Unreal.Logger.v8.zip
- SHA256 367b90523fb3b41264a8fd4b7dbb14f84d5c4ae32e69ddd0d4f670ef9c2fe0c0
Overview
overview
8Static
static
3Unreal.Logger.v8.zip
windows10-2004-x64
1Unreal.Logger.v8.zip
windows11-ltsc_2024-x64
8Keystone.Net.dll
windows10-2004-x64
1Keystone.Net.dll
windows11-ltsc_2024-x64
8Microsoft....er.dll
windows10-2004-x64
1Microsoft....er.dll
windows11-ltsc_2024-x64
1SharpDisasm.dll
windows10-2004-x64
1SharpDisasm.dll
windows11-ltsc_2024-x64
1Unreal Logger.exe
windows10-2004-x64
6Unreal Logger.exe
windows11-ltsc_2024-x64
8de/Microso...es.dll
windows10-2004-x64
1de/Microso...es.dll
windows11-ltsc_2024-x64
8es/Microso...es.dll
windows10-2004-x64
1es/Microso...es.dll
windows11-ltsc_2024-x64
8fr/Microso...es.dll
windows10-2004-x64
1fr/Microso...es.dll
windows11-ltsc_2024-x64
1it/Microso...es.dll
windows10-2004-x64
1it/Microso...es.dll
windows11-ltsc_2024-x64
1ja/Microso...es.dll
windows10-2004-x64
1ja/Microso...es.dll
windows11-ltsc_2024-x64
1pl/Microso...es.dll
windows10-2004-x64
1pl/Microso...es.dll
windows11-ltsc_2024-x64
1ru/Microso...es.dll
windows10-2004-x64
1ru/Microso...es.dll
windows11-ltsc_2024-x64
1sv/Microso...es.dll
windows10-2004-x64
1sv/Microso...es.dll
windows11-ltsc_2024-x64
8tr/Microso...es.dll
windows10-2004-x64
1tr/Microso...es.dll
windows11-ltsc_2024-x64
8x64/keystone.dll
windows10-2004-x64
1x64/keystone.dll
windows11-ltsc_2024-x64
8x86/keystone.dll
windows10-2004-x64
3x86/keystone.dll
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Unreal.Logger.v8.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Unreal.Logger.v8.zip
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
Keystone.Net.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Keystone.Net.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral5
Sample
Microsoft.Win32.TaskScheduler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Microsoft.Win32.TaskScheduler.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SharpDisasm.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
SharpDisasm.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Unreal Logger.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
Unreal Logger.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral11
Sample
de/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
de/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral13
Sample
es/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
es/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral15
Sample
fr/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
fr/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
it/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
it/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
ja/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
ja/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
pl/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
pl/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
ru/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
ru/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
sv/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
sv/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral27
Sample
tr/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
tr/Microsoft.Win32.TaskScheduler.resources.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral29
Sample
x64/keystone.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
x64/keystone.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral31
Sample
x86/keystone.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
x86/keystone.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Unreal.Logger.v8.zip
- Size 3.7MB
- Sample260705-tlbr2adx5x
- SHA256 367b90523fb3b41264a8fd4b7dbb14f84d5c4ae32e69ddd0d4f670ef9c2fe0c0
- MD5 51feb6809cbc49a513405da0ad257900
- SHA1 76622ad2be79453dc6741a1ecf972b76d3fd8e78
- SHA512 ad80f40b359603ceb27c2f43c27abb2f8cc181511574a4078283e52546901f7afaa55d583154d248e5797bdbf4d13d80f5f5dde830e91dd1725804e4480520e3
- SSDEEP 98304:jTAYjIwynq9sCYc1os8NO9uygqpjI1gdCEBjv2xo8Why:nLZynq9dYWoX0sqpOgIh
- TLSH T11D063339A1484803F3D3E7BEE217D7690B32E1E6A3650F962F6E361054E66E05D2C74B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 17 IoCs
Checks for missing Authenticode signature.
