject
OsThunkDdReleaseDC
OsThunkDdGetDC
OsThunkD3dValidateTextureStageState
OsThunkDdGetDriverInfo
OsThunkDdQueryMoCompStatus
OsThunkDdRenderMoComp
OsThunkDdEndMoCompFrame
OsThunkDdBeginMoCompFrame
OsThunkDdDestroyMoComp
OsThunkDdCreateMoComp
OsThunkDdGetMoCompBuffInfo
OsThunkDdGetInternalMoCompInfo
OsThunkDdGetMoCompFormats
OsThunkDdGetMoCompGuids
OsThunkDdGetAvailDriverMemory
OsThunkDdFlipToGDISurface
OsThunkDdSetExclusiveMode
OsThunkDdWaitForVerticalBlank
OsThunkDdGetFlipStatus
OsThunkDdGetBltStatus
OsThunkDdUnlock
OsThunkDdUnlockD3D
OsThunkDdLock
OsThunkDdLockD3D
OsThunkDdResetVisrgn
OsThunkDdFlip
OsThunkDdGetScanLine
OsThunkD3dDrawPrimitives2
OsThunkDdDeleteDirectDrawObject
OsThunkDdDeleteSurfaceObject
OsThunkDdDestroyD3DBuffer
msvcrt
realloc
calloc
malloc
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
free
_purecall
_strlwr
wcsrchr
atoi
ceil
_stricmp
_vsnprintf
floor
_CIpow
__CxxFrameHandler
_ftol
_snprintf
memmove
qsort
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
fflush
fwrite
??0exception@@QAE@ABV0@@Z
fopen
sprintf
strchr
??0exception@@QAE@XZ
fclose
_CxxThrowException
_except_handler3
user32
mouse_event
CreateIconIndirect
GetWindowDC
GetDesktopWindow
DestroyIcon
SetCursor
GetCursor
SetCursorPos
GetCursorPos
SetForegroundWindow
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop
IsWindow
GetWindowThreadProcessId
KillTimer
SetWindowLongA
CallWindowProcA
SendMessageA
IsIconic
PostMessageA
GetWindowLongA
GetKeyState
GetForegroundWindow
IsWindowVisible
ShowWindow
IsZoomed
SetTimer
SetRect
GetClientRect
EnumDisplaySettingsA
OffsetRect
IntersectRect
GetSystemMetrics
LoadStringA
GetMonitorInfoA
GetDC
ReleaseDC
SetWindowPos
SystemParametersInfoA
DefWindowProcA
wsprintfA
ClientToScreen
advapi32
InitializeAcl
RegCreateKeyExA
RegSetValueExA
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
GetLengthSid
RegOpenKeyA
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
winmm
timeEndPeriod
timeBeginPeriod
gdi32
GetSystemPaletteEntries
CreateDIBitmap
DeleteDC
GetDeviceCaps
GetNearestColor
CreateDCA
GdiEntry13
GetRegionData
DeleteObject
GetRandomRgn
CreateRectRgn
GetDIBits
CreateCompatibleBitmap
GetDeviceGammaRamp
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
SetStretchBltMode
BitBlt
GdiEntry1
kernel32
LocalFree
LocalAlloc
GetCurrentProcessId
DisableThreadLibraryCalls
CreateMutexA
OpenMutexA
CloseHandle
GetCurrentProcess
OutputDebugStringA
InterlockedCompareExchange
GetCurrentThread
SetThreadPriority
ResumeThread
SetThreadAffinityMask
GetProcessAffinityMask
VerifyVersionInfoA
TlsGetValue
TlsSetValue
GetEnvironmentVariableA
TlsAlloc
CreateEventA
CreateThread
ExitThread
SetEvent
WaitForMultipleObjects
VirtualProtect
VirtualAlloc
VirtualFree
GetSystemInfo
IsProcessorFeaturePresent
DebugBreak
lstrcpynA
VerSetConditionMask
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
lstrcmpA
WideCharToMultiByte
GetVersionExA
CreateFileA
MultiByteToWideChar
SetFilePointer
ReadFile
MoveFileA
DeleteFileA
WriteFile
GetFileSize
GetModuleFileNameA
GetSystemTimeAsFileTime
TerminateProcess
GetTempPathA
GetLastError
ReleaseMutex
InterlockedIncrement
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
SetErrorMode
WaitForSingleObject
FreeLibrary
GetProcAddress
LoadLibraryA
InterlockedDecrement
GetSystemDirectoryA
GetModuleHandleA
DebugSetLevel
DebugSetMute
Direct3DCreate9
Direct3DShaderValidatorCreate9
PSGPError
PSGPSampleTexture
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=18, version=8444,
count=2, id=25, version=9412,
count=8, id=64, version=9210,
count=138, id=29, version=9178,
count=15, id=25, version=9210,
count=244, id=1, productName=Unmarked objects,
count=16, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3dim.dll
- IMPHASH aaf084b5ca64e225bdea4fd61bc7dfac
- SHA256 03ad13e2f3a4026e76b960fa37b7800c2abe8d9c0a212a52f98035f8ed2f29c7
- MD5 cd4b00be972220d8b7da69d81ef3cd21
- SHA1 055923868e6cb4cbe85ca473ca7b60671309f00d
- SHA512 87678f11b75ae85f23ce5ea0908cea1b67c181b87df4ea5c3ca6ebeb0fac7776c1c0af9af4e8ca75ac4ae55ad24300c6fd9d93c98f65f3b53f5535d50803be0d
- SSDEEP 6144:bGn/r7udzoQwOwjq3PWsd4Y+uXEP3DGJxUprSDs+bBMarCG9KNVcM6:SuBwbG3D+uXEPIxUprSDs+bB/f
- TLSH T13394BF61AEB2C07AC4874A73CD9E673D75FE5342C9068CD78FC80D766B60EA1712612E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
110960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
msvcrt
_initterm
free
??3@YAXPAX@Z
_except_handler3
_purecall
??2@YAPAXI@Z
sscanf
_ftol
_CxxThrowException
fwrite
ftell
_onexit
__dllonexit
_CIpow
_CIexp
sprintf
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
fflush
fopen
fclose
fseek
user32
IntersectRect
SetRect
advapi32
RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
ddraw
ReleaseDDThreadLock
DDInternalUnlock
DDInternalLock
D3DParseUnknownCommand
AcquireDDThreadLock
kernel32
DebugBreak
HeapDestroy
HeapReAlloc
HeapFree
HeapCreate
VirtualFree
VirtualAlloc
OutputDebugStringA
HeapAlloc
LoadLibraryA
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleA
GetModuleFileNameA
DisableThreadLibraryCalls
GetSystemInfo
GetCurrentProcessId
InitializeCriticalSection
DeleteCriticalSection
IsBadReadPtr
FreeLibrary
IsBadCodePtr
D3DFree
D3DMalloc
D3DRealloc
Direct3DCreate
Direct3DCreateDevice
Direct3DCreateTexture
Direct3DGetSWRastZPixFmts
Direct3D_HALCleanUp
FlushD3DDevices
FlushD3DDevices2
PaletteAssociateNotify
PaletteUpdateNotify
SurfaceFlipNotify
Name
.text
Size
379KB
Virtual Size
379KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=14, version=7299,
count=39, id=1, productName=Unmarked objects,
count=27, id=2, version=7274,
count=169, productName=Unmarked objects (old),
count=1, id=14, version=8204,
count=9, id=19, version=9049,
count=1, id=6, version=2090,
d3dim.xpg
- IMPHASH 0a250d2a7f2aabed9156e96aafc6c5f9
- SHA256 1d5044e3f4b6f9b333b0c8ea4d91e85df7ef0b6ed85d1e12d5d2a085e90b43fa
- MD5 79e4ec1d4b6b9a80543b13958ac773d0
- SHA1 76b581265322dba078466b5ac3d07ef0d4dfc998
- SHA512 65b5cb47c0db3977aed53026a66484c1216557b45da72b80c69386a08fb7df501d79483bc51792843fda2ed817b1663c692374cbfa4052d651fbbb8055e98205
- SSDEEP 6144:iNN1LWbptJTxe0aLDaY+uYt7A4iLDmd9Ht43O7r1HWzSXvwRkRIsYvMuA6:yWbpt3e3+uS7A4iLDmdpt430HWznq6
- TLSH T1A894BFD3FAB1C076C8D74A72C59E277E39FE9381D94248D79EC40CA73A60A91701962F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
108409
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
fopen
fclose
fflush
fseek
ftell
fwrite
_except_handler3
_CxxThrowException
_CIpow
_CIexp
sprintf
_ftol
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
sscanf
user32
IntersectRect
SetRect
advapi32
RegSetValueExA
RegCreateKeyA
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
ddraw
ReleaseDDThreadLock
D3DParseUnknownCommand
DDInternalUnlock
DDInternalLock
AcquireDDThreadLock
kernel32
GetCurrentProcessId
IsBadReadPtr
InitializeCriticalSection
GetSystemInfo
FreeLibrary
IsBadCodePtr
GetModuleFileNameA
GetModuleHandleA
DisableThreadLibraryCalls
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
LoadLibraryA
LocalAlloc
LocalFree
LocalReAlloc
VirtualFree
OutputDebugStringA
VirtualAlloc
DeleteCriticalSection
D3DFree
D3DMalloc
D3DRealloc
Direct3DCreate
Direct3DCreateDevice
Direct3DCreateTexture
Direct3DGetSWRastZPixFmts
Direct3D_HALCleanUp
FlushD3DDevices
FlushD3DDevices2
PaletteAssociateNotify
PaletteUpdateNotify
SurfaceFlipNotify
Name
.text
Size
370KB
Virtual Size
370KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=14, version=7299,
count=60, id=1, productName=Unmarked objects,
count=11, id=25, version=9210,
count=57, productName=Unmarked objects (old),
count=7, id=28, version=9178,
count=3, id=64, version=9210,
count=105, id=29, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3dim700.dll
- IMPHASH 44012ae2f104a644e715dfc96a041b0a
- SHA256 66b7986eef185648a3dfd319adeb68926bcc613c3bd1f82c0f3ae98c7d799d10
- MD5 0a738df2ac9dda22d9a4058f8fd6d7f2
- SHA1 4e5abcf8c9b5e32d01a814e4eb65711d9ae4724d
- SHA512 ef5f598616c53e550cfc689b0004a45f1fc31ae04e6521c5f817ccc6957854f2b4734c7e819e9c5d21ecafb857aaa4e8f8d220f3fa06f35c63c6b6e5e795fe22
- SSDEEP 12288:k6k4uan+KBeUg1V6A3xnUxoZz7LDXCISrhZ5JQ7UZZ6+:kD4N3Be/tMq7LDTS1z6S6
- TLSH T14B059E92EFB945B2C9930131551F2FFBB8FE9712C41104A399D16EFABEB0B963520217
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
123052
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
malloc
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
free
_ftol
fopen
fclose
fflush
fseek
ftell
fwrite
_except_handler3
_purecall
pow
sprintf
exp
_CIexp
_CIpow
??2@YAPAXI@Z
_CxxThrowException
__CxxFrameHandler
??3@YAXPAX@Z
user32
IntersectRect
IsRectEmpty
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegOpenKeyExA
ddraw
CompleteCreateSysmemSurface
ReleaseDDThreadLock
AcquireDDThreadLock
DDInternalUnlock
DDInternalLock
D3DParseUnknownCommand
kernel32
LoadLibraryA
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleA
GetModuleFileNameA
Sleep
GetVersionExA
GetCurrentProcessId
IsBadReadPtr
FreeLibrary
IsBadCodePtr
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
LocalAlloc
LocalFree
LocalReAlloc
VirtualFree
VirtualAlloc
GetSystemInfo
CreateTexture
D3DBreakVBLock
D3DFree
D3DMalloc
D3DRealloc
D3DTextureUpdate
DestroyTexture
Direct3DCreate
Direct3DCreateDevice
Direct3D_HALCleanUp
FlushD3DDevices
GetLOD
GetPriority
PaletteAssociateNotify
PaletteUpdateNotify
SetLOD
SetPriority
SurfaceFlipNotify
Name
.text
Size
694KB
Virtual Size
694KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=49, version=8876,
count=6, id=18, version=8444,
count=2, id=25, version=9412,
count=63, productName=Unmarked objects (old),
count=4, id=64, version=9210,
count=78, id=29, version=9178,
count=9, id=25, version=9210,
count=67, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
d3dpmesh.dll
- IMPHASH 11fe7b7a647f9d7f932a13447062b9ec
- SHA256 0fa81e6b37946f358292c077983fa31532e8a0e4e409e9b8e8a13aa0f60e04b5
- MD5 2ee4f61345ee644a6af25ae1b81b1a64
- SHA1 786af22410233d8efd021f866ea2663d349e974d
- SHA512 e5bcc8a86d798cd514fd430b5fa2dcee366bd98db0297541609a022c23d529617d73defb46ffcad40b984a8a77403de650af6d3d5f8ca6cc3ae405e1e6fc3d96
- SSDEEP 768:GyWwx2xURbaLVYmTh3t9FElRlvryLNnq0/sz:GZwVgYmTL9SlvrIoOsz
- TLSH T104F25DE0AEE220FDC0C307356E7A6B61A2FD6B460CB90DE987953D1C5D70951E62873B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
35680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
msvcrt
malloc
_adjust_fdiv
_ftol
_initterm
free
kernel32
EnterCriticalSection
lstrlenA
HeapDestroy
HeapCreate
HeapFree
LeaveCriticalSection
SetEvent
lstrcpyA
lstrcmpA
HeapAlloc
CreateD3DRMPMeshVisual
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=10, id=2, version=7274,
count=3, id=19, version=9049,
count=1, id=6, version=2090,
count=15, productName=Unmarked objects (old),
d3dpmesh.xpg
- IMPHASH bf37aaa95d3ffb6ec33700abef7bde7f
- SHA256 7b3b8e9329300369e92dcf079bebe307ac942484760c1091ec761dfe5ee38a5e
- MD5 a023d0c8897ee721a54b125c3c0c9d1b
- SHA1 397c870bb052853fb933c2b319f4a95f0b87f946
- SHA512 504458a0e0c3b77184a7fbe63e07556d335bb3e605eeb3f97e5a7f105453954b36a8fb2a0bdc0e03874225a4383d0d4da6597d008161578e01433ea5227fe763
- SSDEEP 768:qQVblWWSnXr1aHt8XPVmtdQuVI37myMiqjB81lVg:qHWI7MtmPsHQWICyMixlVg
- TLSH T148F23BD09FE261F9D0531B7BAE5AABB536FA170608791CCD87903E0D5A60D81D13CA3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
34536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_adjust_fdiv
malloc
_initterm
free
_ftol
kernel32
LeaveCriticalSection
HeapDestroy
HeapCreate
HeapFree
HeapAlloc
lstrlenA
lstrcmpA
lstrcpyA
SetEvent
EnterCriticalSection
CreateD3DRMPMeshVisual
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
510B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=64, version=9210,
count=19, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=7, id=28, version=9178,
count=7, id=29, version=9178,
count=1, id=61, version=9210,
d3dramp.dll
- SHA256 9760c57666b2a2a88911ea60a24fc0cacc1094dfb5fe10c839856f326ed3a392
- MD5 f3a0f7e3e571ef7d08f49702f6554e1e
- SHA1 b01abefa93e0321aea9818bc61ef1bd804cfad39
- SHA512 8714f265ea2925399ac51926af7e9e3dfc474922d54846501b263365bd7f1c99cba3f1b0c523d90d95ceebcf86de18b2c240215968716b429f105973f70f9529
- SSDEEP 12288:+MwBzU24uRfaZHStoHYFy2Xiui4eiysi3L+aDdImaa9JONIoIc4fyfpKbxWKdqi8:+J/ySftKQyr
- TLSH T1E6C4E4C2899F4D4AC4077ABC682D7B9384DD5B167580F29CBFC5548A0CA9F13F49E82E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
RampOldTri
g_RampOld_BeadTbl
Name
CSEG
Size
419KB
Virtual Size
419KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
512B
Virtual Size
453B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DSEG
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=19, version=9049,
count=1, id=6, version=2090,
count=43, productName=Unmarked objects (old),
d3dramp.xpg
- SHA256 b51a4bbf2c4cefe6ed0c8d317d8c45029b2d80c6cdb4bc14bc7af53ecf721f61
- MD5 f3fb1edda3d4d38a03f6669dd9f5657a
- SHA1 19924e5fd6616eeff3f73c7521a6c0649515e90a
- SHA512 2e040c94ab38d79cdf94b6ba1339de442c8c211a77626d80eafc5043f79428f962cf6b8f20e54664d6760ac1340b23549ba025a09bb47c5c0a6d6b6629faf7c0
- SSDEEP 12288:UWozibvZx7c1fiD8Z49vs386vBjLQYHYtwLqvBfEyIg0UTYzzNPIOOYifJqAJ/UB:4386vB5JgY/PC0JhHKQyr
- TLSH T165C4D7CDCC6D149FE00B6ABC683637E3859D2B12D750FA1C6AAC789B4E0C656742C47B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
RampOldTri
g_RampOld_BeadTbl
Name
CSEG
Size
419KB
Virtual Size
419KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
512B
Virtual Size
389B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DSEG
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=40, productName=Unmarked objects (old),
count=1, id=28, version=9178,
count=2, id=29, version=9178,
count=1, id=61, version=9210,
d3drm.dll
- IMPHASH 2e99249d0177976ed8ca94ec21bdcca3
- SHA256 e2f13f6d88b32aa2f17c1fc88b4ba471cfe32c74db237b822dd5faed501b55c7
- MD5 aecd31520ec41b7f162f71d2ff879889
- SHA1 01e7efac08806bc25c9edcfd391b642cca93badc
- SHA512 7a7fd43c0f6fc8d07950dbf29fb8666ff42e0b5e6d8c540c9041e302a70bd9d1a1fc503bf49f389e8b8bd16f7ef7666ba19a6d90dde71b2ee4a90a6d3a6734f8
- SSDEEP 6144:V0KhtHyXUuPR+81UbKjOXsikqVkOEo4LMGb249feAPyY:V0KhkkA+81yKjOXs/ON4LMGb2499yY
- TLSH T1B7744C1BB3F2A42DD457137609B66BEEBE786E920C36F5468B5A4E481B61101F33F207
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
330144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
msvcrt
_except_handler3
getc
_initterm
_adjust_fdiv
??2@YAPAXI@Z
_beginthread
_endthread
_CIfmod
??3@YAXPAX@Z
floor
fread
time
srand
isdigit
fseek
isspace
qsort
_CIacos
_strdup
wcscmp
getenv
realloc
rand
memmove
malloc
free
_ftol
kernel32
GetLastError
GetCurrentProcessId
DeleteFileA
lstrcatA
CreateFileA
HeapCreate
HeapReAlloc
HeapDestroy
HeapAlloc
HeapFree
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GlobalUnlock
GlobalReAlloc
GlobalAlloc
Sleep
lstrcmpA
GetProfileIntA
LeaveCriticalSection
WaitForSingleObject
SetEvent
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
CreateEventA
CloseHandle
DeleteCriticalSection
GetSystemInfo
IsBadReadPtr
IsBadWritePtr
GetProcAddress
LoadLibraryA
LocalFree
lstrcpyA
lstrlenA
lstrcpynA
SetFilePointer
ReadFile
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
FreeLibrary
SizeofResource
GlobalFree
GlobalLock
FreeResource
LockResource
GetTempPathA
GetTempFileNameA
LoadResource
FindResourceA
user32
wsprintfA
ReleaseDC
GetDC
ClientToScreen
SetRect
GetSystemMetrics
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
gdi32
GetSystemPaletteEntries
GetDeviceCaps
ddraw
DirectDrawCreate
msvfw32
ICImageDecompress
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
D3DRMColorGetAlpha
D3DRMColorGetBlue
D3DRMColorGetGreen
D3DRMColorGetRed
D3DRMCreateColorRGB
D3DRMCreateColorRGBA
D3DRMMatrixFromQuaternion
D3DRMQuaternionFromRotation
D3DRMQuaternionMultiply
D3DRMQuaternionSlerp
D3DRMVectorAdd
D3DRMVectorCrossProduct
D3DRMVectorDotProduct
D3DRMVectorModulus
D3DRMVectorNormalize
D3DRMVectorRandom
D3DRMVectorReflect
D3DRMVectorRotate
D3DRMVectorScale
D3DRMVectorSubtract
Direct3DRMCreate
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
322KB
Virtual Size
322KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=19, version=8022,
count=70, id=1, productName=Unmarked objects,
count=33, id=2, version=7274,
count=15, id=19, version=9049,
count=1, id=6, version=2090,
count=210, productName=Unmarked objects (old),
d3drm.xpg
- IMPHASH 036abd03779827a82c766078826c93be
- SHA256 e04e3781e7ff3466723565da8413b08b705533acda257773874f2f8166b3d4d6
- MD5 dde9e3b8c264957ae0a017d371293123
- SHA1 af25767f425fa7877b996e5d29a54cab29b5ecfb
- SHA512 824b938383ce5e826c2abdc1065c24b6d8c3f781f9e44b6530a4c68423130a0d88fd5c631bd9f52bb4b07531f04e2f321c7aca3532d9d8825ca1c51670258dce
- SSDEEP 6144:gWZ2zQlXqEGzRXoJGfMnMMxzF+bnat9qqdpBnhwo6rbxOv:gWZ2zQ6YJGkX8cXHzwo6rbxOv
- TLSH T197745B1371F6533AF04312B9C66B67B97BE9B702502A958667880B5E072E643933F337
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
316593
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_endthread
??2@YAPAXI@Z
??3@YAXPAX@Z
floor
_beginthread
time
srand
fread
fseek
_initterm
_adjust_fdiv
_except_handler3
_CIfmod
isspace
isdigit
getc
qsort
memmove
malloc
realloc
free
_strdup
getenv
_CIacos
rand
wcscmp
_ftol
kernel32
GetTempFileNameA
GetTempPathA
GetCurrentProcessId
FreeLibrary
LoadResource
HeapDestroy
HeapCreate
HeapReAlloc
HeapFree
HeapAlloc
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
GlobalReAlloc
GlobalAlloc
GlobalUnlock
GetProfileIntA
Sleep
FindResourceA
LeaveCriticalSection
WaitForSingleObject
SetEvent
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
CreateEventA
CloseHandle
DeleteCriticalSection
GetSystemInfo
IsBadReadPtr
IsBadWritePtr
GetProcAddress
LoadLibraryA
LocalFree
lstrcpyA
lstrlenA
lstrcpynA
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
lstrcatA
CreateFileA
lstrcmpA
LockResource
GetLastError
GlobalFree
GlobalLock
SetFilePointer
ReadFile
SizeofResource
FreeResource
DeleteFileA
user32
wsprintfA
ClientToScreen
SetRect
GetDC
ReleaseDC
GetSystemMetrics
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
gdi32
GetSystemPaletteEntries
GetDeviceCaps
ddraw
DirectDrawCreate
msvfw32
ICImageDecompress
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SysAllocString
SysFreeString
D3DRMColorGetAlpha
D3DRMColorGetBlue
D3DRMColorGetGreen
D3DRMColorGetRed
D3DRMCreateColorRGB
D3DRMCreateColorRGBA
D3DRMMatrixFromQuaternion
D3DRMQuaternionFromRotation
D3DRMQuaternionMultiply
D3DRMQuaternionSlerp
D3DRMVectorAdd
D3DRMVectorCrossProduct
D3DRMVectorDotProduct
D3DRMVectorModulus
D3DRMVectorNormalize
D3DRMVectorRandom
D3DRMVectorReflect
D3DRMVectorRotate
D3DRMVectorScale
D3DRMVectorSubtract
Direct3DRMCreate
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
309KB
Virtual Size
309KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=3, id=64, version=9210,
count=102, id=1, productName=Unmarked objects,
count=17, id=25, version=9210,
count=3, id=29, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=206, id=28, version=9178,
count=1, id=61, version=9210,
d3dxof.dll
- IMPHASH 2a5a73044e09ce5262a6a38d104ae40e
- SHA256 9bf244d82d32fc2759cefceb1975cd2184bf122d9dd27ac29b85b0c76154e0ee
- MD5 8259cd86a1fa746bc5c97abbf2db53c3
- SHA1 a5922de309f682545c1495f2ebedfaddfad76eda
- SHA512 d1ccda68d36d7dc15b84620d96b8961e2fc83f9f23d2b14ab4a3bd33d390e3b7a433fd2dea3d811e94a13aa70854ea18fe1056069a36c1cf0c2408a11e24056e
- SSDEEP 1536:7Kiuovp9G3lTKI0DKahzKwi96Iwo6tlN:7KiuoR9UKI0D9hE6IwntlN
- TLSH T1AE239E13A7E0F7B7D01243310A1A772267FF6ED16A009A7AC3D0B9D55EF0981A73C65A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
41744
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
msvcrt
_adjust_fdiv
malloc
_initterm
free
vsprintf
isalpha
atof
atol
isalnum
isspace
isdigit
isxdigit
sscanf
_purecall
kernel32
IsBadReadPtr
lstrcmpA
HeapDestroy
HeapCreate
HeapReAlloc
HeapFree
HeapAlloc
MoveFileA
SetFilePointer
ReadFile
GetTempFileNameA
WriteFile
DeleteFileA
LoadLibraryA
GetProcAddress
LeaveCriticalSection
WaitForSingleObject
SetEvent
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
CreateEventA
CloseHandle
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
CreateThread
FindResourceA
lstrlenA
IsBadWritePtr
FreeResource
SizeofResource
LockResource
LoadResource
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
WaitForMultipleObjects
DirectXFileCreate
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=1, productName=Unmarked objects,
count=19, id=2, version=7274,
count=3, id=19, version=9049,
count=1, id=6, version=2090,
count=28, productName=Unmarked objects (old),
d3dxof.xpg
- IMPHASH 9e292ef8a851106689587dd3bcf4e9b3
- SHA256 dffb9e97277964353041b84f57f89c169502a9172067563feba98db4b1b25f77
- MD5 9bb566d2992a94caa25b2a886b0fb53b
- SHA1 50bcdb44cc705460c3ba95ba67894b58d5eceb97
- SHA512 8f17d6092140ee1989627758f01274473d65dc2a01f90b0950d61f620982a14573929f8adc59b87764c1d58dbd3735b69c36f84383e67c7f20b5068a6a0663c2
- SSDEEP 768:FTAW7hD5l8j7r0D6QeZyXo/uMNqZkGRexgTSAnpctQPqaaPE:d83r0D6Q3XW/NqiGeI5npc+PqaGE
- TLSH T116238E03AAFC7038E76141760BEE732327FEF9108A358A26439D65695E715CD923D363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
40586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_adjust_fdiv
malloc
_initterm
free
vsprintf
setlocale
_strdup
isalpha
atof
atol
isalnum
isspace
isdigit
isxdigit
sscanf
_purecall
kernel32
lstrcmpA
HeapDestroy
HeapCreate
HeapReAlloc
HeapFree
HeapAlloc
MoveFileA
SetFilePointer
ReadFile
GetTempFileNameA
DeleteFileA
WriteFile
LoadLibraryA
GetProcAddress
CreateThread
WaitForMultipleObjects
CreateFileA
GetFileSize
LeaveCriticalSection
WaitForSingleObject
SetEvent
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
CreateEventA
CloseHandle
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
IsBadReadPtr
lstrlenA
IsBadWritePtr
FreeResource
UnmapViewOfFile
SizeofResource
LockResource
LoadResource
FindResourceA
MapViewOfFile
CreateFileMappingA
DirectXFileCreate
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=64, version=9210,
count=60, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=11, id=28, version=9178,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
ddraw.dll
- IMPHASH 4c2e62100e8951673b1b2ac56ddbd9f0
- SHA256 e3ec130b154ff12ebfe9936cc4d779975dd7e84ed7a0ff3a4b15101bfe5da8d3
- MD5 61cc64c43bec193100e3722f6cf4b1e1
- SHA1 5378474cc1b0d0e795f9558f6376189643dbc55e
- SHA512 c6a7fbd081b1c697a174676a70d8b0b8f123fae3b597783be1cfa5072d05051f1a05371950a483060ae4d9a6e448cb25ff56418f4a6aa913978f9100796d66df
- SSDEEP 3072:T/gEgCIUyjyoTWM0b+5hx9sopTXdJhFvFSI3rpemVBFMROahJPpL9UgPXTIK1uim:76UyjrsETdJzFSYrb3a1NMK1ut9K3A
- TLSH T113547B03B3E3E232F077127A9564179A25AA7B608C3EF5CB065D699C6E34F40B636713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
232881
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_initterm
_ftol
malloc
_except_handler3
_adjust_fdiv
memmove
free
qsort
bsearch
_strlwr
wcsrchr
atoi
_stricmp
floor
ntdll
VerSetConditionMask
user32
RedrawWindow
ChangeDisplaySettingsExA
EnumDisplayDevicesA
wsprintfA
DestroyWindow
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClientRect
ClientToScreen
GetWindowThreadProcessId
SetCursor
KillTimer
SetWindowLongA
SendMessageA
IsIconic
PostMessageA
CallWindowProcA
GetAsyncKeyState
GetKeyState
SetFocus
DefWindowProcA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop
GetLastActivePopup
SystemParametersInfoA
mouse_event
SetForegroundWindow
SetWindowPos
GetForegroundWindow
ShowWindow
IsZoomed
SetTimer
ClipCursor
GetWindowLongA
IsWindowVisible
GetSystemMetrics
IsRectEmpty
GetMonitorInfoA
ChangeDisplaySettingsA
LoadStringA
CopyRect
EnumDisplaySettingsA
IsWindow
ScreenToClient
OffsetRect
SetRect
GetDC
ReleaseDC
IntersectRect
EqualRect
dciman32
DCIBeginAccess
DCICloseProvider
DCIDestroy
DCICreatePrimary
DCIOpenProvider
DCIEndAccess
advapi32
RegQueryValueExA
RegEnumKeyA
RegCloseKey
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
gdi32
SaveDC
DeleteDC
RestoreDC
GdiEntry8
StretchBlt
GdiEntry7
SelectPalette
SetDIBColorTable
GetSystemPaletteEntries
SelectObject
CreateCompatibleDC
CreateDIBSection
GetDIBits
CreateCompatibleBitmap
DeleteObject
ResizePalette
CreatePalette
GetDeviceCaps
GdiEntry5
BitBlt
RealizePalette
SetPaletteEntries
AnimatePalette
GetObjectType
GdiEntry4
GdiEntry2
GdiEntry10
PatBlt
ExtTextOutA
SetBkColor
StretchDIBits
GdiEntry13
GdiEntry6
GdiEntry11
GdiEntry14
GetDeviceGammaRamp
GdiEntry15
GetStockObject
GetRgnBox
CreateRectRgn
GetRandomRgn
GetRegionData
GdiEntry12
GdiEntry1
GdiEntry3
CreateDCA
GetNearestColor
SetSystemPaletteUse
kernel32
LocalFree
GetCurrentProcessId
GetLastError
GetSystemInfo
IsBadWritePtr
LeaveCriticalSection
EnterCriticalSection
IsBadReadPtr
GetProcAddress
GetModuleHandleA
IsBadCodePtr
FreeLibrary
LoadLibraryA
ReleaseMutex
WaitForSingleObject
lstrcpyA
lstrcpynA
CloseHandle
SetErrorMode
GetProfileIntA
lstrcmpA
GetCurrentThreadId
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
InterlockedExchange
lstrcmpiA
GetTickCount
OutputDebugStringA
LocalReAlloc
DeleteCriticalSection
OpenMutexA
InitializeCriticalSection
CreateMutexA
DisableThreadLibraryCalls
GetCurrentProcess
lstrcatA
WideCharToMultiByte
CreateFileA
MultiByteToWideChar
GetSystemDirectoryA
lstrlenA
ReadFile
SetFilePointer
GetModuleFileNameA
VerifyVersionInfoA
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
LocalAlloc
AcquireDDThreadLock
CompleteCreateSysmemSurface
D3DParseUnknownCommand
DDGetAttachedSurfaceLcl
DDInternalLock
DDInternalUnlock
DSoundHelp
DirectDrawCreate
DirectDrawCreateClipper
DirectDrawCreateEx
DirectDrawEnumerateA
DirectDrawEnumerateExA
DirectDrawEnumerateExW
DirectDrawEnumerateW
DllCanUnloadNow
DllGetClassObject
GetDDSurfaceLocal
GetOLEThunkData
GetSurfaceFromDC
RegisterSpecialCase
ReleaseDDThreadLock
Name
.text
Size
229KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=8, id=29, version=9178,
count=20, id=64, version=9210,
count=13, id=25, version=9210,
count=206, id=1, productName=Unmarked objects,
count=55, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
ddrawex.dll
- IMPHASH 40193c37e36853f13b55eb16686bbe8d
- SHA256 a21e6529fe4ab7efbf70bf2728b3daf96fbf58734f0a4ba191df3a02efc24469
- MD5 8a4936ea4b8a234a41c6037329087c13
- SHA1 ffd55bd6f217feabf7ef315ce16752e1102f5bc3
- SHA512 1c3c122299d281baee710c59345a6f8ddbbdff4882f1d5affadf64da2d97619a7f0f34d7e52fd7ede723f922b886cbae508313a22585926f04bc40e86d578eb5
- SSDEEP 384:ZkMIB21BthF3OsHj/MdOsupU592r9oirLjufuReXigTqmTnSMnfPRcaUK8XyuyWB:SMIA1ZFBj/MdHup89g9RLjjeihmTnSa+
- TLSH T173B21A5333F79178C0EB33334C69929FB3996B285472A80A83EA934317B5A15D52973F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TerminateProcess
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
InterlockedIncrement
GetTickCount
QueryPerformanceCounter
GetProfileStringA
LoadLibraryA
GetVersionExA
GetProcAddress
FreeLibrary
SetErrorMode
LocalFree
LocalAlloc
GetModuleFileNameA
lstrlenA
DisableThreadLibraryCalls
InterlockedDecrement
GetCurrentProcess
user32
GetDC
wsprintfA
ReleaseDC
MessageBoxA
advapi32
RegSetValueExA
RegCreateKeyA
RegDeleteKeyA
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
gdi32
DeleteDC
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
SelectObject
GetSystemPaletteEntries
DeleteObject
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
ddraw
ReleaseDDThreadLock
AcquireDDThreadLock
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=11, id=25, version=9210,
count=46, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=5, id=29, version=9178,
count=1, id=61, version=9210,
devenum.dll
- IMPHASH f773868e6cb462194b004b94abddb0dc
- SHA256 16bfa9ed6a2ac204868266aa6675107f1162adac972eb492d597264c774105fd
- MD5 15ab547237e05740634d300e67853730
- SHA1 20f8b1ea3301ac4d358d8e1581915f8fc73374ad
- SHA512 dc61b009c468863beecc1927399a7b8dd54cc22dadce88394688aaa84a02ab8d6ebb3332571800fc98ab6e86f181aa5957b2b25234b8b98e08f5d9dc5195afcb
- SSDEEP 3072:5FLUnMTp2tyfKHfeENUiWUHtdVDd5ZnnKzsb:6PGENB
- TLSH T1A3D3638177EF0559E1EA42B129B511A7866FF853C9F006F8A6AD921091F8F00E73CF97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
23328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryW
CreateMutexW
TerminateProcess
GetProcAddress
lstrcmpW
DisableThreadLibraryCalls
GetVersionExW
ReleaseMutex
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
lstrcpynW
GetModuleFileNameW
lstrcatW
HeapDestroy
WaitForSingleObject
GetCurrentProcess
CloseHandle
GetLastError
lstrlenA
WideCharToMultiByte
lstrcmpiW
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcpyW
lstrlenW
msvcrt
_except_handler3
_purecall
free
??2@YAPAXI@Z
realloc
malloc
??3@YAXPAX@Z
user32
wsprintfW
LoadStringW
CharNextW
advapi32
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegEnumKeyW
ole32
CoCreateInstance
StringFromGUID2
CreateBindCtx
CLSIDFromString
CreateAntiMoniker
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VarI4FromStr
LoadTypeLi
RegisterTypeLi
SysAllocString
VariantClear
SysFreeString
winmm
midiOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveInMessage
waveOutMessage
waveInGetNumDevs
midiOutGetDevCapsW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=11, id=25, version=9210,
count=161, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=20, id=29, version=9178,
count=1, id=61, version=9210,
diactfrm.dll
- IMPHASH 7ccc752422fb8b9373bf78f44fa203ed
- SHA256 d8262ac8465f08b5fecfdd2cae8fb99a89ce0cdbc4dde28a9c8d8ac5b177df66
- MD5 548f65df7a2af723c1d29349ffb8ad98
- SHA1 115935bac9300e8b1f93e3211cf78d3eabf5b07f
- SHA512 11ed2f1d7dc0d39f076792fac0ac87178ff66c4d1091e10c6c752778e1eb7f13a540c3c8da89010b2d751f3f844224f8c11a4d7282b9d7851ab872e560dfcd67
- SSDEEP 6144:fIeeeeeeeeHeeeeeeee8/NAOVx9pu/v6NPhMFSoB29rQYpkBoKIL6iCa5zpmUNeM:Nzw+6FKZQY2hIGa5QUNe36hko
- TLSH T1D1A47C01B3F8813AF0F36B306C7A2B6A6A7BBE519938C55F1794066E1D30A55CE71363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
115017
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwind
kernel32
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RaiseException
HeapSize
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
LoadLibraryA
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetFilePointer
SetUnhandledExceptionFilter
GetSystemInfo
VirtualQuery
SetStdHandle
IsBadCodePtr
FlushFileBuffers
CloseHandle
LeaveCriticalSection
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsProcessorFeaturePresent
UnmapViewOfFile
CreateFileW
CreateFileA
CreateFileMappingA
MapViewOfFile
GetFileSize
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
GetModuleHandleA
ExitProcess
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
TlsSetValue
GetCurrentThreadId
GetModuleFileNameW
Sleep
WideCharToMultiByte
IsBadReadPtr
IsBadWritePtr
lstrcmpW
GetTickCount
MulDiv
lstrcpyW
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
LoadLibraryW
GetProcAddress
FreeLibrary
lstrlenW
VirtualProtect
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegQueryValueW
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
ole32
CoTaskMemFree
StringFromCLSID
user32
DefWindowProcW
WindowFromPoint
EndPaint
BeginPaint
IsWindowVisible
SetPropW
GetPropW
RegisterClassExW
EnumChildWindows
DispatchMessageW
TranslateMessage
GetMessageW
ReleaseCapture
SetCapture
GetWindow
UnregisterClassW
GetClientRect
InvalidateRect
CreateWindowExW
DestroyWindow
LoadImageW
GetDesktopWindow
GetWindowDC
SetCursor
ValidateRect
LoadCursorW
GetIconInfo
DrawIcon
PostQuitMessage
ClipCursor
GetSystemMetrics
GetWindowRect
FillRect
GetUpdateRect
GetDoubleClickTime
SetFocus
SetParent
LoadStringW
IsWindow
MoveWindow
OffsetRect
GetDC
ReleaseDC
GetCursorPos
ScreenToClient
ClientToScreen
PostMessageW
KillTimer
SetTimer
PtInRect
InflateRect
ShowWindow
SendMessageW
SetWindowPos
GetParent
wsprintfW
DrawTextW
gdi32
SetBkColor
GetBkMode
GetBkColor
GetTextColor
CreateFontIndirectW
GetDeviceCaps
SetViewportOrgEx
OffsetViewportOrgEx
RestoreDC
SaveDC
CreateDIBSection
Polyline
DeleteDC
GetStockObject
GetObjectW
GetCurrentObject
LPtoDP
CreateCompatibleBitmap
StretchBlt
SetBrushOrgEx
SetStretchBltMode
GetBrushOrgEx
GetStretchBltMode
Polygon
ExcludeClipRect
IntersectClipRect
BitBlt
CreateCompatibleDC
CreatePen
SelectObject
CreateSolidBrush
Rectangle
MoveToEx
LineTo
SetTextColor
SetBkMode
DPtoLP
DeleteObject
dinput8
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
331KB
Virtual Size
331KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
80KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=8, productName=Unmarked objects (old),
count=215, id=1, productName=Unmarked objects,
count=15, id=25, version=9210,
count=31, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=129, id=28, version=9178,
count=116, id=29, version=9178,
count=1, id=61, version=9210,
diactfrm.inf
- SHA256 0fa10ec8733140fd48bd763e195c866029acfcc58869dc9b250f75d8ba080b30
- MD5 c981a5e3a834ae2f7be9b24fa12064c2
- SHA1 17ffd4b002fed95c17222aae988926e7cce502a5
- SHA512 5a039c0145c18ecc1f3f5bb638e27ad89c2cd8a2af27e80d144b640e691ad32a4948b27d21585b200ce6ebc3abe6cb1a2ecd8d02773db4c590465f576fcfbf20
- TLSH T13C1199BBCF3E4A9F19DD534FD8BA323241AC952AA0C1E18561D06102D84F4FCE45C5D9
- MD5 SHA1 SHA512 TLSH
diactfrm.xpg
- IMPHASH 7ccc752422fb8b9373bf78f44fa203ed
- SHA256 3060393e0818340397fe714adb913aa40a96d3c077bdbc94c1c0d396d441b78b
- MD5 28226b16860c2a0ceb1a26e5de905171
- SHA1 f4f7c28f3a9c68769a1d8e411c9527cb8f590a25
- SHA512 689aaf07437a715a1b2567a01d082481b7f52904b5b50b3c8479df2423678b378fba9b0efac013bd99f69b3dc89d03cc0b3fe4bba8b2a7c109b24866663c7fd6
- SSDEEP 6144:4naS/KAOe5FpU39e9s4bmoNyrZJdlQxVFoWuUfRpxkjqVBKkQeewQeeIQeesQee3:4aLsWWXbsZNQHF1uUf5YqVnhWlD
- TLSH T10DA46B01B3F88139F0F36B30697A97AA6A7BBE11CD38D15F179416AE1D30A55CA31363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
118988
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwind
kernel32
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RaiseException
HeapSize
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
LoadLibraryA
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetFilePointer
SetUnhandledExceptionFilter
GetSystemInfo
VirtualQuery
SetStdHandle
IsBadCodePtr
FlushFileBuffers
CloseHandle
LeaveCriticalSection
