Leonardo 0.17.70 Multilingual Beta [FileCR].zip
- SHA256 e3bc323582a1de50449cbbfd1e6d602e436c16cf44587d6b86c13945376db7f6
Password
123
Overview
overview
8Static
static
3Leonardo 0...R].zip
windows10-2004-x64
1Leonardo 0...R].zip
windows11-ltsc_2024-x64
8Leonardo 0...me.txt
windows10-2004-x64
1Leonardo 0...me.txt
windows11-ltsc_2024-x64
1Leonardo 0...ll.exe
windows10-2004-x64
4Leonardo 0...ll.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...ID.dll
windows10-2004-x64
3$PLUGINSDI...ID.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
8$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3Uninstall.exe.nsis
windows10-2004-x64
3Uninstall.exe.nsis
windows11-ltsc_2024-x64
8leonardo.0...64.exe
windows10-2004-x64
1leonardo.0...64.exe
windows11-ltsc_2024-x64
1leonardo.0...rm.exe
windows10-2004-x64
leonardo.0...rm.exe
windows11-ltsc_2024-x64
run_latest...do.exe
windows10-2004-x64
3run_latest...do.exe
windows11-ltsc_2024-x64
6Leonardo 0...rd.txt
windows10-2004-x64
1Leonardo 0...rd.txt
windows11-ltsc_2024-x64
8Leonardo 0...ch.exe
windows10-2004-x64
7Leonardo 0...ch.exe
windows11-ltsc_2024-x64
8Leonardo 0...co.nfo
windows10-2004-x64
1Leonardo 0...co.nfo
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Leonardo 0.17.70 Multilingual Beta [FileCR].zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Leonardo 0.17.70 Multilingual Beta [FileCR].zip
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Leonardo 0.17.70 Multilingual Beta/Readme.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Leonardo 0.17.70 Multilingual Beta/Readme.txt
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Leonardo 0.17.70 Multilingual Beta/leonardo.0.17.70.winstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
Leonardo 0.17.70 Multilingual Beta/leonardo.0.17.70.winstall.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Uninstall.exe.nsis
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
Uninstall.exe.nsis
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
leonardo.0.17.70.win64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
leonardo.0.17.70.win64.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
leonardo.0.17.70.win64arm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
leonardo.0.17.70.win64arm.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
run_latest_leonardo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
run_latest_leonardo.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral23
Sample
Leonardo 0.17.70 Multilingual Beta/password.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Leonardo 0.17.70 Multilingual Beta/password.txt
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral25
Sample
Leonardo 0.17.70 Multilingual Beta/zmco-patch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
Leonardo 0.17.70 Multilingual Beta/zmco-patch.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
Leonardo 0.17.70 Multilingual Beta/zmco.nfo
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
Leonardo 0.17.70 Multilingual Beta/zmco.nfo
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Leonardo 0.17.70 Multilingual Beta [FileCR].zip
- Size 7.8MB
- Sample260707-tbbdhsgy91
- SHA256 e3bc323582a1de50449cbbfd1e6d602e436c16cf44587d6b86c13945376db7f6
- MD5 20d916c9cb81fa948f3d1b639326caee
- SHA1 bc69496b1bfc8b98a75ed812f5580c175d92414a
- SHA512 b649e758c36346ea003afbabb7b29e58184ba0ebbe493376723ae9632867f182c96b02170745e886d91976075ac2e3a4a5622cf5fced888f00341c5aa2c0d939
