stlupdt.7z
- SHA256 9c93454072525b2c4bd008221b42598260f5149135fd18e8df55027d80b54cec
Password
password2026
Behavioral task
behavioral1
Sample
sslconf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
sslconf.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
300 seconds
Behavioral task
behavioral3
Sample
sslconf.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
300 seconds
Behavioral task
behavioral4
Sample
sslconf.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
300 seconds
General
- Target stlupdt.7z
- Size 3.5MB
- Sample260705-te21msdw4w
- SHA256 9c93454072525b2c4bd008221b42598260f5149135fd18e8df55027d80b54cec
- MD5 215052dfb239a9ef3554d5f8870f27ba
- SHA1 bb21a97ff12815a04eacac6e74168beb3952e627
- SHA512 bba9cf5f2fcec108a8492df3f623ebb31b912f3ef99791e0050bac84dc7e2bac2dd5163473b0d07a6011c0108a3ce67690af7f3be05086f4032e61855541605a
- SSDEEP 98304:wjvznXreqKpupY02N2jjCYcHT1zu7ZQ3eMTWxMjL5Q:WziqxpYbN2nCYcHT1t4MjL5Q
- TLSH T100F533AE1D5FC62D3340863459F5FE652D921CBF32ABE98447C00A0E6C8AD629751CBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 2 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/tempdir.dll unpack001/vcruntime140.dll -
resource yara_rule static1/unpack001/tempdir.dll upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/tempdir.dll unpack001/vcruntime140.dll
File Explorer
-
stlupdt.7z.7z 3.5MB
-
sslconf.exe.exe 29KB
-
tempdir.dll.dll 8.4MB
-
vcruntime140.dll.dll 130KB
sslconf.exe
- IMPHASH a851b483cb4aab788ee9b331890b7445
- SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
- MD5 71fdd6fb7f0acd3e9a6206851452e11b
- SHA1 82011a9ff3692236df69427eb200ba05799205b0
- SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
- SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
- TLSH T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
password2026
Digest
41:75:cf:0e:3d:a0:a4:55:bc:6e:d3:c0:a0:0e:01:1e:9a:63:bd:d7:03:e4:44:78:d0:30:38:e8:d7:89:e4:eb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=International Business Machines Corporation,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US
Chains
Apr 18, 2026
CN=International Business Machines Corporation,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=International Business Machines Corporation,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2013 - Jan 15, 2038
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=International Business Machines Corporation,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US
Serial Number