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsProcessorFeaturePresent
UnmapViewOfFile
CreateFileW
CreateFileA
CreateFileMappingA
MapViewOfFile
GetFileSize
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
GetModuleHandleA
ExitProcess
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
TlsSetValue
GetCurrentThreadId
GetModuleFileNameW
Sleep
WideCharToMultiByte
IsBadReadPtr
IsBadWritePtr
lstrcmpW
GetTickCount
MulDiv
lstrcpyW
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
LoadLibraryW
GetProcAddress
FreeLibrary
lstrlenW
VirtualProtect
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegQueryValueW
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
ole32
CoTaskMemFree
StringFromCLSID
user32
DefWindowProcW
WindowFromPoint
EndPaint
BeginPaint
IsWindowVisible
SetPropW
GetPropW
RegisterClassExW
EnumChildWindows
DispatchMessageW
TranslateMessage
GetMessageW
ReleaseCapture
SetCapture
GetWindow
UnregisterClassW
GetClientRect
InvalidateRect
CreateWindowExW
DestroyWindow
LoadImageW
GetDesktopWindow
GetWindowDC
SetCursor
ValidateRect
LoadCursorW
GetIconInfo
DrawIcon
PostQuitMessage
ClipCursor
GetSystemMetrics
GetWindowRect
FillRect
GetUpdateRect
GetDoubleClickTime
SetFocus
SetParent
LoadStringW
IsWindow
MoveWindow
OffsetRect
GetDC
ReleaseDC
GetCursorPos
ScreenToClient
ClientToScreen
PostMessageW
KillTimer
SetTimer
PtInRect
InflateRect
ShowWindow
SendMessageW
SetWindowPos
GetParent
wsprintfW
DrawTextW
gdi32
SetBkColor
GetBkMode
GetBkColor
GetTextColor
CreateFontIndirectW
GetDeviceCaps
SetViewportOrgEx
OffsetViewportOrgEx
RestoreDC
SaveDC
CreateDIBSection
Polyline
DeleteDC
GetStockObject
GetObjectW
GetCurrentObject
LPtoDP
CreateCompatibleBitmap
StretchBlt
SetBrushOrgEx
SetStretchBltMode
GetBrushOrgEx
GetStretchBltMode
Polygon
ExcludeClipRect
IntersectClipRect
BitBlt
CreateCompatibleDC
CreatePen
SelectObject
CreateSolidBrush
Rectangle
MoveToEx
LineTo
SetTextColor
SetBkMode
DPtoLP
DeleteObject
dinput8
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
333KB
Virtual Size
332KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=29, version=9177,
count=1, id=18, version=8444,
count=8, productName=Unmarked objects (old),
count=215, id=1, productName=Unmarked objects,
count=15, id=25, version=9210,
count=31, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=129, id=28, version=9178,
count=109, id=29, version=9178,
count=1, id=61, version=9210,
dijoy.hlp
- SHA256 5fd8d8aa0201478bab648bc238bd62acb285fc6920093099b723f1bacbfa180f
- MD5 137415567983464456676fd31e6062cf
- SHA1 e3761e725a08fb9dc41484096c8efc163335cf71
- SHA512 eab0c78188fe7c8cb3f3705888d7c3fec80e72f18debf0e0f2431d011d752acac8cfe05f980af6fb60977c8447b15740fee33bea4b6e8cb40c1a06622b9199e1
- SSDEEP 192:rn86i/9CHs32dZd1xE9clDqjRmwMClDHpXF+r:rzs9sm2dZdvE9clKMClDHpXF+r
- TLSH T13A92316F395FC612D754CCB9D6F2B9B98E28DCE1EC704507F9023A0C94B1BA6D293648
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoybrz.hlp
- SHA256 ab933cd613b713ce5812db9832957d03a4aca976ba3e0b7cc1ca6dfd3d8d335d
- MD5 e56c0c19b188bc93bad580c9789a1ca9
- SHA1 d905fff0a3c4938636167e94f4da4a519c70d01c
- SHA512 cc12d77873c6cebf517d78a7a2f71484920013c8989c5a83298618b6b2f6b7d0a65e8e80e1e4be5e452f764ed98b3d8d4d05a59854b199357a72570ba2241eea
- SSDEEP 96:gZVmb1PBLJ3+NtFJvVzcxrDx+XDN0vUzO2VMSxXDb0uwJmIPtFC3kAtcv9MMMMJ:qsNJu51Od+bzbbxX30vXtNAtSj
- TLSH T11D42D540BD94CE73C9954B38DDEAA9ED2162BE4ADC544B43704D3F8C3C32149AA5A97C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoychs.hlp
- SHA256 a989146607cca03659d3e5cadee3fd9f92675e7f49233c9c926dd641d8323f49
- MD5 e2b12a7212974b373fb5cef7c16e2910
- SHA1 253503674d0078dfa80bcfd687190c30a339ea56
- SHA512 b54399cef70dccd029f20bb872ec1826cbce8b0de4ee34f12660aaa448f1a379174e29a249dc031a881550f09951c246c16be8a7d6286899f094d16c192467e7
- SSDEEP 96:bwZ02kGSkC2LZc6HjYa/4Ky+4sxnLCvEIafedWLajezW5/bSnUMMMMJ:blh2LZcCj31y+NLCM2WLER5/Ic
- TLSH T1D9329251BC54EA57E8410AB4ED96FBE9F426BC45CD508367380C3B1C7C33145AB5A87C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoycht.hlp
- SHA256 1a9eee00c310a19ceba3b867873350b2fd657fb5ad0a17f7dd897c4170816363
- MD5 4b068dac56444fe69c0a29f58593c414
- SHA1 d94da6d175e9c417dc7a32d2be499105e42e4551
- SHA512 4b1cfde3bff6a2bb0ed6dc222392fc280f0d3b110041e288d7d57ce578c39301936bddb84bcee30d33b8967e2e5408a99010ec75d5290083283cf27c1bb75995
- SSDEEP 192:sEDppRgEuwkafEorxNs9ZzmK6wMClDHpXF+r:skpvuwkafEorxNAzhfMClDHpXF+r
- TLSH T19DA202AA5D50865AE165E83DD5EB73FD4A30ED11ADE0460F761F2A4D24F3FC280A360E
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoycze.hlp
- SHA256 e54b683561ded2a33a9cb8ac880ca9d16bb3e9a385a7419547914937af7dccfe
- MD5 b24f65363c41999f491c42dfaaf68006
- SHA1 bb600555568ee35726694031f4608528e47b2551
- SHA512 b5dbec06cba3dd57dcfa5638e65f92bb86daa8364bc979802bdb27abd3433fc362472e4697c57d275f43673ebf856b7c4f01282d083f40c4395d70c5dbdffd28
- SSDEEP 192:2zlYYzxIvU58MqbFpvSLc0hVSIPgERX49zXqmwMClDHpXF+r:bY68NguLc0hV3g064MClDHpXF+r
- TLSH T18CA2AE1EAAD1C513E254EE3EEED772FA6E10DC41AD80C4077F66274E24F39978063A18
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoydut.hlp
- SHA256 3c6e39b2150de576234eabd114386b7e0c590344e478e5f466ddf9e6eba1e7de
- MD5 9cd3263bf30d9a8ee30e4c67b4618920
- SHA1 3cc9fda099838283b2069838e71b659eebc70351
- SHA512 5a54d4eeedc47516a1aab18ddeb2fc5f53faaa186df56db6e6e3182ee24839072a6ac80bed6b93499855e9b66040d7ddbe29cf9d3906d0364c80efcbf71bfbb0
- SSDEEP 192:aYchIP+0T5aBH4KWYe6jkm7n4SsA8h7wmhhx:aYcmmRBH42Jjkm7psB7F
- TLSH T1AA4208553D51DE13C9A80B38DCEA72ED35B2BC0A8E65474B345D3B2D3D32914B90A87C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyfrn.hlp
- SHA256 420a39d13d76208fb4945fbb50765f86a21a10a52636f2e6c9090ff2b4e80f5a
- MD5 bc2602451a67cd71e3235fee03a80e1d
- SHA1 04ac95bdf73a103a213151da1f5be2a9e4f3ff2c
- SHA512 0ef376aa4328952af14acad024d2c36692ec042b93e028b0ea0d0a8db0370cbc68ddeeaf3146793d9a1dcbb05886abf24aa953bef4ed4be9b797dc6145dd9385
- SSDEEP 192:sDiDSyd0l7T81cWesLa1gs6u/YdeUzRe0Z7+:sDEpGWP2196efUzReIK
- TLSH T1B642E4413D6AD6A3D5840A74DEE2B9ED2071BD08ED504F8374497B6C2C32359AA4F87C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyger.hlp
- SHA256 79f5403200d668c28eb612cf427399b675ca5e7dddc9ed6950f3d6d37ece8327
- MD5 a0b7f28be23af3fb2408fe16e129194b
- SHA1 c4c090b356ac72d27afd7e284cd961b860ff6353
- SHA512 a119fbc294a9fcf790b290507315280a8bc30ca15db60baa6128d4b9b131e09ee2fdb36dc373aa4212802557764ab29d1d3aa6d1761b9b06c12e06255d77a514
- SSDEEP 192:qbLEH4huJ9ytDTfuW5BGfCRsjFDI0FnJRh0g4qvCwMClDHpXF+r:qb7c7EmOkFDrn9v3MClDHpXF+r
- TLSH T17092101EBD94C913E164DD7ADEEB71DD5B21EC42ED80C00B76267B4E28F2A429053B5C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyitn.hlp
- SHA256 3d8fe49c80fc3c95944db5c3a2981ad6185b65005466d44115a38e5545daedca
- MD5 790a63022358d88838b75fdcebe0d117
- SHA1 d7bf4afe54bec452929c0c8bf7bfd865ac0f827d
- SHA512 ebf2d39bba567f67419d7abf1385b751e9d2b8df313a052f1d7f87f7dd99d2fe8e44240e4953661ce1ca6805717fa68865a1f784539f9ad01e2a70df54d32562
- SSDEEP 96:c/x8jt76wJu0owCknzvSjFS9YICxwKX1c7xUBzjhXsb9voBrVdMi9LkkSyT5mSL1:GejBQeqbQKX+7xUBzjhXEv2DMgF/Vv
- TLSH T111420710BDA9DE27CD9A0A749E9678EE3231FC85CC964B1735283B1CBC77090A61C87C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyjpn.hlp
- SHA256 82c877015c2991c295c91587cc72110bd5d60b82b395436bfe3f03378e3d651f
- MD5 860d56f398918504f7bf635cac90b1a8
- SHA1 0f9bf97ec06c6a9d6446b43d6b80e422bd12e172
- SHA512 b51057746685d8b6e2b128cda719fdbe89391f03d0404f7be1e96361e31635c05a38c59c4c477e9f2b2c82333cdb27c81b40c44aa056d90f678d21c0bca783b2
- SSDEEP 96:GjcNBGLt1TpRMijFlynTkQgZ8Mo9Swyi3Uw/7diN6LgOuma/BYHOutk1CBzh4oZH:7vWX3aTk31ISxikw/7GJ1KSYHWvqp
- TLSH T1974207543CA5DE23C8584AB5CCE9F9E9346BFE82CD128F4335253B0C6E72484568B9BC
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoykor.hlp
- SHA256 37c89ff5eb05509bb94fd65b07f7a00e797c0f0ca74a5dd3c7df5942739fb5ff
- MD5 7c71777a3efa0749bb57b29e2f696674
- SHA1 7f6b8c7d8bd35de23c957a30ca09f5ec80d0dfe7
- SHA512 ba0bb13635eef016153e6d06b9566c9a9701dfae0bae88f3a9d9b258e1340b0c098c7afd479e7f044ed5e6b2edb0c0d80feb27168df7f4c2467e09d9de56618f
- SSDEEP 192:Y6eF9MbwmylCRkwjwJdD1DfpNWJxfObB3J+Lk1CocwMClDHpXF+r:sMJyl3SwJdDxpIXfOt5FMClDHpXF+r
- TLSH T105925F1EADD1C513E6649C7AE9DBB1A95E21EC41FC80C40B371A3B4E28F2E966053F5C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoypol.hlp
- SHA256 78f5386903c55ce3e668ea6b1951d083f6b966d0bd7732def083f796bb5fc440
- MD5 eaa0f6e7220f0becb4f03d13a94898db
- SHA1 bf517524e7aac53108d623bd2f4b3a63e1221ec6
- SHA512 b65cae32346503ac1e54ab31484091debcf864b55bdb493cf6efa508fa88536867572a696e81fa9a0f58554766ab9372f6ae2f3f3a8de00a8d58485ccd2c6b4b
- SSDEEP 384:prpyZc0K4D1KJeUtAXknfPXUhMClDHpXF+r:prpyZdK4D1KJ1tAXkfPXx
- TLSH T12D92311E7D80C513E564AD3ADBEBB6ED5B24EC41FD80C40B37267B4E28F2A82605365C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyrus.hlp
- SHA256 83300151382c642a5c923429504ede2a9f5b85c1c90cf448db6f0d81e86fc3e8
- MD5 e24d0e58df91ba9dc49d3fa72705c431
- SHA1 f2cfb7faf7de946a95ed2a362fa15f03130a18d0
- SHA512 347250adfa27cb7585d0e8803e59062320aa7dfd8a1fbbfa2899e90f63f853fc421e2f31ff93915be3a2b9570bf0c6a3d8d91b0c6c3476fc371641422041f8d4
- SSDEEP 96:nZB9zpCtbqw4coli8GWF1HfXwHO4sM7h54+932Arm41YGvvRbzdES5BTJEw/MMMw:nZB99iqYAgEMoCI4mgFdEuJjN
- TLSH T14D42E755FCA8EAA7C8940E74ECD7A6ED3815FC51BC418B2375113F4D7C3204A6A1A47C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyspa.hlp
- SHA256 5708c8d5b7f66788501b41e95072bdcfc4f4a870669bed72522caf07f3e8ff32
- MD5 cc6fe8fb75fc04c142a555be4d58b045
- SHA1 8e42720e2b74afd73500e487c224ed27c26a77c1
- SHA512 985ebe210fd27170b76e94e6a5c151a0eb9ec2c30425b8a2f8813605f2104bb42e521e7f271fc4192f8b35c892a0c24b03ccab601901ad157dbea7699d3e4848
- SSDEEP 192:R0KBPPZApLQiMI/gUZOQT8KABedBowZsgq+4Z6x8:R0KBPPaBQiEQgQ1b8
- TLSH T122420846BD96EA7BC4944774CDEA69EC3072FC0AEC06478371193F2C7C76180AA2993C
- MD5 SHA1 SHA512 SSDEEP TLSH
dijoyswe.hlp
- SHA256 24b9ccb7cbfdd39808025c1e40e39f73459419ab32a23f53e8f1b7411f90c030
- MD5 3939643e42362724cc79b10cbfed090d
- SHA1 78522d750ebac38913092eb91813fd694da58157
- SHA512 38b165e6642576f17dee54c733f1811f214d65475b3f0c82bfad0eec08ae891e50f91e319a97f1b785dbdaae5710ed16fc798c35ee3326293f4e56f3a1b18cb8
- SSDEEP 96:PUypMNALLx8G6paLKss/7bWxr/JOBHVinQtxTmpusARZX5ecZkJtPjAlkQ89WhMq:MyeNK9D7Ln47CxzcuQrCtA7tutLHfQ
- TLSH T1B342D650BC18ED57D4990678EEAFB9FD64667C89EE520B9332183B1C3C31049B58E17C
- MD5 SHA1 SHA512 SSDEEP TLSH
dimap.dll
- IMPHASH 469e31fbcb0cceedc5dbfe00ddb0c612
- SHA256 d0558fc713d47d0135f456a6660d809c4c6b6baf303fb96e5795e2cedd51ba1a
- MD5 163d4da9294255ce948ff2f8f4380fb0
- SHA1 00708c5fb2f6fdb7b6b8fab7bb347356539c03e4
- SHA512 0d4bc6802a905e5e495c6c7d0ad1d70966969f1e746d27ca390be5b9e409c49dd5be6b7c145b0e4d713ae07b9cdd7572fb2f01668bb69349a60205a841950d72
- SSDEEP 768:Dc2m0ufNky9EZa1sSb0NBXc86m26t4LxOq5HVL+a3IP9bpb:LbufPEZ+sSoBs85GLEqCCIPzb
- TLSH T163135C03B9D4C071E66219389FA467287AFBE0308C129E576368664F6F32B47FC55B17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
32892
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
?terminate@@YAXXZ
free
?_set_new_mode@@YAHH@Z
memmove
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
wcscpy
wcscat
_snwprintf
wcschr
_wsplitpath
swscanf
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
??0exception@@QAE@ABV0@@Z
iswspace
??1exception@@UAE@XZ
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
_adjust_fdiv
malloc
isdigit
??0exception@@QAE@ABQBD@Z
strlen
wcslen
_initterm
memcpy
kernel32
GetModuleHandleW
GetSystemTimeAsFileTime
GetVersion
GetPrivateProfileStringW
CreateDirectoryW
GetPrivateProfileIntW
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
GetLastError
DeleteCriticalSection
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
user32
wsprintfW
CharUpperBuffW
ole32
StringFromGUID2
dinput8
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
266B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=11, version=8397,
count=3, id=64, version=9210,
count=59, id=1, productName=Unmarked objects,
count=15, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=5, id=28, version=9178,
count=5, id=29, version=9178,
count=1, id=61, version=9210,
dimap.xpg
- IMPHASH 469e31fbcb0cceedc5dbfe00ddb0c612
- SHA256 9aff1e5a20742bd47c384e294091f6063241bc1c10e3a5d731c3e657e349dbe1
- MD5 b5603cb6cebf85058eade5d62258acba
- SHA1 d09f34ea9df9053b75d49cd949def5d49c31149a
- SHA512 042e0101f791aa915ad5bb3c0a39e290f75d32b20207a30e3a0e195c2948c75d241002738920b09271345f71b86685774eee21119fbc906af1962480e0a127bb
- SSDEEP 768:Kolmi5ufNvJdyOXsHvFG7tK8+m4jZE8i99Y1a37U9bpb:zT5uf3dyIsNuKzZE8i99Y1C7Uzb
- TLSH T11B13394B3B90C275E6632A39CB606B1D55F5F2304F12895B6329AB8D1A75F47C232F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
32892
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
?terminate@@YAXXZ
free
?_set_new_mode@@YAHH@Z
memmove
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
wcscpy
wcscat
_snwprintf
wcschr
_wsplitpath
swscanf
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
??0exception@@QAE@ABV0@@Z
iswspace
??1exception@@UAE@XZ
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
_adjust_fdiv
malloc
isdigit
??0exception@@QAE@ABQBD@Z
strlen
wcslen
_initterm
memcpy
kernel32
GetModuleHandleW
GetSystemTimeAsFileTime
GetVersion
GetPrivateProfileStringW
CreateDirectoryW
GetPrivateProfileIntW
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
GetLastError
DeleteCriticalSection
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
user32
wsprintfW
CharUpperBuffW
ole32
StringFromGUID2
dinput8
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
266B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=11, version=8397,
count=3, id=64, version=9210,
count=59, id=1, productName=Unmarked objects,
count=15, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=5, id=28, version=9178,
count=5, id=29, version=9178,
count=1, id=61, version=9210,
dimaps.inf
- SHA256 b762ccc6087e6089a923ac09134e19311e57d60e1cbdc4d1525576395d283c8d
- MD5 0545bc83300356cc68fdb44e0f90b774
- SHA1 0ea39abe3b95a3a4c73ac80ae1c5e36b13acd6bc
- SHA512 3557fae927a47db1293f50834236cc9bd1300902541eb742190a9d1695cb53d4363f482d40f1832af4271eed22dd86398d9b85a69b64d2f8f6b2fdcc2ba62621
- SSDEEP 192:D1XXRJO0FxTG5Q0U+y0J9zgR1FRPvdbxyNgBTTQai3a6ANIKZfZW8dvm/188OX63:DlhNxTG5Q0UGkOMs4BBKGS1V
- TLSH T13B62B9FA5D1ACE73D4E3D0C2E202AD17F54B9859D2A55DC4E8F1118ACB462A8803CBDA
- MD5 SHA1 SHA512 SSDEEP TLSH
dinput.dll
- IMPHASH cdcbbe5700e5939b98dbad5bf6ec9b91
- SHA256 fbe0589ba7b0aa3da4bbf8158aa79f0f6a309de1ea517a699ee63acd811510ce
- MD5 373ff13118d0ca8201e69cb14f673aef
- SHA1 f2b2566a3dfaba95d659c7977e8218d043fe282d
- SHA512 cd2c8c7276e332a2bdfad93b9ebb08ba3fca2fad460b5ed208611d6c5bd2e4558b2abbdcdedcf9f7f771a621a48165b9dc07c4ac9c6c8d9f17bfc3d412636057
- SSDEEP 6144:yOZ/aq5SB/exySKiX9Yg/rrX6n1d121eCnnnnnnnnnnnnnnnn:lt7ohGF
- TLSH T1D4D4F901B3FD5629F6F3BF786EB912954E7BBDA2AA35C10D0250254E1D31F909A20B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
43332
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_except_handler3
_ftol
kernel32
DeleteCriticalSection
ResetEvent
GetCurrentProcessId
IsBadReadPtr
IsBadWritePtr
WideCharToMultiByte
FreeLibraryAndExitThread
FreeLibrary
GetLastError
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventW
LoadLibraryW
GetTickCount
lstrcmpiW
ReadFileEx
DuplicateHandle
GetCurrentProcess
GetVersion
lstrcpynW
Sleep
ReleaseMutex
WaitForSingleObject
MulDiv
SetEvent
LocalReAlloc
SleepEx
ResumeThread
OpenEventW
GetProcAddress
DisableThreadLibraryCalls
UnmapViewOfFile
MultiByteToWideChar
lstrcmpW
GetPrivateProfileStringW
GetWindowsDirectoryW
lstrcmpiA
WriteFileEx
DeviceIoControl
SystemTimeToFileTime
GetLocalTime
MapViewOfFile
CreateFileMappingW
CreateMutexW
LoadResource
FindResourceW
CreateProcessW
InitializeCriticalSection
GetVersionExW
IsBadCodePtr
lstrlenA
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetSystemTimeAsFileTime
lstrlenW
CreateFileW
ReadFile
SetFilePointer
GetFileSize
lstrcpyW
CloseHandle
GetModuleHandleW
GetModuleFileNameW
GetFullPathNameW
InterlockedExchange
LocalFree
InterlockedDecrement
InterlockedIncrement
LocalAlloc
advapi32
RegOpenKeyExW
RegEnumValueW
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
GetSecurityInfo
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueW
RegCreateKeyW
RegOpenKeyW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW
AllocateAndInitializeSid
RegSetValueExW
RegCloseKey
BuildTrusteeWithSidW
user32
mouse_event
IsWindow
CallWindowProcW
wsprintfW
CharUpperW
UnhookWindowsHookEx
GetWindowThreadProcessId
IsIconic
GetForegroundWindow
GetWindowLongW
CallNextHookEx
SetWindowsHookExW
PostThreadMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
SetTimer
GetInputState
SystemParametersInfoW
IntersectRect
GetWindowRect
GetDesktopWindow
MapWindowPoints
GetClientRect
ReleaseCapture
SetCursorPos
GetAsyncKeyState
SetCapture
ClipCursor
ShowCursor
GetMessageTime
SendNotifyMessageW
GetCursorPos
GetSystemMetrics
MapVirtualKeyW
LoadStringW
keybd_event
GetKeyboardType
IsRectEmpty
SubtractRect
SendMessageW
RegisterWindowMessageW
FindWindowW
PostMessageW
SetWindowLongW
DefWindowProcW
GetPropW
SetPropW
RemovePropW
winmm
mmioClose
mmioOpenA
mmioAscend
mmioDescend
mmioCreateChunk
mmioRead
mmioWrite
DirectInputCreateA
DirectInputCreateEx
DirectInputCreateW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
514KB
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=64, version=9210,
count=152, id=1, productName=Unmarked objects,
count=11, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=60, id=28, version=9178,
count=1, id=61, version=9210,
dinput.inf
- SHA256 b457f9d6bdc0319e9d25bfdf45894a2ff15450d4d9c15f9c7440d03bcce06c9f
- MD5 ccb9a9be27aff07fb568e8590337e530
- SHA1 f114e3d8ab09613d9005680b5b44006a75d9a09c
- SHA512 e64e41208546ec15e472c32815c96ac6c0cfeeed1663292beb35310e425bc8ee6229c3ec851561eab9f3781d4a0e1c6f3264b1def93555e32c3e7e83690e583b
- SSDEEP 384:ljp4nYxTmr/xHz79a/Yh7hjN7D0gt9z7lQv2l6noRV7R7pz7j:ljp4npF3U/ghjtQIplS2l531j
- TLSH T1ACB22486DF1C0611D0C3AB09BB06BD06D12E7B5951A0941FEA9C6F0EF7CE62484F6D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
dinput.xpg
- IMPHASH bbce740fef1666a6f7c543502180b356
- SHA256 6d33bd779b70daed4296aa27113455811267a2d2df99b094d1d641be185d87ad
- MD5 a0d6489eb1739bdc106b95266005e1d6
- SHA1 ed42b1b53e9e9d8af356735c788dae88778649fa
- SHA512 ecaf60050a5316870b9d400cbded221240cc607ab4b7a1406032dc2c89197403b1ad36805a631fa740e3d1f689f7a5dbe41b96cf4c1c22f78c1b52ccd0872c19
- SSDEEP 6144:u/uc1FJVzUyEGEGswr616n1q121PTnnnnnnnnnnnnnnnnW:umCHzS9X
- TLSH T19FD4F911B3FD5629F2F3BB786EB916954E3BBDA2A936C10D0250254E1D31F90DA20B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
44181
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_except_handler3
malloc
free
_ftol
kernel32
LeaveCriticalSection
SetEvent
DeleteCriticalSection
ResetEvent
GetCurrentProcessId
IsBadReadPtr
IsBadWritePtr
WideCharToMultiByte
FreeLibraryAndExitThread
WaitForSingleObject
FreeLibrary
GetLastError
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventW
LoadLibraryW
GetTickCount
lstrcmpiW
ReadFileEx
DuplicateHandle
GetCurrentProcess
GetVersion
lstrcpynW
Sleep
ReleaseMutex
MulDiv
LocalAlloc
LocalReAlloc
SleepEx
ResumeThread
OpenEventW
GetProcAddress
DisableThreadLibraryCalls
UnmapViewOfFile
MultiByteToWideChar
lstrcmpW
GetPrivateProfileStringW
GetWindowsDirectoryW
lstrcmpiA
WriteFileEx
DeviceIoControl
SystemTimeToFileTime
GetLocalTime
MapViewOfFile
CreateFileMappingW
CreateMutexW
LoadResource
FindResourceW
CreateProcessW
InitializeCriticalSection
GetVersionExW
IsBadCodePtr
lstrlenA
EnterCriticalSection
GetCurrentThreadId
GetSystemTimeAsFileTime
lstrlenW
CreateFileW
InterlockedIncrement
ReadFile
SetFilePointer
GetFileSize
lstrcpyW
CloseHandle
GetModuleHandleW
GetModuleFileNameW
GetFullPathNameW
InterlockedExchange
LocalFree
InterlockedDecrement
advapi32
RegDeleteValueW
RegEnumValueW
AllocateAndInitializeSid
BuildTrusteeWithSidW
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
GetSecurityInfo
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueW
RegCreateKeyW
RegOpenKeyW
RegDeleteKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
user32
MapWindowPoints
GetRawInputDeviceList
GetRawInputDeviceInfoW
GetKeyboardType
IsWindow
wsprintfW
CharUpperW
UnhookWindowsHookEx
GetWindowThreadProcessId
IsIconic
GetForegroundWindow
GetWindowLongW
CallNextHookEx
SetWindowsHookExW
PostThreadMessageW
MsgWaitForMultipleObjects
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadIconW
LoadCursorW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
SetTimer
GetInputState
SystemParametersInfoW
IntersectRect
GetWindowRect
GetDesktopWindow
GetClientRect
ReleaseCapture
SetCursorPos
mouse_event
GetAsyncKeyState
SetCapture
ClipCursor
ShowCursor
GetMessageTime
SendNotifyMessageW
GetCursorPos
GetSystemMetrics
MapVirtualKeyW
LoadStringW
keybd_event
IsRectEmpty
SubtractRect
SendMessageW
RegisterWindowMessageW
FindWindowW
PostMessageW
SetWindowLongW
GetPropW
SetPropW
RemovePropW
CallWindowProcW
winmm
mmioClose
mmioWrite
mmioRead
mmioOpenA
mmioAscend
mmioDescend
mmioCreateChunk
DirectInputCreateA
DirectInputCreateEx
DirectInputCreateW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
516KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=64, version=9210,
count=161, id=1, productName=Unmarked objects,
count=11, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=60, id=28, version=9178,
count=1, id=61, version=9210,
dinput8.dll
- IMPHASH 20264582df85180f5b29d7280a7ac0ee
- SHA256 6162987ce4d5101168902bde04da37a0e7bd4d2e5cce2d732efacba97d52e899
- MD5 9bc8e8eb2fb9d9405928eb0f5c3fa821
- SHA1 516f8949e05b6727ed0dbd9ed0c474e5ac267e3c
- SHA512 06209c6f99e103058335b21855f460bcf305c64b8d4b0454a729b7573e56c272ebe1a2f668549a4fa8e4bd0ea0f75fbe53d47df44dc3d379b382f7d6b533250e
- SSDEEP 6144:6auXlAzI0TrpIh+78u6BGj+1r45zW1t121qA3nnnnnnnnnnnnnnnn:rAP0lBtj+
- TLSH T1F5E40A11B3FC5629F6F3AB786EB912954E3BBDA6A935C50E0250254E1D31F90DE20B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
50851
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_except_handler3
strchr
iswctype
towupper
_ftol
kernel32
IsBadReadPtr
IsBadWritePtr
lstrcpyW
lstrcmpW
FreeLibraryAndExitThread
FreeLibrary
GetLastError
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventW
LoadLibraryW
GetTickCount
lstrcmpiW
ReadFileEx
DuplicateHandle
GetCurrentProcess
ReleaseMutex
WaitForSingleObject
MulDiv
GetVersion
LocalAlloc
LocalReAlloc
GetCurrentProcessId
ResumeThread
GetProcAddress
DisableThreadLibraryCalls
UnmapViewOfFile
MultiByteToWideChar
lstrlenA
IsBadCodePtr
CompareFileTime
lstrcpynW
GetPrivateProfileStringW
GetWindowsDirectoryW
WriteFileEx
Sleep
DeviceIoControl
SystemTimeToFileTime
GetLocalTime
HeapFree
HeapAlloc
GetProcessHeap
MapViewOfFile
CreateFileMappingW
CreateMutexW
LoadResource
FindResourceW
CreateProcessW
InitializeCriticalSection
GetVersionExW
CreateFileA
GetFullPathNameA
WideCharToMultiByte
ResetEvent
DeleteCriticalSection
SetEvent
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
lstrlenW
GetSystemTimeAsFileTime
CreateFileW
ReadFile
SetFilePointer
GetFileSize
CloseHandle
GetModuleHandleW
GetModuleFileNameW
GetFullPathNameW
InterlockedExchange
LocalFree
InterlockedDecrement
InterlockedIncrement
SleepEx
advapi32
RegEnumValueW
BuildTrusteeWithSidW
SetEntriesInAclW
GetSecurityInfo
RegDeleteKeyW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
FreeSid
RegEnumKeyExW
RegSetKeySecurity
RegCreateKeyW
RegOpenKeyW
RegQueryValueW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
GetUserNameW
RegCreateKeyExW
user32
MapVirtualKeyExW
GetKeyboardLayout
GetActiveWindow
GetKeyNameTextW
ToUnicodeEx
PostMessageW
wsprintfW
CharUpperW
UnhookWindowsHookEx
GetWindowThreadProcessId
IsIconic
GetForegroundWindow
GetWindowLongW
CallNextHookEx
SetWindowsHookExW
PostThreadMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
SetTimer
GetInputState
SystemParametersInfoW
IntersectRect
GetWindowRect
GetDesktopWindow
MapWindowPoints
GetClientRect
ReleaseCapture
SetCursorPos
mouse_event
GetAsyncKeyState
SetCapture
ClipCursor
ShowCursor
GetMessageTime
SendNotifyMessageW
GetCursorPos
GetSystemMetrics
MapVirtualKeyW
LoadStringW
keybd_event
GetKeyboardType
IsRectEmpty
SubtractRect
RegisterWindowMessageW
SetWindowLongW
DefWindowProcW
GetPropW
SetPropW
RemovePropW
CallWindowProcW
IsWindow
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
517KB
Virtual Size
520KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=64, version=9210,
count=161, id=1, productName=Unmarked objects,
count=9, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=61, id=28, version=9178,
count=1, id=61, version=9210,
dinput8.xpg
- IMPHASH 2d552e50787a48e41699730d07d32036
- SHA256 48d05ae3fe993c9c64d442bf5440ff03a15609396d7c39637ddbf836b6eb3e1b
- MD5 c026f271456e1fc247f7bfb362258bff
- SHA1 8cd0742682fb2590f8d9f372911abd5504f3159d
- SHA512 a9a38c9cd912bbeaa6af3fdde9e3fe76f60d1aa591b30b2518f4c641c7db1424ce8d5c93bdcb0aef9bd5c65e3ed990cbb5b7c97be9ad155154c9f920e0a7be45
- SSDEEP 6144:GoVJKqjmlTkcUpgGq71uDsKrV+zW1t121wXRnnnnnnnnnnnnnnnnn:7VIlNBr78s
- TLSH T179E4FA11A3FC5629F6F3BF786EB916954E3BBDA2A936C10D1250254E1D31F90DA20B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
51637
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_except_handler3
malloc
free
strchr
iswctype
towupper
_ftol
kernel32
WideCharToMultiByte
GetCurrentProcessId
IsBadReadPtr
IsBadWritePtr
lstrcpyW
lstrcmpW
FreeLibraryAndExitThread
WaitForSingleObject
FreeLibrary
GetLastError
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventW
LoadLibraryW
GetTickCount
lstrcmpiW
ReadFileEx
DuplicateHandle
GetCurrentProcess
ReleaseMutex
MulDiv
GetVersion
LocalAlloc
LocalReAlloc
SleepEx
ResumeThread
ResetEvent
DisableThreadLibraryCalls
UnmapViewOfFile
MultiByteToWideChar
lstrlenA
IsBadCodePtr
CompareFileTime
lstrcpynW
GetPrivateProfileStringW
GetWindowsDirectoryW
WriteFileEx
Sleep
DeviceIoControl
SystemTimeToFileTime
GetLocalTime
HeapFree
HeapAlloc
GetProcessHeap
MapViewOfFile
CreateFileMappingW
CreateMutexW
LoadResource
FindResourceW
CreateProcessW
InitializeCriticalSection
GetVersionExW
CreateFileA
GetFullPathNameA
DeleteCriticalSection
SetEvent
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
lstrlenW
GetSystemTimeAsFileTime
CreateFileW
ReadFile
SetFilePointer
GetFileSize
CloseHandle
GetModuleHandleW
GetModuleFileNameW
GetFullPathNameW
InterlockedExchange
LocalFree
InterlockedDecrement
GetProcAddress
advapi32
RegOpenKeyExW
RegEnumValueW
BuildTrusteeWithSidW
SetEntriesInAclW
GetSecurityInfo
RegDeleteKeyW
GetUserNameW
RegCreateKeyExW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
FreeSid
RegEnumKeyExW
RegSetKeySecurity
RegCreateKeyW
RegOpenKeyW
RegQueryValueW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
user32
MapVirtualKeyExW
GetKeyboardLayout
GetActiveWindow
GetKeyNameTextW
GetKeyboardType
GetRawInputDeviceInfoW
GetRawInputDeviceList
PostMessageW
wsprintfW
CharUpperW
UnhookWindowsHookEx
GetWindowThreadProcessId
IsIconic
GetForegroundWindow
GetWindowLongW
CallNextHookEx
SetWindowsHookExW
PostThreadMessageW
MsgWaitForMultipleObjects
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadIconW
LoadCursorW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
SetTimer
GetInputState
SystemParametersInfoW
IntersectRect
GetWindowRect
GetDesktopWindow
MapWindowPoints
GetClientRect
ReleaseCapture
SetCursorPos
mouse_event
GetAsyncKeyState
SetCapture
ClipCursor
ShowCursor
GetMessageTime
SendNotifyMessageW
GetCursorPos
GetSystemMetrics
MapVirtualKeyW
LoadStringW
keybd_event
IsRectEmpty
SubtractRect
RegisterWindowMessageW
SetWindowLongW
GetPropW
SetPropW
RemovePropW
CallWindowProcW
IsWindow
ToUnicodeEx
DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
518KB
Virtual Size
517KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=64, version=9210,
count=170, id=1, productName=Unmarked objects,
count=9, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=61, id=28, version=9178,
count=1, id=61, version=9210,
dmband.dll
- IMPHASH 2dd98eee91901e42aced29ca5eefb08b
- SHA256 9b47be4207fdf4938ed2efe147267368156eff3ef858532894dc65994431ab78
- MD5 d9fa25931877554c70afff8caef2fa01
- SHA1 2a4a97e44ab654f29f33482858b4cb3d4ca59b94
- SHA512 d5bf731f1312bc1a5eec9fbb338e28633f41e83941d00780713e296130f83fea9de81ab6736bf85591c0ca3c969bb37caf9ec7d53fbae05129ad83ceb6007fa2
- SSDEEP 384:H+RBs49fj7nR2QbX8K8Iv9YFQNKaOb8CIvuV2A8dPCrofD7+p0kWhKZW1:H+7HBnLv/iFmKrb8CIvuAA0PWa7iRg
- TLSH T185C23B63B3E18079E97A1235AF65276923FBD720895A554213451B8E37B08C2E23EB07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
24716
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
MultiByteToWideChar
lstrcpynA
DisableThreadLibraryCalls
lstrlenA
lstrcatA
lstrcpyA
GetModuleFileNameA
QueryPerformanceCounter
InterlockedDecrement
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
Sleep
IsBadCodePtr
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
IsBadWritePtr
GetTickCount
IsBadReadPtr
msvcrt
_adjust_fdiv
_initterm
free
malloc
wcstombs
__CxxFrameHandler
wcsncpy
_purecall
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
ole32
StringFromCLSID
CoTaskMemFree
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=3, id=64, version=9210,
count=7, id=25, version=9210,
count=50, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=10, id=29, version=9178,
count=1, id=61, version=9210,
dmcompos.dll
- IMPHASH 968421b7ed4e42ca13de160c864b4ae6
- SHA256 710f66714db0e5c6188d9a0f39e21f06ddcc9ded23e5457e07f8c04ed09de697
- MD5 989ba23c8505cba0a9bf202da0c0d06f
- SHA1 55712157c443758b17c1eebf374cc7ab09cb4085
- SHA512 c13e2687abd9ecceea93f8530ae045e7d368d699a2651dae690e52e1e3ef5b9ab8a63ea83400903157eea627d0417b08553576f95b2fea45b4c7bef1b94612d6
- SSDEEP 768:PpjWekfKuZSXp4aVPKRORsyHicwjoE2yjMdGtW7EQj274AMHezbMirGzam:VkFSZZVPK4Rsya92TMQ7EQjpe5r+/
- TLSH T106436C6373E3C0F6D1632171DA08A7EA17F99B2D583B858A67180F4E7B609C5973C50B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
53673
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
IsBadCodePtr
lstrlenA
lstrcatA
lstrcpyA
GetModuleFileNameA
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LeaveCriticalSection
InitializeCriticalSection
Sleep
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
IsBadWritePtr
MultiByteToWideChar
IsBadReadPtr
msvcrt
wcslen
malloc
free
_initterm
_adjust_fdiv
wcstombs
wcscpy
time
srand
wcsncpy
_purecall
__CxxFrameHandler
rand
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
ole32
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CreateStreamOnHGlobal
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=64, version=9210,
count=7, id=25, version=9210,
count=61, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
dmime.dll
- IMPHASH e84f92ef3e04403f433866f3a97f487c
- SHA256 a228e18ff64273e9a6193a95362f8e50d3672321fa60b3f7072c4a9ee42303c8
- MD5 2cc3c8a3b898606b3422a1b8a065ed5b
- SHA1 b88faec9a7b8b7d35d81101308f7509c0ae15273
- SHA512 08f3194296383b922df311e353452029d4623cd1f0ef86d0e823bc31024bf95c24c58cba3273623fcab70039afe27d17347834e5d3c4333449094e2726a2cccc
- SSDEEP 3072:Z4FYkXv4moqzj6dn+byWi8M+43UXZIKmU5//02dEEfvE:GWqvcqzj6d+OWNX9qKmU5XpE
- TLSH T120F37C2173D2C03AE483A2328A0973BAF3F9DB292637565312541F1DFBB0596A73D647
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
157721
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WaitForSingleObject
SetEvent
GetCurrentThreadId
Sleep
SetThreadPriority
CreateEventA
CreateThread
DisableThreadLibraryCalls
lstrlenA
lstrcatA
lstrcpyA
CloseHandle
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
InterlockedDecrement
InitializeCriticalSection
IsBadCodePtr
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
IsBadWritePtr
IsBadReadPtr
GetModuleFileNameA
msvcrt
__dllonexit
_onexit
_adjust_fdiv
_initterm
rand
_CIpow
malloc
wcstombs
wcscpy
__CxxFrameHandler
wcscmp
time
srand
_ftol
_purecall
wcslen
free
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
advapi32
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegCloseKey
ole32
CoTaskMemFree
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
StringFromCLSID
user32
GetForegroundWindow
IsWindow
GetDesktopWindow
dsound
ord11
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
154KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=13, id=25, version=9210,
count=75, id=1, productName=Unmarked objects,
count=12, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=29, id=29, version=9178,
count=1, id=61, version=9210,
dmloader.dll
- IMPHASH 8332206d5778356b1110b44f2e3cfdef
- SHA256 544800d356d887b9dd560807b93e8031c9dffd8fe2c70c515ee33105d9867fee
- MD5 350527f0de735d2e4ac4fa5f892a41b2
- SHA1 a840241b2b273bbf67e60421773ced34fe5fc9cf
- SHA512 b9d780bcce6b06ed439c2811042407fb9376fdfdeb2ffa3ce75744c704ba10681f41c9c38f4942b324c1dcac57bf078d37ebad8f1c34cef95cfdec49da583f8b
- SSDEEP 768:K3k/xJStMm6UB4kyVkxPzrueihLGP6/zUKpmMtfmw:L/xJKMU+87rXPQ4K8MAw
- TLSH T18DE28C93B7E394B9E7939630A95A73DA23B9A7744A2910165B410B0F3E71A52E33C703
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
30152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
IsBadCodePtr
GetFileAttributesA
GetFileAttributesW
DeleteCriticalSection
InitializeCriticalSection
FindClose
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
lstrlenA
lstrcatA
IsBadWritePtr
GetModuleFileNameA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
IsBadReadPtr
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
Sleep
DisableThreadLibraryCalls
GetVersionExA
InterlockedIncrement
lstrcpyA
InterlockedDecrement
msvcrt
fclose
fread
fwrite
ftell
fseek
_strerror
_fsopen
_wfsopen
malloc
free
_initterm
_adjust_fdiv
wcsncat
wcsrchr
_wcsicmp
mbstowcs
wcslen
wcstombs
wcsncpy
_purecall
wcscpy
__CxxFrameHandler
wcscat
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueExW
ole32
StringFromCLSID
CoTaskMemFree
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=3, id=64, version=9210,
count=7, id=25, version=9210,
count=74, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=10, id=29, version=9178,
count=1, id=61, version=9210,
dmscript.dll
