Progi_do_100_kb.rar
- SHA256 6dad7050573d5f639471cd60a98e9a9182e8939d220b707ba5d9d97561387ee2
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Overview
overview
9Static
static
9Aml Maple/...le.exe
windows10-2004-x64
6Aml Maple/...le.exe
windows11-ltsc_2024-x64
6CPUiD/cpui...id.exe
windows10-2004-x64
3CPUiD/cpui...id.exe
windows11-ltsc_2024-x64
3EVE/eve/eve.exe
windows10-2004-x64
3EVE/eve/eve.exe
windows11-ltsc_2024-x64
3EVE/eve/eve_faq.rtf
windows10-2004-x64
1EVE/eve/eve_faq.rtf
windows11-ltsc_2024-x64
1EVE/eve/readme.htm
windows10-2004-x64
3EVE/eve/readme.htm
windows11-ltsc_2024-x64
3FAIM с и...im.exe
windows10-2004-x64
3FAIM с и...im.exe
windows11-ltsc_2024-x64
3FAIM/faim0...im.exe
windows10-2004-x64
3FAIM/faim0...im.exe
windows11-ltsc_2024-x64
3InqSoft Sp...ls.exe
windows10-2004-x64
6InqSoft Sp...ls.exe
windows11-ltsc_2024-x64
6Internet M...ac.exe
windows10-2004-x64
4Internet M...ac.exe
windows11-ltsc_2024-x64
4MPW/mpw.exe
windows10-2004-x64
3MPW/mpw.exe
windows11-ltsc_2024-x64
3OpenedFile...ew.chm
windows10-2004-x64
1OpenedFile...ew.chm
windows11-ltsc_2024-x64
1OpenedFile...ew.exe
windows10-2004-x64
9OpenedFile...ew.exe
windows11-ltsc_2024-x64
9ScreenShot...er.exe
windows10-2004-x64
3ScreenShot...er.exe
windows11-ltsc_2024-x64
3fSekrit/fs...it.exe
windows10-2004-x64
3fSekrit/fs...it.exe
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
Aml Maple/AmlMaple/AmlMaple.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Aml Maple/AmlMaple/AmlMaple.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
CPUiD/cpuid/x_cpuid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
CPUiD/cpuid/x_cpuid.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
EVE/eve/eve.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
EVE/eve/eve.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
EVE/eve/eve_faq.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
EVE/eve/eve_faq.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
EVE/eve/readme.htm
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral10
Sample
EVE/eve/readme.htm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral11
Sample
FAIM с исходниками/faim021src/faim.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
FAIM с исходниками/faim021src/faim.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
FAIM/faim021src/faim.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
FAIM/faim021src/faim.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral17
Sample
Internet Maniac/Internet Maniac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Internet Maniac/Internet Maniac.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
MPW/mpw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
MPW/mpw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
OpenedFilesView/ofview/OpenedFilesView.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
OpenedFilesView/ofview/OpenedFilesView.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
OpenedFilesView/ofview/OpenedFilesView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral24
Sample
OpenedFilesView/ofview/OpenedFilesView.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral25
Sample
ScreenShoter/ScreenShoter/ScreenShoter.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
ScreenShoter/ScreenShoter/ScreenShoter.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
fSekrit/fsekrit/fSekrit.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
fSekrit/fsekrit/fSekrit.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Progi_do_100_kb.rar
- Size 1.1MB
- Sample260718-pex98sev2z
- SHA256 6dad7050573d5f639471cd60a98e9a9182e8939d220b707ba5d9d97561387ee2
- MD5 9cf83f1ec31d0bfef348f2053093e82f
- SHA1 abc51534adff9db113edc434451118b0462f9abd
- SHA512 c289ea479b3fcc29780c92aed8ecbb3fb39018bff215a407aa6fcf2576d8fe33cd927029ff1832bf72372a4bef2b659395225a19176bc32126f2c33894299479
- SSDEEP 24576:R8xmWre28OS5g1Wbm6TmVCWSlVu8jJVHZ4c:ex5eGSW1I+VLuu8jJVac
- TLSH T1DF35DF16BA904263E5698131087397B4EB36BC2669329E433F6CBF1C2F76182EF71355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft static1/unpack002/out.upx Nirsoft -
resource yara_rule static1/unpack001/OpenedFilesView/ofview/OpenedFilesView.exe upx - Unsigned PE 12 IoCs
Checks for missing Authenticode signature.
resource unpack001/Aml Maple/AmlMaple/AmlMaple.exe unpack001/CPUiD/cpuid/x_cpuid.exe unpack001/EVE/eve/eve.exe unpack001/FAIM с исходниками/faim021src/faim.exe unpack001/FAIM/faim021src/faim.exe unpack001/InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.exe unpack001/Internet Maniac/Internet Maniac.exe unpack001/MPW/mpw.exe unpack001/OpenedFilesView/ofview/OpenedFilesView.exe unpack002/out.upx unpack001/ScreenShoter/ScreenShoter/ScreenShoter.exe unpack001/fSekrit/fsekrit/fSekrit.exe
File Explorer
-
Progi_do_100_kb.rar.rar 1.1MB
-
Aml Maple/5c093ceadf.gif.gif 10KB
-
Aml Maple/AmlMaple/AmlMaple.exe.exe 50KB
-
Aml Maple/AmlMaple/ReadMe.rus4KB
-
Aml Maple/AmlMaple/ReadMe.txt846B
-
Aml Maple/AmlMaple/french.lng818B
-
Aml Maple/AmlMaple/romanian.lng706B
-
Aml Maple/AmlMaple/russian.lng726B
-
CPUiD/08e0c882e7.gif.gif 4KB
-
CPUiD/Thumbs.db8KB
-
CPUiD/cpuid/_READ_Me.txt2KB
-
CPUiD/cpuid/x_cpuid.exe.exe 5KB
-
EVE/e923d20d7d.gif.gif 29KB
-
EVE/eve/anibuttons.eve16KB
-
EVE/eve/bordereffects.eve4KB
-
EVE/eve/clickablemap-u.eve12KB
-
EVE/eve/clickablemap.eve12KB
-
EVE/eve/eve.exe.exe 73KB
-
EVE/eve/eve_faq.rtf.rtf 12KB
-
EVE/eve/eveintro.eve41KB
-
EVE/eve/flowchartsymbols.eve5KB
-
EVE/eve/readme.htm.html 2KB
-
FAIM с исходниками/8a7b822efa.gif.gif 4KB
-
FAIM с исходниками/Thumbs.db5KB
-
FAIM с исходниками/faim021src/data.asm10KB
-
FAIM с исходниками/faim021src/encrypt.asm1KB
-
FAIM с исходниками/faim021src/faim.asm50KB
-
FAIM с исходниками/faim021src/faim.exe.exe 33KB
-
FAIM с исходниками/faim021src/faim.res10KB
-
FAIM с исходниками/faim021src/packet.asm11KB
-
FAIM с исходниками/faim021src/readme.txt411B
-
FAIM с исходниками/faim021src/snac.asm10KB
-
FAIM с исходниками/faim021src/string.asm6KB
-
FAIM/8a7b822efa.gif.gif 4KB
-
FAIM/faim021src/faim.exe.exe 33KB
-
FAIM/faim021src/readme.txt411B
-
InqSoft Speedballs/InqSoft Speedballs/Sources/Data_1.bin.xml 643B
-
InqSoft Speedballs/InqSoft Speedballs/Sources/HotKeySelect.asm5KB
-
InqSoft Speedballs/InqSoft Speedballs/Sources/MainDlg.dlg6KB
-
InqSoft Speedballs/InqSoft Speedballs/Sources/Res/MainDlgDlg.Rc2KB
-
InqSoft Speedballs/InqSoft Speedballs/Sources/Res/SpeedBallsVer.rc384B
-
InqSoft Speedballs/InqSoft Speedballs/Sources/ResXP.rc17B
-
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.Asm19KB
-
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.Inc1KB
-
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.Rc390B
-
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.bmp8KB
-
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.ico2KB
-
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.rap2KB
-
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls_Running.ico318B
-
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls_Stopped.ico318B
-
InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.cnt426B
-
InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.exe.exe 24KB
-
InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.hlp17KB
-
InqSoft Speedballs/Thumbs.db7KB
-
InqSoft Speedballs/bafa59d335.gif.gif 9KB
-
Internet Maniac/3d8e3551dc.gif.gif 6KB
-
Internet Maniac/Internet Maniac.exe.exe 97KB
-
MPW/bae495195a.gif.gif 4KB
-
MPW/mpw.exe.exe 40KB
-
OpenedFilesView/e03dd1da67.gif.gif 38KB
-
OpenedFilesView/ofview/OpenedFilesView.chm.chm 14KB
-
OpenedFilesView/ofview/OpenedFilesView.exe.exe 37KB
-
out.upx.exe 69KB
-
OpenedFilesView/ofview/readme.txt5KB
-
ScreenShoter/5326d5240d.gif.gif 44KB
-
ScreenShoter/ScreenShoter/ReadMe_rus.txt1KB
-
ScreenShoter/ScreenShoter/ScreenShoter.exe.exe 104KB
-
ScreenShoter/ScreenShoter/main.dat177B
-
fSekrit/Thumbs.db5KB
-
fSekrit/c5bbe8cb0a.gif.gif 4KB
-
fSekrit/fsekrit/fSekrit.exe.exe 50KB
-
fSekrit/fsekrit/history.txt1KB
-
fSekrit/fsekrit/readme.txt6KB
Aml Maple/5c093ceadf.gif
- SHA256 79d3923d4f2e4170ba53b7c807b723387cdd0f4477dc78b071befa96df3fa935
- MD5 d5bc17e536b5a5bfa3c48a54547865e6
- SHA1 dcdc89129737c6ba21739d46946ab1c9749d9455
- SHA512 49b4590e3098756989b3cd573250ea42d5c53482820c3baebb8051c01333ba137dacab147037acb0b18e93b0d9b383c01a85564669b5eb3b3d98be0ee38d007a
- SSDEEP 192:++DnC7/TYyAuTi40QDeoZ+EUugNEWvRxl5X+ndJyc49:hDnC7VTVNjUuWvR39+ndJd4
- TLSH T1C732BF95FD000B9A49D435E1123A60416E8F134CF83A732E54A7CD49F79A9FCE91A1B8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Aml Maple/AmlMaple/AmlMaple.exe
- IMPHASH 3e9bb93f69aff2eb4f693b4dbf27945d
- SHA256 e061da19174524bbb11a2de3feb4f1312da574d32821367c9367e94961cad898
- MD5 6096d538d5c81734b46966fc97ac1d9f
- SHA1 f2911f4d76e358cc824e3fc0b780204594d7989e
- SHA512 74c0dab3d729e06ae2b2188eafafe243d59f6c24251e34c230753e536135a7d7d2a7e19161f33d7c1f7af4c8ac1e4c4a66ea4eb329fb796d9ccb027587e271a9
- SSDEEP 768:7fvoh0rgo2prGPuaLfRUjFiNG1GDMsDI1/JW9+j6soHRjj//:7YHo2prGPuaLJUmCGVDaJJj6soHRf//
- TLSH T1E4337196B290C876E0590E32ED17DBF456A5FCA959688A537FC47F0E3C312909B30B27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20415
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
GetVersionExA
FindFirstFileA
IsBadStringPtrA
FindNextFileA
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleFileNameA
OpenMutexA
CreateMutexA
GetModuleHandleA
CloseHandle
GetStartupInfoA
user32
SetTimer
DialogBoxParamA
GetKeyboardLayout
GetWindowThreadProcessId
WindowFromPoint
CheckMenuItem
PostQuitMessage
KillTimer
LoadCursorA
CreateCursor
SetWindowPos
GetDesktopWindow
UnregisterHotKey
GetClientRect
GetParent
RegisterClassA
RegisterHotKey
CreateWindowExA
EndDialog
SendMessageA
SetWindowTextA
DestroyWindow
GetDlgCtrlID
GetWindowTextA
GetCursorPos
GetDlgItem
GetWindowRect
PtInRect
SetCursor
MessageBeep
MessageBoxA
SetForegroundWindow
BringWindowToTop
SetActiveWindow
SetFocus
LoadMenuA
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
RegisterWindowMessageA
LoadStringA
SetMenuItemInfoA
AppendMenuA
GetWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
ModifyMenuA
MapVirtualKeyA
GetKeyNameTextA
LoadIconA
SystemParametersInfoA
GetMessageA
TranslateMessage
DispatchMessageA
LoadImageA
CopyIcon
GetMessagePos
IsWindow
GetMessageTime
DefWindowProcA
comctl32
InitCommonControlsEx
shell32
ShellExecuteA
Shell_NotifyIconA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
gdi32
SetTextColor
GetObjectA
GetStockObject
SetBkMode
CreateFontIndirectA
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
__CxxFrameHandler
??3@YAXPAX@Z
strcmp
_splitpath
_strlwr
_strupr
??2@YAPAXI@Z
memset
strncpy
sscanf
strcpy
sprintf
toupper
strlen
strcat
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, productName=Unmarked objects (old),
count=11, id=19, version=8034,
count=119, id=1, productName=Unmarked objects,
count=14, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Aml Maple/AmlMaple/ReadMe.rus
- SHA256 4e07fa3b415e6da15ed6b4f4c1e95031d2c35eeeb574073a85bc2e5f04782433
- MD5 309dfe77c4c58035ee3e19b88f21162c
- SHA1 cad7de9fecb87c83888d0652f302e1b65bd28638
- SHA512 4c20f6dc0f45734f1255c48e94ee37f4509243fef5236aeb01c7a28a5acf4e0ad91ef9d26420cbdc26964ea826a561eb511c303aaf9b347bea89e578a04be673
- SSDEEP 96:vHSC3JOUmxBnG0R5G0RJ9B3iFzXVCLcdQH/iR:vHSC5pmxVyOJ9kFTaTH/O
- TLSH T1CC91D75DDE4008F49B250E3D1167AE3BC0F82D5FD858C1723E11C74D873A592BA9EDA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Aml Maple/AmlMaple/ReadMe.txt
- SHA256 e96be9abf23462f8e7d6d23a70c26d91a8e924da7bbdecea3991e22107716f19
- MD5 dc5d41ba8bd39efe28cf358ca1a32a56
- SHA1 45d27a8d20308a3691ff22b99b736057b994e9ad
- SHA512 eae4a446547329296e6c1cb756a5155a6d5d639a498763db3e37536ddc4e27fed177ecbc9115770248a5b1214c3ed6a904cf390da980620dcb1194fd6a367cf2
- TLSH T15F01900D641D70513A172542F3332EB7E58404F215A7D9ECBF2A534C367ABB5721E079
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Aml Maple/AmlMaple/french.lng
- SHA256 515a9a7f09342ad5c82e9a4991e0e7c8c7d055b6cacf0eae95c78107ff0e3e68
- MD5 943acae9f2771f831043267dd1aa6b44
- SHA1 e2cddf718edef383cd20c8b074de3581ba64d669
- SHA512 444fbf0ddc8f7e37ea8f5fc4edf51ba7abcc1c410fc69fdf9c276c7366d44bf528f22b0c2617eb4a4992af3e1c8511b6cc6881eaeb41dc5764db88a9f4d6d86b
- TLSH T1CA01AB6BE3F81948EA2FEBF2330C12F5A11FB4E40066893852C28A5F5F09169E05C187
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Aml Maple/AmlMaple/romanian.lng
- SHA256 80159e56abc7b5ef643e99dfb91804f6a58ee210ff20608f7ef35a3caadd2800
- MD5 5eed136f12176656bf948fddff1885d2
- SHA1 a1fd45c75738fe644384b12b0e914011c18f3feb
- SHA512 b7a6fd2738c0f961206baef96516186e2f2392450a1a6c64632969e72537c3c70cc78d0335d1547aa775dcb121db9d76be22f08fb50c528978aac50dfd351215
- TLSH T16C01CB01B2FF0A62496792E36110CD7910CBBCAC06852DF029C58F5DAA06349CAAD257
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Aml Maple/AmlMaple/russian.lng
- SHA256 39fb159b32bdf8e74e1470b0e3c7ef627fa2996c5cabb13708d35b0498f81f1c
- MD5 da655b7b15cbec9025e9922d17752847
- SHA1 48294951d15d3eb0e5c4924c838b874019dbf96a
- SHA512 8562c355fa912d21926f24f2f8729f6f2b8a53df95cecfb4e3570eca26b767bb2c028091df27295641f6f5474af97206f0ac425f9988f90f576bde1abb2bb678
- TLSH T1CC01DC0081B001D4921FC7E3286F8ABC103C3FE5554A263E76A5AF4C0F5522BF2861A0
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
CPUiD/08e0c882e7.gif
- SHA256 e9b7c6a7df8cf4041484c9a602a43fa2a8dc7023c4f2155a550cb30f9272bd38
- MD5 f65dc0fdae8c62afbdc303037cd52757
- SHA1 c1dd494cc603aaea28757e7c5d8fc5486332559e
- SHA512 1789a96fcbc4fdca6dc55d148a22273c9fb516a3403ee8e142de4fd3f5dbe1250d31c90a5677a396cdd7ea3080c58693a16dacadec265afa79c143be68a4f3b4
- SSDEEP 96:fMgw5mdD9Kr83cLL4vdD3fEN7S7LlYn742EutBQ1mOUy/O5zzelxQZVLRF9Fn:ko9I83e4vNvEN7mlYn74yLSmdyWzthlF
- TLSH T100B17D48F06090E5F7385CFA6355AF4686256FD0B025D3A8EDCA3A7CF4CA548C49A2D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
CPUiD/Thumbs.db
- SHA256 bd62b46ce85edb260a98a9a9ac3544726565b99ec4a634a47c8a4ea29e9a7f2c
- MD5 c1cab1ea5a975a6d90e9c9e2b95b21bb
- SHA1 88e4eb3bda0946f8048f72a908f344d5ec3ceb28
- SHA512 f617a316aedec28bd49566d3454cf19a01e486fb4e7aac27020e108c7e4b63f02c35d7dc74ddc80d0fca73140e3e612dd3bba3e73b249f675d7ab88cb792d4ac
- SSDEEP 192:t3q2bBij54lpU/wuaJFpg5IOl5rA+sVx:t629i4aqFZ05js
- TLSH T1D4F16C27B77842D8FD0C6877CD206D85B6ECFE412C914E0B39D8355EC67896098C8775
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
