52006a9280b53449375fd8d7211a2a8def7e287f93028bb469660ce877bd4a2e

resource
unpack001/gnwinfo.exe
unpack001/gnwinfox86.exe
unpack001/libcdi.dll
unpack001/libcdix86.dll
unpack001/nwinfo.exe
unpack001/nwinfox86.exe

SHA256 52006a9280b53449375fd8d7211a2a8def7e287f93028bb469660ce877bd4a2e
MD5 4bb427d5335d9411dcbc90c80f08b6b5
SHA1 f1d2f96bbdc559daa909a8b35415e23a1988ed08
SHA512 a863898c5b40dfecf5fb37b2539fbdde2d0480e76db5809122621541c915b47513607c50d36519ef7c7369b64b286862838f6de2970cae6d91974b631fca2f46
SSDEEP 98304:oYF7rPPm/KX6r6tMF/TP+3WQw1ljk71kDxg8IRsU4vR2r4u02n6XjrJKbT4A/L4V:r16/d6tMFLWDwfk71Kg8eaR2UMngdaVM
TLSH
T18F5633441D596F504730FD25DE2C236D4F336AD6A3A4EC03786CA48766FCAE8A306E9D
MD5 SHA1 SHA512 SSDEEP TLSH

AMDFamily0F.bin

SHA256 a6e11619e87a97820705a6523714f22d676ce44f902631833d4429b89d509d55
MD5 d57c6d33a424f55ffde6cf1d6e76e5c0
SHA1 139712c9188f7f9b3e88c4396b3317c78e66f9ea
SHA512 265370bf8fb7082416b82ab3483c488580b830fceab3d7fa9d3213f34a5d4d5d78f630ec7cd80e263f4cbe46dc45c798202c9f134330edeb04b2204ccb7a5356
SSDEEP 96:ZIZ0dVz7J8cmgz3tlhbf5DD79ny9BoiTfN2BwRJK:ZIm
TLSH
T1AF029246B8C1CAB6C8994B730DCAD640B7B8BD178C6D6B0B3488B75E5DBF19D7841708
MD5 SHA1 SHA512 SSDEEP TLSH

AMDFamily10.bin

SHA256 6443080b2968474ffbc38aa4356cc56f9664349fa4b917afdb33027d6bb50525
MD5 ccee1f5a25441425b1223eb8b65e6938
SHA1 1c572d2d2c8b6095b781d81c450bfbacb842b3bb
SHA512 75c9366b544fcc3cec9080171c5cd35899d13ccd715d388952500db0366bcb0a8bdfaf580dde058eec81a725c765e21e459e0388f16c83ba26b745591353597f
SSDEEP 96:HbPPj5c0dVz7J8zP93IPxSgbD/N6hyw8t1m9/NX/rvjXM+fb5U5rn6zG8yX+QcHt:7P61sx
TLSH
T121725F46B8C1CAB6C8494F770D89E600A7B8BD178C6D6B0B308DB71E5EBF19C7851718
MD5 SHA1 SHA512 SSDEEP TLSH

AMDFamily17.bin

SHA256 dae74615761b78bdf064dfb3e136252ddcc6fc727d88f14738d0e5800d427a91
MD5 720ae7e9b3bdc3ca2826522a819929cf
SHA1 81031241e039064ebefa756a23a2f96c37777ed8
SHA512 13f4d95309fb864f801df94ed33f4d3b57b1452a4c9a08e16d2a05722f24440dccb31a915215b5ca2c97f9cb7d18c4a28bf9d7887ef3648be672dc5e8199d592
SSDEEP 96:W5qC1d30dVz7J8jPshTe5tOCGp6i7mIz3tFUz4qPl/nTHBDUsx0:uZdM6aYz
TLSH
T16E22C446B9C1CA76C8494B730D8AD640B7B8FD178D2DAB073489B31F5EBF99CA442718
MD5 SHA1 SHA512 SSDEEP TLSH

IntelMCHBAR.bin

SHA256 3f82b832d99b4aac37d2a20fdb7c9baa2a3bc0488612c9019c9484eb0e8a6eae
MD5 32d687c0481845829003f730932acc28
SHA1 4295338b9f1407b6321be822a60ae3c779671655
SHA512 57870d080b577546564a5f78744ea37d444f8042ab3eada76bfb1b7fc6f1de9730de0dc6e4ebbdc2e75dfc353e107f5605cbe8fcdbf0355d4f9a5ecc48eae680
SSDEEP 96:GIn5iD3XYpB0dVz7J8NEds0rPH/h/9nMfhH1SMhLPEz3YWhLPAz3jagHNWB5Yp:ZiMEds7sHoH
TLSH
T102529C56B8C18A76C8894B370D8BD250ABB8FD174C6D6B07308DBB5E4EBF58C7842718
MD5 SHA1 SHA512 SSDEEP TLSH

IntelMSR.bin

SHA256 d6ed85d65ab17a22f813ef98207d6d537155ee2ded5976a21cb48413c9b92e5f
MD5 3ad3b6e49d81238ac2078390903245d1
SHA1 7b102e45caec631d0bd9f85d9bccbc3dfd13f5b8
SHA512 c60a0095393ad567c8c778631b0063f60b9af9aff31d135d51e116828d4306a4e3231e222d2dba1cd20c3131b4de326fb0045f37978027b88ffd7ac446a827b8
SSDEEP 48:Wc9hPmAsLYKKAsErKfE4eujqJI0dVUHXxWBrxGCjz3tGgAmGCT4zR:WcakIrKfE79I0dVkXxmjz3tFTq
TLSH
T160B10557B8C18A76C8494B374D8BE1406BB8FE068D6DAB073088FB9E9E7B1DD7542304
MD5 SHA1 SHA512 SSDEEP TLSH

IntelPCHThermal.bin

SHA256 478500ae78aebef3ae7a0b5fe4848d2d5737e8f7c5d51200c284a61c21d7865d
MD5 2680843570559ccc5dd6922bf6d04f9b
SHA1 b1618d3e1bed3851c61907371b2eed5883f58460
SHA512 60396e94d6ad15b535dd202de2f29fc4a732f04b26a6509d1e0ff71965046ad77505fb72fc3eb0967b0b12a3c7852890117eda783e09ceaa4f37d9ee2fecee1a
SSDEEP 96:OmiLxD8zbznYCZ0dV84tdTwjQa/v+C7BICOmGP93rrYp1YP93TcDK+9X9f9H63nS:OmiWbGc
TLSH
T15152BF46B9C1CAB6C8494B770D8AD640B3B8FE1B4C6DAB073488B71E5EBF19C7851748
MD5 SHA1 SHA512 SSDEEP TLSH

