c0zes Hard HWID unban[.]zip

resource	yara_rule
static1/unpack001/5/Revo Uninstaller Help.pdf	pdf_with_link_action

resource
unpack001/GRINX64v2/amifldrv64.sys

resource
unpack001/2/2.exe
unpack001/3/3.exe
unpack001/4/Ghosts_Toruney_Cleaner.exe
unpack001/4/cleaner.exe
unpack001/6/AMIDEWINx64.EXE
unpack001/GRINX64v2/AMIDEWIN.EXE
unpack001/GRINX64v2/AMIDEWINx64.EXE
unpack001/GRINX64v2/DMIEDIT.EXE
unpack001/GRINX64v2/UCOREDLL.DLL
unpack001/Hard Disk Serial Changer.exe

resource
unpack001/5/RevoUPort.exe
unpack001/5/x64/RevoUn.exe
unpack001/5/x86/RevoUn.exe
unpack001/GRINX64v2/UCORESYS.SYS
unpack001/GRINX64v2/UCOREW64.SYS

c0zes Hard HWID unban.zip

SHA256 eb5477a85a77e9605efd76e9f475c51e7a8077bacc247a023e47aa11650342c8
MD5 9a11b7091c2fd011ccde1901f7b50737
SHA1 8e7ce576f617acf542b54334a6c091ecddb01ee3
SHA512 ead1e7212dec000265b04e26f1179ae6da3c894ebbe481b4910dd4b3de390bb4bf1dfad04bac522dd2c54d3b3844a18f6f905ce17441fb786302db59bd0ff475
SSDEEP 393216:ouVeT7BIt5lG/XYYK/LINXtJA0nczk7rkWLD:obpItrG/NOsNXs0ncY7D
TLSH
T17D173354C143B118EC636235113B0E1B7CC9B58F66E40ABEFA679C4EB1FCA541D24BEA
MD5 SHA1 SHA512 SSDEEP TLSH

1/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

2/2.exe

IMPHASH a8fd72e864d14b8484dd49e800fd3a36
SHA256 a453b3ea8d8133531fad26b18701c694c324cc201e3069d07e99f0e100908c1a
MD5 a7c8cf1d50ebe630a7d0c47686a0abbf
SHA1 3229e8080975f4f5512d2382552f68c0389acff5
SHA512 42340b7435605049e3f817feac1ac238177772b2b1ebf05eb9311bb58ee3dd1cab39913240a4c39e3407374009310770d8221c31914549524ecd92beab93b787
SSDEEP 98304:ARU3j4wtopcj2dqCYV1coZ4hv3tmF1b6CrjfW/sfH6s7zQcKDsVv/JLSF66b/:ARqt/CdqRc64hv3tmF1b6CffW/sfH6sm
TLSH
T14C369E2777EF9035D6D7827036B66FA26E387C452A3C8D0B3234B54C17729A19AB431B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaCopyBytes __vbaStrCat __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct ord669 __vbaExitProc ord593 ord594 __vbaObjSet __vbaOnError ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord305 __vbaStrTextCmp __vbaEraseKeepData _CIsin ord631 __vbaErase ord709 ord525 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaAryConstruct2 __vbaGet4 __vbaPutOwner3 __vbaI2I4 DllFunctionCall __vbaFpUI1 __vbaCastObjVar __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt __vbaObjIs ord311 EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaStrUI1 __vbaExceptHandler ord711 ord313 ord712 __vbaPrintFile __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord714 ord531 __vbaFPException ord717 ord532 __vbaUbound __vbaGetOwner3 __vbaStrVarVal __vbaVarCat ord537 __vbaFileSeek ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaVar2Vec ord570 __vbaNew2 ord648 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 ord579 __vbaAryLock __vbaVarAdd __vbaVarDup __vbaStrToAnsi ord613 __vbaFpI2 ord616 _CIatan __vbaCastObj ord618 __vbaAryCopy __vbaStrMove _allmul __vbaLateIdSt _CItan __vbaAryUnlock __vbaUI1Var _CIexp ord580 __vbaRecAssign __vbaFreeObj __vbaFreeStr

2/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

3/3.exe

IMPHASH 6b71a51c953ff20af290e7286a7dad23
SHA256 2c141c06f7df57f11ef2c62f2a96093484a65df47065b1a475c53784af0e2664
MD5 c20e96d4e616ce333c19a1c15a1cc137
SHA1 f79645ec115130ee59958c55a556f564260b7a9e
SHA512 519fec9955c4a18e45ec68d9e7dc2bcda74721a6ea088e59e634e26b136bfa15f5efedf8839c036a3cfdcdb9780a2121dc2d71f1fdbbfd3df02d9969e5db753b
SSDEEP 12288:EN1TNRzUSWgDxPWnP0Lamg+hyMU1EUFT99qpDDcZDDR5Id1888888888888W888H:whNRASWgDxPWnP0LamWYC8EOd
TLSH
T188D47D12B3D14437D177563D9C7B92A8AC26BD212EE4984A2EF4FE4C1F787813939263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

485340

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegFlushKey RegCloseKey

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassLongW GetClassInfoW GetCapture GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen CheckMenuItem CharUpperBuffW CharToOemW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BeginPaint AdjustWindowRectEx ActivateKeyboardLayout

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualAlloc SwitchToThread SizeofResource SignalObjectAndWait SetThreadLocale SetLastError SetFilePointer SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReadFile MultiByteToWideChar MulDiv LockResource LoadResource LoadLibraryW LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVolumeInformationW GetVersionExA GetVersionExW GetVersion GetTickCount GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetExitCodeThread GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCPInfo FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW EnumCalendarInfoA EnterCriticalSection DeviceIoControl DeleteCriticalSection CreateThread CreateFileW CreateEventW CompareStringW CloseHandle Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchBlt SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SelectClipRgn SaveDC RestoreDC Rectangle RectVisible RealizePalette Polyline PlayEnhMetaFile PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits FrameRgn ExtTextOutW ExcludeClipRect DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW BitBlt

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ole32

OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create

shell32

ShellExecuteW

Name

.text

Size

467KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

60B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

3/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

4/1.bat

SHA256 2fe645bcbe93398f67d06a80607a0bbe3f1441ecdb02b277fd62dd8e2ad99340
MD5 e6ee619d82590355f8b9eccfab8cee9f
SHA1 fe6929f638a394728fbde1b48d21c5a92e4b96d1
SHA512 d8b7686a1815712ce1495ea1673ea0926c3fee693fd96089f78cf4874bf77796ce2ee8114aa994ce9054b7557040d62c3918b77332ea1571887df650ccea48d3
SSDEEP 49152:yTOB4ynYygOvXsMruROZyUpWvWOLZkORes:Y
TLSH
T16FE5324162149172D46321CCD7DFA91D396CE08B35E03BE352E9AF4CD88B83C957AEE6
MD5 SHA1 SHA512 SSDEEP TLSH

4/4.bat

SHA256 00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
MD5 98f1a0eebcb5f4798662a40323b05a7e
SHA1 068e288005c04b8d859c44d3767613a8036bdb11
SHA512 6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
SSDEEP 768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn
TLSH
T1ADB3D292621895B2D96704CC83EF964D3C7CE0C625F137A242F2BE48D94A83C567ADF7
MD5 SHA1 SHA512 SSDEEP TLSH

4/Cleaner1.bat

SHA256 ca7dfbc65c1fde66413b5dd06f763cbe6b8be78c2a3b88030ccd5dfac23c07df
MD5 ccf667986586fc0ee3a0898629a36ede
SHA1 6ffaec4689d257344f8edd02d44d8388280fb162
SHA512 3e7f9b8df4c455595b57c18917ab9092f5cbd08545116788bcfa709e9edc79c36dae51493da7dc19ba04f69067a420755379a5b11a73205bd05b569f3c0c7ff3
SSDEEP 48:5eB5uGLW8FktI/JHeUsY200qfDTfbi5t2Qzt2Nt2QVt2ttUFt2AAt2Aop+RAULJY:oHeZY2ELTTqMQPdwYrOPT
TLSH
T10D91BF8323974021691230B6EBDF860F6DA8E04F27D9365125F1763AEF468389176FDA
MD5 SHA1 SHA512 SSDEEP TLSH

4/Cleaner2.bat

SHA256 6d8474b60f28ee629a8b0eae25cc8c214d2e45c23e64445105389b530b535819
MD5 691a8da53eac534e67dd0a1afd8d7829
SHA1 fe9754ea0817ab1c3b43c3541ec0b8b5fb551aea
SHA512 667193eee3fceb28c9fdce6017938d87d0666948cee6abe46f36e92055781e30d8e39d3835fcf7d8350f560873065c958e7e0c58aee242f770beade3be27d6f6
SSDEEP 96:tVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg51fH84f/vWo:OZifinifILh9aswTthIIhU0
TLSH
T1EAA27FA1BFD1E237AD5B421E037EDF1A45AC8C89128511702772BE49E28E43C65F1EDB
MD5 SHA1 SHA512 SSDEEP TLSH

4/Cleaner3.bat

SHA256 317142fae707cbac948083d56b1163aa5a6a1b9270031d9e49ea79214ebe99ef
MD5 7d29dc3ace16b45ae3b437cf8aa7d65f
SHA1 fbcfde13c5522d808c321c58291cfa962f104655
SHA512 333d36985afdbe68fbe455d3f59cbe6fc77b0669de44194e07ca28dece06505a1bd5c354ef132df70b936f7ba2740241046b75ab86afbd4728c0da5371e576d9
SSDEEP 768:zo9R/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLg3:E9xg8gUDRnvplQL5LvLpLjLnC
TLSH
T137B3E292631895B2D96704CC83EF964D3C7CE0CA21F537A242F2BA48D94A83C557ADF7
MD5 SHA1 SHA512 SSDEEP TLSH

4/Cleaner4.bat

SHA256 11699f90d4533162a3b7ad620b61a9745a9a06989c3b93b217cd10dec64fb0ad
MD5 8c3967f9be32e3f7d07ee878e1794c13
SHA1 4b0d632fd8f3d30147f4a5721e6fdfb0b0b470b7
SHA512 55519fabada9285bd96d043f3128a6ed4dffad624359c47b27342fe63e0e6f24d9cd35f1a7488da627f68146d4d803ee1e4e946384f62f5a1c32c4599d2ff9d4
SSDEEP 768:xlkTPz5U3/D35lU14IYIXZBMjmgPBpszWQP54Iq5Knz5U3/D35lU14IYIXZBMjmB:Azhzp
TLSH
T120F344045B218001D6F23B4FF52ABD654F6EB24FB5D05AC721AEB70ADCABA4DC3503A5
MD5 SHA1 SHA512 SSDEEP TLSH

4/FortniteCleaner.bat

SHA256 365685c1e71944bc955c6be46cc33a44099bcb0f8c625228e89445f18866b778
MD5 2429db21a224c48fa6b17e55a6762328
SHA1 f86eb0c2de25e8970add83b66253d3f18b0994e1
SHA512 0487e79a9b2b427f8c0e5bb860e78039bcf29626bd58ad8190df858fcfa130d15add3fcd350cdadaccbc1d2e13f822dab76e418029d692d2ccd972594b4c0e23
SSDEEP 49152:9TOB4ynYygOvXsMruROZyUpWvWOLZkORn:b
TLSH
T1A37532006260D2B2D46711C8D7DF995C396CE08725E07BA343E6AE8CDDCA43C55BEEDA
MD5 SHA1 SHA512 SSDEEP TLSH

4/Ghost_cleaner1.bat

SHA256 d1ef552d446eb507fe476872efe18e76e0890198a8deb563e78b22b4c411c439
MD5 8b337ed377138886726892733a624e24
SHA1 8a1c8b34fe7c38cf5d72ed9106defd71778e1495
SHA512 f5498c58ded38991fb3da53dea11c9e796e27943d9fe5ad17cfc448300b78eaeb190e876347517e5c79769e548a1a68c1aaee89438534c0ca810629ca027aa23
SSDEEP 1536:LkYLmcHjAkpYLmcTzg8gxDRnvplQL5LvLpLjLwazhztzhzo:LkYScHNYScTzg8glRnvpWzhztzhzo
TLSH
T1A2C4654027248011D5B3364DE66FB8296F6DF18F71E06AC711EEBB0DD89B91CC2752EA
MD5 SHA1 SHA512 SSDEEP TLSH

4/Ghost_cleaner2.bat

SHA256 a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35
MD5 ce55c0703b6be160771e927ba9de028f
SHA1 144d8889c6d21de0121e189ff3a3d9f607875faf
SHA512 a71678d1aa93a98c82721b351bb52aa339d374070aa85bb2a5782ee499823234d9bfdca1736c14dcba3626365059798275a6e55864cb7253a1895c91e4b82fdf
SSDEEP 1536:gwNoZxBOz2oofaCWfr3PwUWgM8361L5LvLpLjL5Gzf4oH9Gzf4gH9c:gLfaCWcUWgM+4oH9q4gH9c
TLSH
T1F744B0926219A632E867108CC3EF855E38B8D08615E137B251F5EE0CD98B83C557BEF7
MD5 SHA1 SHA512 SSDEEP TLSH

4/Ghost_cleaner3.bat

SHA256 6a0a081e956bb8570b273e6d88206f047ba415e633d54199ff1f23346f201d9e
MD5 8dd0170e85ff789296ea34d4cb82ae36
SHA1 8667b2bce43ad66a6e2daca9bcb5e2289cc33682
SHA512 18354d46ef22315b56c9c4e6c8620406892a358730c7d7278c5cc53d4d97b055dec6a57878d978aa1ac25aee4cd24cd769b06030121d644f731486269cdcd8e0
SSDEEP 96:IVeRHI8UeBVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg5l:IVeRHIKeZifinifILh9aswTthIIhU0
TLSH
T124B290A1BFD1E237AD5B411E037EDF0A85ACC849168412702772BE49E28E43C65F5EDB
MD5 SHA1 SHA512 SSDEEP TLSH

4/Ghost_cleaner4.bat

SHA256 3a146cc094d610615883fbcd72097bdf86b48e9c2bc190ae33458f02b0589b8a
MD5 599c81c06b0f5e86b220d15a4775b4d3
SHA1 ba21681af9669e77e27186a23dd1176d866cef1e
SHA512 ae58c6e1bd10f3e3d4b96dca60d5de6dc4efa912af5702d939685c6b9cfa50c52d51114b1bf2a9b62a6e35ab602d33d87eeec37cc19e20ecab2f396d191e2de7
SSDEEP 768:XX/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJuP:Xvg8gU61nvplxL5LvLpLjLwc
TLSH
T103B3D49263189572D96704CC83EF864D3C7CE0CA25F5376242F2BA48D94A83C967ADF7
MD5 SHA1 SHA512 SSDEEP TLSH

4/Ghost_cleaner5.bat

SHA256 f70f71900d00f4e3fecf0bb8ba9af0670455a07420893f3f5c3e07a961023aa1
MD5 582d19556759663a6f10f1cbcdb8c7b3
SHA1 381638fe09bf6e445183a053f0de584c43f64ad8
SHA512 b37c5b18c112a38ecee4d9f5f9d1231ccf82c848430d408dc49c4f99534a9c63d8f0ef14426a4e2e58a5d5fb0765ce629c7bec438b7b565b3f3cc7d110a7e275
SSDEEP 96:NVeRHI8UehgRVejIXO4C4AyCT5bWV7oJnJddsK4hSQX4V4j4V4z5ig51fH84f/vy:NVeRHIK6oI3m9asdsth6IhU0M
TLSH
T1E3B2B0A1BFE1E233D96B411A037EDF0A95ACC84A1584117027737A59E28E43C61F5EDF
MD5 SHA1 SHA512 SSDEEP TLSH

4/Ghosts_FortniteCleaner.bat

SHA256 fc5a6bbfcbc91ba982f27afcf525eb516515690ed249b5b6a4be861a1411ec5f
MD5 413fb52303987394bf98beb4f5499d03
SHA1 cc0fb83104bb19312ef459a721aa094a2818ec73
SHA512 c4d0df0ff3473f16317e78422f21d5ef42ed083738c7ff35543dd254529573dc2f0f03f1984f16f5f51d89803465cd226ee32b965938f98d6be0bf6046df618d
SSDEEP 49152:YTOB4ynYygOvXsMruROZyUpWvWOLZkORn:E
TLSH
T1BD7532006260D2B2D46711C8D7DF995C396CE08725E07BA343E6AE8CDDCA43C55BEEDA
MD5 SHA1 SHA512 SSDEEP TLSH