- IMPHASH 903e24e172a63cf62c8720d3d4074255
- SHA256 28d548356bf614035ad26ec572533c09bc88d9cd693a360a2cc74a4b8ea3172a
- MD5 e0148ed5eba4a5ddf173c7f40b3b7a26
- SHA1 8f4ff2dd7594f07fd80e6db3fc5a3d4dee11064b
- SHA512 b46216d9f65b8adb37e9124c9f5fd47c0ff8cb7d51331320aacab2bb50893380ace696605d42e401e4f6e0a7cfd44e2a4abe6c77d691b2b0ac42ca21a10180a8
- SSDEEP 1536:CqnzhvqHa+ekgfjpNdvI4b7HYgRsqwCJhzVVXf4Kl3p+n:rS6D9pN9ZbdRs+hMK5pM
- TLSH T116735C2277E58036F77276764A30B269A3FA99142D3BDE1613140B4D2EB1E83E97C347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
69597
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryA
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
DisableThreadLibraryCalls
WaitForSingleObject
SetEvent
CreateEventA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetTickCount
InterlockedDecrement
GetCurrentThreadId
IsBadCodePtr
InterlockedIncrement
IsBadWritePtr
CloseHandle
IsBadReadPtr
Sleep
msvcrt
_CIpow
_ftol
wcsncpy
tolower
_stricmp
wcstombs
wcsstr
_ultow
wcstoul
_endthreadex
_beginthreadex
free
_initterm
_adjust_fdiv
__dllonexit
_onexit
_except_handler3
malloc
wcslen
wcscpy
wcscat
_wcsicmp
wcscmp
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumKeyA
RegCreateKeyExA
ole32
CLSIDFromProgID
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=7, id=25, version=9210,
count=73, id=1, productName=Unmarked objects,
count=13, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=36, id=29, version=9178,
count=1, id=61, version=9210,
dmstyle.dll
- IMPHASH 9b9b56669a52debf1b2dccbc03819e5c
- SHA256 c7ef00e4f266b88d65a93ee043d990ede09668a2c356896f5d488831dd62505e
- MD5 10888b2d07e0d0b4bf359ec02340b838
- SHA1 07f8a4e551188eee7b7c4c670f0a4bd8104ef471
- SHA512 f21027df801097b78599818084c0fc688aba09f50617ffc19ccbcb3566ac1125ca32ab26980c74d75a8e229b0071e1223de383c740ea0ef3b9d5b7141bf51f8b
- SSDEEP 1536:p9KTQGLwfvrhCqa7KcCiOIHzZtxwDl0L/pgupbATi7mV9FX2/FNmBv:pYTQG0fUKcMIvCDlsqCbQrVfG6Bv
- TLSH T1D3A37C52B3D6C03BE65651319A18B3EA73FAC718282AB5077B145E8DBBB04C1D3BD607
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
91279
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
lstrlenA
lstrcatA
lstrcpyA
GetModuleFileNameA
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
IsBadCodePtr
InterlockedIncrement
IsBadReadPtr
MultiByteToWideChar
IsBadWritePtr
msvcrt
wcstombs
wcscat
malloc
free
_initterm
_adjust_fdiv
time
srand
rand
wcslen
wcsncpy
wcscpy
_purecall
__CxxFrameHandler
_wcsicmp
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
ole32
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CreateStreamOnHGlobal
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=7, id=25, version=9210,
count=62, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=19, id=29, version=9178,
count=1, id=61, version=9210,
dmsynth.dll
- IMPHASH 7bc002e7c5147c1079569ca2d742d33d
- SHA256 eb164cc9722e4a04d11bd77b7b98c57a7b76fc5564abbf35c5ee693c1b7571fa
- MD5 9a71f870820f8a5193484854e470a80a
- SHA1 aa49f126b7379214b0eb6859e0cc2842f9ee2fa7
- SHA512 9312c890f0c4b3d9591f83a5b95bed62e95b30b7368be434302792cd4c3fa0417d41a40bb2908dae505b95a5b2972c1c25860c6538eb8275451b1b476139e8c3
- SSDEEP 1536:tAtsOAIBRqtvWRbr6QsndNgL1ciyZR7TpbFcE8VfC9roux2srOpaGOS7:tjIusJrNsnduL1KxOxwOpaGOS7
- TLSH T15AA37E52FEA641FAEC82E935940B73B397769F158525818393A0FF6C69302C1B97D322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
76374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcatA
lstrcpyA
DisableThreadLibraryCalls
IsBadCodePtr
SetEvent
WaitForSingleObject
SetThreadPriority
CreateThread
CreateEventA
CloseHandle
InterlockedIncrement
GetModuleFileNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
InterlockedDecrement
IsBadWritePtr
IsBadReadPtr
MulDiv
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
InitializeCriticalSection
msvcrt
_adjust_fdiv
_initterm
wcscpy
wcstombs
free
malloc
__CxxFrameHandler
_CIpow
_ftol
winmm
timeGetTime
advapi32
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ole32
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=9, id=25, version=9210,
count=59, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=28, version=9178,
count=17, id=29, version=9178,
count=1, id=61, version=9210,
dmusic.dll
- IMPHASH 0d0933e7a3778416c0a53f39a2e21c7e
- SHA256 8d33e7113b5c9743d6cc27c4f62d827647ddad59bc403fb4e6135488958e0a67
- MD5 bcc54d945bf09ea5fa07bce2c16aff7d
- SHA1 5829e8f316e54b95f4f7d1c02f8426d4ab8b9076
- SHA512 e5f02634830e205db04486de8e4ea73fa943d88363fc9366fd152a7dcb118befde73f6cca3ac591365c0c281e255f814d1a56b8af6f456e1e53f2da41a4f9184
- SSDEEP 3072:keUmWwKwipeXH3J02d6cGYqMTC9I5OWDAFavxthuVusU:Y7peppNiasU
- TLSH T1D5B3395033F65439F9E32A305DB6776BA6B6FB295E36822E06001B8D2CF4D42C539B53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
87999
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryA
GetVersionExA
DisableThreadLibraryCalls
IsBadCodePtr
FreeLibrary
lstrlenA
lstrcatA
lstrcpyA
GetModuleFileNameA
ResetEvent
SetEvent
PulseEvent
WaitForMultipleObjects
CreateThread
CreateEventA
MultiByteToWideChar
InterlockedExchange
CreateFileA
LocalFree
LocalAlloc
GetProcAddress
GetOverlappedResult
SetLastError
GetCurrentProcessId
DuplicateHandle
GetCurrentProcess
OpenProcess
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
CreateFileMappingA
GetLastError
MapViewOfFile
CreateMutexA
WaitForSingleObject
ReleaseMutex
CloseHandle
UnmapViewOfFile
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
DeviceIoControl
IsBadWritePtr
msvcrt
malloc
_stricmp
wcscmp
mbstowcs
_wcsicmp
wcstombs
wcscpy
_purecall
__CxxFrameHandler
free
_initterm
memmove
_except_handler3
wcscat
wcsncpy
_adjust_fdiv
winmm
timeSetEvent
midiOutUnprepareHeader
midiOutLongMsg
midiOutShortMsg
midiOutClose
midiOutOpen
midiOutPrepareHeader
midiInClose
midiInReset
midiInAddBuffer
midiInPrepareHeader
midiInUnprepareHeader
midiInStart
timeKillEvent
midiOutGetNumDevs
timeEndPeriod
midiOutGetDevCapsA
midiInGetNumDevs
midiInGetDevCapsA
waveOutMessage
timeBeginPeriod
midiInOpen
timeGetTime
user32
wsprintfA
wsprintfW
GetForegroundWindow
GetDesktopWindow
LoadStringA
IsWindow
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyW
RegCreateKeyA
RegEnumKeyA
RegCreateKeyExA
RegDeleteKeyA
rpcrt4
UuidCreate
ole32
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromString
msacm32
acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmStreamClose
acmStreamOpen
acmStreamSize
acmFormatSuggest
dsound
ord11
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=7, id=64, version=9210,
count=17, id=25, version=9210,
count=123, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=35, id=29, version=9178,
count=1, id=61, version=9210,
dmusic.inf
- SHA256 d93e8faf798cd31f44d2ceb42506e00d26b2834aad77fe0915e906aaf543cbf6
- MD5 6e5ed8816a6182d57502b63c91a833af
- SHA1 7bd69ac6bb9d08756f00e34f4638b9b4f2cfdd8c
- SHA512 77efc0c1607a438ed273bbc2bbb2d5d87810606949255cc0e75f4feb3a09f0f947a7d225f731b227f87fb306cec9e732b62a00251269947a6e31a505c15a861f
- SSDEEP 384:b7reL4Pzs+0QMswKMAoyGtP5tD1nCfeCbmhvOzvqz0s7gs3kp70P7eRO+O2q+rZe:2W3r1oHE7yo6SfjctgW2h/ey+UG4q
- TLSH T195136A19FECEE09AEFDBE18558D41A61675C06A310CFFF6812DDA7680D0B9F5E02A053
- MD5 SHA1 SHA512 SSDEEP TLSH
dplay.inf
- SHA256 89a14e722647aef89e8b5a36b8ac7e2b27f1398d35e4e401d411f823a5dfd1de
- MD5 798d1b276d1ed717bb32666141cab716
- SHA1 894a84a567bda05eb324f6d88e209677f72546ce
- SHA512 3433fd995e9e6268ad9c4b8fbdace4faaab8f0ecfa5d694955796eb276f937866faa68c1f6132874c598e96e970529f34c72396b7f3a765c920f934936d1d602
- SSDEEP 384:L09jzsEAqQCXXg8ouCR5zB7Bo0nRKBhBkRYTKB:vxQ4
- TLSH T12A62AB60BCDEB11131E275C07576A041687640F3580E82AC296643A7B39E6DEE3FE79F
- MD5 SHA1 SHA512 SSDEEP TLSH
dplaysvr.exe
- IMPHASH 0e2d56d5ee03e5e670b2f35982dccb42
- SHA256 e3ee1e2d903237131ba42c770f07e7eceaa3574b4ce718062a4e3c1f9cdbf893
- MD5 b3cf3924d51ff06ec7293383cc23ceca
- SHA1 bb405ee204bada9b7cc06ce35aa6a1ff8ae1795d
- SHA512 d4658ab7187c5450c6647d07cddaa313d6fb9108284b5bc6a45ad5185d867f311f1a2997edc98a4984f9ba3419003d1ec4cec5c92c3d666be7a6e8000f09256f
- SSDEEP 384:UcIqBALuftzYypZXBEOZqaEg440qmcG7qknkdigoJUr+7bIGiJhT8i6j9g3AlG2j:Sq2Lwn/Ia+qmc7oJ4MxiJhuWwl3OYpp
- TLSH T1C2C27C0170A8C83FE1534674C575AB06E7BA5E000BB5B7CF9B84A99BAB363D4E539343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14977
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapFree
DeleteCriticalSection
UnmapViewOfFile
GetCurrentProcessId
MapViewOfFile
SetEvent
InitializeCriticalSection
CreateMutexA
CreateFileMappingA
CreateEventA
GetLastError
GetCurrentProcess
SetCurrentDirectoryA
GetSystemDirectoryA
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
OpenProcess
WaitForSingleObject
ExitThread
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetVersionExA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
RtlUnwind
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCommandLineA
GetStartupInfoA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
GetACP
GetOEMCP
GetCPInfo
Sleep
VirtualAlloc
VirtualQuery
advapi32
RegEnumKeyExA
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
gdi32
GetStockObject
user32
DefWindowProcA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
winmm
timeGetTime
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=8, id=64, version=9210,
count=1, id=29, version=9178,
count=9, id=25, version=9210,
count=88, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=41, id=28, version=9178,
count=1, id=61, version=9210,
dplayx.dll
- IMPHASH cbe881ee03c779cb1aa48dc35de15730
- SHA256 7fe78e39c52357b722819eceed0b5e695b1b8435ef35a74015c5dad2ad78be12
- MD5 57845c9ae5f2dd884e50482bcf3d49b5
- SHA1 006e63f3eaac0637a71993e2ad390731c1539b54
- SHA512 0986dbf862b1a2f0cdc93fc19b9c1a3ff1fed05e40b8ff5238514c7997825e3d746d067b4f9ce748d33229014ada0303235fb6b0dda64950a363eedfe8ea575e
- SSDEEP 3072:SHFOz/apwq0p0vVw7/Wxf3VLt3QKEVYLiun/CH3i35IXATBO3iT3u7:kFODaSKplxxMc5XT/u
- TLSH T150244B02F7910C72C4572BB98D9933E66379CB0E4979D7160B39187B3A15CF29BB920E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
74728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ReleaseMutex
SetEvent
WaitForSingleObject
GetTickCount
CreateThread
ResetEvent
lstrlenA
Sleep
FreeLibrary
GetVersionExA
DuplicateHandle
GetCurrentProcess
LoadLibraryW
LoadLibraryA
GetProcAddress
CreateEventW
CreateMutexW
CreateFileMappingW
OpenFileMappingW
OpenFileMappingA
CreateProcessW
CreateProcessA
GetCurrentDirectoryW
CreateFileMappingA
CompareStringW
CompareStringA
GetProfileIntA
InterlockedIncrement
InterlockedExchange
DisableThreadLibraryCalls
LocalFree
DebugBreak
WaitForMultipleObjects
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
GetCPInfo
GetLocaleInfoA
GetLastError
MapViewOfFile
CreateEventA
CreateMutexA
GetCurrentProcessId
UnmapViewOfFile
IsBadCodePtr
IsBadReadPtr
GetModuleHandleA
GetModuleFileNameA
CreateFileA
CloseHandle
SetFilePointer
ReadFile
InterlockedDecrement
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetCurrentDirectoryA
LeaveCriticalSection
LCMapStringW
LCMapStringA
VirtualAlloc
VirtualFree
GetCommandLineW
GetCommandLineA
ExitThread
OpenProcess
ResumeThread
GlobalFree
GlobalAlloc
ReleaseSemaphore
CreateSemaphoreA
GetStringTypeW
ntdll
RtlUnwind
rpcrt4
UuidCreate
user32
wsprintfW
wsprintfA
advapi32
RegDeleteKeyA
RegDeleteKeyW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteValueA
RegDeleteValueW
RegEnumValueA
RegEnumValueW
RegSetValueExA
RegSetValueExW
RegEnumKeyExA
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegQueryInfoKeyW
winmm
timeSetEvent
timeKillEvent
timeGetDevCaps
timeGetTime
DirectPlayCreate
DirectPlayEnumerate
DirectPlayEnumerateA
DirectPlayEnumerateW
DirectPlayLobbyCreateA
DirectPlayLobbyCreateW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
gdwDPlaySPRefCount
Name
.text
Size
197KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=8, id=64, version=9210,
count=1, id=29, version=9178,
count=11, id=25, version=9210,
count=120, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=91, id=28, version=9178,
count=1, id=61, version=9210,
dpmodemx.dll
- IMPHASH 11047f92afa1f1e11ff8e095545a3dd4
- SHA256 200753c96fd4ceac9b9bbed12a4b74d5c25df522cb32820dfc58d3d193be8eec
- MD5 a9f01adb35efb4457887e1f19f64ce5d
- SHA1 c69d6c0e8d92b88da51eb814ce4987fbfee6d0ca
- SHA512 5c05be6f1cbd606bfaa1189d988a82f14caea64fe0fc844f5a4d341284e2b12c358185e220d50b6063e68ac00e2d6c8b1f0f8186b7e660d28d31cb99b729c061
- SSDEEP 1536:Lxu8UVLNY6CgV1Ct4pGRVWRs32d3xakCgdMRxGy3SrcW5u:lpUVhY69i4pG72lwkCgdMRUy3SrcW5u
- TLSH T1F173F12163F84615F0F39F7498F643A7663ABC51EA36C31F9A40674E2831A94DA31B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4788
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
PurgeComm
EscapeCommFunction
WaitForSingleObject
SetCommMask
SetEvent
CloseHandle
GetOverlappedResult
GetLastError
ReadFile
ClearCommError
WriteFile
GetCommState
ExitThread
WaitForMultipleObjects
WaitCommEvent
CreateEventA
ResumeThread
SetThreadPriority
CreateThread
InitializeCriticalSection
SetupComm
SetCommState
CreateFileA
lstrlenA
Sleep
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetCommTimeouts
DeleteCriticalSection
user32
DispatchMessageA
KillTimer
PeekMessageA
SetDlgItemTextA
GetParent
wsprintfA
SetTimer
GetWindowRect
GetDesktopWindow
SetWindowPos
GetDlgItemTextA
EnableWindow
GetForegroundWindow
DialogBoxParamA
GetWindowLongA
EndDialog
SetWindowLongA
GetDlgItem
SetFocus
TranslateMessage
SendDlgItemMessageA
LoadStringA
tapi32
lineInitialize
lineShutdown
lineDeallocateCall
lineOpen
lineNegotiateAPIVersion
lineGetID
lineGetCallInfo
lineGetDevCaps
lineAnswer
lineDrop
lineMakeCall
lineClose
lineConfigDialog
dplayx
gdwDPlaySPRefCount
SPInit
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=25, version=9210,
count=85, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=12, id=28, version=9178,
count=1, id=61, version=9210,
dpnaddr.dll
- SHA256 d8e745adde0a4f38d915a0b130dc4eb7920d9b96f99bebb992184519c29fa050
- MD5 62e741785abde1524a86b480ae922e96
- SHA1 ce02b6613fa54edccbe3ba4b0b663e4a17de16b3
- SHA512 df8c59cd75ac08a59c64264b36199350d540b93b446a54f9fc270cbd2a44397c8a4c4ebdfb7aa281efe0b2339aa28dbdebbd6ccb6a168d38f4d44fcdc26bdce3
- TLSH T10351AF01A3F80A19F4B70B795DF74627A079BC209F76D25D0E50126E2C71668C972F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4241
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DirectPlay8AddressCreate
Name
.text
Size
512B
Virtual Size
271B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
dpnet.dll
- IMPHASH 7cd8abafddca244dc1e8376ad8a2fc46
- SHA256 b3f41e537797abc414fda5136a864865c37e7324b55a9a5705c6761ff9a8e816
- MD5 6ea6032ab20a77e80ad479bf4cd433d4
- SHA1 2d1ff2a1895f74ef49fd237746375bd36be9ee3c
- SHA512 72c5c00c7a5248b5eec8f1c10eedb9ba493323951f504055dde94334002af2a3adb7c5b62adee8ba68253c7d7e63f3c19bc21662d5d16ffa8501d76e6a912e08
- SSDEEP 12288:QNVbQYsTvBX8dZYLlRlckmZReZMMw6Kbp:QN1QvjgGJRlYcxw6
- TLSH T149F4825167F84229F2F37B306AB813656E7BBD919D38C54E028124AD1DB0E41EEB4B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
126137
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
CreateEventW
CloseHandle
IsBadReadPtr
IsBadWritePtr
Sleep
GetCurrentThreadId
ResetEvent
InterlockedDecrement
SetEvent
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
IsBadStringPtrA
IsBadStringPtrW
GetLastError
GetModuleHandleW
GetVersionExW
FreeLibrary
LoadLibraryW
lstrcpyW
lstrlenW
LocalFree
TlsFree
CreateSemaphoreW
TlsAlloc
GetSystemInfo
TlsSetValue
WaitForSingleObject
TlsGetValue
LeaveCriticalSection
ReleaseSemaphore
InterlockedExchange
SignalObjectAndWait
SetThreadPriority
SetThreadAffinityMask
SetThreadIdealProcessor
GetCurrentThread
CreateThread
CancelIo
SetWaitableTimer
CreateWaitableTimerW
InterlockedExchangeAdd
InterlockedCompareExchange
GetModuleFileNameW
LoadLibraryA
GetSystemDirectoryA
SetLastError
OpenEventW
CreateProcessW
GetSystemDirectoryW
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateMutexW
GetCommandLineW
OpenProcess
GetExitCodeProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
CreateFileW
WaitForSingleObjectEx
CreateIoCompletionPort
SleepEx
PostQueuedCompletionStatus
GetQueuedCompletionStatus
WaitForMultipleObjectsEx
SetCommMask
PurgeComm
SetCommTimeouts
SetCommState
ReadFile
FlushFileBuffers
WriteFile
lstrcpynW
FormatMessageW
GetStdHandle
DuplicateHandle
CreatePipe
EnterCriticalSection
DeleteCriticalSection
HeapFree
GetProcessHeap
WaitForMultipleObjects
HeapAlloc
winmm
timeGetTime
timeBeginPeriod
timeEndPeriod
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoCreateGuid
StringFromGUID2
CLSIDFromString
msvcrt
calloc
malloc
_adjust_fdiv
_initterm
free
wcscpy
wcslen
_stricmp
wcsrchr
_wcsnicmp
wcsstr
wcsncpy
memmove
strncpy
swprintf
srand
_ftol
wcscat
_wcsicmp
wcscmp
wcstoul
wcsncmp
_wsplitpath
strtoul
strchr
sprintf
strtol
_except_handler3
ws2_32
WSASetLastError
WSAIoctl
WSARecvFrom
WSAGetOverlappedResult
shutdown
WSASendTo
setsockopt
gethostname
bind
getsockname
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
WSAGetLastError
socket
inet_addr
gethostbyname
htons
ntohs
WSAStartup
WSACleanup
getsockopt
closesocket
user32
wsprintfA
wsprintfW
CharNextW
PostMessageW
DialogBoxParamW
GetWindowLongW
EndDialog
SetWindowLongW
GetWindowTextW
GetDlgItem
SendMessageW
SetWindowTextW
LoadStringW
advapi32
CryptReleaseContext
FreeSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
AllocateAndInitializeSid
InitializeSecurityDescriptor
CryptAcquireContextW
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
CryptGenRandom
DirectPlay8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
318KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
359KB
Virtual Size
359KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=3, id=64, version=9210,
count=13, id=25, version=9210,
count=196, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=158, id=29, version=9178,
count=1, id=61, version=9210,
dpnhpast.dll
- IMPHASH 103a3a8f5867b82d4d9d14ed0aa51885
- SHA256 ab9743ce54837735f0e1cb8840ac58d578093078bc80e0dd91219dc37e5a703d
- MD5 d98628937fd50cda89c64973cef9dd84
- SHA1 2d8c793bb60d35279b86b00f168208fcd88273e4
- SHA512 9850806bdcab64e9029030d24b05cd2305cc80e7a0006e454f165023239a33a7a1a3b6c048ef4835682e2f8e72f4a59718bcefa6881e07fabb964ad6e469fe35
- SSDEEP 768:WdmwgVn9+i+b1fA7Sr+aGez4d6R71TzlZwVsd:Wd7gVn7U+aGY2Q6+d
- TLSH T10DE25B00FAE0C075D46353B05E7C7316EAFBAA6619548D7B23012E9A2934793F3BD74A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
27497
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
Sleep
GetVersionExW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetProcessHeap
HeapFree
FreeLibrary
SetEvent
PostQueuedCompletionStatus
InterlockedDecrement
GetProcAddress
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
InterlockedIncrement
IsBadReadPtr
GetCurrentThreadId
lstrcpyW
lstrlenW
GetLastError
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
CreateIoCompletionPort
GetCurrentProcess
DuplicateHandle
CloseHandle
IsBadWritePtr
HeapAlloc
winmm
timeGetTime
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
msvcrt
_adjust_fdiv
_initterm
free
malloc
srand
swprintf
_except_handler3
ole32
StringFromGUID2
DirectPlayNATHelpCreate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=1, id=64, version=9210,
count=9, id=25, version=9210,
count=71, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=8, id=29, version=9178,
count=1, id=61, version=9210,
dpnhupnp.dll
- IMPHASH e1a61076ca8761b8ba640bb74494bcde
- SHA256 59e74dd3de40e22aac95133cf746be32cb0de40e4fc801cf63be13d9e2ca8134
- MD5 a337328c4d6994e9cca40e0969b0b1f9
- SHA1 8ad62a0bb8249be9fdaf21b648903656c8e43cfe
- SHA512 a98768549ef58a635e9432be1cac8a8c1561a58bc1abb5e518b2259e58f67387dbbc04057358ac959f9572524802649bca3a893f2bec5a2b51a7877794ed2a6e
- SSDEEP 1536:58A+Jttfu2gnxicG1Bu7f7ZpgpYU8d1ej1amOmeDSYfwf:5uZcwBgDLO8d1+kmeDSYIf
- TLSH T1B1637C7BF6F5847AD87212B0585C3352F6B6BE251A248C8763404F861235A87F3BDB27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
60048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
PostQueuedCompletionStatus
SetEvent
CreateEventW
FreeLibrary
GetVersionExW
QueryPerformanceCounter
InterlockedDecrement
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
Sleep
CreateIoCompletionPort
GetCurrentProcess
DuplicateHandle
IsBadWritePtr
GetLastError
OpenEventW
GetModuleFileNameW
ReleaseSemaphore
GetCurrentThreadId
WaitForSingleObject
CloseHandle
CreateSemaphoreW
IsBadReadPtr
InterlockedIncrement
HeapAlloc
DisableThreadLibraryCalls
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
GetProcAddress
HeapFree
GetProcessHeap
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
IsBadStringPtrW
InitializeCriticalSectionAndSpinCount
LocalFree
lstrlenW
lstrcpyW
user32
wsprintfW
winmm
timeGetTime
advapi32
InitializeAcl
RegEnumValueW
RegSetValueExW
RegQueryValueExW
AllocateAndInitializeSid
GetLengthSid
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
ole32
CoCreateInstance
CoTaskMemFree
CoUninitialize
StringFromGUID2
CoInitializeEx
CoSetProxyBlanket
msvcrt
malloc
strtok
strstr
_adjust_fdiv
_wcsicmp
_stricmp
_strnicmp
atoi
_wsplitpath
wcslen
srand
swprintf
_initterm
free
strchr
wcscpy
_except_handler3
DirectPlayNATHelpCreate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=1, id=64, version=9210,
count=11, id=25, version=9210,
count=99, id=1, productName=Unmarked objects,
count=12, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
dpnlobby.dll
- SHA256 d0553ca14ed69afba892e30fe4069c180b07361106eb118a0536c82209469812
- MD5 1fd0aecab0ee7510b52081789919c9d9
- SHA1 d7a90213c830fed3b55b7254ba0e2a594c1bc7a5
- SHA512 43f868b77ee35407ed92ee6775954cce40a835e699624b1300eea4491d0c63ffb92a50d80f6d1b4c338b5faf2c12492be6a13b8016c858f5302b06436a50c1e9
- TLSH T14751AC01A3F81629F4F70B795CF70767A07ABC209B76D25D0A50239E2C705A48971F73
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DirectPlay8LobbyCreate
Name
.text
Size
512B
Virtual Size
270B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
dpnsvr.exe
- IMPHASH 14afd694d39937cccde81195f7378eb3
- SHA256 1ff263d2c1a97d422f94dd3d0872b1fa49de99b825ba64a5bf06f483a1849ac7
- MD5 162a9cbd15be74c26912d57b198bc9d9
- SHA1 b278c878fd6db3c3563632ed7d54c785c0679543
- SHA512 a12de324b79062dec11cb360dbf5c93a82079fe213597a4e5c5482addf72c055c311a18ecc0514f44b4183d00a2a96aafd139c77215c87aa9534fab8a71a5afe
- SSDEEP 384:PMgJp6Ur+pg1tmHLbJKX4RO1tvZScsSTXaOXDskkRD6GmfjkeWrvQW:0g1Kdi4ROjvZSUDskNGeS
- TLSH T149725A92B2FA483FE06287704FB5679BB5B4E7405871532F5B444D8F2A2E981A631F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11491
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateFileMappingW
InterlockedDecrement
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetProcessHeap
HeapFree
CompareStringW
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
CreateEventW
CreateMutexW
DeleteCriticalSection
SetEvent
GetTickCount
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
OpenProcess
GetLastError
CloseHandle
InterlockedIncrement
lstrlenW
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetVersionExW
FreeLibrary
LoadLibraryW
lstrcpyW
OpenEventW
ReleaseSemaphore
CreateSemaphoreW
ole32
CoUninitialize
CoInitializeEx
CoCreateGuid
StringFromGUID2
CoCreateInstance
msvcrt
_except_handler3
_controlfp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
wcslen
__set_app_type
srand
wcscpy
advapi32
RegCreateKeyExW
FreeSid
SetSecurityDescriptorDacl
CryptReleaseContext
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
CryptAcquireContextW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AddAccessAllowedAce
user32
wsprintfW
winmm
timeGetTime
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=64, version=9210,
count=2, id=25, version=9412,
count=11, id=25, version=9210,
count=97, id=1, productName=Unmarked objects,
count=13, id=28, version=9178,
count=1, id=69, version=9111,
count=18, id=29, version=9178,
count=1, id=61, version=9210,
dpvacm.dll
- IMPHASH b17f510eadb77dc154e2cac23cbb4c04
- SHA256 4b21c76105096f0a02678b00b0ccff11276bbf0d39d63dd063c5df43b9238c25
- MD5 b76ff66231e355f7b1f607657a6fa188
- SHA1 777163fb5b5a0d40f0903f9628af6f36f78b0916
- SHA512 209126a5e5b55bd6269ce1aac2f000a007af3ce6edccd1e26d1acbd4f5fb9f4bf1c7e283d4cfa7e78e8414532ad962aceafd81dace51d75ee38cfd6000f32c36
- SSDEEP 384:vzCjI2yob0h4vXLBHwwAviSwSeeJgpmY+nS180r9qdfqpEohviWkU0Wvgc:vzCj/yob04VillgplZ+K9F6ol5pg
- TLSH T106921A02F7E20176F57296B019B53676D9FAF6A06970CD5DA3105C8A1874B03E2FEB13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16363
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TerminateProcess
GetCurrentProcess
lstrlenW
lstrcpyW
GetVersionExW
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
LoadLibraryW
FreeLibrary
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetLastError
IsBadWritePtr
EnterCriticalSection
HeapAlloc
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
HeapFree
GetProcessHeap
GetModuleHandleW
Sleep
user32
LoadStringW
winmm
timeGetTime
msacm32
acmDriverDetailsW
acmStreamClose
acmDriverID
acmStreamOpen
acmStreamUnprepareHeader
acmStreamConvert
acmStreamPrepareHeader
advapi32
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
ole32
CoCreateInstance
StringFromGUID2
msvcrt
free
_initterm
_adjust_fdiv
__dllonexit
swprintf
malloc
wcslen
wcscpy
_purecall
srand
_except_handler3
_onexit
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=2, id=25, version=9412,
count=13, id=25, version=9210,
count=81, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=29, version=9178,
count=1, id=61, version=9210,
dpvoice.dll
- IMPHASH 9c767fdfde0fefa8d0dedc5ac9f6dbea
- SHA256 9b1c0f547598bd1c48c54a687801f4dbbb28634c7c133b21f0ef7631bb9712e6
- MD5 6a3a72b878cd71364532534412abe15b
- SHA1 f302dfe2e60a3363ced98192e2362166f5a87c86
- SHA512 843fc0178448c468e1ae3f24b2266a93577a99fa8e402d3a9b4be4e37503d55eb1f9fe8453f8a4ad464da492c09109a20f566eba2a41aa1ed56654e054f23b39
- SSDEEP 3072:5MEVPFPElEmD02kLc0M/DBMLdO1+Y78/iYhZdg3GY/LanUic+CqDEN57Eg88UakC:mEdk/DBMaLgZkz/fYCS4d
- TLSH T14F849F21E7FA8221F8F36B7C6DB817926D367D528E34C50E6604228E1DF4A52DA35733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
73097
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
InterlockedCompareExchange
GetCurrentProcess
GetSystemInfo
CreateSemaphoreW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcessId
ProcessIdToSessionId
InterlockedExchange
ResetEvent
IsBadWritePtr
IsBadReadPtr
Sleep
TerminateProcess
GetProfileIntA
GetModuleFileNameW
lstrcpynW
GetWindowsDirectoryW
CreateEventW
CreateThread
SetThreadPriority
DeleteCriticalSection
GetTickCount
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CloseHandle
SetEvent
WaitForSingleObject
HeapFree
GetProcessHeap
WideCharToMultiByte
HeapAlloc
SetLastError
ReleaseMutex
CreateFileMappingW
MapViewOfFile
InitializeCriticalSectionAndSpinCount
GetLastError
GetModuleHandleW
GetVersionExW
lstrcpyW
lstrlenW
CreateProcessW
GetExitCodeProcess
GetSystemDirectoryW
GetExitCodeThread
TerminateThread
CreateMutexW
LoadLibraryA
UnmapViewOfFile
msvcrt
swprintf
malloc
srand
_wcsnicmp
wcscpy
wcsncat
wcslen
wcsncpy
__CxxFrameHandler
_onexit
__dllonexit
_except_handler3
?terminate@@YAXXZ
_adjust_fdiv
_initterm
free
_beginthreadex
_endthreadex
sprintf
_purecall
wcscat
_CIpow
fclose
fflush
_vsnprintf
fputs
vfprintf
fopen
_ftol
user32
LoadStringW
MessageBoxW
IsWindow
LoadCursorW
GetSysColorBrush
RegisterClassW
InvalidateRgn
DefWindowProcW
GetClientRect
BeginPaint
EndPaint
UnregisterClassW
GetWindowLongW
EnableWindow
DialogBoxParamW
GetParent
GetDlgItem
EndDialog
LoadIconW
SetWindowPos
GetClassNameW
GetWindowThreadProcessId
SetForegroundWindow
GetSystemMetrics
GetWindowRect
EnumWindows
SendMessageW
ReleaseDC
GetDC
SystemParametersInfoW
SetWindowLongW
PostMessageW
SendDlgItemMessageW
winmm
mixerSetControlDetails
waveInGetDevCapsW
waveInGetDevCapsA
waveOutGetDevCapsA
PlaySoundW
waveOutGetDevCapsW
waveOutSetVolume
waveOutGetVolume
mixerGetID
mixerGetLineControlsW
mixerGetLineInfoW
mixerGetControlDetailsW
timeGetTime
advapi32
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegFlushKey
RegCreateKeyExW
ole32
CoInitializeEx
CLSIDFromString
StringFromGUID2
CoCreateInstance
CoUninitialize
gdi32
CreatePen
CreateFontIndirectW
GetDeviceCaps
CreateSolidBrush
GetStockObject
Rectangle
LineTo
MoveToEx
SelectObject
DeleteObject
DirectPlayVoiceCreate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
233KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=3, id=64, version=9210,
count=13, id=25, version=9210,
count=190, id=1, productName=Unmarked objects,
count=11, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=59, id=29, version=9178,
count=1, id=61, version=9210,
dpvoice.inf
- SHA256 6842ec89b0453e1ace1b62cac39a550abb8cc014136db7926388e19fd9921f15
- MD5 25887d6e6f3931813cab4ce5a9979b5d
- SHA1 048bc6aa7d3a297c1d91f66fa9d0420b035b1f65
- SHA512 d5212ad9a22f36bf07c2de4514e87df421232195a0f4fe64a14fdd2d66b42132f6a3d34f9593826e0cb9e09ca4c1c1574f45fd919501d03c0fce42871086552a
- TLSH T192B09294A98765242125A9388EA30299B6AA482192A8A14CBA9121288366608E15DBAF
- MD5 SHA1 SHA512 TLSH
dpvsetup.exe
- IMPHASH 1405b97b615751afaa909eba25b4804d
- SHA256 e874d60d3514f29fafc59bef7e7954b686c7d850366565f514109ded24bb16b7
- MD5 a27d713b51923e72e58fae4d5ca073d7
- SHA1 dbdd1b4ae44679c8476679cb5d13799921a0c72a
- SHA512 a308f6d859258aafb7caf0de865d32af14ec69cba73083d7a9066b4cb21ea0720ce96470cdc1ed4b89a582f7ebc69ed432925c98d3e0aeb346674cb13e217ff7
- SSDEEP 1536:EV84GGpVl9qUKw5wfQtB+5GQOTdEhALYywBu3PG:15Gpxtwg+5pOTmT2PG
- TLSH T11C833A01379481BFC04102704A25CB79D6B9AD100F259BDF7BA4BF8B793A6D3B939B12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15468
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcess
TerminateProcess
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetCommandLineW
GetStartupInfoA
lstrcpyW
GetLastError
LoadLibraryW
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetVersionExW
Sleep
CreateProcessW
CloseHandle
GetExitCodeProcess
GetSystemDirectoryW
GetExitCodeThread
TerminateThread
WaitForSingleObject
SetEvent
CreateMutexW
WaitForMultipleObjects
CreateThread
CreateEventW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
ReleaseMutex
OpenFileMappingW
OpenEventW
SetLastError
FreeLibrary
LoadLibraryA
HeapFree
GetProcessHeap
HeapAlloc
DeleteCriticalSection
msvcrt
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
__p__fmode
__p__commode
wcsncpy
_XcptFilter
_adjust_fdiv
_c_exit
wcstok
_wcsicmp
swprintf
srand
_wcsnicmp
wcslen
fopen
vfprintf
fputs
_vsnprintf
fflush
fclose
__setusermatherr
_initterm
__getmainargs
_acmdln
_cexit
_exit
exit
wcsncat
user32
GetWindowRect
LoadStringW
LoadCursorW
GetSysColorBrush
RegisterClassW
InvalidateRgn
DefWindowProcW
GetClientRect
BeginPaint
EndPaint
UnregisterClassW
GetDesktopWindow
GetWindowLongW
EnableWindow
DialogBoxParamW
IsWindow
GetParent
GetDlgItem
EndDialog
LoadIconW
MessageBoxW
SendDlgItemMessageW
PostMessageW
SetWindowLongW
SystemParametersInfoW
GetDC
ReleaseDC
SendMessageW
EnumWindows
GetSystemMetrics
SetForegroundWindow
GetWindowThreadProcessId
GetClassNameW
SetWindowPos
winmm
waveInGetDevCapsA
PlaySoundW
waveOutGetDevCapsW
waveOutSetVolume
waveOutGetVolume
mixerGetID
waveOutGetDevCapsA
waveInGetDevCapsW
timeGetTime
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
StringFromGUID2
advapi32
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegFlushKey
gdi32
LineTo
Rectangle
GetStockObject
CreateSolidBrush
MoveToEx
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreatePen
SelectObject
dsound
ord1
comctl32
PropertySheetW
ord17
CreatePropertySheetPageW
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=64, version=9210,
count=17, id=25, version=9210,
count=162, id=1, productName=Unmarked objects,
count=15, id=28, version=9178,
count=1, id=69, version=9111,
count=21, id=29, version=9178,
count=1, id=61, version=9210,
dpvvox.dll
- IMPHASH 28936a80008711944b369d04d634270c
- SHA256 c1af86c20a8b82dc98b3f0cd42fca58580429faf0dc071b1cb41789f056e299e
- MD5 092eb4d0e687dd46420a51fc28b55c4d
- SHA1 33d9b6b4ba169af1e1f0058fe0f880658469037f
- SHA512 0da5f0eeb5a139c29214ab7f319459eedbf81f7da20933b75cd03d4e4534604a6e0bbb970e7d8bb80e14a0095246ddc03351d5c648fc121fb48cecae5733ff9c
- SSDEEP 3072:Qc959N7EHm52iiqNlPKqsojo0UOsmq25E:15/v25qNkqdozZX
- TLSH T163B3B0427CD100BAE7974738BD7631A4A3F8DA322D34AA4DDF4814872DA4946F2EDB47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
107201
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
lstrlenW
GetModuleHandleA
GetVersionExW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetLastError
IsBadWritePtr
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
HeapAlloc
HeapFree
GetProcessHeap
lstrcpyW
FreeLibrary
Sleep
user32
LoadStringW
winmm
timeGetTime
msacm32
acmStreamUnprepareHeader
acmStreamConvert
acmStreamPrepareHeader
acmStreamClose
acmStreamOpen
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
ole32
StringFromGUID2
CoCreateInstance
msvcrt
floor
_ftol
free
calloc
ceil
_except_handler3
swprintf
_CIpow
_CIacos
wcslen
_CIasin
_initterm
_adjust_fdiv
__dllonexit
_onexit
wcscpy
srand
_purecall
_CIexp
malloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=127, id=28, version=9037,
count=2, id=25, version=9412,
count=13, id=25, version=9210,
count=84, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
dpwsockx.dll
- IMPHASH 138099c151cf1ecb23702e002fa85c73
- SHA256 b2f5a36a8390299f666dbfc44495d2f718cb4d73bffcd82a05cae92b106ad428
- MD5 6590d3eef5964967c6e05a55517569aa
- SHA1 86e39223bf5f908cd8b77898d6f6776abc723dd3
- SHA512 cb80e43e5f60abef376c1fe6e5bda4569b988fa87030a62c2cd1e9e83a22ab54176010e28199b9818a4730df9ef1994b2a7a63314480d192d6480a79e03fc314
- SSDEEP 1536:tVknY6EduwEHbKA4xD+sObzMduapMBNDODsOoDkZ/VaFDRkRb8TFZ6v0q:Vd9A4pObbyDsOQQ/VaFDRob8TFZ6v0
- TLSH T14D73E52177F50136F8B35B70ACF61767A97AFD609A36C25E4690268E2834D40EB31B27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
38198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InterlockedExchange
Sleep
ResetEvent
SetEvent
SetThreadPriority
CreateThread
WaitForSingleObject
GetVersionExA
DisableThreadLibraryCalls
HeapAlloc
GetProcessHeap
ReleaseMutex