08:cb:cb:6b:86:63:94:e0:32:0a:5f:67:1b:69:f6:bd
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 14, 2024 - Jun 14, 2026
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
6968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Workroom\views\v32_Win64_Backend_Build\cs_work2\VC9_64\release\etc\sslconf.pdb
tempdir
StringMerge_SPSS
GetAppParams
api-ms-win-crt-string-l1-1-0
strncat
strlen
strcpy
strcmp
memset
strcat
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf
_set_fmode
api-ms-win-crt-runtime-l1-1-0
__p___argv
__p___argc
terminate
_register_onexit_function
_initialize_onexit_table
_cexit
_seh_filter_dll
_seh_filter_exe
_crt_at_quick_exit
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_set_app_type
_configure_narrow_argv
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_execute_onexit_table
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
vcruntime140
__C_specific_handler
__std_type_info_destroy_list
user32
SetWindowTextA
IsDlgButtonChecked
GetDlgItemTextA
DialogBoxParamA
EndDialog
GetDlgItem
kernel32
TerminateProcess
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitNamedPipeA
GetModuleHandleA
GetLastError
CloseHandle
WriteFile
CreateFileA
IsProcessorFeaturePresent
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=26715,
count=2, id=257, version=26706,
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=261, version=26706,
count=10, id=260, version=26706,
count=3, id=259, version=26706,
count=3, id=257, version=27035,
count=65, id=1, productName=Unmarked objects,
count=1, id=256, version=27035,
count=2, id=261, version=27035,
count=1, id=255, version=27035,
count=1, id=258, version=27035,
tempdir.dll
- SHA256 3aea7342a1cf46f6b6cdd9b120831621a848765a2b6d27f192e47c17f5da93cf
- MD5 94dc8225b32c0dad2d7623f956944cae
- SHA1 607af831161b910a3261199dd38335ae8411d2a1
- SHA512 f6fd76c322887324ceea49236060c27676cfb2abb46d278b85d7ec30ac25670ce71c9eb677a3a9521252797d4086c0b827626d398aa4d02adf8236d4b58412d9
- SSDEEP 49152:gVz9KcBToaRdLwHeXOVfFFsP84xE3P+GX4u28VVcnVbyGf5NwnX2kSn4COI9jmTl:45nrwzYPFx4Gq2G6+GMnX2XaDx3
- TLSH T1F89633DE65167208D9192CFDC91A764F34E7BAF3221A1B1887368627231893C6F37E74
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4500128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
A1M55PNwQV5x1C3jEb
A8n1z6rjHSwx4Rvx2hSswnga61B
APITEvkfHPrpvybKBUcJ10pY
AZFyEb8z8RuTGQdGHXzY
AbCIl6xHXMzTgvM
Abm4z8TH7FdcpAdKwf94EEDo74kw
AhbdG1CfELJMLY2FmEwGXGig
AkuMefq9IY
ApplyBspatch
ArQEM0rm9zqr2hoZogzInQFm5T4r
AsLiJU6ANtOS6SVCJZgl0oM8qqSwO