CPUiD/cpuid/_READ_Me.txt
- SHA256 2f2943fe2aac2b5048e99c61cc0ffcac9f677641b50f8f9abf15ccd9dd963f34
- MD5 a706aef5d70d6845de2b079eb68b60ef
- SHA1 8c30a071279952e5f083d983b980c23de80a3882
- SHA512 946228a6303dfcddfd78b98d9132f12ded55c41ebf975f7e2696fb8a3d70d2f6a865fa2416010d70983beccd7bb334e0cd6b95bbc78157b8069f4ad598019d37
- TLSH T1B54172C0762306B81C3B0F2146471F18DBD51B07FB80A7A1BA5DC89D2F363906225A0E
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
CPUiD/cpuid/x_cpuid.exe
- IMPHASH 083d348c323305f34108aaf76a710076
- SHA256 c760d2d93bfc47bfa212a6b39e674c6f44245cced29e1e3f71939464269394ce
- MD5 c38bca19aa7c66df4e5149edbadd98fd
- SHA1 990076012de769a77c4e0c3be4869406ff5002d2
- SHA512 6933aca82a7e24dbea6d38bf9db0b9018abbc4dbcc438c08face6f7cecd88a3771249254eed8b56fb8ef2e86089a2743b829ffefe778190e33072ca2b283aaac
- SSDEEP 96:Ye3dyagesF2hwhKhvhihThJhOhYFWI4wAOGVBlUD:FyavsF2qkJ8VXsrldh6
- TLSH T1EDB1316776A8A423C2E457B342F3CE92FEAE37122331435A97D3686CB1B45879D1D604
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
SetDlgItemTextA
SendMessageA
SendDlgItemMessageA
LoadIconA
DialogBoxParamA
wsprintfA
kernel32
ExitProcess
GetCurrentProcess
GetCurrentThread
GetModuleHandleA
GetPriorityClass
GetThreadPriority
SetPriorityClass
SetThreadPriority
Sleep
gdi32
SetTextColor
SetBkMode
SetBkColor
DeleteObject
CreateSolidBrush
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
650B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
374B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=19, version=8078,
count=1, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
EVE/e923d20d7d.gif
- SHA256 7e6c311c10a2f032967c56680a94fe03f8e236775a24f4586e2d25497969f19b
- MD5 abffa1d7431f8404fdebbd8a63d48f8f
- SHA1 b568f3acd07e98f3aca884710ea9c4e3e9f98d7c
- SHA512 77e0d53e29a0c42704ea9513d183ce365dcb7fa4329364148b512318d78f2b0b56c5617e9e476ad7b1a595a8ef9c236f3fd933fee8034dd1b414dfab38b90077
- SSDEEP 768:mxCCQzAgcaNS4ourZ56LgsNjIfK93ITfcJnKZ/H:mxCagcajJrZM8KdILLf
- TLSH T118D2E04BE294E80186498740192335A4EDB457D6DD8D27FE28E86E6860CFCFE3BDC619
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
EVE/eve/anibuttons.eve
- SHA256 d9a3f80338253443de29104e0ed231d8fc87a2c83c044ec2889c528e2a91c62f
- MD5 18c57384da0620e1e1a678668592a756
- SHA1 41245e52d1d9bbb9c7f591b3c6b953d94d2e910a
- SHA512 038fe386bad413100d77ee577669fd1f5e5d32cb1f53dafe9b37e695b8291988ec094ef6a5a284d2a576da1a1e6eadbbb70aacb1029e8d850ec21ea7e9778695
- SSDEEP 384:qoIgOnr3UUbgrHvmDHpRfmPeU0A+i072+/ZJIbTPmJqkIXBt9yZ9o:qoIAUbg6DHpRfmF0A+ko+WBCiZ9o
- TLSH T18D72CF467228C5E3C6C585B9C9D790CD736DE92A2812F2C337405B5DBFE75AAD47810C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
EVE/eve/bordereffects.eve
- SHA256 db2e20ac8859413bd355ab5fe0cb3c2c9592957b8490f482390df75d4d1a1b34
- MD5 0a2574d4db88d983502a812c2b84d8cb
- SHA1 e423f9653ec7bc7b194c197d5b75eece977eaaab
- SHA512 9401b464c3a7625a00309eb533ff6980aeb82648db38b411d570da8eb3bbaf7370a353bd2e34cb8baf88336dbfdcbfeb1edfcfd71748e5b5a7cfd5bd998fc4ea
- SSDEEP 96:V6jmj1SoB5w09x4W52J+R++F7jueUGLjGwL/um83zAyjoc5/5q:V9woBG0z4W4sR7vueUgjGwjumKZoc5/M
- TLSH T126A1398A3816C751E678057166799B587306D6CCBC15231FB688E7AE6CB7001AF09726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
EVE/eve/clickablemap-u.eve
- SHA256 fd3fa12018bf2f52da1d172633d75c3d6ea65bc870454ac7288b2001f0d03d94
- MD5 30a84d2a34308ae836380f7e2d202fcf
- SHA1 f799566826ff146e95c3d4328890ebdc0c18633f
- SHA512 e89942ad6979346a1ecab8a463296df83da925f93e39a094982b4a56a821bf213718a773486d88b6c2d982bac8db0540564a33b62ff31dba49eb21bfbc894266
- SSDEEP 192:kDM36QghUAu5r4nJnZLoinng1NOJBy92x7LJdo6uUls28Zb5HorxWJG26RSpnUEn:qDQgKKtZLoijy92ZLU2Y9O3T4fn
- TLSH T1ED52BF9C3B77AE6AE91A8237C13D934C0BF19B052605E1556731340B59BFF107AA3734
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
EVE/eve/clickablemap.eve
- SHA256 99e18c87f883cbc26bf8a49a9ee60d580b8198f9a0af8da3eefcf0321bc30c61
- MD5 db9efb8c6dab1531e6768c3839b8ed5c
- SHA1 24d160bd7426ed2a628934cde53688a9b173f1d7
- SHA512 8c0635933245760b1645ae4c2941aa216267010bd767fc311ecbf1f7d8cb16c06a09e6b2599b10eb5683499bc814c3f9aab396782b4f9eb82f2cc1ff14904c7d
- SSDEEP 192:QXGgcHFCdua4s51C9yOOhdcBkPpTay1TVmU56fkc67dNCiI64SE1+uwUjYI6XFHr:ukFLt21C9ImB4/VmnfkbE1+EE1h5h
- TLSH T1F452C06865D4AF4ED51D9172CDAC63E88FB26F043133C104622C2912CDBE78DF8F6664
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
EVE/eve/eve.exe
- IMPHASH e3f07045b81cf4b29b7d7ef03a3f43c6
- SHA256 dcfc9f6a3b8243397a7d33a8bf241a1ac1674e946f52fa1e11822717f2c29cfa
- MD5 cc11d88dce4316f1f2817cfc37cbfdc5
- SHA1 03b8876918149d6c4f8fc43674f2983bf3dc467e
- SHA512 95ddcdd7dd2a5dfdb4720fa9b2057d992b99b2b6894bb3a9603d52fdd80d7caed906ed59e30d6477946ea4d7025fc962eedbbde788d28907d0896bc649be9cd0
- SSDEEP 1536:WOc9V+aRuSIY2UahOI7DkcS1pUkbahMdALcURn31P46jVlBdt2qP:WOc9kDSIY2UtI7A91pUkbahMqQUJC6vh
- TLSH T14B7302C1CE314B48CEA6737107A98259B104F2FE23599F574F247CAEFC2615636267E2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
282880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA
user32
DrawMenuBar
gdi32
InvertRgn
comdlg32
ChooseFontA
winmm
PlaySoundA
ole32
CreateStreamOnHGlobal
olepro32
ord251
shell32
ShellExecuteExA
Name
pec1
Size
54KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=177, productName=Unmarked objects (old),
count=1, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
EVE/eve/eve_faq.rtf
- SHA256 638b63fd351137c637aa1043dfd63cc2d3d1f93444ac8f25d9618edfa7797de1
- MD5 d249adb29faff74f7a9ce27b2991c8b5
- SHA1 80a8ba80c1e110784a530c70cb939f5238e7a921
- SHA512 6cdc83f1b4606e58c958ab5b13c119a4d77e9d167eb6d0fe2d84a4348f55cab6296e49ef5417ec295c9957c218c25520842d7956352977720b798316e024b3a0
- SSDEEP 192:E8+/+O7z6e/D2zdTpU3tfXjVtJJrXVc02hk0WzAG+J2gkShqBPUcFQG:E8+/+O/6e/UU3DtTrFcN1V2gBiPBuG
- TLSH T1464295CBAE044B7216AD03D3670D66C6DB12C0FC27A6E4E5745CB06833B2966737B6D4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
EVE/eve/eveintro.eve
- SHA256 6fa3c234bd6487b0c58a4da48672a09d714fd41afb00b3f4cf53cdf614693662
- MD5 f8ce6c9f05c525c4145d4aa17ec0b700
- SHA1 6d54df4cbe75be4d06d5bb54e5d1a50c984755d2
- SHA512 8fa55e8422c21035a383deaf397515f0d309078eddfd15ebd53e74f5ecd734309b6a172de6c7c67a3d0898a3145159ae12794030491b1668271984f000663c01
- SSDEEP 768:ZbBF2fIciUK1mYwuZuI/7j3aj6mSYJNdxdRkAFtALVq66jBDCyr9z1Vi13Sx8R53:ZOfIcAU+/7jKjLSYJNLxFyLM6RE9jihx
- TLSH T19013D009720AF781C5B970324C1244AD3359F448AE02AE462148573DEEEE9EDDF6EEB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
EVE/eve/flowchartsymbols.eve
- SHA256 3e1e233d27c4370369a4ae17609ecde8b9b5d30576bc3c72aea49e8ae29a914f
- MD5 8b6bf539e33e7e83c19eaf02416af1ec
- SHA1 e0722226943af697d7522432bad7969f9f593510
- SHA512 ad9d75a7d9585e692132681e25d23b4e9b3c7bf96a33b4f48cda48d5f621e3def7cf14267e4ebee5e7aaa0bd19a4e1ee43eaf79e87829268c296a287c053f6df
- SSDEEP 96:467n4tT0A0eDBYjQmR4zeX5dptcQ+8kuLE5tpvuZGbzmQMrtaOnIusPb0G/1Hl2x:54Zlu4iX5dpmuw5XGZMzByIusPD/1HAx
- TLSH T1BDC17C9CB380429A93B619350737D379420EE4326231CF173D6693EE54F576EAC389B6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
EVE/eve/readme.htm
- SHA256 e0af07be2a8c0803c28c9dad5f275d23498f64320a6b1c2e856c7a1e6ec460db
- MD5 52656a7e3f832b1ba6e5e8b2de237bf6