4/Ghosts_Toruney_Cleaner.exe

IMPHASH 159731ee3c8c9d0496dcd3dc6dfc52a1
SHA256 d5b857f4972fea91c9d476905d4fb6f80de89df311da0dce83adfbef4d32d1b3
MD5 03c9069653a814dd3a0d69d1431145eb
SHA1 d57ca643bfb63dc9df696054ff12770132a81038
SHA512 b7958fa0c0d2953ed4062f2e241f982377b4b0f990a179da9bf328a39e0a00b79ee76a537cd42482d2d782e33e36f390c85585d88fe16b882e67c4c9edd366cf
SSDEEP 768:EcLW2SN3ItwfkDG7FIMXVGBzn5v1QLKeJunPxrU+lP/X3Zwkin9Sbh9Sb:LLWDN4qfkDo8z5tMGP9U+BBBuC
TLSH
T17ED3E8439ADC3CC6C038A3B477BB93C5C72EEC9592A2C28F56C01295D9BE55379227D8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

24272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\source\repos\cleaner\cleaner\x64\Release\cleaner.pdb

kernel32

FindFirstFileW GetStdHandle SetConsoleTextAttribute FindClose CreateFileW GetLocaleInfoEx FormatMessageA LocalFree FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId FindFirstFileExW

advapi32

GetUserNameW

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException __current_exception __current_exception_context memset

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc terminate _crt_atexit _cexit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _exit abort _invalid_parameter_noinfo_noreturn system exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

4/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

4/Registry.bat

SHA256 867ebe3a036cdc5c70c2ee267ca4a9124bc717dfb3e73c132dc60a4693a13d24
MD5 82c83643e937e4802178b2762976275d
SHA1 260befe1c1cb651f60cd5bf067f0d285922ce916
SHA512 954e168c4c144d3660a179f1deabb0df521c48a4f635159d65f086b09140f801bbbb912134fab019d9283f575a36f97d3c74067897826a270cceb3f0ff928de9
SSDEEP 768:R3Slbz5U3/D35lU14IYIXZBMjmgPBpszWQPX4Ir5KYz5U3/D35lU14IYIXZBMjmp:oxXxX
TLSH
T129F344045B214001D6F23B4FF52ABC654FAEB24FB5D05AC721AEB70ADCABA4DC3513A5
MD5 SHA1 SHA512 SSDEEP TLSH

4/cleaner.exe

IMPHASH 04ec74b53750063212aa61296042395d
SHA256 ce283342401e7fe747fe0ba57befb47465bdfe0f96ddfbeb869496684d6dc967
MD5 ce27988cc633ed4e1ea1ed4bfd94e6af
SHA1 ea627f85d7b710266d6eaf4c741fbce49d329c94
SHA512 6204358139fc5bf8b8b12f8fdcfb5c3f615ce20e651fcb60042376b9d1cf5e5e02ec886a20bdb71ff94ccab16c5881da508431c288e31c9c134dfa10c79e48e3
SSDEEP 384:y943jeTsybDGc9VIJ9KWSCGEcTvMtpAqFAgZl3QfBX8d7ptPQ9Z7L:vyPLoMMnAGZlGB6PQ9
TLSH
T1EA53085FB7A160FBE5B6C1399AC22219BAB171B403229BCF504115791F707E83C3D799
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

70247

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\admin\source\repos\cleaner\x64\Debug\cleaner.pdb

vcruntime140d

__vcrt_LoadLibraryExW __vcrt_GetModuleHandleW __vcrt_GetModuleFileNameW __C_specific_handler_noexcept __current_exception_context __current_exception __std_type_info_destroy_list __C_specific_handler memcpy

ucrtbased

terminate strcpy_s strcat_s __stdio_common_vsprintf_s _wmakepath_s _wsplitpath_s wcscpy_s _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _seh_filter_dll __p__commode _set_new_mode _configthreadlocale _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _set_fmode _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _CrtDbgReport system _crt_at_quick_exit

kernel32

GetLastError QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent TerminateProcess GetCurrentProcess GetProcAddress FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar RaiseException GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

379B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

618B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

4/good one.bat

SHA256 bf8229dcbb4fd5705403ce27f92187bb18aba22033741d9226c481a4085903fe
MD5 f0f4bad659c963e0e1f8baaf578fca2e
SHA1 c3fddafc0759effc2cec8b1a2d3d814c92a5476a
SHA512 58eee8e494e1eb0e00640ae9c2cd261e380d203675c8f66f19acefdd88987209f1b7a49d0159b0a52c12f00831053ce5194ccc8a144e47a0259e453ed61b4d6d
SSDEEP 49152:7TOB4ynYygOvXsMruROZyUpWvWOLZkORZO:e
TLSH
T177F5324162149172D46321CCD7DFA959396CE08B35E03BD312E9BF4CD88B83C967AEE6
MD5 SHA1 SHA512 SSDEEP TLSH

4/regedit_change.bat

SHA256 d73f8099a9125b4cf8932de41114ce9a308c5426f95818b385e3160fb442b558
MD5 76612436f2530bdedea29c7b93dac4aa
SHA1 ef4459e02db59572c48c3534dff5138dd2b80c89
SHA512 b80c3b2819dc633bb6829cf190f3f6852298a11b36ebaed7170252385096e72e241719a18b46ac4c1c822e961d8ac3e0d195bbba9bcbff754f4314df2b9ab988
SSDEEP 768:+/zTATLU3fjX5F0VYIYIXuhsDGLPhJMT2Nz5U3/D35lU14IYIXZBMjmgPBpszWQZ:3mzozEzozOd5T6E9
TLSH
T10874464427214001D5F23B4FF52ABC654FAEB24FB5D05AC721AEB70AD8ABA4DC3613E5
MD5 SHA1 SHA512 SSDEEP TLSH

4/traces.bat

SHA256 94549cc3627afb5b6fac384a2c76cfd13eecf9b4c446472846e5000230952794
MD5 445e5d89086ea289363678a826bced03
SHA1 ff5ffffc89f0f92f99f8c8724481d529f20453cb
SHA512 7ea8822a6d2b13c30522fd31b9079fe8ddfb4a7ec396fcc1d55e7146a1df7afb0a79989f5e9e8ee04f60bc3511212d3e6d60e693e22bc5610287053cb499be87
SSDEEP 3072:iYScHNYScTzg8gvRnvpWyhytyhy6LfgCWcUWgM+4oH9q4gH9/142:REwE6l142
TLSH
T19F15228163158131D863358DD3AFB9196A79E18B31E137D311FDBB0DD88B82CC276AE6
MD5 SHA1 SHA512 SSDEEP TLSH

5/LicenseAgreement.txt

SHA256 079a40fdcab2f7bedf66cd9ab26fce42d2057ef899eba7fb367d9f6981b30267
MD5 13d3876c402174dcd9239c60f559fa7d
SHA1 1cdda259609df4c18ff13aa2f7a4e475e1ef1945
SHA512 8e8e04401c5a4637d110d4ad718321f027cb39f1a366e021584f657dbe30c01384f60a82ddaf6ff2e4291f8354d026723515b0029059f064a17ca7d44d0fae6f
SSDEEP 96:oxfbLEJB34LGPy2ZJ4bTw7aw4ri2q9uCosEt+i4B7KVrVHBhyo/fKhwsi:onLs3fLbnEtj+7gZH3Z/Ch2
TLSH
T107E1CD11B2F9621CF9B73B909FF9C16C8B3ABD64A93EC65E11A0104F4AB09409F61777
MD5 SHA1 SHA512 SSDEEP TLSH

5/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

5/READ.txt

SHA256 4ad8edd3243f042bbbb41c8be042cbb7b7ba9d4b77926ca7227dddb43eb26f8f
MD5 ca117b6313fc2098f84615203f8a5dbb
SHA1 bb6a21fa7994c0fcb6cbb65a9f74a2bd70eee83a
SHA512 d3d7f8fd73e45176c301ce6a45563e069e6783eb52c645936e51bdcfe2c376aa2d4b65f0c775e3748f077fd1737b8ea26fe34c6e410484d2ca72e884a1ef7045
TLSH
T1DBC08C02430632B89C11069A260B5082BE484C98E22878051495007A8E28A8C24706B5
MD5 SHA1 SHA512 TLSH

5/Revo Uninstaller Help.pdf

SHA256 72aa84045e0e18c8cc65d4c675f24acfbb8d036293669191c3bde48a977d5f7c
MD5 55333fa55d246c2f6cc36bd62fd1b547
SHA1 3b9177ec77903208e2e3d235e2314567b1350d77
SHA512 f2fe10b8e65322ae23b14b3c3878188480605ebe1cf7ce8ce39346750e44893688e6ba6ad9a5462900caac174094da77e02b8c780d3a2b524eb8ce540679e908
SSDEEP 24576:qnit1JSd5kcVqoinG7au2aJ42MWYbkByZpZKh4EL1SeNnztfAwG8Z1:t1JSd5sG7d2eHxgZ3KGRiVXGC1
TLSH
T157652304C4028DC9D8F245F9EB5B9E31FB7AF41281CA8659327CE54FAB41E7DE883562
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

Extracted URLs

file http://www.revouninstaller.com
file http://www.revouninstaller.com/

5/RevoUPort.exe

IMPHASH f1701f0b31fe827683fdfb65eb40b138
SHA256 1e1b6b9ea8985ee022f6724fbf8986039f8cd97346f97e150244324aafed3dd3
MD5 c0e7417a7f7d5396ba78d6b7503a4992
SHA1 bead818743b83b2902e08b98c62dbaaf3c264853
SHA512 b1418534207557eff050fc06ef27af51fd5ffa4f220c188b95dde917ea17f483fd3a200842adb208507a306f033d594ffec8883bd8c4492d370a400486095809
SSDEEP 3072:tkLnAdeRbvAZpoKIIn9xg//XHTfq2M0W30L/OHQ4HFs3qMGrfv8npp:6LAoYZCIn9SzsFwWw
TLSH
T17714C057BB20D83AC8066E715DF2CCAA6679BC213F910D9B310EB2368B313477D5A25D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

94:78:65:fa:a2:e2:37:2d:53:8a:82:5c:0a:2a:06:f8:90:32:c9:2a:57:7a:dd:ce:2b:d7:45:21:ab:76:17:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Chains

Jan 1, 0001

PE Signature issue

Digest

ff:19:79:9e:b8:b7:b7:df:ff:53:a2:05:81:19:47:f3:8b:f5:91:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Chains

Jan 1, 0001

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Serial Number

0f:ae:00:14:1b:9f:16:25:f7:80:19:f2:59:ff:fc:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 7, 2024 - Aug 13, 2027

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

0

Major OS version

5

Entry point

4996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

I:\Projects\RevoUninFreePort\Release\RevoUPort.pdb

5/ctrlbars.dat

SHA256 c831e8cd1734d3b4d1e8a9dab9ac8cf82cb80274b7228a953eb76fd9efae6031
MD5 8aeed44b5bbaa6bf032b16e1d37549b2
SHA1 cb96d69dd271027ff72a97566cf813e5df209f9b
SHA512 651fc7a0f77d33faf0720a64f2946582295a28d89b0d6e16c19f6c60e63fe1da0b8fa9c6ae301248849058bedf80498c9b6f2c184c62866d7280e41fcba16219
TLSH
T1A801DA2BF7954142D8118330085F979176A6EC505F399707B116736C1EB6709ECC5E8F
MD5 SHA1 SHA512 TLSH

5/lang/Estonian.ini

SHA256 1899006aab38b129bac93e3935bef214accc31d7fbe08fee733e7a89eeef9e08
MD5 fb4844267d83de0565c5ab8d8475605f
SHA1 cfa437a8ac17216cb9e965f7305363f459e69572
SHA512 a6655508cbc8ecacd6da3d0d4741f3c7b20294ccad932f761d1cee16477970c937034804e9d5360d164c7cd999d66ca5cf88a04431985f38da85600794d8154c
SSDEEP 768:Qoo7Xt4YZqN5IIsJ40C3PbEHzzB4O3orViGugUVP6:CbtwtWhoc6
TLSH
T1F3A3AF9696FC5125F3F7AE04ACF012115B63BD9BBD78D21C1680069D6EF46C0E8B236B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/albanian.ini

SHA256 09fe4f2a0d1d54c5d374db235f07f06642404a630f8b981461b0f7998b7c753b
MD5 cd86d5df4564a5d91934b3383a2b342e
SHA1 d278404bf4412d00e07839911cff8a9f0c3afc2a
SHA512 7fc876b6637897ce0aa46d947764da63616978f0f5bbc71b0bf1e6b7b1fc8680ff0a5e1b691737b4d0f75920b1c854cec150dfd27e599c326fbfd5277609eca1
SSDEEP 3072:PqsTpW4zQl0dBdRNBPbz6M+fnZPjJPvY/:S5q
TLSH
T12BA3D12697F94159F2F37B0199B843617A77BDAABD38D20C0280264D5EF1A80DCB177B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/arabic.ini

SHA256 d8d0c60ead40825b14d3218ad5a17870f51d602653a397f2162f31b0150e6915
MD5 c75676d808ed8d88add598cc51f79769
SHA1 418cc54489003c093d391b5da26105bcd0f13870
SHA512 e598ebdc0cea722ba3811c1b1a13e256c940002ca5386fc6374cffd8ee0cd414fac300b638f0fa78ebd724720ec1fd865460cd3ab59923d62f1dba050453b8c6
SSDEEP 768:QozVbxjdghJOUphZAalAGVd2c1q8bBosGgK/pb:5VVjiXre6Ad
TLSH
T1CC8383258E58D63C2763C324C796CA23A215896F9DEC323A46F54E450AE1530A74FFFE
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/armenian.ini

SHA256 1da3e26753481f5b8c46d4fae24de4c64272b94e5f8efba57d023d95d45af71c
MD5 c2e52abf76949ac22c6a1065b6b31c26
SHA1 6379c1cea97c9b7c2a3fc7109bd737a5636e75f4
SHA512 9e7268f2be2af7e6337b0b3a46f337f22e539249be20a8c98447122491c0854c195d658c17c7fdf7937b5dd06c3b29fce1021ff0d9056730811e3362ac63b6a2
SSDEEP 1536:dkBUnjsnfKN4+p23BItlXCNZXL+wUX+RZ7yWQlCOQYjt2z+4B69YK3zpMJ:dkenjL4WSBvKje
TLSH
T153730B3B05E0C11A5267972496E2172DBF23E799E538B74880DD496D37F0801E86FFEA
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/azerbaijani.ini

SHA256 40bfd25dde16bf01fabbe69d437ddc41912cd2345f298791b29ad6f799f5005f
MD5 1a4347051fe1c06c7f1a3ca92fa446f4
SHA1 01f5f0dc9c8ec115056e778bd6eb1cc7b913e4a2
SHA512 a2de98a5def251f5a9182be1dea0d05bd6fe9534aafc8fcad25e1b56e95194f8776be3520d44aef1f49a3eb8008dc5219f087d44d0743e77044bd5c254d3acfd
SSDEEP 1536:tr/B/DYbKOmtkk64nvyoA2gIyLNeMOsVfF3FoFFfOB8ZA+s:tr/B/jOmtmmvyReMPfRevs8ZA+s
TLSH
T1EFB3F66183AD9215F6F34F44FCB13E6357A73EE63E38D14A22C5058C19F12A1A471BAB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/bengali.ini

SHA256 4bc156e2e76c204d2a2a799596c108bd38ae29dc0cf2e9bd7a2e7402b70c0537
MD5 217dfde5bbef95c1c50503294c9ace4c
SHA1 db2fb2a5921a2938006faee99e39a148982a9719
SHA512 7aaf5814438afa292d769e2848d365136e0e620f052e839b583a3a8f1c0029a9c862f8e8aea5cd3667d8164237d5306c0138403fab9a5dc095e29358d12da4a1
SSDEEP 1536:o0g0yS3dFxAB17/vw3q7jcV3H0iBTkH8Ngva4e++l:M0yS3dFxICF
TLSH
T1EAC3F5296701763A15FD404C43C38EBF5EEAB944202CA5F864E5DE81A3E62FA0D4F79D
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/bulgarian.ini

SHA256 c8df8a3923526c3aae67a6c0ceffcd7d732eee8a9215aca7f67833becf213c9a
MD5 ae03e256cde717b0512fdb5593eab610
SHA1 11139cb0a9df7b969032852372d66ca22df79c34
SHA512 c16f36a37f4fcae6f3603782b818f2d45da9ccd5f793e34dc78bd580117798edbf58e3b539541733d4283b25607c7c0fa715471503eaaa0b80b12d1be4f5769f
SSDEEP 3072:qVA2Mkq6dm17gEzBB3dm0bnx06m+O0wufFduJ9BoNdwQKTlZJnTXYTBF63:WMkszBBtm0bnx06m+O0wufnuJ9BoNdwv
TLSH
T1D8B3EF0FB87D9214B664D2119F9642E722BB7B1467385AC682CF3DA8715CA3533263CF
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/czech.ini

SHA256 aa6b1d30a2adc755a44122aca13c7ca56c740c6e69f9b799ea6fd5ca7109dc4e
MD5 edf65aa9e3901e57e6290c53d9b18f19
SHA1 c22a962518f577f96d187831c4009d807f5f8b6d
SHA512 0be4b66e464ccc6108df33156eef18e473424e8ebe832060321dea50be93e2a8e1aa81801ab44d545e24654cb112abf302d983345936dc2e8a73b0abbd4a9505
SSDEEP 768:Qo4WsLv7IW5d2Up6zgnwnDLJ7u32oKmbcEUE6KkAcsl5V9nOlIjVM2bhTRvwLaJO:Wv7YC5V5xjVM2bhtvwicvgU/WdEc0Km
TLSH
T1A8A3E81656FC0156F2F79F05E9B006B28A777C957E38D20E51D1068D2AF1AC0E8E27BB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/danish.ini