LICENSE

SHA256 436a6d536138f203ac333858cff92a568be62797752b3adb94bcaa0f6ffe7ef6
MD5 d512eeaf0d5285acc53d4569054cbb08
SHA1 e94b688646f4129635b82668543ef594c079e972
SHA512 7d2c41db2fc891a5327798a1eb048093e25356ada8b7074308df69d85a51d2fb057b2998e38aba6277e983de486790f60d3b8b7cab70030ab2b779e19c7fcf46
TLSH
T104218457B28107202D8523A3684174CDF34BD49E7C3B26843466A248031F8ACE2FFA2C
MD5 SHA1 SHA512 TLSH

LpcIO.bin

SHA256 b3896a1cab0d808fca31fe2ebcae045d59dac690da87b17c858bb8da357eb45e
MD5 05f0aec05425b1f40e7eda14a07a3385
SHA1 6aa0ad583d6ca5c435c51a979c3f1b3e88c2c2df
SHA512 63f10ed10512a98eded63c0a3ab41445cf893f4604d3a9f595d79894c65f0d1b76caabd41dd0ac9acdfee527d79082241817bc389625ed65ad109bd8a8b6cb3c
SSDEEP 96:dO7TAJh2hNhZSRP3Py9e5zA7uN93900Wam+w0vdHsvvvvk:dkTAYaan
TLSH
T1EA82A396B9C14A79C8590A770DDE9260B7B8BE078C2E6F07304DB31E6E7F29D7901744
MD5 SHA1 SHA512 SSDEEP TLSH

PawnIOSetup.exe

IMPHASH 2dc7f4df09d86c9712fe5fb25a98b9c0
SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
MD5 956e73fc2a40945bc66af3a3ff963371
SHA1 096660b9e3aeff0547dfc621c03953852afd4629
SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
TLSH
T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

53:30:8f:04:43:5b:2d:9d:d5:b0:0c:37:89:dd:2c:61:59:09:23:88:2d:26:52:25:9b:dc:32:2d:77:2e:6c:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

Chains

Mar 15, 2026

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

CN=GLOBALTRUST 2015,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Subject

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

Serial Number

4f:3d:79:e2:3f:36:fc:99:9c:b6:22

Issuer

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2024 - Aug 5, 2027

Subject

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Serial Number

01:f9:c5:34:2a:d3:cb:20:65:93:e4:ce:56

Issuer

CN=GLOBALTRUST 2015,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 25, 2016 - Jun 10, 2040

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

2

Major OS version

5

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

LdrAccessResource LdrFindResource_U LdrGetDllHandle LdrGetProcedureAddress LdrLoadDll NtClose NtCreateFile NtCreateKey NtDeleteKey NtOpenFile NtOpenKey NtQueryDirectoryFile NtQueryInformationFile NtQueryValueKey NtReadFile NtSetInformationFile NtSetValueKey NtTerminateProcess NtWriteFile RtlAllocateHeap RtlAppendUnicodeStringToString RtlExpandEnvironmentStrings_U RtlFreeHeap RtlNtStatusToDosError RtlRandomEx __chkstk _snprintf _snwprintf _vsnwprintf _wcsicmp iswspace memcpy memmove memset sscanf wcscmp wcscpy wcslen wcsncpy wcsstr

comctl32

ord413 InitCommonControlsEx ord410

setupapi

SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

BeginPaint CreateWindowExW DefWindowProcW DialogBoxParamW DispatchMessageW EndDialog EndPaint GetDC GetDlgItem GetMessageW GetWindowLongPtrW GetWindowRect InvalidateRect LoadCursorW LoadIconW MessageBoxW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageW SetWindowLongPtrW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UpdateWindow

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateDIBitmap DeleteDC DeleteObject GdiAlphaBlend GetBitmapBits GetObjectW SelectObject

README.pdf

SHA256 7d7c2143c84c57fa2976ce9e5b1319c32fac78d57372a712a00a4c7c7e17ec3f
MD5 2e45abd50ff49c0923254132baf83eb4
SHA1 6d5b6defef2a2e071039256f0a0aa9c69df864b0
SHA512 5dfebc9e0cc7993695e8a3b52a0698e1a5998d4696018e7b045680d02e395100ee5c14fe078077a5f7159ea2a8f18f548be9a767d65aa6acb097bb7074f8eb7f
SSDEEP 6144:XKvVC/kSepjzu6g15fSHkKTla0jZ6LHHi2ODd8go:XAC8Hji6gPqCHH9Hz
TLSH
T15E847675F4CD8C8CE9C6EB1AC5B9385B4E5DB84B66CD7880006D8A19F502ED6B783387
MD5 SHA1 SHA512 SSDEEP TLSH

Extracted URLs

file https://crystalmark.info/en/software/crystaldiskinfo/
file https://deepwiki.com/a1ive/nwinfo
file https://github.com/Immediate-Mode-UI/Nuklear
file https://github.com/a1ive/libcdi
file https://github.com/a1ive/nwinfo/actions/workflows/msbuild.yml
file https://github.com/a1ive/nwinfo/releases
file https://github.com/hiyohiyo/CrystalDiskInfo
file https://github.com/nothings/stb
file https://github.com/skeeto/optparse
file https://github.com/snwh/paper-icon-theme
file https://github.com/vcrhonek/hwdata
file https://libcpuid.sourceforge.net/
file https://nightly.link/a1ive/nwinfo/workflows/msbuild/master/NWinfo%20Library.zip
file https://nightly.link/a1ive/nwinfo/workflows/msbuild/master/NWinfo.zip
file https://pawnio.eu/
file https://unlicense.org/
Show all

RyzenSMU.bin

SHA256 54da61c2653ed0afabc20d1349636023cb90e7582c4ee4ab93fa77d673e33f26
MD5 b9a945f8db38b2edc9e7a4cf4cbe8ceb
SHA1 0ad673573b55f8ecc2e470f787ba244e90d4a27d
SHA512 26f5e6a2d9cd94a7d9e9f3a5cd19d0824d2005154fa2116ff37bbc2490a37c6733f2706dae0932ffc87c46d4b40db7c171157c4d742f60380660bbf7f09db3ad
SSDEEP 96:y2EDEeNqxgTVWYQj0dVz7J8k5kXMIVlCD9n9x9h9v9X9wIn/EjwOS9jwxn/Kjwh5:hEYegxgT1kbJqxnYOF923b
TLSH
T1DC03CA56B8C1CA76C8590B330D8AD550B3B8BE178C6D6B0B308CB35E5EBF18D7991798
MD5 SHA1 SHA512 SSDEEP TLSH