UnmapViewOfFile
OpenMutexA
MapViewOfFile
CreateFileMappingA
HeapFree
CreateProcessA
GetSystemDirectoryA
OpenEventA
GetCurrentProcessId
HeapReAlloc
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
GetCurrentProcess
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
VirtualAlloc
GetCPInfo
GetOEMCP
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualFree
VirtualQuery
HeapCreate
HeapDestroy
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
GetCommandLineA
FreeLibrary
GetProcAddress
ExitThread
WaitForMultipleObjectsEx
InterlockedDecrement
GetLastError
InterlockedIncrement
InitializeCriticalSection
CreateEventA
CloseHandle
DeleteCriticalSection
EnterCriticalSection
TerminateProcess
LeaveCriticalSection
ntdll
RtlUnwind
user32
SetWindowLongA
GetForegroundWindow
SendMessageA
SetFocus
GetDlgItem
GetWindowLongA
GetDlgItemTextA
EndDialog
DialogBoxParamA
wsock32
select
__WSAFDIsSet
getpeername
recvfrom
gethostname
gethostbyname
send
sendto
listen
recv
getsockname
connect
setsockopt
inet_ntoa
WSAGetLastError
closesocket
inet_addr
getsockopt
WSACleanup
WSAStartup
socket
ntohs
bind
ioctlsocket
htons
accept
winmm
timeGetTime
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
SetSecurityDescriptorDacl
FreeSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegQueryValueExA
dplayx
gdwDPlaySPRefCount
DPWS_BuildIPMessageHeader
DPWS_GetEnumPort
SPInit
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=8, id=64, version=9210,
count=1, id=29, version=9178,
count=13, id=25, version=9210,
count=123, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=46, id=28, version=9178,
count=1, id=61, version=9210,
dsdmo.dll
- IMPHASH 320f45a32628b35d761b69e505a2c544
- SHA256 ff9b3b5a9acc7bbc6d15a668b8ea897e8ff9a94b598cd3bbc35a715249a5411d
- MD5 f8bc193b4c119d43181337219be0f37a
- SHA1 1be0269567171781807f378e8909a42e0100e4f7
- SHA512 765f346543b1cf033cb186b4b87eeed10ee348d5ee10f568f7cb9dbcb1a32984722969b866361ec2dbbb57c92ed3785f6b3af7af1b1b1a40edf8341e84ff4d88
- SSDEEP 3072:COFyqAITGF1KTvloaTcACXV4B3JQtuVQtEWkxqhxcj19cJIYxIMOUMSx76klU311:3yqAITGF1KTcnWj19cJIlMOUMSijxAeT
- TLSH T107042A02674B5CE2DE5A38F055BCBBFAD2348B41622558036EB0DF757267079B8AD3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
111010
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersionExA
DisableThreadLibraryCalls
CloseHandle
WaitForSingleObject
GetLastError
DeviceIoControl
CreateEventA
IsBadWritePtr
IsBadReadPtr
InterlockedDecrement
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
InterlockedIncrement
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameA
Sleep
QueryPerformanceCounter
lstrlenA
msvcrt
_initterm
_adjust_fdiv
malloc
free
wcslen
_vsnwprintf
_vsnprintf
_CIsinh
ceil
modf
__CxxFrameHandler
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
wcstombs
_CIpow
floor
_ftol
advapi32
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
ole32
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
msdmo
DMORegister
DMOUnregister
MoInitMediaType
MoFreeMediaType
MoCopyMediaType
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=9, id=25, version=9210,
count=66, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=13, id=28, version=9178,
count=25, id=29, version=9178,
count=1, id=61, version=9210,
dsdmoprp.dll
- IMPHASH 44c532b5aea3995196546902607fa520
- SHA256 1e044bf590eb0559a105d4452eac4c43c79380ddd5c67246c770286c3ad4597d
- MD5 16d9890f66435b052e75a90fe46466aa
- SHA1 96a26c5223f497a58af6a4c0897788a1cbc166fd
- SHA512 62ce664f8823f6fb91e47d8b8a6daf00b5753d7807311e98c1de99575667697e0b78e36d38a9567ce0aba4c8d68b6460f4806d72b01697cd459fe10975d0b193
- SSDEEP 3072:ZdVLmLDLOOhkjyGMHCfq14jQx1Y2outhpXfDOBoDTREIL:SDLOOSEx
- TLSH T159A40C653BD8C09AF1A746722DF05FC3AC66BC41AE18CE4FEE55730EA839900EF51619
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
36444
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcatA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceA
GetLastError
LoadLibraryExA
GetShortPathNameA
lstrcpyA
MulDiv
GetCurrentThreadId
HeapAlloc
FlushInstructionCache
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
lstrcpynA
IsDBCSLeadByte
lstrcmpiA
lstrlenA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetProcessHeap
HeapFree
lstrlenW
WideCharToMultiByte
LockResource
MultiByteToWideChar
msvcrt
_initterm
malloc
free
??3@YAXPAX@Z
realloc
??2@YAPAXI@Z
atoi
atof
_ftol
_vsnprintf
_purecall
_adjust_fdiv
gdi32
GetDeviceCaps
CreateFontIndirectA
SelectObject
GetTextMetricsA
GetTextExtentPointA
DeleteObject
oleaut32
SysFreeString
SysStringLen
SysAllocStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
VarUI4FromStr
user32
CheckDlgButton
IsDlgButtonChecked
GetDlgItem
GetDC
SendMessageA
CharNextA
ShowWindow
MoveWindow
IsDialogMessageA
SetWindowLongA
DestroyWindow
IsWindow
LoadStringA
GetDialogBaseUnits
ReleaseDC
CreateDialogParamA
WinHelpA
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
advapi32
RegCloseKey
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
439KB
Virtual Size
439KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=2, id=37, version=8755,
count=2, id=64, version=9210,
count=11, id=25, version=9210,
count=100, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
dsound.dll
- IMPHASH d70f4f0e3129cf35ca0973bba72c4159
- SHA256 1c46928acb028b7c37570d8f46b283aab8f2c9239527415aaa48114123862593
- MD5 ca6cc3a47d8813208cee02eb40daca21
- SHA1 8c4ae6cd3b02de91920a2a9286d45fe7f08add71
- SHA512 cb31ed31c5df059522a66c7b0f668bbc612b43271ec6f033443e70d6a47b2e7cfba32f045ced496a1545b2ca72949c0c67e55825088baeb317ad3135e0800988
- SSDEEP 6144:hv+MRZLLz+SAmU/OlmPdHLFpqmSa7sZFJt4IGpruCGL:lrdAm1UBfSa7Ufz
- TLSH T1E5746CD0BAE3C0F5F7E337B189257E5972EE6BA599F5C90802C85CC92936550F239322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
311591
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FreeLibrary
GetProcAddress
LoadLibraryW
GetLastError
lstrlenA
lstrcpynA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
lstrcpynW
GetVersionExW
SetThreadPriority
SetPriorityClass
GetThreadPriority
GetPriorityClass
GetCurrentThread
lstrcatW
lstrcpyW
lstrcmpW
CreateMutexW
ReleaseMutex
DisableThreadLibraryCalls
GetCurrentThreadId
GetCurrentProcessId
SetEvent
lstrcpyA
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
EnterCriticalSection
InterlockedIncrement
InterlockedDecrement
OpenEventW
CreateThread
CreateEventW
GetExitCodeThread
OpenProcess
GetSystemDirectoryW
GetOverlappedResult
DeviceIoControl
ResetEvent
GetTickCount
WaitForMultipleObjects
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetWindowsDirectoryW
SetLastError
GetPrivateProfileStringW
MulDiv
VerifyVersionInfoW
VerSetConditionMask
WaitForSingleObject
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
DuplicateHandle
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
CreateFileW
ReadFile
SetFilePointer
GetFileSize
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
GetFullPathNameW
LeaveCriticalSection
CloseHandle
msvcrt
_isnan
_ftol
_initterm
_adjust_fdiv
__dllonexit
_onexit
malloc
_CIpow
free
_wcsicmp
wcsrchr
__CxxFrameHandler
ntdll
NtQueryInformationProcess
user32
CharUpperW
wsprintfW
GetParent
GetForegroundWindow
GetWindowPlacement
IsWindow
GetWindowThreadProcessId
LoadStringW
CharLowerBuffW
EnumWindows
advapi32
RegSetValueExA
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegOpenKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyA
RegOpenKeyExA
RegCreateKeyW
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
CloseServiceHandle
rpcrt4
UuidFromStringW
ole32
CoCreateInstance
winmm
waveInReset
timeBeginPeriod
timeEndPeriod
mixerSetControlDetails
mixerOpen
mixerGetLineInfoW
mixerGetLineControlsW
mixerGetControlDetailsW
mixerClose
waveOutGetPosition
waveOutPrepareHeader
waveOutWrite
waveOutGetDevCapsW
waveInGetDevCapsW
waveOutGetVolume
waveOutSetVolume
waveOutMessage
waveInMessage
waveOutGetNumDevs
waveInGetNumDevs
waveOutOpen
waveOutClose
waveInOpen
waveInClose
timeGetTime
waveInUnprepareHeader
waveInStop
waveOutPause
waveInGetPosition
waveInAddBuffer
waveInPrepareHeader
waveInStart
waveOutUnprepareHeader
waveOutReset
waveOutRestart
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
DirectSoundCaptureCreate
DirectSoundCaptureCreate8
DirectSoundCaptureEnumerateA
DirectSoundCaptureEnumerateW
DirectSoundCreate
DirectSoundCreate8
DirectSoundEnumerateA
DirectSoundEnumerateW
DirectSoundFullDuplexCreate
DllCanUnloadNow
DllGetClassObject
GetDeviceID
Name
.text
Size
306KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=17, id=25, version=9210,
count=158, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=23, id=28, version=9178,
count=48, id=29, version=9178,
count=1, id=61, version=9210,
dsound.inf
- SHA256 2e4258ad5fda79156740519a994d2f1bad2e0ce2bc50097b8091dffff662bf78
- MD5 7c9a09e48a3567f85d6856805c9f0bc2
- SHA1 c3fd6bd20b47dcd1102c415b6e2dbe49cdf29627
- SHA512 3d552d12a1953f261baf32b0a67369524ee5b513c70f18d44938258dca7b5971b4ea856e31f188f9d21ff819287b29c52a4025b0c35153136d29db0f4059370e
- SSDEEP 768:au1SdfDzvtiMAe0V1ZUrBNBCBsBgB+AVB1BVB5UnBhB2BoBcBiAxBJBhBlxO/nxs:mtDSoEdrLrGBPOMYRf3P3ZW7Wh3vpX
- TLSH T1D6F2D0AE378DA2D2A3CCC5E8ADD0BB19558C44B1E0C6BD5D36A0DED4190D1A423BC7DB
- MD5 SHA1 SHA512 SSDEEP TLSH
dsound.vxd
- SHA256 dda4d53dd9d6b5d34ad1273c2b82cc81d94752ff5e905d62ca8167b184c61810
- MD5 f985c896b37091927e381f3f5121bdab
- SHA1 398792cd40882f7c3cc5f4d9e2d0ebf6d2924617
- SHA512 9d5b8361a0104e87e0ca9ebcfa876a532a6afadd8cd4e00d0b03cca06de4e8666c84b517835788e4646ee6a40dc8a476ae83fa224acff0943f1900a808cd5def
- TLSH T142A011E208E820B3B08002A8208AB282B30C802000203800C0EAA08028A20202A0FBAC
- MD5 SHA1 SHA512 TLSH
dsound3d.dll
- IMPHASH 423fd2aec57d2beb55ba046748fc0345
- SHA256 fc6a3613748c9285149696b665e7d1de221b6785d59d0b10db7739e83ac1df4d
- MD5 32cb980e22bce4cbb33ffa26e9fe802c
- SHA1 602ff8ef155ec0e94b6fc99a6e2c7e155f56b145
- SHA512 1bfd0e3eb9a236043e292674ce7efafdc047525e30ddb2419522d1301a8459d25b9950163f6ededf1e94aace7548af4eaebef0459129e4b3b1e139e9bc4e690c
- SSDEEP 12288:i9gU5I4qC5iFvSLAJYEAg17b1F0UQyHhnBJn5uoMnQCH6BRURa15rm/VixUn3O00:PvSLAJYEAg17b1F0U3xiMfQedyG9
- TLSH T106555BC8843F5CAAFA9824FA50FDB88FA1FC1ADD65F43B55808513897D7620076E90F9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1294847
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_adjust_fdiv
_initterm
malloc
free
kernel32
Sleep
DisableThreadLibraryCalls
CafBiquadCoeffs
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=28, version=9178,
count=5, id=25, version=9210,
count=10, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
dswave.dll
- IMPHASH 53dde5acafd181deae6d47482f150b5b
- SHA256 73174f7c2d273f0a371fa76abd3057be4d103aea4ccb087999d972ddadb4d82a
- MD5 6b65d315296c83b180d93076f15895a4
- SHA1 1e406f357b476b3ff9f58baf7515c5270889507a
- SHA512 6120cdcb3ac4f832be46e11b742d507e0ad36d313586e642a0db90d951e936d8b2a8b47f4079810ee7446e016fe5829bf627619068bd79c129c9b0fdd8081aac
- SSDEEP 384:61+P3nusjsTdybx6/KmH46S0KsidPygv10LRsAnnkpfWh3UW:A+/usjwybaSBXdPygN0L6AI2
- TLSH T13E824B4277F148FAC453A7304ADA735323A2DB281D1D9D1A06201F593EB89D3EAFE647
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15692
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalUnlock
IsBadWritePtr
IsBadReadPtr
GlobalLock
GlobalAlloc
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GlobalFree
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GlobalHandle
DeleteCriticalSection
GetModuleFileNameA
DisableThreadLibraryCalls
GetVersionExA
Sleep
InterlockedIncrement
QueryPerformanceCounter
InterlockedDecrement
msvcrt
free
memmove
_initterm
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
wcstombs
_adjust_fdiv
_purecall
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
msacm32
acmStreamPrepareHeader
acmStreamConvert
acmStreamSize
acmStreamUnprepareHeader
acmStreamClose
acmFormatSuggest
acmStreamOpen
ole32
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
748B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=9, id=25, version=9210,
count=59, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
dx7vb.dll
- IMPHASH 1075cfd402ecf012fa24c5ee66bf0f31
- SHA256 58623415fa9c6cdcdad238f486b796298499e129ffc3aa9390b05eec4794a0d3
- MD5 16913af40beee13f9b2874c349e2941f
- SHA1 2fa172c74e783557d4f18372e436e1224de522f6
- SHA512 0cb365b18aaa089e5855b42199d8f18531118b2f47ab60ef57fb59d375f656b47406af47aba86da01c94adad195115212e1e10a57291e8646b4edadd35cb70ba
- SSDEEP 12288:DgvoPMy9NpLXcJHSY8I4mE0fzduc7rSiHwneHZHvlXst+c99xZRKKWdlqaBuJt5e:DSOHG
- TLSH T1E1D4D5637381C9E3C9491631A817A74A9FF560063F02E7877385135E2E623D6BF0E79A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
35801
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LockResource
_lopen
_lread
_lclose
WriteFile
FindResourceW
OutputDebugStringA
GetModuleHandleA
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FindResourceA
LoadResource
SizeofResource
GetModuleFileNameA
lstrcatA
lstrcpyA
HeapDestroy
GetCurrentProcess
GetLastError
lstrlenA
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
LocalReAlloc
lstrcmpiA
LeaveCriticalSection
EnterCriticalSection
CreateEventA
CreateThread
ResumeThread
GetSystemDefaultLCID
WaitForSingleObject
CloseHandle
SetEvent
GetTickCount
GetProcAddress
lstrlenW
GetVersionExA
DisableThreadLibraryCalls
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
LocalFree
LocalAlloc
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
msvcrt
_except_handler3
wcslen
_wcsicmp
wcsncmp
_wcsupr
wcscpy
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
ole32
CoCreateGuid
OleInitialize
CoGetInterfaceAndReleaseStream
OleUninitialize
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
StringFromCLSID
gdi32
SetBkMode
SetBkColor
Polyline
CreateBrushIndirect
CreateSolidBrush
CreateHatchBrush
CreatePen
GetObjectA
CreateCompatibleDC
SelectObject
StretchBlt
DeleteObject
GetSystemPaletteEntries
CreateHalftonePalette
GetPaletteEntries
CreateICA
GetDeviceCaps
Rectangle
RoundRect
Ellipse
ExtTextOutW
SetTextColor
GetTextAlign
SetTextAlign
DeleteDC
msacm32
acmStreamSize
acmStreamUnprepareHeader
acmStreamConvert
acmStreamPrepareHeader
acmStreamOpen
acmStreamClose
user32
LoadStringA
CharNextA
GetWindowRect
GetDC
ReleaseDC
LoadImageA
wsprintfA
oleaut32
VariantChangeType
SysStringByteLen
VariantInit
VariantClear
SysFreeString
SysAllocString
RegisterTypeLi
LoadTypeLi
SysStringLen
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
367KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=5, id=64, version=9210,
count=13, id=25, version=9210,
count=181, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=90, id=29, version=9178,
count=1, id=61, version=9210,
dx8vb.dll
- IMPHASH d7478ded6c8775462f2d7c0c8f58d1d9
- SHA256 49e4256804a33378ba78ad1ccc839c57bab9fd2aeb964e055ed88420a6b460c1
- MD5 5d99843b40e6954f3f9c0dd78afb1972
- SHA1 f851f000041326b737b0c85cb2702a4ae30d4ba5
- SHA512 23b19f4655ed2ab32a53e3ab65995ba6b2274a8669dd5c39842654dd060c3606a12a7406a4660fadcaa09ad2a3fa97ed81469f73869a8bf0f5ad4243d9a10afa
- SSDEEP 12288:iGoAAp8bHeb7fcoz3NcB23tKGCV6Hj2j7exFGnixvkNstVkEmakJTW/K9dCsGB+g:i7KtX9zqIKS/2eLGqeX+r7Mo4+/T
- TLSH T1BB455B03B395D8E7C8071630A957A399AAF166437F06A6C77388172F5E633D07F2634A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
67726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetFilePointer
ReadFile
SetThreadPriority
GetTickCount
Sleep
lstrcmpA
WriteFile
FindResourceW
OutputDebugStringA
GetModuleHandleA
HeapValidate
LockResource
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FindResourceA
LoadResource
lstrlenA
SizeofResource
GetCurrentThread
GetModuleFileNameA
lstrcatA
lstrcpyA
HeapDestroy
GetCurrentProcess
GetLastError
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
CreateEventA
CreateThread
ResumeThread
GetSystemDefaultLCID
WaitForSingleObject
CloseHandle
SetEvent
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
lstrlenW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
GetProcessHeap
HeapFree
CreateFileW
IsProcessorFeaturePresent
GetVersionExA
IsDBCSLeadByte
GetTempPathA
GetTempFileNameA
DeleteFileA
InitializeCriticalSection
TerminateProcess
msvcrt
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
realloc
free
_CIacos
_finite
_ftol
wcslen
sprintf
wcscpy
ceil
?terminate@@YAXXZ
exit
floor
_CIpow
_setjmp3
longjmp
sscanf
isspace
isalnum
_except_handler3
_snprintf
__CxxFrameHandler
qsort
_controlfp
_wcsicmp
_strdup
setlocale
calloc
_vsnprintf
atoi
isdigit
isalpha
advapi32
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegSetValueExA
RegCloseKey
ole32
CoGetInterfaceAndReleaseStream
OleInitialize
CoCreateGuid
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoReleaseMarshalData
CoMarshalInterface
CreateStreamOnHGlobal
CoUnmarshalInterface
StringFromCLSID
CoUninitialize
CoInitializeEx
CoInitialize
OleUninitialize
gdi32
GetDeviceCaps
CreateICA
GetObjectA
SelectObject
CreateFontIndirectA
GetCurrentObject
GetOutlineTextMetricsA
DeleteObject
GetGlyphOutlineA
GetGlyphOutlineW
SetTextColor
SetBkColor
SetBkMode
CreateDIBSection
CreateCompatibleDC
DeleteDC
msacm32
acmStreamPrepareHeader
acmStreamOpen
acmStreamSize
acmStreamConvert
acmStreamUnprepareHeader
acmStreamClose
user32
DispatchMessageA
TranslateMessage
LoadStringA
CharNextA
wsprintfA
DrawTextA
DrawTextW
PeekMessageA
oleaut32
SafeArrayCreate
RegisterTypeLi
LoadTypeLi
SafeArrayDestroy
SysFreeString
SysAllocString
d3dxof
DirectXFileCreate
D3DIndexBuffer8GetData
D3DIndexBuffer8SetData
D3DVertexBuffer8GetData
D3DVertexBuffer8SetData
D3DXMeshIndexBuffer8GetData
D3DXMeshIndexBuffer8SetData
D3DXMeshVertexBuffer8GetData
D3DXMeshVertexBuffer8SetData
DXCopyMemory
DXLockArray8
DXUnlockArray8
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VB_AddDataToBuffer
VB_AddStringToBuffer
VB_D3DColorARGB
VB_D3DColorMake
VB_D3DColorRGBA
VB_D3DColorXRGB
VB_D3DXColorAdd
VB_D3DXColorAdjustContrast
VB_D3DXColorAdjustSaturation
VB_D3DXColorLerp
VB_D3DXColorModulate
VB_D3DXColorNegative
VB_D3DXColorScale
VB_D3DXColorSubtract
VB_D3DXMatrixAffineTransformation
VB_D3DXMatrixIdentity
VB_D3DXMatrixInverse
VB_D3DXMatrixIsIdentity
VB_D3DXMatrixLookAtLH
VB_D3DXMatrixLookAtRH
VB_D3DXMatrixMultiply
VB_D3DXMatrixOrthoLH
VB_D3DXMatrixOrthoOffCenterLH
VB_D3DXMatrixOrthoOffCenterRH
VB_D3DXMatrixOrthoRH
VB_D3DXMatrixPerspectiveFovLH
VB_D3DXMatrixPerspectiveFovRH
VB_D3DXMatrixPerspectiveLH
VB_D3DXMatrixPerspectiveOffCenterLH
VB_D3DXMatrixPerspectiveOffCenterRH
VB_D3DXMatrixPerspectiveRH
VB_D3DXMatrixReflect
VB_D3DXMatrixRotationAxis
VB_D3DXMatrixRotationQuaternion
VB_D3DXMatrixRotationX
VB_D3DXMatrixRotationY
VB_D3DXMatrixRotationYawPitchRoll
VB_D3DXMatrixRotationZ
VB_D3DXMatrixScaling
VB_D3DXMatrixShadow
VB_D3DXMatrixTransformation
VB_D3DXMatrixTranslation
VB_D3DXMatrixTranspose
VB_D3DXMatrixfDeterminant
VB_D3DXPlaneDot
VB_D3DXPlaneDotCoord
VB_D3DXPlaneDotNormal
VB_D3DXPlaneFromPointNormal
VB_D3DXPlaneFromPoints
VB_D3DXPlaneIntersectLine
VB_D3DXPlaneNormalize
VB_D3DXPlaneTransform
VB_D3DXQuaternionBaryCentric
VB_D3DXQuaternionConjugate
VB_D3DXQuaternionDot
VB_D3DXQuaternionExp
VB_D3DXQuaternionIdentity
VB_D3DXQuaternionInverse
VB_D3DXQuaternionIsIdentity
VB_D3DXQuaternionLength
VB_D3DXQuaternionLengthSq
VB_D3DXQuaternionLn
VB_D3DXQuaternionMultiply
VB_D3DXQuaternionNormalize
VB_D3DXQuaternionRotationAxis
VB_D3DXQuaternionRotationMatrix
VB_D3DXQuaternionRotationYawPitchRoll
VB_D3DXQuaternionSlerp
VB_D3DXQuaternionSquad
VB_D3DXQuaternionToAxisAngle
VB_D3DXVec2Add
VB_D3DXVec2BaryCentric
VB_D3DXVec2CCW
VB_D3DXVec2CatmullRom
VB_D3DXVec2Dot
VB_D3DXVec2Hermite
VB_D3DXVec2Length
VB_D3DXVec2LengthSq
VB_D3DXVec2Lerp
VB_D3DXVec2Maximize
VB_D3DXVec2Minimize
VB_D3DXVec2Normalize
VB_D3DXVec2Scale
VB_D3DXVec2Subtract
VB_D3DXVec2Transform
VB_D3DXVec2TransformCoord
VB_D3DXVec2TransformNormal
VB_D3DXVec3Add
VB_D3DXVec3BaryCentric
VB_D3DXVec3CatmullRom
VB_D3DXVec3Cross
VB_D3DXVec3Dot
VB_D3DXVec3Hermite
VB_D3DXVec3Length
VB_D3DXVec3LengthSq
VB_D3DXVec3Lerp
VB_D3DXVec3Maximize
VB_D3DXVec3Minimize
VB_D3DXVec3Normalize
VB_D3DXVec3Project
VB_D3DXVec3Scale
VB_D3DXVec3Subtract
VB_D3DXVec3Transform
VB_D3DXVec3TransformCoord
VB_D3DXVec3TransformNormal
VB_D3DXVec3Unproject
VB_D3DXVec4Add
VB_D3DXVec4BaryCentric
VB_D3DXVec4CatmullRom
VB_D3DXVec4Cross
VB_D3DXVec4Dot
VB_D3DXVec4Hermite
VB_D3DXVec4Length
VB_D3DXVec4LengthSq
VB_D3DXVec4Lerp
VB_D3DXVec4Maximize
VB_D3DXVec4Minimize
VB_D3DXVec4Normalize
VB_D3DXVec4Scale
VB_D3DXVec4Subtract
VB_D3DXVec4Transform
VB_GetDataFromBuffer
VB_GetStringFromBuffer
VB_NewBuffer
Name
.text
Size
605KB
Virtual Size
605KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
63KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
462KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=8, productName=Unmarked objects (old),
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, id=64, version=9210,
count=15, id=25, version=9210,
count=216, id=1, productName=Unmarked objects,
count=11, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=157, id=29, version=9178,
count=1, id=61, version=9210,
dx9w2k.cat
- SHA256 db386dd480e3d5b2153724b4ed1034dc0633a9e3a23ce516bbe7ea3fd11e9c91
- MD5 2c0af9b48c9c71e4e3bb19ca331909a0
- SHA1 6a6af23152aed80c021d7e6b6585bcf917584ccb
- SHA512 32bf96fddbb7307d8f0a3e1e0cb35639a7154c1ef97cb457d4b2bda23fed2bbcef93394918e7ef5a83a411c9e409954171e01459338432dfaaf1658238c1cfe3
- SSDEEP 192:DWCNEjo6Roui2qNydMgRS3H136TnhfBIIhEJFCvkQ9re+fBQyvF65Z/eWWfad6LW:k81EA+zACd0j2olhe1OHrDpB
- TLSH T133B2AD6B19E84163412DC8B1CFF5EC9FB422D6B6A9125D3E209373944683B62738F93D
- MD5 SHA1 SHA512 SSDEEP TLSH
dxapi.sys
- IMPHASH 451e7ae3e889975f362e0be68fb23162
- SHA256 943e53683ce11630f3dd4954208c1f1e16c2b59efd4f4f4b977c794a4aa1abb7
- MD5 bca14d9d8955387401f23a2a2514bced
- SHA1 772ac475174b383118af5856b9e0a2d7d170bf49
- SHA512 4b767ea9e718a109c3b7a64168720483aeb866db9deccd2209e998ef8b1a6bac3dfca41899c42b666465b08e4057cf4affff79d565ec4f67a01539c3f69fad99
- SSDEEP 192:bbgcWtVELv/NiNaO3sKssVxvLhEI56ht+aSaFM3CWSdtWW:HgdawNaO3saJLhe3Sa+3CWSdtWW
- TLSH T15C222B01CFB10639E0A287F68BE72319227F2E155222E67F45846084BD35F147F3A36B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
KeInsertQueueDpc
KeSetEvent
ExAllocatePoolWithTag
KefAcquireSpinLockAtDpcLevel
_allmul
ExFreePool
_aulldiv
hal
KeQueryPerformanceCounter
KfAcquireSpinLock
KfReleaseSpinLock
videoprt.sys
VideoPortSynchronizeExecution
_DxApi@20
_DxApiGetVersion@0
_DxApiInitialize@32
_DxAutoflipUpdate@20
_DxEnableIRQ@8
_DxLoseObject@8
_DxUpdateCapture@12
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
192B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
288B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
704B
Virtual Size
694B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
256B
Virtual Size
241B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
448B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
960B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
224B
Virtual Size
202B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=8, id=19, version=9049,
count=1, id=6, version=2090,
count=1, productName=Unmarked objects (old),
dxapi.xpg
- IMPHASH 6a7f14fd633aa42f777a1ec1fa7bb386
- SHA256 fe26fba13079189ef96a1c994036ea472a4bf34fa14c163c693ad481bf31e676
- MD5 fe97d0343acfdebdd578fc67cc91fa87
- SHA1 731bd21a972dca7f70adbe1f93ae8200a17a7208
- SHA512 6f81e645c7f3e5ad6c43db541240d2f3175489f8765989f93076d5d17672709a4a72e4542854d7660bc171795cf04a44cce5c6e4e87e5caa291384af304439bf
- SSDEEP 192:txyMVa9giqkt1fYFCAukBtLtmbkSVM+kY17WSQfwW/Q:y9Okt1fYHBtL617WSQfwW/
- TLSH T1C2221B5067B2013BE5B302B19C9F3325632BDE129523A77F186064D87E28E11BF697B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
dxapi.pdb
ntoskrnl.exe
_allmul
_aulldiv
KefAcquireSpinLockAtDpcLevel
KeAttachProcess
KeIsAttachedProcess
KefReleaseSpinLockFromDpcLevel
KeInsertQueueDpc
KeSetEvent
ExAllocatePoolWithTag
KeDetachProcess
ExFreePoolWithTag
hal
KeQueryPerformanceCounter
KfAcquireSpinLock
KfReleaseSpinLock
videoprt.sys
VideoPortSynchronizeExecution
_DxApi@20
_DxApiGetVersion@0
_DxApiInitialize@32
_DxAutoflipUpdate@20
_DxEnableIRQ@8
_DxLoseObject@8
_DxUpdateCapture@12
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256B
Virtual Size
142B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
384B
Virtual Size
364B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
640B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
256B
Virtual Size
241B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=1, id=29, version=9178,
count=1, id=61, version=9210,
dxdiabrz.chm
- SHA256 9ca5aee16796d8bcc7b8b540e5e205001ed8f9a83dc4a4a75da813048dd73838
- MD5 53c73ef6daffdb7c3730c1608777e1d5
- SHA1 4f26b1ccb0b2250377b848da5950bc10bf2f55cb
- SHA512 d69cb7fdad285c8da0c7d4a99a868b966eb31252f86534eeafbfa928ae15c0ce3a91c1d1bca2b077385c3e48d3c979a61eb892d0d38db4b28970ea130a18043e
- SSDEEP 384:6Dg65cgcal9pVJsRDy5vzPctpT5EMpkvRDja3etj5kk/CS:6Dg2cgx33sBmPctZSMpUi0bCS
- TLSH T1BAB2CFFB0590C02FC1C346F22EE542C6751D3D56DA921ACB12A9163D9BB368C8FB2D27
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiachs.chm
- SHA256 ae5417657ca355416d9d12e90f1e543c7518880e695c2cbfda7a15423c52349f
- MD5 73e82b73df5fadafad4b6769e629f785
- SHA1 b394d6d6e3dc8266710df5f36b35c308db7f03d7
- SHA512 8a4c80f3db5ac3171eea8dae5d9aa3d734b9fbfc26b8977b27527853b092c8373ba7d8b1f6c5e76ce53d816eaf64dd203d4a074a6d299775f3d14aae33d853e2
- SSDEEP 384:Lx9c2X4IusikWoiEAC/40BoYH5VAdUZxav5srqSCA+z6pISlXx0Vw3zxdT:Lx9Fssiih44oYH5VHVrSuXx0VE1V
- TLSH T1F8C2CF9133904420E685D83E7A858A43F04A3F17E2DAAA0DF052BBAD1673F0767619B7
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiacht.chm
- SHA256 5bbb6a9b1bdb2ec80f8c5fc4a373ec5c2539081e146decd35183bd2ff50b64f2
- MD5 024ad44006f8913db27a6dbf9914ca25
- SHA1 7201b5d91e77be5a893a9492a37d4c7d75dea054
- SHA512 75325fe6b535d26cfbc4d7804fa8623dd07c48f6c3c3b5b7a78cc697ac2e90de46d1337c55d702e455d2284f7e19aac6517b43b10ea8b6398dfc50104f177321
- SSDEEP 384:P0rp30rPMPpJild4RO1UfTA5613+IC1Gyjkumtx1MrMxSTuK1743RLmN:P0rpkwpJ+iO1X5e3iGypmtx1Mrf7743m
- TLSH T137C2C0E9636AA95BD80217B65AB8130A92633C08CC5063EFA274332F14F5F641F7495B
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiacze.chm
- SHA256 6d77211a660b988c5119b48003db33e990676d32633a37e93ff3f0b1d3e431f3
- MD5 144b2198a88cecece732e1ff04b4e124
- SHA1 47f84621c0721a8e94453fe5afa5e388edb87ed1
- SHA512 00a9e91ae54d1754ce25bf97d1af794ecba87f3945c6986d3ad4a5997f892d8385f9cdc9670492da01e1caa7255c7eb6b80c21b1fa84e01b98d9acfccff8bf9f
- SSDEEP 384:oFe5DsecRkWn7/VufDeH/9llasr/37n2wsgy/8bHCVvNuDZan4sgv:oFe5Lc+W79E293P/a5/8bO1uDZanRu
- TLSH T188C2E0B4BBE6A51DE215463153B0F1DFA70CECC4E568D4FC21AAD7A8372E246432C636
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiadut.chm
- SHA256 11f25e59793a2fb3860f27223dc8a981b49f4b154a28b4cf63d540ef22ed4d2c
- MD5 b0eef1fda652b64c59b113236bdaeea4
- SHA1 a5851331a3b2e791a6d5de4a426952ef8168d9c5
- SHA512 cf59892252684690608a45fd5e995cad07627afea9053cc88a6a6c7d5829a14b39d936fd837eb448d7b00ef47a49f230d0042f9bb8c304ecf376f632cb86f867
- SSDEEP 768:1pFUiogyVdft7K9rRoELdKKbtAWeXDYqEl63oN/ojrHX:1pFUi3wdF7KFRoEL1bCWeOlL/Ub
- TLSH T130F2D1ED3FC599D1D3021A3AA2C91EC57138E63829CB839FE110FD657B67D9C2A2140D
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiafrn.chm
- SHA256 05c1747926daad44bfc8e05f54b0d921e9690515c6898430aa665b629225ddc6
- MD5 5a14a2abef5adaa08c025365ef47faab
- SHA1 3f78e2c9ccc7d9ba62f41300bf197d8f05095daf
- SHA512 4936ee5f1cc1bde9dc211d2ca46e7186e533e58629faf179dbb8d6ab1f10f52c52e8c960e9978c8d57effa96ac5db39b7891497774fd9f21545a20847286cb90
- SSDEEP 384:JlgmbaNEcvpsUXk0Epc1LqY5kU9ahYxTIsALhKPkVF:JSmb3Up9k0NPkhKaLh0kT
- TLSH T1C7B2C07A23238314F4594A39BF9113A7A234AE5A8575D3D5F31BC6FC5BA7E88BB00061
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiag.chm
- SHA256 aa50e05ccb8ded699db5a8da1068afd8bfef1f8717e6004419d89f2cf5e5e506
- MD5 e4985c0c04a05d83da060409408d005a
- SHA1 6b61a545a26fcfbe7b92bcb2e5490f981c285e90
- SHA512 a0dbabf8db99d3603f12366ef0e2792cfbcfb4cf6504241b264e3a5504548a799f946a40fa387a5ef6ddf5e34b613301c4836951551126a8dbf93e5923c01da8
- SSDEEP 384:HZjB8bflvUSUP0BsEq6hglFidAEeJvmezSXMgUfe7t:HZjBGBBspHOwJvVCme7t
- TLSH T12EB2C0F05AA02B49DA4526708B600657346F5843D2B19985F63BA21E1EBAD5CCEF23F1
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiag.exe
- IMPHASH 4c1cc062ad1ba9603fe58485dabee66e
- SHA256 4e2201e6b77dcefcce36f2b20315ef260908a5b19042d995be624f3f6e720704
- MD5 0b31a013babc182763ee4eacd70a70cd
- SHA1 68a929593bb61d25837fe5784329f1b43fcbd9b6
- SHA512 45eb1b3bab84835038a5f9b461867ddb530164619a2e97bcf455aa075ab26e3bcb904cadd3dc4298595ffe6f3d40c25696ad34cf7f3652eb1d437a0a40e50ad1
- SSDEEP 12288:xxoVTjLj6H7rseA7PwivOloinBNJFxciPAiVAZDgweM12zFfIJmhnpxlTBP1U+4Z:xxUTXjK4Zx
- TLSH T17F15F91067FD962AF1F36B346EB912A64E37BD51AE35C54F5A10718E4932F80DE20B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
148280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WaitForMultipleObjects
SetEvent
GetCurrentThreadId
FreeLibrary
LoadLibraryW
Sleep
WaitForSingleObject
GetCommandLineW
CreateEventW
GetSystemInfo
GetFullPathNameW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetVersionExW
lstrlenA
CompareFileTime
GetWindowsDirectoryW
lstrcmpW
lstrcpyW
GetProcessHeap
HeapAlloc
HeapFree
CloseHandle
DeleteCriticalSection
GetModuleFileNameW
GetFileAttributesW
InitializeCriticalSection
GetCurrentDirectoryW
GetSystemDirectoryW
ReadFile
SetEndOfFile
CreateFileW
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
LCMapStringW
LCMapStringA
SetFilePointer
IsBadCodePtr
IsBadReadPtr
RaiseException
SetUnhandledExceptionFilter
MultiByteToWideChar
VirtualQuery
VirtualProtect
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
GetACP
LoadLibraryA
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
TlsAlloc
SetLastError
TlsFree
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
InterlockedDecrement
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
lstrlenW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
CreateThread
GetLastError
TlsGetValue
TlsSetValue
ExitThread
RtlUnwind
GetCommandLineA
GetVersionExA
GetStartupInfoA
HeapReAlloc
advapi32
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegCloseKey
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyW
gdi32
GetTextExtentPointW
user32
MessageBoxW
LoadStringW
EnableWindow
SendMessageW
GetDlgItem
wsprintfW
EndDialog
GetDesktopWindow
MsgWaitForMultipleObjects
PeekMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
SetWindowsHookExW
UnhookWindowsHookEx
PostQuitMessage
GetClientRect
CreateDialogParamW
GetWindowRect
AdjustWindowRectEx
SetWindowPos
GetFocus
SetFocus
SetTimer
KillTimer
SetForegroundWindow
LoadIconW
CheckRadioButton
GetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
GetDC
ReleaseDC
SetWindowTextW
CheckDlgButton
ShowWindow
SetDlgItemTextW
LoadStringA
wsprintfA
MessageBoxA
DestroyWindow
GetKeyState
IsWindowEnabled
PostMessageW
CallNextHookEx
GetWindowLongW
DialogBoxParamW
UpdateWindow
comctl32
ord17
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
comdlg32
GetSaveFileNameW
shell32
ShellExecuteW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeSecurity
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
Name
.text
Size
200KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
708KB
Virtual Size
707KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=19, id=64, version=9210,
count=15, id=25, version=9210,
count=184, id=1, productName=Unmarked objects,
count=141, id=28, version=9178,
count=1, id=69, version=9111,
count=17, id=29, version=9178,
count=1, id=61, version=9210,
dxdiager.chm
- SHA256 ecf4dc10f45af9ca9276d45aaa783b68df0e0450533c3993042ef3e530244dad
- MD5 8eddacb09e28fddf68c1d19fd20a7e39
- SHA1 944aff3867b30abb7a6b3b588a7766a7a88f0169
- SHA512 d228300471abe6eae963e34e49141f44cdfd286730d7ae3fdca7ce7017a061a3284e274a5234caa3ebdc4f5c6c86025f828e23c1c15e93dff5c6a47d64791973
- SSDEEP 768:LpuQJ5RzN2PXp4CblEsv655v7Cd6z7BEuim4:LpuQJzQh4Gv6zo6X+uim4
- TLSH T19BE2E0F002AE1111E8959C379BA269CAF2631EC6EF40DD87E0F63B188296C525FD50B7
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiagn.dll
- IMPHASH f279e27e8da3ee34daa485580c7a0a49
- SHA256 cd170117ad12c60914efd18c26397e1f6e0a679446242cef718a74d3f9b05635
- MD5 4654cbe77cc8cf1602e16a30548626fd
- SHA1 f614a37a9cfcaffe67069483b8d1843d94f25e7a
- SHA512 9953586a2399b3b0cc2dbffae6ed4876aa934c1590f23344690279e584dab86b8da7f04787eebaf206cba6a10ae14c8e35c57575fc5c90f8e78b649210e0e62b
- SSDEEP 24576:8yKy9+rrVqHQvFvZYhWozIDlDCf6fkf6fEAfk:/xixqHFQyIDlDCf6cf6cAfk
- TLSH T111751711A3FD5229F1F36F346EB922A61A76BD92AD38C50E1244754E1D72F90CA70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
389453
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
FindFirstFileW
GetFullPathNameW
ExpandEnvironmentStringsW
lstrcmpiW
GetPrivateProfileStringW
GetSystemInfo
Sleep
SetPriorityClass
GetPriorityClass
GetCurrentProcess
GetProfileIntW
OpenProcess
GlobalMemoryStatus
GetSystemDefaultLCID
GetLocalTime
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceW
GetTempPathW
DeleteFileW
LeaveCriticalSection
EnterCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
CreateFileA
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetModuleHandleA
TerminateProcess
CreateFileW
CloseHandle
GetVersionExW
GetLocaleInfoW
GetCurrentDirectoryW
GetWindowsDirectoryW
OutputDebugStringW
GetModuleFileNameW
GetFileAttributesW
InterlockedIncrement
InterlockedDecrement
lstrlenA
GetProcessHeap
FindResourceA
IsProcessorFeaturePresent
ReadFile
FlushFileBuffers
SetStdHandle
SetFilePointer
IsBadCodePtr
IsBadReadPtr
RaiseException
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
VirtualQuery
VirtualProtect
LoadLibraryA
GetCPInfo
GetOEMCP
SetEndOfFile
GetACP
HeapSize
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
VirtualFree
GetSystemDirectoryW
MultiByteToWideChar
GetModuleHandleW
GetVersionExA
lstrcmpW
CompareStringW
GetLastError
lstrlenW
FreeLibrary
LoadLibraryW
GetProcAddress
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
SetLastError
TlsFree
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
TlsSetValue
advapi32