SHA256 7a2f9651f01898d76e4b0ad81272d12602162aab0af87eb7e0294ed345c1a6b2
MD5 b460a1121bdb6806e308212eb9f63f8f
SHA1 b42175bf8208c16669434f49ee46fdaadcdafe6a
SHA512 d826b851fdff9b77211a264e593921b2239f1fb20278524e091459941a6ef69ae1bfbf227a1d5c243366a51a3f87f4e474e95be0a6532140db268d7f537da806
SSDEEP 768:woFSqMIncxRMfdlcae2rggccdx1rml/AqllDzGykfT:ShIncxRadlcaevgdj1rml/AqllDiyu
TLSH
T10493C31267E8422DF2F76B10FCF502655A67FC99AE3DD60C0281068C1EF1A94E5B277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/dutch.ini

SHA256 2e28a502e941e141084f26baedb6516db1fe31aa3d4738672133dd669b2af1ac
MD5 cdc73811540f2c2c034e5c3a449f33de
SHA1 9c69a2131c2906f8c526cb99a9a8d8cc995cc557
SHA512 22a7539b1090291e93125a6b7e175c9d0af5a4b8acae97b75f4377a14c8e105d67e3d402d8f926be7b2d7a3266bdd7ffe07754294f890a96fe9526c3911161a8
SSDEEP 3072:7H4dFoMDFALOCHmS6YjMnj2m9ROmjBOZenO683p8ffcT3kWaP/HeiTKs4R474UOz:EW4p8J
TLSH
T11DB3C31217F9821DF6F36B04ADF406619F77BCD9AD39D60C0390169C1AF1A80E9A277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/english.ini

SHA256 c372b6e261751b5fc08418aa3f3c72778125cc1dcf9827e1b01b61ff22d6df3b
MD5 2f8397ae9aa350dc9e3bd4b51096632f
SHA1 807f0b12c2b678e0edc43c6a093138875add779d
SHA512 148a9075e220f8fb39b3396fefb7ad7aa0f3a51a0858ce65580da4d499fa4f65180fd3b4b3c8149332408876f0513ba07e322ee87b6d16aadcecd43d563dc54e
SSDEEP 768:Qo3oW7/ETiuWD6V5yBxzqp+iImPXhF9cie9MzJs5IzS/GYeop6w/lB69YK3zgivB:OO6ryBxzqp+iImcVCop1lB69YK3zT
TLSH
T121A39C5267F80119F6F77F54AEB502714E77BC9AAD38D64C0281058E2AF1E40D8B27BB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/finnish.ini

SHA256 fedcc719ac22d45a77f117372e0e124aa0ede73dfc0768e7cdf7420539140731
MD5 a3d974340201c1d00af3a87f4d3da6dc
SHA1 5a7b7effc4e0f4bf37672c57f859af4e370d0f64
SHA512 db2570f00a443f52c5f59da1c90721e31b9c094e50e17bf2552c59d4aec05eeb28301a6d9cfa1ae09140e141da7e6ac92565da10b18c5b26dc40596b7f1adf08
SSDEEP 1536:FBS3SpCVzylAGnh/kI2l/UPg9te5t3c6E:FBS3SpCxuAGnh/Kl/ag9te5tu
TLSH
T171A36B5656FD9225F6F79F00EEF402214B737DAA6DBCE60C0B80054DAAB1580E4B17BB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/french.ini

SHA256 55dfc5a4c1281e73a7032684ebf6e4266eda20f7edb5c308c0d37ee3b97e9979
MD5 a9d13c44aec86f1be897df918f98b28d
SHA1 12f6017c0a5b29d8c4588c410550f38797fd6aad
SHA512 67230ad9f2813a62045e1a15c89e71b808cb0b65b2d5db68106dceb5ec00c79b868ef3a6d0fdff49366dcae44e1797fda47833bc31144a9c84e5274b76c444b2
SSDEEP 768:joiM7CcsVh5ervgf28Z9qq2dK0KA9Mf8C0FfUHK3Np/p52Y29f0JmYd:ajsderm28Z0pNuh0F3JD
TLSH
T164C36616A7F84216F3F2BF01A9F902218E7B7C8A9D38D61C0281558D2EF1E54D8B577B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/georgian.ini

SHA256 a37876448b2ea24f5fbf964130485bc7a5b7669d6fa5d1dfefebe98ea3a967f2
MD5 198f4e61dfcef0808b8ede2acbc2b5a0
SHA1 66ab89ae7bd5b78fb6ef919b96d6333ccf05b67b
SHA512 42f7229469e515334fee8a2f4b4f58c4e9126f9ec547df4acb47c70b421aada0a2467d2c628083a07c9aa4b2d98caee06320a7da83a27be75c4c0b34500b0d05
SSDEEP 768:D6rx6V5yBxzqp+iImPXhF9cie9MzJs5IzSRGYeop6w/lB69YK3zgivDUwk:Wrx6ryBxzqp+iImcV8op1lB69YK3zS
TLSH
T143A3D15267F90119F6F77F20ADB806695E77BD99AD3CD60C0280098E1AF1E40D8B277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/german.ini

SHA256 20c5cfdec557a3235f941dd364e2309fd479027cdba3ce4010450626d9372a7a
MD5 50ff2a7b7501a747368cf917a353dcb9
SHA1 c83270bb4ef5e592ebbbc645c5d5ccf48dcc7a64
SHA512 7336c7e786b8bb92af29a63e4e1652ad72d6e41c503dfee8cd3fcf23a67a615a668307d1f431a75b359919a0f6ba11907ab3a07b0d8b587b1b02c23c3e618aa6
SSDEEP 3072:5iWbqp5O0vDnkQywCn1vEkpHuOmm1ocKDvW3yS8TJM3KUAjva9o3HhQwq0kJcjzc:BSG
TLSH
T105C3E01247E9461CF2F26F10BEB513619E73BCEAAE39E60D1380059D1DB0A40E97277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/gujarati.ini

SHA256 b9749dbf8f843ec48cfb9c6d194a14a1434bcb059c3dd517afc6fe0107394a2f
MD5 10bf3204711b86067f270ce2e26b1be6
SHA1 d47900ffa35de3acaaa9b69c341bbcf7b68c9ddc
SHA512 e781b76ed27881975165498aa89945abe3dc94883fae386ed265760bc071fdb668d4e271c1f1bba8ba6fedf7b96499d041734f88f98bc5b97c7503fefc90e875
SSDEEP 3072:LUVdwiSTdrABIXzfGCR3ZIaquF4Gfzbu/XysbdQbHhDYFX:LUVdwiSTdrABIXzfGCR3ZIaq84Gfzbu/
TLSH
T10BC3F3BA2EE706EFD06E9001D2FAA533E32A1498E275E24754A517833FD710279573EC
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/hebrew.ini

SHA256 6afa576feadaf7aabe5fc735155523ed724abc7871a899fbca7a3f5aa1cfb8a8
MD5 9d97e4da88f7417381e9271b2a5facc0
SHA1 5b7019c9992abf72147792da5e264a3dd92dfcfd
SHA512 46bab97cf5b825939a8cd0b8463da22ff7626e06e0f7602a7d82aed8211608d8c94ebdb62c491a0c0ca7fb29af025c2e837d7fe012b2fccaad8dd371d591643b
SSDEEP 768:Qo3P8kH9JvEiYr+m7B5r3Z8sG/F7pYAz1m6yizgwUknK46V:dP8aEv+m7B5TZHGtjHMwUknK46V
TLSH
T1375303A40A50C2FDA664EF07C6AB0A2FC792DA08417D770764CD0AB03F5E691975E7BC
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/hellenic.ini

SHA256 1fbfee3e9fb3d7e4bac9ab89c49b25b1d93d65389a1db3d9276c0b8c1a9c363b
MD5 2750a46c066ce37250be338d2d4b2c28
SHA1 70a26f9d3e3e418dbc6b16c785b25b6e0ede57b0
SHA512 0856e4f4d81f1bf731b56c3a24e6a6d48726b89869012d8a63499d003b55303e9b0287291c11acf6f2a940229204bb5fa7b694698e87d8997a703d531538ceff
SSDEEP 3072:Ac5z/5PUzxtz9draMdSfhNbDsAV2g+3X8fry:r57DBy
TLSH
T1EBC3054E0DAB16219EA5A9F2947381174E5FF49A043CEE7AB2F03144EA9D8118DC3F5F
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/hindi.ini

SHA256 e12c37a1db03bd8a8846bb01e3d6b6a96b95ac0ab7a6b1871451efcacdd4f5a5
MD5 e472bd91ea5a4a3fa1c205d4977cf109
SHA1 ea5ed4f2ab3625457c1a5203921dcee890ce0d03
SHA512 b506d5972e455d42e2e13ff5f1133ad47652b32fc312896d11853a2ce0db1cc2e1ac16b3d99f02c66b87f04ef4734232c21f48e21731f5093bc589c619285bc7
SSDEEP 1536:eY/rr+qEG5U3JYBBZ/aYRVlkvbV/Ca8jTmARUSD0zzSJt0kTR:eY/rr+qNUWBBZ/aKkp/C5K8QzSJ3
TLSH
T17FB36B0658815E34615C8ABEF86103779DCB2C2C76DE23854FC626FAEAC933E5046BDD
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/hrvatski.ini

SHA256 7fd712396d175d5fc694d78fdbd5149c955944e7b343143b5215ec6305fa0b71
MD5 feb1e88105e492fcbdd1d6db74e0e1ea
SHA1 99c21c1df4de45d8a49e7cba1566ff683b420208
SHA512 cafb9b1609cb9c2758eac3d92055acf6602ff6641c4487e9c35dfebc6ae9451a87698f4af138471956780f620de04fedf4c45de43ae5ebad4019551a8e7c8c18
SSDEEP 768:QoMLuV/aGAVazqJfcUEOINf9Fp/EitEfUsnghc1V7Z7jRln1FponVg3yMKP:HVcXJfcUCFFpPGfgGvZ7jvzpzm
TLSH
T19593D117A7F8125AF6F7AB04E5F903655A7B7CA97E38D20D01C0068D1AF16C0E5A237B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/hungarian.ini

SHA256 fdf714f0b9db81dcce9789fd733a6d3cef53c691e0de65d9dedac72d0e53880a
MD5 a7ee365669c543d7e381bb8803822d27
SHA1 6a7490e02721d6224517b8041c9469b6d2528546
SHA512 e938388ed765e9a05817ca170f8306fc8b5a4b08e2b3866eda1df487b4c5254b61c47ed107b36a1915b1c5ff61986ff35ad743332e58532e4667e952f33bfb55
SSDEEP 3072:euphjkIdd/DdEIRmabm4QPVs0fwodhjAMX+907+AjwVm+VVKiW8HjJkS6tEjD96g:pJdZmy
TLSH
T1ECB3AF1662EC411AF6B7CF02BDF043664A37BC996D3DD21D81C1168C2EF5A80D971BAB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/indonesian.ini

SHA256 7c106fc49fba2b474f2110e4cca4f7118686cc88247a26ece263b07c641f395a
MD5 03c961e39ff65dffa29c91bd88ef2bf0
SHA1 66a72334c6c89bc7c253c154244c8f63b593b124
SHA512 9022bddb8f28657aa35f42642448be98bbe87e02ec7fec748a4ef89d3463a84d2cb7fb6abab20c61335653633c405594a7e50d7a6b009c145beda5d536bac568
SSDEEP 768:QopWzmYva0w2t2O21T4oO+CWKKu0b9YVU/yfIyN0LTr5VR/28ci4BVR2p8HZTE15:YA2tKhriV0BBkk5V
TLSH
T175A3BD5666EC9109FBF79B00A9F402A15F6BFD9BBD38D20C038115592EB4AC0DD2277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/italiano.ini

SHA256 4e95ec19294e55ae3567e8a948a58caf92f086025e3f299a31ab85efbffe474d
MD5 f63e667767a07a538d6d603378588c12
SHA1 4b039630fcaab45186f68aa2c2ca805930c9a56e
SHA512 e0783e6e0086853e3745bf6d0df692cc6c51f408878525c76986233963d8c3beae8bfa584027b75af264f4c9c751a51f9838b4ad1ec2e0d6d946f1115633d065
SSDEEP 1536:3FfDoukGXUbrlNC3K/BWj55pq2asvR7NzlixEsE:VfDoL5rl83K/BIHp9asvRxzsxFE
TLSH
T14CC3BD22A7F81219F2F3BF40BD7906254E37BE5AAD3CD65C02C1058D1AF1E5498A17BB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/japanese.ini

SHA256 c7db46a3e7456315891cf9485ef8f7d2ff3cea29b29436331f576def5e3240d9
MD5 40dfb52accc2112b1a079ac2f4df3262
SHA1 918e4e553f20b2ea1425a3b585a7f281b19539dd
SHA512 fd6306c1268a8c1b19c782f49cc0fd4b190a0fb314454c00a60914f8480b081c7157a311eb23fd5f0b9a99dadb09f849f946b0f05b9753f45c93b9cbee7585d6
SSDEEP 1536:P4p5dzhjWVI3NNRuZKxCmN7XyY2YWnzYZqfyequDRZESt4pFVpW:A5dzRWWfRuZm7XyY2Y6zYUfKujPoW
TLSH
T1DA532E8D79540A2F26B6C290D1D06362AB97F82C1ABD5F8401CE4A8F77A185D63533FF
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/korean.ini

SHA256 4e9d3a8020ffb04e242851c14599d5e8d2e27cf18cde29aff07e31d65ec2d1a0
MD5 d2ed0a6eac4af1464150a037cebb7f97
SHA1 4894a0dad8a6902ad1a213ec788ed55745c8c5ef
SHA512 936eb15569e8d1d91be9934b38b8e667a2eb96f4fc0b9aba318a0daaf85518710aedd764fff6c1e7e287480bd4d84e5f26c363e2d67d1d3c760bcec1db193665
SSDEEP 768:QoVBirLYmoDX3BNALkr3QR4FHuuPAQKjTezMmX3ySCyXZLOqm:PcYmoDX3BNCkzggHBKjIC6LOqm
TLSH
T15453202D6CA1926163B1D308D6E643B7E307558D2B3E6F4992C10AC537F2B41B5A33EE
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/kurdish.ini

SHA256 9b0c3a8d0bab19d6fa3aad207fca13776af59de6580bfd49acb0afaf3b79bc5b
MD5 01b3acb4ee074bdf8994cc6ad6e3d052
SHA1 3c1bca426e4a8328f5c0c75fe333ba806df1e01b
SHA512 8cbd95e0c318e0bf72e81247eb9a94a9d69ede91caf4167cd21d597c21286afbb8d5f94eb2334156cf05325c24235a6882ed8f0cfa358e07e2cbd8f0cd39f280
SSDEEP 768:QojEDwthZmIwWc3bBtbD0ANX8zf2WDafbqoV4XL2L4IiIJBPbUc2APae77:5+hXs8b2i6a
TLSH
T17863213697E99609F6F3AB00D5F417A74BA37CDA793C920C02E01A081BF57C195A277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/macedonian.ini

SHA256 7054d25dceec5354a3d9d13c10bc0cdb1e6a9c0375ddef98925caf3d0946d365
MD5 dd34def228659a04a154c1847939a8be
SHA1 f47857c50817257660709cdc76e5968ac357748d
SHA512 c6f5f6e34652802bf19c8ebd2cfec5301d815e8c9e1164050dd7a8aec77595b9d00e3134d93531952410d3f0636d4d692876120a083c726d724c1c694393db30
SSDEEP 1536:AseY/ko34dTYxIxQazH+KM5N59Svvtuig36p7NXxdV1vNWM3ktFRyGigjHBlI/pB:AseY/koIdMxIxQazH+KM5N59SvvtuigO
TLSH
T1AF93F31FB9BD4204B2A0D2619FA586E722EB3B1863384B8541CF3DA4726D67573163CF
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/norwegian.ini

SHA256 313ba8d4ad1cf58590506abeaad0e0082ebe15435c05794f48a1d01eeacce484
MD5 13ba2c253ac9c3dca2f77b68cc333ed8
SHA1 333a7626b3bb7ccffd7caa27d8dbe388c1396ffe
SHA512 5a88017ff3caf8d4db2292cf62c437d143d72636b7d99f5cdcac1259c6d9cf8658ac939c6614d8e6525e634b4b01df8d00bdbdddd0c366287a949823fe41aafa
SSDEEP 1536:uWlB3TQkbLM1FPrlJdji6E+X4t1AexI5Tz3yeJ1UrrLYsY:uW7jQkbLMDLdji6E+X4t1AexI5Tz3ye3
TLSH
T1A393BE52A7E8511DF2F36F10FDF802215A6BBC99AD3DD60C0281168C1AF1AD4E5B277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/persian.ini