resource unpack001/Keystone.Net.dll unpack001/Microsoft.Win32.TaskScheduler.dll unpack001/SharpDisasm.dll unpack001/Unreal Logger.exe unpack001/de/Microsoft.Win32.TaskScheduler.resources.dll unpack001/es/Microsoft.Win32.TaskScheduler.resources.dll unpack001/fr/Microsoft.Win32.TaskScheduler.resources.dll unpack001/it/Microsoft.Win32.TaskScheduler.resources.dll unpack001/ja/Microsoft.Win32.TaskScheduler.resources.dll unpack001/pl/Microsoft.Win32.TaskScheduler.resources.dll unpack001/ru/Microsoft.Win32.TaskScheduler.resources.dll unpack001/sv/Microsoft.Win32.TaskScheduler.resources.dll unpack001/tr/Microsoft.Win32.TaskScheduler.resources.dll unpack001/x64/keystone.dll unpack001/x86/keystone.dll unpack001/zh-CN/Microsoft.Win32.TaskScheduler.resources.dll unpack001/zh-Hant/Microsoft.Win32.TaskScheduler.resources.dll
File Explorer
-
Unreal.Logger.v8.zip.zip 3.7MB
-
Keystone.Net.dll.dll 14KB
-
Keystone.Net.xml.xml 12KB
-
Microsoft.Win32.TaskScheduler.dll.dll 325KB
-
Microsoft.Win32.TaskScheduler.xml.xml 553KB
-
SharpDisasm.dll.dll 215KB
-
Unreal Logger.exe.exe 1.9MB
-
Unreal Logger.exe.config189B
-
de/Microsoft.Win32.TaskScheduler.resources.dll.dll 9KB
-
es/Microsoft.Win32.TaskScheduler.resources.dll.dll 10KB
-
fr/Microsoft.Win32.TaskScheduler.resources.dll.dll 10KB
-
it/Microsoft.Win32.TaskScheduler.resources.dll.dll 10KB
-
ja/Microsoft.Win32.TaskScheduler.resources.dll.dll 10KB
-
nerdstuff.cfg517B
-
pl/Microsoft.Win32.TaskScheduler.resources.dll.dll 10KB
-
ru/Microsoft.Win32.TaskScheduler.resources.dll.dll 10KB
-
sv/Microsoft.Win32.TaskScheduler.resources.dll.dll 9KB
-
tr/Microsoft.Win32.TaskScheduler.resources.dll.dll 10KB
-
x64/keystone.dll.dll 5.1MB
-
x86/keystone.dll.dll 4.6MB
-
zh-CN/Microsoft.Win32.TaskScheduler.resources.dll.dll 9KB
-
zh-Hant/Microsoft.Win32.TaskScheduler.resources.dll.dll 9KB
Keystone.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 409e77c96de54f2fc2149710b153eb6dec9429d88646bdda8eb46455596be91a
- MD5 1a72edb33aa911f4bdb20f9ba1c8e8c6
- SHA1 8156aa1ee11d2a76a4ef150fbb28d2ed11e202bb
- SHA512 ddbb84a2c4c41ac01b8ad2ac3a5d0fd05ef54a29b2b889d4a5d462bedc02b060b854259d26751b689de9e8a3f5294c143f9d377d01cd418d3f6390ef53948dcf
- SSDEEP 384:K8HtDHWAQfJ6BzNNxkSYq+/zcweftIbz:K0HafJ6BxkSYRCqf
- TLSH T14C52E7C247F411B3EAEA1B32D9FA03700237B5956B6B9B0F9724319BB9362F4542071B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\james\dev\github\keystone\bindings\csharp\Keystone.Net\obj\Release\netstandard2.0\Keystone.Net.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Keystone.Net.xml
- SHA256 265efcc78e8d6e914a63c2c995cbac12d7888e003ddea97b1df41722136c1c59
- MD5 60d57905180954f0d5c1ff90da4e17f6
- SHA1 840852ad6cc11346092590cd708f88c554796c3b
- SHA512 5c5e6c9dc640e15c65daf79367655a23b2aa2b53b929795ebbd90350f35ccb3f5430217d19b844ea200fc0a254b154de5e17d2ac7ec37fb7cbd631379455b16f
- SSDEEP 192:wTzmkSg4uNfkuJf56Z2fS6Z1fP6jIfo6jnfT6jc3S1HeyqnE:wTzmNuSu76Zf6Zt6jH6j76j8wHevnE
- TLSH T13542CE15B9C0AB260CF702128D65F08CFE75253B2529D81674CC7E672FB9CA2E2BF161
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft.Win32.TaskScheduler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e64f2b0912f3fd60d62c4907229033ef22a349791843c0a0e748b3260e3fcae
- MD5 692499d2aff48e4ac7cbe522e4d751d3
- SHA1 2f9dbc8480a9020c201265d89b74afb2a52bc95f
- SHA512 2037be19bff47efda5334369531621e0e91058889e6d111ab0e69d4bf100766747c3dcc4cf058370b61045ad0b031410ce5fdd14e5b06b92212d7f191fbc30f9