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegEnumKeyW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyW
RegOpenKeyA
RegCloseKey
user32
CharNextW
GetSystemMetrics
GetWindowRect
SystemParametersInfoA
IntersectRect
OffsetRect
EnumDisplaySettingsW
ReleaseDC
GetDC
CharLowerBuffW
LoadStringW
FindWindowW
GetKeyboardType
LoadImageW
ShowWindow
CreateWindowExW
DialogBoxParamW
SetForegroundWindow
PostMessageW
KillTimer
SetTimer
EndDialog
IsDlgButtonChecked
GetWindowTextW
GetDlgItemTextW
CheckRadioButton
EnableWindow
GetDlgItem
InflateRect
InvalidateRect
SetWindowPos
GetCursorPos
SetCursorPos
ShowCursor
SendMessageW
MessageBoxW
SetRect
PeekMessageW
GetWindowLongW
DefWindowProcW
RegisterClassW
SetWindowTextW
gdi32
GetDCOrgEx
GetClipBox
DeleteDC
CreateDCW
GetDeviceCaps
DeleteObject
BitBlt
SelectObject
CreateCompatibleDC
GetObjectW
GetStockObject
winmm
waveOutMessage
timeGetTime
waveOutGetDevCapsW
mmioOpenW
mmioDescend
mmioRead
mmioClose
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ole32
CoInitialize
CoTaskMemFree
CLSIDFromString
CoUninitialize
CoCreateInstance
oleaut32
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
VariantClear
VariantInit
VariantCopy
SysFreeString
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
672KB
Virtual Size
671KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
880KB
Virtual Size
879KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=95, version=2067,
count=6, id=18, version=8444,
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=40, id=64, version=9210,
count=13, id=25, version=9210,
count=226, id=1, productName=Unmarked objects,
count=170, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=149, id=29, version=9178,
count=1, id=61, version=9210,
dxdiaitn.chm
- SHA256 38281c3e17b2d9c0485012ea200022d0036d3a68873d828f03ec1fa825314f81
- MD5 dafc6ee570887cefae4debe72b49650e
- SHA1 b1da18985d246b4aabf2872ebf70180afb821484
- SHA512 d8e1ed5f61625491d4a53dad42b1d18f60594f314f19a75dc1049ef601ff8cee8a17a62e1c6da345f518caba9cbe28ecf93c8a6f1c57271d9398d59ee106c874
- SSDEEP 384:ZxAkR2OekdPNjEePStyBDd5W/OTl9XKijfvIqe60Kf:ZxAUdPNwdcDd5z9XKi7Aqe6V
- TLSH T1FCC2D0C437108E0CCD0499F3F185E1887AB63F42AC50DF5AFB2D6E48BAB5F895B56152
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiajpn.chm
- SHA256 da682d976eaa8f066a4cd6ca96dc67abcddbff2715c7998f8a18298423c29370
- MD5 81f4ee6ba91a82ef3b435d93911a6873
- SHA1 8d4425cdc1f62eb6432cabe0dc4f497ecad6fab6
- SHA512 ddb0e4350b6f7e02b5c39ebe6271c8d41b83ae1b2fa8f74f06a5a8e9607386fe4e5f4abd5d4c3673b897489e96e4fcd307bf1c6039a97a5fbc0e2be228339ace
- SSDEEP 384:dVZvmyl49vMl/EMtxlGtU86d1uwI02PRyLIf6Ch75bdvLypkX8O4dtmmrJ:dzOyaulXlGtV6C02PRIISApvLfMORml
- TLSH T1DEC2D0831F210332E4266F35B99F2DC6BB594C06FC69BB168EA2B57C0EB7D491015A73
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiakor.chm
- SHA256 d9e0d7fcbb6210a8eb8675a37c72dd7fba95a0daa3dcd5eb06baae57bf5ff79a
- MD5 b49cd05759b11df66a9f6fd74e04b1a0
- SHA1 ddd408554d9701afdcc41b99e65a04ab71eda3af
- SHA512 5ba2df5370d2e39e4a9eaf10619f943646ced896c97bb3cc42f633566286fc9544a1493d8e3b1ededc530eb2d6988bdf46c5a2b59644cd967d729c55280f6f17
- SSDEEP 384:iGmCZvXVmIlW7kLXXzfkSbf5KdvDP0O+xYEXR3AHxh4o00qpYOs8i772N:iGmI8I5jfkSbfk0O6mHxhO0ELsN2N
- TLSH T15CC2D0745742D193E14E4533AFDE29E239127C107E3866D6F417DB3E8B77E5848E1421
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiapol.chm
- SHA256 7015d193adeace0a781ce065c7a53b11c1dbc54caa26e2c14b29ce9c857d5685
- MD5 e82515e43e735747d1953e61f02be720
- SHA1 1837c25922728ec14c47d75fd6fd39756aa3b988
- SHA512 9dfcebfaf8bfa11dc742bf833b5e3d7c0b70a5a9a188b77cc738a7540442cc1e078cfd6bb9437df01f695023c137a34ab4f75bbe122fe16320fffada2cfb8fd8
- SSDEEP 384:+TMeBMvZlZ0aASIkUm8orxybF14PtXjcRW2ta3pGTbhkBo2m+6pr:+TruZw7o8/5ktXjO+Gfhuoh+U
- TLSH T1C8C2C0C33302490CC5225F39B4E8EAE1F8E4AC37A150C25EF15CB5DDBB9BE1553459AA
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiarus.chm
- SHA256 7526376dcc365dd1e0f23ed1ea915e599005d153c64a6527edfb2b292ef1dae4
- MD5 b414edc29df6de61f3fce33b29a91b35
- SHA1 b1953e743ee41ffe255de89e4c4f6759f90ff52b
- SHA512 f40702046eedb885f13367362fcce7cb497df36cb349a6f710753977351b4a5c5e84e4753f8a23880f0b42f336bbe85a17b2e5d6b281fd66a976aaa934ddb737
- SSDEEP 384:jNLm8bF3tITeSD4equLmug7zMCddq6i9A6WdeOraN8qvo/xU:jNL33t0DDxmusACHXi9A6WwOr/7pU
- TLSH T186C2D1F036D6156FD2B49A71F99A24C0805B3E659862B2CF51548F2CE6F80164FF4F92
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiaspa.chm
- SHA256 e74077db52d39759c80ccbe7c79714c045e91d43917c2493259f1bbe98d729a3
- MD5 d7eb8554de9524e080fd9228e25e71c5
- SHA1 21a0cdd2da963b64ed2461a35db5018bc5035c69
- SHA512 65a768d19e3be7856ccf05d5e4da25151e1085856abd789643525c32421de2e218c9c19cc0524a8ade5458e9e6b241dc36700a29567df2d5b20386b2ede79f83
- SSDEEP 384:Qtoi5o60JWWIBPxzffOOvCQ+23H6BJOra5p90LlnuOUh+g:QtoewJWdvTfOe+wH6Ia8ndUf
- TLSH T152B2D0B823A1454CEC5046711BA886D7A4637E86A45CE196928CF33C1AB8F8F4384E72
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdiaswe.chm
- SHA256 42f60e3ac4651d996cdfa14b2c869b41595ece1bf04ee47ba684c0fbb0846531
- MD5 b1acf7038845805fcf0d504d851429e9
- SHA1 6f48f1449b28a939e7be8dfc697b34da2a570c56
- SHA512 6b6831e801a57d008edfdf7f97ff87f589009bc92cd3a891e7f8f65c130d3b9f076e46b8c1c4f5c303bfab82b411931708ab8d33982ffcf18e723ce4812bbd14
- SSDEEP 384:UOOgdCUxJuREySovd1MoQbCJ/Ag6Ru7jMrlxxaUz4W:UOOgdCUxJlb4MoPJ6Rvrlxx7z4W
- TLSH T10EB2C0BCF7A0126DE1866E3A73E1E0D7B486BC43D060D947755A17232FF498E239A022
- MD5 SHA1 SHA512 SSDEEP TLSH
dxdllreg.exe
- IMPHASH 7808fd325bf451cda117496280bd1fac
- SHA256 81aefdb0459c6cc4c26ff98a3ee8e3a858aaa9eb9f53026d3f8c269a324e6fcf
- MD5 5081f2fd42a97c2d8885f1de109f7b39
- SHA1 e5531a7eb27e14f92ac7c4c6686ba90b1bba7b9d
- SHA512 77a4cef3e8727d6b074f97d7d2338aedb5009119d326ee3c314bd8191cb9bbca1c8b44de1dede5df1366ca39670234de3e6ba35120de19a0c27b1d1b3e497b0b
- SSDEEP 768:I42N/LzVSpZQ5zfovWKIvT5dI33zDIP75z0DiCbBkHunij6Ja6OVC/:J2N/LzVSpoZKITazG75QDiCbBkHuFJjv
- TLSH T192137D027360C17FD0C567780576CB25ABB6F4101AB1578F5B548A8EAFA37D0AF39392
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
FindClose
FindFirstFileA
lstrcpyA
lstrlenA
GetPrivateProfileSectionA
FreeLibrary
GetProcAddress
LoadLibraryExA
GetPrivateProfileStringA
GetSystemDirectoryA
lstrcmpiA
CreateMutexA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetVersionExA
GetWindowsDirectoryA
OutputDebugStringA
lstrcmpA
lstrcpynA
VirtualQuery
GetSystemInfo
VirtualProtect
ReadFile
GetProcessHeap
SetEndOfFile
RtlUnwind
GetCommandLineA
GetStartupInfoA
GetLocalTime
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsFree
SetLastError
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
Sleep
InitializeCriticalSection
SetStdHandle
FlushFileBuffers
CreateFileA
SetFilePointer
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
advapi32
RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
setupapi
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextA
SetupFindFirstLineA
SetupOpenInfFileA
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
ole32
CoInitialize
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=64, version=9210,
count=2, id=25, version=9412,
count=9, id=25, version=9210,
count=108, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=99, id=28, version=9178,
count=4, id=29, version=9178,
count=1, id=61, version=9210,
dxdllreg.inf
- SHA256 a424ebc884e0c9bb227c1e58d205b1aaf4d5495a5f50fc38e7e6c323e619fa6c
- MD5 22e034aff6264e9ae75d57caac38a2c7
- SHA1 7a89a59e0b629d1f08c8ca448c39f17003664bab
- SHA512 5fe42a0c0b339e6d9dd4923e439042715ebad9ce5b77cb0f6a9e203be6857998106145ebe107ffea0d4ebb35dd6b735ad657cdd6cb74e6a525bce2f5a019b78f
- TLSH T12451AA9EE5B2402658D7B04DB810ACCF641224063B5EB7D9B39937D43AB394FACA403E
- MD5 SHA1 SHA512 TLSH
dxnetsrv.cat
- SHA256 20557cbeb1455617f435daa6118b494559847a37e0249d2aad458fe9a7d3fcba
- MD5 c015c83ff0938e8b3870aef662fc7911
- SHA1 dae0ffe76114c3e020abb1ac739b4668144961e8
- SHA512 7b6b71192c11b3901a932b05cd8e34f80ab572435724585635b4334c0fc8065b506c2e055fdef73dea74bff313da0ab3ceb58522d371f442a19bb66bf5399c3a
- SSDEEP 192:5WCNEjo6kLWLuWlqstydMBD7lRQAhh136Tn/hYozhyDbFJFCvVCQ9re+fBQyvFm/:+85SfkS+zuCytA2K1dOLhe1OHrDuhU
- TLSH T1F6D2AC6B19E84163412DC8B1CFF9EC9FF022D6B6A5125D3E209373944683B62739F92D
- MD5 SHA1 SHA512 SSDEEP TLSH
dxnetsrv.inf
- SHA256 1d52e26294e677227500b3c2bf4568ecdf19ec432a430e724516f31709aec7c5
- MD5 a5323dbfd33c8c046e8e60da862ecd91
- SHA1 0fdddad6593ce37075e9d5991314dad3fd810494
- SHA512 3d3f5f44f651c82de7b32bc1f2f9f314b052a7e274ce5212ecbbb57ce8c3159127be748158f16ae0548ece2d9d10fe29f931f00d265bf40bc4ae18db6ae1c9c9
- SSDEEP 96:72oqU4hyNMtG3cwrvCqlZyVedSCspYSCK6gsPnQis2l95V46xJ:72ZHocwrvCqlZyVedSis6gsP7R
- TLSH T145A1FC9CCA308D99B5AA3B50885E7DCDA524C1A637C61247F46E90CD9F2F4BFC224537
- MD5 SHA1 SHA512 SSDEEP TLSH
dxnt.inf
- SHA256 667056e8724cc1c445631f9818178399b88218444dc0f6adcb9933206fc5c2a3
- MD5 31412f15595fed4b42f2a59828ee0b38
- SHA1 8004e24c57bfd7437774870d3474ae6b2d4f70ac
- SHA512 1afef6295e6f0e12e693836cc961467ad4224fe64505363d6540fb14aea308027ceeed94b39b2a115c3aed8cbafd211971a87998bb25eb9a290304c2bde8ec77
- TLSH T12861004FD2B1C75C02DDA4A0895A2C8F625C50263AA521D6F5AD03CACF7B9BF83A1532
- MD5 SHA1 SHA512 TLSH
dxntunp.inf
- SHA256 132d87564a8b2804dfc485422005ffa79940c9c85063f361a4a45839676bfc6f
- MD5 66180f70e344619e6f3580cd3920f1c9
- SHA1 8b3de6114e678ae7aa58c150b2fafa6c4b5d4a65
- SHA512 204c9e10301977c5d7a54c8ee82e9a9a2d19434d8e4e7381735f95f2a69fcab6e70d088732eb13bb7eb61000ef948bb242249f7b368ff8b897000521ea53541c
- SSDEEP 384:lh/a0BImofpG2C2eEl0bSpg5NA5tszduMriQ4kPmUFrM9KMoGJAbK5kRevD:lh/a0BImofDC2eOhp0FrM9mGJAbK5kRC
- TLSH T123A2C6CDE5B188A8E0947A418A663DCD150CB16733CBAB4DD1A983CD8D2B9FBD151E33
- MD5 SHA1 SHA512 SSDEEP TLSH
dxver.inf
- SHA256 632ecc3c127aeca60ff9cd394cdad96a0fc8b999f7c1bcdbc3b8d1f6919a862d
- MD5 17772caeaa51adf03245418ce84c7d93
- SHA1 1dd7dca4ab5c2ac0234f19dfcd4f9921bb17f68d
- SHA512 f22781824da76045bfcf80f7375da9df1a23031bf936baab1d8c267470b1468bc184d664a312a45c382bcd006c13061113c15522cf05b22b0132bced7c4270aa
- TLSH T1EEE0C215A515F222E4255722D7073E57FFE8CA4320CAF78CBEF029024715E8A610E7FA
- MD5 SHA1 SHA512 TLSH
dxxp.cat
- SHA256 5b2db73a74c9abdf6324a61a39afbc2da6955265b0b7b6197bb33d01d9089700
- MD5 3c53ef7fd8bc8f4af12953c4e680234a
- SHA1 eca39bbdb9d41b2f666763ab34959ed7c891ca31
- SHA512 8bdde7f0aa65dc9b52b86460c1ef84a8b15dd41141ea9ecda79620c2c232aaf876ecece8e5f0aed0aa5841f1f21e83df987970e0491b764b7322695f7ea1b001
- SSDEEP 192:bWCNEjo6kLWLulqstydMBD7lRN2Ahh136T9O/hYoUNhyDbFJFQ9ovVCQ9re+fBQQ:c85SeIX+7ugyZbFV2t1dxLhe1OHrDUlk
- TLSH T119E2AB6B19E841634129C8B1CFF9EC9FB022D6B6B4125D3E209373954683B62739F92D
- MD5 SHA1 SHA512 SSDEEP TLSH
dxxp.inf
- SHA256 8d62132b2a5a2bc82ddb0efdba91dee7bb54588328770a9a9f54ad3dfb4ce572
- MD5 e251a9fa40e977fe9cf9c47a3e1cc09b
- SHA1 dbbe68f276e30e2bc6580029a39bc0286a7b0831
- SHA512 c0e2edbf586631c1c5219485c69af1fe8d3551d32caa763e29c4c6979d4d0bb97e51a7f7b1c6fc500f5151f15169953d866356229918b6fa6f2dc4cbebeb9538
- SSDEEP 96:72oChARI0GnaBlZltKTpGywKTpinCvQponr4nDffHxCYgSg4nQodp8LVs2l95Vku:72ZhlaBlZlUVGyfV+/n44ddpeB5
- TLSH T1C5A1305DCAB1CE4D54DB7459C90A7E8FA01C901233952396F6AD48DDCF339BF82A063A
- MD5 SHA1 SHA512 SSDEEP TLSH
encapi.dll
- IMPHASH 7ef4eb075baf0539b4fc0bbc0e5355d6
- SHA256 4734bcfbcea9201aa71e0b9cadfbcfa86ea95489bb6fea9dfba00f435bca100d
- MD5 f32cdbe214217d6c30676acf807dd047
- SHA1 bce835800dab2d087b0058a342f9fc272af84311
- SHA512 02ca5b1656d19e054c45f6977231386f4ddc79df3ccf07f55471e1638b78b81812113f0291c043d54bd03d0b12e6b6c27f085fb90beb8b68bebd60f0e890e543
- SSDEEP 384:chZeFCCVEXb5SqZthlVSn+cwgrkVh/gbx13x3vfWVZWGl:EZeFCCVqb8qZzDSn+/g4vgXx/qDl
- TLSH T15F823B83BBE58837D2E242714EB23A6572EEE62C4A71DE5243600D0F2D79DC381B9753
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
CreateEventA
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
DeviceIoControl
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
GetOverlappedResult
CloseHandle
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetProcAddress
InitializeCriticalSection
CreateThread
InterlockedExchange
lstrlenW
GetModuleHandleW
CreateEventW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
msvcrt
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
advapi32
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
user32
wsprintfW
ole32
CoFreeUnusedLibraries
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
IIDFromString
CoCreateInstance
StringFromGUID2
oleaut32
SysStringLen
SysStringByteLen
SysFreeString
SysAllocString
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=11, id=25, version=9210,
count=81, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=13, id=29, version=9178,
count=1, id=61, version=9210,
gcdef.dll
- IMPHASH 3fc52270ad7ee22032b21464fecb39f8
- SHA256 fbb217771b57633d7b05aa0fb01ab580c930402cbe3323110fe91339bc7d3b0d
- MD5 45dea90300599245316b92b5b4815b89
- SHA1 7cf6279b61d0067faa4d8edc9dc35aec4ae6ffa7
- SHA512 b9a8ff99ab1c681ce6e19c07ba8925d7aefa6a65c6504f24f61d230721b87562e68eb850a5ab00a9b7d58ee83e5a4ed8bbe49b6b448d63a49c7485c2bc8b88b5
- SSDEEP 3072:HgfkFdp3GTFkzy1rZfCXVLBJH7JigE+2aoWct4/uPgTbd4Owp4sD7FgMSTVr5kfR:HM6cF
- TLSH T17C141211A3F8D109F0F3BB34A9BE8AA55E3BBC519B35C91DA754124E19B0E40DE62723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mfc42u
ord2971
ord3076
ord2980
ord3257
ord2854
ord4459
ord3254
ord3142
ord6238
ord823
ord4270
ord765
ord567
ord3693
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord3131
ord2977
ord5273
ord2116
ord2438
ord6051
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord825
msvcrt
??1type_info@@UAE@XZ
wcslen
__CxxFrameHandler
_ftol
?terminate@@YAXXZ
_except_handler3
dinput
DirectInputCreateW
user32
DestroyIcon
ChildWindowFromPoint
IsWindowVisible
GetMessageTime
GetCursorPos
CreateWindowExW
RegisterDeviceNotificationW
IsWindow
ScreenToClient
LoadImageW
MapWindowPoints
InvalidateRect
SetRect
GetSysColor
EnableWindow
RedrawWindow
GetWindowRect
GetSystemMetrics
MessageBoxW
WinHelpW
UnregisterClassW
DestroyWindow
SendMessageW
GetWindowDC
SetTimer
GetClientRect
LoadStringW
wsprintfW
GetParent
PostMessageW
GetDC
ReleaseDC
UnregisterDeviceNotification
KillTimer
SendDlgItemMessageW
SetWindowPos
GetDlgItem
SetWindowLongW
RegisterClassExW
DefWindowProcW
BeginPaint
GetWindowLongW
DrawIconEx
GetWindowTextW
DrawTextW
EndPaint
GetDlgCtrlID
gdi32
CreatePolygonRgn
DeleteDC
BitBlt
DPtoLP
SetMapMode
GetMapMode
SelectObject
CreateCompatibleDC
GetRgnBox
GetStockObject
SetBkColor
Ellipse
SetDCPenColor
SetViewportOrgEx
SetViewportExtEx
SetWindowExtEx
LineTo
MoveToEx
CreatePenIndirect
GetDeviceCaps
CreateFontW
CreateSolidBrush
ExtTextOutW
DeleteObject
SetBkMode
PaintRgn
SetTextColor
kernel32
InitializeCriticalSection
LocalFree
GetLastError
MulDiv
DeleteCriticalSection
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
LocalAlloc
LeaveCriticalSection
IsBadWritePtr
IsBadReadPtr
EnterCriticalSection
Sleep
lstrlenW
advapi32
RegQueryValueExW
RegCloseKey
comctl32
PropertySheetW
CreatePropertySheetPageW
shlwapi
StrCpyNW
StrDupW
StrNCatW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
168KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=28, version=9178,
count=4, id=64, version=9210,
count=16, id=25, version=9210,
count=3, id=4, version=8450,
count=151, id=1, productName=Unmarked objects,
count=1, id=11, version=8012,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=10, id=29, version=9178,
count=1, id=61, version=9210,
gcdef.xpg
- IMPHASH 3fc52270ad7ee22032b21464fecb39f8
- SHA256 12f6befcfacabe333ddc04ac643fe033f07f656b0b29310ca1910b055f2b9baa
- MD5 663988c1110ac436bb0ef18acfc9e262
- SHA1 4cd85ffb56b2c4c67c0d114d588498da8443c2a9
- SHA512 ba823c84070d65f052f10708ce3d21506a956033d0695311a85a726e73fc512f03a4d04db849b0ed061bd3c9ecf2bbae26739c059ce23bf0717ca15a0416ca98
- SSDEEP 3072:QzPCUGYVx8Rh/IFxkFN+d8J1ZnfX7kf5E+NutZ8G3yx3rZICiKX4cJHONXQvUX+:QLCZh/I
- TLSH T19F24FF15A3F89105F0F3BB3499BE87A55A3BBC51AF35C91DA654324E19B0E40CE62B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15309
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mfc42u
ord2971
ord3076
ord2980
ord3257
ord2854
ord4459
ord3254
ord3142
ord6238
ord823
ord4270
ord765
ord567
ord3693
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord3131
ord2977
ord5273
ord2116
ord2438
ord6051
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord825
msvcrt
??1type_info@@UAE@XZ
wcslen
__CxxFrameHandler
_ftol
?terminate@@YAXXZ
_except_handler3
dinput
DirectInputCreateW
user32
DestroyIcon
ChildWindowFromPoint
IsWindowVisible
GetMessageTime
GetCursorPos
CreateWindowExW
RegisterDeviceNotificationW
IsWindow
ScreenToClient
LoadImageW
MapWindowPoints
InvalidateRect
SetRect
GetSysColor
EnableWindow
RedrawWindow
GetWindowRect
GetSystemMetrics
MessageBoxW
WinHelpW
UnregisterClassW
DestroyWindow
SendMessageW
GetWindowDC
SetTimer
GetClientRect
LoadStringW
wsprintfW
GetParent
PostMessageW
GetDC
ReleaseDC
UnregisterDeviceNotification
KillTimer
SendDlgItemMessageW
SetWindowPos
GetDlgItem
SetWindowLongW
RegisterClassExW
DefWindowProcW
BeginPaint
GetWindowLongW
DrawIconEx
GetWindowTextW
DrawTextW
EndPaint
GetDlgCtrlID
gdi32
CreatePolygonRgn
DeleteDC
BitBlt
DPtoLP
SetMapMode
GetMapMode
SelectObject
CreateCompatibleDC
GetRgnBox
GetStockObject
SetBkColor
Ellipse
SetDCPenColor
SetViewportOrgEx
SetViewportExtEx
SetWindowExtEx
LineTo
MoveToEx
CreatePenIndirect
GetDeviceCaps
CreateFontW
CreateSolidBrush
ExtTextOutW
DeleteObject
SetBkMode
PaintRgn
SetTextColor
kernel32
InitializeCriticalSection
LocalFree
GetLastError
MulDiv
DeleteCriticalSection
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
LocalAlloc
LeaveCriticalSection
IsBadWritePtr
IsBadReadPtr
EnterCriticalSection
Sleep
lstrlenW
advapi32
RegQueryValueExW
RegCloseKey
comctl32
PropertySheetW
CreatePropertySheetPageW
shlwapi
StrCpyNW
StrDupW
StrNCatW
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=28, version=9178,
count=4, id=64, version=9210,
count=16, id=25, version=9210,
count=3, id=4, version=8450,
count=151, id=1, productName=Unmarked objects,
count=1, id=11, version=8012,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=10, id=29, version=9178,
count=1, id=61, version=9210,
joy.w2k
- IMPHASH d81675a4e5011c9ef7681b0dce9a2174
- SHA256 a1093e62fdce9d44e44eab0b1ec4276f7f10d339a19e50a85cbc6f2cbbcc4190
- MD5 46815f507955f52c716757ea491dea86
- SHA1 2d7f9b5baec7bc88319ce60a9b8866c10457095d
- SHA512 6695198c1c13fdbfc53db6df87f97989838b1b23c6eca6872faf9136f82ed73492f40412f8c1ed2c01c91975672d5962eb3be8e28ad7dfb95c1d259fd58a014d
- SSDEEP 3072:6+zbBiuiVCNo6u33ssmmx5Wf5ucjO9SRGaVSbsRbeJSG+mZMhxM8Fv64Dnz+EETl:94uoH6unssL4nmZ8xZFvj0WS
- TLSH T18E64DB21A3F88615F1F3AF34ADB917915E37BCA2EE39C60E5644624E1870E54DE24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
30003
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mfc42u
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord3257
ord4621
ord4418
ord3605
ord656
ord4270
ord3084
ord5977
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord6051
ord2371
ord2859
ord2854
ord3133
ord4294
ord1165
ord825
ord567
ord1644
ord2081
ord2455
ord823
ord4075
msvcrt
wcscat
__CxxFrameHandler
malloc
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_wcsdup
wcsncpy
free
wcslen
wcscmp
_wcsnicmp
wcschr
wcscpy
wcsncat
wcsncmp
ole32
CoFreeUnusedLibraries
CoUninitialize
CoGetClassObject
CoInitialize
CoCreateInstance
advapi32
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExA
RegEnumKeyExW
RegSetValueExA
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyW
dinput
DirectInputCreateW
kernel32
CreateMutexW
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
WideCharToMultiByte
MultiByteToWideChar
lstrcpyW
GetVersion
Sleep
DisableThreadLibraryCalls
GetVersionExW
lstrlenW
FindClose
CloseHandle
CreateProcessW
FindFirstFileW
ReleaseMutex
GetWindowsDirectoryW
user32
SetDlgItemTextW
LoadIconW
GetWindowTextW
EnableWindow
GetDC
ScreenToClient
SetForegroundWindow
MessageBeep
GetKeyState
UpdateWindow
RegisterWindowMessageW
KillTimer
MessageBoxW
wsprintfW
LoadStringW
SetCursor
LoadCursorW
SendMessageW
GetDlgItem
SendDlgItemMessageW
PostMessageW
IsWindow
RedrawWindow
SetWindowLongW
GetWindowLongW
ReleaseDC
GetWindowDC
DestroyIcon
EndDialog
LoadImageW
SetFocus
GetDlgItemTextW
SetWindowPos
CheckRadioButton
InvalidateRect
DestroyWindow
IsWindowVisible
DialogBoxParamW
GetParent
WinHelpW
DestroyMenu
TrackPopupMenu
ClientToScreen
GetClientRect
AppendMenuW
CreatePopupMenu
CallWindowProcW
GetWindowRect
GetSystemMetrics
IsDlgButtonChecked
UnregisterDeviceNotification
MapWindowPoints
RegisterDeviceNotificationW
ExitWindowsEx
IsWindowEnabled
GetFocus
SetTimer
gdi32
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
comctl32
CreatePropertySheetPageW
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
PropertySheetW
shell32
ExtractIconExW
CPlApplet
ShowJoyCPL
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
275KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=64, version=9210,
count=18, id=25, version=9210,
count=3, id=4, version=8450,
count=190, id=1, productName=Unmarked objects,
count=1, id=11, version=8012,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
joy.xpg
- IMPHASH 94221c7beb4a4be2e07d617b424cb6b5
- SHA256 075143957fa10a36a6a1a1cc757b5b5c41686e4d140f2d5ed7560f244019ec3d
- MD5 56ca1db6b017f64b0da4af9eb8b7542b
- SHA1 8596436b6dfb253fc8ff956973f80af307647b88
- SHA512 2486d4b13833f9a632fea70873067a4a60b0b6fc40be9d72d329df943890b4a948289ad4c76272666082e4bd286ca7dd4e28f5abb4423290bf7160f06871217a
- SSDEEP 3072:TTPSEseTkmIXeslb3X5OkrYbZCeM2Yqs5LXS0FqaHM3U80CdAz7iai0OXxnwkOP5:6uTTIr
- TLSH T140141D10A3F89615F1F36F3469B647914A3ABD52AD39C64E7A88325E1E30E44CE74B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
wcsncpy
_snwprintf
_wcsnicmp
wcscmp
wcsncmp
wcschr
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
msvcp60
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
ole32
CoFreeUnusedLibraries
CoInitialize
CoGetClassObject
CoUninitialize
advapi32
RegCloseKey
dinput8
DirectInput8Create
kernel32
LoadLibraryW
GetModuleFileNameW
GetProcAddress
CreateMutexW
GetWindowsDirectoryW
CreateProcessW
CloseHandle
GetModuleHandleW
SetLastError
IsBadReadPtr
lstrlenW
GetLastError
ReleaseMutex
DisableThreadLibraryCalls
user32
SetWindowPos
DialogBoxParamW
SetForegroundWindow
ExitWindowsEx
GetClientRect
KillTimer
SetTimer
GetDlgItem
LoadStringW
wsprintfW
MessageBoxW
GetWindowLongW
SendMessageW
WinHelpW
EndDialog
SetWindowLongW
InvalidateRect
EnableWindow
ShowWindow
GetDlgItemTextW
SetFocus
shlwapi
StrCatW
CPlApplet
ShowJoyCPL
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
174KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=4, id=64, version=9210,
count=89, id=1, productName=Unmarked objects,
count=15, id=25, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=5, id=28, version=9178,
count=4, id=29, version=9178,
count=1, id=61, version=9210,
ks.inf
- SHA256 b9298854d34560acff3ad7fb3a8abe902f80a3d06a1a854189cf4695f0d0792a
- MD5 bc517470ebe7e36db27398a1394ff831
- SHA1 69ff3a23aafa2e549f8615b03dd9b64a0d136b6b
- SHA512 7d179e7eb77ee91e7b8e2226213753599cf67df817d0dc86730f3589341ca3ca7d8c2311092fd89f93fbc1a8dfb92aba274fdf3f73d009f036a76b217f8ba99f
- SSDEEP 384:3AEvRGpiNcJxGMDhX1erbBZjJlUVyl3ntDynwYOV8Wzzpbt3KD/uO5E1BBeyQQ:3ATGMDhX1eJZjfynwJHRGuJP0yF
- TLSH T1D7F2D11E930D8913E20C72C0F7D12DC7709A509ED0E052AE7B26DA9E685EE96451CF7F
- MD5 SHA1 SHA512 SSDEEP TLSH
ks.sys
- IMPHASH 799c7065e0973a0f7a80b1e4089df3f8
- SHA256 ba790438ca8b68e88fb9fabf12e8e7b54c432a7bc946d71c0e57bc8a35f8dfcf
- MD5 dc197a88746a55ae60d1c81d45cd1b4a
- SHA1 8fac5067d9507a8582b5ab61af5e3d5082a886cc
- SHA512 58b120c32fa5cd778ee08b41a126d4a2bc448a1fae3d560f00b9ef55c25e5f26f7279061792537d9a022d3e050a3ae4a591948923a3a9a02a262341c6be67ec3
- SSDEEP 3072:Aahi+EhdvTSVFsmyaa0tCxB62xIVhgeUiT6g0iZVTXJV:cdvTs/BtCnxcHTKinTX
- TLSH T1C3D38C23B2C5443AD19323F19F0E336F73775311172AA25746246EE13ABA901FD2A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
119975
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ks.pdb
ntoskrnl.exe
ExDeletePagedLookasideList
ExFreeToPagedLookasideList
ExAllocateFromPagedLookasideList
ExInitializePagedLookasideList
KeInitializeSpinLock
ProbeForRead
IofCallDriver
IoBuildSynchronousFsdRequest
ZwClose
ExFreePoolWithTag
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
RtlFreeUnicodeString
wcscat
wcscpy
RtlStringFromGUID
SeReleaseSubjectContext
SeAssignSecurity
IoGetFileObjectGenericMapping
SeCaptureSubjectContext
IoGetRelatedDeviceObject
ObfReferenceObject
IoBuildDeviceIoControlRequest
ExGetPreviousMode
ZwEnumerateValueKey
ZwSetValueKey
RtlCompareMemory
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
ZwCreateKey
RtlAppendUnicodeToString
RtlCopyUnicodeString
ExQueueWorkItem
swprintf
wcslen
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
IoSetDeviceInterfaceState
KeSetTimer
IoInvalidateDeviceRelations
ExAllocatePoolWithQuotaTag
ProbeForWrite
IoGetDeviceProperty
KeBugCheckEx
ZwEnumerateKey
ZwQueryKey
IoRegisterDeviceInterface
RtlGUIDFromString
_wcsicmp
IoDeleteDevice
IoCreateDevice
ZwDeleteKey
IoDetachDevice
IoAttachDeviceToDeviceStack
KeInitializeDpc
KeInitializeTimer
_wcsnicmp
SeSinglePrivilegeCheck
KeCancelTimer
KeSetTimerEx
ExInterlockedCompareExchange64
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
ExInitializeNPagedLookasideList
KeInitializeTimerEx
KeReleaseMutex
KeSynchronizeExecution
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeSetImportanceDpc
ObfDereferenceObject
KeRemoveQueueDpc
KeReleaseSemaphore
KeInsertQueueDpc
ExEventObjectType
ObReferenceObjectByHandle
ExSemaphoreObjectType
ExAcquireResourceSharedLite
PoCallDriver
PoStartNextPowerIrp
KeGetCurrentThread
ExInitializeResourceLite
ExDeleteResourceLite
RtlCompareUnicodeString
IoCreateFile
RtlMapGenericMask
SeUnlockSubjectContext
SeOpenObjectAuditAlarm
SeFreePrivileges
SeAppendPrivileges
SeAccessCheck
SeLockSubjectContext
SeQuerySecurityDescriptorInfo
SeSetSecurityDescriptorInfo
MmMapLockedPages
KeClearEvent
ExRaiseStatus
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
ExfInterlockedRemoveHeadList
ExfInterlockedInsertTailList
LdrAccessResource
LdrFindResource_U
IoOpenDeviceRegistryKey
KeInitializeMutex
IoFileObjectType
IoGetDeviceInterfaces
IoAllocateDriverObjectExtension
IoGetDriverObjectExtension
IoFreeIrp
IoAllocateIrp
_snwprintf
IoAllocateAdapterChannel
PoUnregisterSystemState
PoRegisterSystemState
IoIsWdmVersionAvailable
PoRequestPowerIrp
PoSetPowerState
IoOpenDeviceInterfaceRegistryKey
memmove
KeReadStateMutex
KeResetEvent
KeQuerySystemTime
MmMapLockedPagesSpecifyCache
_except_handler3
KeTickCount
ExDeleteNPagedLookasideList
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
IofCompleteRequest
InterlockedIncrement
InterlockedDecrement
ExFreePool
ExAllocatePoolWithTag
ExInterlockedPushEntrySList
KeQueryTimeIncrement
ExInterlockedPopEntrySList
hal
KfLowerIrql
IoFlushAdapterBuffers
IoFreeMapRegisters
IoMapTransfer
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
KfRaiseIrql
??0CBaseUnknown@@QAE@ABU_GUID@@PAUIUnknown@@@Z
??0CBaseUnknown@@QAE@PAUIUnknown@@@Z
??1CBaseUnknown@@UAE@XZ
??_FCBaseUnknown@@QAEXXZ
?IndirectedAddRef@CBaseUnknown@@UAGKXZ
?IndirectedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?IndirectedRelease@CBaseUnknown@@UAGKXZ
?NonDelegatedAddRef@CBaseUnknown@@UAGKXZ
?NonDelegatedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z
?NonDelegatedRelease@CBaseUnknown@@UAGKXZ
DllInitialize
KoCreateInstance
KoDeviceInitialize
KoDriverInitialize
KoRelease
KsAcquireControl
KsAcquireDevice
KsAcquireDeviceSecurityLock
KsAcquireResetValue
KsAddDevice
KsAddEvent
KsAddIrpToCancelableQueue
KsAddItemToObjectBag
KsAddObjectCreateItemToDeviceHeader
KsAddObjectCreateItemToObjectHeader
KsAllocateDefaultClock
KsAllocateDefaultClockEx
KsAllocateDeviceHeader
KsAllocateExtraData
KsAllocateObjectBag
KsAllocateObjectCreateItem
KsAllocateObjectHeader
KsCacheMedium
KsCancelIo
KsCancelRoutine
KsCompletePendingRequest
KsCopyObjectBagItems
KsCreateAllocator
KsCreateBusEnumObject
KsCreateClock
KsCreateDefaultAllocator
KsCreateDefaultAllocatorEx
KsCreateDefaultClock
KsCreateDefaultSecurity
KsCreateDevice
KsCreateFilterFactory
KsCreatePin
KsCreateTopologyNode
KsDecrementCountedWorker
KsDefaultAddEventHandler
KsDefaultDeviceIoCompletion
KsDefaultDispatchPnp
KsDefaultDispatchPower
KsDefaultForwardIrp
KsDereferenceBusObject
KsDereferenceSoftwareBusObject
KsDeviceGetBusData
KsDeviceRegisterAdapterObject
KsDeviceSetBusData
KsDisableEvent
KsDiscardEvent
KsDispatchFastIoDeviceControlFailure
KsDispatchFastReadFailure
KsDispatchInvalidDeviceRequest
KsDispatchIrp
KsDispatchQuerySecurity
KsDispatchSetSecurity
KsDispatchSpecificMethod
KsDispatchSpecificProperty
KsEnableEvent
KsEnableEventWithAllocator
KsFastMethodHandler
KsFastPropertyHandler
KsFilterAcquireProcessingMutex
KsFilterAddTopologyConnections
KsFilterAttemptProcessing
KsFilterCreateNode
KsFilterCreatePinFactory
KsFilterFactoryAddCreateItem
KsFilterFactoryGetSymbolicLink
KsFilterFactorySetDeviceClassesState
KsFilterFactoryUpdateCacheData
KsFilterGetAndGate
KsFilterGetChildPinCount
KsFilterGetFirstChildPin
KsFilterRegisterPowerCallbacks
KsFilterReleaseProcessingMutex
KsForwardAndCatchIrp
KsForwardIrp
KsFreeDefaultClock
KsFreeDeviceHeader
KsFreeEventList
KsFreeObjectBag
KsFreeObjectCreateItem
KsFreeObjectCreateItemsByContext
KsFreeObjectHeader
KsGenerateDataEvent
KsGenerateEvent
KsGenerateEventList
KsGenerateEvents
KsGetBusEnumIdentifier
KsGetBusEnumParentFDOFromChildPDO
KsGetBusEnumPnpDeviceObject
KsGetDefaultClockState
KsGetDefaultClockTime
KsGetDevice
KsGetDeviceForDeviceObject
KsGetFilterFromIrp
KsGetFirstChild
KsGetImageNameAndResourceId
KsGetNextSibling
KsGetNodeIdFromIrp
KsGetObjectFromFileObject
KsGetObjectTypeFromFileObject
KsGetObjectTypeFromIrp
KsGetOuterUnknown
KsGetParent
KsGetPinFromIrp
KsHandleSizedListQuery
KsIncrementCountedWorker
KsInitializeDevice
KsInitializeDriver
KsInstallBusEnumInterface
KsIsBusEnumChildDevice
KsLoadResource
KsMapModuleName
KsMergeAutomationTables
KsMethodHandler
KsMethodHandlerWithAllocator
KsMoveIrpsOnCancelableQueue
KsNullDriverUnload
KsPinAcquireProcessingMutex
KsPinAttachAndGate
KsPinAttachOrGate
KsPinAttemptProcessing
KsPinDataIntersection
KsPinGetAndGate
KsPinGetAvailableByteCount
KsPinGetConnectedFilterInterface
KsPinGetConnectedPinDeviceObject
KsPinGetConnectedPinFileObject
KsPinGetConnectedPinInterface
KsPinGetCopyRelationships
KsPinGetFirstCloneStreamPointer
KsPinGetLeadingEdgeStreamPointer
KsPinGetNextSiblingPin
KsPinGetParentFilter
KsPinGetReferenceClockInterface
KsPinGetTrailingEdgeStreamPointer
KsPinPropertyHandler
KsPinRegisterFrameReturnCallback
KsPinRegisterHandshakeCallback
KsPinRegisterIrpCompletionCallback
KsPinRegisterPowerCallbacks
KsPinReleaseProcessingMutex
KsPinSetPinClockTime
KsPinSubmitFrame
KsPinSubmitFrameMdl
KsProbeStreamIrp
KsProcessPinUpdate
KsPropertyHandler
KsPropertyHandlerWithAllocator
KsQueryDevicePnpObject
KsQueryInformationFile
KsQueryObjectAccessMask
KsQueryObjectCreateItem
KsQueueWorkItem
KsReadFile
KsRecalculateStackDepth
KsReferenceBusObject
KsReferenceSoftwareBusObject
KsRegisterAggregatedClientUnknown
KsRegisterCountedWorker
KsRegisterFilterWithNoKSPins
KsRegisterWorker
KsReleaseControl
KsReleaseDevice
KsReleaseDeviceSecurityLock
KsReleaseIrpOnCancelableQueue
KsRemoveBusEnumInterface
KsRemoveIrpFromCancelableQueue
KsRemoveItemFromObjectBag
KsRemoveSpecificIrpFromCancelableQueue
KsServiceBusEnumCreateRequest
KsServiceBusEnumPnpRequest
KsSetDefaultClockState
KsSetDefaultClockTime
KsSetDevicePnpAndBaseObject
KsSetInformationFile
KsSetMajorFunctionHandler
KsSetPowerDispatch
KsSetTargetDeviceObject
KsSetTargetState
KsStreamIo
KsStreamPointerAdvance
KsStreamPointerAdvanceOffsets
KsStreamPointerAdvanceOffsetsAndUnlock
KsStreamPointerCancelTimeout
KsStreamPointerClone
KsStreamPointerDelete
KsStreamPointerGetIrp
KsStreamPointerGetMdl
KsStreamPointerGetNextClone
KsStreamPointerLock
KsStreamPointerScheduleTimeout
KsStreamPointerSetStatusCode
KsStreamPointerUnlock
KsSynchronousIoControlDevice
KsTerminateDevice
KsTopologyPropertyHandler
KsUnregisterWorker
KsUnserializeObjectPropertiesFromRegistry
KsValidateAllocatorCreateRequest
KsValidateAllocatorFramingEx
KsValidateClockCreateRequest
KsValidateConnectRequest
KsValidateTopologyNodeCreateRequest
KsWriteFile
KsiDefaultClockAddMarkEvent
KsiPropertyDefaultClockGetCorrelatedPhysicalTime
KsiPropertyDefaultClockGetCorrelatedTime
KsiPropertyDefaultClockGetFunctionTable
KsiPropertyDefaultClockGetPhysicalTime
KsiPropertyDefaultClockGetResolution
KsiPropertyDefaultClockGetState
KsiPropertyDefaultClockGetTime
KsiQueryObjectCreateItemsPresent
_KsEdit
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=156, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=5, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=16, id=28, version=9178,
count=12, id=29, version=9178,
count=1, id=61, version=9210,
kscaptur.inf
- SHA256 8e277c581c0562401fb8551875a11b5498fcf41b98e27d592c14ae5e6b75bfb4
- MD5 d9eee85cf7e9d861c91ba68fba82e3c7
- SHA1 01cdae51360a2c2f0c6d29cccf6d119862819870
- SHA512 e06c8ae3f79230b79484ed8466114181367d5e29b3ee196c1f127a0e0bc1e977f624f5307179dafc658dd20211bba1a5d7386b809f2874097cbac327b337c873
- SSDEEP 384:tbPDGYVv871qlvsuPrk1agj6o5aOO0Bs9Ck3omF8Fw7tvy0AeSyaLQ:tbPDGulvsuDk0ZOO0Bswsh6cSy+Q
- TLSH T1DDA2660B831B8963D18592B8F7931EC77084719B41F1916E3B75CA1A34DFDF4882E9EA
- MD5 SHA1 SHA512 SSDEEP TLSH
ksfilter.inf
- SHA256 adb323c722db57e00e6154812d989ebd96210fa1f38bcac261fa608f0f4316c8
- MD5 1a7ab501fe7b9054c7f7649239260dc3
- SHA1 c11efd706ea9105d427260ec0ab89361b5e5c44a
- SHA512 3676b551f24275ba771d4c4ea86af48e13041f03e7a94dcfa6e2af9dda38a177099fdf9499f59e3e3eb34937037e800f03e340fff3596cf045f42852875e2baf
- SSDEEP 192:s0fo0Qo80OcIMNOwSltw3/RwN76wgolFwrYKynddTylQwtXsLBhI:Ko80OcIMNOZ72/RC76UbCYlnddTyCOs0
- TLSH T10222125E4E870876B148E7ACA8D76BC3E6053063B2CC09143D4BE9457DCA9D8623DAFC
- MD5 SHA1 SHA512 SSDEEP TLSH
ksolay.ax
- IMPHASH a3fd6dc1b0adee45584d8de85cd8c504
- SHA256 ce55994b6e475483de09f6bcf32e65b0ff4218a0b38d6ea81d0d13b950eea52b