SHA256 2b26c5dfaca7a8a89b50026f5c659a7cf8793e96ea70948e8799d58c8e0b92e1
MD5 2624ebd91ec84714395d1c1bb989a14b
SHA1 e4a93ae374a2ba4f9beae19d937160535eda7c20
SHA512 452648b7ae74c3be3d054703bba19fb22dd4969bf28a0af87acfab7e00539bf827849fe055202a22c02d39d9ca15adae440e358cc1556e8e13419a8f7fe8ac8e
SSDEEP 768:QoeiQ/oOoYiPL0qTNzZG8gZnD29Yli1NUiHskISCGkZ3Ue9:kl1oYiPL0qT+8eDKYlONhil37
TLSH
T1A0B39A054C92CA3417AB6318C543C567622304DF68E98E3D9BDD0D6D0B962BCD68FFAE
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/polish.ini

SHA256 ccc2d33edc510d95c3892ba33afdd6856ee3760893083e020f61cb331c141f5c
MD5 074033e9a8a816865ff8fb3cd036226f
SHA1 f656810b04b8baf9f362891716f1376d56321ae2
SHA512 28dbd51e3bc2494f0ac474e251cbafecb8692bd4dbbe53a38099c03166bcd7b27e46749d443362e42bfa32477117fde6f21a80055985b55ec186320fbb3f6427
SSDEEP 768:QoKcrsLkEOChte3GW00OKhnk7as1ugPU0fUjcu+qRtNCO7oMYrkmPulvoQNE3ZmG:2dink7HYgP9FSRBiVnXsk
TLSH
T1B6A3461267F40155F7F7AF44E5F522658F7BBC2ABE38C28E1580064D2AF0980E96277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/portuguese.ini

SHA256 dcc6d5bd7d168eca5df7af479052010d112574cd11d9fdf76e3c167be750ccce
MD5 d7d4842bf8547de0b8127bf0a134017a
SHA1 e31f59a2b72bae57e7edc2f72a32ec0a725ec033
SHA512 bac4fc7404140f113929441f9d5003ad21d4dac7a9af2582e3ade8305fd56e6177afa42b0213d7e7f58e624e3fcfefabc2db8ec4052c20d0befeef8bb2862ecd
SSDEEP 1536:i3UBngABUk7ck9WzCGwHWaIGuvRbxDmojfx0degoWJ58B0:3gygpvE
TLSH
T1EEB3AC1297FC1219F6F3BF05A9B816268E37BC95AD3CD21C029005991EF1F40E9B676B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/portuguese_standard.ini

SHA256 202daceefb06dafc459fad9e194643aeea9d8fb441f898326fc26f27b73fe535
MD5 2be6dfda140d556c60980c83958da5c2
SHA1 139cce83c93ab264a67f0f53d3ba27ad52c9f370
SHA512 155e4d47089e69c9bb13da754aae3afcd3204c1a241263f8947beb378f8ea930d7fdea20e3462b816d1587e98ec6588e417e72a0b5d504f047ef2db22974387d
SSDEEP 1536:rs0yPglf5pO9iql6B7wHWaI9plCAhYV7jECRRzAkc1LaXi8Bf:2gDt7lK
TLSH
T10FB3AC1297FC1219F6F3BF05A9B816268E3BBC95AD3C921C029005991EF1F40E9B577B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/portuguesebrazil.ini

SHA256 8ae5848453f428219588d16614fdc145e4e5b2ed9a436524fbb38bfc642f1cd3
MD5 a7e3aca49f123ca55f3c16d3471b097f
SHA1 cff36dafc9da080c47abe80d26f63f04b426526b
SHA512 3c9dede08d83a30f9e03ee903cde94c3f136b67fc0052b99dca14c791d7feba8f47ddd1f2764c72a1b8084b78b3af993cc28c2a9396edd30203a40cb6b292622
SSDEEP 768:x2gN2IL1WJTKujy1fdFpJMxLRTIfHy9HT0Ea64dgL:ggN11WJTKujEfdFpSQfHoz0Ev
TLSH
T1D2B3BF1297F91215F6F3BF05A9B816228E3B7C96AD3CD60C029006991EF1F40E9B577B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/romanian.ini

SHA256 8d2ccecf98aa31f2f8f06a16eb7a764fd58c743d235fc9efb357b5a56506be97
MD5 56c4e3c74da2837f93715af079d9be12
SHA1 3d9eae7af0c9ce626d53b19357c41f007589d9ca
SHA512 fb556116f6028196f62da8125dad136b031a4cac33a156820698b45ab4744ddda6cc8024863e8e27a1c9e468e8490cd2d03f3b2f009731786d02d756712cf007
SSDEEP 1536:iN2MUMqPo6eyimlMPqCZN5kYe/1ibc/Kp07z:c9k3SZcd/D
TLSH
T180B3DE16A7F80215F3F7BF00BDB412665E377E6BED38D60E1681058D1AB1E80E86176B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/russian.ini

SHA256 becdfdee0735249e88c14731ad641cffe88ea41f3401455696acfa1b6f9b2325
MD5 8891a81dd4196871babdd1bfc1eba19f
SHA1 3596bc4aed8bcc903716f3eed00efb09ae7b8d28
SHA512 c0f08bd5f6b7668c6a886e9965ab1bed7d3b341d22fb9f8b2946f9a0b3e85e63e42c867b6c03bdc045750ade2a51b4e607883280aa4dbc0be3adbaf59efc0df7
SSDEEP 3072:xoyQmMYBvBv1pDT1DIFO+lczThijUDGU63jcTYspTkKZCvs7e15:WyeKBv1pDT1DIFO+lczThijUDGUxTYsa
TLSH
T15DA3270FF97C9151A664D3608BA24AE321A7B708273996C6D6CF3DA8715C67133263CF
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/serbian.ini

SHA256 663fef249682c9de0819f193ef2b6e2625e2054f093eba37ef852181cfb61ae0
MD5 604ce883fd5e8100f69303f172790f5d
SHA1 6dc166ad68251174a39f22bc955b63a7d9326338
SHA512 065d233f4407dcba1319a515fe05fd6d2c2a1f66c25e1b0f15a7606e833c14cfa41701474c258ee74638e8291d41c2204bafff3b8fb107f53e9e2cf5c5e9d334
SSDEEP 1536:rlyvi0HQGqlUfj9T4xYIvZttVc1bVBuqqe25+Hox6TVp0DK9k8hLoS60thuR0Rdx:rlyvi0HQGqlUfj54xYIvZttVc1bVBuqt
TLSH
T19193E40FA9BC9314B6A0D2619FA586E321EB7B187338568581CF3D94716CA7633163CF
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/serbianLatin.ini

SHA256 eadc85c8748f3b86297b0f69a04964f5c72a2af6a39ce3ae62224572750e7c0f
MD5 0370a43b65f652b883ef7fb20bfbb017
SHA1 ba904238476aef10db916e1f478fed478e24b2ea
SHA512 9c9a44fce1817c4f5d4984e2b3c5afe5a893b46d87efc1e100b90dd5e592a9e0d8d6d5f2f2b57b75b97b0d251c6eab05db0ad4dd6fe4ec0494ab7d64dec4cbaa
SSDEEP 768:woHpxpwVcmmL4Htk5SWgduiI/QHi+9QE/2TWTLDmB0ULZzzB2Yn4qP0gm9Unjxqj:LxpcCSWV/QxsWw0UFH861Ppmm96pokB
TLSH
T1B293E317A7F8125AF6F7AB04E5F803655B7B7C6A7E39D10D0180068D1AF26C0E5A237B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/simplifiedchinese.ini

SHA256 c324cfcda981fdeb77d4cb936ece749a29071e9c5c90d10b096d7a14c6a94da2
MD5 e28499f183fe96f8e42d383630d3ecaf
SHA1 8c02586b6120180e6cc7bd79fae983aee666bcbe
SHA512 08e34431f8a666d5dcfc16d7bb6e712ada56291aea78be87b0545675a18207c23da29e12d64170756728d600207a45eca4d86d042395bf335ed3e3a05562d826
SSDEEP 768:Qo4zlXG/EBCAjxqmrd16Qo6D/K4zytFvNO9y+72vL51N5DEgddpgGIka+XFKCUZl:yz99x/dpo6utF1h+7iTJXJEC0
TLSH
T15C232E294BA0466A43B98618D1D11737E363588E6A3CEF4A45C34FC937DAD0270A77EF
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/slovak.ini

SHA256 634933fd82dfa32fe6258cc77d3a68eb115f6b8a648fa6ab459d96fb71f69716
MD5 32082a6864e2ba727dbaae26c494f281
SHA1 8b4b50e7e3a95a93e456656db0118497c71ce7e1
SHA512 f195f1b479c47ee9d42425f5bf74441275106ccbaa18dff4ad384aaad151d266fe899ca211d939444ed9758d2fea17274a7bfabf1a7ebfa68e857c0bec209999
SSDEEP 1536:zM3DQNFEFVw1D2yGZ2eJxKnuPN9KsyubmGzm9kTrI0Ptw568N:zoD4FEvw1D2yGMeJTKsyubHzm+/Jm68N
TLSH
T16793F52652FD0156F6F7BF41E4F402754B7B3C997A3CD20E56C046891AF1AC0A8A27BB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/slovenian.ini

SHA256 ef3611f727f522da40f5c54fbecd1511500ff919c483533a19259ba4d8f10c33
MD5 f9cb4f26fc5f018367a763e6d89016d1
SHA1 48a2030d046cf9a0129c31557b0d97f42f0600f1
SHA512 2d3e0b4f0a56a20efb0e41127f85bff437b2e8fa7e90252ea13bcd67763a0e640367a74b8b1ac5876f39de3d1fa2a70bfac69acf41b46b32161b7d744a1504f7
SSDEEP 1536:Ek8NAvXgQ+bPeznSkCXr4GzTLC2aw41Ew8Edw9yDPnt8Ml/MN:Ek8NAPGeznYbbzTu2awpw8E2yDF8V
TLSH
T138B38116A7F8125AF5F7AF00D9F406754B7B7CA97A38C11D0290069D1AB26C1E1F23BB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/spanish.ini

SHA256 8c7d26ff0a1a47cb11ca2e2c19a44610b99355a0f741ce19fda76c96afeff560
MD5 d25b299bf6aaada653864f5f10bfe1df
SHA1 f386268c02cb6d5763badb76ed01e4e9676952b9
SHA512 b5ce8454cf9f788fd85207000f8fbef96fb328d3a130912865c928f4366efce583a577361c0dadfc542e05dfc51888b8cb7869261edc8c17c1d6d9eb93e87487
SSDEEP 768:Qo6LSQ9NXboUjhtDJ8XU+RX5ZUTwn9knK5Dc94Advp/Z2TOEvkjsAwlPw6MLuZeN:A9NroUjhtDYRX5ZXVosVmLr
TLSH
T126C377119BF95216F2F3BF04A9B916258E3BBC96AD3CD10D0290069E1EB0E40DD75B7B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/swedish.ini

SHA256 af9cbf6ca800c728b24802743040a42f20db847d4d8956f1bf1b651345fe7c61
MD5 5b4950bbb615d2e3a01dc9bf6c439a7e
SHA1 5a117b2bc13b491d44098254f1f97546e664e00b
SHA512 c09dccc0890467f4f72717307f2a5a0dc45cdd060a1d684743e6d7a76248830ad75b3de3a0ec43c0729d5c901a7522450cc88f3c0ed41014df7007ac51a1360f
SSDEEP 3072:9a5xswBcca3Lb8olTfhGCJyLjJ4SOWzDvJN:9aP
TLSH
T184A3EC5267EC5229F6F39B44FDF402214AABBCD96D3DD60C0280098C1AF1A95E5F277B
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/thai.ini

SHA256 7f4519b478f322286096dc796529df25bab8aabceb64218908f78dc7507c9a29
MD5 7262c82a010789707fcddad58eea61bb
SHA1 054873004d9cd2bd4f60117f8c74f5aa73a94fba
SHA512 fa0f1d78da928252e7a744469994ff72660e79c3dabe975e725ef654608ad6ed6236a660bc44e5faabf12f9c1dcaea2dacdddad8166b49bd2171a324627ad5c9
SSDEEP 1536:Mk071uEADs98s2u4xu/7NoNQdyYEw2VI/2o9xrfln+L47T/LbWdE0wbmw1hCHumI:C398sgaUu2Gi2gwz
TLSH
T1FDA36B3996762312425AD1F4D2D10B33BD1AB81AD87FD24180DBCF2477509B5A2F2FAE
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/traditionalchinese.ini

SHA256 a291eef4b23ba4dfb6f16ceeeec654989145cfbec70685f3a85ad0ddbf922f19
MD5 17b6920cc99857c031f06cfbfd6c85b1
SHA1 4139425baccc974a51d20843e3d251ec63432a62
SHA512 498eceae08c3886c310abda9d9233ede8d1df1bcbaa62c080a1ce4b9bc7d683fa0837bc99dcb4cbb43d4f93094755976587986c346b9da700d041a991e13a719
SSDEEP 768:wowxTZOmlKWIrfwty2bY/SQM4ghr9mJGSC3+vH6Ftx2IvtAPWtU:o1OmlKWIbwtyqYqn4Mr+vHwpO0U
TLSH
T1702321294E95022B53B6C608D5E11727FB63589D1F3CAB8944C64F8933E5D82B0A73EF
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/turkish.ini

SHA256 5f9e53abae5e8f438c1cb01d4de4c1eb459b340066ef8d19b9f677dd8c8bbdbd
MD5 bb7c613587724040db123308d4a62fdf
SHA1 190c1738f14952f9aaa5b0900b93e85c00700de3
SHA512 fe0edfb942bcd54534b20d662b295e6d46d70730e4f865639b34be8ce86ffcb8fe444615699da78477a180b19b2165d563831289062e0ae321a714a438099e1e
SSDEEP 3072:if5EZ/tnh2KhROYI66Vu4ANh5c5MNOCLllZwvBiz9CjOSJaSAoqTxlpo+VUW7znw:Hd35HYB
TLSH
T181A3041583EC4116F6F35F05BDF112624BA7BCBABE3CD20F128115981AF06E09566BBB
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/ukrainian.ini

SHA256 d5b886dd759cd7442705a044cb12d174621e199bcea5e8728e63bcf6896f6bca
MD5 83d527fe61a3cec460137d696af7465f
SHA1 c6c2f9d8323ec851d3a973060fa0dcf8ba82d313
SHA512 c1cf615536667825f2dea8a8cb763b0440ca23d3160f95bc2e960c1010bbe545b3a2832905ea927615a31810321268bf718f74af2d03dfb9a9e121a919e1f8e1
SSDEEP 768:QoELKcU5ElkgV4WetF3BPSgFIrJYnkxZRSyZT6Yg9og4eLFK:GKcDlkgV4WetF3BPSZJY0vVTg5K
TLSH
T1DDA3670FF97C86649794D2508E9246EB11EAB70817B8D6C9A2CF7D6035AC63573223CF
MD5 SHA1 SHA512 SSDEEP TLSH

5/lang/vietnamese.ini

SHA256 8fcb33f7e9d3b8dba46c02c787c67f8b50433ff86be4930c6ee85389fd8ac0a0
MD5 b49d6ab717329b552d1fcb73fcbe9b11
SHA1 cc93f1a198adc734711023462d6bdbfbb1cd8191
SHA512 b78dd5c490bc5ce69e6ccd59efc6dbfe8d1103ee0042891fcc5c6d85adb7d660af0e020ce5b5078c1d5dc174a6cbb709224017128d34a013123da4e86b8bff62
SSDEEP 768:QoHHj/lYz22ES7J8U4vrmSDipIcSjBDqOGOjcrSaUTirBjOQF3aO0fXTl+N5XBQG:4FJ94TjDGzJBTxCXy
TLSH
T1E7A38B34C56FA115B6F2670181A912321E96FDE9A53FF706C3C65E8C27A8C006D93B7B
MD5 SHA1 SHA512 SSDEEP TLSH

5/settings.ini

SHA256 cd34f9148dfd6047c89d6b6401ebad46216810da9196a409bedf2251ea70b5d7
MD5 3424f791dd8cac995d10ae13dec336a2
SHA1 8b5bd9fc5b9539fc274976ccc006ae3ceafeca47
SHA512 e019bb32ccb2ccb90780c1c590599c37ee3b4878d467e3a1b6b19ecd752bfcf0ea1dc1abeee62f924066c04461a2a1771d172aff75b3d8b6564107a4f9b0cee7
TLSH
T12E81B1922AE4241AB373BF95EFB8D9688727BDE44C2AC51D42E0014F05F5A81D9327B7
MD5 SHA1 SHA512 TLSH