- SSDEEP 3072:AJA5RylsHmD5+nGklYTkliWHOdjb9LH4+SiM57Yw4Af9ekaGDaTAFnb6aKCaV8wM:JHmDnklYTkoWHOg+De9ekXaUb6wg
- TLSH T16E644B1127FC862AEAFF4B79E0B4021187B9F446E46AD71D9990A5ED1C23380D963773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
338702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\dahal\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb
mscoree
_CorDllMain
Name
.text
Size
323KB
Virtual Size
322KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Win32.TaskScheduler.xml
- SHA256 c4c2edf5a13325af13d05741736f5a0f2355dbd5d9b6d7a0302b6a768fa2e0a4
- MD5 93ccdfd2eb744313a48a7e77a0b38509
- SHA1 fe32fde45b5680e2940c48c567297b127b1d8b16
- SHA512 cc26c1a418b2fd7e0adcaa9ac79768c14006b30ecc6b70c46bc62690b0eab77a068af6e70d9943984575b51b6b5784ac71555012fcedc0d56d7ac5d15c282b80
- SSDEEP 3072:BqR2xaaH/TvFw56R2KXgolvj+GuIatj7jXjLjFH20jEjmjEjJD4jmxiojHCJ9uNI:BHwcR2ikNxuN9W
- TLSH T157C4312A7AC096219CB70226CDA5F4D4FF2A056754379E2D30CD9D336F3288AC3BB556
- MD5 SHA1 SHA512 SSDEEP TLSH
SharpDisasm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d3ce990cdf58da228697d25416d16d15994135c5f66571fe1e00e9c975bc2cf
- MD5 0f900d9190603d646009ec3523fa43cc
- SHA1 a04598dcef92337ec57c0a357c2e55a1fb9c0f40
- SHA512 24397a81c9ad30f3d5377632d74706345c4a9811076357df3fc8d307a8941167b2b40b85923a4782f22a531e9f3ac4fe234ab892bdc1139a1a60f4ed7798a467
- SSDEEP 3072:y0AUOuR0cuVT+INgDgU0CaG8yVHZ2pFnjuWG/tDTQPd0FvAvxl3vBsyr8fnLN64R:hsuRUVT7U0CaGpVHs/jEEsz6
- TLSH T13224A772654223B3D0766BFC47B3E68F01A0DCB729279F59388B39D6D9583305AA2D31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
216186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\sharpdisasm\SharpDisasm\obj\Release\net45\SharpDisasm.pdb
mscoree
_CorDllMain
Name
.text
Size
211KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Unreal Logger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e0935cce357647387620d0cc18dc051972a3edaab620be00c94af2fc0c404915
- MD5 1e0d24c9df04397f516af921f7edd5bd
- SHA1 1e2184f4c25b997fd8395a783308ab0343f7241d
- SHA512 d3934b41ba5bece8b7b9e387a08b53f8d0f9084eff1e592fa3641843fa440afd0e033f1c7b2e0924a08b62bb6c077c68805142f7a944233582500816d5d02ed8
- SSDEEP 24576:IWrSKUu7qWWrSKUu7qlWrSKUu7qSWrSKUu7qBfWrSKUu7q:F+m72+m75+m7a+m7ku+m7
- TLSH T1C39590532B088E87D572A7FD6051E7B983632FC87528C39658F2EC63FA9D6831D291C1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1638226
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Unreal Logger.exe.config
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- TLSH T17CC080454054BD274D334B1357518539EFB073A36424140CF42FA7560F3114D4657377
- MD5 SHA1 SHA512 TLSH
de/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f54e8a38be8e27f178ac519e7eafa613d0341037bd0f723bf128fcdb94b7b540
- MD5 862d5b4278ecde363e96f1cc77bb99a3
- SHA1 fe0bab095851ba56583780bca6f9d5db387bf2be
- SHA512 7b612ad01a61ff00f94a7be36a6ab659dbe034b0a3fced1323d042856fc74bb1bfd16215f37aa15d7b763baaf5595518edf3fe0bc4c82504685b0509c9de63d1
- SSDEEP 192:QiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufA+a1b5rAM0XWr:/1Nvb5adVl8P2djJMZJSGuo+85rAM0Xq
- TLSH T113122E09ABF8063DF1F72FB9E9B68631B43AFD968D32D52D1244814C4530A41CAE1B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
es/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b417b6a5b5dc7349122a00c43c06897aedf414046af83ba14ba28838f243ca42
- MD5 689f3297baa8b758d593e4146e8bb8ca