SmbusI801.bin

SHA256 2e971a15e1ac6e68f4ada8d087ffd3c10f87984b18c777bafe7fa3bd5787ab15
MD5 a50cc51066aff18f88011ca29a51273a
SHA1 2370148bb44a473057e26adf82803299f1b8e593
SHA512 89a6772bcbe4d0c76fbfe14ab1152d124fcf2f65b0c168b87391d0d24b4cac5aa735e2d19ecfe452956400e410e56372a73d16165516de04ae0add94667832bd
SSDEEP 96:CCO/zTYNP8C4FPALPxP93s9fhbwXHP939/9PuYYKYACjyBYfcYTPpnBCmB9YYM1j:Cp/AejzLra
TLSH
T143435B85B9C1CAB6C8994E370D89E500B778FE178C2DBB0B3088B31E6EBF19D6911755
MD5 SHA1 SHA512 SSDEEP TLSH

SmbusPIIX4.bin

SHA256 91f9b4b1c39e3d399ce48477a89d8f6bd3e58a2241064a4daec3a1513dff56e5
MD5 6c85b820ef73dcda9ff67eb5c9b9a281
SHA1 23d8ce70ab3e4c9bba36930ad2970ad27123da94
SHA512 b001b28d363f95627b33d19b43a8121302deb5ed9d600bc7daf528705f00b966124e6e6420429b198b37e0ca99114f1c7564932a7654ef186eec56d7b8b4f8ce
SSDEEP 96:PqCZrOquokYmc8C4FPALPxP93s9fhbwXHP93El7/+VZn/FrgB2XmWjLff9xW3AmW:h3KFlRlK
TLSH
T131138B85B9C1CABAC8594B370CCAD510B7B8FD178C2DAB0B3488B35E5EBF19C6911758
MD5 SHA1 SHA512 SSDEEP TLSH

ZhaoxinMSR.bin

SHA256 4b56103ca456517ec1a553731f425905e1df9b825db232a19dafcfd98c944b61
MD5 ea7015c6b07efab0163b0b0b00b77269
SHA1 0f041eab4c869269ca1a6ff0b379ccb4c992e120
SHA512 4d3d442779d48a37a7944d834ed85ee4dd5fb5d5bbc372341226ab8add4840a643b27c8f3f6c340260ba2e907a595d76072510c23bb64b9305eb9162a7985c33
SSDEEP 48:3IfXqscgDSXXU0p7DSJ0dVz7J8AWBrxGCQz3tYJG5kV5S:4mgET7Dk0dVz7J8AmQz3t8WkV5
TLSH
T1AFA10785FCC5CA76C4994F730D8AD244A3B8BE578C6D6B0B3098B35E5EBB28D6442748
MD5 SHA1 SHA512 SSDEEP TLSH

gnwinfo.exe

IMPHASH 1490b4b90c3b54100c7ecc746e4a4b88
SHA256 0a4a3755a4b6f8eec5f7b90bcc7b45cedca1d83e964e009766451f7acb8c1225
MD5 f975f4cde9ee991a5b2571458d030fb8
SHA1 a26eefe83996cf146a626db2e6a386b5bf63512d
SHA512 2160eeb293696cd43d71d3b6949bc5a59e26d5729c1bcb3a113a91306f4ddd2ef4f167332a434f9811a270d8c4a579fb85f34492931cff50eebb3da9ffd57962
SSDEEP 12288:Ani/w6JKRswbeh4HT7R/sE09bnT+RoAiDIKTSFtWf:l/w6ARswimUEIbnT+RoBcCSfW
TLSH
T16D458D46B36445F4C4AB81B5CA438067E6717C082F208AEBEED0B76C1F72AE61F7D615
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

621392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\nwinfo\nwinfo\x64\Release\gnwinfo.pdb

kernel32

SizeofResource LockResource LoadResource FindResourceW GetUserDefaultUILanguage GetPrivateProfileStringW AttachConsole SetProcessWorkingSetSize GetLogicalDrives GetDiskFreeSpaceExW WritePrivateProfileStringW GetLocalTime QueryPerformanceFrequency CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess CreateWaitableTimerW WaitForMultipleObjects Sleep SetWaitableTimer CreateEventW CreateMutexW VerifyVersionInfoW UnhandledExceptionFilter GlobalSize RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleExW ExitProcess InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCurrentThread QueryDosDeviceW GetSystemPowerStatus GetSystemTimes GetProcessHeap GetComputerNameW GetWindowsDirectoryW GetComputerNameExW FindNextVolumeW FindVolumeClose DeviceIoControl FindFirstVolumeW GetVolumeInformationW FileTimeToSystemTime GetNativeSystemInfo GetFileSize CreateFileA GlobalUnlock VerSetConditionMask GlobalLock GlobalAlloc WideCharToMultiByte MultiByteToWideChar IsDebuggerPresent WaitForSingleObject ReleaseMutex SetEvent LeaveCriticalSection EnterCriticalSection HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException GetVolumePathNamesForVolumeNameW CreateFileW GetDllDirectoryW MulDiv SetThreadAffinityMask LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary UnmapViewOfFile VirtualFreeEx MapViewOfFile OpenFileMappingW CreateFileMappingW WriteProcessMemory VirtualAllocEx VirtualQuery VirtualProtect GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GlobalMemoryStatusEx IsProcessorFeaturePresent CreateProcessW GetExitCodeThread GetCurrentThreadId OpenMutexW CreateRemoteThread

user32

EnumDisplayDevicesW EnumDisplaySettingsExW GetMessageW GetWindowRect ReleaseDC GetDC GetSystemMetrics SetTimer DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW PostMessageW CreatePopupMenu CreateIconIndirect DestroyMenu TrackPopupMenuEx AppendMenuW DrawTextW GetCursorPos SetWindowPos UnregisterClassW ShowWindow IsWindow PeekMessageW GetWindowThreadProcessId TranslateMessage EnumDisplaySettingsW MonitorFromWindow GetMonitorInfoW EndPaint BeginPaint ReleaseCapture IsClipboardFormatAvailable SetClipboardData SetCapture GetClipboardData CloseClipboard OpenClipboard MessageBoxW GetKeyState KillTimer MessageBoxA DestroyIcon SetForegroundWindow GetDesktopWindow LoadCursorW LoadIconW SetLayeredWindowAttributes TrackMouseEvent DispatchMessageW

gdi32

SelectObject CreateDIBSection CreateCompatibleDC PatBlt CreateFontW DeleteDC SetBkMode DeleteObject CreateBitmap GetDeviceCaps SetTextColor

comdlg32

GetSaveFileNameW

advapi32

OpenServiceW CreateServiceW RegSetValueExW RegQueryValueExW RegOpenKeyExW CloseServiceHandle OpenSCManagerW CheckTokenMembership FreeSid OpenProcessToken AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW RegEnumKeyExW RegQueryInfoKeyW DeleteService StartServiceW ControlService RegGetValueW