AvHG9iE3Bu2u1b5clhhBG5GHzL
AzImuMtjfOu
B0WLaYF9pOD6lOYV4T
B3AwNXRG2huzA5EnHu2gDoTvYZNQd
B4RComJawqxXFitf6PKKyQJr
BK1UpU4ODT1a2JuyegKia8GZx
BeTzScdJHvN1n0bf4
BjRq0hfvggQJ
Bzl2gI11Q5R
C1xMdv41kbuo
C3Re8odwf8GD4FNYeby2D7KhCr
C9DzAVGM8V
CIz9w9gu1YpqDTjiRmhQfxk2h7ic
CdOZjdaqzpKjplTUH10ikIpR
Cj8ZVYWT8NA7Y
CjHZYRNe89LG
CloseSpeakerVolumeInterface
CqLuy4FYVnwnmhBZTyicvqYc
CvkP0KHa4KLJvS3pjRQmT7s6I8
D8L8FNAHQXj3X2H
D9fOG0tOYOjNH8wiyMkTJFqTR9Np
DM1hRICqYQBuvzB
DS0LVf85mrdNg0COzWozvCi
DVVtv0a58QKBM
DWwBES4060miH3yPb
DfgemgE761s4kNzWGvvKabZ1NhI
DgK8MtDnTwL7JCnWUrggZKQ
DiatjfiYtYwUMDaPrTj4cyeP0d
DllRegisterServer
Dw9GJYMqtdakqikAgZamp
E1M62mhwQC
E398X2rfPFXu9UZkP
EAlOUX0ePMsWqr9YQEGrEZ
EBLjqgrz4A3jjyOoQl
EG3DZSM5ae3g6
ESfv37srTQJWRuhs
Ec049quYbzDdqpomLemgsdH
Eq5d8WA6Gk4hqrmH
F5eVLBpBdDcH
F5zD7ofooUgfV
FHTEQ4ppVvGGTBdaXQKgH
FHwZBFkOb6BCi
FMeW7g6v8K
FWK0y7wCx4VXLfe3uR
FXnXxyXIs96quz41ee7tBXnGQ9
FYSS1vr8ZX
FlAapTTKq3qIFI
Fm6eM56THoTXfpFn
Fxc2GdlgB9dz2gYQ9
G5otm89OrZiN7AFd3
G7kAobCADMsaGj2MYbGEAH50fDI
GJ6o60L3RMyFAcQv6VNGc
GJPwZ8QYqdJovsvxSI
GOtTX6wnJJF8o7qcLt5Zhkb
GSvW12Z4HmYYlL
GUQph1QTOBopVB2xG4K5
GUViuvT1LdmCCiKcaUrglggi
GetAppParams
GetMuteState
Gg6ZysqhSprTTHGoV
GgR9u1a3KgNb
GltbBPbz3V3FIDajO85
H0IKvtjjmnq
H2Jo5Joxg4JkiYKK
H7IJbvEPZrkH3
HGXF5jAYdsKLgj6EDP1c
HGgmi2lGTh2CgVZv
HJuodydKAAVGsQcqe
HNyxxXEvmxS
HPJ6KbqYJV6h8HduISs9mDUl0f13
HPcV2VV97T7
HRsN85Ia8b96pZNAUV93C
HTemhBsvlXL4MXNnMu0V0WlPhhmV
HX9yXk44bB3NFKe
HcIJittm7IU8baAXWoVOXYEbpp
HdJUFKUtZQ7m5NIxg8rmc
HfE2fzV0tibhhWtGQpaipB
HkJQNaQlcx8yOPMnc
HostMainLoop
Hsf1BrlThVTOn9nC
ICct7tC54u1806HwElCnc
IZegUup6ZvhMDLVezrjCTt
IbEw8vnHz5f
IlIWjFF2m2qZr19jXHQWwZak
IrYvhebMLLQqnNJvxe
ItxY5KKjc9PO
IzvOdlnWML9mritR0B4jj
J0lB8Q5a1FypdPD5
JC4DrbMl4s8h
JS5E573hg9Os
Jp6ou16jGZISKKsU
Jvaps3kj4td0Q9mDkJhD
K8UkNErpVLnua6f
KMyjx2H5wo9kkAJ2Gmv
KO2NtH98Bc7
KOMZr26pb3AVNG0wXFoqlZS1A
KYlkX1TQtfPoP3jcAVfAQkV2KOxXx
KZe1qDUmMTEJtt
Kga29L8qzOjleyEmU
LD8fpZPt8Li5
LLgXZUusMAFjHsP5fiZRT4AP6RB
LSGetMessage
LSRelease
LSRequest
LSUpdate
LTy2Zyddz3PA
LWLxYD0O3hfZHG
LXOF2F6knLql
LXrKnwMXcrDLnHWxojt2qG7FFeI
LfWAf3mCjYXtx8BGL4pVxudZ
LqxkyaGpx0Xj94MDJAeHMZzXCCOg3
MKeBLN8dFmjnY4On7ddVgXFPaQ
MUo9NbrfH04QuirhPK1
MgsB10T5X7DpmaUWcl
ModuleMain
ModuleMain2
MqCyHfkER1Es0zyJZICpEmFQ2YS3
Mqw8Xm5Rcz6vXxTGV7tB
MsiVfhFz3y0wXAAKeJwP91lwvg
MwV45yf9slXemSUvduPo1xA
N3iIufjHrFMWet8UITsGkj7
N4hdqHHv0lKuyGqGK98zpMs
NP3muqR3EZBifDjJftI7dYkCze68
NRJDdS7i2v
NVaFW3iBsioPUQZCfmem
NiMJYh69vvYw7LUMZY
NiVKeCLZbAM7HrD2DFKqbHH
Niny8zWbv5
NuDrHLK0a26Rwu1
NuqlDzdsHfZKJealq