- MD5 02f14573a629d63340ba1898c29494a8
- SHA1 1582d7cd94e4b50ffd18d1507bebb55bbf783888
- SHA512 178b8ba78b9a621059c134546015555ec4696abf89887d2ee5b75ca96692e15fbcf2e1a2686da01f8f9c42eb9aa518b300ffab7736e79008bca61b8c1c868089
- SSDEEP 192:VwrIwyBBWD84aT1BARN2Hca60rLtgI/6yixTvjgQA8TWWfWA:V+894hH2HRgI/63x/g4WWfWA
- TLSH T1DC421901A3D95473E3F34BB56AF5176B33B9BA385BBFA3098920051A1EB4D26D530712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7420
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
lstrlenW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetVersionExW
GetTickCount
QueryPerformanceCounter
GetLastError
ksproxy.ax
KsSynchronousDeviceControl
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
wcscpy
wcslen
wcscmp
advapi32
RegSetValueW
RegCloseKey
RegEnumKeyExW
RegCreateKeyW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
user32
BeginPaint
ShowCursor
GetDC
GetClientRect
UnregisterClassW
DefWindowProcW
ReleaseDC
EndPaint
wsprintfW
GetMonitorInfoW
EnumDisplaySettingsW
EnumDisplayDevicesW
SendMessageW
DestroyWindow
RegisterClassExW
CreateWindowExW
gdi32
ExtTextOutW
SetBkColor
ole32
CoInitialize
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
CoCreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=15, id=25, version=9210,
count=96, id=1, productName=Unmarked objects,
count=6, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=9, id=29, version=9178,
count=1, id=61, version=9210,
ksproxy.ax
- IMPHASH 29fd22e5424a4c4f251c5cc8a8b9d534
- SHA256 72afc310cf5f55408182e16824b9571c538d5f978a43e6cb4ee217caa8a8a424
- MD5 8e6c3624d605770f942391b8000dd3f0
- SHA1 5f9c35006344e013f354b6e00a6ec4aeafb2280d
- SHA512 0452694fb1e17ede8367dfadf03c4ac4eecb2b9e09f759bf17abe41e5495b51e6935d10e5fb52942bb295eb87b2ef04eebd76201995b72167a64f9e141c06724
- SSDEEP 3072:+bSMc74NUOJVDoll2flUZnYGg1Zw+W5DhfrSxKK:+bSM04N/Jpo6dUZYGEK+WvSx
- TLSH T10AB3495373F780F7C25302B29DB9B3FAA2F6D6201A2AD64657140F092F60952E73DA17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
85926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
wcscpy
??3@YAXPAX@Z
memmove
swscanf
swprintf
_ftol
_purecall
_except_handler3
_CIpow
wcslen
??2@YAPAXI@Z
kernel32
InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetLastError
CreateEventW
CloseHandle
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CreateThread
CreateFileW
ReleaseSemaphore
InterlockedExchange
CreateSemaphoreW
InterlockedDecrement
DeviceIoControl
InterlockedIncrement
ResetEvent
GetOverlappedResult
CreateMutexW
ReleaseMutex
GetHandleInformation
GetVersionExW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryW
lstrlenW
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
lstrcpynW
WaitForMultipleObjects
WaitForSingleObject
GetSystemInfo
VirtualFree
VirtualAlloc
GetProcAddress
ResumeThread
SetThreadPriority
advapi32
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyW
user32
wsprintfW
ole32
StringFromGUID2
IIDFromString
CoCreateInstance
CoTaskMemAlloc
CoFreeUnusedLibraries
CoInitialize
CoTaskMemFree
CoUninitialize
oleaut32
SysFreeString
setupapi
SetupDiOpenDeviceInterfaceW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInterfaceAlias
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiOpenDeviceInterfaceRegKey
SetupDiCreateDeviceInfoListExW
SetupDiGetClassDevsW
ksuser
KsCreateAllocator
KsCreateClock
KsCreateTopologyNode
KsCreatePin
ntdll
RtlNtStatusToDosError
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
KsGetMediaType
KsGetMediaTypeCount
KsGetMultiplePinFactoryItems
KsOpenDefaultDevice
KsResolveRequiredAttributes
KsSynchronousDeviceControl
Name
.text
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=104, id=1, productName=Unmarked objects,
count=17, id=25, version=9210,
count=5, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=23, id=29, version=9178,
count=1, id=61, version=9210,
ksreg.inf
- SHA256 042347904c4abcf01e1ce4025bccb8b8b18269f0b7d86a3f21850c591817e94c
- MD5 5a65d9e1d248976c5b9d17aef3ac8dc4
- SHA1 47825826e88edb62e453474c9f2bb154611ed241
- SHA512 456f51e18bcbe4900ebe65ff8297b3911bb9ef350d08a71fb7260af5a26df49019fbe8a30a472986787c124b541c0ec8704e0b88e7be91efb9c834a2a1e5be39
- SSDEEP 384:3OEvRGpiNcJxGMDhX1erbBZjJlUVyl3ntDynwYOV8Wzzpbt3KD/uO5E1BBeyQQ:3OTGMDhX1eJZjfynwJHRGuJP0yF
- TLSH T1BDF2D11E930D8913E20C72C0F7D12DC7709A509ED0E052AE7B26DA9E685EE9A451CF7F
- MD5 SHA1 SHA512 SSDEEP TLSH
ksuser.dll
- IMPHASH 407f14f3ab3229ce994109fc31901c00
- SHA256 1cb2339f19f58f0631a043f1debf39265d8a33170a5c06b3be576e606fd12e74
- MD5 15914e0bf4dda56cf797993dccb637d1
- SHA1 9c8ee02f146f3efb6fc977f0f06e7849d3b2f72a
- SHA512 29e690ba9375f97f2f415549e3881bbaa62edc9d1fe682144d02afe4e6136ac28524c490934dd2e2b1830d919b8e959b025c8543b0add48c177eca9eee8c5d0e
- TLSH T1A381635553F80426F0F78F70DBF20B5BA17E7C24AA6A8E690990175B3C61A11CA31F3E
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapAlloc
GetProcessHeap
HeapFree
ntdll
NtCreateFile
RtlNtStatusToDosError
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
50B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=25, version=9210,
count=5, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=1, id=61, version=9210,
l3codecx.ax
- IMPHASH d7e8a0cc68dc418d56e7942bed824e2d
- SHA256 b5c87e6604585feff04e67f82a5a2e562f51efbf21d49841e6077790cd4ab2c7
- MD5 938b396850b318cae7ffb7380091ccbe
- SHA1 469403f7cb3b35ae1bc6944d874ec5cb19bcce06
- SHA512 8af1f6a5ead49176590daaaa1ad7d63bcab4fd7d6cc039f191b5e85bd1082d8d32e90018017a7c38c3122e19ad03b95656f127a8a635963c360e350401acf145
- SSDEEP 1536:znO7U7L8+AkxhnMOejOIOAZM2nrREegqB7v9lCDLU:DiUE+hnMOejOIOAGMrRHgqN9lULU
- TLSH T1D5836B42BAC346B1EABF65B504EB2237E738EA412514CD277B1CC5663833160ABD735E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36687
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_CIpow
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
kernel32
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
GetVersionExA
FreeLibrary
InterlockedDecrement
GetLastError
MulDiv
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
advapi32
RegEnumKeyExA
RegSetValueA
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegCreateKeyA
RegOpenKeyExA
user32
SetDlgItemTextA
wsprintfA
GetSysColor
KillTimer
SetTimer
SetDlgItemInt
GetWindowLongA
SetWindowLongA
CreateDialogParamA
MoveWindow
InvalidateRect
DestroyWindow
DefWindowProcA
CheckRadioButton
LoadStringA
LoadStringW
GetWindowRect
GetDesktopWindow
GetDlgItem
ShowWindow
EnableWindow
gdi32
DeleteObject
SetTextColor
CreateSolidBrush
SetBkColor
ole32
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoFreeUnusedLibraries
CoInitialize
CoTaskMemFree
StringFromGUID2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=167, productName=Unmarked objects (old),
count=1, id=6, version=1668,
count=8, id=2, version=7303,
mciqtz32.dll
- IMPHASH a6a29e19932abf7e264745f7249bd231
- SHA256 5fc314830f0a4f4176c8fd079f42e3b53fe72cfac9f167783fe6047cc78a5f84
- MD5 d2de8daba14979d79e54e2a040403a19
- SHA1 03d1cc87926d753c96fbb8e8217b6cfeb1d68a35
- SHA512 6fa130cfdf74ce7201e555e26a6805b091935c017752e88300972a2e0b0152239ec854dc1965eaf407fcc68550c24e02c95ec9cb0f40d8f81eaeca40cede2cb8
- SSDEEP 768:qRj+M4DK2hjcQJUBYrLaWwLwvNp792ioNx9Xu:1DRcFocwvn8DRXu
- TLSH T158F26052A7F84A77F1F30F7188762621327ABCB56A37D28F1A45025D1E727818E74B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19884
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LocalAlloc
lstrlenW
lstrcpynW
GetProcAddress
MulDiv
MultiByteToWideChar
lstrlenA
lstrcpyW
DisableThreadLibraryCalls
GetModuleHandleA
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalFree
CreateEventW
CreateThread
WaitForMultipleObjects
CloseHandle
SetEvent
ResetEvent
GetModuleHandleW
WaitForSingleObject
user32
ScreenToClient
GetSystemMetrics
SetWindowTextW
SetForegroundWindow
UnregisterClassW
DestroyWindow
WindowFromDC
EndPaint
BeginPaint
DefWindowProcW
SetWindowLongW
RegisterClassW
LoadCursorW
GetWindowLongW
PostMessageW
LoadStringW
InSendMessage
GetWindowTextW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
GetClientRect
CreateWindowExW
GetWindowRect
AdjustWindowRect
IsWindow
IsIconic
IsZoomed
ShowWindow
IsWindowVisible
SetWindowPos
SendMessageW
SetRectEmpty
winmm
mciFreeCommandResource
GetDriverModuleHandle
DefDriverProc
mciGetDriverData
mciLoadCommandResource
mciSetDriverData
mciDriverYield
ole32
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
gdi32
CreatePalette
GetObjectType
SetStretchBltMode
SelectPalette
RealizePalette
StretchDIBits
GetStockObject
DeleteObject
quartz
DBToAmpFactor
AmpFactorToDB
DriverProc
MCIEntry32
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=64, version=9210,
count=13, id=25, version=9210,
count=88, id=1, productName=Unmarked objects,
count=5, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=8, id=29, version=9178,
count=1, id=61, version=9210,
mpg2splt.ax
- IMPHASH 5d049fe11c3e4153abd49378531fbbd9
- SHA256 97789ac30f17945031b553a1f02f8123f600789330cb291f2f3d8eb36a9015a4
- MD5 1f3286d4feb80e74fe6c362ecea23215
- SHA1 b17825811c4a60f3537536705d26b864de00f330
- SHA512 98b5f6bac1630952e84a4f4d2cf71f22df87468f0a199631ad9b4d20ff934a708347850c9cbff9eebde1f3afe08bccdd6be8f1329f21b253b337db1965990880
- SSDEEP 3072:IHtYrlo1vrJ2qdU5FuF08311nsPWfzK7lUyKMbd7xZuxW:Iyry1vrXpFdn7LILxMx
- TLSH T1EBD38D9373D280BAC3D332734A76377AA7EBD7141A39966347613C496B2544AE23E313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceFrequency
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MulDiv
CreateThread
SetThreadPriority
InterlockedExchange
lstrcpyW
VirtualAlloc
CreateSemaphoreW
lstrcmpW
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
WaitForMultipleObjects
ResetEvent
SetEvent
CreateEventW
CloseHandle
lstrcpynW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetModuleHandleW
GetVersionExW
lstrlenW
MultiByteToWideChar
lstrlenA
GetLastError
GetModuleFileNameA
msvcrt
_purecall
_wcsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
wcslen
wcscpy
_except_handler3
_itow
malloc
free
_ftol
qsort
memmove
user32
wsprintfW
advapi32
RegCreateKeyExW
RegQueryValueExW
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
ole32
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
winmm
timeBeginPeriod
timeGetTime
timeGetDevCaps
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=9, id=64, version=9210,
count=11, id=25, version=9210,
count=102, id=1, productName=Unmarked objects,
count=8, id=28, version=9178,
count=1, id=63, version=9210,
count=38, id=29, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
msdmo.dll
- IMPHASH 19b6ba09daee0b1fa5b47610e9903183
- SHA256 d8386ab77c4293a1c3700beb663e2298324803314ee9c8ed50c880aa795905b0
- MD5 5f2a1317fab96fe887447e5fd96838b7
- SHA1 b8ff2f10bac16d693187a9078cd92038b160e0ce
- SHA512 bf1e8b9d52674edb57e18799502b782b0d764b13524849a31a9c5b3a9008a2c1ac9bdb363a2d81e287350c4474c5357005ed4cf0d8d0bce3b82746e3e49b714a
- SSDEEP 384:Pv1uONkqOKUuun/ObWDUQ6JBj/IidxuVj1uWXjioxnLWVqG:Pv17NdY+kEJ+idxuVj1BLxuq
- TLSH T165520802B6E5121BE2E38A75A2F1132753FAE9215C31ED1AC610064F3675F53EBB8B13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TerminateProcess
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
Sleep
GetCurrentProcess
lstrlenW
msvcrt
wcscat
??3@YAXPAX@Z
_adjust_fdiv
_initterm
swprintf
sprintf
wcslen
wcscpy
realloc
free
malloc
??2@YAPAXI@Z
sscanf
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
advapi32
RegDeleteKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegOpenKeyW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegSetValueW
RegQueryValueW
RegCloseKey
user32
wsprintfW
DMOEnum
DMOGetName
DMOGetTypes
DMOGuidToStrA
DMOGuidToStrW
DMORegister
DMOStrToGuidA
DMOStrToGuidW
DMOUnregister
MoCopyMediaType
MoCreateMediaType
MoDeleteMediaType
MoDuplicateMediaType
MoFreeMediaType
MoInitMediaType
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
562B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=25, version=9412,
count=9, id=25, version=9210,
count=46, id=1, productName=Unmarked objects,
count=11, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=4, id=29, version=9178,
count=1, id=61, version=9210,
mskssrv.sys
- IMPHASH ae7af65c91def368b78cf6daaa295831
- SHA256 dd144a4befc670cc3d874cf690b8ca407d1fdab07e0e2c23d042c6d454a4d8a1
- MD5 85736f804191cb420a31aca2a7f0674f
- SHA1 3ff53fe75b2f227028e5849c4d02693d3be99573
- SHA512 82f42f7e1ab5cba7ca795e17787c268ebdf18c68b0d89426e2e382ac9919888a5e01d5bbd309d4218f1c66f2c323572fc2400ac22e93d0ce3e4a68323b986ea7
- SSDEEP 192:MojRsr0NvszGqoaSFE9NTca5rxHO1Isl5bym0WNAwWPH:MoCzGjaSFEvga5Ry5WpWNAwW
- TLSH T1E5E1CA52F7E85527F0B309F4AE97462BD2E3A8125DB0871E59501B4D29BCF04AF32B17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4949
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mskssrv.pdb
ntoskrnl.exe
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
ExFreePool
ExAllocatePoolWithTag
memmove
RtlCompareMemory
ObfDereferenceObject
ZwSetValueKey
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
ZwQueryValueKey
IoOpenDeviceInterfaceRegistryKey
RtlInitUnicodeString
IofCompleteRequest
KeTickCount
KeBugCheckEx
ks.sys
KsQueryDevicePnpObject
KsSetDevicePnpAndBaseObject
KsAllocateDeviceHeader
KsSynchronousIoControlDevice
KsCacheMedium
KsDereferenceSoftwareBusObject
KsAllocateObjectHeader
KsReferenceSoftwareBusObject
KsFreeObjectHeader
KsPropertyHandler
KsNullDriverUnload
KsSetMajorFunctionHandler
KsDefaultForwardIrp
KsDefaultDispatchPower
KsDefaultDispatchPnp
Name
.text
Size
384B
Virtual Size
316B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
384B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=1, id=61, version=9210,
mspclock.sys
- IMPHASH 80ceafa87487c2a1e5e0a913df0055d1
- SHA256 4730d20e07329885ac2b00d41a5fad581bff2389a25fdde375cf2ff92259a8a1
- MD5 e943adb93d83c5cbc0ca3f53f53b48cc
- SHA1 f7e23473cf5621ff48012697098740cc89640fba
- SHA512 0a6844cad5d0c8e57248be0e374f24a18820eb841573ebb78a219a6b96df3506e0ecc4416525b83137a7ba5f3462fe47c7c193ad2b67ca4daadaf0737b8d693d
- SSDEEP 96:Hd4d6Jh12+EXq2mCF5BcklFraJowayWViWwjosn:9xLMv62mevD5fyWViW8r
- TLSH T1BFB183A2B3EC6E01E4B619B08CDF2B17A2772C119D74EB0206444B7C3D2A910BD95B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2645
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mspclock.pdb
ntoskrnl.exe
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
IofCompleteRequest
ExFreePool
KeInitializeEvent
ExAllocatePoolWithTag
KeTickCount
ks.sys
KsiDefaultClockAddMarkEvent
KsiPropertyDefaultClockGetFunctionTable
KsiPropertyDefaultClockGetState
KsiPropertyDefaultClockGetResolution
KsiPropertyDefaultClockGetCorrelatedPhysicalTime
KsiPropertyDefaultClockGetCorrelatedTime
KsiPropertyDefaultClockGetPhysicalTime
KsiPropertyDefaultClockGetTime
KsSetDevicePnpAndBaseObject
KsAllocateDeviceHeader
KsSetDefaultClockTime
KsSetDefaultClockState
KsDereferenceSoftwareBusObject
KsAllocateObjectHeader
KsAllocateDefaultClock
KsReferenceSoftwareBusObject
KsFreeObjectHeader
KsFreeDefaultClock
KsFreeEventList
KsPropertyHandler
KsEnableEvent
KsDisableEvent
KsNullDriverUnload
KsSetMajorFunctionHandler
KsDefaultForwardIrp
KsDefaultDispatchPower
KsDefaultDispatchPnp
Name
.text
Size
128B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=4, id=28, version=9178,
count=1, id=61, version=9210,
mspqm.sys
- IMPHASH 379ad7346b38b027988675ecb0316f3c
- SHA256 915f4d83f37872cb1222bdbb055bbff7f190b12b4acb792e0627b99e037c866f
- MD5 f6a726b8832db1f88326b8be98b11981
- SHA1 6a80150e52ee8b686e8511a451b0f7b07295f6a0
- SHA512 16ef9296d09a4bdfeb63da11337808cb46129de4f7d8493549b173c567974c5db0d5dd62b969696c6ae7a78a8cb105a7519a25c33571305ab3e02492910d0f55
- SSDEEP 96:DD+EKHekJT8h6RImfkQmy8LZWgOuZwWwU/:v+EKHTW6RImVmyUWeZwWX/
- TLSH T15991B68173DAAA57E0F69AB119EB230771377C208A319F39164C1A1C2FB7660FC15B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mspqm.pdb
ntoskrnl.exe
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
IofCompleteRequest
ExAllocatePoolWithTag
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
ExFreePool
KeInitializeEvent
KeInitializeSpinLock
ks.sys
KsSetDevicePnpAndBaseObject
KsAllocateDeviceHeader
KsDispatchSpecificProperty
KsRemoveIrpFromCancelableQueue
KsAddIrpToCancelableQueue
KsDereferenceSoftwareBusObject
KsAllocateObjectHeader
KsReferenceSoftwareBusObject
KsFreeObjectHeader
KsCancelIo
KsPropertyHandler
KsNullDriverUnload
KsSetMajorFunctionHandler
KsDefaultForwardIrp
KsDefaultDispatchPower
KsDefaultDispatchPnp
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
982B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=1, id=61, version=9210,
mstee.sys
- IMPHASH ba17250f7c9c0536bc777562ff599d7c
- SHA256 d551d7df5736847caf1c7c48470035a4aabc6fb7cf7512db11c6c9c9898d83ed
- MD5 d5059366b361f0e1124753447af08aa2
- SHA1 aa5f775c386d70d16d97832119f3c618d6ca36b7
- SHA512 ff5824332a973a355e5dbff37e48edaf854ea4bac8cb2fd9e8026f1790a49c1e21a8ea31dd47673324385bc6da5b537866ed892336711b835e76d66c84f8336a
- SSDEEP 96:T/4ddiILzpAjlDG3Dp7eG8AvC7RTXsHW7RwWw:rYdiILzpAjlDG3Dp7eG8AvKYHW7RwW
- TLSH T153B19222B7E91D14F8E34A701CEB5B85A376FD215D328B1B1950175E1E36980BC34B62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
3606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mstee.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
RtlCompareMemory
KeTickCount
ExFreePool
ks.sys
KsInitializeDriver
KsFilterGetFirstChildPin
_KsEdit
KsPinGetConnectedPinInterface
KsPinGetNextSiblingPin
KsPinGetParentFilter
KsFilterGetChildPinCount
Name
.rdata
Size
256B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
190B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=5, id=28, version=9178,
count=1, id=61, version=9210,
mswebdvd.dll
- IMPHASH 92e5618f232053bc39b696e31857d9b5
- SHA256 523c4b8a925bb0ad76df192d69802744a32a5134a6233acce5be4853a3460f80
- MD5 0db04280a7bec2350dc6585f62ebb4db
- SHA1 e68dc06f852f7aff04b078f224ec2cbdba71bcd0
- SHA512 529d3efa1441d3ab3fc2b61a7b1ecd0fb68cc8b77072f5f203cf79ec92cab1c830dc8543e30654985e7ff8f564586fda6e7d5859ac5a0ba5eb7d0f6bf503245f
- SSDEEP 3072:nGbDgFOO2uR9E/eorkQXqrfNRcya7z5IDLRt9ny1cUPcUfX8z3F1iC6VIIY5C5w7:GIEO2uR9E/eorNX6FRczzuvRfyxzszy
- TLSH T17264C301B3E8C626F1F71B305EBAA69A5A77FD509E36821F2284131D1D71F84EA24737
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
82087
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
TerminateProcess
FreeLibrary
GetVersionExA
GetUserDefaultLangID
IsValidLocale
GetCurrentThreadId
SetEvent
ResetEvent
GetTickCount
WideCharToMultiByte
WaitForSingleObject
lstrcpynW
GetDriveTypeW
CloseHandle
lstrcpyW
InterlockedDecrement
GetLocaleInfoW
InterlockedIncrement
HeapAlloc
GetProcessHeap
HeapFree
GetShortPathNameW
LoadLibraryExW
GetLastError
FindResourceW
LoadResource
SizeofResource
lstrlenA
DisableThreadLibraryCalls
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameW
lstrcatW
HeapDestroy
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
CreateEventW
EnterCriticalSection
LeaveCriticalSection
Sleep
GetVersionExW
lstrlenW
GetSystemDirectoryW
GetModuleHandleW
LoadLibraryW
GetCurrentProcess
FlushInstructionCache
GetModuleHandleA
msvcrt
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_vsnwprintf
fwrite
fclose
_ui64tow
malloc
realloc
??3@YAXPAX@Z
??2@YAPAXI@Z
_CxxThrowException
wcslen
_ftol
__CxxFrameHandler
free
fopen
_purecall
gdi32
GetClipBox
GetDCOrgEx
CreateMetaFileW
SetWindowExtEx
CloseMetaFile
DeleteMetaFile
CreateDCW
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetTextColor
DeleteDC
RestoreDC
CreateSolidBrush
SelectObject
Rectangle
DeleteObject
GetNearestColor
GetDeviceCaps
GetSystemPaletteEntries
CreateRectRgnIndirect
SetBkColor
SetViewportOrgEx
user32
GetWindowRect
SetTimer
CharNextW
GetDC
PtInRect
UnionRect
GetKeyState
DestroyAcceleratorTable
SetWindowLongW
CallWindowProcW
EndPaint
BeginPaint
IsChild
GetFocus
RegisterClassExW
wsprintfW
GetClassInfoExW
SetFocus
ShowWindow
GetParent
SystemParametersInfoW
SetRect
GetSystemMetrics
IsIconic
DefWindowProcW
DrawTextW
InvalidateRgn
RegisterClassW
GetClassInfoW
PostMessageW
GetWindowDC
ReleaseDC
KillTimer
DestroyCursor
DestroyWindow
LoadStringW
InvalidateRect
ShowCursor
GetCursorInfo
GetWindow
SetCursor
GetClientRect
IsWindow
GetDesktopWindow
MapWindowPoints
ClipCursor
LoadCursorW
IntersectRect
EqualRect
CreateWindowExW
IsWindowVisible
GetWindowLongW
SendMessageW
SetWindowPos
SetWindowRgn
OffsetRect
advapi32
RegDeleteKeyW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptGetHashParam
RegCreateKeyW
RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
ole32
ProgIDFromCLSID
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
CoTaskMemFree
oleaut32
SysAllocString
SysFreeString
SysAllocStringLen
SysStringLen
VariantClear
VariantCopy
VariantInit
SetErrorInfo
CreateErrorInfo
OleTranslateColor
VariantChangeTypeEx
SysAllocStringByteLen
LoadRegTypeLi
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
VariantChangeType
SysStringByteLen
OleCreatePropertyFrame
comctl32
ord17
comdlg32
GetSaveFileNameW
shell32
SHGetSpecialFolderPathW
winmm
mixerSetControlDetails
mixerGetLineControlsW
mixerGetLineInfoW
mciSendCommandW
mixerGetControlDetailsW
mixerGetNumDevs
mixerOpen
mixerClose
ddraw
DirectDrawCreate
quartz
AMGetErrorTextW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=4, id=64, version=9210,
count=23, id=25, version=9210,
count=221, id=1, productName=Unmarked objects,
count=12, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=19, id=29, version=9178,
count=1, id=61, version=9210,
pid.dll
- IMPHASH c104ac93b4854145491d5be96d5f7be7
- SHA256 3b3414e5dab4a23dd5306804f2b20aae2fa44cd353e7c35df3c8922c19b094da
- MD5 c5439671424e05065262a89b2d7262c8
- SHA1 07d35edea49fc6bcf45f5ed7af5d608f1113d405
- SHA512 b051a360a4bae7d6df6503375a7ec854c38ec7dd7fa3e6e4344457d3450070a4870d86135783ce6fcb801494b6b760cf81284ea6f57db670ae3c7f15c1440756
- SSDEEP 384:9wATgCadCCf325/I4SO0Zy4qEg7pf4gDE3ogcxo2hTXRgZm6MqtqtsWuhGWqD/:tTgChC/2VSOUmf76gDQQto5MRtQ
- TLSH T158E23B20B7F989B7F2F6427019C26B6177BC59180278AD8F53E01D8B3CF0D95A62A753
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7460
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwind
kernel32
FreeLibrary
LoadLibraryW
CreateThread
CreateEventW
GetModuleFileNameW
CreateFileW
WaitForSingleObject
GetVersionExW
GetVersion
IsBadReadPtr
WriteFileEx
ReadFileEx
FreeLibraryAndExitThread
ReleaseMutex
MulDiv
WaitForMultipleObjects
ResetEvent
SetEvent
WriteFile
GetLastError
UnmapViewOfFile
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
InitializeCriticalSection
CreateMutexW
CreateFileMappingW
CloseHandle
MapViewOfFile
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
lstrlenW
lstrcpyW
LocalReAlloc
LocalAlloc
LocalFree
Sleep
advapi32
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
BuildTrusteeWithSidW
AllocateAndInitializeSid
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
user32
MsgWaitForMultipleObjectsEx
PeekMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
wsprintfW
hid
HidP_GetLinkCollectionNodes
HidP_GetUsages
HidD_GetPreparsedData
HidD_GetAttributes
HidP_SetUsageValueArray
HidP_SetUsages
HidP_GetSpecificButtonCaps
HidP_GetSpecificValueCaps
HidP_SetUsageValue
HidP_SetScaledUsageValue
HidD_SetFeature
HidP_GetScaledUsageValue
HidD_GetFeature
HidD_FreePreparsedData
HidP_GetCaps
HidP_InitializeReportForID
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
986B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=1, productName=Unmarked objects,
count=11, id=25, version=9210,
count=3, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=17, id=28, version=9178,
count=1, id=61, version=9210,
pid.xpg
- IMPHASH c104ac93b4854145491d5be96d5f7be7
- SHA256 77ab8f0f35c1979f0682edd320c8a89979d5312596afd4e1b9c61b92d172a9ed
- MD5 23f608f9e03f9044d8ae1e07c360cf35
- SHA1 9d61f30741c95af392a22a4cfcf161bc2fb7533e
- SHA512 715704ee6c51566611544e9e0660e123f8dc251c6a14cb66c9becbf9c8df11f77b467fd5b471a708d9762b8b68e5bd841bbb96dd0570bbae7c95007575b47131
- SSDEEP 384:KxbTgqDq1QVb520nP0GFu1AqDfxOtpW0JMlmg8C2xdrGBD6nITqtqtCUbWu5GWQD:8TgqEQVbc0cGlTjJMlQKBDnTRtCU1
- TLSH T113E24A50F7C549BAE1F636345AD2AB6137BDAE180234E88F53D01D1A3CB0E51963E7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7460
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwind
kernel32
FreeLibrary
LoadLibraryW
CreateThread
CreateEventW
GetModuleFileNameW
CreateFileW
WaitForSingleObject
GetVersionExW
GetVersion
IsBadReadPtr
WriteFileEx
ReadFileEx
FreeLibraryAndExitThread
ReleaseMutex
MulDiv
WaitForMultipleObjects
ResetEvent
SetEvent
WriteFile
GetLastError
UnmapViewOfFile
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
InitializeCriticalSection
CreateMutexW
CreateFileMappingW
CloseHandle
MapViewOfFile
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
lstrlenW
lstrcpyW
LocalReAlloc
LocalAlloc
LocalFree
Sleep
advapi32
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
BuildTrusteeWithSidW
AllocateAndInitializeSid
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
user32
MsgWaitForMultipleObjectsEx
PeekMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
wsprintfW
hid
HidP_GetLinkCollectionNodes
HidP_GetUsages
HidD_GetPreparsedData
HidD_GetAttributes
HidP_SetUsageValueArray
HidP_SetUsages
HidP_GetSpecificButtonCaps
HidP_GetSpecificValueCaps
HidP_SetUsageValue
HidP_SetScaledUsageValue
HidD_SetFeature
HidP_GetScaledUsageValue
HidD_GetFeature
HidD_FreePreparsedData
HidP_GetCaps
HidP_InitializeReportForID
DllCanUnloadNow
DllGetClassObject
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=1, productName=Unmarked objects,
count=11, id=25, version=9210,
count=3, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=17, id=28, version=9178,
count=1, id=61, version=9210,
qasf.dll
- IMPHASH 34b0e65d4741d54395cac26e108e8246
- SHA256 4cc448041d271b2a6f81bbcfe4a4fc6d806bb7116c592bc41293dfd20093b072
- MD5 d00019595622e5bd09692e78ec659b04
- SHA1 20161fcfa6b19a2a4221a28a18aa435b0c89fe59
- SHA512 c9308d94cc993ff26ac7c4f57b46be24a1feb2dc6f83477f742910b195c2598fe1f94481ee4c02ea224e6dcb4e4de90529caaddde4ea69da7298f0de277d6170
- SSDEEP 3072:qef8nrZvp82W6CDaU42u6KrEZdL2Z0VoYhto0HV3eKVp2RFJxen8ef8IOaQyD5Zq:qTvp8Lu6KrEZdL2KWqtrV34nJxO8
- TLSH T197046C02B3F67075E1E3523ADB7AB37BB379BB145A21D65A06144F1E2E31680E92C317
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetComputerNameA
GetDiskFreeSpaceA
GlobalMemoryStatus
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetLocalTime
DeviceIoControl
GetModuleHandleA
LoadLibraryA
GetVersionExA
LocalAlloc
LocalFree
DisableThreadLibraryCalls
CreateThread
GetTickCount
SetThreadPriority
InterlockedExchange
lstrcpyW
GetModuleHandleW
GetProcAddress
VirtualAlloc
CreateSemaphoreW
GetCurrentThreadId
GetCurrentProcess
lstrcmpW
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
ResetEvent
SetEvent
CreateEventW
CloseHandle
lstrcpynW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryW
InterlockedDecrement
FreeLibrary
GetVersionExW
lstrlenW
MultiByteToWideChar
lstrlenA
GetLastError
GetModuleFileNameA
InterlockedIncrement
RaiseException
msvcrt
swprintf
_ftol
_except_handler3
_wtoi
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
wcscat
wcslen
wcscpy
gdi32
GetTextExtentPointW
user32
wsprintfW
LoadStringW
GetDesktopWindow
GetWindowRect
DefWindowProcW
DestroyWindow
ShowWindow
InvalidateRect
MoveWindow
CreateDialogParamW
SetWindowLongW
GetDlgItem
GetDC
ReleaseDC
SendMessageW
GetWindowLongW
advapi32
RegQueryValueExA
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
GetUserNameA
RegSetValueExA
RegCreateKeyExA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
oleaut32
SysAllocStringLen
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=6, id=64, version=9210,
count=3, id=29, version=8923,
count=7, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=23, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=14, version=7299,
count=8, productName=Unmarked objects (old),
count=13, id=25, version=9210,
count=152, id=1, productName=Unmarked objects,
count=10, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=24, id=29, version=9178,
count=1, id=61, version=9210,
qcap.dll
- IMPHASH 5b434342bca065771fb82248c16cfe2f
- SHA256 300cf546942d1677931a9a8870f5db4908d1c7c047fda678ce5d2e9bcf341c5d
- MD5 ba463212059dd46754ddbb652deaa1cc
- SHA1 5775c1f78e598304dc06f71b15713d65f3f880ef
- SHA512 fd685dad38883940d9be616c55acaece75a4c3719e2dad20804469dcd7365e39e9c6cfe7807e8fbc6c1142a4c2e2ba8370b3c126954fec41573dc4358d7b6f38
- SSDEEP 6144:rBHGyV1sKLcgkFdzHukl2LT98EUFXW1mV6/gQ:VHGU1nLcgkaX98EMW
- TLSH T172443A01A3F9C03AF1F34B755EF977A65A7AFD045A28C80F9B82278D1971A00DA25737
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
19216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcessId
lstrcpyA
CreateIoCompletionPort
GetDiskFreeSpaceW
GetTickCount
QueryPerformanceCounter
lstrcmpiW
GetModuleHandleW
GetCurrentProcess
ReadFile
GetFileSize
DeleteFileW
DeleteCriticalSection
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateFileW
SetFilePointer
WriteFile
SetEndOfFile
GetACP
IsBadCodePtr
IsBadHugeReadPtr
GetFileAttributesW
IsBadWritePtr
HeapFree
GetProcessHeap
HeapAlloc
GetPrivateProfileStringW
IsBadReadPtr
GlobalMemoryStatus
GetProfileIntA
GlobalAlloc
GlobalLock
GlobalHandle
GlobalFree
GlobalUnlock
MulDiv
CreateThread
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
lstrcpyW
GetFullPathNameW
lstrlenW
GetCurrentThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
VirtualAlloc
CreateSemaphoreW
lstrcmpW
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForMultipleObjects
ResetEvent
SetEvent
CreateEventW
CloseHandle
lstrcpynW
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetModuleFileNameA
GetLastError
GetVersionExW
msvcrt
_except_handler3
wcslen
_ftol
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
gdi32
GetObjectW
GetPaletteEntries
GetStockObject
SelectObject
PatBlt
GetTextExtentPoint32W
user32
CheckDlgButton
GetDesktopWindow
IsRectEmpty
SetDlgItemTextW
EnableWindow
GetDlgItem
SetDlgItemInt
ReleaseDC
ClientToScreen
GetClientRect
GetDC
IsWindowVisible
IsWindow
SetCursor
LoadCursorW
GetAsyncKeyState
CheckRadioButton
GetDlgItemInt
SendMessageW
wsprintfW
GetWindowRect
DefWindowProcW
DestroyWindow
ShowWindow
InvalidateRect
MoveWindow
CreateDialogParamW
SetWindowLongW
GetWindowLongW
PeekMessageW
DispatchMessageW
TranslateMessage
LoadStringW
advapi32
RegOpenKeyW
RegCreateKeyW
RegSetValueW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegEnumKeyW
ole32
CoCreateInstance
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
SysFreeString
SysStringLen
VariantClear
msvfw32
ICCompress
ICDecompress
ICGetInfo
ICOpen
ICClose
ICSendMessage
ICLocate
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
SendDriverMessage
mixerOpen
mixerClose
waveInStop
waveInStart
waveInAddBuffer
waveInPrepareHeader
mixerGetControlDetailsW
mixerSetControlDetails
mixerGetID
mixerGetLineInfoW
mixerGetLineControlsW
waveInGetDevCapsW
waveInReset
waveInClose
waveInOpen
CloseDriver
OpenDriver
waveInUnprepareHeader
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
155KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=10, id=64, version=9210,
count=17, id=25, version=9210,
count=215, id=1, productName=Unmarked objects,
count=11, id=28, version=9178,
count=1, id=63, version=9210,
count=37, id=29, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
qdv.dll
- IMPHASH 9996c03ebc30affa9b90fc9f618619d0
- SHA256 68ffcb34ed26f9dbb516783d3f956c39b688ff3c51c825ae5ecb0bad3a2941e4
- MD5 f0a0a5bb04bb2dc9a01db2cf6a9f65c5
- SHA1 498420750cd23c94f8e2bdd738d0475cf3785294
- SHA512 21b8bdbe5abd07439d01a601b8851b9c95d2a4ab85f5c110c071200991ac9150c8f2673b958e2d0ea03cac121d96c3405b053031ebfe0cb87af646a3d11142c1
- SSDEEP 6144:w6xsCTokQkaUGp5F0koa+bS15tJ1KI715ta15th3lwg1IXEU8qWc2x5hPFqBFvYi:w6xsCToVKOEIU5BPN
- TLSH T1BF648D7363A5D62AD0A2447A95FF23BD29B9BF20C615988786C1357D3C706828B3335B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10669
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
??2@YAPAXI@Z
_purecall
_ftol
_except_handler3
??3@YAXPAX@Z
user32
GetDesktopWindow
GetWindowLongW
LoadStringW
IsRectEmpty
IsDlgButtonChecked
SendDlgItemMessageW
CheckRadioButton
wsprintfW
SetWindowLongW
CreateDialogParamW
MoveWindow
InvalidateRect
ShowWindow
DestroyWindow
DefWindowProcW
GetWindowRect
advapi32
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
ole32
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
msvfw32
StretchDIB
winmm
timeGetTime
kernel32
GetModuleHandleW
TerminateProcess
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetVersionExW
DisableThreadLibraryCalls
lstrlenW
MultiByteToWideChar
lstrlenA
GetLastError
GetModuleFileNameA
InterlockedIncrement
FreeLibrary
InterlockedDecrement
LoadLibraryW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrcpynW
CloseHandle
CreateEventW
SetEvent
ResetEvent
WaitForSingleObject
ReleaseSemaphore
lstrcmpW
GetCurrentProcess
GetCurrentThreadId
CreateSemaphoreW
GetProcAddress
lstrcpyW
InterlockedExchange
SetThreadPriority
GetTickCount
CreateThread
MulDiv
QueryPerformanceCounter
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
226KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=95, version=2122,
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, id=64, version=9210,
count=15, id=25, version=9210,
count=142, id=1, productName=Unmarked objects,
count=7, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=27, id=29, version=9178,
count=1, id=61, version=9210,
qdvd.dll
- IMPHASH 5636221ffff22127eabde036df3441b1
- SHA256 df18a93af09a5310eea956545c58ae3722d9f3c57b68ab4dc30d06f40b2dcf83
- MD5 e078a1400c7965c4dc0dee954d68b288
- SHA1 5a8053649a890c729458f23d8a2f249be7de1115
- SHA512 a1785f2cc2ec856e4d1c308fb09fa7272ad96cd34952571650847140e4dd6965fa7b0639c72844e7ba1668263df32b65f9ed94f9c03a30868675864c95a0c973
- SSDEEP 6144:4WEgNPdQ4AZnSFiTsR4/XgXzpNVmO2pku+O3OfNe0n3Im89nH:wiQ4riAtznVmjpUIM3Im8Z
- TLSH T1BCA47D52B3FAD036E0F327349D7D67B666BBB9102638880A53451A0D3B72A01D62F777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
46027
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVolumeInformationW
SetWaitableTimer
CreateWaitableTimerW