5/un_report.dat

SHA256 64642e9d8612c9ae2cc2ed4e1a08048cebcd540eddfc374425ab291efc7f3292
MD5 7658c70859a6ab72cf8b9a026c49abbe
SHA1 9f1203ea976d20c036b0c0ae81fd93cb82694780
SHA512 810cb4f37916cf05e7ac27b4f461d29adfe92824a26dfed7cabba80d0de6dde253c498fa8e2da9f96e63c01976e523e1585ae0229930919071205b265dd91aff
TLSH
T17A211CAA77FF56C4F0F74F33D51A962156B8BCF83830A1A9774B02AD84B258448A0733
MD5 SHA1 SHA512 TLSH

5/x64/RevoUn.exe

IMPHASH 01140ca2ffc80deab26c9c9c7eaf2f22
SHA256 76428cf02598629a0d2a143a8fc02feb2a0fed00fdedbf89746422985b5460fd
MD5 66edd1df967b88fb121116c7eeef89f5
SHA1 0d0a0795d2bb93264effacf3d7d6344885744d71
SHA512 83b046e90bc4180ed9e728b6b1dbf6a83d266e92c0f746a9d4d9d8b3e33a56d30744b221032534a725e278ab71b6fad8c25e044adff443b8cd5e66bbca07c755
SSDEEP 196608:5w32yiqpdeABNLZhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIp:542UpdPZhlqPWpyR1pxP
TLSH
T16F2718B2991188CCDE2CA6B5CE1D89FDCEA27C5AAF9049AF41143D50EDB32C09D3D25D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f8:15:dd:90:7f:5a:d8:b6:da:b3:76:88:f1:dc:d5:36:0d:22:9f:5d:f6:9d:5f:ec:b6:08:89:47:c3:8a:1b:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Chains

Jan 1, 0001

PE Signature issue

Digest

f5:ac:1f:53:31:06:ed:cb:64:41:98:dc:8f:8a:2f:5e:af:be:d6:34

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Chains

Jan 1, 0001

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Serial Number

0f:ae:00:14:1b:9f:16:25:f7:80:19:f2:59:ff:fc:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 7, 2024 - Aug 13, 2027

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

0

Major OS version

6

Entry point

3340724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Work\VSRevo\Windows\Projects\VSProjectFree\x64\Release Portable\RevoUnin.pdb

shlwapi

StrCmpIW ord29 PathIsUNCW PathUnExpandEnvStringsW PathIsRootW ord487 StrStrW PathRemoveExtensionW PathMatchSpecW PathAddBackslashW PathQuoteSpacesW StrToIntW PathStripToRootW SHDeleteKeyW SHDeleteValueW PathRemoveArgsW PathGetArgsW PathUnquoteSpacesW StrFormatKBSizeW StrCmpW PathIsDirectoryEmptyW StrStrIW PathIsDirectoryW StrFormatByteSizeW PathFindFileNameW PathAppendW PathFindExtensionW PathFileExistsW StrCatW PathRemoveBackslashW PathRemoveFileSpecW StrCpyW SHQueryValueExW

psapi

GetProcessImageFileNameW EnumProcesses GetModuleFileNameExW

msi

ord217 ord173

advapi32

RegQueryValueW RegGetKeySecurity RegFlushKey RegEnumKeyExW RegCreateKeyExW RegConnectRegistryW RegDeleteKeyW RegEnumKeyW GetUserNameW RegNotifyChangeKeyValue GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW SetSecurityInfo SetEntriesInAclW OpenProcessToken RegDeleteKeyExW FreeSid SetNamedSecurityInfoW AllocateAndInitializeSid ConvertSidToStringSidW LookupAccountNameW RegUnLoadKeyW RegSetValueExW RegSetKeySecurity RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey OpenSCManagerW OpenServiceW CloseServiceHandle DeleteService RegOpenKeyW RegDeleteValueW RegQueryInfoKeyW RegEnumValueW RegLoadKeyW

wininet

FindNextUrlCacheEntryW FindCloseUrlCache DeleteUrlCacheEntryW FindFirstUrlCacheEntryW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

kernel32

GetVersion GetModuleHandleW ExitProcess GetUserDefaultLCID GetLocaleInfoW GetLongPathNameW GetLogicalDriveStringsW QueryDosDeviceW VerSetConditionMask VerifyVersionInfoW GetLocalTime GetUserDefaultLangID GetCommandLineW GetShortPathNameW GlobalSize GlobalFree CopyFileW SetLastError SetThreadPriority EncodePointer GetSystemDirectoryW FreeResource GetModuleHandleExW LoadLibraryExW GlobalDeleteAtom GlobalAddAtomW GlobalFindAtomW ReadProcessMemory ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW lstrcmpA GlobalGetAtomNameW GetVolumeInformationW GetThreadLocale ReleaseSemaphore GetCurrentThread GetPrivateProfileIntW FileTimeToLocalFileTime GetFileSizeEx GetFileTime TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalAlloc LocalReAlloc GlobalFlags CompareStringW GetSystemDefaultUILanguage VirtualProtect SetErrorMode GetCurrentDirectoryW FindResourceExW GetProfileIntW SearchPathW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW VirtualFreeEx VirtualAllocEx DecodePointer RaiseException FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList VirtualFree GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SwitchToThread SignalObjectAndWait CreateTimerQueue FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleCP WriteConsoleW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale SetEnvironmentVariableA GetACP GetStdHandle HeapQueryInformation GetCommandLineA SetStdHandle PeekNamedPipe GetFileType FreeLibraryAndExitThread ExitThread VirtualQuery InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetCPInfo LCMapStringW QueryPerformanceFrequency SetFilePointerEx FindFirstFileExW GetExitCodeThread GetStringTypeW IsBadWritePtr IsBadReadPtr WinExec CreateThread GetVersionExA GetCurrencyFormatW GetNumberFormatW GetTimeFormatW GetDateFormatW GetModuleHandleA GetPriorityClass SetPriorityClass GetThreadPriority GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetCurrentThreadId VirtualAlloc SuspendThread WriteProcessMemory GetFileAttributesW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI FreeLibrary GetProcAddress LoadLibraryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetComputerNameW WaitForMultipleObjects CreateEventW GetTempFileNameW WideCharToMultiByte DuplicateHandle LocalFree GetCurrentProcess GetEnvironmentVariableW GetPrivateProfileStringW GetPrivateProfileSectionNamesW GetPrivateProfileSectionW WritePrivateProfileStringW TerminateProcess GetModuleFileNameW GetVersionExW CompareFileTime GetTempPathW SystemTimeToFileTime GetSystemTime GetDiskFreeSpaceExW DeviceIoControl lstrcmpiW lstrlenW GetUserDefaultUILanguage GetBinaryTypeW GetDriveTypeW GetLogicalDrives DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount MultiByteToWideChar TlsAlloc SetEvent ResumeThread ResetEvent SetFileAttributesW RemoveDirectoryW OpenProcess WriteFile CreateFileW GlobalUnlock GlobalLock GlobalAlloc CloseHandle CreateProcessW MoveFileW lstrcatW GetWindowsDirectoryW ExpandEnvironmentStringsW lstrcmpW lstrcpyW GetFullPathNameW DeleteFileW FindClose FindNextFileW FindFirstFileW GetLastError CreateDirectoryW Sleep MoveFileExW WaitForSingleObject FindResourceW LoadResource LockResource SizeofResource MulDiv CreateActCtxW

user32

DestroyCursor GetWindowRgn WindowFromDC SubtractRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar GetUpdateRect IsClipboardFormatAvailable CharUpperBuffW ModifyMenuW SetMenuDefaultItem DestroyAcceleratorTable CreateAcceleratorTableW GetKeyboardState ToUnicodeEx MapVirtualKeyExW IsCharLowerW GetKeyboardLayout WaitMessage GetComboBoxInfo MonitorFromPoint UpdateLayeredWindow FrameRect CopyIcon SetCursorPos DrawStateW SetClassLongPtrW EnumDisplayMonitors NotifyWinEvent InvertRect EnableScrollBar GetIconInfo DrawIconEx DrawFocusRect GetMenuDefaultItem MessageBeep GetNextDlgGroupItem PostThreadMessageW GetDCEx CopyAcceleratorTableW UnionRect InvalidateRgn CreateMenu GetTabbedTextExtentW TrackMouseEvent GetAsyncKeyState CopyImage RealChildWindowFromPoint ShowOwnedPopups MapDialogRect SetWindowContextHelpId RegisterClipboardFormatW PostQuitMessage DeleteMenu GetWindowRect GetClientRect IsWindow EndDeferWindowPos DeferWindowPos CharNextW MapVirtualKeyW GetKeyNameTextW MsgWaitForMultipleObjectsEx CharUpperW ReuseDDElParam UnpackDDElParam InsertMenuItemW BringWindowToTop SetParent DrawEdge SendDlgItemMessageA SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetNextDlgTabItem EndDialog CreateDialogIndirectParamW GetMenuItemInfoW WinHelpW GetScrollInfo SetScrollInfo UnhookWindowsHookEx GetLastActivePopup ScreenToClient BeginDeferWindowPos IsChild GetWindowLongPtrW LoadCursorW DefWindowProcW IsCharAlphaNumericW GetClipboardData GetCursor SystemParametersInfoA CreateIconIndirect LoadMenuIndirectW GetClassInfoW SetTimer GetFocus GetSystemMetrics GetSystemMenu InvalidateRect EnableWindow GetDlgItem GetSysColor LoadImageW DestroyIcon UpdateWindow GetParent SendMessageW ClientToScreen LoadAcceleratorsW CopyRect SetCursor PostMessageW CreateWindowExW OpenClipboard EmptyClipboard SetClipboardData CloseClipboard TranslateAcceleratorW wsprintfW KillTimer GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetRectEmpty SetFocus RedrawWindow SetWindowPos ShowWindow SetScrollPos GetDC ReleaseDC GetCursorPos OffsetRect InflateRect LoadStringW LoadIconW RegisterHotKey UnregisterHotKey DestroyMenu LoadMenuW MonitorFromWindow GetMonitorInfoW EqualRect GetClassNameW GetDesktopWindow SetScrollRange GetScrollRange GetScrollPos LockWindowUpdate GetWindowLongW SetWindowLongW IsZoomed IsRectEmpty FillRect DrawFrameControl GetMessagePos UnregisterClassW SetRect GetSysColorBrush LoadBitmapW SetWindowRgn SystemParametersInfoW GetForegroundWindow SetForegroundWindow GetWindowDC FindWindowW EnumChildWindows SetLayeredWindowAttributes PtInRect IsIconic DrawIcon SetCapture ReleaseCapture WindowFromPoint GetTopWindow GetClassLongPtrW SetWindowLongPtrW MapWindowPoints AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar ScrollWindow SetActiveWindow SetMenu GetMenu GetCapture SetWindowPlacement GetWindowPlacement DestroyWindow IsMenu GetClassInfoExW RegisterClassW CallWindowProcW GetMessageTime RegisterWindowMessageW IsDialogMessageW GetWindow GetWindowTextLengthW GetWindowTextW SetWindowTextW IsWindowEnabled GetDlgCtrlID SendDlgItemMessageW CheckDlgButton SetDlgItemTextW MoveWindow EndPaint BeginPaint IntersectRect CallNextHookEx SetWindowsHookExW ValidateRect GetWindowThreadProcessId PeekMessageW CreatePopupMenu InsertMenuW TrackPopupMenu IsWindowVisible GetMenuItemCount GetMenuItemID GetSubMenu MsgWaitForMultipleObjects IsWindowUnicode GetMessageW GetMessageA TranslateMessage DispatchMessageW DispatchMessageA MessageBoxW IsCharAlphaW GetDoubleClickTime GetActiveWindow GetMenuStringW GetMenuState AppendMenuW RemoveMenu GetKeyState HideCaret

gdi32

ExcludeClipRect GetClipBox GetCurrentPositionEx GetObjectType GetPixel GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PlayMetaFile RestoreDC SaveDC CreateSolidBrush CreateHatchBrush SetRectRgn SetBkColor PatBlt SelectClipRgn ExtSelectClipRgn EndDoc StartPage EndPage AbortDoc SetAbortProc GetROP2 GetBkMode GetNearestColor GetPolyFillMode GetTextFaceW SelectPalette SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect CreateRoundRectRgn Polyline Polygon CreatePolygonRgn CreateEllipticRgn SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode CreatePalette EnumFontFamiliesExW GetRgnBox StretchDIBits GetCharWidthW OffsetRgn GetViewportOrgEx GetTextAlign GetTextColor DeleteMetaFile CreateMetaFileW CloseMetaFile ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx MoveToEx GetTextMetricsW GetDeviceCaps GetTextExtentPoint32W CreateFontIndirectW DeleteObject GetObjectW GetBkColor BitBlt DPtoLP GetMapMode CreateCompatibleBitmap CreateDIBSection CreateBitmap LPtoDP CreateCompatibleDC Escape ExtTextOutW TextOutW RectVisible PtVisible DeleteDC SelectObject SetDIBColorTable CreateFontW GetStockObject Ellipse Rectangle CreatePen GetStretchBltMode SetStretchBltMode CreateRectRgn SetROP2 SetTextColor SetTextAlign StartDocW CombineRgn GetDIBits StretchBlt CopyMetaFileW CreateDCW CreatePatternBrush CreateRectRgnIndirect GetDCOrgEx GetMetaFileW CloseEnhMetaFile CreateEnhMetaFileW DeleteEnhMetaFile GetEnhMetaFileW PlayEnhMetaFile GetTextCharset CreateEllipticRgnIndirect ExtCreatePen GetWindowOrgEx

msimg32

TransparentBlt AlphaBlend

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

shell32

SHAddToRecentDocs DragFinish DragQueryFileW SHEmptyRecycleBinW Shell_NotifyIconW CommandLineToArgvW SHGetSpecialFolderLocation SHFileOperationW SHGetDesktopFolder SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW SHAppBarMessage ShellExecuteExW ShellExecuteW SHGetFileInfoW ExtractIconW SHGetFolderPathW ord92

comctl32

ord17 _TrackMouseEvent ImageList_ReplaceIcon ImageList_Remove ImageList_GetImageCount ImageList_GetIcon ImageList_AddMasked ImageList_Duplicate ImageList_GetImageInfo

uxtheme

GetThemeSysColor GetWindowTheme GetCurrentThemeName GetThemeColor DrawThemeText DrawThemeParentBackground IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemePartSize DrawThemeBackground CloseThemeData OpenThemeData

ole32

IsAccelerator OleTranslateAccelerator OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard CoRegisterMessageFilter OleIsCurrentClipboard OleFlushClipboard CoRevokeClassObject StgOpenStorageOnILockBytes CoGetClassObject OleDestroyMenuDescriptor OleCreateMenuDescriptor CreateILockBytesOnHGlobal OleLoadFromStream StgCreateDocfileOnILockBytes CreateStreamOnHGlobal CoDisconnectObject CLSIDFromProgID OleUninitialize OleInitialize CoFreeUnusedLibraries CoCreateGuid OleSaveToStream ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CLSIDFromString CoInitializeEx CoUninitialize CoInitialize CoCreateInstance WriteClassStm DoDragDrop

oleaut32

VarDiv VarR8FromStr VarMul VarI4FromStr VarBstrFromR8 OleCreatePictureIndirect VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysFreeString SysAllocString VariantInit VariantClear VarDateFromStr SysStringByteLen SysAllocStringByteLen SysAllocStringLen VariantChangeType OleCreateFontIndirect SysStringLen SafeArrayDestroy VariantCopy VarCyFromStr LoadTypeLi

oledlg

OleUIBusyW

urlmon

URLDownloadToFileW

gdiplus

GdipGetImagePalette GdipGetImagePaletteSize GdipFree GdipBitmapLockBits GdipAlloc GdipBitmapUnlockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDisposeImage

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

oleacc

CreateStdAccessibleObject LresultFromObject AccessibleObjectFromWindow

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundW

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

133KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

294KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=19, id=241, version=40116,

count=203, id=243, version=40116,

count=33, id=242, version=40116,

count=23, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=47, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=261, version=23013,

count=16, id=206, version=65501,

count=1, id=207, version=65501,

count=1, id=199, version=41118,

count=43, id=260, version=24123,

count=12, id=259, version=24123,

count=466, id=261, version=24123,

count=3, id=208, version=65501,

count=53, id=203, version=65501,

count=1042, id=1, productName=Unmarked objects,

count=106, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

5/x64/button.bmp

SHA256 18d6342804edc786e5f3c5c6249e68681594809492880c4bcca7c5c490ea4e51
MD5 adc319b9cde52444a7486ba50294d34c
SHA1 7a7c4fa9896e6f3d12d8464ad8a98d75c51c1f78
SHA512 785cfe2a03c6f292f012ee0435f436dab814cbf4282fdcd5a31c3df716124ee6c605e7a13b3f7723356db01baa52dcb844dc8e8486189a7fe8fc6522b87f8d5f
SSDEEP 48:yJxwyvOO5Vs9RnMLK2UNsShRYmOB3gVKD4nLyjF:WvOlMK2esShRYmk8GjF
TLSH
T1F5810A02A6C17DC4CC3D9931F45205686A79EB6E59D8738458DCE7BA1B340A3A548ECE
MD5 SHA1 SHA512 SSDEEP TLSH