- SHA1 4336e03597e98ccad2ba997592602f06d7b92f49
- SHA512 daadece64e1765181f755535f246569efb302bbe7e87ee5df23398413a99bc641ceb950800e43373b1d1b6339f2780df0a23d085778fdb51a78b0e6e34cf4dd1
- TLSH T14441B5EF550316720B92B139E899B0C5FB36D0ED7AA56244E099305F42A307C832BBCA
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/8a7b822efa.gif
- SHA256 ed54da70ba6537d806c94b498426f374b39b6e2a8b0f4b0435d701ff0c64fbb4
- MD5 6468271a41d9a43ff3b25459b90dd789
- SHA1 7d5b31db3345b61bcb3a340f71e30e8336c8a369
- SHA512 f961ef7ab7ffe46861fd1646204144e1e1106ec9c2fed5ebd765f861665e91ff973e8b4b9f0cd5511f257f862728b63cd9da56176e805591181cd5601f1983a7
- SSDEEP 96:ydsBHOeIa05mesRTepqBr1qEE3xLTnVI02Lq1zQovTZ:ydsoHx5WRSEBBqEE3xDHuUsoV
- TLSH T1E6917CF1536759A3CFA29032E34782C136583A493142599B3673A203ABE4192FE193FB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/Thumbs.db
- SHA256 4e3fe7ddf090fd27fd19fbeec9810105d58821646268c67390b23b1f25361ef3
- MD5 8fbab71b42ddbbaa7626891a2ffdbe35
- SHA1 56f87bccc179cb27081de1888ca35bd0e236e710
- SHA512 7c385bd1352045993a8e32a0dda37b454850778b9747db02e635d8bd771b4d3192d615c53772462b6647db53967c63b66283e258256a26ecb7666a651b461cfc
- SSDEEP 96:a8zEdOkf3WnGSiJNdMxZNXmU5ivH2kJc8Q:asrkpXaxZEU5ivH2kJc
- TLSH T170C16C2B60A056FAF402AE702E07FE8443F57D40FC50A60B7AD6B35FD870A1E5415B68
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/faim021src/data.asm
- SHA256 8855fd6b75024c9b55289be8f5b131dbab91c2af3404e3fb4b3415decb76dc2e
- MD5 aa06eb4791fe0361da875f898da8d0ac
- SHA1 8e91de7322106c5b2a733cb4506f87533888c45c
- SHA512 a65e4f50249bd1614e6f68a3d0f04ce652c9d4a8c3b7ba879245240c44a27d35be985d0478e6fd284a454a170c69aa4eb84041dc26a995ce107098e1a7bf6e2e
- SSDEEP 192:8dUN7ON2hwmVWS4mRcT63jZD3kSqYpbxBNxNyNeghwwLyo0u43DIynHdZOtzD71u:8dUNiSRWK7ZwI
- TLSH T1CF22986DD3D909F1BFBB6A54A562E06E967422B743EB5C64BE3C1C5C371B0EECA08500
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/faim021src/encrypt.asm
- SHA256 81a0a1c7d8c3a50f2dc739fb311fddc5fb2da95ad6cacf0134f3ba5112fd4e67
- MD5 ed0d7c0c552d4d5e17d747000706d08a
- SHA1 a361fb19e2699d884c2c0704408f59aaae30035d
- SHA512 d43342249f8b52cb24d104e16e9ae7f0c6a2b72b361107f929949db9a282bb8182a124c485f9e9108de4f1bc4a50ae5b340658546bf7458747d6a436505bf1a0
- TLSH T16C31B17B679B175F0D1166EA9DF50BED9F21B4606C3340B6A85D462D0BDC202A9306F4
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/faim021src/faim.asm
- SHA256 fd0a19184805b6e0445dfcfa9c1d94237f200da4279c4374e4e8a650cb3b2bd4
- MD5 609bd7c26a4f065a41f3f9c61c136181
- SHA1 71986b7d55850d24c3bd9245388d36c3bb417c9e
- SHA512 5da0f4498f9a5cdde1fc17ed7cd07dd5f39f921d93ad80874d4e17582c0ec03ebcfff843da9c08e647c157740728f00cd2da816405336380cf1052b6daf33166
- SSDEEP 1536:4M/tHYi1IkSAGSao0MoQnmcKMBTKGBKbrq62GGu8KTzG:4yHYi1IkSAGSao0MoQnmcKMBTKGBK3qN
- TLSH T11F33A5013E17035B2CEB31AAA5B3A69DBB7019255933ACA17D0C94EC17FB4F683963D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/faim021src/faim.exe
- IMPHASH aa9051d1fb0f56bf56f1b5f3c446cbd9
- SHA256 4e066f3a4146a308a898a60dd09f5445354efa2d1a0f5e2856ea11f28384a996
- MD5 744c42b639e913d8edf8a6fd13ae3c76
- SHA1 5ce25464a0bbdd891eb376fd524cc5d7823ace8f
- SHA512 ac1083c82942ae5b1834eaccb1753f3b9ca2a3da32801a0e766015cc093e8258b235188038b19c4e52b8dfe1231e44a89f8a763aacc23f62465a1869caf1deb2
- SSDEEP 384:H7gsSMdLUju1bS6hwlW0wXGvnSXvLFQyXolxgxXVwoF+X2UKDvKD+VNzCWC:0lYL50wXGvnS/uyX0gxXVwi3NzCWC
- TLSH T1FFE2B746FDA0D863D6601C3443BB4F63672BB8734821AA4B0BC9AD6E9D1DC50DDE5345
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
29890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
CreateThread
HeapAlloc
GetProcessHeap
HeapFree
GetVolumeInformationA
LoadLibraryA
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
user32
DialogBoxParamA
CreatePopupMenu
LoadIconA
AppendMenuA
GetClientRect
DestroyMenu
SetForegroundWindow
DestroyWindow
GetDlgItem
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
GetWindowPlacement
GetWindowRect
PtInRect
GetCursorPos
TrackPopupMenu
PostMessageA
SendDlgItemMessageA
SendMessageA
ShowWindow
MoveWindow
EndDialog
MessageBoxA
CreateDialogParamA
CreateWindowExA
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterClassA
UpdateWindow
LoadCursorA
PostQuitMessage
EnumWindows
GetClassNameA
GetWindowLongA
SetWindowLongA
SetFocus
DestroyIcon
FlashWindow
wsprintfA
GetMenu
EnableMenuItem
EnableWindow
IsDialogMessage
CallWindowProcA
gdi32
DeleteObject
CreateFontA
shell32
Shell_NotifyIconA
ShellExecuteA
ws2_32
WSAStartup
gethostbyname
socket
connect
recv
send
closesocket
WSACreateEvent
WSAEventSelect
WSACloseEvent
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
ioctlsocket
advapi32
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
comctl32
InitCommonControlsEx
ImageList_AddIcon
ImageList_Create
ImageList_Destroy
Name
.udata
Size
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.code
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
FAIM с исходниками/faim021src/faim.res
- SHA256 28e422495731c0b6b35d8b1ff2ea8719ac59e771d0e384255631e03f6536e989
- MD5 42d63520cd5dd089e8ae5723b8e336f5
- SHA1 399027d0d42fbc47b994d9664d2eb87f89a9ae6a
- SHA512 a057a0aba535e4b57a2660f134ac25a3e0d38248e1159b194c0fa2d7f4e470e7b0d909a0cf922595ed5ee2f3236748140adad96f1c27a1302257241d628362b2
- SSDEEP 96:gWVeE6vvEOgRt6JBfKrkp2GkJOtJyg4DuFFNpk9Aud1k9gOtJyg4DQpkWa9ZpW9y:XVeE6vvDTfKgpXLKDgFvnKDatUt
- TLSH T11532ED22E6A4F840D9F18E3685A78BF20831FC13D961BA6767CC3E5F5C2EC94D925316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/faim021src/packet.asm
- SHA256 413791f234ce0ae8238b7a97a184a6e80e9f70fdf07869dbb81f7940e7b398e5
- MD5 c6a2a46aa2169b9ccad2ad81e328dd07
- SHA1 46ecabb36cb4690fa7336b6f9679d573767fc96d
- SHA512 ebc5023d5d079a285bb253513060136e3ade182a12562fe1edd2c69e10a1147f949303c9636a6d7a51d53fce80e2c2f57912490189cb213c3239519404fa78f9
- SSDEEP 192:r1RtiP87qDsG8xuYPV7SR1pyB+XvRXXX9ZmsMsEUJ7lOjoPsx0bX:r1I4G3Z/XXLmsM1E7lOUPs6b
- TLSH T17D3284252B57031E2E7675B46BF113CAFB58641AAD33A0613E4DCAAC1BF2013E7643E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/faim021src/readme.txt
- SHA256 ae78a7c685b8eaf6c244a9c2b859a31b10c25eece2f8b9ede55db74ff94331b9
- MD5 82589c2398cdb1e01cb195ec342020eb
- SHA1 c807cf01d0d27c3f808900648f4119650706ae01
- SHA512 dcf16898c999bd625b245bfde4ec770bff4ebfc3e8faad875e1b51b29342c5a35675bdd878df168301bf5da705c8447e832ccb8aac1dc05a910831ee4e22835a
- TLSH T1F7E0F142059F712F896C3131A81300ED233C1124E321108434E8C94F1B05C1D86CEB6C
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/faim021src/snac.asm
- SHA256 d312b65d6849ac85999a9a047325cee17e05382433d8a3ebc2ff8b14e313e5f0
- MD5 a8dd4198a03428ad5b9a4b81f62ea6ed
- SHA1 c8191e9e6de8101ef429bb05474ad31d12ac0d7d
- SHA512 6921894438db7d859911e1c04cae8c3ea048f123e68c963969412551073895bc7e67297e4bbf2e49742e17e042525c535f1e272c65318fae98bd5b07a3926213
- SSDEEP 192:asF64iNlN6N0NHNNS8A71duD/mpQXLpqXCfw30y3WaduJvpk:p64+SP71dGmpQXleIaWad8q
- TLSH T11F3283121B47036D0DA93271D6F053CEEBA8191FA833B0B1BC5D595C2B7A5368B993F1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM с исходниками/faim021src/string.asm
- SHA256 f63882ec7a83fa04daa45249d2642c367bf92dd41df4ce1e86908b5d9cdf36e7
- MD5 1e66b00b35a4fc2604d32f7c8582db59