SetFilePointer
ReadFile
FindCloseChangeNotification
GetLocaleInfoA
IsValidLocale
FindNextFileW
DeviceIoControl
GetOverlappedResult
TerminateProcess
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
FindFirstFileW
FindClose
GetDriveTypeW
GetFileAttributesW
GetUserDefaultLCID
GetComputerNameW
CreateThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
lstrcmpiA
VirtualAlloc
CreateSemaphoreW
VirtualFree
GetSystemInfo
ReleaseSemaphore
GetModuleFileNameA
GetVersionExW
IsBadReadPtr
IsBadWritePtr
HeapFree
SetLastError
lstrcpynA
lstrcpyA
WaitForMultipleObjects
ResetEvent
CreateEventW
lstrcmpW
SetEvent
Sleep
GetFullPathNameW
SetErrorMode
LoadLibraryW
MulDiv
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
CreateFileW
GetFileSize
CreateFileMappingW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThread
lstrcpynW
GetModuleFileNameW
lstrcatW
HeapDestroy
WaitForSingleObject
GlobalFree
CloseHandle
GetLastError
GetCurrentThreadId
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiW
GetProcessHeap
HeapAlloc
GetCurrentProcess
FlushInstructionCache
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcpyW
lstrlenW
msvcrt
malloc
realloc
??2@YAPAXI@Z
free
_purecall
_ftol
qsort
_except_handler3
??3@YAXPAX@Z
gdi32
CreateCompatibleBitmap
GetDIBits
CreateDCA
SetBkMode
ExtTextOutW
CreateFontIndirectW
GetTextMetricsW
EnumFontFamiliesExW
GetSystemPaletteEntries
SetBkColor
SetTextColor
CreateRectRgnIndirect
GetDeviceCaps
CreateDCW
DeleteMetaFile
CloseMetaFile
RestoreDC
SetWindowExtEx
SetWindowOrgEx
SaveDC
CreateMetaFileW
DeleteDC
SetViewportOrgEx
SetMapMode
LPtoDP
SetPixel
GetPixel
GetStockObject
GetObjectW
CreateDIBSection
DeleteObject
StretchBlt
BitBlt
SelectObject
StretchDIBits
SetDIBitsToDevice
GetRegionData
FillRgn
OffsetRgn
CreateSolidBrush
CombineRgn
GdiFlush
SetStretchBltMode
CreateCompatibleDC
CreateRectRgn
user32
SetDlgItemInt
SetDlgItemTextW
CheckRadioButton
EnableWindow
EnumDisplayMonitors
DrawTextW
ChangeDisplaySettingsExW
GetSystemMetrics
GetMonitorInfoW
GetQueueStatus
PostThreadMessageW
MonitorFromWindow
SetRectEmpty
RegisterWindowMessageW
PostMessageW
ScreenToClient
FillRect
SetRect
ClientToScreen
IsWindowVisible
IsRectEmpty
InvalidateRect
IsWindow
DestroyWindow
ShowWindow
SetFocus
LoadStringW
CheckDlgButton
PtInRect
CharNextW
GetWindowLongW
CallWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjects
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
EndPaint
GetClientRect
BeginPaint
ReleaseDC
GetDC
GetDlgItem
SendMessageW
MapWindowPoints
GetWindowRect
GetParent
SetWindowLongW
GetDlgItemInt
CreateDialogParamW
IsDlgButtonChecked
KillTimer
SetTimer
GetWindowThreadProcessId
UnregisterClassW
SendMessageTimeoutW
RegisterClassW
GetClassInfoW
wvsprintfW
GetDesktopWindow
MoveWindow
UnionRect
RegisterClassExW
wsprintfW
LoadCursorW
GetClassInfoExW
CreateWindowExW
DefWindowProcW
IsIconic
advapi32
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
RegSetValueW
GetUserNameW
RegOpenKeyW
ole32
CoCreateInstance
WriteClassStm
CreateOleAdviseHolder
OleLoadFromStream
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
StringFromCLSID
IIDFromString
StringFromGUID2
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
OleSaveToStream
oleaut32
GetActiveObject
VarI4FromStr
SetErrorInfo
LoadRegTypeLi
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
VariantInit
SysFreeString
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeEndPeriod
timeBeginPeriod
timeSetEvent
timeKillEvent
timeGetTime
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
324KB
Virtual Size
323KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=10, id=64, version=9210,
count=15, id=25, version=9210,
count=329, id=1, productName=Unmarked objects,
count=9, id=28, version=9178,
count=1, id=63, version=9210,
count=102, id=29, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
qedit.dll
- IMPHASH dc535e1caa50b23b0200f8cc949d7f8b
- SHA256 f9960a3175589339793b3873d3a6d7970cc981ad6a6b0393a3b902a3b47dd686
- MD5 13b80167ea34ecab3a0a6c80459a59ad
- SHA1 6b1f4e7a3ae11e5dd878cba3f63605dbf7edcaf2
- SHA512 2d473fd7f98bb47fd2405da12eff88517a272d82eb895588c980ec073e379476401e87eeae6a61e5e80e90136644b0d476347a6a66ab16fa6acb36576822a688
- SSDEEP 12288:WWikFauLgL2ChPJN5+Xrq5qtq1CdBBBBBBBBBBBBBBBBSoJN:VimJX0b5arq5qtqPoJ
- TLSH T18F851A52F3C6C5A3C05E02304C7B6BD62F71B9015E26AB1B7B09578E2EB23D5B6057E2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
53496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentDirectoryW
LocalAlloc
LoadLibraryA
RaiseException
TerminateProcess
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
MulDiv
LockResource
GetModuleFileNameA
GetModuleHandleW
CreateFileW
GetFileSize
GetFileType
GetFileTime
GetSystemDirectoryW
DeleteFileW
GetFullPathNameW
WriteFile
lstrcpynA
GlobalFree
SetFilePointer
ReadFile
Sleep
CompareStringW
CreateThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
VirtualAlloc
CreateSemaphoreW
lstrcmpW
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForMultipleObjects
ResetEvent
SetEvent
LoadLibraryW
GetVersionExW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
CreateMutexW
DisableThreadLibraryCalls
CreateEventW
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThread
lstrcpynW
ReleaseMutex
GetModuleFileNameW
lstrcatW
HeapDestroy
WaitForSingleObject
CloseHandle
GetLastError
GetCurrentThreadId
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcpyW
lstrlenW
msvcrt
free
_purecall
??3@YAXPAX@Z
malloc
realloc
??2@YAPAXI@Z
wcspbrk
wcstoul
wcsncmp
wcscat
srand
rand
_vsnwprintf
_wsplitpath
wcscmp
sprintf
_iob
fprintf
exit
fread
_setjmp3
wcscpy
atof
_ftol
wcslen
longjmp
fclose
_wfopen
_wtoi
gdi32
DeleteObject
CreateCompatibleDC
SetStretchBltMode
StretchBlt
CreateDIBSection
GetObjectW
CreateFontIndirectW
SelectObject
GetTextMetricsW
GetTextExtentPointW
DeleteDC
GetDeviceCaps
user32
LoadStringW
EndDialog
DefWindowProcW
GetWindowTextLengthW
GetWindowTextW
GetDesktopWindow
CharNextW
wsprintfW
GetWindowLongW
PeekMessageW
DispatchMessageW
ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
ReleaseDC
GetDC
GetDlgItem
DestroyWindow
IsWindow
InvalidateRect
MoveWindow
WinHelpW
IsDialogMessageW
CreateDialogParamW
GetDialogBaseUnits
wvsprintfW
PostThreadMessageW
RegisterWindowMessageW
GetQueueStatus
MessageBoxW
GetDlgItemTextA
SetDlgItemTextW
SetDlgItemInt
GetDlgItemInt
CheckRadioButton
IsDlgButtonChecked
IsRectEmpty
CharPrevW
GetWindowRect
SetWindowLongW
advapi32
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegSetValueW
RegCreateKeyW
RegQueryValueW
RegOpenKeyW
RegEnumValueW
ole32
CreateBindCtx
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
OleLoadFromStream
CreateStreamOnHGlobal
StringFromCLSID
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CLSIDFromString
StgCreateDocfile
CoCreateFreeThreadedMarshaler
StgOpenStorage
CoCreateInstance
oleaut32
VariantChangeTypeEx
VarI4FromStr
LoadTypeLi
RegisterTypeLi
SetErrorInfo
LoadRegTypeLi
SysAllocString
VariantCopy
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
msvfw32
DrawDibOpen
DrawDibDraw
DrawDibClose
winmm
timeEndPeriod
timeSetEvent
timeGetTime
timeBeginPeriod
timeKillEvent
comdlg32
GetOpenFileNameW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
407KB
Virtual Size
406KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, id=64, version=9210,
count=3, id=29, version=8923,
count=17, id=25, version=9210,
count=315, id=1, productName=Unmarked objects,
count=42, id=28, version=9178,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=90, id=29, version=9178,
count=1, id=61, version=9210,
qedwipes.dll
- SHA256 949e4d6697ce7f4101682affdfa915ef32908a170417aae657b6da5da2e39a11
- MD5 15329f765ae3559fbc62ef241b71fdab
- SHA1 cecafa46ebb3b7830cec3775c68882da28fb0a11
- SHA512 fd2bb614d007edabc7074fc289764cf7536f297c81ff11409df7b55acd5dca6a55c0f8520a07f01ac2a296e5aa9b0027c70708210f206fbb892534a306d63918
- SSDEEP 12288:2HHhsO4j/aBz5ge6BbeZ2gnzM6MNCTs17pfST8iypSovFLBs5nrSi/7F:2HH6GzaD5Fi5rSi/7F
- TLSH T18EF4CF0FAF725C56CCE8433006A93275D7189A76AFEFD68C7469AB3E5C1044B947A02E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
715KB
Virtual Size
714KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=69, version=9111,
count=1, id=61, version=9210,
quartz.dll
- IMPHASH ad5ba4fab893c1bbbbb3ec299e041eb7
- SHA256 a378764866d8dd280e63dda4e62c5b10626cf46a230768fb24c3c3d5f7263b87
- MD5 6b6e934bee7aa98a5eed62c6c8506612
- SHA1 23007bee25fc8bca6f1f1fc1307fadd9724a535a
- SHA512 22c919540af04de4e5944a9d10bc997ab507b0d64c683d942e8e376962fd298a7c559d3c8a45bc844b4d0aaf506929842952af589cbc481f1f9e08f85b4417d4
- SSDEEP 24576:TZrLvyvWJhmrnDRi847M8KwW2HQkf8zFpNkISLtYO:NrTwWDontib4WWvy5p
- TLSH T1E595E60227FA8166F1F37B3569B953A25E7A7D91A939C60D1380665E2DB1E40CE30F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
349357
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProfileIntW
MulDiv
GetShortPathNameA
GetACP
lstrcmpiA
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetProfileStringA
GetExitCodeProcess
lstrcpyA
GetFullPathNameW
WriteFile
QueryPerformanceFrequency
ReleaseMutex
CreateMutexW
HeapDestroy
WideCharToMultiByte
FreeLibraryAndExitThread
Sleep
GetPrivateProfileStringA
lstrcatW
SetFilePointer
ReadFile
FormatMessageA
FormatMessageW
CreateThread
GetCurrentThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
lstrcpyW
LoadLibraryW
GetLastError
lstrlenA
GetModuleHandleW
GetModuleFileNameW
GetVersionExW
VirtualAlloc
CreateSemaphoreW
lstrcmpW
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
SetEvent
CreateEventW
CloseHandle
InterlockedDecrement
InterlockedIncrement
lstrlenW
lstrcpynW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DelayLoadFailureHook
MapViewOfFileEx
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
LocalAlloc
LocalFree
RaiseException
HeapAlloc
GetProcessHeap
HeapFree
WriteProfileStringW
SetErrorMode
GetDriveTypeW
GetFileSize
LocalUnlock
LocalLock
LocalReAlloc
CompareStringA
lstrcmpA
lstrcpynA
IsBadWritePtr
IsBadReadPtr
GetDiskFreeSpaceW
CreateFileW
DeviceIoControl
GetCurrentProcess
TerminateProcess
GetModuleHandleA
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
GetModuleFileNameA
MultiByteToWideChar
OpenProcess
lstrcmpiW
msvcrt
??3@YAXPAX@Z
_ltow
towupper
atoi
memmove
??2@YAPAXI@Z
getenv
sscanf
_except_handler3
sprintf
wcscpy
_strdup
_wtoi
wcslen
_ftol
free
_initterm
_adjust_fdiv
malloc
_onexit
__dllonexit
gdi32
CreateCompatibleDC
CreateDCA
GetClipBox
GdiFlush
SetPixel
GetPixel
ExtTextOutW
SetBkColor
SelectPalette
FillRgn
CombineRgn
CreateRectRgnIndirect
CreatePalette
GetStockObject
GetTextExtentPoint32W
SetTextColor
SetBkMode
BitBlt
CreateDIBSection
StretchBlt
SetStretchBltMode
CreateDCW
GetObjectW
StretchDIBits
SetDIBitsToDevice
EnumFontFamiliesExW
SetTextCharacterExtra
SetDIBColorTable
GetDeviceCaps
DeleteObject
GetDCOrgEx
EqualRgn
ExtCreateRegion
CreateRectRgn
CreateFontIndirectW
GetSystemPaletteEntries
GetDIBits
PatBlt
CreateSolidBrush
SelectObject
DeleteDC
RealizePalette
CreateCompatibleBitmap
user32
SetTimer
SendMessageW
GetWindowThreadProcessId
LoadStringW
GetDC
ReleaseDC
GetMessageW
TranslateMessage
PostMessageW
KillTimer
IsWindow
ReplyMessage
GetMonitorInfoW
MonitorFromWindow
wsprintfA
SetRect
EqualRect
GetSystemMetrics
IsWindowVisible
IsRectEmpty
SendDlgItemMessageW
EndDialog
DialogBoxParamW
GetDlgItem
MessageBoxW
SystemParametersInfoW
GetDlgItemInt
EnableWindow
GetWindowRect
UnhookWindowsHookEx
InvalidateRect
SetWindowsHookExW
EnumDisplayDevicesW
EnumDisplayMonitors
ClientToScreen
GetClientRect
SetRectEmpty
MapWindowPoints
ScreenToClient
IntersectRect
ChangeDisplaySettingsExA
MonitorFromRect
GetWindowPlacement
IsIconic
GetParent
GetWindowLongW
CharNextW
DispatchMessageW
GetQueueStatus
RegisterWindowMessageW
SetWindowLongW
PostThreadMessageW
wvsprintfW
MsgWaitForMultipleObjects
PeekMessageW
wsprintfW
AdjustWindowRectEx
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadCursorW
GetClassInfoW
IsZoomed
SetParent
SetDlgItemTextW
CreateDialogParamW
DestroyWindow
InSendMessage
FillRect
OffsetRect
ChangeDisplaySettingsExW
GetWindowTextW
SetWindowTextW
MoveWindow
SetForegroundWindow
ShowWindow
GetForegroundWindow
SetWindowPos
UpdateWindow
GetKeyboardState
SetKeyboardState
LoadImageW
DestroyCursor
SetCursor
BeginPaint
EndPaint
GetDesktopWindow
advapi32
RegCreateKeyExW
RegQueryInfoKeyW
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegQueryValueW
RegFlushKey
ole32
CLSIDFromString
CreateBindCtx
CoCreateFreeThreadedMarshaler
MkParseDisplayName
CreateStreamOnHGlobal
StringFromCLSID
StgOpenStorage
StgIsStorageFile
IIDFromString
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
CoCreateInstance
oleaut32
SysAllocStringLen
SysStringLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
VariantCopy
VariantChangeType
LoadRegTypeLi
SetErrorInfo
SysReAllocString
VariantInit
winmm
waveOutGetVolume
waveOutSetVolume
waveOutWrite
waveOutUnprepareHeader
waveOutRestart
waveOutReset
waveOutPrepareHeader
waveOutPause
waveOutOpen
waveOutGetPosition
waveOutGetErrorTextW
waveOutGetDevCapsW
waveOutClose
waveOutGetNumDevs
midiOutReset
midiStreamOpen
midiStreamProperty
midiOutGetNumDevs
mixerGetNumDevs
mixerGetLineInfoW
mixerGetDevCapsW
mixerGetLineControlsW
mixerSetControlDetails
mixerGetControlDetailsW
midiStreamOut
midiOutUnprepareHeader
midiStreamRestart
midiOutPrepareHeader
midiStreamPause
midiStreamPosition
midiOutGetErrorTextW
midiStreamClose
timeKillEvent
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeSetEvent
timeGetTime
rpcrt4
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrClientCall2
IUnknown_AddRef_Proxy
AMGetErrorTextA
AMGetErrorTextW
AmpFactorToDB
DBToAmpFactor
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
1012KB
Virtual Size
1011KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
503B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
74KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
772KB
Virtual Size
772KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, productName=Unmarked objects (old),
count=12, id=64, version=9210,
count=15, id=25, version=9210,
count=420, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=204, id=29, version=9178,
count=93, id=28, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
quartz.w2k
- IMPHASH ad5ba4fab893c1bbbbb3ec299e041eb7
- SHA256 a378764866d8dd280e63dda4e62c5b10626cf46a230768fb24c3c3d5f7263b87
- MD5 6b6e934bee7aa98a5eed62c6c8506612
- SHA1 23007bee25fc8bca6f1f1fc1307fadd9724a535a
- SHA512 22c919540af04de4e5944a9d10bc997ab507b0d64c683d942e8e376962fd298a7c559d3c8a45bc844b4d0aaf506929842952af589cbc481f1f9e08f85b4417d4
- SSDEEP 24576:TZrLvyvWJhmrnDRi847M8KwW2HQkf8zFpNkISLtYO:NrTwWDontib4WWvy5p
- TLSH T1E595E60227FA8166F1F37B3569B953A25E7A7D91A939C60D1380665E2DB1E40CE30F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
349357
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProfileIntW
MulDiv
GetShortPathNameA
GetACP
lstrcmpiA
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetProfileStringA
GetExitCodeProcess
lstrcpyA
GetFullPathNameW
WriteFile
QueryPerformanceFrequency
ReleaseMutex
CreateMutexW
HeapDestroy
WideCharToMultiByte
FreeLibraryAndExitThread
Sleep
GetPrivateProfileStringA
lstrcatW
SetFilePointer
ReadFile
FormatMessageA
FormatMessageW
CreateThread
GetCurrentThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
lstrcpyW
LoadLibraryW
GetLastError
lstrlenA
GetModuleHandleW
GetModuleFileNameW
GetVersionExW
VirtualAlloc
CreateSemaphoreW
lstrcmpW
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
SetEvent
CreateEventW
CloseHandle
InterlockedDecrement
InterlockedIncrement
lstrlenW
lstrcpynW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DelayLoadFailureHook
MapViewOfFileEx
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
LocalAlloc
LocalFree
RaiseException
HeapAlloc
GetProcessHeap
HeapFree
WriteProfileStringW
SetErrorMode
GetDriveTypeW
GetFileSize
LocalUnlock
LocalLock
LocalReAlloc
CompareStringA
lstrcmpA
lstrcpynA
IsBadWritePtr
IsBadReadPtr
GetDiskFreeSpaceW
CreateFileW
DeviceIoControl
GetCurrentProcess
TerminateProcess
GetModuleHandleA
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
GetModuleFileNameA
MultiByteToWideChar
OpenProcess
lstrcmpiW
msvcrt
??3@YAXPAX@Z
_ltow
towupper
atoi
memmove
??2@YAPAXI@Z
getenv
sscanf
_except_handler3
sprintf
wcscpy
_strdup
_wtoi
wcslen
_ftol
free
_initterm
_adjust_fdiv
malloc
_onexit
__dllonexit
gdi32
CreateCompatibleDC
CreateDCA
GetClipBox
GdiFlush
SetPixel
GetPixel
ExtTextOutW
SetBkColor
SelectPalette
FillRgn
CombineRgn
CreateRectRgnIndirect
CreatePalette
GetStockObject
GetTextExtentPoint32W
SetTextColor
SetBkMode
BitBlt
CreateDIBSection
StretchBlt
SetStretchBltMode
CreateDCW
GetObjectW
StretchDIBits
SetDIBitsToDevice
EnumFontFamiliesExW
SetTextCharacterExtra
SetDIBColorTable
GetDeviceCaps
DeleteObject
GetDCOrgEx
EqualRgn
ExtCreateRegion
CreateRectRgn
CreateFontIndirectW
GetSystemPaletteEntries
GetDIBits
PatBlt
CreateSolidBrush
SelectObject
DeleteDC
RealizePalette
CreateCompatibleBitmap
user32
SetTimer
SendMessageW
GetWindowThreadProcessId
LoadStringW
GetDC
ReleaseDC
GetMessageW
TranslateMessage
PostMessageW
KillTimer
IsWindow
ReplyMessage
GetMonitorInfoW
MonitorFromWindow
wsprintfA
SetRect
EqualRect
GetSystemMetrics
IsWindowVisible
IsRectEmpty
SendDlgItemMessageW
EndDialog
DialogBoxParamW
GetDlgItem
MessageBoxW
SystemParametersInfoW
GetDlgItemInt
EnableWindow
GetWindowRect
UnhookWindowsHookEx
InvalidateRect
SetWindowsHookExW
EnumDisplayDevicesW
EnumDisplayMonitors
ClientToScreen
GetClientRect
SetRectEmpty
MapWindowPoints
ScreenToClient
IntersectRect
ChangeDisplaySettingsExA
MonitorFromRect
GetWindowPlacement
IsIconic
GetParent
GetWindowLongW
CharNextW
DispatchMessageW
GetQueueStatus
RegisterWindowMessageW
SetWindowLongW
PostThreadMessageW
wvsprintfW
MsgWaitForMultipleObjects
PeekMessageW
wsprintfW
AdjustWindowRectEx
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadCursorW
GetClassInfoW
IsZoomed
SetParent
SetDlgItemTextW
CreateDialogParamW
DestroyWindow
InSendMessage
FillRect
OffsetRect
ChangeDisplaySettingsExW
GetWindowTextW
SetWindowTextW
MoveWindow
SetForegroundWindow
ShowWindow
GetForegroundWindow
SetWindowPos
UpdateWindow
GetKeyboardState
SetKeyboardState
LoadImageW
DestroyCursor
SetCursor
BeginPaint
EndPaint
GetDesktopWindow
advapi32
RegCreateKeyExW
RegQueryInfoKeyW
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegQueryValueW
RegFlushKey
ole32
CLSIDFromString
CreateBindCtx
CoCreateFreeThreadedMarshaler
MkParseDisplayName
CreateStreamOnHGlobal
StringFromCLSID
StgOpenStorage
StgIsStorageFile
IIDFromString
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
CoCreateInstance
oleaut32
SysAllocStringLen
SysStringLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
VariantCopy
VariantChangeType
LoadRegTypeLi
SetErrorInfo
SysReAllocString
VariantInit
winmm
waveOutGetVolume
waveOutSetVolume
waveOutWrite
waveOutUnprepareHeader
waveOutRestart
waveOutReset
waveOutPrepareHeader
waveOutPause
waveOutOpen
waveOutGetPosition
waveOutGetErrorTextW
waveOutGetDevCapsW
waveOutClose
waveOutGetNumDevs
midiOutReset
midiStreamOpen
midiStreamProperty
midiOutGetNumDevs
mixerGetNumDevs
mixerGetLineInfoW
mixerGetDevCapsW
mixerGetLineControlsW
mixerSetControlDetails
mixerGetControlDetailsW
midiStreamOut
midiOutUnprepareHeader
midiStreamRestart
midiOutPrepareHeader
midiStreamPause
midiStreamPosition
midiOutGetErrorTextW
midiStreamClose
timeKillEvent
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeSetEvent
timeGetTime
rpcrt4
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrClientCall2
IUnknown_AddRef_Proxy
AMGetErrorTextA
AMGetErrorTextW
AmpFactorToDB
DBToAmpFactor
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Name
.text
Size
1012KB
Virtual Size
1011KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
503B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
74KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
772KB
Virtual Size
772KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=37, version=8755,
count=2, id=25, version=9412,
count=7, productName=Unmarked objects (old),
count=12, id=64, version=9210,
count=15, id=25, version=9210,
count=420, id=1, productName=Unmarked objects,
count=1, id=63, version=9210,
count=204, id=29, version=9178,
count=93, id=28, version=9178,
count=1, id=69, version=9111,
count=1, id=61, version=9210,
stream.sys
- IMPHASH 175996a21e8bff8704f68bfef83adfb6
- SHA256 323e279cd44c5930453c3715bf238f5d1ba3acabd19491d759dd3031e55e09ba
- MD5 d5ecbe98cceda4507fa9168e8d932088
- SHA1 2aba7cf7cfce349bf55f75a6bac20448d682a0d9
- SHA512 d497a40e6ac5160f850566a05c26aa7ab41d5c561929c150c0fc80b8b68e2d9f04fd1a4db6bc765047725f1eb2147f932b5d844b49f48babd355d6e62ee7def6
- SSDEEP 768:K5Wdw0ZIzUoSxME1qF85bAMgwsN+nf3rNzdz1r8b9Cx6IpK6WC:NdzZIIFxfYe51vZ3rNl1rIIpGC
- TLSH T142237DD1B6D114B2D5D30FF09A2A272BB33B7F075229D2B703205D656B2AE41BD29273
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
39173
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
stream.pdb
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
KefAcquireSpinLockAtDpcLevel
IoFreeMdl
ExAllocatePoolWithTag
IoAllocateMdl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeSetEvent
InterlockedDecrement
IoFreeIrp
IofCompleteRequest
IoCancelIrp
ZwQueryValueKey
RtlInitUnicodeString
KeWaitForSingleObject
ExFreePool
IoBuildSynchronousFsdRequest
KeInitializeEvent
MmResetDriverPaging
KeSetTimer
KeCancelTimer
ExQueueWorkItem
PoRequestPowerIrp
InterlockedIncrement
PoCallDriver
MmMapIoSpace
ZwClose
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
sprintf
IoOpenDeviceRegistryKey
IoAllocateIrp
MmBuildMdlForNonPagedPool
InterlockedExchange
IofCallDriver
MmPageEntireDriver
IoGetDriverObjectExtension
IoBuildDeviceIoControlRequest
KeResetEvent
PoStartNextPowerIrp
ZwSetValueKey
IoOpenDeviceInterfaceRegistryKey
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
IoStopTimer
MmUnmapIoSpace
IoDisconnectInterrupt
wcscpy
wcslen
IoCreateDevice
ObfReferenceObject
ZwEnumerateKey
ZwOpenKey
_snwprintf
swprintf
IoGetDeviceProperty
RtlIntegerToUnicodeString
IoStartTimer
IoConnectInterrupt
KeSynchronizeExecution
IoGetDmaAdapter
KeInitializeTimer
KeInitializeDpc
KeInitializeSpinLock
IoDetachDevice
IoDeleteDevice
IoInitializeTimer
IoAttachDeviceToDeviceStack
IoAllocateDriverObjectExtension
DbgBreakPoint
IoGetDeviceInterfaces
KeDelayExecutionThread
ObfDereferenceObject
ProbeForRead
KeInsertQueueDpc
IoReleaseCancelSpinLock
memmove
ObReferenceObjectByHandle
IoFileObjectType
ExGetPreviousMode
IoGetRelatedDeviceObject
KeTickCount
KeBugCheckEx
KefReleaseSpinLockFromDpcLevel
RtlUnwind
hal
KfLowerIrql
KeQueryPerformanceCounter
KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
ks.sys
KsUnserializeObjectPropertiesFromRegistry
KsDiscardEvent
KsAllocateExtraData
KsProbeStreamIrp
KsFreeObjectHeader
KsAllocateObjectHeader
KsUnregisterWorker
KsRegisterWorker
KsDispatchIrp
KsAddIrpToCancelableQueue
KsRemoveIrpFromCancelableQueue
KsFreeDeviceHeader
KsAllocateDeviceHeader
KsNullDriverUnload
KsGenerateEventList
KsGenerateEvent
KsCacheMedium
KsDispatchFastReadFailure
KsDispatchFastIoDeviceControlFailure
KsDispatchInvalidDeviceRequest
KsPropertyHandler
KsEnableEvent
KsDisableEvent
KsMethodHandler
KsPinPropertyHandler
KsCreateDefaultAllocator
KsSynchronousIoControlDevice
KsTopologyPropertyHandler
KsStreamIo
KsQueueWorkItem
KsSetTargetDeviceObject
KsFreeEventList
KsValidateClockCreateRequest
KsValidateConnectRequest
KsPinDataIntersection
DllInitialize
DllUnload
StreamClassAbortOutstandingRequests
StreamClassCallAtNewPriority
StreamClassCompleteRequestAndMarkQueueReady
StreamClassDebugAssert
StreamClassDebugPrint
StreamClassDeviceNotification
StreamClassFilterReenumerateStreams
StreamClassGetDmaBuffer
StreamClassGetNextEvent
StreamClassGetPhysicalAddress
StreamClassLogError
StreamClassPnPAddDeviceWorker
StreamClassQueryMasterClock
StreamClassQueryMasterClockSync
StreamClassReadWriteConfig
StreamClassReenumerateStreams
StreamClassRegisterAdapter
StreamClassRegisterFilterWithNoKSPins
StreamClassScheduleTimer
StreamClassStreamNotification
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
768B
Virtual Size
676B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
896B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=126, id=1, productName=Unmarked objects,
count=7, id=25, version=9210,
count=6, id=64, version=9210,
count=1, id=63, version=9210,
count=1, id=69, version=9111,
count=6, id=28, version=9178,
count=1, id=61, version=9210,
swenum.sys
- IMPHASH 2b29cc5a8e62f78b659fb1c44e574507
- SHA256 97582cf8f5065b1408343ff996cdd6b7df63c7de0fee7fd468ef12eb2138a351
- MD5 616a013d3ea068b6dee83d905e92ee9f
- SHA1 c7a7c7e6dbd9e2a948713f2d40fecff5b2696117
- SHA512 578533684c01cfb531c0e4abe7101650907c9a4bcf302ae43f476855eff92f5af6b2cdde48321bc31e41a853970d664beb59d62be53f67aa0df9457d707a1b46
- TLSH T16381981183F81D7AF5BB1B312CE35A232277F8109C72CA1D2634478F1C59E40B955B23
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2253
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
swenum.pdb
ntoskrnl.exe
IofCompleteRequest
IoDeleteDevice
IoCreateDevice
IofCallDriver
PoCallDriver
PoStartNextPowerIrp
KeTickCount
ks.sys
KsCreateBusEnumObject
KsGetBusEnumPnpDeviceObject
KsServiceBusEnumPnpRequest
KsIsBusEnumChildDevice
KsServiceBusEnumCreateRequest
KsInstallBusEnumInterface
KsRemoveBusEnumInterface
KsGetBusEnumIdentifier
Name
.text
Size
384B
Virtual Size
298B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256B
Virtual Size
198B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
640B
Virtual Size
556B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
640B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
128B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=1, productName=Unmarked objects,
count=5, id=25, version=9210,
count=1, id=69, version=9111,
count=3, id=28, version=9178,
count=1, id=61, version=9210,
MaxPayne 2/DirectX9/dxsetup.exe
- IMPHASH 771d815b9638cdc29fedafed6d81c3a6
- SHA256 67c521b646c74f01ccae7e730cde027326908ddc7d26ace045451a68a6567d31
- MD5 50ca7683aca3e726583aa99f1621decc
- SHA1 7234cb81e06e72ea9c4160cf70caca19ec163aca
- SHA512 7a7a1214469d4a1806f94a6fe9786bb0c2de83336961e5e5f24b6dfbb7e0612ef11a42b820ee419d2aa54fdb460ffd3daeddf091fefe53055265f51aa776a4bc
- SSDEEP 3072:W2N/LzV2ocdHDDvziN0YngAqJdOC9SN2LhaM87fICs532mNot4c383fMkII4RKov:WNoOWLgAHwUMXR84CD
- TLSH T14BA4D72167F99225F4F36B386AB913964E3ABE90DD34DA5E5310319E4931E40DEB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
23334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetSystemDirectoryA
GetModuleHandleA
CreateThread
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
lstrcatA
CreateMutexA
SetErrorMode
GetModuleFileNameA
GetCurrentDirectoryA
GetCurrentProcess
CreateFileA
GetFileSize
ReadFile
CloseHandle
lstrlenA
lstrcpyA
FindFirstFileA
FindClose
GetLastError
lstrcmpiA
GetVersionExA
LoadLibraryA
GetProcAddress
GetProcessHeap
SetEndOfFile
RtlUnwind
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetFilePointer
FlushFileBuffers
SetStdHandle
HeapReAlloc
InitializeCriticalSection
GetCPInfo
GetOEMCP
GetACP
LCMapStringW
MultiByteToWideChar
LCMapStringA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
Sleep
HeapAlloc
LeaveCriticalSection
FreeLibrary
GetWindowsDirectoryA
OutputDebugStringA
lstrcpynA
GetCommandLineA
GetStartupInfoA
GetLocalTime
ExitProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsFree
SetLastError
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
HeapFree
EnterCriticalSection
advapi32
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
AdjustTokenPrivileges
gdi32
GetDeviceCaps
CreateFontIndirectA
SelectObject
CreateCompatibleDC
DeleteDC
StretchBlt
GetObjectA
DeleteObject
user32
MessageBoxA
LoadStringA
LoadImageA
wsprintfA
SystemParametersInfoA
SetWindowTextA
SendDlgItemMessageA
GetWindowLongA
PostMessageA
GetParent
SetDlgItemTextA
SendMessageA
ShowWindow
GetDlgItem
SetWindowLongA
GetAsyncKeyState
ExitWindowsEx
EnumWindows
GetWindowTextA
GetClassNameA
SetForegroundWindow
SetFocus
GetDC
ReleaseDC
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
comctl32
CreatePropertySheetPageA
PropertySheetA
ord17
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
406KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=64, version=9210,
count=2, id=25, version=9412,
count=11, id=25, version=9210,
count=151, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=101, id=28, version=9178,
count=6, id=29, version=9178,
count=1, id=61, version=9210,
MaxPayne 2/Help/html/graphics.htm
- SHA256 6b0eb720332d917c7a3af68076a3da19796b01430448391dfc79b82c8155465b
- MD5 c06b596629499bb2ff6c1211e19c6955
- SHA1 39450ce1248d9baa9e80c5805e7ef877921744a8
- SHA512 d6faebcf4536610c65cc9d7fcb01d23fe9788415c2f91193a332938cae90d85a6211db83c392e2207677c33b8020f5736b729a4bfb71cd58887da2b8e182bcfa
- SSDEEP 192:cjebRMq7qWvuxCDL+RAUTT2e73708PnRpOUURKiVrNo0txXhiEI+xcoGYuMNuGRe:mebRMq7qBxoL+hxgK4jtJZGXruCrB
- TLSH T16532E74AFE4853A20D63C366EA321190EF12901963635AEDF41F403F13591F667BF6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/Help/html/input.htm
- SHA256 6e7feaf72378c8f93060ae7b44c79ad9c891f5176ee4fd81afdfe5e7b0e93dc2
- MD5 1335b2f4ae53832da10aac63365624f5
- SHA1 e64c0a8b5eb686cdddb393943ff7f5d59f3c83ad
- SHA512 815653c2eb11a3e8ce888180d9ac554848fc3bd81ad0365ac42e502d7d276af7c73e167a3f888a719c44e7644a86034713f0f56a4cadd63ad6ebe170754f0f24
- SSDEEP 96:RwvhJK5KXI0lnEAu4AuX+jBTaj2je8tttttttttttttR:cLXIYruP9TDCU
- TLSH T1158195CBDE002DA33673C361E836A68BFB12405D13695BA9F01D625B23F516482BF5CD
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/Help/html/install.htm
- SHA256 c31cd68f8cfc970c014803af0f6bb46bc79d5ae45ac29a887407eaa686c4c97d
- MD5 b5212763991069ace9f03404b1a5e5d4
- SHA1 b2941abe2daaa647ddb18a128a9823b47c52cf04
- SHA512 736bebe3f64a723792eae18c16580a25df04b8c1547a1a855ae1b1491cf4b6c114ebcde6d2d929f73aadb7b3aa73eceb6d29f9209486a3e631c80a08c185ff23
- TLSH T14561C88AAE051E7779F3C272A83B68C6DB264049512226D4F0CD619733BD12487FF5DE
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/html/intro.htm
- SHA256 6a8ba4a4c24c933333fc888f0823e0ab6e0ba89bc6269fb31aac1302bdcbcfaf
- MD5 bd6b92a64e9ebcc13299a816785d63a5
- SHA1 54c8cb1132ae74559b647b983a56740b34e11680
- SHA512 f3232c6ff3c9166c662432f37955e1d71914dcf014345b90931d83096f73ddaacab405e360410c835b552730a7bad03760c9dcf1a41b01f5bda3710e4711bafe
- TLSH T1075184949C9529570036C2209D37A5C3EF62400B42536EEDB05D426B2FB85A083BF5EE
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/html/perform.htm
- SHA256 6ffec7278700300088ddb4922a428f0bef982e88e52077dc5685e910550d83d2
- MD5 5895a88732e8849e2f6088ad5d39e8a6
- SHA1 f8e7a6163d6d55c6c439f77bdf6d646a2c404ade
- SHA512 2fb8d9a0a6e54b863828c848fca0e91dd5486a6c29bbb0a4b3bdd0af9c997d616943f4be05efbdc8c1a7809cfcbba7e9217b3f67a997316baa99349da0c6a02b
- SSDEEP 96:RwvhJK5k06TWiBS/N4mzUa+8gT9LeF0SNpY/TMrBbEsrus4lrltttg:cH93BS/NtIaaT9LoiTEus4lrg
- TLSH T1C1B108DAEE095A976832C322553B7681FF270857101316A6B04F213F373E3A9467F9AD
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/Help/html/playing.htm
- SHA256 ed25a3972a354519bd25913be918ff5eebdabbb7535481237697b796b74e1943
- MD5 8530a7f7a5d9a146c091d6ffc62551c0
- SHA1 9959fc590c3a539a15d6f0c34e9015cb70b39a5d
- SHA512 80b8e0af68621a0add8b864c0774cdcc95efa2ac9e674bc92b76881faa2ca93539ceeab6e1413721793dca9205e52bdc72c230cad7c18d07ab536e8bc2110ba0
- SSDEEP 192:cc1dL/dz7I7RfEjhWB7oTge5xP04AoHkyHfHL4X+e0GR/Ld:fjy7FEwB7oTp5xP04AUg+e0e
- TLSH T107321AEFE7501BBA096311E46A4D31F2EB2250695371AB64B82E441F33651B303FF2E6
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/Help/html/side.htm
- SHA256 4fdc21e214b8885b8913348986f785c7f16d1878a57f1523e3b296636a592906
- MD5 0a0a693993a2abeafc7f57d23c47a5e1
- SHA1 8d3ff3b0ea703b14bae69a83843c18b7d5f2994d
- SHA512 345bca2fb8e06a29ccb78d2d16748427270f337e4da2e2e3be4799d0c5a660d092e05b51609d117a6a38960e209e1f16f1640f5b4e36a479a8bb2901b2082c65
- TLSH T13F41E19E816A57BF45950EE182AEE39B156180C3CD138DCDDAB90AC3D344F77A353B05
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/html/side_ie.css
- SHA256 77722b6a607f82020bea07e7bb8db584c862e1c841942f7079358b54a0bd2c7e
- MD5 30c784e5d187e6f7450e1e88f9f5e523
- SHA1 b45a2ba943107931857a5878b13fa7fd5d14aecb
- SHA512 03e87fd9371b4fc475e78542bfe72e6f104a852ed183d3afea05ea1bd3ecb4a71d3e7bc3adc79cabb7f5b6f3c4e52b123b5094dffb9b2d3b07018b695301648f
- TLSH T181110803851E024EF33A5C752B2B8012E6243C4E7C9A8FF137DA8A80DDB42385712B4C
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/html/side_ns.css
- SHA256 3a618e98e2a1ab68acb53cb894e12f654953bcc716104db25dca1f21c45bf8f0
- MD5 de633f8bf8e1608d75575b8719e6514b
- SHA1 a450d112895c1776f72da3982d622d0ff0f1c0cb
- SHA512 49d7ee07d9436949beda9b19f8844dfa5bd7cf25d5c39818555968b901c4702bd48d63af068a03a532d7348e651b6b5b667d507c18dd4c2b9ed3d4e022aa26d2
- TLSH T1AB018003C51E024EF73A8D752B1B9022E9243D4EBC9ACFB137DA8A80DDB42395752B4C
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/html/sound.htm
- SHA256 36adf3ab9f88d062b8ac31c8efff26e412be32c1d203e0a8145f2f11371f1eb1
- MD5 9ec654134997a5b82eca5e7020c6797f
- SHA1 490356acdcee6182e7d4fe88704359962beabfe6
- SHA512 b7c427c5ad449468b001a75c23bc110af0da7d49c95322f2783a197e8ae1437e0dfe7776ca84f0f74ec836596c00cabfd41d91208777b4fa203a214c0483c535
- SSDEEP 96:RwvhJK5OyIPd6LZieNe57DoS9hInrdwiJhx+oaAWUw/ghbtttttttttttttg:cuMkLZidDoS9htiJhMUTw/M2
- TLSH T1A0A1B7DC8D4417BB4AD3C175E43370E2CB0501AD437666A6901C322F37991A263AFEDE
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/Help/html/style_ie.css
- SHA256 fa430cd682185f1ce727b301b9dc0df44dbeb4b6100769d9e85459bd7f05cf44
- MD5 458631e3cdf80b87ea628ab591aa99ee
- SHA1 4c40cb1b1cfad2caa7b6d044e0ded14827cba306
- SHA512 9ed6afa24298a556c00975c8cbcf154cf1adf84ad8f3f87b89524510590495ae861618fbe00e78c8df5e8777450aad36a74d556aa1b4ac0bd3d58f75e9b0ad22
- TLSH T12CF0E70AE98D460BF7499849F336BE229E45748B15E983B0B5E56A48DC8142A27503D8
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/html/style_ns.css
- SHA256 1e155da66fd0057908f758426b9f4cd85c2f5eaf758dbb07e9febe158f3ea476
- MD5 14cfe5f0c30149bc1dc3322ba55100b3