- SSDEEP 196608:oFdF6lZBu84T2jfNRaB5aF9A0e3cAKbvg/oDNU6dLsOU7Ftb2:oFcBu+RSULA/wvumK73a
- TLSH T12D8633DFB7457B00B5D87481E74A269CE2A046B3A848813101ADB25C9F5F7773EAB1B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/ApplicationID.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack001/Leonardo 0.17.70 Multilingual Beta/zmco-patch.exe
File Explorer
-
Leonardo 0.17.70 Multilingual Beta [FileCR].zip.zip 7.8MB
-
Leonardo 0.17.70 Multilingual Beta/Readme.txt485B
-
Leonardo 0.17.70 Multilingual Beta/leonardo.0.17.70.winstall.exe.exe 7.4MB
-
$PLUGINSDIR/ApplicationID.dll.dll 198KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
Uninstall.exe.nsis16KB
-
leonardo.0.17.70.win64.exe.exe 9.4MB
-
leonardo.0.17.70.win64arm.exe9.2MB
-
run_latest_leonardo.exe.exe 655KB
-
Leonardo 0.17.70 Multilingual Beta/password.txt13B
-
Leonardo 0.17.70 Multilingual Beta/zmco-patch.exe.exe 1.5MB
-
Leonardo 0.17.70 Multilingual Beta/zmco.nfo4KB
Leonardo 0.17.70 Multilingual Beta/Readme.txt
- SHA256 b43538fe7a602e13c82af920d953292dc2b034db5e1a655f3db924b3ff582cb4
- MD5 8e188af9d329fc2c933a3216990a5610
- SHA1 c18c9b864ed1c28ade11820b4cc75e5fc7a0219b
- SHA512 1c77d5c9b4d55d37b4a43c5c72b44235360248b3904681910bc248d6744cd1999dae15cea0e4650150cf951e4e449e5de4e531c005bcb9df9fac3a64f4d3ca1c
- TLSH T18EF05C9BAE97D3F22210E259258E8CE0D30B408DD0C18441346DC58B36646D945CE0CD
- MD5 SHA1 SHA512 TLSH
Leonardo 0.17.70 Multilingual Beta/leonardo.0.17.70.winstall.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 8d9dbf320aee83c537a32d2fd55567a76eb639aa30ec40c422a28c65f52025f2
- MD5 e5a7899831b471a7c5124a1cfb811bc0
- SHA1 d79616808cf885392eb452808526d53ab73e4e24
- SHA512 a2e56d5b893c4363eb14bf0f5c03030d048be07c7d2473d6805177323da3107e19a36f4e2639f765df7b76d3161d9d081ca28ec3bbe61cbcdad3b65efec6e863
- SSDEEP 196608:aYRQiznh8rdoI8NMpPSP6dAERWKx1u8MlKL95/nhig:aYyizodoIfgEAE5rdMlm5/hig
- TLSH T1E47633866F50EDD9FB79623E2A218708FC76E41E98991E5427E11D3C1E0F7CC326E852
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Digest
14:c0:65:ed:f7:d1:91:64:10:b5:b4:20:d3:77:3b:de:73:bc:26:71:e6:29:9b:23:11:17:e1:4d:52:4b:b1:cb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
Chains
Jun 11, 2023
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
Serial Number
0e:e5:3a:b5:ee:2e:b5:44:7b:a2:97:9d:ea:85:e2:61
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 6, 2020 - Jul 5, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
13199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/ApplicationID.dll
- IMPHASH 8c45ff8a205d07c8c17066afebcdfc91
- SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
- MD5 91c2e2f34b5bba068e9a6178e13a4e5c
- SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
- SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
- SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
- TLSH T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
35572
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\src\NSIS-ApplicationID\ReleaseUnicode\ApplicationID.pdb
kernel32
lstrcpynW
GlobalAlloc
GlobalFree
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
FreeLibrary
LoadLibraryExW
InterlockedFlushSList
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
CreateFileW
shell32
SHCreateItemFromParsingName
SHGetPropertyStoreFromParsingName
ole32
CoCreateInstance
CoInitialize
CoUninitialize
shlwapi