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteW Shell_NotifyIconW

ole32

PropVariantClear CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

shlwapi

ord12

ws2_32

WSASetLastError

psapi

GetPerformanceInfo EnumPageFilesW

setupapi

CM_Get_DevNode_Registry_Property_ExW SetupDiGetDeviceRegistryPropertyW CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_Sibling CM_Open_DevNode_Key CM_Locate_DevNodeW SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList

iphlpapi

GetIfEntry GetAdaptersAddresses

gdiplus

GdipDrawRectangleI GdipDeleteFontFamily GdipGetImageHeight GdipDrawPieI GdipCreateFontFamilyFromName GdiplusShutdown GdipSetPenColor GdipDrawPolygonI GdipDeleteBrush GdipDrawEllipseI GdipDrawImageRectI GdipDisposeImage GdiplusStartup GdipCreateFromHDC GdipSetSmoothingMode GdipCreateFont GdipCreateSolidFill GdipFillPieI GdipGraphicsClear GdipSetPenWidth GdipCreateFromHWND GdipDrawBezierI GdipSetSolidFillColor GdipSetClipRectI GdipDrawArcI GdipFillPolygonI GdipLoadImageFromStream GdipSetStringFormatFlags GdipDrawLineI GdipCreatePen1 GdipDrawImageI GdipDeletePen GdipGetImageWidth GdipGetFontSize GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipFillRectangleI GdipGetImageGraphicsContext GdipMeasureString GdipStringFormatGetGenericTypographic GdipSetTextRenderingHint GdipCreateBitmapFromGraphics GdipFillEllipseI GdipDrawString

msvcrt

_initterm _errno strcmp fopen _iob __pctype_func tolower ___mb_cur_max_func wcstol _lock _unlock freopen towupper __wgetmainargs _msize _XcptFilter __set_app_type _wcmdln _fmode ___lc_handle_func ?_set_new_mode@@YAHH@Z _commode ?terminate@@YAXXZ _isatty _fileno mbtowc ___lc_codepage_func _strtoui64 ceil log10 _clearfp wcstoul _wcsnicmp iswctype fread _stricmp _wfopen qsort isprint isxdigit isspace _strdup realloc fputs fflush _strnicmp _time64 rand srand setvbuf _wcsicmp abort strtol strtoul strrchr __CxxFrameHandler fclose strcspn fgets strncmp strncpy wcscmp strtod calloc wcslen strlen malloc free _amsg_exit strstr wcsstr strchr memset memmove __C_specific_handler wcsrchr isdigit memcpy

gnwinfo.ini

SHA256 fa7dc6954d1707e1ca1b6fdae2ba0d0d5ac361dd97f667a8664be9aa5bff9456
MD5 5dfc3a5e5843b7253840b7b50a978dac
SHA1 fe2cbbf20da981f75cee3a790c48ed963d172411
SHA512 59deb2718fce5432e6b97803b58c6d684c328b52a9015c606b8eb278e9fa300d13a906c86c51c5ea7b35a2b6f3d3dafbfe77caf1ba87c8a4020ace9267ba641d
TLSH
T164D0C92701F84098A4F35659C0D765B62731B90A1A1EC89C54C9031E44E1A008427FEB
MD5 SHA1 SHA512 TLSH

gnwinfox86.exe

IMPHASH 4bf5fef689c8a684adf1bf99fc40b7d0
SHA256 e6fea9d2ffeaeb7b0593fe065f6b37fe68ba2cab66b95ed1eb7f26c3f75acce6
MD5 2e83dc6fa773fcf2b9691cbffbe73fd3
SHA1 e03bfbef852f17ecc8620212cede4166189fae7c
SHA512 0b82b5db505adb732a030f769751b1f0580feed4e382749e9fb3172dc2bd2403a965cf2090e7d64dd99cc6fb365a04ccf3fdacc34c310eae77a76c795b9fd2f5
SSDEEP 24576:BmaPUM+CU2z7HfCoFSBgYNS/KtT48WRIoFEz:oaG2z7HfCWKk/KF4REz
TLSH
T13735BF90B621C5BAD89101716DE7A3EB69287E7C1F5252DFF3C076AC11B00E217B9B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

537680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\nwinfo\nwinfo\Win32\Release\gnwinfo.pdb

kernel32

AttachConsole GetLogicalDrives GetDiskFreeSpaceExW WritePrivateProfileStringW GetLocalTime QueryPerformanceFrequency GetExitCodeThread GetCurrentThreadId CreateRemoteThread CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess CreateWaitableTimerW WaitForMultipleObjects Sleep SetWaitableTimer CreateEventW GetUserDefaultUILanguage IsDebuggerPresent GetModuleHandleExW ExitProcess RtlUnwind InitializeSListHead SizeofResource SetUnhandledExceptionFilter GetCurrentThread OpenMutexW QueryDosDeviceW GetSystemPowerStatus GetSystemTimes GetProcessHeap GetComputerNameW FindNextVolumeW FindVolumeClose DeviceIoControl FindFirstVolumeW GetVolumeInformationW FileTimeToSystemTime GetFileSize CreateFileA GetPrivateProfileStringW FindResourceW LoadResource UnhandledExceptionFilter LockResource GlobalUnlock WideCharToMultiByte MultiByteToWideChar VerifyVersionInfoW VerSetConditionMask GlobalLock GlobalAlloc GlobalSize GetStartupInfoW CreateMutexW WaitForSingleObject ReleaseMutex SetEvent LeaveCriticalSection EnterCriticalSection HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException GetVolumePathNamesForVolumeNameW CreateFileW GetCurrentDirectoryW MulDiv SetThreadAffinityMask LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary SetProcessWorkingSetSize UnmapViewOfFile VirtualFreeEx MapViewOfFile OpenFileMappingW CreateFileMappingW WriteProcessMemory VirtualAllocEx VirtualQuery GetNativeSystemInfo GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GlobalMemoryStatusEx IsProcessorFeaturePresent GetComputerNameExW CreateProcessW ExpandEnvironmentStringsW