O2YbqyPIGRMpJ15PqXzl7I
O4jLpfa2c3QiPR0ZU75LfFT9z
O5i4Mt72XPw
OFbVB6gfzqhR7HA
OHV5byecE8jNb5lPl3
OJTS6A6FCPdi5CxVcgo5H2yuWe
OM3sAVblqKfl
OlT18u3qKkOX2peUTAlyJRKiMT0
OpenSpeakerVolumeInterface
OqrzoKcYR9mHGQck7eMtc
OxFot2VJ6J
OzVLq9NfXljb9IYUJK2zXmOR8iTPn
P2zmZQvb5TiUS1p0vM8h
P9TgrCbZWDhF
PCdtQ0xmBlUM0ZuRIonw0CSZD
PF0RWzUCtQbCfTHLFWV44
PFEORIFeOyJIdGBZLSoWIR
PFXFrjxaPOfCyX5ZLQxGExJAD2zc
PIR18i3WdUL8lOE6FPdyFANg
PK1kuxegmssCmO0z
PLSuzBhz775t90kHgFogIDgK0z
PPKxvJYorcHbcsf
PQsDd5gk73
PaUo6ysFWMQcRCyOnjlV7bXW
PcHDcb6Weyi9XSiaT5IAQfm
Q934faUCsFjffeV
QID9ndv7hOd8ihPkah
QPrwiMaFGLNcgpPjjO
Qd2b3bNTEmHOCb93a4aDNG8nlJMM
QpyovaGQfX
QqTnwlB9gw0YEv
QxYhueFmJ3R
R1vWkuXHqjtPGLbgA6V
RFi3gWZayQiVBJEQNECGCV40NLxf
RG7HRLuVDsjiQ6zEIv4ehVCZvfZ8
RKLCC4tcXdWo
RPvybZqRsJ9rJE7mCn
RVjwRBpFL6P6jaZpHjZwRn
Rd9Q04f45v1NzCP89a70M01JGpr5
RvMHNPCKxSL9MAwIm
S471VKbYmR498jV
S6Q8sI5XIlUDaXNXD5jEer
SQL0uPOb2GNB
SQk0exeqnVDY
SThm0FtnjaRq21PO75Ns1eNSB8oLw
Sb6dueHhJKUKn
Sg0YC8HqSvSiSl7rOGHpOgctri8
StringMerge_SPSS
SvCDdyFgMR2rjm84Z
Sy4ZGfMz2zrFuLAJ
T2qNSbRTwdfZghnzMxAyd
TDcYWeOoJ1iU5jir6sAn
TMf89UZMMioyAGUmYcKd
TPvqotFSvCOo
TVi2N2ixNGss2np4BDajbqvpLQ0fX
Tqk9535n8ypXERjpyy
UPctjhznc3XTlvD
URMKqAroNzceSy29kSx27bQQ
UZNrkGPlIyH56lE4
Ui2M5bbDf0u
Uu7i90qmBlT
V0CeH8cvgJXlPFMMc4Wc8nJr
V2tmkTJ53C2m71JEILd3NtidDe1AS
V9OXUAS64MDQMPZom5
VCKa3cSU8AVhWRxlIUoHKL1ZNah
VLSaddFeature
VLSaddFeatureExt
VLSaddFeatureToFile
VLSaddFeatureToFileExt
VLSaddServerToPool
VLSbatchUpdate
VLScalculateLicenseHash
VLSchangeDistbCrit
VLSchangeUsageLogFileName
VLScleanExpiredCommuterCode
VLScleanup
VLScleanupIssuedKeys
VLScontrolRemoteSession
VLScreateUsageLogBackupFile
VLSdelServerFromPool
VLSdeleteFeature
VLSdeleteFeatureExt
VLSdeleteLicenseFromFile
VLSdeleteLicenseFromFileExt
VLSdestroyHandleInClient
VLSdisableAutoTimer
VLSdisableLicense
VLSdisableLocalRenewal
VLSdiscover
VLSdiscoverExt
VLSdiscoverExt2
VLSenableLocalRenewal
VLSerrorHandle
VLSgetActiveHandleList
VLSgetAndInstallCommuterCode
VLSgetAndInstallCommuterCodeExt
VLSgetBroadcastInterval
VLSgetCapacityFromHandle
VLSgetCapacityList
VLSgetClientInfo
VLSgetClientInfoExt
VLSgetCommuterCode
VLSgetCommuterInfo
VLSgetCommuterInfoExt
VLSgetConsumeLimit
VLSgetContactServer
VLSgetContextData
VLSgetDistbCrit
VLSgetDistbCritToFile
VLSgetFeatureFromHandle
VLSgetFeatureInfo
VLSgetFeatureInfoExt
VLSgetFeatureTimeLeftFromHandle
VLSgetGraceRequestFlag
VLSgetHandleInfo
VLSgetHandleStatus
VLSgetKeyTimeLeftFromHandle
VLSgetLastErrorStatusFromHandle
VLSgetLeaderServerName
VLSgetLibInfo