SHStrDupW
Set
UninstallJumpLists
UninstallPinnedItem
Name
.text
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=130, id=243, version=40116,
count=29, id=242, version=40116,
count=21, id=259, version=24123,
count=49, id=261, version=24123,
count=32, id=260, version=24123,
count=1, id=206, version=65501,
count=9, id=203, version=65501,
count=100, id=1, productName=Unmarked objects,
count=1, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- MD5 75ed96254fbf894e42058062b4b4f0d1
- SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
- SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
- TLSH T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
10647
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH e2ee55bddad4241d619d6a8a38e2d869
- SHA256 feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
- MD5 ca95c9da8cef7062813b989ab9486201
- SHA1 c555af25df3de51aa18d487d47408d5245dba2d1
- SHA512 a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9
- SSDEEP 192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
- TLSH T16312F793E5A820B3C6D3523F35BE2B2EC7B95335B0512C0487738A497A6947A6E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
7443
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc
user32
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
630B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Uninstall.exe.nsis
- SHA256 327b0260906ef76f93369e21062d996da87bdedc057e9aa5d4100fc6b2289c58
- MD5 96f5f09c2ef054e2570c5cdd0397075f
- SHA1 8fe2edccd48e897016239f89311feb29a215521d
- SHA512 01ec502d5a4944bdf1ca8a7667cf1d09800e154958b2deae685a312343491ab20c6b8522c666b4e0e221e2b4ae0cee1b62546cd2713a63615fab3b462335d309
- SSDEEP 384:2c+SpEV01lzheSh6fR5OwzYSJFDRc1tz4BzTQcP+T0d:n1Ei1lVxh6ZYwzYSJc16R3+T0d
- TLSH T1A472D1C06E851F227A56141F36EB617DE024CF60DCCBBA59C61A2B6B79CD700E318273
- MD5 SHA1 SHA512 SSDEEP TLSH
leonardo.0.17.70.win64.exe
- IMPHASH 96992abbb1d88b3a90fecb5123d551d4
- SHA256 8df6fc289e3d490c2be013e69b13b49e4e691465b0400584cff6bd6ae37fd0eb
- MD5 ec76279d61f33d56bc60cb0226a6e586
- SHA1 7b780c37d03be1222443ed6aa45e9ee65c718054
- SHA512 698701be34ff99874e245e6176a65678d8a5ecf0e647cd0ff576f5c1ca7cfc86de180df0bcd9d69d5f48cdf789e0d3d238b9a52108cdf1f6d2190512a1bb63dd
- SSDEEP 196608:9gUUJlZHsQTGbWDlHQevKMeLB/ppcmmTBz4A:9pUJll1vKMeLGmmTBzL
- TLSH T1A2A68C43B3A184E4E8B681758971DB9AC3727C094F30C7CB2295B96A7EB3BC10DB6715
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Digest
25:82:66:3e:d0:1d:ae:bb:78:a4:74:ab:fe:4c:e5:11:71:13:43:fd:d7:b8:2d:9d:b7:e4:d6:54:2a:74:92:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
Chains
Jun 11, 2023
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
Serial Number
0e:e5:3a:b5:ee:2e:b5:44:7b:a2:97:9d:ea:85:e2:61
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 6, 2020 - Jul 5, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
1581944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WaitForSingleObjectEx
SetCurrentDirectoryW
GetCurrentDirectoryW
GetModuleFileNameW
ResetEvent
WriteConsoleW
GetTimeZoneInformation
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
ReadFile
WriteFile
SetEndOfFile
CreateFileW
CloseHandle
SetFilePointerEx
FlushFileBuffers
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
WaitForSingleObject
CreateEventW
Sleep
SetEvent
SwitchToThread
DeleteCriticalSection
SetPriorityClass
GetCurrentProcess
GetLastError
CreateProcessW