5/x86/RevoUn.exe

IMPHASH 39e3b226c8c21881ad6f426f8bdcca79
SHA256 393b81a74551f5144cf3a04ccc64612374c1f6c06e8478de66f3e3d9b778f3c8
MD5 1131f4842a33064db3eff44af3c244f2
SHA1 87f85119a5b0b4f76c2b99931c29744fed7e3670
SHA512 37ce09a7503c4fd12e9d96ca95f449f256db874b75037f9f8f12484ff4bb1a1df2c54601ce18dcd5b4a5f3281b7d62277c6bf00e5bcbb593cdcccce7bcf4a64f
SSDEEP 196608:+RB9ZtZaY8aZGbCgaHQW6r9YdNELZhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIf:+nrjLZdg86ZhlqPWpyR1pxp
TLSH
T1E5171A72ED01C95CEE1C27B1CE1D8EFC1DAA5D6AEF9058AF91443C10E4B26C1693D68E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

04:5f:05:cd:2b:47:47:d9:c3:90:9f:c6:f0:96:ee:1a:41:26:01:0b:1a:bb:c7:5b:2f:42:98:92:ba:ac:26:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Chains

Jan 1, 0001

PE Signature issue

Digest

f5:46:d6:07:74:4a:1d:7b:1b:b3:ab:32:c7:a2:e5:08:9d:5b:4d:51

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Chains

Jan 1, 0001

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Serial Number

0f:ae:00:14:1b:9f:16:25:f7:80:19:f2:59:ff:fc:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 7, 2024 - Aug 13, 2027

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

0

Major OS version

6

Entry point

2651828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Work\VSRevo\Windows\Projects\VSProjectFree\Release Portable\RevoUnin.pdb

comctl32

ImageList_AddMasked ImageList_Duplicate ImageList_GetImageInfo ord17 _TrackMouseEvent ImageList_ReplaceIcon ImageList_Remove ImageList_GetImageCount ImageList_GetIcon

shlwapi

StrCmpW PathIsDirectoryEmptyW StrStrIW PathIsDirectoryW StrFormatByteSizeW PathFindFileNameW PathAppendW StrFormatKBSizeW PathFileExistsW StrCatW PathRemoveBackslashW PathRemoveFileSpecW StrCpyW StrCmpIW PathUnquoteSpacesW PathGetArgsW PathRemoveArgsW SHDeleteValueW SHDeleteKeyW PathStripToRootW StrToIntW PathQuoteSpacesW PathAddBackslashW PathMatchSpecW PathRemoveExtensionW StrStrW ord487 PathIsRootW PathUnExpandEnvStringsW SHQueryValueExW ord29 PathFindExtensionW PathIsUNCW

psapi

GetModuleFileNameExW GetProcessImageFileNameW EnumProcesses

msi

ord217 ord173

advapi32

RegNotifyChangeKeyValue GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW SetSecurityInfo SetEntriesInAclW RegQueryValueW OpenProcessToken RegEnumValueW RegQueryInfoKeyW RegDeleteValueW RegOpenKeyW DeleteService CloseServiceHandle FreeSid SetNamedSecurityInfoW AllocateAndInitializeSid ConvertSidToStringSidW LookupAccountNameW RegUnLoadKeyW RegSetValueExW RegSetKeySecurity RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegLoadKeyW RegGetKeySecurity RegFlushKey RegEnumKeyExW RegCreateKeyExW RegConnectRegistryW RegDeleteKeyW RegEnumKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey OpenSCManagerW OpenServiceW GetUserNameW

wininet

FindNextUrlCacheEntryW DeleteUrlCacheEntryW FindFirstUrlCacheEntryW FindCloseUrlCache

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

kernel32

VirtualAllocEx VirtualFreeEx ReadProcessMemory WriteProcessMemory SuspendThread VirtualAlloc VirtualFree GetVersion GetModuleHandleW ExitProcess GetUserDefaultLCID GetLocaleInfoW GetLongPathNameW IsWow64Process GetLogicalDriveStringsW QueryDosDeviceW VerSetConditionMask VerifyVersionInfoW GetLocalTime GetUserDefaultLangID GetCommandLineW GetShortPathNameW GlobalSize QueryPerformanceCounter CopyFileW SetLastError SetThreadPriority EncodePointer GetSystemDirectoryW FreeResource GetModuleHandleA LoadLibraryExW GlobalDeleteAtom GlobalAddAtomW GlobalFindAtomW lstrcmpA GlobalGetAtomNameW GetVolumeInformationW GetThreadLocale ReleaseSemaphore GetCurrentThread GetPrivateProfileIntW FileTimeToLocalFileTime GetFileSizeEx GetFileTime TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalAlloc LocalReAlloc GlobalFlags CompareStringW GetSystemDefaultUILanguage VirtualProtect SetErrorMode GetCurrentDirectoryW DecodePointer GetProfileIntW SearchPathW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStdHandle HeapQueryInformation GetCommandLineA SetStdHandle PeekNamedPipe GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread VirtualQuery InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetCPInfo LCMapStringW QueryPerformanceFrequency SetFilePointerEx FindFirstFileExW GetExitCodeThread GetStringTypeW IsBadWritePtr IsBadReadPtr WinExec CreateThread GetVersionExA GetCurrencyFormatW GetNumberFormatW GetTimeFormatW GetDateFormatW GetPriorityClass SetPriorityClass GetThreadPriority MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA RaiseException FlushFileBuffers GetTickCount FindResourceExW FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetCurrentThreadId GetFileAttributesW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI FreeLibrary GetProcAddress LoadLibraryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetComputerNameW WaitForMultipleObjects CreateEventW GetTempFileNameW WideCharToMultiByte DuplicateHandle LocalFree GetCurrentProcess GetEnvironmentVariableW GetPrivateProfileStringW GetPrivateProfileSectionNamesW GetPrivateProfileSectionW WritePrivateProfileStringW TerminateProcess GetModuleFileNameW GetVersionExW CompareFileTime GetTempPathW SystemTimeToFileTime GetSystemTime GetDiskFreeSpaceExW DeviceIoControl lstrcmpiW lstrlenW GetUserDefaultUILanguage GetDriveTypeW GetLogicalDrives DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount MultiByteToWideChar TlsAlloc SetEvent ResumeThread ResetEvent SetFileAttributesW RemoveDirectoryW OpenProcess WriteFile CreateFileW GlobalUnlock GlobalLock GlobalAlloc CloseHandle CreateProcessW MoveFileW lstrcatW GetWindowsDirectoryW ExpandEnvironmentStringsW lstrcmpW lstrcpyW GetFullPathNameW DeleteFileW FindClose FindNextFileW FindFirstFileW GetLastError CreateDirectoryW Sleep MoveFileExW WaitForSingleObject FindResourceW LoadResource LockResource SizeofResource MulDiv GetACP SetEnvironmentVariableA IsValidLocale EnumSystemLocalesW GetTimeZoneInformation WriteConsoleW GetConsoleCP GetConsoleMode ReadConsoleW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW CreateTimerQueue SignalObjectAndWait SwitchToThread GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx GlobalFree

user32

IntersectRect CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState RemoveMenu AppendMenuW GetMenuState GetMenuStringW GetActiveWindow GetDoubleClickTime IsCharAlphaW MessageBoxW DispatchMessageA DispatchMessageW TranslateMessage GetMessageA GetMessageW IsWindowUnicode MsgWaitForMultipleObjects GetSubMenu GetMenuItemID GetMenuItemCount IsWindowVisible TrackPopupMenu InsertMenuW CreatePopupMenu PeekMessageW GetWindowThreadProcessId WindowFromPoint ReleaseCapture SetCapture DrawIcon IsIconic PtInRect SetLayeredWindowAttributes EnumChildWindows FindWindowW GetWindowDC SetForegroundWindow GetForegroundWindow SystemParametersInfoW SetWindowRgn LoadBitmapW GetSysColorBrush SetRect UnregisterClassW GetMessagePos DrawFrameControl FillRect IsRectEmpty IsZoomed SetWindowLongW LockWindowUpdate GetScrollPos GetScrollRange SetMenuItemInfoW GetDesktopWindow GetClassNameW EqualRect GetMonitorInfoW BeginPaint MessageBeep GetNextDlgGroupItem SendDlgItemMessageA DrawEdge SetParent BringWindowToTop DrawFocusRect EndPaint MoveWindow SetDlgItemTextW CheckDlgButton SendDlgItemMessageW GetDlgCtrlID IsWindowEnabled SetWindowTextW GetWindowTextW GetWindowTextLengthW GetWindow IsDialogMessageW RegisterWindowMessageW GetMenuCheckMarkDimensions InsertMenuItemW UnpackDDElParam ReuseDDElParam GetMessageTime CallWindowProcW RegisterClassW GetClassInfoExW IsMenu DestroyWindow GetWindowPlacement SetWindowPlacement GetCapture GetMenu IsCharAlphaNumericW GetClipboardData GetCursor SystemParametersInfoA CreateIconIndirect LoadMenuIndirectW SetMenu SetActiveWindow ScrollWindow ShowScrollBar SetPropW GetPropW RemovePropW AdjustWindowRectEx MapWindowPoints GetClassLongW GetTopWindow GetLastActivePopup UnhookWindowsHookEx SetScrollInfo GetScrollInfo WinHelpW GetMenuItemInfoW CreateDialogIndirectParamW EndDialog GetNextDlgTabItem CheckMenuItem EnableMenuItem CharUpperW MsgWaitForMultipleObjectsEx GetKeyNameTextW MapVirtualKeyW GetWindowRect DrawIconEx GetClientRect IsWindow EndDeferWindowPos DeferWindowPos ScreenToClient BeginDeferWindowPos IsChild GetWindowLongW LoadCursorW DefWindowProcW GetClassInfoW SetTimer GetFocus GetSystemMetrics GetSystemMenu InvalidateRect EnableWindow GetDlgItem GetSysColor LoadImageW DestroyIcon UpdateWindow GetParent SendMessageW ClientToScreen LoadAcceleratorsW CopyRect SetCursor PostMessageW CreateWindowExW OpenClipboard EmptyClipboard SetClipboardData CloseClipboard TranslateAcceleratorW wsprintfW KillTimer GrayStringW DrawTextExW DrawTextW SetMenuItemBitmaps GetMenuDefaultItem TabbedTextOutW SetRectEmpty SetFocus CharNextW DeleteMenu PostQuitMessage RegisterClipboardFormatW SetWindowContextHelpId MapDialogRect ShowOwnedPopups RealChildWindowFromPoint CopyImage GetAsyncKeyState DestroyCursor GetWindowRgn WindowFromDC SubtractRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar GetUpdateRect IsClipboardFormatAvailable CharUpperBuffW ModifyMenuW SetMenuDefaultItem DestroyAcceleratorTable CreateAcceleratorTableW GetKeyboardState ToUnicodeEx MapVirtualKeyExW IsCharLowerW GetKeyboardLayout WaitMessage GetComboBoxInfo MonitorFromPoint UpdateLayeredWindow FrameRect CopyIcon SetCursorPos DrawStateW SetClassLongW EnumDisplayMonitors NotifyWinEvent InvertRect HideCaret EnableScrollBar GetIconInfo SetScrollRange RedrawWindow PostThreadMessageW SetWindowPos ShowWindow SetScrollPos GetDC ReleaseDC GetCursorPos OffsetRect InflateRect LoadStringW LoadIconW RegisterHotKey GetDCEx CopyAcceleratorTableW UnionRect UnregisterHotKey DestroyMenu LoadMenuW MonitorFromWindow InvalidateRgn CreateMenu GetTabbedTextExtentW TrackMouseEvent

gdi32

CreateRectRgn SetStretchBltMode GetStretchBltMode CreatePen Rectangle Ellipse GetStockObject CreateFontW SetDIBColorTable SelectObject DeleteDC PtVisible RectVisible TextOutW ExtTextOutW Escape CreateCompatibleDC LPtoDP CreateBitmap CreateDIBSection CreateCompatibleBitmap CombineRgn GetDIBits StretchBlt CopyMetaFileW CreateDCW CreatePatternBrush CreateRectRgnIndirect PatBlt SetBkColor SetRectRgn CreateHatchBrush CreateSolidBrush ExcludeClipRect GetClipBox GetCurrentPositionEx GetMapMode GetPixel GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PlayMetaFile RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextColor SetTextAlign StartDocW ExtCreatePen MoveToEx SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CloseMetaFile CreateMetaFileW DeleteMetaFile GetTextColor GetTextAlign GetViewportOrgEx OffsetRgn GetCharWidthW StretchDIBits GetRgnBox EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel CreateEllipticRgn CreatePolygonRgn Polygon Polyline CreateRoundRectRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx EndDoc StartPage EndPage AbortDoc SetAbortProc GetROP2 GetBkMode GetNearestColor GetPolyFillMode GetTextFaceW DPtoLP BitBlt GetBkColor GetObjectW DeleteObject CreateFontIndirectW GetTextExtentPoint32W GetDeviceCaps GetDCOrgEx GetMetaFileW CloseEnhMetaFile CreateEnhMetaFileW DeleteEnhMetaFile GetEnhMetaFileW PlayEnhMetaFile GetTextCharset CreateEllipticRgnIndirect GetObjectType GetTextMetricsW

msimg32

TransparentBlt AlphaBlend

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

shell32

SHFileOperationW SHGetFolderPathW ExtractIconW SHGetFileInfoW ShellExecuteW ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc DragQueryFileW DragFinish SHAddToRecentDocs SHEmptyRecycleBinW Shell_NotifyIconW CommandLineToArgvW SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage ord92

uxtheme

GetThemePartSize OpenThemeData CloseThemeData DrawThemeBackground IsThemeBackgroundPartiallyTransparent IsAppThemed DrawThemeParentBackground DrawThemeText GetThemeColor GetCurrentThemeName GetWindowTheme GetThemeSysColor

ole32

IsAccelerator OleTranslateAccelerator OleLockRunning WriteClassStm RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CoRegisterMessageFilter OleFlushClipboard CoRevokeClassObject StgOpenStorageOnILockBytes CoGetClassObject OleDestroyMenuDescriptor OleIsCurrentClipboard CreateILockBytesOnHGlobal OleLoadFromStream StgCreateDocfileOnILockBytes CreateStreamOnHGlobal CoDisconnectObject CLSIDFromProgID OleUninitialize OleInitialize CoFreeUnusedLibraries CoCreateGuid OleSaveToStream ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CLSIDFromString CoInitializeEx CoUninitialize CoInitialize CoCreateInstance OleCreateMenuDescriptor

oleaut32

VarI4FromStr OleCreatePictureIndirect LoadTypeLi VarCyFromStr VariantCopy SafeArrayDestroy SysStringLen OleCreateFontIndirect VariantChangeType SysAllocStringLen SysAllocStringByteLen SysStringByteLen VarDateFromStr VariantClear VariantInit SysAllocString SysFreeString VarBstrFromDate SystemTimeToVariantTime VariantTimeToSystemTime VarMul VarDiv VarBstrFromR8 VarR8FromStr

oledlg

OleUIBusyW

urlmon

URLDownloadToFileW

gdiplus

GdipFree GdipAlloc GdipDisposeImage GdipDeleteGraphics GdipDrawImageI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipGetImageGraphicsContext

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

Name

.text

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

105KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

6/!!!!RUNME!!!!!.bat

SHA256 f01a1d81cc15187304360905980a01fca029e221cfd7eff5543adeadfdd0b415
MD5 b85b07c305578fe29c88fed4a348a891
SHA1 028203b9a34fcc6ca6c47d67c14619d00b5b36f8
SHA512 3cced910a3e9b772c0f6579ab5daefe9ce84836e7339caea4f070572b1f31f62e3c7d2cb38a66aba88f2b2e096d5560b7b1bd136daeed8cfcbc6c1efa3b28950
TLSH
T1BE21FF63A2D6E09019E0899F70C3BE15ED8B2DE7209F59EB3DC352D5006992DA704B92
MD5 SHA1 SHA512 TLSH

6/AMIDEWINx64.EXE

IMPHASH 5d7543265f1d05f9bd6a417f4988fb48
SHA256 2c67fb6eb81630c917f08295e4ff3b5f777cb41b26f7b09dc36d79f089e61bc4
MD5 64ae4aa4904d3b259dda8cc53769064f
SHA1 24be8fb54afd8182652819b9a307b6f66f3fc58d
SHA512 6c16d2bc23c20a7456b4db7136e1bb5fcee9cbf83a73d8de507b7b3ffc618f81f020cde638d2cd1ef5f154541b745a2a0e27b4c654683a21571183f7a1bffd16
SSDEEP 6144:4NFU+vVycygjjsp5dcAONdA22xVK8LRPo4WBIeX+oD9/nwbr9W9v6i:4bygjjsrdcAONdA22xVK8LRPo4WGkD90
TLSH
T1ED84296AEBA620E4EC7791BC84912302F7A1B4644731D7E7B3AD451A4F33BE4A93D710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