- SHA1 d44bf449503af309ac1dcab363bce9e828be09f5
- SHA512 dfb147fa4b9e1f223864d2a5bc1b927515f218f58257b6fd3988bfde6238e8bae4290e6a0da73dfd59dcc94aaa7dc22247327bfb79180e349080068ef20e3d02
- SSDEEP 192:p3WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAA/a1E5rAM0XWr:Z1NvbGVxx6hUltfxgE00cU/T5rAM0XWr
- TLSH T13A221009ABF8463DF4F22FB9E9768132F43AFD959D32C66D4244824C5470A85DAE1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
fr/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4b282ddf1f09e09242ca11a22fd7dfdd069ede751961bdf8d771258071823b51
- MD5 b2bc752b1471034133545dd243d21fe1
- SHA1 2741114bb8c6ef8705d4856e24079783bbdf5734
- SHA512 f2a4967a80fb401413dacadb68843dd13165b8d08cb59abf81120969b0b1ead73e448f4b4902139107a3e2fa66502f440ffc2d7a9ac35bd66764a96ae9722cdc
- SSDEEP 192:ylQRWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VAJa1p5rAM0XWr:ylc1NvbdKJiDjgmlRi0HYZDjJu5rAM06
- TLSH T12422100EABF8162DF5F32FBAE9768522F43AFD959C32C5AD0244810D0571A41D6E2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
it/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 24a3040b55de26ce6c8f36f60e1d728ead14416875c01d160d9ffcfbeaa8dcd5
- MD5 dba841e066426c4d60b2270050a9f1fc
- SHA1 3bd911fd8c6d01972111997ad35247fecee974f4
- SHA512 620521a2a1550099961764ad04eb8ff299973a098d7ee921e1d47be522e89323714c9e0afc3da4c7a72513b221b2eac1d1bfedb9098f9427e038ddb05730f138
- SSDEEP 192:+vCiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mAu7a1j5rAM0XWr:0R1NvbGTNgr1nJI3+07ju7k5rAM0XWr
- TLSH T139220D09ABFC063DF4F36FB9EA768121B97AFD959C22C66D1648810D4470A81D9F1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ja/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e282404035693502882bca0b88e988fe0bff8ace799ce67582bbb1485751b5dd
- MD5 9c539eb6c89ba9f7c7e7b584498f796d
- SHA1 a08d59f48ac09f1043501ce936c92b9678941c98
- SHA512 6e9e031a287e7562997f127847e8c6bf1c9cb411cd49061e593357729b910ed7df2d301c4e2f1c66bc240fff35d06234ed4415dabd55fcd9604b66037e5eb740
- SSDEEP 192:QiWWNv/jzSE3tKMXdIPJxrDnBRbpsHDeAha105rAM0XWr:Qi1NvbRXdIPJxrDBRmHDLhj5rAM0XWr
- TLSH T1B422DA0DA7F80A3DF4F22BB9E97A8121B43AFDA5CD32D62D0608C11D5530A45DAE1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
nerdstuff.cfg
- SHA256 904a0106ba60c9ea2d5fb625ffd94bfccb6cd1cf7b3fbdd4f8dc7d9ed9bf899e
- MD5 3628ccbe2590eca8aaf52495353099e0
- SHA1 6de7a75e3ecaa09e8b327da6a8faa73d6fcaa4dc
- SHA512 3698637b73027b7e5c27368fb30c05cbe942d97c8b9edbacea2f39bf9def111c1b87bbf04e9ab37e9e027ea46ca5a9f1787c9733da3523aa412de3eb975b6fb6
- TLSH T140F0BE34AC7BA0E5C883D0FEE2906474FED551E1E132BCC86003FF57690AD21423886A
- MD5 SHA1 SHA512 TLSH
pl/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2ddd5ed4d84e8732334b5f6e08b3d61190da58762d33db72f7e229eb7e4791f0
- MD5 ed524af39f781293eee1590c66804fee
- SHA1 6f40ac486e24595d1c3a9a2924d709a78e191e9b
- SHA512 e6fe284784dea1e4a6b82adeb6733aafc6f4b5432fa7c9c74889eac47745855001b171d069834dad9a28c7c36f3e2912d8f94991767202c2e9b93c4315c0a890
- SSDEEP 192:G2WWNv/jzSEYtq2dE1cxy8ON0Qsk96sApa1k5rAM0XWr:G21NvbaG1cxy8ONHskupz5rAM0XWr
- TLSH T15F220E1DA7F8062EF5F22FB8E9B78132B47EFD958D22C66E1644811C4930641DAE1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ru/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b15e736a0e3c1051becdefaadfeaab68163c2203381e1e782316372a58fcb0c6
- MD5 b070b847d5353a67ef6158e13b7d65e2
- SHA1 0e93cf101d726572b1f270f4057c080e7035c509