GetProcessId
GlobalAlloc
GlobalLock
GlobalUnlock
LocalAlloc
LocalFree
GetModuleHandleW
LoadLibraryA
GetProcAddress
GetVersionExW
GetSystemInfo
IsProcessorFeaturePresent
GetCurrentProcessId
GlobalMemoryStatus
IsDebuggerPresent
GetUserDefaultUILanguage
GetTempPathW
GetFileSizeEx
GetFullPathNameW
RemoveDirectoryW
GetFileAttributesW
UnmapViewOfFile
GetFileAttributesExW
DeleteFileW
CreateFileMappingW
MapViewOfFile
GetCurrentThreadId
CreateThread
GetSystemTimes
K32GetProcessMemoryInfo
GetProcessTimes
GlobalFree
SetThreadPriority
GetVolumeInformationA
GetCurrentThread
FreeLibrary
HeapFree
GlobalSize
HeapAlloc
GetProcessHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
SetCurrentDirectoryA
GetCurrentDirectoryA
GetModuleFileNameA
ExitProcess
DeleteFileA
GetTempFileNameW
WideCharToMultiByte
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
LoadLibraryExW
MoveFileExW
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateDirectoryW
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
HeapSize
HeapQueryInformation
GetConsoleMode
ReadConsoleW
GetConsoleCP
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
RtlUnwind
user32
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
IsIconic
LoadImageW
FindWindowA
SystemParametersInfoW
IsZoomed
GetClientRect
SetWindowLongW
FindWindowW
SetFocus
SetLayeredWindowAttributes
GetMonitorInfoW
ShowWindow
GetActiveWindow
RegisterClassExW
SetWindowTextW
GetSystemMetrics
SendMessageW
SetClipboardData
CreateWindowExW
MonitorFromWindow
EqualRect
SetWindowPos
DestroyWindow
GetWindowRect
AdjustWindowRectEx
DefWindowProcW
GetWindowLongW
GetCursorPos
MapWindowPoints
SetCursorPos
ClientToScreen
ReleaseDC
DrawTextW
GetDC
GetKeyboardLayout
GetDesktopWindow
SetCursor
LoadCursorW
DestroyCursor
CreateIconFromResourceEx
GetDoubleClickTime
EnumDisplayMonitors
ReleaseCapture
SetCapture
GetCapture
IsClipboardFormatAvailable
RegisterClipboardFormatA
GetFocus
DispatchMessageW
PeekMessageW
TranslateMessage
MapVirtualKeyW
GetWindowTextW
ScreenToClient
SetForegroundWindow
UpdateWindow
GetClassNameW
EnumWindows
MessageBoxA
MessageBoxW
ShowWindowAsync
GetKeyState
d3d9
Direct3DCreate9
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetCompositionStringW
ImmSetCandidateWindow
ImmGetContext
ImmAssociateContextEx
dwmapi
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
version
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoW
shlwapi
ord219
PathFileExistsW
iphlpapi
GetAdaptersInfo
wininet
InternetReadFile
InternetConnectA
InternetQueryOptionA
HttpQueryInfoA
InternetOpenA
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA
ws2_32
ntohl
ntohs
htons
htonl
gdi32
DeleteObject
GetObjectW
GetDeviceCaps
DeleteDC
GetPixel
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
EndPage
StartDocW
CreateDCW
GetDIBits
StartPage
CreateDIBSection
StretchBlt
EndDoc
winspool.drv
EnumPrintersW
ord203
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegOpenKeyExA
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
OpenSCManagerW
EnumServicesStatusW
RegQueryValueExA
RegSetValueExW
shell32
DragAcceptFiles
DragQueryPoint
ord74
SHGetKnownFolderPath
SHGetFolderPathW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
DragQueryFileW
DragFinish
ole32
CoCreateInstance
OleInitialize
CoTaskMemFree
DoDragDrop
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3.8MB
Virtual Size
16.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
156KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
283KB
Virtual Size
282KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=26213,
count=206, id=261, version=26213,
count=126, id=261, productName=VS2019 v16.1.2 build 27702, version=27702,
count=128, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=6, id=199, version=41118,
count=72, id=261, version=27521,
count=36, id=260, version=27521,
count=11, id=259, version=27521,
count=34, id=260, version=26213,
count=1, id=262, version=26213,
count=35, id=257, version=26213,
count=285, id=1, productName=Unmarked objects,
count=709, id=264, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=2, id=151,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
leonardo.0.17.70.win64arm.exe
- SHA256 84c9c6ba6bd5434040d098d504d36cf01a58028e6fc9aa4fdfe6d5df084964cd
- MD5 7588e7f8cfcb2716d730ac6849611265
- SHA1 2eaadb570f2c7cb714b40178eb2513b3636cdd4f
- SHA512 c412bbd39b271685d199ad00828fff2573f8647381513161553d1d76a7d8a5f5016655380c92857e906195a5ea08bf71b14e7f38469113fe659300f608935750
- SSDEEP 196608:xtmMJb7tOryFCm0DuhIlHFUvKhTcYpppQmmJFwH:2UHtmyEKTvKhTcjmmJFwH
- TLSH T15EA69E437B98C8D1E6E5867999758F5423337C68CD31820B3216B95EFCF6BC14CA23A9
- MD5 SHA1 SHA512 SSDEEP TLSH
run_latest_leonardo.exe
- IMPHASH cf4e70310708064017786fb007ec77ea
- SHA256 e0f502e5026e2cb408c38bf7feca0d3f990bc9db2a9035206a5a31086270b92c
- MD5 1ba4afa924e7f32e6ba498a869cd91a7
- SHA1 5da2721d43b976f4d8313c6176da94c28a0b4984
- SHA512 aa49226c9145c40f200b7cae9c67f3baae66b6110fb97aad5093daab9fb91a52f6b825a2e8b5246c3ddb4c738e3420055c52a9b70d6c64cbe1f7adc2dd8827fe
- SSDEEP 3072:uKiL7GLnO/2XrV+vgnvqaoajmuuffDewRus7IyB0Jt:MXcOarXq9uuffXReyB0Jt
- TLSH T1B7E466E8D7818C75FA9314B85DBEDD265227DDBE1CC209825A2F34F6AE61B8438F4143
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Digest
20:0d:c5:f8:04:89:a8:b6:64:0d:74:65:62:e2:ac:23:65:21:92:82:0b:8f:d3:6e:93:f2:be:f3:b8:fe:41:65
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
Chains
Aug 21, 2020
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Xade Software AB,O=Xade Software AB,L=Stockholm,ST=Stockholms län,C=SE
Serial Number
0e:e5:3a:b5:ee:2e:b5:44:7b:a2:97:9d:ea:85:e2:61
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 6, 2020 - Jul 5, 2023
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
7227
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\xade\code\Release\run_latest_leonardo.pdb
kernel32
GetFullPathNameW
GetCurrentProcess
GetModuleFileNameW
GetVersionExW
CloseHandle
GetProcAddress
CreateProcessW
GetModuleHandleW
IsWow64Process
WriteConsoleW
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DecodePointer
user32
MessageBoxA
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
559KB
Virtual Size
558KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26715,
count=146, id=261, version=26715,
count=18, id=260, version=26715,
count=37, id=261, version=28117,
count=17, id=260, version=28117,
count=17, id=259, version=28117,
count=5, id=257, version=26715,
count=88, id=1, productName=Unmarked objects,
count=1, id=264, version=28319,
count=1, id=255, productName=VS2019 v16.4.6 build 28319, version=28319,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.4.6 build 28319, version=28319,
Leonardo 0.17.70 Multilingual Beta/password.txt
- SHA256 4d9644b189d4864e6b8ee89210d3aebd3153653c29b574ac7ae5d32351166653
- MD5 2338605ab49aa80c32e521e6a431786d