user32

EnumDisplayDevicesW EnumDisplaySettingsExW GetMessageW GetWindowRect ReleaseDC GetDC GetSystemMetrics SetTimer DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW CreatePopupMenu CreateIconIndirect DestroyMenu TrackPopupMenuEx AppendMenuW DrawTextW GetCursorPos SetWindowPos UnregisterClassW ShowWindow IsWindow PeekMessageW TrackMouseEvent SetLayeredWindowAttributes LoadIconW LoadCursorW GetDesktopWindow SetForegroundWindow TranslateMessage DispatchMessageW GetWindowThreadProcessId EnumDisplaySettingsW MonitorFromWindow GetMonitorInfoW EndPaint BeginPaint ReleaseCapture IsClipboardFormatAvailable SetClipboardData SetCapture GetClipboardData CloseClipboard OpenClipboard MessageBoxW GetKeyState KillTimer MessageBoxA DestroyIcon PostMessageW

gdi32

SelectObject CreateDIBSection CreateCompatibleDC CreateFontW DeleteDC SetTextColor SetBkMode DeleteObject CreateBitmap GetDeviceCaps PatBlt

comdlg32

GetSaveFileNameW

advapi32

RegEnumKeyExW CloseServiceHandle RegSetValueExW RegQueryValueExW RegOpenKeyExW OpenSCManagerW DeleteService CheckTokenMembership FreeSid OpenProcessToken AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW ControlService RegQueryInfoKeyW OpenServiceW StartServiceW CreateServiceW

shell32

CommandLineToArgvW ShellExecuteW Shell_NotifyIconW

ole32

CoInitializeEx PropVariantClear CoCreateInstance CoTaskMemFree CoUninitialize

shlwapi

ord12 SHQueryValueExW

ws2_32

WSASetLastError

psapi

GetPerformanceInfo EnumPageFilesW

setupapi

CM_Locate_DevNodeW CM_Open_DevNode_Key CM_Get_Sibling CM_Get_DevNode_Registry_PropertyW CM_Get_Child CM_Get_DevNode_Registry_Property_ExW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW

iphlpapi

GetIfEntry GetAdaptersAddresses

gdiplus

GdipSetPenColor GdipCreateFontFamilyFromName GdipDrawPieI GdipGraphicsClear GdipFillPolygonI GdipGetImageHeight GdipDeleteFontFamily GdipDeleteBrush GdipDrawEllipseI GdipFillPieI GdipSetPenWidth GdipCreateFromHWND GdipDrawBezierI GdipSetSolidFillColor GdipSetClipRectI GdipDrawArcI GdipDrawImageRectI GdipDisposeImage GdiplusStartup GdipStringFormatGetGenericTypographic GdipSetSmoothingMode GdipCreateFont GdipCreateSolidFill GdipDrawPolygonI GdipDrawString GdiplusShutdown GdipCreateFromHDC GdipFillEllipseI GdipSetTextRenderingHint GdipCreateBitmapFromGraphics GdipLoadImageFromStream GdipSetStringFormatFlags GdipDrawLineI GdipCreatePen1 GdipDrawImageI GdipDeletePen GdipGetImageWidth GdipGetFontSize GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipFillRectangleI GdipGetImageGraphicsContext GdipMeasureString GdipDrawRectangleI

msvcrt

_wcsnicmp wcstoul towupper isdigit _initterm __p__commode _errno fopen _iob __pctype_func tolower ___mb_cur_max_func fread _lock _unlock freopen _XcptFilter __wgetmainargs _msize __set_app_type _wcmdln _fmode ___lc_handle_func ?_set_new_mode@@YAHH@Z ?terminate@@YAXXZ _control87 _isatty _fileno mbtowc ___lc_codepage_func _strtoui64 _CIlog10 ceil _clearfp _stricmp _wfopen qsort isprint isxdigit isspace _strdup realloc fputs fflush _strnicmp _time64 rand srand setvbuf _wcsicmp abort strtol strtoul strrchr fclose __CxxFrameHandler strcspn fgets strncmp strncpy strtod calloc malloc free _amsg_exit strstr wcsstr strchr memset memmove memcpy _except_handler3 wcsrchr iswctype wcstol

hw_report.ps1

SHA256 eb801cd844edda6dc143c4f1f55ad41fe846310fa6dac989b04e8e6d19f717c8
MD5 791779e2948ec93987da0baebcb4d6c9
SHA1 0f9304fb32c9f5e95ec1fe1cf13c5401227a4ede
SHA512 e98f37a53cd5d738229864d7b0cf86f842646b5f6c3a33fd27b4d5728786f5c7578b1d25cd869774afcf9214a60bb6fa20389687bd5a7319e7650c0193ff7ec4
SSDEEP 192:uc4EsQ3MP4Epv5esUe46dhFMdq1qvCvD9TYAJjdiJlG6IHzmEXEL8LJwAXsCqzSZ:mRPvwPelhFx5rBYY4vG6iDLtXz+Ulvv
TLSH
T1C682D510B79EE825C2D34255AA79BD81EF2141765278085C729C594FFFF780283FBAE8
MD5 SHA1 SHA512 SSDEEP TLSH

jep106.ids

SHA256 0b634a484c990d39424b886db569f45d09f2c24dbd5abe3137c0eaceb5a1e5c8
MD5 b7078da93903b3b9ee364ee4960d1cf5
SHA1 522d493624766d6b85d43cb8f7395408855c0a4b
SHA512 3af5c6cc17ec4b3eeb86947d581223e6da369096e61e7e2030a947db83d61ae4d3af892d9797a386ad81537639fded46645e5ebf46aa7bb11a3dff47cdf9512e
SSDEEP 768:pgvY71Iy4ZOyWDrbOWHUGsb8o7lgbbbXIFCDxNoEO+Y26tLBcmZ:poY71DBPsYUlRoDxeEOc6fcmZ
TLSH
T130431075FA2E77020F69339C1DF31F66A01422D586B51622B3A8840335F0A7DAFDB65E
MD5 SHA1 SHA512 SSDEEP TLSH

libcdi.dll

IMPHASH c405167e3b51a6a87732727df59770f9
SHA256 861d53bbb54d7251b8bc26eb84f7477c965437666eb801f7ddfa2b36e4837077
MD5 5bc4587870dd5ea51b4b3abd3bf8be83
SHA1 070faf0022cfad64d491f54b6908b3443bfe8a62
SHA512 4b03972920f93ee7a96d7849dbf65f3dfee471ebd194e117d941d597984b3b24c7195ef60e1c700c24e92b101a4fcd2ba23e94525fdd61aba1db1ce8fc5a79aa
SSDEEP 12288:yZMPdGEfKq8wQsJfwOP3I8oEvmVZ6UlqpG2Ch:tG+Kq87sNC8oEuVZ6UlqpG2Ch
TLSH
T1BAB43A50A3F806A4F173D13CCB675117FA7678652B30C6DF02A08A696F33BD19A39726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