- SHA512 135e09b2832e990e96d68f4f9204a4109e78e73b9a79ef53518e690ed8cec85b4906ee2588821d72ebae8cc6b797e781350dc1bb20889e1e34f337ad861d50c5
- SSDEEP 192:nWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZAlga135rAM0XWr:n1NvbH7O9JKgglrCPChnYVCiyA5rAM06
- TLSH T1E22240199BF8052DF0F27F79F9769925B83AFDB95E22C22D2504451D1471910C6F2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
sv/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 84ede4a0234ee6cd52329939e696b8bc2758b313dd7225d7a46828ed626d5e36
- MD5 23b598c0c3af7f789da10d2c31be1e13
- SHA1 1067e8450abf89fcc9f8f3948838de5f0657adbb
- SHA512 010af5f9353a72eeebda2bf0b108e61dc0e79a7ff0066db9ce80569e57ce191e45801441641adf4b33f10ffd12ccdd28b252c01b7a529fc67ca356a1ec5271f0
- SSDEEP 192:9iWWNv/jzSEHt+EQ5GQkW/9t3OWpVL35AGa175rAM0XWr:Q1NvbfUGQkW/9t3FJCGc5rAM0XWr
- TLSH T10512330AE7F8063DF5F36FB9E9768125B43AFD958D32C56D1244810D4830A869AF1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
tr/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1429cd58467aea880302b369eb802a55411aba008895bd0023376526538fb462
- MD5 bce4ac282cecaf88a9369ebc0fadbe1e
- SHA1 9dfc2467d4a60bb81c73b3008cdb8f02da79a449
- SHA512 67eb1e4057bfa551284aa04da66e1628b82b9cb665ccf9c9fb94688230c5e3d84fdc0d2769c16f9ac787b5175c2174856757f20bc627320cfafcf2cd30251a93
- SSDEEP 192:sMTWWNv/jzSEftF5t4A8otofPRjWPl4liBH0W/MA1a145rAM0XWr:sMT1Nvbxt4A8otofPRjTYH06h1/5rAMJ
- TLSH T186222009E7FC052DF4F32FB9E8B68521B8BAFE919C32C56D2644861D5431A41DAE1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
x64/keystone.dll
- IMPHASH 9f61f7d66661e6f3872bceb2eb5a6bc9
- SHA256 144508decba543d3a1d0ba5036d3205eb32f9d9ae738ba27ef3dd5fc501723db
- MD5 82c41b5bf73f934947bc581bf3a31c2d
- SHA1 b088ab427e685ad96fdbda40b209c4e06edc162f
- SHA512 2bfa0cd806b31ae332a31fcee1bba30dd2ad89597614c1a2751688a292f6779c866429f956e81dbf22da561745c168970f66cf92024d6fe733700ae446cb1b52
- SSDEEP 98304:K3o0TksGXQX2isKq8wJX9ulnTrdntWkmz:K3o0TPGXQXt
- TLSH T14A36C30AB611E429C01681388DDBCB997BB1BCA0CF22939776E6733F5D373952EB5601
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1440364
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
GetSystemInfo
VirtualQuery
GetCurrentDirectoryW
CreateFileW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
CloseHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DisableThreadLibraryCalls
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
msvcp120
?_Orphan_all@_Container_base0@std@@QEAAXXZ
?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPEBDH@Z
msvcr120
malloc
memmove
_CxxThrowException
__CxxFrameHandler3
memcpy
free
memchr
memcmp
memset
exit
getenv
strncmp
??_V@YAXPEAX@Z
isalpha
isdigit
isxdigit
isalnum
abort
_snprintf
_errno
_get_osfhandle
_open_osfhandle
_isatty
isupper
islower
toupper
tolower
calloc
realloc
isspace
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
_fpclass
_write
_close
_lseek
qsort
_read
ks_arch_supported
ks_asm
ks_close
ks_errno
ks_free
ks_open
ks_option
ks_strerror
ks_version
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
57KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=199, version=41118,
count=2, id=223, version=20806,
count=12, id=224, version=20806,
count=4, id=221, version=20806,
count=7, id=225, version=20806,
count=1, id=208, version=65501,
count=7, id=203, version=65501,
count=118, id=1, productName=Unmarked objects,
count=5, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=143, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