- SHA1 e65e8e6b231547686935f14b5d411bddc28d6706
- SHA512 360ea1f9cff336d4a786d822e45a7d5d32f2dd4afbe0b4d83e0f9c664bcf33ef76a294cb8c63d03cdd528ac87df03e7264ee30b689fffe0959d1be05cb653c26
- MD5 SHA1 SHA512
Leonardo 0.17.70 Multilingual Beta/zmco-patch.exe
- IMPHASH 68d27cc89024d4b6cc658663ff9bf9ac
- SHA256 c93ebff2895292679c5da2e1e58c47fb5821e5e8b57b7bda2a4678514e25d616
- MD5 e6ae1be2b30926f4d56b81daf3bee8eb
- SHA1 fa36714bd4de248b7c7350eb089592335211b441
- SHA512 49e5554bf91ca6efa161a6aea9318b2be488b92d321ab7dab8c8a23026a8b6305702ac0c4c263c2a9c9e508622b061026045eddcbd1e648311517c2d5e3ad201
- SSDEEP 24576:U/oHCXNVR7D8rvfUI5Z7C9SGp4RRlZd4TJvc/z3la6ygwU0SoHZbiSWKfjwIKY1S:UYCjGrnUI5Zu9SGpCR7dkJvc/z3ladgV
- TLSH T164658FB1FA4A8DEAD261F6385038E974044F1AA5ED72806E3A5FBB6DE3353830D1D714
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
15750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
TrackPopupMenu
ShowWindow
SetWindowTextA
SetWindowRgn
SetWindowPos
UpdateWindow
SetTimer
SetFocus
SetDlgItemTextA
SetClassLongA
SetCapture
SendMessageA
SetWindowLongA
ReleaseCapture
RegisterClassExA
RedrawWindow
PtInRect
OffsetRect
MessageBoxA
LoadStringA
LoadIconA
LoadCursorA
LoadBitmapA
IsDlgButtonChecked
InvalidateRect
IntersectRect
GetWindowRect
GetWindowLongA
GetSystemMetrics
GetParent
GetKeyState
CloseClipboard
EmptyClipboard
OpenClipboard
SetClipboardData
GetClientRect
MoveWindow
GetDlgItemTextA
GetDlgItem
GetDlgCtrlID
GetDC
GetCursorPos
GetCapture
GetActiveWindow
EndDialog
EnableWindow
DrawTextA
DialogBoxParamA
DefWindowProcA
CreateWindowExA
CreatePopupMenu
CheckDlgButton
CallWindowProcA
AppendMenuA
kernel32
FindFirstFileA
GetStdHandle
WriteFile
FlushFileBuffers
CompareStringA
CreateDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
FindClose
lstrlenW
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
WideCharToMultiByte
WaitForSingleObject
VirtualFree
VirtualAlloc
UnmapViewOfFile
Sleep
SizeofResource
AttachConsole
CloseHandle
CopyFileA
CreateFileA
CreateFileMappingA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindResourceA
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetFileAttributesA
GetFileSize
GetFileTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
MapViewOfFile
MoveFileA
MultiByteToWideChar
RtlMoveMemory
RtlZeroMemory
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesA
SetFilePointer
SetFileTime
shell32
ShellExecuteA
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectA
CreateSolidBrush
ExtCreateRegion
GetStockObject
GetTextExtentPointA
RemoveFontResourceA
TextOutA
SetTextColor
SetBkMode
SetBkColor
SelectObject
RoundRect
AddFontResourceA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
comdlg32
GetOpenFileNameA
GetSaveFileNameA
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=42, version=8803,
count=147, id=19, version=8078,
count=18, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Leonardo 0.17.70 Multilingual Beta/zmco.nfo
- SHA256 4fa23ba82fd7fb503ac55854fb88494e4e8d6f166d4577d6eabde7c9a698e8f4
- MD5 30c6bc761b3da8639d80603c8e325211
- SHA1 91c64729b709e8273c01a2197e9500e228965046
- SHA512 e450ec437dbabc387a4f8959d52379fe40c102092597574a6a4ce1522fd9e335b481a21ec13988a9313221168b9a0a5d14265073ab369f99925cac294ca4ffed
- SSDEEP 96:DjMNpd4GLV/lMzbdJjlRilQRYglQGgSK5:4MbZwQhQ2k
- TLSH T1D991F345E7A5F7DEFB70D531EE1043089D21685A82342988352F3B25EFAB3B382BD915
- MD5 SHA1 SHA512 SSDEEP TLSH