225216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\nwinfo\nwinfo\x64\Release\libcdi.pdb

kernel32

RaiseException GetLastError CreateFileW SetLastError SetErrorMode QueryPerformanceCounter HeapAlloc HeapReAlloc HeapFree HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount ReleaseMutex WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess InitializeSListHead RtlUnwindEx InterlockedFlushSList RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter ExitProcess GlobalUnlock GlobalLock DeleteFileW GlobalAlloc GetDriveTypeW OpenMutexW DeleteCriticalSection DecodePointer FindResourceW LoadResource LockResource DefineDosDeviceW SetFilePointer DeviceIoControl SizeofResource OutputDebugStringW IsDebuggerPresent SetUnhandledExceptionFilter MultiByteToWideChar GetDllDirectoryW LocalFree LocalAlloc GlobalFree GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetCurrentThreadId GlobalFlags LocalReAlloc GlobalHandle OutputDebugStringA GetModuleHandleExW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW lstrcmpA FormatMessageW EncodePointer GlobalDeleteAtom lstrcmpW GlobalAddAtomW GlobalFindAtomW InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc

user32

UnhookWindowsHookEx CallNextHookEx LoadIconW WinHelpW SetWindowTextW GetSysColorBrush LoadCursorW DrawTextW DrawTextExW GrayStringW TabbedTextOutW ClientToScreen RealChildWindowFromPoint DestroyMenu CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW LoadBitmapW GetClassNameW IsMenu IsWindow GetClassInfoExW GetClassInfoW CallWindowProcW GetMessageTime GetMessagePos PeekMessageW RegisterWindowMessageW GetWindow GetWindowTextW GetScrollPos GetLastActivePopup GetWindowLongW MessageBoxW IsWindowEnabled EnableWindow DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW GetClassLongPtrW SetWindowLongW PtInRect CopyRect GetSysColor GetTopWindow ScreenToClient RemovePropW GetPropW SetPropW GetParent OffsetRect SetRectEmpty GetClientRect RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetMenu GetMenu GetCapture GetKeyState GetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos UnregisterClassW wsprintfW GetMonitorInfoW MonitorFromWindow GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints AdjustWindowRectEx GetWindowRect BeginDeferWindowPos GetMenuItemCount GetMenuItemID ReleaseDC GetDC GetSystemMetrics DestroyWindow CreateWindowExW SetWindowPos GetSubMenu

gdi32

SetWindowExtEx OffsetViewportOrgEx SetViewportOrgEx DeleteDC SetBkColor SetTextColor CreateBitmap DeleteObject Escape GetClipBox GetStockObject PtVisible RectVisible RestoreDC SaveDC SelectObject SetMapMode ScaleWindowExtEx ScaleViewportExtEx GetDeviceCaps SetViewportExtEx TextOutW ExtTextOutW

advapi32

SetSecurityDescriptorDacl QueryServiceStatus CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid FreeSid StartServiceW InitializeSecurityDescriptor InitializeAcl OpenServiceW AddAccessAllowedAce

shell32

ShellExecuteW

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize

oleaut32

VariantChangeType SafeArrayGetElement VariantClear SysAllocString SysFreeString VariantInit

shlwapi

PathFindExtensionW PathFindFileNameW

setupapi

CM_Get_Device_IDW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW

wintrust

WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

crypt32

CertGetNameStringW

oleacc

LresultFromObject CreateStdAccessibleObject

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

msvcrt

mbtowc ___lc_codepage_func _iob _lock _unlock ?terminate@@YAXXZ _fileno ceil log10 _clearfp _isatty strrchr __CxxFrameHandler wcsspn wcsrchr __C_specific_handler memcmp memcpy memmove memset wcsstr _CxxThrowException wcschr _amsg_exit __DestructExceptionObject _local_unwind free malloc strlen wcslen wcstol _wcsicmp iswspace _wtoi _wtof qsort _wtoi64 _errno strncmp wcscspn fflush fclose realloc wcscmp _wcsdup _msize ldiv _expand _initterm abort strcmp __pctype_func tolower ___mb_cur_max_func _wsplitpath _wcsupr _wcslwr _wfopen __CppXcptFilter __getmainargs

libcdix86.dll

IMPHASH 050c0d29bf7930249893fbb7a4902217
SHA256 bc4e4c7d6e3be668492377cdab2563a099c2a63a4c765571aef66bec32163766
MD5 eaf548f5ee6d1efe22a28e25cc8a5b87
SHA1 263b46b5fc3abd5167b99efc4de40badbceb2d3d
SHA512 565e4cda5338be05d9ba6f798a05d7c3334d1cb8043aaa695b5ba96904c30e77fb6d96c67b915022cd3a3834fa64814a7dfde11274e2eef869a86894417f6829
SSDEEP 12288:ZrfV04OtBiEjpMY2xgYdIVbvWyQSr7d6zyZa0l65W2UVkUR:Z8TbvTrwzyZa0l65W2UVLR
TLSH
T1BFA45B1173D99475E6BD56B0BEBC96B6657D3A710B38C0DBE3A40A0F2E304C68930B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

206301

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\nwinfo\nwinfo\Win32\Release\libcdix86.pdb

kernel32

CreateFileW AreFileApisANSI RaiseException GetLastError SetLastError SetErrorMode QueryPerformanceCounter HeapAlloc HeapReAlloc HeapFree HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount ReleaseMutex WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThreadId InitializeSListHead InterlockedFlushSList RtlUnwind UnhandledExceptionFilter ExitProcess GetModuleHandleExW GlobalUnlock GlobalLock DeleteFileW GlobalAlloc GetDriveTypeW OpenMutexW DeleteCriticalSection FindResourceW LoadResource LockResource DefineDosDeviceW SetFilePointer DeviceIoControl SizeofResource OutputDebugStringW IsDebuggerPresent SetUnhandledExceptionFilter MultiByteToWideChar LocalFree LocalAlloc GlobalFree GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery VirtualFree VirtualAlloc GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GlobalFlags GetCurrentDirectoryW ExpandEnvironmentStringsW LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue OutputDebugStringA GetModuleHandleA lstrcmpA FormatMessageW GlobalDeleteAtom lstrcmpW GlobalAddAtomW GlobalFindAtomW InitializeCriticalSection TlsAlloc