x86/keystone.dll
- IMPHASH 5dca7fe5ad20e19dd4d1b9441149d0d6
- SHA256 6ba0a438ba80d9353db0baa7ff55cd595a02223db3f7a365a815ccbf3620537b
- MD5 1b1075ea1c1dc32ea3cad8e054c0e255
- SHA1 fa066f6e2ad695340b2e2a197f7f755093f2ebde
- SHA512 dba567eb64075432276229d5a90b9e757813bb5ada6f79dba342006dc93e9e8524b97147d40815a6b1b93c153012561e408ca400ed46d81b378a510d5b7b4d31
- SSDEEP 49152:qIiBelz1tf2B9411ok+/ax5sIrag1EfkI:HcelK9411ok+/ax5sIrag1mk
- TLSH T1E3268006B612D52AD84E02384CDBD7ED2B717E94CF2283D376E4337F5D363952AA2246
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1235474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
GetSystemInfo
VirtualQuery
GetCurrentDirectoryW
CreateFileW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
CloseHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DisableThreadLibraryCalls
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
msvcp120
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
msvcr120
malloc
memmove
_CxxThrowException
__CxxFrameHandler3
memcpy
free
memchr
memset
exit
getenv
strncmp
??_V@YAXPAX@Z
isalpha
isdigit
isxdigit
isalnum
abort
_snprintf
_errno
_get_osfhandle
_open_osfhandle
_fpclass
_isatty
isupper
islower
toupper
tolower
calloc
realloc
isspace
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except1
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
?terminate@@YAXXZ
__clean_type_info_names_internal
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
_write
_close
_lseek
qsort
_read
ks_arch_supported
ks_asm
ks_close
ks_errno
ks_free
ks_open
ks_option
ks_strerror
ks_version
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
45KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=199, version=41118,
count=14, id=223, productName=VS2013 build 21005, version=21005,
count=14, id=224, productName=VS2013 build 21005, version=21005,
count=4, id=221, productName=VS2013 build 21005, version=21005,
count=7, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=208, version=65501,
count=7, id=203, version=65501,
count=114, id=1, productName=Unmarked objects,
count=5, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=143, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
zh-CN/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9f1f40400b3184e162f6606cce12820fabbb7f2a9b67202e91c01595b6dee26a
- MD5 4d4eb9a8bf413bd0641edd448acbde01
- SHA1 b7ca6ed28aca479b0ec3efc7cf4abb2db491227b
- SHA512 bcc3ce7e914519cea7f20fb0a038af0dac41cc01bf9b061f04936699de74ef3340067f9e6a1f46f876be283da9db2878685b4e7fe4c1a80bc4359ba487c47f11
- SSDEEP 192:bWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yCAVfa1C5rAM0XWr:b1NvbcbSEm22mdqet+f1F5rAM0XWr
- TLSH T10412FF4EA7FC0A2DF4F22FB8EAB68125B57AFD968C32C26D1554811C4571A41CAF1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
zh-Hant/Microsoft.Win32.TaskScheduler.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a065c666fea783efd1c535bea0f409cdaeeda0f279d339bb120a32537766e1aa
- MD5 cd075bd1c89c32ee3fad9f2cc72f423f
- SHA1 9590a7fe13a13058eda3eeb37489238fd872a8a6
- SHA512 3fcc4526f90bc70c7655c41afaa43da2f51d6a4d7ea2d3b03e44692d0301d1fce592f477b7e1c10397f83660e3b3900cbf09968537a7f66a60b04c2a7170526e
- SSDEEP 192:8vWWNv/jzSEhtimYtEq40uI7Sr2fqmxkNeo7R7L7c7xM757odHK9nAoqa1+5rAMJ:8v1NvbOtEq40uYSatEdHwWloA9APp5r3
- TLSH T12C121049A7FC062DF4F26FB8EAB68171B43AFDA68C32D5AD1544811C5931A41CAF1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