VLSgetLicInUseFromHandle
VLSgetLicInUseFromHandleExt
VLSgetLicSharingServerList
VLSgetLicenseInfo
VLSgetLicenseInfoExt
VLSgetMachineID
VLSgetMachineIDOld
VLSgetMachineIDString
VLSgetNumberedMachineID
VLSgetNumberedMachineIDExt
VLSgetOutputCP
VLSgetPoolServerList
VLSgetQueuedClientInfo
VLSgetQueuedClientInfoExt
VLSgetQueuedLicense
VLSgetRenewalStatus
VLSgetServInfo
VLSgetServInfoExt
VLSgetServInfoExt2
VLSgetServerList
VLSgetServerNameFromHandle
VLSgetServerPort
VLSgetTimeDriftFromHandle
VLSgetTimeoutInterval
VLSgetTrialPeriodLeft
VLSgetTrialUsageInfo
VLSgetUsageLogFileName
VLSgetVersionFromHandle
VLSgetVersions
VLShashedMachineIDToLockCode
VLSinitMachineID
VLSinitQueuePreference
VLSinitServerInfo
VLSinitServerList
VLSinitialize
VLSinstallCommuterCode
VLSisLocalRenewalDisabled
VLSisVirtualMachine
VLSlicense
VLSmachineIDToLockCodeEx
VLSmachineIDtoLockCode
VLSqueuedRequest
VLSqueuedRequestExt
VLSreleaseExt
VLSremoveQueue
VLSremoveQueuedClient
VLSrequestExt
VLSrequestExt2
VLSrevokeByPermissionTicket
VLSrevokeByPermissionTicketExt
VLSsetBorrowingStatus
VLSsetBroadcastInterval
VLSsetConsumeLimit
VLSsetContactServer
VLSsetContextData
VLSsetCustomData
VLSsetCustomExFunc
VLSsetErrorHandler
VLSsetFileName
VLSsetFileNameExt
VLSsetGraceRequestFlag
VLSsetHoldTime
VLSsetHostIdFunc
VLSsetLicensePrecedence
VLSsetMinimumSigningKeyIndex
VLSsetOutputCP
VLSsetPersistenceDevice
VLSsetRemoteRenewalTime
VLSsetServerLogState
VLSsetServerPort
VLSsetSharedId
VLSsetSharedIdValue
VLSsetTimeoutInterval
VLSsetTraceHandler
VLSsetTraceLevel
VLSsetUserErrorFile
VLSsetUserTraceFile
VLSshutDown
VLSuninstallAndReturnCommuterCode
VLSupdateExt
VLSupdateExt2
VLSupdateQueuedClient
VLSupdateQueuedClientNew
VLSusageAuthenticate
VLSusageFileDecrypt
VSOMzSO1b75bdEG0eOZsJ
VZwAVB6owmApjRTskC3LR
VfMC4HtEDz9AMX
W35SL6fx949moQeEwVuGjPLmc
W3GEdJk3qABSHnjQ8K3
WDohhUVytxQbSpgqxGI9l0Sn
WFslQ3PyPiVjG
WI9jtlvEDdoQTny4j
WY9Jnj6NJDnBJkWpO
WbqqWiq6rcaCo
Wewk9I5vYWgI4UnjOXG5W
WiKOnAXnDjVJnFjGIJ
WoNiKbY7QpzliiBbbmZ8LcH
WvdxSMHUhr
Wvz25py5m5LdNhlSZvt2
X36HlLnNr4hm1w9gW
X85UjCs349t3pjpyj
XA7Nep9rhRvrEyRMJWhz4q1N8hZwd
XF4AKaxmt6w
XIJFF6PU7bOq
XNRgyitgk4fQ9Kwdmm3J
XSuvVbIeFirlAY
XWJd7D8gCeGGssg9fDZtSv4pj
XhRuzRaz4fVSmA0qXLsZh
Xpvj9bMGE4NXnXUE8NnUqqGDx5f
XunjKWbtmxt
XwvsBz6ynVIzq0lbce
XxskRQZbxMBZVnRNVFUsXUPeddItt
Y0iEcOWJ5wQc9
Y9acylmjEx
YN6eu5LBJizVdBQwQYK
YNZ9NC7mnoborDmG11V8ff2TJ
YdncXaRCLVwrN8479
YgVeaBY6vB2Fwc8tGYZRgO4
Z3nCv19qkWExSZAUTmougSn1wKhS
Z4nT3AKFnGqgkxoj5TxsdYTC
Z5idwUroGXeIRyolgfU0T1mwUe