user32

UnhookWindowsHookEx CallNextHookEx LoadIconW WinHelpW SetWindowTextW GetSysColorBrush LoadCursorW DrawTextW DrawTextExW GrayStringW TabbedTextOutW ClientToScreen RealChildWindowFromPoint DestroyMenu CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW LoadBitmapW GetClassNameW ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetMenu GetMenu GetCapture GetKeyState GetFocus GetDlgCtrlID GetDlgItem DispatchMessageW SendMessageW PostMessageW GetClassLongW PtInRect CopyRect GetSysColor ScreenToClient IsIconic GetTopWindow RemovePropW GetPropW SetPropW EndDeferWindowPos GetParent OffsetRect SetRectEmpty GetClientRect DeferWindowPos BeginDeferWindowPos SetWindowPos IsMenu IsWindow GetClassInfoExW GetClassInfoW CallWindowProcW GetMessageTime GetMessagePos RedrawWindow PeekMessageW RegisterWindowMessageW GetWindow GetWindowTextW GetScrollPos GetLastActivePopup MessageBoxW IsWindowEnabled UnregisterClassW wsprintfW GetMonitorInfoW MonitorFromWindow GetWindowThreadProcessId SetWindowLongW GetWindowLongW MapWindowPoints AdjustWindowRectEx GetWindowRect ReleaseDC GetDC GetSystemMetrics EnableWindow DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW GetMenuItemCount GetMenuItemID GetSubMenu

gdi32

SetViewportExtEx ExtTextOutW DeleteDC SetBkColor SetTextColor CreateBitmap DeleteObject Escape GetClipBox GetStockObject PtVisible RectVisible ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx GetDeviceCaps TextOutW RestoreDC SaveDC SelectObject SetMapMode SetViewportOrgEx

advapi32

SetSecurityDescriptorDacl QueryServiceStatus CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid FreeSid StartServiceW InitializeSecurityDescriptor InitializeAcl OpenServiceW AddAccessAllowedAce

shell32

ShellExecuteW

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize

oleaut32

VariantChangeType SafeArrayGetElement VariantClear SysAllocString SysFreeString VariantInit

shlwapi

PathFindExtensionW PathFindFileNameW

setupapi

SetupDiDestroyDeviceInfoList CM_Get_Device_IDW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust

crypt32

CertGetNameStringW

oleacc

LresultFromObject CreateStdAccessibleObject

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

msvcrt

?terminate@@YAXXZ mbtowc ___lc_codepage_func _iob _unlock _XcptFilter _isatty _fileno __getmainargs _CIlog10 ceil _clearfp _lock strrchr qsort wcsrchr _except_handler3 memcpy memmove memset wcsstr _CxxThrowException wcschr __CxxFrameHandler _amsg_exit free malloc wcstol _wcsicmp iswspace _wtoi _wtof strncmp _wtoi64 _errno wcsspn wcscspn fflush fclose strlen wcslen realloc wcscmp _wcsdup _msize ldiv _expand _initterm abort __pctype_func tolower ___mb_cur_max_func _wsplitpath _wcsupr _wcslwr _wfopen

generic

count=4, id=261, version=27412,

count=4, id=260, version=27412,

count=7, id=199, version=41118,

count=2, id=257, version=35219,

count=1, id=259, version=35219,

count=54, id=261, version=35219,

count=1, id=260, version=35219,

count=1, id=259, version=35207,

count=1, id=261, version=33145,

count=16, id=259, version=35721,

count=12, id=260, version=35721,

count=119, id=261, version=35721,

count=11, id=260, version=33145,

count=51, id=257, version=33145,

count=883, id=1, productName=Unmarked objects,

count=1, id=261, version=35226,

count=7, id=265, version=36252,

count=1, id=256, version=36252,

count=1, id=255, version=36252,

count=1, id=151,

count=1, id=258, version=36252,

nwinfo.exe

IMPHASH 6dc121bb1e328ef6448a2c23d1fbf24b
SHA256 ccd2a555086807036319d261e43855685fa0e009ed808a035fd189d9d6929d4c
MD5 b3632b9a8737fb65c87270ca79b880ad
SHA1 7623c50c16f2f6f923b41f44baec4caebbe7e00b
SHA512 67811d504375947c4d3da532d50e426a58344bd4f2484d22d1baf7a190cba3989dd27f796e36701bbb4e3755eca4f938a7b417f011c41526c7959923286d4c85
SSDEEP 12288:tm37zPooHSnWoZVMIqnIOTewqz+qoKH4lqbxQt:tm37zPooHSnWPTebz+qo24ld
TLSH
T174058D4AB76589F5C8678139CD839163EAB1BC082F6157E77990B66C3F730E61E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

400480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\nwinfo\nwinfo\x64\Release\nwinfo.pdb

advapi32

RegOpenKeyExW RegQueryValueExW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService StartServiceW OpenServiceW RegQueryInfoKeyW RegEnumKeyExW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid CheckTokenMembership GetUserNameW

iphlpapi

GetAdaptersAddresses GetIfEntry

setupapi

CM_Get_DevNode_Registry_Property_ExW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList

ws2_32

WSASetLastError

kernel32

FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LocalAlloc LocalFree SetThreadAffinityMask GetDllDirectoryW MultiByteToWideChar WideCharToMultiByte OpenFileMappingW GetWindowsDirectoryW GetComputerNameExW GetUserDefaultUILanguage GetProcessHeap GetCurrentThread GetSystemTimes FindNextVolumeW FindVolumeClose GetDiskFreeSpaceExW FindFirstVolumeW GetVolumeInformationW DeviceIoControl FileTimeToSystemTime OpenMutexW GetFileSize CreateFileA GetNativeSystemInfo CreateFileMappingW VirtualQuery VirtualProtect GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GlobalMemoryStatusEx IsProcessorFeaturePresent CreateProcessW GetCurrentThreadId UnmapViewOfFile MapViewOfFile QueryPerformanceFrequency GetModuleHandleExW TerminateProcess GetCurrentProcessId GetCurrentProcess CreateWaitableTimerW Sleep SetWaitableTimer ExitProcess UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead SetUnhandledExceptionFilter GetSystemPowerStatus GetComputerNameW CreateFileW GetVolumePathNamesForVolumeNameW RaiseException CreateMutexW WaitForSingleObject ReleaseMutex LeaveCriticalSection EnterCriticalSection HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError

user32

EnumDisplayDevicesW GetRawInputDeviceInfoW EnumDisplaySettingsExW GetRawInputDeviceList GetSystemMetrics GetDC ReleaseDC

shell32

SHGetFolderPathW

ole32

PropVariantClear CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

shlwapi

PathFindFileNameW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetPerformanceInfo EnumPageFilesW

cfgmgr32

CM_Get_Device_Interface_List_SizeW CM_Get_Device_IDW CM_Get_Device_Interface_ListW CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key