4652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetHandleCount GetFileType GetStartupInfoW DeleteCriticalSection EncodePointer DecodePointer FlsFree SetLastError FlsSetValue FlsGetValue GetLastError GetCurrentThreadId FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection OutputDebugStringA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx SetConsoleCtrlHandler FreeLibrary GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount LoadLibraryExW HeapFree HeapAlloc GetCPInfo GetACP GetOEMCP Sleep TerminateProcess GetCurrentProcess UnhandledExceptionFilter LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc VirtualProtect VirtualAlloc SetThreadStackGuarantee GetSystemInfo VirtualQuery WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle WriteFile ExitProcess GetModuleHandleW GetProcAddress SetUnhandledExceptionFilter GetVersionExW GetCommandLineA SetEndOfFile SetStdHandle GetSystemFirmwareTable GetVersionExA SetThreadExecutionState CreateMutexA SetProcessAffinityMask DeleteFileA GetCurrentDirectoryA GetModuleHandleA GetWindowsDirectoryA LoadLibraryA GetSystemDirectoryA CloseHandle GetFullPathNameA CreateNamedPipeA CreateFileA ReadFile CreateThread LocalFree DeviceIoControl ReadConsoleInputA SetConsoleMode GetConsoleMode HeapSize GetConsoleCP FlushFileBuffers CreateFileW WriteConsoleW SetFilePointer GetProcessHeap

advapi32

DeleteService ControlService OpenServiceA StartServiceA CreateServiceA CloseServiceHandle OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA OpenSCManagerA

shell32

ShellExecuteA

user32

ExitWindowsEx RegisterClassExA DefWindowProcA DispatchMessageA BlockInput GetMessageA MessageBoxA CreateWindowExA wsprintfA SystemParametersInfoA TranslateMessage

6/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

6/amifldrv64.sys

IMPHASH 4fbdc03e4487f98fb59360ea5b3e640d
SHA256 20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb
MD5 0dff47f3b14fb1c1bad47cc517f0581a
SHA1 db3538f324f9e52defaba7be1ab991008e43d012
SHA512 f572e741b5a7e854353420bfe072f4e8d10ea61bd0be06a48f3b07bb58e98987761a4cbd77423bf1ab4a9a79b599b824b6b2951bae9e8ad16bca98c84c72b0a6
SSDEEP 384:Hv+RD9ZsRVl8jqiZchbao0HMrEDulUoLdZFnJtQSZsHLPK6jzOO9bvFR3lZbI1:HvyJZmmqlHCMmulJLZJt6PKgaO9Po1
TLSH
T1C6D24B91C6784C43EEA3DD3062F4D6277D34B6822B60CACF411AD0A44B927C1AB7C36D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

69:99:ca:ca:67:b3:78:60:ab:b5:e6:d9:54:20:d1:b0:d0:49:66:bc:66:74:aa:c3:bf:de:4e:23:94:ad:37:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 26, 2020

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

8e:67:62:87:43:95:9e:8b:73:d8:2a:e5:b9:ee:7a:38:7a:51:92:5d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 25, 2020

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 30, 2017 - Sep 24, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 11, 2020 - Mar 5, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:01:12:24:73:a3:35:86:69:13:0f:00:00:00:00:01:12

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2019 - Jan 21, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

1

Major OS version

6

Entry point

24676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb

6/amigendrv64.sys

IMPHASH f9141c3df8f7ec7b3f2d46265a3b5528
SHA256 38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20
MD5 119f0656ab4bb872f79ee5d421e2b9f9
SHA1 e35969966769e7760094cbcffb294d0d04a09db6
SHA512 428c2a7db1559cb39a882a7dce5a0559efd9d83c2e86ca94bbe3c10c9989fe63c160ab7f475db0400a2ed016ab21f00faa9d0e0b7fdba5e3c34daadab24e71f2
SSDEEP 768:Jn9+pli0X09luuJ4j/2HGra+Jt6PKgeGPeHPc:t0muuJK1a+JtkwGPMc
TLSH
T1F8F25C9197B84C92FDAB9E3062E0D6577D78F6D23A30C7CF0164C0640F63BC26928369
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

4f:35:cf:1f:2e:0f:b8:7a:27:28:30:30:91:ee:50:5a:0b:c5:46:cf:63:dc:d3:81:78:ad:f4:84:77:ec:0f:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 29, 2020

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

9f:88:70:ec:27:29:33:ee:6f:4e:1e:da:97:5a:6d:5d:b5:f9:fb:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 28, 2020

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 30, 2017 - Sep 24, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 11, 2020 - Mar 5, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:897A-E356-1701,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:2c:22:af:45:97:75:f9:1b:ee:00:00:00:00:01:2c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 19, 2019 - Mar 17, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

10

Entry point

32768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Work\WindowsDriverModel\amifldrv\sys\x64\Release\amifldrv64.pdb

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

508B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

7/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

7/READ.txt

SHA256 0ce09b03a154a204d22e1e43bafd10f70d629c40384bdddaa1b2823f1ad96700
MD5 aa25337592c3803ad18413b5d4d703dd
SHA1 4bc511ee499f93e058f72f26a237323d25699863
SHA512 62e0d83d9b11970aac851d0ed21f1f27f3981cf99f173cad067e67c9e1a3f0f5072243669d5402a5f85ce6ff1fc16610a5d01c8e10c85d474fcc296ae4704494
TLSH
T1ADA00272F30A64E9985B880018C7B6F4D41D974991A454CC9CE9024C27B543ED511D4D
MD5 SHA1 SHA512 TLSH

8/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

8/create a vhd disk.txt

SHA256 ef9baec1aaa2c07418be2be990af371f8a2dd4fdce22d8d1415c86b383d18a03
MD5 092835a079737c2fb9d97ecc2c978ffd
SHA1 c1595edc3de67dcd53106d9ad9d6d5bcfaff4938
SHA512 515c8ba2e08b051273a3de47f0ff451140de7b33cda7154d06f6119f45637cc37aafcece74cf7a29af850c6247a5932a63f1034682b7c67f5d608d659f72521c
TLSH
T1F4C02B5380038AF77D340051425F22B4E2C8324C003EB4492906141841ACD4BE343D41
MD5 SHA1 SHA512 TLSH

9/FINAL.txt

SHA256 47a565d2bdb0b0b152ef8908fec7efdf08d904f9f19dc1dd4d15e4506ed53e63
MD5 b7b78064c8d9278bdf52532348960616
SHA1 1cd36824b29ef7809e1c77a6eca41bc9d5933f42
SHA512 35420dc5d9a35595ad515062f6a8965837c568b51c75758e709a3775083ee32ce7899b9947c8da032fbcaf232ceaace7953fc6f4a557289a76c1881c15698134
TLSH
T16AD0953F7413409D2C01551D2C1F90A1B034339416663328285B00CD8C3DFFD7BD249D
MD5 SHA1 SHA512 TLSH

9/Made by c0ze from 0x21 Discord Server.txt

SHA256 90b17cddff4d01abfc779a3e8119ba2f3f2a34ae32ba336d101fb4620ccccfd0
MD5 d51610a0ecc803427c069e21cac7f914
SHA1 1e77f2fae30353dcbe63241827e56bf6a0c3e6a5
SHA512 00e21e96284578323aad8135c4192665413c5d2d38c318f7a32e59561d8b22895f0e1778089814d2b67256e1d5309408b3ed31bc52df49ffee820be3fc5c9fcc
MD5 SHA1 SHA512

9/SerialsChecker.bat

SHA256 e17f3d6a6dd6ffce80664d11d73cad8aaebb7676ca40b17265947ef839cd5277
MD5 a4501b9bb5f4c87b73c5303b59c42878
SHA1 444e37debe37f9a309b2fde5aa895a6710ccd912
SHA512 3e4b65f4d0547da83ef557a6a3c4ba8192454253b7ff277d632da01a4523bd427214c1c928b14e21f629a68c37c6991b70d8e1e469638650d3b507e004ed9d23
TLSH
T135014C46764CDB589AD14B540B75500639282853988729C82C7E52658FA14CCBE8BA3B
MD5 SHA1 SHA512 TLSH

GRINX64v2/AMIDEWIN.EXE

IMPHASH e4bef79f59242df9daf28c2c8193c40e
SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
MD5 182ec3a59bd847fb1bc3e12a41d48fa6
SHA1 2f548bceb819d3843827c1e218af6708db447d4b
SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
TLSH
T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

43344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentDirectoryA SetFileAttributesA GetFileAttributesA GetSystemDirectoryA CopyFileA GetCurrentProcess GetTimeZoneInformation CreateProcessA WaitForSingleObject Sleep GetVersionExA DeviceIoControl GetLastError SetFilePointer WriteFile ReadFile CreateFileA SetProcessAffinityMask CloseHandle GetSystemTimeAsFileTime HeapFree HeapAlloc ExitProcess TerminateProcess DeleteFileA GetCommandLineA GetVersion SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleHandleA GetModuleFileNameA GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc FlushFileBuffers GetProcAddress GetFullPathNameA UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW RtlUnwind SetStdHandle MultiByteToWideChar GetStringTypeA GetStringTypeW GetDriveTypeA GetCPInfo GetACP GetOEMCP LoadLibraryA SetEndOfFile LCMapStringA LCMapStringW CompareStringA CompareStringW SetEnvironmentVariableA ReadConsoleInputA SetConsoleMode GetConsoleMode

user32

wsprintfA

advapi32

StartServiceA OpenServiceA DeleteService CreateServiceA OpenSCManagerA CloseServiceHandle ControlService

GRINX64v2/AMIDEWINx64.EXE

IMPHASH ed928bd060b03bab412d37a11b9d26a0
SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
MD5 6a6505b2413d2c7b16c6d059448db9e5
SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
TLSH
T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

245880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadConsoleInputA SetConsoleMode GetCommandLineA QueryPerformanceCounter GetCurrentProcessId GetFullPathNameA CloseHandle Sleep GetCurrentProcess GetSystemDirectoryA GetWindowsDirectoryA CreateFileA DeviceIoControl GetModuleFileNameA GetModuleHandleA GetCurrentDirectoryA DeleteFileA GetLastError CreateMutexA SetThreadExecutionState SetConsoleCtrlHandler ReadFile WriteFile CreateNamedPipeA CreateThread LocalFree EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetTimeZoneInformation ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte HeapFree RtlLookupFunctionEntry RtlUnwindEx HeapAlloc RtlPcToFileHeader RaiseException GetEnvironmentStringsW IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError GetCurrentThreadId DeleteCriticalSection FlushFileBuffers GetConsoleCP GetConsoleMode IsDebuggerPresent IsProcessorFeaturePresent GetStdHandle GetFileType GetStartupInfoW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetModuleFileNameW LoadLibraryExW GetProcessHeap ReadConsoleW SetFilePointerEx HeapReAlloc GetStringTypeW CompareStringW LCMapStringW SetStdHandle WriteConsoleW OutputDebugStringW CreateFileW SetEnvironmentVariableA SetEndOfFile GetVersionExA LoadLibraryA GetProcAddress HeapSize FreeLibrary FreeEnvironmentStringsW

shell32

ShellExecuteA

user32

DefWindowProcA DispatchMessageA TranslateMessage GetMessageA RegisterClassExA MessageBoxA BlockInput SystemParametersInfoA ExitWindowsEx CreateWindowExA wsprintfA

advapi32

ControlService RegOpenKeyExA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken CloseServiceHandle CreateServiceA DeleteService OpenSCManagerA OpenServiceA StartServiceA

GRINX64v2/DMI16.EXE

SHA256 28e6e1908f2996af9b7a9930f13d4c770d6963425df0869ce4bcdb1442a4a917
MD5 2a89d4e479351022ab8bd604030a76f3
SHA1 ad1d39fd38fafaae4d77eed5f1c67f665686736d
SHA512 0fb48aaeeedb5a96246ffd80c167f501ff2f5a08cf8d2dbf63373666c6f3394244395e05e49b68fedf02c2a3df75ad6ba4223f0066c350993233cf218da83e43
SSDEEP 384:d2a1f/coJEQ88t5hDQ8o3wk4YMoURAzMbdLWxrqw8CKn6l3myGWstap/+ZU0KXy+:dLf/NWQltVoV4YfDOWxXd3my/cY
TLSH
T140E23E867A3A02F5E3B76EF45E0A972D7FEC214CC5FD64740639649FDB4082B3A86411
MD5 SHA1 SHA512 SSDEEP TLSH

GRINX64v2/DMIEDIT.EXE

IMPHASH 9bbd972bee7030506f62236dff565e85
SHA256 5d37e5e7ce01549965bf2166adcba33d1e2c4bd2c90711032f3987b58452ce49
MD5 fbaf6262fd84f9966338518d4de46fdd
SHA1 291d481e3b42029e157e7c60febc8fe67cd50cf1
SHA512 5d8cc6e1ab85fae8d9a5ffa83cecc2608b1fbbb28b9e80afe2dc6f7d46b657d489e03f75e42fc147d49313b3a41ad768fd0f320a905cbc41d767c0fc3c3d9d7e
SSDEEP 49152:VOQ6nNB9ySqeDoVFixOA9DruNebQk9DtTKkuecMC+coEbyxvgg+lV:D6nwNomN1AKku1M2Jfj
TLSH
T1BBF57D5A67B840E4D4A6C278C4068A0BD3F3F8944B339B9F51D947AF1F736A24E2D721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2072680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

LoadCursorW LoadCursorA MapVirtualKeyA GetKeyNameTextA IsDialogMessageA SetWindowTextA CheckDlgButton SetDlgItemTextA MoveWindow GetMonitorInfoA MonitorFromWindow GetScrollInfo SetScrollInfo LoadIconA GetTopWindow GetClassLongPtrA GetClassLongA SetWindowLongPtrA GetWindowLongPtrA MapWindowPoints AdjustWindowRectEx GetWindowTextLengthA GetWindowTextA RemovePropA GetPropA SetPropA ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow SetForegroundWindow GetForegroundWindow TrackPopupMenu SetWindowPlacement GetWindowPlacement IsChild CreateWindowExA GetClassInfoExA RegisterClassA CallWindowProcA DefWindowProcA GetMessageTime GetMessagePos RegisterWindowMessageA UnhookWindowsHookEx DestroyCursor EndDialog CreateDialogIndirectParamA DestroyWindow CallNextHookEx SetWindowsHookExA ValidateRect DispatchMessageA TranslateMessage GetMessageA ClientToScreen EndPaint BeginPaint GetWindowDC ReuseDDElParam UnpackDDElParam WinHelpA LoadImageA LoadIconW GetWindow IntersectRect SetRectEmpty SetActiveWindow InsertMenuItemA DestroyMenu SetMenu GetMenu LoadMenuA TranslateAcceleratorA LoadAcceleratorsA GetCapture GetActiveWindow SetFocus GetDlgCtrlID LockWindowUpdate IsIconic IsWindowVisible GetNextDlgGroupItem DrawFocusRect GetIconInfo ShowWindow GetClassInfoA EnableWindow UpdateWindow ReleaseCapture IsWindow GetSysColor SetCursorPos SetTimer KillTimer DrawIcon SetWindowRgn IsRectEmpty GetSystemMenu SetParent IsZoomed RealChildWindowFromPoint LoadAcceleratorsW GetDCEx LoadMenuW CopyImage SendDlgItemMessageA ShowOwnedPopups WindowFromPoint ScreenToClient GetCursorPos SetWindowPos SetMenuItemInfoA UnionRect GetTabbedTextExtentW PostThreadMessageA CopyAcceleratorTableA GetNextDlgTabItem RedrawWindow ReleaseDC PeekMessageA InvalidateRect SetWindowLongA InflateRect GetDC PtInRect SendMessageA GetClientRect MessageBeep GetParent SetCapture PostQuitMessage GetWindowRect SetCursor IsMenu CopyRect ModifyMenuA DestroyIcon InsertMenuA UnregisterClassA GetSystemMetrics SystemParametersInfoA RemoveMenu GetMenuItemCount AppendMenuA LoadBitmapW GetSysColorBrush CreatePopupMenu GetMenuItemInfoA GetDesktopWindow TabbedTextOutA GetMenuState SetRect DrawTextExA DrawEdge GrayStringA CreateMenu DeleteMenu DrawIconEx GetSubMenu DrawTextA GetMenuItemID FillRect GetWindowLongA OffsetRect CharUpperA GetFocus GetKeyState EndDeferWindowPos BeginDeferWindowPos DeferWindowPos EqualRect GetDlgItem GetClassNameA OpenClipboard PostMessageA CloseClipboard IsWindowEnabled MessageBoxA GetWindowThreadProcessId GetLastActivePopup GetMenuStringA wsprintfA RegisterClassExA BlockInput ExitWindowsEx CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetAsyncKeyState EnableScrollBar HideCaret InvertRect NotifyWinEvent GetMenuDefaultItem WaitMessage IsClipboardFormatAvailable SetLayeredWindowAttributes EnumDisplayMonitors SetClipboardData EmptyClipboard DrawStateA LoadImageW DrawFrameControl UpdateLayeredWindow MonitorFromPoint TrackMouseEvent GetComboBoxInfo GetKeyboardLayout IsCharLowerA MapVirtualKeyExA RegisterClipboardFormatA GetKeyboardState ToAsciiEx CreateAcceleratorTableA DestroyAcceleratorTable SetClassLongPtrA GetDoubleClickTime CopyIcon SetMenuDefaultItem CharUpperBuffA FrameRect DrawMenuBar DefFrameProcA DefMDIChildProcA TranslateMDISysAccel GetUpdateRect SubtractRect MapDialogRect GetWindowRgn BringWindowToTop