ZAid5rJRLzgECVOKBzpZZ00BXxXl
ZBYQ7TqtE5QLHCNCZqdjNxRZEfRd
ZSPNhjduWR
ZWN168UznDL6dKw8Klc28gp
ZZEtQxkw69Vb4Kuud5P
ZZQGOzp5f9
ZgpF6pGw64HVGFM06jM3T
ZiuyyXPXPaKM
ZkjkoBIFld7sec5aiAODiCejlRF
ZpvrO9T0DIJ1
ZtLrSTz2aTax9TvaPBnWd8ybC3J7Q
a98s9K4P5v3ijx57Gc
aC5iaYpIlJs9XS9uikwmjC
aJWwA7ZKPnLwDl5q1
aMXZuxLkE8hbPmEGIPeEHK
aRM7OG0mxcSMaSGNdl8Dy
abG7GSI0b112nNA85ApLP2jhKSa
allyQ54IA3spHGAeQ4uZ
arFZZLnCTnMauCAR3fSMaEKhFA
bAVuP3FQIQPK06t3eUJMwW
bVR1niZr1Gnk8Wa
benXSMrh2MqNaJ
btnHJ9V9qS1w8mwayNI0QIRa
c2Ks6ptILopSzqmEkkuQPH0i
c8pBpPvvvdkb65gKjbGtMg7p
cYiToPq5dDJ
cb90MQ0Z39xyPbxe7Y4
cfYMz1JC3P5hPyuh20DzipoYc
cgbP49FY1DgNE2E83Vqm9b
dAu5VbWeSFi08
dBlMzoMOFq1qQsiux0rgJlYA1
dC6xfflpkaRdcZW9
dEq0VyHAqk5PxgVZyHkEKxiIfIAxI
dXEmqNkz5zJ4y2CIBAy4lVzdBj
deNL4anZ8yvK
djhCCK7sTkS5dwJDwsiKcZyAZLNG9
eQZyMemBmPykm59kmxu87ZSS08
eYh3D7I8BQSmaJOja5hDyg9l4
eYwseyODnt0SqkPUztsi9uG0KoY
ejBMsyq7kpXsRrHfNmT
ezBOv1P9cS8A9J5r8Qeq
fHT2Ggk8wA
fJ2c63Uhaz4UpiHCbx3
fa9ERN6F6pDLes8a9zwCFBEJhcN1W
fdltQIFbPufufGR56
fyvQHAzXZ284GBbmbnq75VffA
g5gilW2RGeGVzLaGAI3
gKCVInRqQ80B
gfQApuzNTnLfbnYmyWmIOgadW
giTz12hNfGao0LWx
goCPTcspkL1SKG5jiDH
grFvXciGSoj
gx5TstzWjYFUrfS3ROb4KyIkm8cLX
gxs3rRAqCqnGOa09Mi
gzV0WQ6u5EwoNy9IcjzKgtkp
h5pmjhytiURoL4ZuFhMo
h8qXnwCNrWXTnIh
hJNfeJSbKpN
hK0Svdx4iFIACkl
hRJcln4CJJPebBSMzVs1
hVPlOCuZ0pe
hW6lfc1aF3L
hcIQ7jmNsizlUyv
hr018jqBJ506sr1kRIP0mwYx
hryEeh8M2y9V
hspMzakVur58u
hxKynkDTWEeFCpZuGDsxoiJaGgAT
i5pnIYSJonWqJb
iDXvzCyJ7flv376L
iGV6updrajGm4mZmLTq0tARNmgkD
iK4fQOQCawAEsAe4p
iQihUAo6c1
iVHmr5dKz9cL179f
iZ4PUxtZPD
iho8NWYYL4dDKAAYv9k
ijnrrr43sV2mtEXiqSeXLXSn
ikEKYNDdFC2qfR3WXp
imXDgLG1YRg01l6b6lMygAiM77Ll1
irrotbA3ZpaVIUMB9JjYwwh
ivUBqlkQKBQuTpjAO2C1NWfV1
ixDJ88eJwfaQKI2mT5Q
j0GcfyhzGcCrxEv45czok6
j0mAEv8yGJx6FNXkJozf7Ym
jEHVBUjPgf
jQGh0VIAODGlF75Zzx
jSm4lm6Orn
jYjFusPbPlPZfcCRhHnbUUFqvS
jd3tpRPEDEBide4TGKcJqkx
jfJ2pooJZZ0JMW4
jsX4mtIL7lei
k5fWQg1lgUqMGSV6igzLamN2C3a
k6PQYJgsiLTEqoFD7meo2FhMRhG
k6gfpUfliUuvV9LEwm58N
k85Who8SzN4iOV24x7
kLT9zIyoKl0im
kPELjaLJfv2OFlrwxMyklYQRi
kUXUfoefTGmHbxBDPGcVdthoFda
kVWKCLxU0pNaa6BQKQIqFRB3H
kXfxIVxDySex2iNasF5Hnwvlj
kfqLcTZIwj6
khoRVqkrWbSpA4YOx
ksj6UvsA6dsfUXy5CQ
kxAC2Q9WPN
lHtQcCmXeylsCCSHmzJe7j1qW32x
lNeIBmmJXUbvDLFJE3esk
ld9VgXmCrUH4CrKgti8RKPyXkD
ll6dqyj2zSLpw9tzC
llTAgxUk4EAo0OMxChkhH0b2
ltlcjLEf5PCkg2dFOUcoZ5V
lumg1t9vbbkeXuBmU6cV32jIvNk
lwx4PYOkMmvAGq3jZwEzC85rwOodl
lyCnOJ6ZOVkgQ47
lzIYKS7SBVTrywyFA7WL9
m0fBBQWMKzsfn1vJeaCmEVh0h6Pq9
m2XCE7sM0EvF5tuZei5L1H
m4QeafzOJtEQmi
mA7syzTHrGvGHuB1oa
mM6tUr3EhF
mPOOyDCQve1KQZGV2SawdQpDTNom
mdN2dAUqWTWrJAicyQVKfn