msvcrt

__getmainargs _environ _msize _XcptFilter __set_app_type _fmode __argc __argv ___lc_handle_func ?_set_new_mode@@YAHH@Z _commode ?terminate@@YAXXZ mbtowc ___lc_codepage_func _isatty _fileno ceil log10 _clearfp fopen wcstol ___mb_cur_max_func __pctype_func _iob _unlock _lock strcmp _errno _initterm strtol isalpha wcstoul isdigit _wcsnicmp iswctype fread _wfopen qsort _wcsicmp isprint isxdigit isspace strtoul realloc fputs fclose fflush calloc _strtoui64 _stricmp _strnicmp _strdup tolower toupper abort wcslen strlen malloc free _amsg_exit strstr wcsstr strchr memset memmove memcpy __C_specific_handler wcsrchr strrchr __CxxFrameHandler strcspn fgets strncmp strncpy wcscmp wcsncmp

nwinfox86.exe

IMPHASH c634e9afde19084fb0c81d2a3a20c29f
SHA256 1250ef9422cf42a9d4905ab4cfbd21dcb29c8a2927e9ce04a6a84f3e1f20eecd
MD5 69014df4768314a412d2eb0b0d3a96f9
SHA1 5489c4d35a29d84b98a97b98792ca4c786406270
SHA512 61dab2b991b221b5c539081a9a88a53a42990a592ac06629e4b45c37ee409e3f1858fd1d9f63376f36b0c51e4fa1afa300571d3c4455bf80e630a8ead70976ad
SSDEEP 12288:Zot0Ud+NtynvXuqFvYtrYsSYbsCusghqIGNzAyWZSZDVe7DD:Zot0icynfuqFvKks/sd4dJcZSZJe7DD
TLSH
T193F49C21BE21D472E98141B56EC7D6E229247E3C1F7A06D3F2C437AC66740E62B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

343536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\nwinfo\nwinfo\Win32\Release\nwinfo.pdb

advapi32

RegOpenKeyExW RegQueryValueExW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService StartServiceW OpenServiceW RegQueryInfoKeyW RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid CheckTokenMembership GetUserNameW

iphlpapi

GetAdaptersAddresses GetIfEntry

setupapi

SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList CM_Get_DevNode_Registry_Property_ExW SetupDiGetDeviceRegistryPropertyW

ws2_32

WSASetLastError

kernel32

FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LocalAlloc LocalFree SetThreadAffinityMask MultiByteToWideChar UnmapViewOfFile GetProcessHeap GetCurrentThread GetSystemTimes FindNextVolumeW FindVolumeClose GetDiskFreeSpaceExW FindFirstVolumeW GetVolumeInformationW DeviceIoControl FileTimeToSystemTime OpenMutexW GetFileSize CreateFileA MapViewOfFile OpenFileMappingW CreateFileMappingW VirtualQuery GetNativeSystemInfo GetWindowsDirectoryW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GlobalMemoryStatusEx IsProcessorFeaturePresent GetCurrentThreadId GetUserDefaultUILanguage QueryPerformanceFrequency GetModuleHandleExW ExitProcess TerminateProcess GetCurrentProcessId GetCurrentProcess CreateWaitableTimerW Sleep SetWaitableTimer CreateMutexW UnhandledExceptionFilter IsDebuggerPresent RtlUnwind InitializeSListHead SetUnhandledExceptionFilter GetSystemPowerStatus GetComputerNameW GetComputerNameExW ExpandEnvironmentStringsW GetCurrentDirectoryW CreateFileW GetVolumePathNamesForVolumeNameW RaiseException GetLastError WaitForSingleObject ReleaseMutex LeaveCriticalSection EnterCriticalSection HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError WideCharToMultiByte

user32

GetRawInputDeviceList EnumDisplayDevicesW GetRawInputDeviceInfoW EnumDisplaySettingsExW GetSystemMetrics GetDC ReleaseDC

ole32

CoInitializeEx PropVariantClear CoCreateInstance CoTaskMemFree CoUninitialize

shlwapi

PathFindFileNameW SHQueryValueExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetPerformanceInfo EnumPageFilesW

cfgmgr32

CM_Get_Device_Interface_List_SizeW CM_Get_Device_IDW CM_Get_Device_Interface_ListW CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key

msvcrt

_iob __pctype_func ___mb_cur_max_func wcstol fopen _XcptFilter __getmainargs _environ _msize __set_app_type _fmode ___lc_handle_func ?_set_new_mode@@YAHH@Z ?terminate@@YAXXZ _control87 mbtowc ___lc_codepage_func _isatty _fileno _CIlog10 ceil _clearfp _unlock _errno __p__commode __p___argv __p___argc _initterm strtol isalpha wcstoul isdigit _wcsnicmp iswctype fread _wfopen qsort _wcsicmp isprint isxdigit isspace strtoul realloc fputs fclose fflush calloc _strtoui64 _stricmp _strnicmp _strdup tolower toupper abort malloc free _amsg_exit strstr wcsstr strchr memset memmove memcpy _except_handler3 wcsrchr strrchr __CxxFrameHandler strcspn fgets strncmp strncpy _lock wcsncmp

pci.ids

SHA256 178aff0aa6dc7f38397609c60056d2ad09148ff55afd99857608c65de3509f49
MD5 5a2ece59f0ba8dc328d4c16e534bc206
SHA1 350fd796ce0a27c4c4ebc3ebdb11086f1b639b30
SHA512 a772859e0ac42c21731939b3217afcf13f3e46a42d15e815d52ccdb76b8695803b49c2fd6b861698539b400a80ab4cd31616bb6ae10bf4679da68988cea9009d
SSDEEP 12288:u61S9dFBugsHh8L+TElUftjbmeVBBW+n3GpCWbk8:aNfsHhUkV5n0
TLSH
T1BA751A2878CD50703A5F724B62720D7FAA5E79C65017C19F9229AFF436E32D85F8B908
MD5 SHA1 SHA512 SSDEEP TLSH

usb.ids

SHA256 34b2b2289508a866cf38b96e54b37ac52c0ab7ce8361a56116af24e3fd094421
MD5 98e6f4e55817d4cae8d5680aae91d28f
SHA1 73ff2056fe1b37720496129352427a976241a017
SHA512 71d3e33e5a4410bd9f6c75de4bd79909431b3e569882a7dfb350578b79362dbd1c1c4bade034d5245f1d30853078fe2489eb3168ac5fde8177a0cb459924cac6
SSDEEP 12288:aJEMSkhJLrN/Rcy3naWEH3WrxvOsu28khaCjxC31riyADKyoYoLlRVadrbHQPO0k:MSkHLrN/Rcy3naWEH3Wrxvh8kha9RAdr
TLSH
T16EF45B156EDF3813226B928F6B825CBF591E3885261B166B112CDDDC62C70C99FDBF08
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer