USB-Treiber_V2.3.zip
- SHA256 8689b092e0486b0a6870ba8e6c479c67bd5a64aad434cd6bc4259d73d37f267c
Overview
overview
7Static
static
3Setup.exe
windows10-2004-x64
7Setup.exe
windows11-ltsc_2024-x64
7d9xmei/CYG...ll.exe
windows10-2004-x64
d9xmei/CYG...ll.exe
windows11-ltsc_2024-x64
d9xmei/SLABBUS.sys
windows10-2004-x64
3d9xmei/SLABBUS.sys
windows11-ltsc_2024-x64
3d9xmei/SLABCM95.sys
windows10-2004-x64
3d9xmei/SLABCM95.sys
windows11-ltsc_2024-x64
3d9xmei/SLABCMNT.sys
windows10-2004-x64
3d9xmei/SLABCMNT.sys
windows11-ltsc_2024-x64
3d9xmei/SLABCR.sys
windows10-2004-x64
3d9xmei/SLABCR.sys
windows11-ltsc_2024-x64
3d9xmei/SLABSER.sys
windows10-2004-x64
3d9xmei/SLABSER.sys
windows11-ltsc_2024-x64
3d9xmei/SLABUNIN.exe
windows10-2004-x64
3d9xmei/SLABUNIN.exe
windows11-ltsc_2024-x64
3d9xmei/SLABWH95.sys
windows10-2004-x64
3d9xmei/SLABWH95.sys
windows11-ltsc_2024-x64
3d9xmei/SLABWHNT.sys
windows10-2004-x64
3d9xmei/SLABWHNT.sys
windows11-ltsc_2024-x64
3d9xmei/UNIN98.exe
windows10-2004-x64
3d9xmei/UNIN98.exe
windows11-ltsc_2024-x64
3d9xmei/uninstall.exe
windows10-2004-x64
3d9xmei/uninstall.exe
windows11-ltsc_2024-x64
3setup_9x.exe
windows10-2004-x64
7setup_9x.exe
windows11-ltsc_2024-x64
7setup_xp2k.exe
windows10-2004-x64
7setup_xp2k.exe
windows11-ltsc_2024-x64
7Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
d9xmei/CYG_Uninstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
d9xmei/CYG_Uninstall.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
d9xmei/SLABBUS.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
d9xmei/SLABBUS.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
d9xmei/SLABCM95.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
d9xmei/SLABCM95.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
d9xmei/SLABCMNT.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
d9xmei/SLABCMNT.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
d9xmei/SLABCR.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
d9xmei/SLABCR.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
d9xmei/SLABSER.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
d9xmei/SLABSER.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
d9xmei/SLABUNIN.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
d9xmei/SLABUNIN.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
d9xmei/SLABWH95.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
d9xmei/SLABWH95.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
d9xmei/SLABWHNT.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
d9xmei/SLABWHNT.sys
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
d9xmei/UNIN98.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
d9xmei/UNIN98.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
d9xmei/uninstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
d9xmei/uninstall.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
setup_9x.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral26
Sample
setup_9x.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral27
Sample
setup_xp2k.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
setup_xp2k.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target USB-Treiber_V2.3.zip
- Size 8.9MB
- Sample260804-eq7myavyat
- SHA256 8689b092e0486b0a6870ba8e6c479c67bd5a64aad434cd6bc4259d73d37f267c
- MD5 352a72db71aa1bdf4b1bb82278d48935
- SHA1 0c470fb028c6cd8a2674b894c1f560c831e72feb
- SHA512 26a81a168bcc9432e4137de3e86fbd56f9438484633adf9adfeedf598a30bcdf02adac9e6f1ae437504dfb78e86c471976db2570ada4d56ef073c91a90e39182
- SSDEEP 196608:jAfJGOJAKJyLhBV5XxGSoIkLCr4xg3mJNc8tf8DR5ze6G:jAfgOJKtBV5XYSoCSbtE3zed
- TLSH T1379633A769C232F44160FB6ABFAD524081AD87F6B35C757B47921C3BE711E3B226404E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 14 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup.exe unpack001/d9xmei/CYG_Uninstall.exe unpack001/d9xmei/SLABBUS.SYS unpack001/d9xmei/SLABCM95.SYS unpack001/d9xmei/SLABCMNT.SYS unpack001/d9xmei/SLABCR.SYS unpack001/d9xmei/SLABSER.SYS unpack001/d9xmei/SLABUNIN.EXE unpack001/d9xmei/SLABWH95.SYS unpack001/d9xmei/SLABWHNT.SYS unpack001/d9xmei/UNIN98.EXE unpack001/d9xmei/uninstall.exe unpack001/setup_9x.exe unpack001/setup_xp2k.exe
File Explorer
-
USB-Treiber_V2.3.zip.zip 8.9MB
-
AUTORUN.INF29B
-
Setup.exe.exe 474KB
-
d9xmei/CYG_Uninstall.exe.exe 64KB
-
d9xmei/Readme.txt1KB
-
d9xmei/SLABBUS.CAT9KB
-
d9xmei/SLABBUS.INF8KB
-
d9xmei/SLABBUS.SYS.sys 51KB
-
d9xmei/SLABCM95.SYS.sys 10KB
-
d9xmei/SLABCMNT.SYS.sys 5KB
-
d9xmei/SLABCOMM.VXD23KB
-
d9xmei/SLABCR.SYS.sys 3KB
-
d9xmei/SLABSER.CAT8KB
-
d9xmei/SLABSER.SYS.sys 82KB
-
d9xmei/SLABUNIN.EXE.exe 28KB
-
d9xmei/SLABUNIN.U98162B
-
d9xmei/SLABVCD.VXD12KB
-
d9xmei/SLABVCR.VXD29KB
-
d9xmei/SLABVXD.INF10KB
-
d9xmei/SLABW2K.INF4KB
-
d9xmei/SLABWDM.INF4KB
-
d9xmei/SLABWH95.SYS.sys 6KB
-
d9xmei/SLABWHNT.SYS.sys 5KB
-
d9xmei/UNIN.INI61B
-
d9xmei/UNIN98.EXE.exe 204KB
-
d9xmei/UNIN98.INI200B
-
d9xmei/uninstall.exe.exe 46KB
-
d9xmei/uninstall.ini61B
-
setup_9x.exe.exe 6.1MB
-
setup_xp2k.exe.exe 4.3MB
AUTORUN.INF
- SHA256 ed8b2bde9e7cbb5abec327710f26aa5ca577bcad60c6527dfed5cdd4b565b922
- MD5 b1dfc0f50215cf08f9a08ecb804f73e3
- SHA1 547389325638cd08f3e84760676ce4f367df75f2
- SHA512 80028f60a5d856dd96eccf368f8b649397175a5c20219642f10c6f5382cf57440da9c36034f81b67eef892eaae1bd18c6fae5ebaa7c6c9dd71c29ee17e872378
- MD5 SHA1 SHA512
Setup.exe
- IMPHASH 208c9389b7fdbe2d922cef1a992bc541
- SHA256 a895b8fa84f355b41508a069e8b2c3c97e49fafd427afdfafd0b57c0bcbb19c3
- MD5 413eff425aaaafe3589c69dffd3083d3
- SHA1 d9832479b4d86087aab1d19d79c90d7d2cde5523
- SHA512 0c03933e89c1ae5f1c573b5b214a44f28d242924759281c6ea72452d7ce8211248ebd460c003757fb92b99f6472e2896c5fd5fa91ebfd6610b9c7a799e2d25b7
- SSDEEP 12288:wAGQ/9wRWdcARwQztXl0Tc3GLdpHJhsAD+Tifa:wApCQcOpXyjNhsZwa
- TLSH T12DA47C22B6F1853BC0631FB89EFBA365A43EBF112D2805476BE01D4C5F396913929397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
CloseHandle
CompareStringA
CreateEventA
CreateFileA
CreateThread
DeleteCriticalSection
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
FindClose
FindFirstFileA
FindResourceA
FormatMessageA
FreeLibrary
FreeResource
GetACP
GetCPInfo
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetEnvironmentStrings
GetFileSize
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeExA
GetStringTypeW
GetSystemInfo
GetThreadLocale
GetTickCount
GetVersion
GetVersionExA
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFree
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalAlloc
LocalFree
LockResource
MulDiv
MultiByteToWideChar
RaiseException
ReadFile
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
SizeofResource
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcpyA
lstrcpynA
lstrlenA
comctl32
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetIconSize
ImageList_Write
gdi32
BitBlt
CopyEnhMetaFileA
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateFontIndirectA
CreateHalftonePalette
CreatePalette
CreatePenIndirect
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
ExcludeClipRect
GetBitmapBits
GetBrushOrgEx
GetClipBox
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetObjectA
GetPaletteEntries
GetPixel
GetStockObject
GetSystemPaletteEntries
GetTextExtentPoint32A
GetTextExtentPointA
GetTextMetricsA
GetWinMetaFileBits
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
MoveToEx
PatBlt
PlayEnhMetaFile
RealizePalette
RectVisible
Rectangle
RestoreDC
SaveDC
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetEnhMetaFileBits
SetPixel
SetROP2
SetStretchBltMode
SetTextColor
SetViewportOrgEx
SetWinMetaFileBits
SetWindowOrgEx
StretchBlt
UnrealizeObject
shell32
ShellExecuteExA
user32
ActivateKeyboardLayout
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcA
CharLowerA
CharLowerBuffA
CharNextA
CharUpperBuffA
CheckMenuItem
ClientToScreen
CloseClipboard
CreateIcon
CreateMenu
CreatePopupMenu
CreateWindowExA
DefFrameProcA
DefMDIChildProcA
DefWindowProcA
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DrawEdge
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextA
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndPaint
EnumThreadWindows
EnumWindows
EqualRect
FillRect
FindWindowA
FrameRect
GetActiveWindow
GetCapture
GetClassInfoA
GetClassNameA
GetClientRect
GetClipboardData
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyNameTextA
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardState
GetKeyboardType
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMenuStringA
GetParent
GetPropA
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSystemMenu
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowDC
GetWindowLongA
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
InflateRect
InsertMenuA
InsertMenuItemA
IntersectRect
InvalidateRect
IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
LoadKeyboardLayoutA
LoadStringA
MapVirtualKeyA
MapWindowPoints
MessageBeep
MessageBoxA
OemToCharA
OffsetRect
OpenClipboard
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ScreenToClient
ScrollWindow
SendMessageA
SetActiveWindow
SetCapture
SetClassLongA
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemInfoA
SetPropA
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongA
SetWindowPlacement
SetWindowPos
SetWindowsHookExA
ShowCursor
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UpdateWindow
WaitMessage
WinHelpA
WindowFromPoint
wsprintfA
GetSysColor
oleaut32
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VarBoolFromStr
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarCyFromStr
VarDateFromStr
VarI4FromStr
VarNeg
VarNot
VarR8FromStr
VariantChangeTypeEx
VariantClear
VariantCopy
VariantCopyInd
VariantInit
@@Unit1@Finalize
@@Unit1@Initialize
_Form1
__GetExceptDLLinfo
___CPPdebugHook
Name
.text
Size
399KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
d9xmei/CYG_Uninstall.exe
- IMPHASH db7dd27363fd3c60a2a547b99990ba98
- SHA256 d907e7b971673d374cee0df322a1f89d77ef14599910c886caa6ab3a1c92f076
- MD5 043f3884181271183f36d711147880f0
- SHA1 e8b7272a7e291147e8b287f631ebb06399d8ec4b
- SHA512 68e9844caa678dc6ede246d18d667417a94fd0bc5dac1bd5086affcf2fec325f324d8cadb1a555960b39edaefb75b26e4341e599fc78c93f494b84c2f3422f5d
- SSDEEP 1536:vPE3OSJiG+3TEwEqp9vragBZBoC+INtE:v+SEArBZBoC+INtE
- TLSH T1C9538E137EE118BAEC64137415A60BB4433E7C840A3AF5D79F94DD768C3B4AAA635343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
GetWindowsDirectoryA
MoveFileExA
WritePrivateProfileStringA
GetShortPathNameA
CreateFileA
DeleteFileA
SetFileAttributesA
GetVersionExA
MultiByteToWideChar
SetLastError
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapAlloc
InterlockedDecrement
InterlockedIncrement
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetFileAttributesA
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetFilePointer
GetStringTypeA
GetStringTypeW
SetStdHandle
ReadFile
FlushFileBuffers
FindFirstFileA
FindNextFileA
FindClose
CreateMutexA
GetLastError
CloseHandle
user32
EndDialog
MessageBoxA
DialogBoxParamA
SetDlgItemTextA
SetWindowTextA
advapi32
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsA
SetupOpenInfFileA
SetupFindFirstLineA
SetupCloseInfFile
SetupFindNextLine
SetupGetStringFieldA
SetupPromptReboot
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiOpenClassRegKeyExA
Name
.text
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=22, id=14, version=7299,
count=2, id=19, version=9049,
count=113, id=1, productName=Unmarked objects,
count=11, id=19, version=8034,
count=93, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
d9xmei/Readme.txt
- SHA256 273c3dde6f79b21ba3ba156d00b8f7fe1c37434e952aa12dec7583049d15e361
- MD5 01e5a36c0ca2e01131981336af258c3f
- SHA1 0ef57c5aefe05e67759344bce0d49a921d1fb85a
- SHA512 d67a99db7a9d3bd3951008bd36c49a175b07382fbc4b31b7054f96e230f682766914c0c2e62407650a295735cb938ec632466a6bb407140d0018152bc65673ff
- TLSH T1B631534A2DB786A5677AC1D7437BA083E2E6D1CB5917307830EDCD8C6E91408937F46D
- MD5 SHA1 SHA512 TLSH
d9xmei/SLABBUS.CAT
- SHA256 172209c71b0a57a59fd214864b069d2608c8b13b5f4a2df07daaf17d96338c98
- MD5 f6cc6351bc192a39ac92138c005c857f
- SHA1 354e06bad454c6c38dd13bf43a18e85a7cba40d9
- SHA512 e1a8154956d7c78a4959db3816517d3ab0c37cd98695787dc8ef45a6ffe704ab54ea8e0df3b2d738ce5920a0114933cc89f7f453b7f41f8575b3241d7b1cfb3b
- SSDEEP 192:UVjQ37rOJr6rI2CLL/CldolMGoZuy0ivx49:SjwqJe8/LCcMZuy0iZY
- TLSH T18E121992492C4096A86B9DF2A7F9F99BBC75E7D79C008D3D205BB3940D437D4B70881D
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABBUS.INF
- SHA256 22ef5d07275b468d7a5abcc9d57bf9175d3a9f50461ab3581a2b18ef3721c4fa
- MD5 2504e7930630165677f38d5aba83f85b
- SHA1 1e51e12c305286c65fc1c62db7010e7b1da13730
- SHA512 9cd527985c4e6198945888857715c236af71f8e170d9298ec519433563b8a512138f83ad91e74ce3f527eb65aeb967fb9b4ab30d65e0873c0cb457cd0686e0fd
- SSDEEP 96:hfYUAiMS2ThA7skJkKSAGPKSc+RCgxirHd/bxZ/h+:hAUAitrsVKDGCScICRp/1Z/o
- TLSH T1230254092F068E7126D9E7453B4B44C2DB56800E0336126439FFFC617F5E74D856EABA
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABBUS.SYS
- IMPHASH 8d9b215cf254b18beb5638f6fdd9ff38
- SHA256 b3e3f102fa018698b30e3e80d8487848735dd6daf5bc4c2c20f438782c0cc63f
- MD5 886dbe1e6de104591e8b7334b6d42ed8
- SHA1 f9020c55daf0893da45a7c2b7c3194f63d3a3300
- SHA512 e9aa42a35aa9efa776e5c80afd043c95f2f662b5b11f26303b389784c97ce005bc9bb368f18a88d06b72609e094cb85f2aa63cdda52651345d5606db487d321c
- SSDEEP 768:UdNhWRoR2OQKJPmdrGST9ZTlvlm7Fr++47Gb2R7C0GK2ien9lLQO:UVWRETQK8dr3UE+wGi7MK2ie9lkO
- TLSH T14E335D62F7C10C76E4F31AB08AED37A07377B5611B07AA6B871419453E61E80E973726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
IoCreateDevice
IoDeleteDevice
ObfDereferenceObject
InterlockedDecrement
KeInitializeMutex
IoAllocateDriverObjectExtension
IoGetDriverObjectExtension
KeReleaseMutex
RtlEqualUnicodeString
RtlInitUnicodeString
IoGetDeviceProperty
ExQueueWorkItem
IoInvalidateDeviceRelations
KeSetEvent
IoAttachDeviceToDeviceStack
IofCallDriver
RtlAppendUnicodeToString
ZwClose
RtlQueryRegistryValues
KeInitializeSpinLock
IoDeleteSymbolicLink
ExFreePool
ObReferenceObjectByPointer
KeWaitForSingleObject
InterlockedCompareExchange
InterlockedExchange
KeInitializeEvent
InterlockedIncrement
IoReleaseCancelSpinLock
KeCancelTimer
IoCancelIrp
MmUnlockPages
MmMapLockedPages
MmProbeAndLockPages
IoDetachDevice
IoFreeIrp
IoAllocateIrp
IoCreateUnprotectedSymbolicLink
memmove
ZwQueryValueKey
ExAllocatePoolWithTag
KeQuerySystemTime
RtlDeleteRegistryValue
ZwSetValueKey
KeResetEvent
KeSetTimer
KeInitializeDpc
KeInitializeTimer
IoInitializeIrp
KeReadStateTimer
IofCompleteRequest
RtlUnwind
hal
KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock
slabwh.sys
_MCCIWH_FindIoGetAttachedDeviceReference@4
_MCCIWH_QuerySystemVersion@4
_MCCIWH_FindPoSetPowerState@4
_MCCIWH_FindPoRequestPowerIrp@4
_MCCIWH_FindPoStartNextPowerIrp@4
_MCCIWH_FindPoCallDriver@4
_MCCIWH_FindIoOpenDeviceRegistryKey@4
_MCCIWH_FindIoSetDeviceInterfaceState@4
_MCCIWH_FindIoRegisterDeviceInterface@4
Name
.text
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
32B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
896B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=1, productName=Unmarked objects,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=4, productName=Unmarked objects (old),
count=61, id=19, version=8034,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=120, id=10, productName=VS98 (6.0) build 8168, version=8168,
d9xmei/SLABCM95.SYS
- IMPHASH 61e80349045b038d8766e2ea0ad549f0
- SHA256 d2917fb4ecb692d1e96ffeac83ca803c593df4dafbbb94680ee0ab908cc4cce8
- MD5 5ef05cdfdeb93f63fa99c90ce5e892a4
- SHA1 2fcbeb10529cd3a7e0ed73558b619542e6a80326
- SHA512 93199f788b13f25c9c10af89330173c4fcf8b0888b1ff5efa1262d40ecc4243325b8640eb272ccb708623764ed527c9ba97ba7e8fc545ceef52ac3954f5917c1
- SSDEEP 192:yMJ/djjEkWQWPGlFFNBc1wxExCCxq9tJE0QyuH6cBfOX+6IItQR9X5s9AUZ:jJnvFN+1w2Er9tG0fuH6+TiQR9Xt4
- TLSH T12A22F902CF47DC3BD9A20A711CB35358E53FFC3847A7860B0B4615495EA71CBA95A2AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1104
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
ObfReferenceObject
ObfDereferenceObject
KeDelayExecutionThread
ExFreePool
IoInitializeIrp
KeCancelTimer
ExQueueWorkItem
KeReadStateTimer
KeSetTimer
KeInitializeTimer
InterlockedIncrement
KeInitializeDpc
InterlockedDecrement
IoCancelIrp
ExAllocatePoolWithTag
IofCallDriver
IofCompleteRequest
hal
KeGetCurrentIrql
slabcr.sys
_crwdm_call@12
_MCCICM_AddSerialDevice@8
_MCCICM_FindIoOpenDeviceRegistryKey@4
_MCCICM_FindPoCallDriver@4
_MCCICM_FindPoRequestPowerIrp@4
_MCCICM_FindPoStartNextPowerIrp@4
_MCCICM_QuerySystemVersion@4
_MCCICM_ReestablishSerialConnection@4
_MCCICM_RemoveSerialDevice@4
_MCCIWH_CreateDelayedDereferenceItem@12
_MCCIWH_FindIoGetDeviceInterfaceAlias@4
_MCCIWH_FindIoGetDeviceInterfaces@4
_MCCIWH_FindIoOpenDeviceRegistryKey@4
_MCCIWH_FindIoRegisterDeviceInterface@4
_MCCIWH_FindIoRegisterPlugPlayNotification@4
_MCCIWH_FindIoReportTargetDeviceChange@4
_MCCIWH_FindIoSetDeviceInterfaceState@4
_MCCIWH_FindPDOByDevNode@8
_MCCIWH_FindPDOByReference@20
_MCCIWH_FindPoCallDriver@4
_MCCIWH_FindPoCancelDeviceNotify@4
_MCCIWH_FindPoRegisterDeviceForIdleDetection@4
_MCCIWH_FindPoRegisterDeviceNotify@4
_MCCIWH_FindPoRegisterSystemState@4
_MCCIWH_FindPoRequestPowerIrp@4
_MCCIWH_FindPoSetDeviceBusy@4
_MCCIWH_FindPoSetPowerState@4
_MCCIWH_FindPoSetSystemState@4
_MCCIWH_FindPoStartNextPowerIrp@4
_MCCIWH_FindPoUnregisterSystemState@4
_MCCIWH_QuerySystem98Gold@0
_MCCIWH_QuerySystemVersion@4
_MCCIWH_SubmitDelayedDereferenceItem@8
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_LTEXT
Size
160B
Virtual Size
141B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PNP
Size
32B
Virtual Size
6B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
576B
Virtual Size
574B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
896B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
256B
Virtual Size
254B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, productName=Unmarked objects (old),
count=5, id=19, version=8152,
count=19, id=1, productName=Unmarked objects,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
d9xmei/SLABCMNT.SYS
- IMPHASH fa5b893439c85738ba31f644a8b80916
- SHA256 adf5cacb3f94255856ab0dcad6ada5dec1cba347275ba54138fd54be637467cb
- MD5 d93fd96d629adcf8ae147a391ecc4a40
- SHA1 8180157ad01fd9d1ecda468ca4a153fa884e5660
- SHA512 5c339f7c7937f8fee2103803a781c69b6578a66af842667c3b37e0cfd4f6e23cc9895eb126ecd7e872a729ec0237e961693d5eec9a54a09c21507af330837241
- SSDEEP 96:W7Cg7Bm/nmo4jWHMguH6cBfOX+64Unw9aQ96JZCc69H:W+/N4jWNuH6cBfOX+64Unw9aQ96Id
- TLSH T1B9C17553DF52CE26C9E21DB04DB787086C37F4182E4AD40E875A0A497D0A5A958A73EF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
ExAllocatePoolWithTag
ExQueueWorkItem
ObfReferenceObject
ObfDereferenceObject
KeDelayExecutionThread
ExFreePool
IoGetDeviceInterfaceAlias
IoGetDeviceInterfaces
IoOpenDeviceRegistryKey
IoRegisterDeviceInterface
IoRegisterPlugPlayNotification
IoReportTargetDeviceChange
IoSetDeviceInterfaceState
IoGetDeviceObjectPointer
RtlInitUnicodeString
PoCallDriver
PoCancelDeviceNotify
PoRegisterDeviceForIdleDetection
PoRegisterDeviceNotify
PoRegisterSystemState
PoRequestPowerIrp
PoSetPowerState
PoSetSystemState
PoStartNextPowerIrp
PoUnregisterSystemState
_MCCICM_AddSerialDevice@8
_MCCICM_FindIoOpenDeviceRegistryKey@4
_MCCICM_FindPoCallDriver@4
_MCCICM_FindPoRequestPowerIrp@4
_MCCICM_FindPoStartNextPowerIrp@4
_MCCICM_QuerySystemVersion@4
_MCCICM_ReestablishSerialConnection@4
_MCCICM_RemoveSerialDevice@4
_MCCIWH_CreateDelayedDereferenceItem@12
_MCCIWH_FindIoGetDeviceInterfaceAlias@4
_MCCIWH_FindIoGetDeviceInterfaces@4
_MCCIWH_FindIoOpenDeviceRegistryKey@4
_MCCIWH_FindIoRegisterDeviceInterface@4
_MCCIWH_FindIoRegisterPlugPlayNotification@4
_MCCIWH_FindIoReportTargetDeviceChange@4
_MCCIWH_FindIoSetDeviceInterfaceState@4
_MCCIWH_FindPDOByDevNode@8
_MCCIWH_FindPDOByReference@20
_MCCIWH_FindPoCallDriver@4
_MCCIWH_FindPoCancelDeviceNotify@4
_MCCIWH_FindPoRegisterDeviceForIdleDetection@4
_MCCIWH_FindPoRegisterDeviceNotify@4
_MCCIWH_FindPoRegisterSystemState@4
_MCCIWH_FindPoRequestPowerIrp@4
_MCCIWH_FindPoSetDeviceBusy@4
_MCCIWH_FindPoSetPowerState@4
_MCCIWH_FindPoSetSystemState@4
_MCCIWH_FindPoStartNextPowerIrp@4
_MCCIWH_FindPoUnregisterSystemState@4
_MCCIWH_QuerySystem98Gold@0
_MCCIWH_QuerySystemVersion@4
_MCCIWH_SubmitDelayedDereferenceItem@8
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
768B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
896B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
128B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=1, productName=Unmarked objects,
count=3, id=19, version=8152,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
d9xmei/SLABCOMM.VXD
- SHA256 10c5c22c2d7f62ecc571301a1452733bf5f84409f447893d4e1526fc9c11b6aa
- MD5 5785c7cd1e804d7aea16fadc42646f05
- SHA1 2a1adb7041557c845afa7652cae2e1ec77bf7823
- SHA512 2a01a91fbbf39ee186e15f23754b83959568d1493cce7f1b3b2c8aff80a0078dbe196b91c0a72e1f6b4863e351d0ce336c781dcbf7848218363a03f7ba4a7752
- SSDEEP 384:BsCLsCvhPoWlPVko5iD6Xw+hGKvGYH78WbzMLbL4MUY4XY/xTA:BnLBvhgWIWg72zMUMUrYG
- TLSH T12AB21923D8F0807EC4A683B281AB4FBE5E386A4131A615E7DB951CB07F70292D52E59D
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABCR.SYS
- IMPHASH 050bd852a6923ca82652e2fd801d050b
- SHA256 65fbcd86ba0fcb5e7886db1775858c2d4f8773ed8deecd4f5bc1a18c3983a5a5
- MD5 76af26814d7bcb416e145d47d416c61a
- SHA1 0a616675a32363125bdda02871e491d03d546f50
- SHA512 a7b542562720b9c77e6b723b68985d33ca3aa398c3df373b7f551aada0f110acb8587c8310a47953e538a0b7dad77671dc2534b35627e488ea20ee7c08f20243
- TLSH T1DD817522B6D4041FE5FA157035730775623CFC309F32966BBA6C02B22C66554DE63323
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
ZwOpenKey
RtlInitUnicodeString
ZwClose
_crwdm_CloseCrInterfaceHandle@4
_crwdm_FindSysHandleByNdisMiniportHandle@8
_crwdm_FindSysHandleForFdoExt@8
_crwdm_OpenCrInterfaceHandle@8
_crwdm_call@12
_crwdm_callex@16
_crwdm_is_win98@0
_crwdm_is_win9x@0
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
32B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
352B
Virtual Size
337B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
128B
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
864B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
96B
Virtual Size
86B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, productName=Unmarked objects (old),
count=3, id=1, productName=Unmarked objects,
count=3, id=19, version=8152,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=3, id=10, productName=VS98 (6.0) build 8168, version=8168,
d9xmei/SLABSER.CAT
- SHA256 62945e34c153a0552865e8a61fa75677796e1aee7f87075a40b0cf066bbaf7e0
- MD5 ce6e3f944814f0da41c2caa33ba9e231
- SHA1 22bf4ec455cf05efb97639f8de3d28cab53b0b66
- SHA512 d0bc8e40cf94a119eb12b4a5cbdc6b26fe9d6931fa2d74e8a837ab17da2ae67fec5f2df23e5135394d38a7ee97466e1de42ad734fddab2e40356f65f680644e2
- SSDEEP 96:bwmUHHnvkowmYmm7lzQMLy+Cgzdew5mog+MSNWDPDaxDPDaFOgkHDPDab3vZD7De:brMHvVrY7LL/CldolMGoZuy0ivxeqj0
- TLSH T105021A824A3C8186FC6B9EE166E9FD577C71E3D75C419E3D20ABA3980C437E5AB0841D
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABSER.SYS
- IMPHASH 00e6ca38b66637fb580bf540be098b8e
- SHA256 0c0d14ba3707f29a1d24ce5d9773fb690564268c6fc33c8bf873a6ecdb5bc521
- MD5 2f3a6eebbbbb158caaa78790fd49e7c3
- SHA1 65905aa25084f1b65fe8cfb706eb0790aebdc8e9
- SHA512 665244aa30119f0f3d5d2d6989083ffa85bfb020b79d8ec9bae2b002679f57298306110d00d4ba650c051c8a809c6f0eef46ffd70065e7163206463020b171b8
- SSDEEP 1536:FGxYIUQ+EPNW2unlv6SBR5Dlkzd9EEqjB0G9ejh2PXazVP:FG+IUBEPNDASSz5DW9EEBG9ejh2PXazR
- TLSH T13A836E41B7C78C73C5A726B199793365723BA5211A5AFBBB433C2C4C2F36A90B911723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
IofCompleteRequest
KeSetTimer
IoReleaseCancelSpinLock
KeCancelTimer
KeRemoveQueueDpc
IoAcquireCancelSpinLock
IoCancelIrp
KeInsertQueueDpc
ExQueueWorkItem
RtlDeleteRegistryValue
IoInitializeIrp
KeQuerySystemTime
InterlockedDecrement
KeInitializeTimer
InterlockedExchange
InterlockedIncrement
IoCreateUnprotectedSymbolicLink
KeInitializeDpc
KeInitializeSpinLock
KeInitializeEvent
RtlWriteRegistryValue
IoDeleteSymbolicLink
KeTickCount
KeQueryTimeIncrement
KeWaitForSingleObject
KeSetEvent
RtlCompareMemory
KeClearEvent
memmove
IoAttachDeviceToDeviceStack
IofCallDriver
RtlInitUnicodeString
RtlAppendUnicodeToString
IoDeleteDevice
IoDetachDevice
ZwClose
ZwQueryValueKey
ZwSetValueKey
IoFreeIrp
IoAllocateIrp
IoCreateDevice
ObfDereferenceObject
ExAllocatePoolWithTag
KeResetEvent
KeReadStateTimer
RtlEqualUnicodeString
IoGetDeviceProperty
ObReferenceObjectByPointer
ExFreePool
RtlUnwind
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
usbd.sys
USBD_GetUSBDIVersion
slabcm.sys
_MCCICM_RemoveSerialDevice@4
_MCCIWH_FindIoSetDeviceInterfaceState@4
_MCCICM_AddSerialDevice@8
_MCCICM_ReestablishSerialConnection@4
_MCCIWH_FindIoRegisterDeviceInterface@4
_MCCIWH_QuerySystemVersion@4
_MCCIWH_FindPoSetPowerState@4
_MCCIWH_FindPoRequestPowerIrp@4
_MCCIWH_FindPoStartNextPowerIrp@4
_MCCIWH_FindPoCallDriver@4
_MCCIWH_FindIoOpenDeviceRegistryKey@4
_MCCIWH_FindPDOByDevNode@8
_MCCIWH_FindPDOByReference@20
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
256B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
928B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=1, productName=Unmarked objects,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=7, productName=Unmarked objects (old),
count=58, id=19, version=8034,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=156, id=10, productName=VS98 (6.0) build 8168, version=8168,
d9xmei/SLABUNIN.EXE
- IMPHASH 691c5c0dcc3339fbb07697641abe3772
- SHA256 ab0056482699cd1f97c7c58aad328467a45eb5f1538c641871468bac85c6ac53
- MD5 0fa6f15be157ea679d4a6e360cc08b4b
- SHA1 a8f16373e6ead7b719fd4dfdeeb4a7fc026ab08e
- SHA512 e7da22f362f1f7b9933fa926edaa322915e0a083ed81d65cdb7713f8dda446426f06dac4e52d80ad3c683b638bccc67df1e5f23d869e40407780b34e4d59d4e7
- SSDEEP 384:VfbP+OYFy+Xd4I67OERIZqN9V604l4vUV:9+OOy+Xd4I673NHPn8
- TLSH T1B1D23B5B7B130AB2EC7489B0366E76769733540ABD7095A3D794CD19083B201EC3B76B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
setupapi
SetupDiSetSelectedDriverA
SetupOpenFileQueue
SetupScanFileQueueA
SetupCloseFileQueue
SetupDiOpenDevRegKey
SetupDiSetDeviceInstallParamsA
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoA
SetupDiGetDriverInfoDetailA
SetupDiDestroyDriverInfoList
SetupDiClassGuidsFromNameExA
SetupDiCreateDeviceInfoListExA
SetupDiGetClassDevsExA
SetupDiOpenDeviceInfoA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceInfoListDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstallParamsA
mfc42
ord939
ord858
ord540
ord860
ord823
ord4129
ord535
ord6283
ord6282
ord940
ord537
ord800
ord825
ord941
msvcrt
_mbschr
printf
_mbctoupper
_ismbcalpha
_mbsnbicmp
_mbsicmp
sprintf
_strdup
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__CxxFrameHandler
_mbscmp
_chdir
_mbctolower
kernel32
GetSystemDirectoryA
GetVersionExA
lstrcmpA
lstrcpyA
ReadFile
lstrlenA
SetConsoleTitleA
CreateFileA
CloseHandle
GetWindowsDirectoryA
DeleteFileA
GetLastError
WinExec
SetFileAttributesA
user32
FindWindowA
ShowWindow
MessageBoxA
CharNextA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCloseKey
Name
.text
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=2, id=11, version=8047,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=108, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=8, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
d9xmei/SLABUNIN.U98
- SHA256 5900630c42ee4d2233052e95e61b4d2c90591c99def35a997c569a8de85297cf
- MD5 b8dacc855e3bc94996f33a2fb186084f
- SHA1 d193bcac8f099cf658c2afe8b95ccd8e1020dd43
- SHA512 de3355c91286a1435b15a0641e1c204d69e88fb540287e6d6b44cbc52e02e76648b6ef9334320cd186e96d9426bb645cdbe2ff3947cf1ced6d8b351a42df8901
- TLSH T104C02B338231448767D225806FC024488851C8FCE84C983905DCFC898DF00047F009FC
- MD5 SHA1 SHA512 TLSH
d9xmei/SLABVCD.VXD
- SHA256 1f4c4a94ba8d409742a27d418dfb0ea40a9560143f2f04590acb709d5ac6798e
- MD5 1982529aa0b59f72ffb413e61e898c86
- SHA1 01644ffb69ce012a0502db77b14c88f89241bb6a
- SHA512 e44ffba04a6fe819f58fa24d25f07ea58086e030145dd1ebcad4b1459f77aa7f92bfe76fddc50df32aed0d8df6e9bd03f3221618a86d75919cda42f5e1f45384
- SSDEEP 192:uDmTB28KmKrWKu00u2woC8nKDuVxgtNU+BDMQI1ELytORZiinDLYHiFXqocQjp:KS28r20KWZIs+tgU73p
- TLSH T16152F721F852C038C3A453FA98562FFE6BBD9E1463128B13D7EA4C711DE6161AB0B45F
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABVCR.VXD
- SHA256 8a47c0f27354672c699e88368df1594d59467e4f663d9c0ca5140e1d2f9e54e4
- MD5 9b22fcba92b17ef73d4a7f3aecf4e369
- SHA1 ea8c8552ff1a440d2bca2734238da57b39602b72
- SHA512 3edc625ecc5a6ef21e718074709ed7a4e53831c0a42d8df3571220629937bae9de0f5442c1b2527e317fabd31a3b8256f5268ddd17af0fad69b2bf0ce8fab43d
- SSDEEP 768:smNAVCIz1MC5HPu6h5OZg0ArzCqq5HQBkX/YGjvA+e:smsr5HPtIArew+X/YeA5
- TLSH T112D251325961C13FC0A79AF1910A4FFA6D788F352F96A5D3CFA82DB03B70585C53225A
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABVXD.INF
- SHA256 0db80b372c2632de9702111659ee001f43033b22018cbc2c74261e32d98b8540
- MD5 6b0498d4494173713e1d9addd5b0d771
- SHA1 dc5624d54b1151228b6975686b99d0f0a704c721
- SHA512 3c9d650b7456ccdc96326adab402594103ff593f1f972f5b64dd838d748182bf42677f4eaede1fea4d4a7d11235700583fb37b1cb6a2db4952aa1ccab5b001fb
- SSDEEP 96:1bY3A8pHT1VCOuUMV60MV21aMx+NM0ZlMV6gMV2mMx+xM09M0WM0xI2o:1M3A2OrrkWFxPE+U2xnvSgI2o
- TLSH T17C3248110D086F95F122D280DB2F3CABE70DE0988FE4102DB67B61D9EA5DEC75A2DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABW2K.INF
- SHA256 c6f574ad970e343788413b74a4ca062a448c979558dcf45ba5744cda1dfcb0e0
- MD5 63dc6b364475a64a86e4f86998660c91
- SHA1 e0e2416b4a9397154f0491e795369eca7cc18c9e
- SHA512 4176cf68a323b99c468227934e724498572f5c7a9710931a071594199b22181d9bb93b5a6b29ed4a1f874465c2095923797b558a50d4803a13e5bc0eca61a17e
- SSDEEP 48:CkMbbMsH+4AkomYXCtyG7rxSvSdVsBYs7jD3U9K0Gm0kqny334CayCYGc90XdNwS:XMbYuA8zSvSyUs0GmqnyH4HSiwQ/X/f
- TLSH T113A1A5071E028FB26382D68C7B075CD6CB16548D956A152471EFFE127BDCD0C969E8BC
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABWDM.INF
- SHA256 95ebc18e9c8e37dfa5f9a322a0192622396d07b95944be9e2f4f18fad1938de7
- MD5 96ac7cea53dc2fb0275edad279635804
- SHA1 e9a1e9be536901c4d8eac5e02a922977dbb470e6
- SHA512 4bb41a03f811ca715e473fe6688086bcf8247b96e55c7ce82cbcc9e883fb8a106a5030628a4ef96be1dd7b2a36b42ea11a9ba620c9729dc39574c18e3504675b
- SSDEEP 48:m0vbbMsHkZWAkolQutOmuBGotyGwBRc0OJbTLVOVvpBqqLZLwLWQSO7jk3U9K0Gi:lvbY0AXVIZhCbNLRUs0GrdnN/yM/rof
- TLSH T150A182062D124F307381DE09670298E7CB1569DD86BA106D34BEFD51BF0D94DA26DCBD
- MD5 SHA1 SHA512 SSDEEP TLSH
d9xmei/SLABWH95.SYS
- IMPHASH 538311ed6ffd62af508e3fc13d3a76d3
- SHA256 b121be0894f0c89ed420424f35f2e4202fd711d86d5f8fd0ffa9d4e13ba35043
- MD5 3aaa06ffeeaac2fa1db7657209b4518d
- SHA1 871e82e295f9a03a4515b56d5b9db31d5ff2b18d
- SHA512 9a78b212e691ffea77e039d6454fc685d4496c32396c4889d3e2592c1e76f5a54fbc4617b6e1172b515d6c67caf13ee5a203b91e17be91914312664627d43105
- SSDEEP 96:Y0oQdPxmLiacB2zERaG7eYnzfbe7cBfOX+6wCJTCF3olAJL:/o6PaIB24X7eizztBfOX+6jOFhJL
- TLSH T160D18310EB22C92BD5220CB52CE3431CDA3BFC649B6FC6474B8612945C935D9592D3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1020
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
ExQueueWorkItem
ObfReferenceObject
ObfDereferenceObject
KeDelayExecutionThread
ExFreePool
IofCallDriver
ExAllocatePoolWithTag
_MCCIWH_CreateDelayedDereferenceItem@12
_MCCIWH_FindIoGetAttachedDeviceReference@4
_MCCIWH_FindIoGetDeviceInterfaceAlias@4
_MCCIWH_FindIoGetDeviceInterfaces@4
_MCCIWH_FindIoOpenDeviceRegistryKey@4
_MCCIWH_FindIoRegisterDeviceInterface@4
_MCCIWH_FindIoRegisterPlugPlayNotification@4
_MCCIWH_FindIoReportTargetDeviceChange@4
_MCCIWH_FindIoSetDeviceInterfaceState@4
_MCCIWH_FindPDOByDevNode@8
_MCCIWH_FindPDOByReference@20
_MCCIWH_FindPoCallDriver@4
_MCCIWH_FindPoCancelDeviceNotify@4
_MCCIWH_FindPoRegisterDeviceForIdleDetection@4
_MCCIWH_FindPoRegisterDeviceNotify@4
_MCCIWH_FindPoRegisterSystemState@4
_MCCIWH_FindPoRequestPowerIrp@4
_MCCIWH_FindPoSetDeviceBusy@4
_MCCIWH_FindPoSetPowerState@4
_MCCIWH_FindPoSetSystemState@4
_MCCIWH_FindPoStartNextPowerIrp@4
_MCCIWH_FindPoUnregisterSystemState@4
_MCCIWH_QuerySystem98Gold@0
_MCCIWH_QuerySystemVersion@4
_MCCIWH_SubmitDelayedDereferenceItem@8
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PNP
Size
32B
Virtual Size
6B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
256B
Virtual Size
230B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
896B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
192B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=3, id=19, version=8152,
count=7, id=1, productName=Unmarked objects,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=28, id=10, productName=VS98 (6.0) build 8168, version=8168,
d9xmei/SLABWHNT.SYS
- IMPHASH 6c8b2aca61a1698cacbba0b7b8f2a5b7
- SHA256 b053b8636482290e91b38f1b64e29bfe124732071a31b0bb9bbfe097202169d4
- MD5 058343a08415b084a25c2138bff6cc3d
- SHA1 8888fd03375447d23fcb1da310379ba86ebde5bd
- SHA512 ad3e760e4a0f118ebf3778acfc9c9fe68959baf17e4f32c6396b3c98150167751d036ae93136c0f829daece7393d2e2af0aaf64c4c7d8f7602aaab54a9f7faaf
- SSDEEP 96:wAhQOjWIHwcBfOX+61hUnw9aQ9PEJWC7391vD:wAhQOjWIDBfOX+6vUnw9aQ9wr7t17
- TLSH T123C18653EB56DE26C9A218F00DB7434C6D73F0481E99C91E47EA0A5C3D4A4A4A8763EF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntoskrnl.exe
ExAllocatePoolWithTag
ExQueueWorkItem
ObfReferenceObject
ObfDereferenceObject
KeDelayExecutionThread
ExFreePool
IoGetAttachedDeviceReference
IoGetDeviceInterfaceAlias
IoGetDeviceInterfaces
IoOpenDeviceRegistryKey
IoRegisterDeviceInterface
IoRegisterPlugPlayNotification
IoReportTargetDeviceChange
IoSetDeviceInterfaceState
IoGetDeviceObjectPointer
RtlInitUnicodeString
PoCallDriver
PoCancelDeviceNotify
PoRegisterDeviceForIdleDetection
PoRegisterDeviceNotify
PoRegisterSystemState
PoRequestPowerIrp
PoSetPowerState
PoSetSystemState
PoStartNextPowerIrp
PoUnregisterSystemState
_MCCIWH_CreateDelayedDereferenceItem@12
_MCCIWH_FindIoGetAttachedDeviceReference@4
_MCCIWH_FindIoGetDeviceInterfaceAlias@4
_MCCIWH_FindIoGetDeviceInterfaces@4
_MCCIWH_FindIoOpenDeviceRegistryKey@4
_MCCIWH_FindIoRegisterDeviceInterface@4
_MCCIWH_FindIoRegisterPlugPlayNotification@4
_MCCIWH_FindIoReportTargetDeviceChange@4
_MCCIWH_FindIoSetDeviceInterfaceState@4
_MCCIWH_FindPDOByDevNode@8
_MCCIWH_FindPDOByReference@20
_MCCIWH_FindPoCallDriver@4
_MCCIWH_FindPoCancelDeviceNotify@4
_MCCIWH_FindPoRegisterDeviceForIdleDetection@4
_MCCIWH_FindPoRegisterDeviceNotify@4
_MCCIWH_FindPoRegisterSystemState@4
_MCCIWH_FindPoRequestPowerIrp@4
_MCCIWH_FindPoSetDeviceBusy@4
_MCCIWH_FindPoSetPowerState@4
_MCCIWH_FindPoSetSystemState@4
_MCCIWH_FindPoStartNextPowerIrp@4
_MCCIWH_FindPoUnregisterSystemState@4
_MCCIWH_QuerySystem98Gold@0
_MCCIWH_QuerySystemVersion@4
_MCCIWH_SubmitDelayedDereferenceItem@8
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
832B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
896B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
192B
Virtual Size
162B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=1, productName=Unmarked objects,
count=3, id=19, version=8152,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
d9xmei/UNIN.INI
- SHA256 71266dc89e7306abab99112918ba8428aa688bb383906854532915fdf6f960f1
- MD5 b555e6b0be21ff9d7bd32c8ae0b88f20
- SHA1 c7709bf2250bc3e1d927266e714cbcce0db7ca8c
- SHA512 61883c07b1e26669432a3ea4a7c4b6936882da034c2b430784c4d6421f15286822b808d15da50790745e046d1ff666c883c2d9b85c368b6171d412c5dbd94ab6
- TLSH T12FA0022A8617084765D148484DD6590C4115D03ADC18C105714EB538C9B08441C4095E
- MD5 SHA1 SHA512 TLSH
d9xmei/UNIN98.EXE
- IMPHASH d8d679994a63ecc3206477263c666650
- SHA256 9fb2a4950f25c074e5ec71f54c953a19732e22e2a93abb3ec2aa8db79ee29d79
- MD5 36129ee5e3c91879e40a03e391aaafff
- SHA1 8b83756f05ee6474c68937f3a47d16a2b821c42a
- SHA512 1f8cecdda8f7c6af39ec5f6788068bdb0aa72b5f19b54ac9a10d9eba0afeb4aab21ad8d511c262ee33c034bfa3b03bf45dfeec1474d75684ba8f81e277d90d74
- SSDEEP 3072:ZwQbHZ7225Jct5KpGxexbmXoEWUevuzFomDmc5Yb3m9y7zZqhAS3l1KeEPSEMW:ZPbHl2Gc/KtxbmXTWEIzKfKeEPSEM
- TLSH T1C9149E2374D1CCF3C96042334CA397AAA3BCE42447919B1763E8AA3F5E6B6C51F26355
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GlobalLock
GlobalReAlloc
GlobalAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GetVersion
FileTimeToSystemTime
FileTimeToLocalFileTime
GetModuleHandleA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeLibrary
GetProcessVersion
lstrcmpA
GlobalFlags
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
SetEnvironmentVariableA
SetCurrentDirectoryA
RtlUnwind
GetCommandLineA
ExitProcess
RaiseException
HeapAlloc
GetACP
GetTimeZoneInformation
HeapSize
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalAlloc
GetCurrentThreadId
lstrcatA
GetFileTime
GetFileSize
GetFileAttributesA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetLastError
LocalFree
GetModuleFileNameA
lstrcmpiA
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
FindFirstFileA
FindClose
lstrcpyA
LoadLibraryA
GetProcAddress
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
GetCurrentProcess
DuplicateHandle
GetLastError
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetSystemDirectoryA
ReadFile
CreateFileA
CloseHandle
FindResourceA
LoadResource
LockResource
SizeofResource
SetFileAttributesA
WinExec
HeapFree
DeleteFileA
user32
CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
GetFocus
GetNextDlgTabItem
DispatchMessageA
GetKeyState
CallNextHookEx
PeekMessageA
SetWindowsHookExA
UnhookWindowsHookEx
LoadStringA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
SendMessageA
EnableWindow
GetSystemMetrics
MessageBoxA
CharUpperA
EnableMenuItem
advapi32
RegOpenKeyExA
RegDeleteKeyA
RegCloseKey
shell32
SHFileOperationA
comctl32
ord17
gdi32
GetStockObject
SelectObject
SaveDC
GetClipBox
SetTextColor
RestoreDC
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
SetBkColor
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
DeleteObject
GetDeviceCaps
CreateBitmap
GetObjectA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comdlg32
GetFileTitleA
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=26, id=14, version=7299,
count=117, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=6, productName=Unmarked objects (old),
count=15, id=19, version=8034,
count=356, id=1, productName=Unmarked objects,
count=51, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
d9xmei/UNIN98.INI
- SHA256 f075ba10a19832e15e4d736d8fa960a05d2dc08d0d3acba2d09f7355d29485ba
- MD5 54a06284495e2a7ea76bb91752199adc
- SHA1 b667add19de7a4afc0f6d05eb9c0032d7acf0361
- SHA512 da23e09f866a0c789f42e88cdd5d75456de69918135aa0ca3d05e6d6c711421a07235e0a847afb8385081514c9f5f100ed1f3aca829c840c97c73285ec1cebc7
- TLSH T125D0801681304DA793C22D84BF001C148058D4FCAD3D953551BCFD750FF54C4614AA7D
- MD5 SHA1 SHA512 TLSH
d9xmei/uninstall.exe
- IMPHASH 646379189e4cfb8494d40a5aeed8e909
- SHA256 d111f2ca394df3dd9067a700c610ac4a13c58eab70154b07c8981ab8342b3544
- MD5 1661af4f8a6dcf49549493d75a894344
- SHA1 cc6656f38a69b9a29f250b7e9e24f5babd4a1991
- SHA512 758cb887226d50417b8dbf26e58fcd797348f854257bcd334153836d84e06257511789e190ccfd3ee55afcea5e191f6a071f0e578f555b2204f9bbd6bc9c2f53
- SSDEEP 768:Q5sy/GSZlKFPpOMJ85Bdkjxal6rRtq9/e:QHGS+FPpOMR9RtO
- TLSH T1A823B80223E98619F5F73F306AB462250FB37C91AC3CC64C0289952D5AF2E91DD75BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
20039
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
_except_handler3
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
wcsstr
_wcsnset
swprintf
_wcsdup
strstr
free
wprintf
_wcsicmp
_wcsnicmp
iswalpha
towupper
towlower
wcschr
??2@YAPAXI@Z
??3@YAXPAX@Z
_iob
fputs
fputws
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
LookupPrivilegeValueW
kernel32
lstrcpynW
GetDateFormatW
lstrcmpW
lstrcpyW
CreateFileW
MultiByteToWideChar
FreeLibrary
lstrcmpiW
lstrlenW
GetLastError
GetCurrentProcess
CloseHandle
FormatMessageW
LocalFree
GetProcAddress
LoadLibraryW
GetFullPathNameW
DeleteFileW
SetFileAttributesW
GetModuleHandleA
ReadFile
FileTimeToSystemTime
user32
LoadStringW
MessageBoxW
CharNextW
ExitWindowsEx
setupapi
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_DevNode_Status_Ex
CM_Free_Res_Des_Handle
SetupDiCreateDeviceInfoListExW
SetupDiGetClassDevsExW
CM_Get_Next_Res_Des_Ex
CM_Free_Log_Conf_Handle
CM_Get_First_Log_Conf_Ex
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiOpenDevRegKey
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupCloseFileQueue
SetupScanFileQueueW
SetupDiCallClassInstaller
SetupOpenFileQueue
SetupDiSetSelectedDriverW
SetupDiGetDriverInstallParamsW
SetupDiOpenClassRegKeyExW
SetupDiGetClassDescriptionExW
SetupDiClassNameFromGuidExW
SetupDiBuildClassInfoListExW
SetupDiSetClassInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiGetINFClassW
CM_Disconnect_Machine
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInfoListDetailW
CM_Get_Device_ID_ExW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
428B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=64, version=9210,
count=11, id=28, version=9178,
count=111, id=1, productName=Unmarked objects,
count=11, id=25, version=9210,
count=1, id=69, version=9111,
count=3, id=29, version=9178,
count=1, id=61, version=9210,
d9xmei/uninstall.ini
- SHA256 71266dc89e7306abab99112918ba8428aa688bb383906854532915fdf6f960f1
- MD5 b555e6b0be21ff9d7bd32c8ae0b88f20
- SHA1 c7709bf2250bc3e1d927266e714cbcce0db7ca8c
- SHA512 61883c07b1e26669432a3ea4a7c4b6936882da034c2b430784c4d6421f15286822b808d15da50790745e046d1ff666c883c2d9b85c368b6171d412c5dbd94ab6
- TLSH T12FA0022A8617084765D148484DD6590C4115D03ADC18C105714EB538C9B08441C4095E
- MD5 SHA1 SHA512 TLSH
setup_9x.exe
- IMPHASH 2dd1f2ca3497e7bf3a3f47dd48596ca8
- SHA256 ad7396d0efca6d14b654bc0ba10506e46a4839613fbc63a4628db57d1910d699
- MD5 5c659412d36802243ea2e63e930f2084
- SHA1 361e6a3d4d29253d39596936e5afa026ff7b5690
- SHA512 88ef47a0f0f36ea6fc4b91879f2be65d7ce9b2b15c362fcd2a5b7735f1b2efe9c8d7e226310a233e24846802444efbf36acf942cb78a60dac41cb6aecc74a689
- SSDEEP 196608:fHqfGMkASVqV26hgDneS+lrHNQicHkRYa3MniY8I:iuMkqE5AtQiZ1m
- TLSH T16256CE30BD92ACDEC3A280B510D9276F40EDE5D639B06D6DB6BD36C112C68E3D1A6385
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121132
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
shell32
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
comctl32
ord17
kernel32
GetLastError
WideCharToMultiByte
DeleteFileA
lstrlenW
InterlockedIncrement
InterlockedDecrement
QueryPerformanceFrequency
CreateEventA
Sleep
lstrcatA
CompareStringA
CompareStringW
GetVersionExA
SetFilePointer
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
FreeLibrary
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceA
CreateProcessA
GetSystemDefaultLCID
GlobalHandle
VerLanguageNameA
SetCurrentDirectoryA
WaitForSingleObject
GetSystemInfo
MulDiv
GetModuleFileNameA
IsValidCodePage
GetVersion
FlushFileBuffers
SetEndOfFile
LocalFree
FormatMessageA
GetDiskFreeSpaceA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
GetExitCodeProcess
GetCurrentProcess
GetCurrentThread
GetLocaleInfoA
UnhandledExceptionFilter
lstrlenA
GetACP
GetCPInfo
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
SetLastError
HeapDestroy
GetEnvironmentVariableA
LCMapStringW
LCMapStringA
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapSize
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
TerminateProcess
ExitProcess
RaiseException
RtlUnwind
SystemTimeToFileTime
QueryPerformanceCounter
ResetEvent
SetEvent
GetShortPathNameA
SearchPathA
FindFirstFileA
VirtualProtect
VirtualQuery
GetStdHandle
FindClose
GetFileType
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CreateFileA
GetFileSize
GlobalAlloc
CloseHandle
GlobalLock
ReadFile
GlobalUnlock
GlobalFree
CopyFileA
MultiByteToWideChar
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
CreateThread
GetExitCodeThread
GetTickCount
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GetTempPathA
SetErrorMode
GetWindowsDirectoryA
GetTempFileNameA
GetFileAttributesA
GetProcessHeap
HeapAlloc
HeapFree
WriteFile
lstrcpynA
lstrcpyA
CreateFileMappingA
MapViewOfFile
HeapCreate
UnmapViewOfFile
GetEnvironmentStringsW
SetHandleCount
GetOEMCP
user32
GetParent
GetWindowTextLengthA
GetWindowTextA
MoveWindow
GetWindowPlacement
DrawIcon
DestroyIcon
GetDlgCtrlID
SetWindowTextA
FillRect
GetSysColor
GetSysColorBrush
IsDialogMessageA
EnableWindow
GetDlgItemTextA
GetWindow
SetCursor
UpdateWindow
GetClassInfoA
wvsprintfA
LoadStringA
SendMessageA
GetSystemMetrics
SetRect
FindWindowA
IntersectRect
SubtractRect
CharPrevA
DestroyWindow
CreateDialogParamA
CharNextA
MessageBoxA
WaitForInputIdle
GetWindowLongA
BeginPaint
EndPaint
SetWindowLongA
GetClientRect
ClientToScreen
SetWindowPos
GetWindowDC
EndDialog
GetDlgItem
ShowWindow
DialogBoxParamA
GetDesktopWindow
wsprintfA
MsgWaitForMultipleObjects
PeekMessageA
DefWindowProcA
PostMessageA
KillTimer
PostQuitMessage
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
ExitWindowsEx
SendDlgItemMessageA
IsWindow
CharLowerBuffA
GetWindowRect
gdi32
GetTextExtentPoint32A
SetBkMode
SetTextColor
GetObjectA
CreateFontIndirectA
CreateSolidBrush
CreateCompatibleDC
SelectObject
CreateFontA
DeleteDC
DeleteObject
GetStockObject
GetSystemPaletteEntries
CreatePalette
GetDeviceCaps
SelectPalette
RealizePalette
CreateDIBitmap
BitBlt
TranslateCharsetInfo
advapi32
RegQueryValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegEnumValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
RegDeleteValueA
ole32
StringFromCLSID
CoTaskMemFree
CoCreateGuid
CoCreateInstance
GetRunningObjectTable
StgIsStorageFile
StgOpenStorage
CoUninitialize
CoInitialize
CreateItemMoniker
oleaut32
VariantChangeType
SysAllocString
SysAllocStringLen
SysStringLen
SysReAllocStringLen
SysFreeString
VariantClear
Name
.text
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=14, version=7299,
count=128, id=10, version=8047,
count=1, id=12, version=7291,
count=13, id=11, version=8047,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=37, version=8755,
count=272, id=1, productName=Unmarked objects,
count=17, id=25, version=9210,
count=36, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
setup_xp2k.exe
- IMPHASH 2dd1f2ca3497e7bf3a3f47dd48596ca8
- SHA256 400330ed6273449be488a680df3b519b6fdb7a36d2e1193e0fb5fee0bdbed13a
- MD5 0b159843e2981f4399d37f41a3ef3183
- SHA1 492aed8100df53190b28720899e07ef7d3214c1b
- SHA512 e519b394c1175068a1e771f38b98cec15eb4245282984d0d31f3e8a93361177b601ce7d7f269ed7f16115208908b4f3db1281cf27b6d57a02d555d07bc15e5c0
- SSDEEP 98304:ffdqqkfGMTPQLco1gufrVqVxt2i4U5xMTkzkTAeyj5j6WlcV:ffkfGMkASVqVxt258xQkzQAeyjNs
- TLSH T11826DF32BAEB6E55E309E47C7CD013EFA25E4CC0A5566853227E2DDB11AC8D1AC84F47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121132
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
shell32
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
comctl32
ord17
kernel32
GetLastError
WideCharToMultiByte
DeleteFileA
lstrlenW
InterlockedIncrement
InterlockedDecrement
QueryPerformanceFrequency
CreateEventA
Sleep
lstrcatA
CompareStringA
CompareStringW
GetVersionExA
SetFilePointer
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
FreeLibrary
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceA
CreateProcessA
GetSystemDefaultLCID
GlobalHandle
VerLanguageNameA
SetCurrentDirectoryA
WaitForSingleObject
GetSystemInfo
MulDiv
GetModuleFileNameA
IsValidCodePage
GetVersion
FlushFileBuffers
SetEndOfFile
LocalFree
FormatMessageA
GetDiskFreeSpaceA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
GetExitCodeProcess
GetCurrentProcess
GetCurrentThread
GetLocaleInfoA
UnhandledExceptionFilter
lstrlenA
GetACP
GetCPInfo
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
SetLastError
HeapDestroy
GetEnvironmentVariableA
LCMapStringW
LCMapStringA
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapSize
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
TerminateProcess
ExitProcess
RaiseException
RtlUnwind
SystemTimeToFileTime
QueryPerformanceCounter
ResetEvent
SetEvent
GetShortPathNameA
SearchPathA
FindFirstFileA
VirtualProtect
VirtualQuery
GetStdHandle
FindClose
GetFileType
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CreateFileA
GetFileSize
GlobalAlloc
CloseHandle
GlobalLock
ReadFile
GlobalUnlock
GlobalFree
CopyFileA
MultiByteToWideChar
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
CreateThread
GetExitCodeThread
GetTickCount
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GetTempPathA
SetErrorMode
GetWindowsDirectoryA
GetTempFileNameA
GetFileAttributesA
GetProcessHeap
HeapAlloc
HeapFree
WriteFile
lstrcpynA
lstrcpyA
CreateFileMappingA
MapViewOfFile
HeapCreate
UnmapViewOfFile
GetEnvironmentStringsW
SetHandleCount
GetOEMCP
user32
GetParent
GetWindowTextLengthA
GetWindowTextA
MoveWindow
GetWindowPlacement
DrawIcon
DestroyIcon
GetDlgCtrlID
SetWindowTextA
FillRect
GetSysColor
GetSysColorBrush
IsDialogMessageA
EnableWindow
GetDlgItemTextA
GetWindow
SetCursor
UpdateWindow
GetClassInfoA
wvsprintfA
LoadStringA
SendMessageA
GetSystemMetrics
SetRect
FindWindowA
IntersectRect
SubtractRect
CharPrevA
DestroyWindow
CreateDialogParamA
CharNextA
MessageBoxA
WaitForInputIdle
GetWindowLongA
BeginPaint
EndPaint
SetWindowLongA
GetClientRect
ClientToScreen
SetWindowPos
GetWindowDC
EndDialog
GetDlgItem
ShowWindow
DialogBoxParamA
GetDesktopWindow
wsprintfA
MsgWaitForMultipleObjects
PeekMessageA
DefWindowProcA
PostMessageA
KillTimer
PostQuitMessage
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
ExitWindowsEx
SendDlgItemMessageA
IsWindow
CharLowerBuffA
GetWindowRect
gdi32
GetTextExtentPoint32A
SetBkMode
SetTextColor
GetObjectA
CreateFontIndirectA
CreateSolidBrush
CreateCompatibleDC
SelectObject
CreateFontA
DeleteDC
DeleteObject
GetStockObject
GetSystemPaletteEntries
CreatePalette
GetDeviceCaps
SelectPalette
RealizePalette
CreateDIBitmap
BitBlt
TranslateCharsetInfo
advapi32
RegQueryValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegEnumValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
RegDeleteValueA
ole32
StringFromCLSID
CoTaskMemFree
CoCreateGuid
CoCreateInstance
GetRunningObjectTable
StgIsStorageFile
StgOpenStorage
CoUninitialize
CoInitialize
CreateItemMoniker
oleaut32
VariantChangeType
SysAllocString
SysAllocStringLen
SysStringLen
SysReAllocStringLen
SysFreeString
VariantClear
Name
.text
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=14, version=7299,
count=128, id=10, version=8047,
count=1, id=12, version=7291,
count=13, id=11, version=8047,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=37, version=8755,
count=272, id=1, productName=Unmarked objects,
count=17, id=25, version=9210,
count=36, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,