mhFTG7GPoXq43HaYFAOCoWZ
mk6DE6QPNmNHh
mwm3tLKYfUqdDb0wUMYT
n87zVXO3NiIUPdK2WA1CuWQtDX
nJZpKwW38LGzmztqsB
nX8vkuh8MG
naqDHh9MlMQsFKj0cltevqnA9
nfcODPvrlKMvzPcsw0
ngTLuKNTc2ZRkhOqVxUdpQpyz
nolxSFvVvOAtOqIxVVbi8dITfIVi
nqSQE3tNtrqooe
nxBL9GWJO6J6zJDfASQjqYS9eRY3
nyVXUSgYR0KY4E0m
o2Txx6dn3JvPWPEvUcRCSlPD1
o49DmWXgoVA
o992wIbcWVq3y022Em0PTeK
oLqxenj0lb2qlzqrd5hVleW
oVlLJ0rHxgL
oZ7gGT8K8V
oZP8Cu8jJo8uORh
oayktZVTPIp2vFDjNDdiTjN7Z
odP46jognH4jQuGZGB8d1
ohM7vfAiebm4Wcqia
okmiTiPDvYn
ooTktvloPTDjxaNpnj9t1X
opFiRf2WZ8reXu
oqjh4MHscXBrXxiDIzEUw6hoT
pDFdefHmbHikGnYEthDyH1ZV7
pbdjzM7EVtRz
perQ4PIuRYSX
piVJmHpKX9kXkmMpmatANxdcEIX
piyejJKGBPJhJod
pxNy5Wcw94A
q8evcIw9hHj
qMqEHaNXf9jlClEuXu9B
qQ2FqX5jFKY2fbs
qWrx1BEueW
qbTFh4Jpjls
qeqbspRVMXUyp5ixd3
qvOJCYb3Jwa8ZxMUa0vlKw
qvr4YdRm04VawdPrLcAydHc7bWpi8
r3eNNtDzrpgab3NHLe9w4i
r8GniG2uXfCvr6eKL
rG0irZ3LwFAEzQFSvg9vU3lktjyu
rGlHjSlQ2MMwwuQv
rPMiQLYocenVvmB
rZns5Cdo3MayN44Rcl
reyTkjKdHw5J
riv0ccKHmytXdGx7X
rkf33okLCIpSVc2n
ryKcbivVNQrv
sN1kiuN8VHinlXkRrvUdE
sdxHzyPgpIAyK3EMdMciZsECpO
sfIEKOqVNc8X6plhK
sntl_licensing_app_context_delete
sntl_licensing_app_context_new
sntl_licensing_attr_delete
sntl_licensing_attr_new
sntl_licensing_attr_set
sntl_licensing_cleanup
sntl_licensing_configure
sntl_licensing_free
sntl_licensing_get_info
sntl_licensing_get_session_info
sntl_licensing_identity_delete
sntl_licensing_identity_new
sntl_licensing_identity_serialize
sntl_licensing_install
sntl_licensing_install_license
sntl_licensing_login
sntl_licensing_login_attr
sntl_licensing_logout
sntl_licensing_logout_attr
sntl_licensing_refresh
sntl_licensing_refresh_attr
sntl_licensing_register_callback
sntl_licensing_transfer
sntl_licensing_transfer_license
sntl_licensing_uninstall
tQbA7iVtggSm4
tUMsGLEIDWTtA7efAR5XRUZ3vpi
tdn0pvitSa54Pj5C
te1UqEnOniX
tr06zNUpErHcd4E7BbXDvxvOiNVC
twwajtXNAoQnQoVaLarHBVL
tyC6Ns5G9CHzztDVmPb0m9YHBWl
u6JLwMAkWU61LsNJS3cq05oAd
uK8RBTfL7OhusQII
uZl96SClVtWmLoZZmskOo7ZmuBP
uaWqB2uCH2wut
ucJIEzBVTuo4zWLlG
ue0G27j2efN7wKk5CFm7hoLQvN
uo31Wr38ova1f58
uppj0Dh3z1eFjz8br
uqBnailWhhVapKmbVCQCy5AXnV
uueBBKmKnFGXmMqewFCfMu0Vact
uw7zjq3jQhcaHBh
uyhwZlGKbWwgoE94nzXHL2w3d9DFQ
v07cCdxncZjnWSP7Gqx5R
v4vvSg6f7aFD6SHttt
vBL5CAnL2SviP
vMpvMHrbVgyOj4QPBA12srQU
vUE5lVgkfZw5cuZWzWyEpxqt
vXPxxkRwgvT2CFMonJDNcNGKG8uo
vccahdyFcaO2AjM9dLFzb
w3wVu5xoIhfGJCsIzfpXUdg0mtUMz
wLVygmlcOtTIJ
wQfaNeuRBSnjKyfw
wVWoS1L90FLFAbN
wVXBncUUhmboPePd97fB9x1pr3uu
whnt59CiKtfdORsdxy8X6EC3f
wkJnWkR5SbikBxyDRXuV5V
wm5QSfoXUCPupOe7TpC0i2
wqu7NFxDiF7ymvN
wx0NLd8YsXHg6KRxPu5mWTo4Ch
x00ZJFMpNX1QJR6eG0Rr21
x1Bpu6NsmLT0DX
x5Suv7MO2E
xLTAw1JLsllOBidPMf9632sE5s
xRhEDgPwZAFWT8x
xay0aNcGINaVwHz2H3
xbPUadovWMy7UnGZZaBzxHw0A8B
xdsIMr81VQpRAsCGX8QKI9VIg
xiNuhe60jd0I5xXAjkksaJkm6psS
xqgkloLULKCaz1GVlnAD3vM7A3
xrJnZ33jdYMirF2NkIkQyCjuCv
xt7AS5swNyMLN7hw37IXO0TIBtBq
xuSm9sxNVrIbf
y0WXISlb6S
y1GdHBnJLFrmOnkv7mkhENV
y298OznHM1TbfysYcIJn
yBzmK3ElFJDepfDSB
yNZxFksw2HaYxotDkPrCT0
ydbg6cwGBj2PJn0
yis5emU0O5nHRdo5b1TA
yrH8TmfSaU5LRdY6YUmrB10Ei54a
z2ththcP6y
zDaDUBxpLE
zNSi51AGWp8I67NSuFtRNdgdDnR7m
zRCzEKnwlWQvNT
zS4RsRGbmLA1hJ
zSTpy1nrH2soi1zAa8gKTd
zck0eXN6xJc7XnJyummCbH2RUm7N
zgZF6BIBEwbsG
zkkow1s7BYYJD1
zvTl4SYL5pWt5cXj
zxvWswr0zWNA7LbeiYVoMnrEoo5
Name
UPX0
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
167KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
vcruntime140.dll
- IMPHASH cfd5d6cb7ecdafff3769e90c815d91d2
- SHA256 a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd
- MD5 6a969b545789b0be2178d2d79ca603fc
- SHA1 ecc0dcea5f747007eed5621c54f6d03564cde9fd
- SHA512 8c4a40e7e3ebe7ecfa7b92686428779f99fd7cabafb1bd3f331bbda67edfb36654ce03324f38975a8713ef5ad9d4ad474f1fdd8f06b8bef8cbc5a0306b6a6b1a
- SSDEEP 1536:Z9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lngAezG/yLzt7nD:9yA+3EOfmpcGSdOecbeQ6NxnQ+sBn
- TLSH T104D38B4272B801FBC56BD1708292EE27FBB6F50687609BDB07AA86650F537D06D3C385
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
password2026
Minor OS version
0
Major OS version
6
Entry point
66656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
strncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
atol
kernel32
EnterCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
RtlUnwind
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetLastError
_CreateFrameInfo
_CxxThrowException
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__C_specific_handler
__C_specific_handler_noexcept
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__NLG_Dispatch2
__NLG_Return2
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__intrinsic_setjmpex
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_get_purecall_handler
_get_unexpected
_is_exception_typeof
_local_unwind
_purecall
_set_purecall_handler
_set_se_translator
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33140,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=35403,
count=31, id=261, version=35403,
count=21, id=259, version=35403,
count=1, id=256, version=35403,
count=1, id=255, version=35403,
count=1, id=258, version=35403,