kernel32

SetThreadExecutionState SetConsoleCtrlHandler DeviceIoControl CreateNamedPipeA CreateThread GetSystemTimeAsFileTime GetTimeZoneInformation ExitProcess AreFileApisANSI GetCommandLineA RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader GetSystemInfo VirtualAlloc VirtualQuery ExitThread IsDebuggerPresent IsProcessorFeaturePresent HeapQueryInformation SetStdHandle GetFileType IsValidCodePage GetConsoleCP GetConsoleMode GetStdHandle GetSystemDirectoryA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess SetConsoleMode SetFilePointerEx QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW ReadConsoleW LCMapStringW IsValidLocale EnumSystemLocalesW WriteConsoleW OutputDebugStringW CreateFileW SetEnvironmentVariableA ReadConsoleInputA GetStartupInfoW FindResourceExW FreeLibrary GetProcAddress LoadLibraryA GetVersionExA HeapReAlloc HeapAlloc HeapFree GetProcessHeap InitializeCriticalSectionEx RaiseException GetLastError HeapSize DecodePointer GetModuleHandleA DeleteCriticalSection lstrlenA FindResourceW LoadResource WideCharToMultiByte SizeofResource lstrcatA LockResource CreateMutexA WinExec lstrcpyA WaitForSingleObject CloseHandle GetCurrentDirectoryA FindResourceA GetCPInfo MultiByteToWideChar lstrcmpiA GetVersion FreeResource GlobalLock GlobalUnlock GetCurrentProcessId GetModuleFileNameA SetLastError GlobalAlloc GlobalSize GlobalFree LocalFree MulDiv FormatMessageA CopyFileA GetCurrentThread GetCurrentThreadId LoadLibraryExW GlobalDeleteAtom lstrcmpA CompareStringA GetModuleHandleW GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA OutputDebugStringA GetModuleFileNameW GetModuleHandleExW LoadLibraryW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW GlobalAddAtomA GlobalGetAtomNameA SetEvent CreateEventA SetThreadPriority SuspendThread ResumeThread EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetSystemDirectoryW lstrcmpW GlobalFindAtomA GetDiskFreeSpaceA GetFileAttributesA GetFileTime GetFullPathNameA SetFileTime GetTempFileNameA ReplaceFileA SystemTimeToFileTime GetUserDefaultLCID CreateFileA DeleteFileA FindClose FindFirstFileA FlushFileBuffers GetFileSize LockFile ReadFile SetEndOfFile SetFilePointer UnlockFile WriteFile DuplicateHandle GetCurrentProcess LoadLibraryExA GetShortPathNameA MoveFileA GetVolumeInformationA GetThreadLocale GetStringTypeExA SetErrorMode FileTimeToSystemTime InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalAlloc LocalReAlloc GlobalFlags CompareStringW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetACP GetOEMCP FileTimeToLocalFileTime GetFileAttributesExA GetFileSizeEx LocalFileTimeToFileTime GetWindowsDirectoryA VerSetConditionMask VerifyVersionInfoA GetTickCount GetProfileIntA GetTempPathA Sleep SearchPathA VirtualProtect

advapi32

RegOpenKeyExA RegQueryValueA RegCloseKey RegQueryValueExA StartServiceA OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken RegSetValueA RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegSetValueExA RegEnumKeyA SetFileSecurityA GetFileSecurityA RegOpenKeyExW RegEnumValueA RegEnumKeyExA

gdi32

CreatePen Escape PtVisible Ellipse Rectangle CreateCompatibleBitmap GetPixel SelectObject DeleteObject SetPixel GetDeviceCaps CreateDIBSection DeleteDC GetBkMode CreateHatchBrush PatBlt GetTextExtentPoint32W BitBlt GetCurrentObject CopyMetaFileA CreateDCA CreateBitmap CreatePatternBrush CreateRectRgn ExcludeClipRect GetClipBox GetCurrentPositionEx GetObjectType GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo RestoreDC SaveDC SelectClipRgn ExtTextOutA CreateSolidBrush TextOutA GetTextExtentPoint32A CreateFontA CreateFontIndirectA GetObjectA GetStockObject CreateCompatibleDC GetBoundsRect FillRgn SetPaletteEntries ExtFloodFill SetPixelV PtInRegion FrameRgn RoundRect CreateRoundRectRgn OffsetRgn GetRgnBox EnumFontFamiliesExA Polyline Polygon CreatePolygonRgn SetDIBColorTable StretchBlt GetTextCharsetInfo EnumFontFamiliesA CreateDIBitmap RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette GetTextFaceA GetWindowOrgEx GetTextExtentPointA GetTextColor GetTextAlign GetStretchBltMode GetPolyFillMode GetNearestColor GetROP2 GetBkColor SetRectRgn CombineRgn StretchDIBits GetCharWidthA GetTextMetricsA LPtoDP CreateEllipticRgn SetAbortProc AbortDoc EndPage StartPage EndDoc DPtoLP GetViewportOrgEx CreateRectRgnIndirect ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx MoveToEx StartDocA SetTextAlign SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette ExtSelectClipRgn RectVisible

msimg32

AlphaBlend TransparentBlt

comdlg32

GetSaveFileNameA

winspool.drv

OpenPrinterA GetJobA ClosePrinter DocumentPropertiesA

shell32

SHAppBarMessage DragQueryFileA DragFinish SHGetFileInfoA ExtractIconA SHGetPathFromIDListA SHGetSpecialFolderLocation SHBrowseForFolderA SHGetDesktopFolder ShellExecuteA

comctl32

ImageList_Draw ImageList_GetIcon ImageList_GetImageCount

shlwapi

PathIsUNCA PathStripToRootA PathRemoveFileSpecW StrFormatKBSizeA PathFindFileNameA PathFindExtensionA

uxtheme

GetThemeColor GetWindowTheme DrawThemeBackground IsThemeBackgroundPartiallyTransparent DrawThemeParentBackground DrawThemeText OpenThemeData CloseThemeData GetThemePartSize IsAppThemed GetThemeSysColor GetCurrentThemeName

ole32

OleGetClipboard CoLockObjectExternal OleLockRunning CreateStreamOnHGlobal CoInitializeEx IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoDisconnectObject CoInitialize CoCreateInstance CoCreateGuid CoUninitialize ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc StringFromCLSID DoDragDrop RegisterDragDrop RevokeDragDrop

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VariantChangeType VariantClear VariantInit SysAllocStringByteLen SysFreeString VariantCopy VarBstrFromDate LoadTypeLi SysAllocString SysAllocStringLen

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

gdiplus

GdiplusShutdown GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundA

GRINX64v2/UCOREDLL.DLL

IMPHASH 6b893ca0388ae7a60f134fafc899b16d
SHA256 78a4d8e5e8c33793e5a2020325d3a49e92e4826167742e93179bdacbf167b409
MD5 8370f3114924ed6c53741de7a253625a
SHA1 f7782d51e73526226a89229b4f3625c7ce43f3b3
SHA512 5a13c0fb787366869fac57139fa2ebbd0c34a1bfa76c05ac879da60e534cbac694385f2b6120fdb6c7cf0e62cf4948efbdfde96e695a9d377f44eedb2e1b1398
SSDEEP 1536:g+FKwswB29BLymvRwRvSpD0pQD61ShZT1Cw4cf0SbtsWFoYc0RkU:g8Vk9ymvyNMO4QqGeyqoLGL
TLSH
T123B39E217F91C4F2C099033C0E5B1B3A7FBE566CCE6959C3C7951E586E719B2AB3A201
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

45861

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryA Sleep DeviceIoControl GetVersionExA GetCurrentProcess SetProcessAffinityMask GetLastError SetFilePointer WriteFile ReadFile CreateFileA GetFileSize CloseHandle GetTimeZoneInformation GetSystemTime GetLocalTime GetSystemTimeAsFileTime HeapFree HeapAlloc GetCommandLineA GetVersion EnterCriticalSection LeaveCriticalSection GetProcAddress GetModuleHandleA WideCharToMultiByte GetModuleFileNameA GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc InitializeCriticalSection DeleteCriticalSection ExitProcess RtlUnwind TerminateProcess GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW InterlockedDecrement InterlockedIncrement MultiByteToWideChar GetStringTypeA GetStringTypeW GetCPInfo GetACP GetOEMCP LoadLibraryA FlushFileBuffers SetStdHandle LCMapStringA LCMapStringW CompareStringA CompareStringW SetEnvironmentVariableA

advapi32

StartServiceA OpenServiceA DeleteService CreateServiceA OpenSCManagerA CloseServiceHandle ControlService

GRINX64v2/UCORESYS.SYS

IMPHASH 072f277c4d89044b84c482307008a355
SHA256 fd6f56189cd723b32fc06392867fcd5128e63d8b5801e4f7a83523f820531981
MD5 9555d36fb21b993e5c4b98c2fc2b3671
SHA1 210a98be7da32cea98618c5a9640c23ce518c0ee
SHA512 3ec96ba6fca7a4aa45becfef84b23b12c305f34045ac1a15b22745289e33b9326103e853bad698434df772a76515e7e8109fa8724d65f0351ee380c16d888c60
SSDEEP 384:pp4uPb5yDmnoMXP1oy5KYJLWd6jH9inbjJE:pp4sEmTDLAmH94b6
TLSH
T194623CD20B603432EDB70FB14486C7B7DEB392820D96855721349A8E1FC6BB12798D9F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

58:5d:db:1d:04:c7:4b:32:3b:2e:01:b5:59:b7:19:db:74:e5:e6:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

Chains

May 16, 2008

CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

Serial Number

08:df:d8:0b:28:26:71:65:54:b1:fb:8c:fa:50:43:d7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2006 - Nov 16, 2009

Minor OS version

0

Major OS version

4

Entry point

6916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

GRINX64v2/UCOREVXD.VXD

SHA256 0c30287deb78a25a4037fc3201062ddf880b06ea436550d83f47fb7fcac7dcf4
MD5 211b3cda6ee0f7a8c86ffc2e5177020d
SHA1 580685b23248316878560c131b7bffbd1fa5a56c
SHA512 24abb3327282048a651102ecdb3a284c4f4761013d337ee3255f6c475c203650363899b6505b32dadd6c35f31908f2ad2987ab83c46b4d4911ebcf24cf5eccc8
SSDEEP 192:zkAaKkXgVM6kk6F67xWgTHpOxi55CqoWipJ:KXwhk8PHpOxi55CzrJ
TLSH
T186F18537DE5F443ACBC622F1AF0995756FFB48BF1E93849603802D505F4D215BEA18A4
MD5 SHA1 SHA512 SSDEEP TLSH

GRINX64v2/UCOREW64.SYS

IMPHASH 0dcd262801389f839ce909cb173448e2
SHA256 a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200
MD5 a17c58c0582ee560c72f60764ed63224
SHA1 bbc0b9fd67c8f4cefa3d76fcb29ff3cef996b825
SHA512 a820a3280da690980a9297fe1e62356eba1983356c579d1c7ea8d6f64bc710b11b0a659c5d6b011690863065541f5627c4e3bc13c02087493de7e63d60981063
SSDEEP 384:q1ykKJX1BIAQ0r1IiFlYJLWd6jH9inbjJ+T:uygG1IiCLAmH94bgT
TLSH
T1DB621AD687212075D96B4F31A4CAD273AFB3B2412DCD51CF1130C5AE2ED6BB1179C89A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c5:51:73:b9:26:23:5b:86:78:bd:db:9b:49:a1:a8:b9:a9:2a:1a:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

Chains

May 16, 2008

CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

Serial Number

08:df:d8:0b:28:26:71:65:54:b1:fb:8c:fa:50:43:d7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2006 - Nov 16, 2009

Minor OS version

0

Major OS version

4

Entry point

5432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

GRINX64v2/amifldrv64.sys

IMPHASH 363922cc73591e60f2af113182414230
SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
MD5 785045f8b25cd2e937ddc6b09debe01a
SHA1 029c678674f482ababe8bbfdb93152392457109d
SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
TLSH
T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 21, 2017

SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 24, 2014 - Aug 30, 2017

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

1

Major OS version

6

Entry point

24676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb

Hard Disk Serial Changer.exe

IMPHASH 6b71a51c953ff20af290e7286a7dad23
SHA256 2c141c06f7df57f11ef2c62f2a96093484a65df47065b1a475c53784af0e2664
MD5 c20e96d4e616ce333c19a1c15a1cc137
SHA1 f79645ec115130ee59958c55a556f564260b7a9e
SHA512 519fec9955c4a18e45ec68d9e7dc2bcda74721a6ea088e59e634e26b136bfa15f5efedf8839c036a3cfdcdb9780a2121dc2d71f1fdbbfd3df02d9969e5db753b
SSDEEP 12288:EN1TNRzUSWgDxPWnP0Lamg+hyMU1EUFT99qpDDcZDDR5Id1888888888888W888H:whNRASWgDxPWnP0LamWYC8EOd
TLSH
T188D47D12B3D14437D177563D9C7B92A8AC26BD212EE4984A2EF4FE4C1F787813939263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

485340

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegFlushKey RegCloseKey

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassLongW GetClassInfoW GetCapture GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen CheckMenuItem CharUpperBuffW CharToOemW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BeginPaint AdjustWindowRectEx ActivateKeyboardLayout

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualAlloc SwitchToThread SizeofResource SignalObjectAndWait SetThreadLocale SetLastError SetFilePointer SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReadFile MultiByteToWideChar MulDiv LockResource LoadResource LoadLibraryW LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVolumeInformationW GetVersionExA GetVersionExW GetVersion GetTickCount GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetExitCodeThread GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCPInfo FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW EnumCalendarInfoA EnterCriticalSection DeviceIoControl DeleteCriticalSection CreateThread CreateFileW CreateEventW CompareStringW CloseHandle Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchBlt SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SelectClipRgn SaveDC RestoreDC Rectangle RectVisible RealizePalette Polyline PlayEnhMetaFile PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits FrameRgn ExtTextOutW ExcludeClipRect DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW BitBlt

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ole32

OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create

shell32

ShellExecuteW

Name

.text

Size

467KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

60B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Made by c0ze from 0x21 Discord Server.txt

SHA256 c60b810da0d6becc819a2e30d39f82104e6464381110d7210022902bb48db678
MD5 5d1a97fa247ca5d777216c28798404ea
SHA1 2c28d09f89892bc98c9eb6826b37842126bcb088
SHA512 741bec1f7a302a7858fa19865f8ba1d4b8e37b001751791af9c01404889d6f910459d791b895c3943f433fbbfe8d50cd9b416b9e0274815e1f3a5008aca1a3f4
TLSH
T1E290028715D2E06942100449D89A4119A605558650AAB4575691505F14D5A4FA508B76
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

c0zes Hard HWID unban.zip

1/Made by c0ze from 0x21 Discord Server.txt

2/2.exe

msvbvm60

generic

2/Made by c0ze from 0x21 Discord Server.txt

3/3.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

ole32

comctl32

shell32

generic

3/Made by c0ze from 0x21 Discord Server.txt

4/1.bat

4/4.bat

4/Cleaner1.bat

4/Cleaner2.bat

4/Cleaner3.bat

4/Cleaner4.bat

4/FortniteCleaner.bat

4/Ghost_cleaner1.bat

4/Ghost_cleaner2.bat

4/Ghost_cleaner3.bat

4/Ghost_cleaner4.bat

4/Ghost_cleaner5.bat

4/Ghosts_FortniteCleaner.bat

4/Ghosts_Toruney_Cleaner.exe

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

generic

4/Made by c0ze from 0x21 Discord Server.txt

4/Registry.bat

4/cleaner.exe

vcruntime140d

ucrtbased

kernel32

generic

4/good one.bat

4/regedit_change.bat

4/traces.bat

5/LicenseAgreement.txt

5/Made by c0ze from 0x21 Discord Server.txt

5/READ.txt

5/Revo Uninstaller Help.pdf

Extracted URLs

5/RevoUPort.exe

PE Signature issue

PE Signature issue

shlwapi

kernel32

generic

5/ctrlbars.dat

5/lang/Estonian.ini

5/lang/albanian.ini

5/lang/arabic.ini

5/lang/armenian.ini

5/lang/azerbaijani.ini

5/lang/bengali.ini

5/lang/bulgarian.ini

5/lang/czech.ini

5/lang/danish.ini