- SHA1 c24be582cd7f2a3d651b358d9bb5581463b6a2c1
- SHA512 f46bc7918d3b7abf0fd78a8cbf4192d4df8ff6aeb2833e0597d0a45f815363e285f112c1fb3dbfbe81d80ce6996454a3c3083c0b7130dbbf6b7ca5bf99aa34fb
- SSDEEP 192:Ai3Wsm8Cj9WDws3SMr0CYlz8Igs/kXTTgs4IcZg4ntUOIvNIA3Op0b5V:ACo9WDwkS+0CYlzZgjHgfZ123Wt2b5V
- TLSH T14ED19FBA6B83034B5D3271A849F126DDEF5878261833D0A1FD4DC3AD2FB809269642D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM/8a7b822efa.gif
- SHA256 ed54da70ba6537d806c94b498426f374b39b6e2a8b0f4b0435d701ff0c64fbb4
- MD5 6468271a41d9a43ff3b25459b90dd789
- SHA1 7d5b31db3345b61bcb3a340f71e30e8336c8a369
- SHA512 f961ef7ab7ffe46861fd1646204144e1e1106ec9c2fed5ebd765f861665e91ff973e8b4b9f0cd5511f257f862728b63cd9da56176e805591181cd5601f1983a7
- SSDEEP 96:ydsBHOeIa05mesRTepqBr1qEE3xLTnVI02Lq1zQovTZ:ydsoHx5WRSEBBqEE3xDHuUsoV
- TLSH T1E6917CF1536759A3CFA29032E34782C136583A493142599B3673A203ABE4192FE193FB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
FAIM/faim021src/faim.exe
- IMPHASH aa9051d1fb0f56bf56f1b5f3c446cbd9
- SHA256 4e066f3a4146a308a898a60dd09f5445354efa2d1a0f5e2856ea11f28384a996
- MD5 744c42b639e913d8edf8a6fd13ae3c76
- SHA1 5ce25464a0bbdd891eb376fd524cc5d7823ace8f
- SHA512 ac1083c82942ae5b1834eaccb1753f3b9ca2a3da32801a0e766015cc093e8258b235188038b19c4e52b8dfe1231e44a89f8a763aacc23f62465a1869caf1deb2
- SSDEEP 384:H7gsSMdLUju1bS6hwlW0wXGvnSXvLFQyXolxgxXVwoF+X2UKDvKD+VNzCWC:0lYL50wXGvnS/uyX0gxXVwi3NzCWC
- TLSH T1FFE2B746FDA0D863D6601C3443BB4F63672BB8734821AA4B0BC9AD6E9D1DC50DDE5345
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
29890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
CreateThread
HeapAlloc
GetProcessHeap
HeapFree
GetVolumeInformationA
LoadLibraryA
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
user32
DialogBoxParamA
CreatePopupMenu
LoadIconA
AppendMenuA
GetClientRect
DestroyMenu
SetForegroundWindow
DestroyWindow
GetDlgItem
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
GetWindowPlacement
GetWindowRect
PtInRect
GetCursorPos
TrackPopupMenu
PostMessageA
SendDlgItemMessageA
SendMessageA
ShowWindow
MoveWindow
EndDialog
MessageBoxA
CreateDialogParamA
CreateWindowExA
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterClassA
UpdateWindow
LoadCursorA
PostQuitMessage
EnumWindows
GetClassNameA
GetWindowLongA
SetWindowLongA
SetFocus
DestroyIcon
FlashWindow
wsprintfA
GetMenu
EnableMenuItem
EnableWindow
IsDialogMessage
CallWindowProcA
gdi32
DeleteObject
CreateFontA
shell32
Shell_NotifyIconA
ShellExecuteA
ws2_32
WSAStartup
gethostbyname
socket
connect
recv
send
closesocket
WSACreateEvent
WSAEventSelect
WSACloseEvent
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
ioctlsocket
advapi32
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
comctl32
InitCommonControlsEx
ImageList_AddIcon
ImageList_Create
ImageList_Destroy
Name
.udata
Size
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.code
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
FAIM/faim021src/readme.txt
- SHA256 ae78a7c685b8eaf6c244a9c2b859a31b10c25eece2f8b9ede55db74ff94331b9
- MD5 82589c2398cdb1e01cb195ec342020eb
- SHA1 c807cf01d0d27c3f808900648f4119650706ae01
- SHA512 dcf16898c999bd625b245bfde4ec770bff4ebfc3e8faad875e1b51b29342c5a35675bdd878df168301bf5da705c8447e832ccb8aac1dc05a910831ee4e22835a
- TLSH T1F7E0F142059F712F896C3131A81300ED233C1124E321108434E8C94F1B05C1D86CEB6C
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/Data_1.bin
- SHA256 c7c0ab73df0e696501197159a4d7e63724804a089bba9b081383780759eb391b
- MD5 00e2d0e1ce48efa9d3835243a62e8e5c
- SHA1 8d8a1f3ee1218de7f0226ab1ab8b36130bb823cd
- SHA512 d42d59a0498c3d590bd48e37f231775450d5b44005a1cd07275b32242224d64154f20b4b78ef6723eef7c39a7fc02f9bc5bd992e7dfa342b0fcd9ebd77c804a4
- TLSH T16DF0AC00C480FD75563201902EF3E504DB5C0323058C060A38DC7A6BAF76AABC647069
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/HotKeySelect.asm
- SHA256 dc1f14be89c2662294cd2fae8da2ab46a19183d612a157d20818e784f80cd592
- MD5 2363683355b1b0f550865693114c6b1d
- SHA1 7a6f1342bdb69725d2d11e298f3f044902435ecc
- SHA512 80ce56b560b0e82ce86fdabcb6293359848493cb1365f9375252881f1c0d0992658c5080a7f73be78a0f103ae9588198d0b145faf487efb9da143cd3b61a4b00
- SSDEEP 96:cUDuEUcmtahc0f4gVz5s4qEMzQaXNFNIyNANH0+RGNnZKzGg8cccQNX2N0NXpDuw:cjEUczc0f4gVz5s4qEMzQaXLFuNGgePt
- TLSH T154B1F1A280A3159227B482151C81F427D0EA5D6BDB21BF21FA5C62AF0FBD3F05527787
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/MainDlg.dlg
- SHA256 b4007e43f9dad9d51449c0c4a8ca9c2d10225c7b8fc11fa3977e5a81b69e9c58
- MD5 ec663d6c95cd02eff72d599da3831270
- SHA1 f05725b7d82befc46381b1b1c97009928e2c39a5
- SHA512 66d67c3815eb0a33241c97a5ffe34728fb3f63ea4b1e9458228f039ba302ab854d70415ead4da0af8f8a68849c0592600c074a8f77175fa9aebd8407cedc8356
- SSDEEP 24:Tm5l4Ajg5j1lwl1qLPmqsyD7qxyd+HmGujuWGz/bwVETg:TAzjg5jHFtqUd+3VWGzTy3
- TLSH T123E1E13D9DD3BD27CCE0B53D89337B60363664DE8E95CB0782482A9B604B9907F47968
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/Res/MainDlgDlg.Rc
- SHA256 5829b6e3c18123b2e21e14f850430bec42d3a561d9f93703e429e7528d12a055
- MD5 376f3ab23b78ff9002c470d9cfcd0f32
- SHA1 c6b9f7e60d4fe0ca07d8eb36bba8ed62826bd9d5
- SHA512 52a627c5f9b6f5bbea2ae4122525da853565b85d23beaeb4ad2a6797caf01a0106f5ff0d6ec792c68fe59edac84a18c1106745bd32b1c8ed31279699c70a15a4
- TLSH T10A41154808C20456E12DB391BE05B36C2CF9BCA74CD79CC936CCAFE8DE1E89005B598E
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/Res/SpeedBallsVer.rc
- SHA256 10e4dce58664ba0c4f88359ac24936dffdad9692859ed02da0054f1ea1debeb1
- MD5 0b662a1a5d1c9b4dc8ccf9270f1af2bc
- SHA1 593282923940e5708327a4c8d8f745829ff2d309
- SHA512 7b318dd1d4e009448ecec1b6c769fa724e96d325c8b7b784507d40aba4f35e5034f27a93e43db47ab88025ac601e7ff46a10796babcc51a754215f6e5138959f
- TLSH T1D0E092A31A806147EC3DA7F7344435E2E258715B12F0C606B24A56410F75D6F035D3AC
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/ResXP.rc
- SHA256 4f81632b1911e8f6f1fdc04daf51c53bce1e895865b9068aca93e2a26ad92979
- MD5 b91c6b41c5db33faf12203f169c4cd5b
- SHA1 2de7b6136d5c5650443c40c3dde0f835c4ccdd9b
- SHA512 e6a6797cc319cfbe235275c1d5f096757494cbfc8f656cf9fe710e4334ef21a6fab6c6f6a891b79a6c6629a97b2769a41965c55d4ea95812399153c07c300fd8
- MD5 SHA1 SHA512
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.Asm
- SHA256 104de5b662a87f5b1d5046d3d14cc76361fa276aa50bac54cd2084afb3ca6422
- MD5 e7485282ff3a3f6ce8525b3a41a0ca26
- SHA1 5fbc3549e00d3da898f1550dcd8fffcfc247b20c
- SHA512 6510b66c560a21f44f88a0b2f678f2d10f736ee665cd8f14768708750a7bca10635399e6cf4705d0e5023261008a983d73b60644ecd0e2ccc91e4d6f8e2df352
- SSDEEP 384:AmpfBF6xxr03mJjFPRKaAb0RitmdnXkZ+s8e6gQamI:DJBwxr6OKaVRitsK+sRopI
- TLSH T1749260E3601F116B48F160272A53BD06C147185FDFB6CA903B4C49A6BFFA12857BB396
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.Inc
- SHA256 5b17380155f980b9e4466a76b8a1f3d0f2cecd8c4d29288afd3c080632a507c6
- MD5 210f852a3a14770b817a7b8930ab8a65
- SHA1 ccca1fcfe8b91e0f123c88654fddaa1850999a38
- SHA512 f30b78166997df97a65459025523fb0310c52b862765e03e8a9b260fe3df6b1218d6e79ea22880e99bc1c8831aa6afe01d36cfd96edc87baf7f2a6170f1a7e2d
- TLSH T1EC31FE40D1C29AFBCE20B00ED745F3623BEC7D7B4CC899CE72CB5798A1275C12A565A8
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.Rc
- SHA256 dc58fbe17708753673fd7d81d6a16250ace5fa1421ee0d6ba751d955f206afbe
- MD5 74eb396bd3a33f276895cfd2f9f499e9
- SHA1 98db652c8c4a3c1fc7ad2504e2c359a6a4532c4f
- SHA512 0de689724711e8ed524c0cc709fcae7066038e9d24a6f8cc071416d25d75192eab0d5c8b5152fea7d8c3461447648df72dcb4cb5117b6600ddaffe3486f3afc1
- TLSH T104E0612DB671051159D1191B1E45F8C0DC09F9F7DDD4D8BEB47A384D8C9006021F71CC
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.bmp
- SHA256 c233676e59403c759178f0a29c0885c0b55cb3ec6c7f9b9dcdbae2a599363baf
- MD5 aeb650e8b25fe4cef10786d43c2daea3
- SHA1 260042536661426b86218be556c79519ea77c405
- SHA512 de937e568e11ab99c3f5e005b7dd3abd4f96fee0b79e35e308016692eaa8ddc29d019d5ad70f4f6dbe16cc330b284873b2091467fc31b21583b2f8000f5e8c2a
- SSDEEP 96:wBnzjw4/+oaMqNgg+uMcux/PDcT5dxVLZbDmakx7D/wCk0bSGYFPA/vyy8Hsom17:ozM4/+oau+YDupLsFBYFPyvyyXrP
- TLSH T16512ECFC3E3B8B75AD5FE03C059A0BB0DE461886D86119BBD137DFA6A09460770B842D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.ico
- SHA256 374d12110d1cb97d32aef204b248bf5c411c338de1f0f3879f1ffc65e9881228
- MD5 535bf1fd1622d725bcd36881aade32b9
- SHA1 e3b0fa74692168f5d6fe11db25e76bf6409a0303
- SHA512 f199f19b72a0d6845717197d75cacb5135a2575528fa7a30177329beb85aa72c49c0215bc5b2d119a04a660b835d6496e29117f2eb7b1f9ecd49b2b38c4f5b77
- TLSH T152511A303611D5EAC4558A777482F6738B08E5F84C0DAB0331B6DD6E6EFF9292A87780
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls.rap
- SHA256 825816d93e303e76716a02421365959d10e96b63d65ba06a5c3515089f648542
- MD5 47c4322bb3abd0a403a69464ef5198cd
- SHA1 ad9f9c70599e14d65481fcbb30d5c580ac23bc31
- SHA512 c934ab9f30cd33eab69aadd514bb2365cdc7261a6b2899254bfa758a1b34b30f345299a3d56596221a4daf7ac0da9f438e4fc51f8aa28fe18dfecbe3d41745e3
- TLSH T1E351D128A005877B07C037561F6909C0D99AC6DBFDABA072E313789DFD5454BA2BE36C
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls_Running.ico
- SHA256 358372412598f78fa311e1a4e373df0bfff99fbeb7b583c28189624a9c593700
- MD5 8b9128867c07331ec13cf1449c272750
- SHA1 e1d632026c31fcc01d8997348bca5b482dc9f773
- SHA512 0d8adfb2f55286a8580473650bbebec446beed4f8786a40bf4150217d5f55860b1063a139211a9b2ca0f284f7ac93a8187e62bab2329d288fedfbc2ce38e7415
- TLSH T156E067607B2CC086D1941930D193EFA43890EA4A9944091776B47E4FBDF8284EA569E0
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/Sources/SpeedBalls_Stopped.ico
- SHA256 3e17ff689308c0ebde78cad20c4934771126076922278974a183fd8faf2ba2e1
- MD5 5471654d2223c4686d9f593c0b09ab0d
- SHA1 ac3112ffd93d6d086694318c201fde1c8a901b3d
- SHA512 f0947b443836cf5b9c2889aecb24c785f8836269d4d4319b7ab3c8afcea5e40b6667ba54d1c757626a30ad8be9dbed12d499064f1872e6c15820d92f7d449003
- TLSH T179E05E313B2CC0CED3D4093AA443AFB02840EA9984452817B2F03D0EBCF734478455E0
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.cnt
- SHA256 f2e9045566d2dea733d4bf7c6ef5f8b917204a8ed2ad7b8cb934cc30cad4bcc4
- MD5 77345344483ed93bf734dd2030abb9e7
- SHA1 8769d5bacc8756ed015f5baaa803307556e628f5
- SHA512 4faef29c37bae9977b278d44521027ee3ff9b4b3236b390a5dc582132453c3e2d7472b34dc6e445315a3da9b0d2fc572eca0b6bcd358e0f2bdab5d71e29b60a4
- TLSH T16AE0E5A2E9624B52E775032CBD3C38959C4D01D40ED29CB3CD77F4DC23445E88208C69
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.exe
- IMPHASH 8216a60a68d05a5cbadc7aa82dc1ae36
- SHA256 16ea0c847d9a04332185cb70ee5a94457f2d39172efcadf29492e406e50d8473
- MD5 7e5e9f99e284d0e8edad60ba5cd0a2c9
- SHA1 040f3d65539815cf9bad9463165f02e5a06a732e
- SHA512 6f953800bfa7079d4e82c76217598f21c55a729757a7e26c1661c7667c741a1d4aedc52119990d60da21f93dece18f320ff51a3994643e4b2da9bf1a736077c9
- SSDEEP 384:/El96CUOQvvyTH0fxEJjAx9rAe7Z7TBAMreDEo1cKENM:Ml9ZDQv6TH050jY7ZHBAMqDEA7
- TLSH T136B2D4FC3E33CA73E62FC13D14825770EE595AA2D8204A57A773EF1A59B42037A2515C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8273
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
SendDlgItemMessageA
SendMessageA
SendNotifyMessageA
SetDlgItemTextA
SetFocus
RegisterHotKey
SetForegroundWindow
DispatchMessageA
DestroyWindow
SetWindowPos
ShowWindow
TrackPopupMenu
TranslateMessage
UnregisterHotKey
PostQuitMessage
MessageBoxA
LoadIconA
KillTimer
IsDlgButtonChecked
IsDialogMessageA
InsertMenuItemA
GetWindowThreadProcessId
GetWindowRect
GetSystemMetrics
GetSystemMenu
GetMessageA
GetForegroundWindow
GetCursorPos
UpdateWindow
DestroyMenu
CreatePopupMenu
CreateDialogParamA
CheckRadioButton
CheckDlgButton
SetMenuItemInfoA
SetTimer
kernel32
GetPriorityClass
lstrlenA
lstrcpyA
SetPriorityClass
OpenProcess
CloseHandle
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetCommandLineA
ExitProcess
CreateMutexA
shell32
Shell_NotifyIconA
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegDeleteValueA
RegCreateKeyA
RegCloseKey
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=65, id=19, version=8078,
count=1, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
InqSoft Speedballs/InqSoft Speedballs/SpeedBalls.hlp
- SHA256 875c280ab90cd63c1c08ed89c35213177725dbae46b08ce741ec470b9e108f93
- MD5 505b7a9d029f335f19065722dec07777
- SHA1 734decc14f62c2b881dd91cf1d9bb43308958d3b
- SHA512 0418a6c11f98138a1d4e150a2ac84111b9ce6f50bcc4b244786611f626b0236e0ebc276d6bfd619047f630facb76f25846f09d24dbb45e3b47766ed8da4e785f
- SSDEEP 384:QWeKF4WED5Mclpl9/xw5HAI4oQVfOjqOV481v:QWec45Fl/9YgxfJOj48B
- TLSH T1EA82AE4EF2C84ED7CDD01BB26E5F1F8529A4CC4A244E6323A51CFB5C5E33AD96C46648
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/Thumbs.db
- SHA256 cae62aff72ca27569bfd1d00a136397026ad632f87b28d0502c896124da8043a
- MD5 50ec20c714a3abbb547aadebd228f513
- SHA1 6f69224ecf00dc98569710018b2c5b63c03557a7
- SHA512 6360307000ff9726d850296093c637a292a2b47e78432337bfa2857722e2d996cabbc969007fc987be38cf64d9ff2c0d35622d796ecd0075d336300292ad90c9
- SSDEEP 96:kEIaASMO5xrfILBGq0OZvQgG/Zqg3h1vr+W:kolMOfz+Br0Iub/
- TLSH T16CE13B55FA8452DCF972027BDD5B8D80C9ED7C856C80028328E6727DC772FC00EB8695
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
InqSoft Speedballs/bafa59d335.gif
- SHA256 1a552f044138bf5a8fa6db867753954b4ecdc30dc20e833f003533881adb0ea5
- MD5 1140f603616200907fcfd1faf967e287
- SHA1 367ea4f71b4e9d0e228eff33dd7f22e11204027b
- SHA512 cd42a488b6f57073c6274d61f4590fdf801397665e4d0efd91bd965ef5dbf6929313df43c1a136f41e7c1f6b26a67d27da86d9acd0bd0ad9ee294b864ae13b3d
- SSDEEP 192:UwAvwpqdbAO2o3T6ca+aq88BgJ7BDzQSvyjBfaYh7L1wAsmLxeuaL+N0qt:bzpq913T6cjaqrBgJ79QSvy9Lh7L1NLD
- TLSH T17612C03FA1D320F215491A7F6BA2521B168CED85B3FC2E1670EBC52189B17825DE6351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Internet Maniac/3d8e3551dc.gif
- SHA256 39add50aba370f7f3792eb89c38003eaf2dca1f4c6dd04f645843f633413cbba
- MD5 7284b340f7ed5718c17455d52e0ef5d2
- SHA1 57948fdd4e05b949d2d7d17733eb96ff3991d530
- SHA512 1b936bb66324c8b0c5ae5befae2fd2394bef1a71bba5adcd623c4c3833fe03e7601d08a32ca4d59e0f788e2b8de4320b6e03e744763aea5f61c2174dee541122
- SSDEEP 192:UDpRJLDF6G1hDjpq+8fROdK1nzU7JBQJYCKo:UD/JLDdhZq+860zcYJYCD
- TLSH T172D18DDEC6BC421CC8350377AAB78ED562452123BB52103549B319989A0D1C6ADBB349
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Internet Maniac/Internet Maniac.exe
- IMPHASH b94015c14118790478cc1be53bb83b58
- SHA256 a90f2124e3be40a0127a023fcc5423bc0981ab2131ab03fd807a76bc16a897da
- MD5 c825c62d3c699aaf5c173aebc115daba
- SHA1 55d239a4bff281202845a9645ddb871259b37e2a
- SHA512 7ea6d6f1e7145c51afc39f74614e668b04183b32f5afc32b86832aa21406d112a8eb991d3184936432212eebdb1d82dc585b61c3e60b252a1e8f65b1c35ba9cd
- SSDEEP 1536:04jj2Enld2CEmaJ8AKedqitpjBBdojDMF4QSlxr5+nsQZ:hjj2Eld2CEmfp0PtpVDoPMLSlxr5+ns
- TLSH T198A33B60F5E081AAF07ED63124F5AF35AB39BC352B34869BAF34A57F5C325408E25712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38380
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
rpcrt4
UuidCreate
kernel32
CloseHandle
CreateThread
GetCurrentProcessId
EnterCriticalSection
GlobalUnlock
GlobalAlloc
InitializeCriticalSection
GetWindowsDirectoryA
DeleteCriticalSection
GlobalLock
GetPrivateProfileIntA
LoadLibraryA
WritePrivateProfileStringA
FreeLibrary
Sleep
GetPrivateProfileStringA
SetLocalTime
GetPrivateProfileStructA
WritePrivateProfileStructA
lstrlenA
GetProcAddress
lstrcatA
SetEnvironmentVariableA
CompareStringW
lstrcpyA
GetTickCount
TerminateProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
HeapAlloc
HeapFree
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
WriteFile
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
LCMapStringA
LCMapStringW
FlushFileBuffers
CompareStringA
lstrcmpA
LeaveCriticalSection
user32
EnableWindow
SetDlgItemTextA
GetMenu
CheckMenuItem
GetSystemMetrics
IsIconic
GetWindowTextA
LoadImageA
GetClientRect
SetWindowTextA
LoadStringA
SendMessageA
EndDialog
PostQuitMessage
LoadMenuA
CreateWindowExA
SetTimer
SetForegroundWindow
DialogBoxParamA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
KillTimer
DefWindowProcA
GetCursorPos
GetSubMenu
TrackPopupMenuEx
PostMessageA
LoadIconA
LoadCursorA
RegisterClassExA
CreateDialogParamA
ShowWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
MessageBeep
SetDlgItemInt
GetDlgItemTextA
GetDlgItem
MoveWindow
GetWindowRect
GetDlgItemInt
DestroyWindow
wsprintfA
SendDlgItemMessageA
MessageBoxA
gdi32
DeleteObject
CreateFontA
comctl32
ImageList_Create
ImageList_AddMasked
ord6
ord17
shell32
Shell_NotifyIconA
ShellExecuteA
wsock32
recv
gethostbyaddr
ntohl
getservbyport
gethostname
gethostbyname
htonl
WSAStartup
WSACleanup
select
sendto
setsockopt
WSAAsyncGetHostByAddr
connect
send
ioctlsocket
WSAAsyncGetHostByName
closesocket
accept
htons
socket
bind
listen
WSAGetLastError
WSAAsyncSelect
recvfrom
inet_addr
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=14, id=14, version=7299,
count=6, productName=Unmarked objects (old),
count=152, id=1, productName=Unmarked objects,
count=13, id=19, version=8034,
count=94, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
MPW/bae495195a.gif
- SHA256 a55ad72a7a74982df584e214959163918414f839202b87656d275f094751df77
- MD5 531280c76586269c8af38daf5358b0fb
- SHA1 b1b0ed1b9b3e17c5833321620d2136438b7de6ed
- SHA512 8bc49582de9a6e133bd6d5da46ecb57e341241f0a8fb793374522d2ff629820ae607b19313a6ebe8e896db1dc42eaeea1bcfed5d86598a1c490421cc6a4a30a9
- TLSH T110815C424356B97AE5E6A1BD3CC5E53539169A0E40BAC07A2D35C603E16832326E5CFA
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
MPW/mpw.exe
- IMPHASH 6007b1fc9f9e8d0f85553aa84f1be8de
- SHA256 cf296ec1cf5459d982c4eb31b06760e05af279de7160aa6a5f1b3051c589ff67
- MD5 ea3202a79c5c1bb3dd074b10d6fa2996
- SHA1 8d247a681452090f2fe82151f5d2fdf8e2f137ff
- SHA512 90e6279b2bfbf5c880fd1b40dad848356be35643a77b11ef2b4e3f83a1a41e16d6cdbe834f1813acb3a640d165f6cfbf91d73593e826fb917b27b71d5997fac4
- SSDEEP 768:xNaStY5zr7/vrdXcoIarG0kOwCLAJHMwXGLbFHLrrvXcZ:xZ4fvpMohrGtOwCLbmGLbqZ
- TLSH T1A5136CD2FB900F92D155943568923BF2FF6E4A182F6963061F002B5EEEA3453471939F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4104
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateMutexA
CreateThread
ExitProcess
GetCommandLineA
GetFileSize
GetLastError
GetModuleHandleA
LocalAlloc
MapViewOfFile
MultiByteToWideChar
OpenFileMappingA
ReadFile
ReleaseMutex
ResetEvent
SetFilePointer
Sleep
UnmapViewOfFile
WaitForMultipleObjects
comdlg32
GetOpenFileNameA
gdi32
CreateBitmap
CreateBrushIndirect
CreatePen
DeleteObject
ExtFloodFill
GetStockObject
GetTextExtentPoint32A
LineTo
MoveToEx
PatBlt
SelectObject
SetBkColor
SetBkMode
SetTextColor
shell32
DragFinish
DragQueryFile
user32
AdjustWindowRectEx
BeginPaint
CreateDialogIndirectParamA
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EndPaint
FindWindowA
GetDC
GetDialogBaseUnits
GetMessageA
GetSystemMetrics
LoadCursorA
LoadIconA
MessageBoxA
MoveWindow
PostMessageA
PostQuitMessage
RegisterClassA
ReleaseDC
SendMessageA
SetFocus
SetWindowTextA
ShowWindow
TrackMouseEvent
UpdateWindow
dsound
ord1
Name
.text
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
OpenedFilesView/e03dd1da67.gif
- SHA256 d61ed6f05f7a87bd113473e763ba846ab9d7e43c487f5652744ad1e7a12bb92c
- MD5 4984bf89dcf1cb832d4b48a99b6cbf90
- SHA1 398a9a1a54e7f7130f5ec7e8455d49f937081d34
- SHA512 e8cf6ad81b4df1a2a309764f0bea70cc9dfa1930b15022cf306bb17cd8e829a21b985fa1d81cb70f62724728b6ee4eeda7b16459677fcabe65926f544ff09990
- SSDEEP 768:ew6l/sh5KkWKJFM+fK/yyA1OlrrajmuDjhewKkp4gNpjQ8Rhru5:c/gZWmMF/y51OQjBPM5G4gNNQYu5
- TLSH T1D40302E24D9FABD101E6837C9075097C794469C8B6B80F167F078B45D8E8654FB212BC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
OpenedFilesView/ofview/OpenedFilesView.chm
- SHA256 e00dd541de5675f890f9e6fbf417f73cd24547f1e8acc11310f8ba2bf251f301
- MD5 abff6a0be170dbfdc77bc3fb8a075d5d
- SHA1 3e1e4a32886c409cf2491546d6f5a48f4a0c5fb6
- SHA512 2c2e6caa76ba25fd9cd744261fee024a5e4ceee2d3f3347f8b3e6f169fe499fa99f251c3f3cd6fc399ccdfe4104fdc945a6bccaac0be3ae04f96ee9c2b3dd6fe
- SSDEEP 96:UDu+OnY6G42DtYE/cj7z594fs04fAkLAriT4FljN7/SU/IHQhn4Mu+JglAtziMc:gu+OuDJA/QoII4ZAUDh4J+JO
- TLSH T10C528E343A801D19E4758639DBD6EDA723A43C8F1EB207B9430BC31159F5A2FD6741A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
OpenedFilesView/ofview/OpenedFilesView.exe
- SHA256 be3bbeee45bb8b2a9a4331a9517226aae017b7a1a5577d14b17626053489d23e
- MD5 e735aeea761b0bba4c5999d7f14f3423
- SHA1 b68864ce2bba46f2b7c6b5f5351040213c90e82b
- SHA512 5db36c2dc71ba6d98d8967d1fd1fd67eb3c1c6034b31ca2940689600b0439a64040b7e44e6da49f1a5a55845a508cb14a19550a659fb1081c50835ee1b1d0727
- SSDEEP 768:+8gbtDa5eCH3+4+sWcI7xUk0h+7TaO3tcPCIcd7AY2Z:ZgZmqcc+Pcvo5c7+Z
- TLSH T18A03D11353B9B5EBD49A153844B3CB042BF9F8319B09CB3769E8328EDC70B42AC4D609
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
92848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
31KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=12, version=7291,
count=4, id=14, version=7299,
count=2, id=11, version=8047,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=95, version=2190,
count=17, id=93, version=2179,
count=254, id=1, productName=Unmarked objects,
count=23, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 665587ce7e7bed76cbd45e1b5998cd98671de3ccccd966864b8adb612e5920a5
- MD5 3c5ff26d731d6bb19c7fac0174661ad1
- SHA1 55724f2c3a5584ac7d155e5b2de7016cf9017193
- SHA512 7fa41feeab9aa7afcc06c9f4e8e98ce416e96fad9ac8c182fd3139b7efd086fb9f62a29fa7da26a4842fc50022eb16f6dce68aec8f28c8a6880d406d8fc235f4
- SSDEEP 1536:XY+29+TtxdGTThBN8RFCj38TimE/EZVa35WF:I+29ytvGvq8/EZV85WF
- TLSH T187637C0373D10C36E2E718B01E322B3A87F9BE3225B4C16BD7E45E965C71A45DA2934B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=5, id=12, version=7291,
count=4, id=14, version=7299,
count=2, id=11, version=8047,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=95, version=2190,
count=17, id=93, version=2179,
count=254, id=1, productName=Unmarked objects,
count=23, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
OpenedFilesView/ofview/readme.txt
- SHA256 a6bd8a6799e9cf4db4ba9eaf3ee377c646a66bfee1bce4a275256e359b1f18a3
- MD5 303b8b1fa0dd3d009c823e79d9928683
- SHA1 113c6c306805e1d9c65eb7377e75bb7f01fc6288
- SHA512 84833c17a6d5a99d35d93d783dbd03fba50a41f56f1b9e97011980cf88eabfada9259af2ac4c3e870c95d37b0be2e2794d6afaa494ae2ed35130a35dd5666bd3
- SSDEEP 96:iLMuL/X0Xedrn9VC4sLdpBXCOdvu6pLRq6mxKtashFUr3OC:iI6kOT0LJXJvu6pLRCYNI+C
- TLSH T117C1A40FAB470BA597E3319362985DA0E25AC15CDB5F26B93448829C2716723F3F70F8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
ScreenShoter/5326d5240d.gif
- SHA256 241f85bc46be79aef89f5756c0067df5e0842e99469a72251b132d6ae50ed7db
- MD5 80cdddb226876c3fd2d4c626d4255694
- SHA1 d05b1273472373dabed3605945ee44fa941d7f2f
- SHA512 b43da4440ffd03959ad20af208421c482a9f90c3c67a1725d173321c2b7036927aa570dc112ac0b40f141bed2a85df311033ce9aa17edda9e98dc7c43aac5cf5
- SSDEEP 768:45OO3uV3nVhgBZOtjZ3bV/BjJ2iM74utcPRP6HDe2OG9fbqJVyefJb8G0c:45Fe1Vhg2r3D4jtcmS41+VyAJB0c
- TLSH T113230240C061507C2194B851F7DEECBFF9428A95396B2CF60931FAEAD0AF835BF85919
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
ScreenShoter/ScreenShoter/ReadMe_rus.txt
- SHA256 6170175ce89569078f53aa8879d202fdde3872990f95b5a5895d874042c310d7
- MD5 db8fd92001e1e87ae2b6a129a7c43ef3
- SHA1 13e39006fc06d48c2ab2c956874cf7425a07269c
- SHA512 d6aedf9299ab21a65b14963207134be25ad7373c862d493302e6513f8c839824b14f0dfb29c38e627cf372b027673ef78737c2653a442a195f5cd47e53865bf5
- TLSH T19631B46C88AB0C6C09540FB6544B4D11949F0C679CE992B0F605FB082F3171A2F05B3F
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
ScreenShoter/ScreenShoter/ScreenShoter.exe
- IMPHASH 20f141f72e3c5ea83221720bc5c58353
- SHA256 a3758c1969af974e38fc83367cc60f2d56a8725017ec7142aeeb6ca89697f031
- MD5 7ffa56bd7eacd62ee244f0a24cec73e1
- SHA1 a7a389e544bbd8bd56d6fdeec2e970bf2f5d0cdb
- SHA512 245a64f0a2060f2249882e6538b11a4a00fe587edf550364bcc97de57cebdf476713c7de3f83d05b0a7351626beb511ed0af636945e3e33953e5c49e61ec4c26
- SSDEEP 1536:V2UOmalJ90sssiYwAiPQ4/g/mvVfILYidHS0Q1p8cn4cfqf:Xuas36PRHVUE0QAcn4cf8
- TLSH T15CA31A33AD241693EA0106F10D1996693A166C2874309F0763D6FE686876FC3FEF725B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7068
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaLineInputStr
__vbaEnd
__vbaFreeVarList
__vbaVarIdiv
_adj_fdiv_m64
__vbaLineInputVar
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
__vbaStrCat
__vbaBoolErrVar
__vbaLsetFixstr
ord660
__vbaRecDestruct
__vbaSetSystemError
ord662
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaStrBool
__vbaExitProc
__vbaVarForInit
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaFpR4
__vbaBoolVar
__vbaVarTstLt
_CIsin
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
__vbaI2I4
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
ord714
__vbaVarDiv
__vbaI2Str
ord608
ord716
__vbaFPException
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaR8Str
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
ord610
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
ord616
__vbaVarCopy
__vbaFpI4
__vbaRecDestructAnsi
_CIatan
__vbaCastObj
__vbaStrMove
_allmul
_CItan
ord546
__vbaUI1Var
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=7, id=9, version=8041,
count=1, id=13, version=8169,
ScreenShoter/ScreenShoter/main.dat
- SHA256 5aa9c94721d7b57b79b9517fec168ebbe55728fc0026ebfbfa2e3bfe901d7f50
- MD5 4b129569634cd693e706f46f55e23fd6
- SHA1 144b1978daf39aa964c21b9a5d6c4a569a4b25b5
- SHA512 cb2abe729ac56e26c470de7f8fd101f5b5df8daa713e4371c65a7e8d69819f76cf3515fc91af214986caff3bf7f31f87241869d7b9d28ec5dbd2174e57eafe0c
- TLSH T101C0122C2E080AC803B1241AAEC0F2F360F32142400F7828F154FB4B3816830C243C08
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
fSekrit/Thumbs.db
- SHA256 ba2f3450a3612da79c7d1a84b31ec92167386c0160be76128d4ec496377f79e8
- MD5 3563a9257e804a07a19aa5c9ee141f87
- SHA1 e514f64d6b50951a2ff06d9a150141209b934eb9
- SHA512 d684778bdeb7b7840cbaa167f8ce7c4c81841159409cac70ef0468d12dacf1fadfddcc8c0b9a32682ec527c6b124bf3aebf206e06d93bec5e9080a7f2e2dac79
- SSDEEP 24:rI08cyUbo0XxDuLHeOWXG4OZ7DAJuLHenX3Eryg8cEVa7kJZJOoMMz+xLWhrgHP1:rIHUUuERA4EE7kJZJ7Oue64igdT/
- TLSH T171B109467A4153D0F4211AB08D669FE087F9EC82B940AB5FB9C57658AEF1DC0E8187EC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
fSekrit/c5bbe8cb0a.gif
- SHA256 a058cf39cb275f7d4a6a8555e981a1cba4bafd24b795ba41b1f78a9cf9eebeb9
- MD5 ad2569954e06d38e5a6b0f13dead1508
- SHA1 20c31191d0e0757fb638170804976567a6887748
- SHA512 98699221899c00f667441704e8dfc6c860b7f423d3cd7da4b870809bc596225e2b97459edb90079edc26535fd12b170aa6f76675ef813162c8e225b4e115f5bb
- SSDEEP 96:Ruz3TjTcP0jRxWoY0GgEX/LTQI/2dnsoPGErcQFnwzC80SVs/1NO:RijwMrdY7fQE2dsoPsQizCEVR
- TLSH T16FA15B1BEBC98375FC67BC3364ACFC2520DFB424210241D8A1942951961ABDBF8DF416
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
fSekrit/fsekrit/fSekrit.exe
- IMPHASH 09d0478591d4f788cb3e5ea416c25237
- SHA256 d5db7972c8db0917311ac366c048a58d42d428a51d613b8fca1344d74edabea0
- MD5 d61dfbacd180305c3546d4dfa7f8f0bb
- SHA1 a8c1bbccdfd79cd98c1dd44fdbed8ac1d45e351c
- SHA512 f9b5d6219694bdc1e5ac31351587aaf2a6777ccc6478d433f22fde64a6790b2ec8400b63fca2e03d31374b06d642253d0b3630681a377b1a472273a02f253bd9
- SSDEEP 1536:ZSXmXAUQCtymhygrNfFJKoUzsDpD+0MYWJK:ZvXAUBNhfJxssZhKJK
- TLSH T1C533F1806F125383C68591F8EC62C8B8D393FC5064E2176FBD9AEA0F2BB5717C959325
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Name
.text
Size
44KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=18, id=125, productName=VS2005 build 50727, version=50727,
count=100, id=109, productName=VS2005 build 50727, version=50727,
count=42, id=110, productName=VS2005 build 50727, version=50727,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=167, id=1, productName=Unmarked objects,
count=20, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
fSekrit/fsekrit/history.txt
- SHA256 c951f0cd9b5acb711ba8833fcad0323c4a217db17a7271ae6bb4865e2c9e1426
- MD5 e623de36b3c316b22b2afe6b70bfef9c
- SHA1 be4caed065d73930d2007f491edbd20703e872cf
- SHA512 6c6cdc306d78281cb9745a87ccea57ab926f5f4f8f94123a1ad3b324c3c7b5a4e6c12d12cd786b484457264ac19a1bb2a85a8692650f571f12d49a781209b8bd
- TLSH T1A621755F9D1AE22073F3C04763056903C3BD512DF9908FE12445A3A8A77502913AF6BC
- MD5 SHA1 SHA512 TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
fSekrit/fsekrit/readme.txt
- SHA256 42e7a8834e3b09227505cd7dfc33d62b6923a6c03dd25ea667add24fb9865cfd
- MD5 97c2cefae0aa23aa0dc289381dddc86d
- SHA1 9a2482dad98587b8c3c8c0efdabf5da233221229
- SHA512 3fa98d250ceb1e534339a934fac820c3dbaefd682e31c1f5cbee6b7ea7280383daa9b87fd632bdd805067e5e25550a57bca3f155ef6e1204f22e11899fbf16c8
- SSDEEP 192:b56GqF3uIbnFJtdr28qmujx5ioDZLWpke:VyF3Fafmujx5ioFLQke
- TLSH T1FFD1D8AF7F4D03751AD34AD3B7D5EB51DB0A616CA35A42643828C39C31B422993366EC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.