- SHA1 9f626a13b2e37baf528ad2dd7568c2619b8c18a2
- SHA512 d5158ba20b89b79ac0c9f14b489bf97c98c94c316a768ccedbf4cbde7bdc09aec59b87d0c1da044b3becba5f44be2b3693139da1119229c8b09729864d538e70
- TLSH T1C1010C0AD98D460BF7499845F336FF239F4474CB05ED83B074E56648D8C143A27503D8
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/html/top.htm
- SHA256 41999e576120d6f1cb050f6bd0112f08e9760e6d3104f39968e1b38941f10694
- MD5 eae49b7ce617cfbf978d93a0df33306c
- SHA1 d8b86659ac02fd0d18ad1c4c20be8828aa8d4555
- SHA512 204efbe76209b0ca082045d9bd6068dc21c621b2272b232ece1e215702a616b765467b64693e5ff0975c47aa4e525fa7900d7b1fe07b37fcb55e3d2835e80554
- TLSH T1D001707792C8E7EFD020D174F1B1BED0C2D7149D87926E51F817643B7409218897BAAC
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/html/troubles.htm
- SHA256 a428db96e83ef80e041760e622f66e7a6c6fe65710fe0b7f0a7fd87d3e083391
- MD5 289a2b6ece4df996f7d52a8ff3f7c002
- SHA1 93f3978ad7358c9abef3a6687b049bebc0b67912
- SHA512 3f096996ba22024079f5ead671c59802379e88e9c6d96c29ce266382ac39892ec70417c111dbc8386559bd42c6d18e62248e2e15532e3488cdcee2bf573b54fc
- SSDEEP 96:RwvhJK5joFavewoyiXw4W70IQMVVntxtttttttttttttR:cQvedXaDPVVtB
- TLSH T1A39177CDED54391B0AB2C334E83661DACF1680861351BFECB41D2667276822547BF6DE
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/Help/images/1x1pix.gif
- SHA256 71d66e87a9561f8cc70f06a466a5f75a77aa9cb55e8795e0539c514eff7cf7d3
- MD5 16a098a0d6be1295817825c888a8f03c
- SHA1 609b1472e8db8411ee1d8c8240c7a17c2b01eecc
- SHA512 6fd899b855845b173295a321488fea2a8bd2081f9afdcee77720df88baf3bdfd761b159123e4343e5aba51d4cf0c8b3c00fa41dc9f3d87a2ff3153d9ee4e8245
- MD5 SHA1 SHA512
MaxPayne 2/Help/images/maxbg.gif
- SHA256 c58bbe4ec769089649e89c833015e48feb272784d005ea69fce6a45193cbab95
- MD5 198fde9345dab15b8b7f091aaa1774f4
- SHA1 956ceacc371aa8ac0db3ce0cc920a9b94b05192e
- SHA512 d56697b88a0229cae52acb5898995bb76541c38b5ad7815cfb6c2dcf4422332caa9d4d6e94253b10cd4a4e6170d1b5a4928632a5a49cf73f2a103f2475e5818e
- SSDEEP 768:rjWwDWaCDi264aQb2VObplZ2RTagDGo4yq7VcEvduDLix08T6MbJZIqywJONAD8Z:rVW5Di265I2ObZ+OnDhc6uX42qDJONvZ
- TLSH T18323027A047C584AFA16D2B56853A4C02CC882FC7F0E4D92B1A0EA548F778E61ED4FC6
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/Help/images/maxlogo.gif
- SHA256 67ca9409b6d27f7563d2ab6cac68e48587c9446aeed6439fc848b4984690661c
- MD5 571197b307b85b8afbab4f1980a6b4cd
- SHA1 afb1f08a8a74a9bfbde73501badc055d97698906
- SHA512 3582591edae0cbbbdb98b53e4d813d2d8da3bf64676ad84f2d8b4d31a9bf417f305dd00de2ab015d3378453f8d85141cf669fc02201fefbce1c8f1be1def33af
- TLSH T16A815CF8C602B4D4E49F95B6A5C1F589A50EC3B61945A2823E18E4BC2B8B42CFCD7070
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/images/menu1x80.gif
- SHA256 88032d71c38cf9c2bc7d7381ce77f9e696525cbf7ef3aa5136685c167a94c241
- MD5 8582d71c156b4e2dd2002bc606792060
- SHA1 849955495521f5f005262c0d95980b77cec86dbd
- SHA512 d77e2aa8dbc08fecfdcab8512d40880943c59840dc30bfa74c943e48a6914e41940a6a34eb53abcd4295562eb09f559dd02d5c53ea9ca265a2d611410fbfc598
- TLSH T180A02223FCC8F002C000C830080CF3B2230020000E80032BB038830BEC88000CAA082C
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/images/rmdlogo.gif
- SHA256 fce0f589b249037c4102eba3a11e4a15fbef5b388e3d78516023de6d4e341935
- MD5 a34e4b1148397f6ca0c4caee62af41ce
- SHA1 7d1c9d09030417ebe828016f280ac2570f0edef7
- SHA512 3cf9dc412214b6f56ac3dc816fb572d2e542d5d1bdc527fe088ea062ada8d8a599bd7d74cfa276e04ab4dadf0d559ae3ce5088ff41505dadb899b0a92217c4d9
- TLSH T10E310863B229E0530EF9B57C56D0CEE3CD04110824270FBDF2266ED4B608B0A5CEC67A
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/images/rockstarlogo.gif
- SHA256 69e9908bf87bd8b1a4cc9e01e8dbf098faec1e31eab30ecd70455ce40eaaf122
- MD5 111d32047a5f98ff310878af6dd04033
- SHA1 1ffd574ec2285161ff861d6b13d100ba80835a3e
- SHA512 ebc93dcf994d86f8c461a8477bc4916feeae1e644ab134982d2797d01994d79f5ce79131448a62e9b47b6bf876a522c640b98577e7cbc2a3ba8f30379266cd41
- TLSH T1B131FC693068E3A6E6B4C49270E01FEC571CB4549147B3957904B3D0B8D0FD87D7E5C1
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/readme.htm
- SHA256 a8979debe366b5fd288689fe1b070677a943b981233f256e0af9df571f6ca2c4
- MD5 e416cbc350ece2f280d68ff7ccbcfbce
- SHA1 fa4b47a300f7b0193af4efbd6344b45967dc9649
- SHA512 f1cb7b3f71dbef15542b1da1ebeb16ddb1ea8979c1d3111a7e65b675b5d1ff2015ab2d7e27698eb03a8a2e12399d27461e255790bb3327317906a2d9d51101d2
- TLSH T17E117BABD6C9990CC1338164F5F0E2562A05D4C37644EDDF76515433B845292AD8F37D
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/register.url
- SHA256 c71b84af2aff42f54e277b10934c69d2a3ee4d0230c50a0434222043dd6b2128
- MD5 3a9a791dcaa2b53193dd096e8c5c4d27
- SHA1 e3ed20761f3c09886c90037a492c707b2327d13d
- SHA512 733394d6d7b1ee33efd00dd79414da286fe9094fdd187f5667597f8e19c8a906d77b1380f4f7265a7f6da8e5d3e912bc94d33e43a7cc6fefe1275620d43bba66
- TLSH T189C09B98416DD66B84B355095C74DD54BCC624C5815BCD5453619F440DC2085699B71D
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Help/support.url
- SHA256 287a8e2b7bb8cdb24757c5e0dc7b8c04383767217d0f7b2ec8c70c02047d8aa1
- MD5 c2cba010215c90abbb617cf2fec8dc76
- SHA1 2337dc080003ba519b80bcd79a2e8bd8e674faa4
- SHA512 e65c2144dd6e57087e385668626239d1cb500b7bc879c9ecbe97c1ebaf59f1d0e34e08fd5f78d146b36fbee3e4d999a45c3d12558e1646d974e9556577d3a9b5
- TLSH T192B09BC9455DE52D80735D495474CD14ECC575D1855ACCD44350FF440DC10817B85516
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/Install.exe
- IMPHASH 5dc9c4d3cdd2972e3db12ca4a57d1069
- SHA256 42e7bbdfcb42ca99cb5b7a5e6f2432fa2e5ab4e91da923d12836f9ef082eb07c
- MD5 468d6e941908249c18d1c3479be2dc6d
- SHA1 145fb1b1e9c8aef8fc2e283a691b43e4788bda03
- SHA512 752beac87fe0b32401b8e3c9f4ef3364beef34f4c32482dbc6743cd5f89479e01ebf8153cba3dc268f02874746de92c76cc684ebf3a3f28f8051619074f82719
- SSDEEP 1536:c6OyaJd9woNdUAZbK12ovnwPD77DOsU+z0Nx91VOco53:c6pRyhovwPDrOJmco53
- TLSH T1A6C34A167AE6D8B5D8C50171C9628AF1876EFC23D9E09647F7847E0E3E309D1CD26287
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13071
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetVersion
CloseHandle
WaitForSingleObject
CreateProcessA
lstrlenA
LocalFree
lstrcatA
FormatMessageA
GetPrivateProfileStringA
CreateThread
WriteFile
SizeofResource
CreateFileA
LockResource
LoadResource
FindResourceA
GetWindowsDirectoryA
Sleep
DeleteFileA
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
GetTempPathA
GetFileSize
CopyFileA
GetPrivateProfileIntA
FreeLibrary
GetDiskFreeSpaceA
GetProcAddress
LoadLibraryA
GetTempFileNameA
SetFileAttributesA
RemoveDirectoryA
GetLastError
lstrcpyA
GetCommandLineA
ExitProcess
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
GetUserDefaultLCID
RtlUnwind
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetSystemDirectoryA
lstrcpynA
OpenFile
GetModuleFileNameA
lstrcmpA
GetStartupInfoA
GetModuleHandleA
HeapFree
user32
PostMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
DefWindowProcA
PostQuitMessage
DialogBoxParamA
wsprintfA
LoadStringA
SetDlgItemTextA
SetWindowTextA
EnableWindow
GetDlgItem
SendMessageA
EndDialog
DispatchMessageA
SetWindowLongA
GetWindowLongA
InvalidateRect
ReleaseDC
GetDC
EndPaint
BeginPaint
DrawTextA
FillRect
GetSysColor
GetClientRect
MessageBoxA
GetWindowRect
GetSystemMetrics
SetWindowPos
FindWindowA
IsWindow
RegisterWindowMessageA
gdi32
RestoreDC
SetTextColor
SetBkMode
DeleteObject
CreateSolidBrush
SaveDC
Name
.text
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=121, id=1, productName=Unmarked objects,
count=7, id=19, version=8034,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=11, version=8797,
count=13, id=14, version=7299,
count=42, id=10, version=8797,
count=8, id=11, version=8799,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
MaxPayne 2/Install.ini
- SHA256 0b6a3c73dc6205c93a8477816ca701032351b0cad9f116f871a29e629847819d
- MD5 af53f6a7bad3d2aca2cd712eda860cb1
- SHA1 375c3188ad17cd4109a6a77ec93825bc55922614
- SHA512 f5eae89f51a27b10ff7b56e97b97ce8915d108bef8bf4b32d9aead66a3824ef22a4f6a75313abd7078ee88d387deba5cfa8ed436ab05fc54c365744bd53353ab
- TLSH T159E06187437704B404C016A16F77B0BF4A35C5A846207617C4B5ABDF1EC429C1C599D1
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/autorun.inf
- SHA256 19ddee89423151b3ff4272973630cb85e50dcb42d6301621134ca8e9e70e8aa5
- MD5 efe86ec1e67d6cc30e60bfa02438da02
- SHA1 2714efa4b29a17a8fc6d59b9fb73ee946f6f9678
- SHA512 83830684a5ef8ab28bc9d688accbc6db823650cf183627e232ad2b81533bcf2cb4fe042ff89b3050520da9fea70a3bc2e43399dbac049dd0df5fe1d7533ab27f
- TLSH T1FC9002C4C90400A8324925E1238B1821C187F0A846244094438A9499051114D1F18C23
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/data1.cab
- SHA256 9d6b43a1c13cac0c544e336445c9c8ee238721614e048464f8b5e8ecb949070d
- MD5 e01aa372cf3c7d953e106f66f96a736e
- SHA1 d6f4531f87a153b6ba6d64796a122c86a071a985
- SHA512 2a3da8d9a5b52c380f617cdfb87a24bd809a05cc4c8194e6c551d4f14bb804cdb16a0b642726c70688e24f9a707ab346ef3b43148cc8901141e8304a56b6f868
- SSDEEP 6144:a9ayjRMDqYuf2iofqorPJVTRBLnM+M78+yUscmvcc2VAnLQFe9NX:IaymDVyoVrPLTLML4+NFw2WnLQY9Z
- TLSH T1996423ECAD8C82B6FCDC053A9274A81136D9D75943F0FFE4D25DEA3016651AE6DC006E
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/data1.hdr
- SHA256 0ff08596db5c35dc857253611cbb96f62d2edec9206d364183ee0bd7b716567a
- MD5 7dca1f415b16f0b94b148632c39adc63
- SHA1 7d5578d40512015dc329b62ec26e2f2282cba8ce
- SHA512 814d67f6ed3879e7df6100845d7d2213575ca2cfa2e2624ebf81f732b89140cbf41fee9dad2104bd261ca9f63c4a9dec3f499a45f4497a1fc2a535b298f721b5
- SSDEEP 192:MhCsWVX+1Tl9IGhhbslTEOnGAiEyTPFSAHfHfHzD2r2je4l4BEQO5eoC/4XP5Zyn:9sWVXEl9vhVsgHtx4tOUoC/40Yva
- TLSH T1D982225B5B60EEDEDC00F3757347228922E1A244C2B2C3AB615860EC7BF76C66E75394
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/data2.cab
- SHA256 f826ff248b7f4cf65ffcb819ea71d341bdb5d6293cdebe8d1dc64f4cc36ed07c
- MD5 93cb826485c6d04655a2b23a67117e7d
- SHA1 e6e4eb0a4f112f73192ccd31a041bec1f823363d
- SHA512 ebd6b3bf3b92b209ebfde0c19eade72b31f4d69347786567e5b72e0978a172bbb7383d6f34644ea0abe4a99bfffb2077c6051eb8b6c161784a248d573d72785c
- SSDEEP 12582912:MFbv/GHF+KjDTeMrprCxwwdragJezxjEwNJf4NQyZlktMR8DXNsrLGE/gwfcXFia:iTGlfPe6prCzr+xjz2NQyZlMMys+E4w4
- TLSH T1E17933CD841BB88FDD415CE418D85D22D2700C40A1A8D5AA6BCBBF9339D09B2E7A5F5F
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/engine32.cab
- SHA256 a5b857c9168aca517266f64ccba84d9866442250c0532846ad016a295c044523
- MD5 1bc10e0ff6f2145e609997d6b1e07944
- SHA1 052aad1fe7613cbbfe9147311f709c8f2fcfb377
- SHA512 872d008ae2acd60a5ff63324dfc42598d2caf33dfe7895fff667f7d0da66c33380732de7a282d5760a890c17be2dd318d4d9f38088cbd8bce2ab71d42d593854
- SSDEEP 12288:v8L+ucLltn3BDxAHD8/WHN6tVPXcpxWMyE+0mp2EAtrQIxR3G:EL+ucb40XfcphyizxLG
- TLSH T1FE9423CE43D0BC44FFF5A6E02F77469A686F3A7CC62C4A141E00E5545D59EAB27F08A2
- MD5 SHA1 SHA512 SSDEEP TLSH
DotNetInstaller.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dc6f18f38ad199ceb9f7be94316aeb46b156bcb040059b5f60acde41bfb16ef9
- MD5 19d3dc3c2159c407800d69089ba8ce3d
- SHA1 636c1ce473252ab09fdc6d1d95658530dd413da8
- SHA512 9213e33e50887ffe6d90a4a66964c2b88d8fd2585bf7d3f008798de4fc06b873e868de0688331c897fb32f310e902c2b2682928b01fffb03ff86a55d284f964a
- SSDEEP 48:6WvdiAX7JBqVKk5YCfpZBAu8GPTUc4gQ+fzK/4hotiuwV5ZYNunoS8iwegMb4N0i:fdiAX7J0VJyopJwUQ+u/4FlZYhnsC
- TLSH T160C16255E3E88335FDB78F3EBDB336924575BB10CDA2A76F098E010B68355608971B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IScript.dll
- IMPHASH 01079e578402fb3b7165570d3ad44913
- SHA256 9fae0665d7b6d21a93a73708249bd44337910cf4f32210c584eda24733cacf7f
- MD5 742679327ee56723096eb5aa5928be26
- SHA1 20c6d65b0ae8e5e98198cf6dc993c60ada1d6553
- SHA512 05fa9e09fa3fd114eb1dbb96f27c680d78a82e318731a81174e68fe559e1d9f1b3565f2e7eff6b838ed41a429fd00577f2bb5885015bc68bb04d0f97c3150bf1
- SSDEEP 3072:tn+NO80l7dwCkl9n4G2hxIDXTDooqcQNiplc8uX4jBSa6YTOzDx/iTEJuJIcQVxo:1Ovfb0NiplcYlob1gOHxDQt
- TLSH T1CD346C2138E4C435C3A71C35AB6BAFE9D7EEA754CE71058B23AC0B5CEF39944C52251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
120993
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
GetShortPathNameA
GetModuleHandleA
lstrlenW
lstrlenA
GetModuleFileNameA
lstrcmpiA
HeapDestroy
FindClose
FindFirstFileA
GetFileAttributesA
CreateFileA
MultiByteToWideChar
EnterCriticalSection
CloseHandle
UnmapViewOfFile
ReadFile
WaitForSingleObject
SetEvent
FreeLibrary
LoadLibraryA
GetProcAddress
GetOEMCP
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
LocalFree
GetLastError
FormatMessageA
WideCharToMultiByte
QueryPerformanceFrequency
CreateEventA
IsBadCodePtr
ResetEvent
GetACP
GetStringTypeW
GetStringTypeA
SystemTimeToFileTime
VirtualAlloc
WriteFile
IsBadWritePtr
HeapCreate
GetVersionExA
VirtualFree
GetEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentVariableA
FreeEnvironmentStringsA
GetStartupInfoA
FreeEnvironmentStringsW
IsBadReadPtr
GetCPInfo
Sleep
InterlockedExchange
GetStdHandle
SetHandleCount
GetFileType
LCMapStringW
UnhandledExceptionFilter
LCMapStringA
SetLastError
lstrcatA
MapViewOfFile
CreateFileMappingA
GetFileSize
VirtualQuery
VirtualProtect
SearchPathA
lstrcpyA
GetWindowsDirectoryA
lstrcpynA
GetCommandLineA
GetTickCount
QueryPerformanceCounter
GetVersion
HeapFree
HeapReAlloc
HeapSize
RaiseException
RtlUnwind
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
SetUnhandledExceptionFilter
TlsAlloc
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
TlsFree
TlsGetValue
user32
MsgWaitForMultipleObjects
PeekMessageA
LoadStringA
wsprintfA
CharLowerBuffA
TranslateMessage
GetDesktopWindow
GetMessageA
DispatchMessageA
PostThreadMessageA
advapi32
RegQueryValueA
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
ole32
CLSIDFromProgID
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
StringFromCLSID
ProgIDFromCLSID
CoTaskMemFree
oleaut32
GetErrorInfo
SafeArrayRedim
SafeArrayGetUBound
SysStringByteLen
SafeArrayCreate
DispGetParam
VariantCopyInd
LoadRegTypeLi
SafeArrayGetElement
SafeArrayPutElement
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetDim
SysStringLen
SafeArrayDestroy
SysFreeString
SysAllocString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit
SetErrorInfo
CreateErrorInfo
SysAllocStringByteLen
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
156KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=26, id=14, version=7299,
count=85, id=10, version=8047,
count=15, id=11, version=8047,
count=3, id=11, version=8798,
count=3, id=28, version=9178,
count=2, id=37, version=8755,
count=11, id=25, version=9210,
count=164, id=1, productName=Unmarked objects,
count=16, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
IUser.dll
- IMPHASH ed67065e5e9b57547897a7e97c585c27
- SHA256 36f4b8a79035b4df985dbeae8e42312a6ff74d947275ac312d5f2a3fd45b4030
- MD5 85b1375725843284c7987b6bad170bcc
- SHA1 490e87557116cc75167044d18f50af47167df467
- SHA512 7fc14814bc06c176796c0fbab17dd2131859db35f5c53685792d8e1c0b2ca3da16af017df20b0f035ef44a10bb92c5a556e26ed1a37f16bf3ad3e7212f74d02c
- SSDEEP 3072:QUJ07LpRZLzwIWBmSoAExjbctb7gnWwJfc/UNU:R0RHzMBm8tbV8
- TLSH T1E8E39E1276E0C477C399017E59643F3BA7FFA2588DF00A434F280ADD9DB5A61C93A297
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63145
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InitializeCriticalSection
DisableThreadLibraryCalls
lstrcmpiA
LoadResource
HeapDestroy
GetTickCount
FreeLibrary
FindResourceA
FlushInstructionCache
LockResource
GetCurrentProcess
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
lstrcatA
GetModuleHandleA
GetModuleFileNameA
GlobalFree
LoadLibraryA
GetProcAddress
GlobalUnlock
GlobalAlloc
GlobalLock
GetShortPathNameA
DeleteCriticalSection
EnterCriticalSection
GetEnvironmentStrings
CloseHandle
FlushFileBuffers
SetFilePointer
SetStdHandle
ReadFile
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetFileAttributesA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
TerminateProcess
ExitProcess
SetLastError
HeapAlloc
TlsGetValue
lstrcpyA
TlsFree
TlsAlloc
TlsSetValue
RaiseException
HeapFree
GetVersion
GetCommandLineA
RtlUnwind
InterlockedExchange
Sleep
GetLastError
LeaveCriticalSection
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
user32
DestroyWindow
GetDlgCtrlID
GetClassNameA
MessageBeep
IntersectRect
IsIconic
EnumChildWindows
SetWindowRgn
LoadIconA
ScreenToClient
GetWindowRect
FillRect
GetSysColor
GetDlgItem
MoveWindow
SetWindowPos
SetWindowLongA
GetWindowLongA
ReleaseDC
GetDC
IsWindow
SetWindowTextA
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
EnableWindow
GetDesktopWindow
CopyRect
OffsetRect
DrawTextA
wsprintfA
GetDlgItemTextA
GetWindowDC
DefWindowProcA
CreateWindowExA
GetParent
ShowWindow
BeginPaint
EndPaint
SendMessageA
UpdateWindow
GetWindow
SystemParametersInfoA
MapWindowPoints
CreateDialogIndirectParamA
ClientToScreen
SetFocus
SetDlgItemTextA
AppendMenuA
InvalidateRect
DialogBoxParamA
GetSystemMenu
RemoveMenu
LoadStringA
GetClientRect
GetClassInfoExA
RegisterClassExA
GetWindowTextLengthA
GetWindowTextA
CallWindowProcA
gdi32
DeleteObject
CreateRectRgn
TextOutA
SetTextColor
RestoreDC
SelectObject
SaveDC
SetBkMode
CreateFontIndirectA
GetDeviceCaps
CreateSolidBrush
GetStockObject
GetTextExtentPoint32A
Rectangle
DeleteDC
BitBlt
DeleteMetaFile
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
EnumFontFamiliesExA
advapi32
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
ole32
StringFromCLSID
CoTaskMemFree
ProgIDFromCLSID
oleaut32
SysStringLen
SysReAllocStringLen
GetErrorInfo
CreateErrorInfo
SetErrorInfo
SysFreeString
SysAllocStringLen
LoadRegTypeLi
SysAllocString
winmm
mciSendCommandA
sndPlaySoundA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
96KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=26, id=14, version=7299,
count=100, id=10, version=8047,
count=1, id=10, version=8966,
count=15, id=11, version=8047,
count=3, id=28, version=9178,
count=2, id=37, version=8755,
count=15, id=25, version=9210,
count=200, id=1, productName=Unmarked objects,
count=22, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
IsProBE9x.tlb
- SHA256 dd00fccb31404c91dde4ef5153116619d48871d8cbc9d4bb9d4cc0429c9488a3
- MD5 2c7369d67bdbd20bc131701a61afd4a7
- SHA1 1126ed5b87809b33c4e2ca236f10765b2f255da9
- SHA512 f1abca95c228748122f3896bb86f2bc4bf0826ced84d989a706d8d0eb1612e17e55498c190fe65ab26ad5ca081d4a110ccdd483629f47f39f5ee6fc2b639c226
- SSDEEP 1536:UDJVFBxiiFVH8MtyzE98kFP3mgrSkPxh2DuQZxh:8JVFBxhz93mmK
- TLSH T1FD937131BB03DA11D9015BB60CA7C7EA8F24FD93EE5502433A85BB8F7CB57948D99281
- MD5 SHA1 SHA512 SSDEEP TLSH
IsProBENT.tlb
- SHA256 0f0fa3d16fe519155f7ee51594e54be34f46c785a18c8278fdeef571f594ace3
- MD5 a1200142ffc51c3ddf558ee2a97f559f
- SHA1 b5c97c457cb90bd05538708c0ec550d966634b22
- SHA512 3734721f50c8c78a9975030277e260ab4768805a3719f243e376a9bea12c6a62b5ab0e648760845bb45805a396958fbf74a5b6f646e068480de31e1793eb45b1
- SSDEEP 1536:BlsFAquifFyBk4K9cJhg1kZV/V6K/cms4YRB:BQDFyBhK9co1k3NNG
- TLSH T11F835082FB82CAB3C40D0631481B57EA1FB1A04A6F17B7573388536DAEB33C5BB55658
- MD5 SHA1 SHA512 SSDEEP TLSH
ctor.dll
- IMPHASH 66e125b3db52dda3a29db9e25cbdb706
- SHA256 ad48c416a57a9f8a47ec4c8f82f25430a2da42730c3891b43a44c1f21e7f5932
- MD5 e3db818aca6889a18fee5ebef336d305
- SHA1 d68f8cc397f448c5fa6265642833a36a680e60ae
- SHA512 1c44160f74b7afe992e6818689e375e88d07203856f6167e1602ead64210bd09787c2fb41ba31f21542861bcbc67f03b45e113937a9b069e8e5e2dadee9785e4
- SSDEEP 768:j1npoNeR33mrMTCnbvyZn6TF8cg4IL+nhmurNVNVtfyyuCNcnbMv9mnf:j1eNwm/baYGqPSzrAv9Of
- TLSH T1C5433B06B7E2C171F6E330B6CE8537DC62EEB71A1116812A875488C33E71B75C6A7A17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30247
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CopyFileA
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
SetLastError
CreateFileA
GetLastError
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
CompareStringA
CompareStringW
GetPrivateProfileIntA
CreateEventA
HeapDestroy
LoadLibraryA
lstrcatA
DeleteFileA
GetTempPathA
GetWindowsDirectoryA
GetTickCount
GetFileAttributesA
GetTempFileNameA
GetCurrentProcessId
GetCurrentProcess
DebugBreak
HeapFree
GetPrivateProfileStringA
GetProcAddress
LoadLibraryExA
FreeLibrary
DisableThreadLibraryCalls
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CreateProcessA
CloseHandle
lstrlenA
lstrcpyA
GetModuleFileNameA
GetModuleHandleA
lstrcmpiA
GetShortPathNameA
GetSystemDirectoryA
GetVersion
GetCurrentThread
user32
MessageBoxA
CharUpperA
LoadStringA
PeekMessageA
MsgWaitForMultipleObjects
wsprintfA
CharNextA
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegDeleteValueA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
ole32
StringFromCLSID
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CLSIDFromString
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
CoLoadLibrary
oleaut32
CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantChangeType
LoadTypeLi
SysAllocStringLen
VariantCopy
VariantClear
SysAllocString
SysFreeString
SysStringLen
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
LaunchSetup
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=14, version=7299,
count=3, id=10, version=8966,
count=5, id=28, version=9178,
count=2, id=37, version=8755,
count=9, id=25, version=9210,
count=98, id=1, productName=Unmarked objects,
count=9, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
iKernel.rgs
- SHA256 657148f0d0f043ef3e62c7c7ab0578147025edcf59431f2055b45dbd8ac673b8
- MD5 4df94a4c0cd342707098e6662325dbf8
- SHA1 a69aaf162e6a2081f25c8b8976168306a2b5a8ee
- SHA512 07f6ac2751679702b460cdf3d6b4b6821244c5777a6cbed7785ccb4fd057c42f361ace9c9017a47b1c01d3c8a01f161de479306985d27f6958ae8c2d40084836
- SSDEEP 96:FQsYSD9hdM6piTwIBwDrluPnT1JO2dLeZd33GhYcbatByBH9RLVxnRIo5tW2WzWk:FTGrBGMJtqBnK3vK164J3PMi
- TLSH T11FC2C48037CB28A9DA5E110811B53260E98FF5854CE4E5BCC33ED4D5CAE49E6F256FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
ikernel.dll
- IMPHASH 988db718d62757db625a58f79ec644ee
- SHA256 7b5542d5c304f3f5ada9eedfa3fb82c28bec97a0d49e9f0ddf61b7a65006e301
- MD5 8230d489547e2f1c0af852f81d1d63be
- SHA1 95e4ae5e66f60d51a29a007869e3f380d82549f4
- SHA512 7a75352290c6595ec47eb9698626adbeef8b4a4c62399e0620d6fd7fc40fa9adbd49333bc53c21dffdedb89486d13f9b18502ee23ab8394a5a8d51834dda82ed
- SSDEEP 12288:N2aUlDkHQ8vcQvDK37FrapXcqBqJJjZUDK4tjZclFT7eXF3tAdSpdBacJysnXJVb:wLlD6vcQ2prwX8JJjyDK4tjZax613tAY
- TLSH T192E48E1339E4C176E39E0132EA2C5778A2F896654D3049477B588E6E6F7ADC6C023F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
449896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
Sleep
CreateProcessA
GetPrivateProfileStringA
lstrcmpA
CreateFileA
QueryPerformanceFrequency
CreateEventA
SetFilePointer
ReadFile
SystemTimeToFileTime
GetSystemTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileSize
GetFileTime
CompareStringA
CompareStringW
GetVersionExA
WriteFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
LoadLibraryExA
SearchPathA
FreeLibrary
WaitForSingleObject
OpenEventA
GetCurrentProcessId
GetWindowsDirectoryA
CreateDirectoryA
CopyFileA
GetVersion
GetPrivateProfileSectionA
GetShortPathNameA
DisableThreadLibraryCalls
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
SetEvent
LockResource
LoadResource
SizeofResource
FindResourceA
SetFileAttributesA
RemoveDirectoryA
SetFileTime
GetCurrentProcess
WritePrivateProfileStringA
GetSystemDirectoryA
WinExec
MoveFileExA
IsBadWritePtr
IsBadReadPtr
GetPrivateProfileSectionNamesA
WritePrivateProfileSectionA
MoveFileA
ResetEvent
DeleteFileA
GetPrivateProfileIntA
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
lstrlenA
GlobalAlloc
CloseHandle
GlobalLock
InterlockedDecrement
GlobalUnlock
GlobalFree
FormatMessageA
LocalFree
InterlockedIncrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
lstrcpyA
GetTickCount
LoadLibraryA
SetUnhandledExceptionFilter
TlsFree
SetLastError
GetLastError
HeapSize
HeapReAlloc
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
LCMapStringW
TerminateProcess
ExitThread
TlsSetValue
GetCommandLineA
CreateThread
HeapFree
GetCurrentThreadId
RaiseException
RtlUnwind
HeapAlloc
QueryPerformanceCounter
lstrcpynA
InterlockedExchange
TlsAlloc
ExitProcess
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
VirtualQuery
GetCurrentThread
VirtualProtect
GetCPInfo
GetACP
LCMapStringA
TlsGetValue
lstrcatA
GetOEMCP
user32
PostThreadMessageA
MsgWaitForMultipleObjects
LoadStringA
wsprintfA
CharUpperA
GetDesktopWindow
CharLowerA
ExitWindowsEx
PeekMessageA
CharLowerBuffA
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA
advapi32
IsValidSecurityDescriptor
ControlService
QueryServiceStatus
OpenServiceA
CloseServiceHandle
RegEnumValueA
DeleteService
RegDeleteValueA
RegQueryInfoKeyA
RegConnectRegistryA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyA
GetFileSecurityA
RegSetValueExA
SetFileSecurityA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
RegQueryValueA
OpenSCManagerA
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
ole32
WriteClassStm
ProgIDFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
StgCreateDocfile
StgOpenStorage
StringFromCLSID
CoLoadLibrary
OleLoadFromStream
CoCreateGuid
CLSIDFromString
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
StringFromGUID2
OleSaveToStream
oleaut32
SafeArrayGetDim
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SafeArrayGetLBound
SafeArrayCopy
SafeArrayGetUBound
SafeArrayCreate
SysAllocStringByteLen
GetErrorInfo
VariantChangeType
SafeArrayGetElement
SafeArrayDestroy
SetErrorInfo
SysReAllocStringLen
CreateErrorInfo
VariantCopy
VariantInit
VariantCopyInd
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
VariantClear
SafeArrayPutElement
SysStringByteLen
rpcrt4
UuidFromStringA
UuidCreate
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
504KB
Virtual Size
501KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
92KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=12, version=7291,
count=28, id=14, version=7299,
count=89, id=10, version=8047,
count=15, id=11, version=8047,
count=3, id=11, version=8798,
count=2, id=37, version=8755,
count=5, id=28, version=9178,
count=15, id=25, version=9210,
count=245, id=1, productName=Unmarked objects,
count=6, id=10, version=8966,
count=76, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
objectps.dll
- IMPHASH a946c4bf5da14af630ebc8e61f6454ef
- SHA256 dfb91bc980fd1267fb8032b0d36c72d08fca03bb723d895be481ae7d275174e4
- MD5 f68ba4725d1aaf180ff33cf18d262c5e
- SHA1 c80aa11dac0425dcc41e44a955036dbbb773cdc9
- SHA512 7aba373385f2d7a9d4bba03facc2df50bb1a644580fcfbfabab090bccc835b25c48a8432325d1bf380795e92a700e45a8615138a609e8848dc7f82c9b4cfdbc8
- SSDEEP 192:wC7QKb0lcjICIpWBCaE0c2ALrk0z+gfJagCaUAgHFWSVDdHVHUCDznkwAzHks5:wrYhCYBWZzrzSeagGfHdDdJUOgss
- TLSH T182E2C6A1EA769622F09640301DB15777F539BCB0652CE133F788DD1E28790E1A67E713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8576
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
RtlUnwind
rpcrt4
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrProxyErrorHandler
NdrClearOutParameters
NdrProxyFreeBuffer
NdrPointerUnmarshall
NdrConvert
NdrSimpleStructMarshall
CStdStubBuffer_DebugServerRelease
NdrProxyGetBuffer
RpcRaiseException
NdrProxyInitialize
NdrPointerFree
NdrPointerMarshall
NdrStubGetBuffer
NdrPointerBufferSize
NdrSimpleStructUnmarshall
NdrStubInitialize
NdrInterfacePointerMarshall
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerUnmarshall
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrProxySendReceive
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
762B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=5, id=25, version=9210,
count=41, id=1, productName=Unmarked objects,
count=3, id=10, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
MaxPayne 2/layout.bin
- SHA256 a772ad6aad18ce1e4f291ff974b84bfda47dfe6823a2e148c77f4e369d9d9a9e
- MD5 d9f30be5e8601140739c77a12df3f865
- SHA1 c9c9ff82ff606f4a89f892611bb52fd404022f4f
- SHA512 ac987f9e6aff7ad09e21bce755791310341d93a8553de7e0e989d45a7df3c919629d491a8d3e2129fa65d6132c004a0a8eaeeb82d753a66051ea520eee5793f9
- TLSH T118F0A92E38034846C3121EFC683F0AAD4EB07270C222C2A9B320B0993D3E318FC91182
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/setup.boot
- SHA256 b0cd28a617b5ed0a0c57f568156b0d6842ee418e45ae30a61bfac7d11795e763
- MD5 34e9f9d30331239daf92c578c1cf69ed
- SHA1 772c0a9f4769535cb9f658d58d0a2d8c03de27e9
- SHA512 4d3262f24c85191c857061efc2c69ad87a69b3b06a5b944925d15efac0e4d5d017b5f62febecea11d0f29c24924c09606b917efbe2d9bf61a7bdc2f628ddf147
- SSDEEP 6144:JkRkXa5wvsl/1i3nRbrMexdYS+Jvk8T3f1SmSWT3Q8qum+Dyd+:JkKXUms+prgjvkO1RRAxeu+
- TLSH T1327422B2CBF1CFFB37D9F5D829360352ED0F5D9486400D5319EB928E051AAE06A9E583
- MD5 SHA1 SHA512 SSDEEP TLSH
MaxPayne 2/setup.exe
- IMPHASH 5523dda9a438aa3992e03f3746f19bf6
- SHA256 e25cadc80ea5163e0f1c6fd703479469d9f23b47ade244fac5f22bcdb01b39bd
- MD5 5b2065fa6f2ec63fe28be26fdb7b0480
- SHA1 e6d5fde72e7dd1d6581ff6dc05c4d00c795cd760
- SHA512 51dcbf8583104754902a9387da0c2efd05b04842ffb043f3d1035940f6c612e8e20259932e0ebf16e1857c6764596017fe7db3736cab62d3d3f62804535a8417
- SSDEEP 1536:M1SzFn4NZDFS88W5JbOh9n9BkQ43/AM/rdJlR2zB0orjaJLtgb:M1qn4NVFS/YK/9uBAKdJlR2m+aJLtgb
- TLSH T1AFB33912B7E68076F6F31731AD7963A18ABFBD302938C51F5344324D1EB2A91CA60727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
e1:9e:3e:ac:50:1a:00:2b:e6:09:94:98:ca:08:54:71
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=InstallShield Software Corporation,OU=Research and Development,O=InstallShield Software Corporation,L=Schaumburg,ST=Illinois,C=US
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Jan 7, 2004
Subject
CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d
Serial Number
01
Issuer
CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d
Timespan
Aug 1, 1996 - Dec 31, 2020
Subject
CN=InstallShield Software Corporation,OU=Research and Development,O=InstallShield Software Corporation,L=Schaumburg,ST=Illinois,C=US
Serial Number
08:d1:35
Issuer
CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Feb 12, 2002 - Feb 12, 2003
Subject
CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.
Serial Number
08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 28, 2001 - Jan 6, 2004
Minor OS version
0
Major OS version
4
Entry point
45516
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
version
VerInstallFileA
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GetLastError
SetLastError
lstrcmpiA
lstrlenA
CompareStringW
GetVersionExA
DeleteFileA
CompareStringA
GetWindowsDirectoryA
GetTempPathA
GetFileAttributesA
GetTempFileNameA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
GetTickCount
LockResource
LoadResource
FindResourceA
lstrcpyA
SetErrorMode
FreeLibrary
RemoveDirectoryA
LeaveCriticalSection
EnterCriticalSection
CreateThread
CreateMutexA
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
DeleteCriticalSection
SetEvent
OpenEventA
GetModuleHandleA
GetCurrentThreadId
HeapAlloc
GetSystemInfo
HeapCreate
lstrcpynA
lstrcatA
GetPrivateProfileIntA
lstrlenW
FindFirstFileA
SetFilePointer
GetProcAddress
LoadLibraryA
GetShortPathNameA
GetSystemDefaultLangID
MoveFileA
FindResourceExA
GetFileSize
HeapDestroy
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SizeofResource
GetStartupInfoA
ExitProcess
GetCommandLineA
DebugBreak
HeapReAlloc
HeapFree
VirtualQuery
VirtualProtect
SearchPathA
ResetEvent
QueryPerformanceCounter
SystemTimeToFileTime
lstrcmpA
MultiByteToWideChar
GetCurrentThread
GetVersion
IsBadReadPtr
ReadFile
Sleep
WriteFile
CloseHandle
CreateEventA
QueryPerformanceFrequency
InterlockedDecrement
InterlockedIncrement
CreateFileA
GetModuleFileNameA
CreateDirectoryA
WideCharToMultiByte
WritePrivateProfileStringA
GetPrivateProfileStringA
FindClose
CreateProcessA
GetCurrentProcess
user32
MsgWaitForMultipleObjects
LoadStringA
CharNextA
PeekMessageA
PostThreadMessageA
CharUpperA
SetTimer
SetWindowRgn
DialogBoxIndirectParamA
SetActiveWindow
CharLowerBuffA
CreateDialogIndirectParamA
GetDlgItem
SendMessageA
SetDlgItemTextA
LoadIconA
GetWindowRect
SystemParametersInfoA
SetWindowPos
CharLowerA
GetWindowTextA
GetDesktopWindow
ScreenToClient
MoveWindow
KillTimer
DestroyWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
SetWindowTextA
ShowWindow
EndDialog
wsprintfA
gdi32
CreateFontIndirectA
LPtoDP
GetTextExtentPoint32A
DeleteObject
GetObjectA
advapi32
RegCreateKeyExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
RegCloseKey
RegOpenKeyExA
RegSetValueExA
AllocateAndInitializeSid
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueA
FreeSid
EqualSid
ole32
CoTaskMemFree
StringFromGUID2
GetRunningObjectTable
CoCreateInstance
CoCreateGuid
CoReleaseMarshalData
CoInitialize
CoGetInterfaceAndReleaseStream
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
StringFromCLSID
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
VariantCopy
VariantClear
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SysAllocString
lz32
LZClose
LZCopy
LZOpenFileA
Name
.text
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=10, version=8047,
count=12, id=14, version=7299,
count=3, id=28, version=9178,
count=2, id=37, version=8755,
count=177, id=1, productName=Unmarked objects,
count=15, id=25, version=9210,
count=15, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
MaxPayne 2/setup.ini
- SHA256 0851d55ab99c14dbaa0ebd54cb1a698f45a7517399ec6c7036c194508b17981e
- MD5 104f156d5adb29004817eec0594c33eb
- SHA1 51b00755762cb08241ba9c8078df4551e3b92a9f
- SHA512 b2b0555cc4fd31d2517ddb9ea0bf8eabfc27f66d687320e096f168bee97c4606829ce13b2b6bbc2e2885cbe58a419b087ec559d7a5a6bf872d2978a9ab10c48c
- TLSH T14AE0F14B8229882F25515E6532B163949BD2F4ECC459C488C2C0BD3E1FFAE46E48DA0B
- MD5 SHA1 SHA512 TLSH
MaxPayne 2/setup.inx
- SHA256 60c765840fac7d3d502b384d65659b62b53e34b15e181bd0365448313e4a015a
- MD5 f34be693409f16a7b79652a700b4ed0e
- SHA1 d6b121af3ab28c1ec50c284a49670b04a1af8e48
- SHA512 2940d2fd63e7f8e247dd0fe009f49e87815bbb2e95013147eab231c1edc70eff778a2a1f5ad6a82639c5082473a5b1c0d444574aec22562c4617ceb491b1fb3b
- SSDEEP 1536:Ue+c0BHNYPY8jhUOyvX7xIx0zHnatq4eHPjWPYn8xjMToTnToTuToTurECv3Ec1Y:eMBhaX7mhrEAo
- TLSH T1D404DD71B0516E1BE37D9B3BC867D5337360B0549F23AB2621AB772C6C8552B2F422B1
- MD5 SHA1 SHA512 SSDEEP TLSH