d99d1f730281d722194b029bbe76329769b67937d3cdfdea50845d2a4d1fd6de
- SHA256 d99d1f730281d722194b029bbe76329769b67937d3cdfdea50845d2a4d1fd6de
Overview
overview
8Static
static
3WinRing0x64.dll
windows10-2004-x64
1WinRing0x64.dll
windows11-ltsc_2024-x64
1WinRing0x64.sys
windows10-2004-x64
3WinRing0x64.sys
windows11-ltsc_2024-x64
3demo.bat
windows10-2004-x64
3demo.bat
windows11-ltsc_2024-x64
3inpoutx64.dll
windows10-2004-x64
8inpoutx64.dll
windows11-ltsc_2024-x64
8installSer...sk.bat
windows10-2004-x64
3installSer...sk.bat
windows11-ltsc_2024-x64
3libryzenadj.dll
windows10-2004-x64
1libryzenadj.dll
windows11-ltsc_2024-x64
1pmtable-example.py
windows10-2004-x64
3pmtable-example.py
windows11-ltsc_2024-x64
3readjust.py
windows10-2004-x64
3readjust.py
windows11-ltsc_2024-x64
3readjustService.ps1
windows10-2004-x64
5readjustService.ps1
windows11-ltsc_2024-x64
5ryzenadj.exe
windows10-2004-x64
1ryzenadj.exe
windows11-ltsc_2024-x64
1uninstallS...sk.bat
windows10-2004-x64
3uninstallS...sk.bat
windows11-ltsc_2024-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
WinRing0x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinRing0x64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
WinRing0x64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
WinRing0x64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
demo.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
demo.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
inpoutx64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
inpoutx64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
installServiceTask.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
installServiceTask.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
libryzenadj.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
libryzenadj.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
pmtable-example.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
pmtable-example.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
readjust.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
readjust.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
readjustService.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
readjustService.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
ryzenadj.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
ryzenadj.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
uninstallServiceTask.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
uninstallServiceTask.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target d99d1f730281d722194b029bbe76329769b67937d3cdfdea50845d2a4d1fd6de
- Size 140KB
- Sample260804-h2zy1sfa87
- SHA256 d99d1f730281d722194b029bbe76329769b67937d3cdfdea50845d2a4d1fd6de
- MD5 302bbe5772dc2ad914bce419513fcff1
- SHA1 8ab07865b4892cc9f98fc6c1470d3dafb642c85c
- SHA512 ea9251eff9b67279c11e8c90f7efbc1b7aef6cec55cb89fb008c9d49273d0f2bbac7c6170831eac01afa1d1ab850ab020f97c418dc21e5e565c0bc1050ced191
- SSDEEP 3072:nPumIqOcVNZseoXCHSatEQjcWpm0jqfvTC2iwlZ5i:2XKVN+eoSyaSQZpm09Oi
- TLSH T1C8E313087A3347F8E55C1EB3E4D4BE2379A7F909D2A4B8894122E7B275420F25F7A01D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/WinRing0x64.dll unpack001/inpoutx64.dll unpack001/libryzenadj.dll unpack001/ryzenadj.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/WinRing0x64.sys
File Explorer
-
d99d1f730281d722194b029bbe76329769b67937d3cdfdea50845d2a4d1fd6de.zip 140KB
-
RyzenAdjServiceTask.xml.template.xml 1KB
-
WinRing0x64.dll.dll 61KB
-
WinRing0x64.sys.sys 14KB
-
demo.bat100B
-
inpoutx64.dll.dll 96KB
-
installServiceTask.bat.bat 1KB
-
libryzenadj.dll.dll 60KB
-
pmtable-example.py2KB
-
readjust.py2KB
-
readjustService.ps1.ps1 23KB
-
ryzenadj.exe.exe 89KB
-
uninstallServiceTask.bat517B
RyzenAdjServiceTask.xml.template
- SHA256 9df61600f6d20d5c49e4eb9e8a7c1bfdd56b69c1971660e8af9cb5ab31373fdb
- MD5 121cc33e15161f3a11e48dff013770ef
- SHA1 09114fd3c648507d2adfce3f4e27d57c68c4ad5b
- SHA512 dcc47d5aecf5cbc2dd5f4bd07c473b1c60c4598e4c223d0e5d45698ae7afdac7ca0383aaebcca184eda2a5a4b54b5eef3af862977722a4b808e8601a6ed0b0bf
- TLSH T1053114749CC0B71B6A728536E3418782EF2A53A306174134F8CC4B7F3F7A186214356B
- MD5 SHA1 SHA512 TLSH
WinRing0x64.dll
- IMPHASH 7c1c1d24ee5f4360e2d2d3b17479b9d4
- SHA256 a746fd5728e7485f741cc330a279674bc8590b1b8007d8614046c49f58698485
- MD5 eb31c77ef331ec4cbf7262cda4d1233a
- SHA1 ffeb0f08f18a4eca1bf8c4e827f9111ae3c64716
- SHA512 b1143d419e278c1b09ad5d750d5dea1fa95ffaec1c0ee7d9c0d7160929981e1b5815fd45d6e0f8ab7aff1cae4518cb4baf1ed69441a040bb584024c99aaea0d0
- SSDEEP 1536:7Vz2GiL9ZooLCYtdm2R6CKQlqlLLuNsCMku1fT:Pw9ZooftdLTKBLLAsCMkk
- TLSH T183535B8A235540B5E4B7927CD8E30E56E6B1B4211B7203CF473487594F733E9AA3E7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
SetProcessAffinityMask
GetModuleFileNameW
CreateFileW
GetVersionExW
FindFirstFileW
GetProcessAffinityMask
GetDriveTypeW
Sleep
GetCurrentProcess
SetThreadAffinityMask
GetCurrentThread
DeviceIoControl
CloseHandle
HeapFree
GetProcessHeap
HeapAlloc
FindClose
GetLastError
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
user32
wsprintfW
advapi32
OpenSCManagerW
QueryServiceConfigW
ControlService
StartServiceW
DeleteService
ChangeServiceConfigW
OpenServiceW
CreateServiceW
CloseServiceHandle
Cpuid
CpuidPx
CpuidTx
DeinitializeOls
FindPciDeviceByClass
FindPciDeviceById
GetDllStatus
GetDllVersion
GetDriverType
GetDriverVersion
Hlt
HltPx
HltTx
InitializeOls
IsCpuid
IsMsr
IsTsc
Rdmsr
RdmsrPx
RdmsrTx
Rdpmc
RdpmcPx
RdpmcTx
Rdtsc
RdtscPx
RdtscTx
ReadIoPortByte
ReadIoPortByteEx
ReadIoPortDword
ReadIoPortDwordEx
ReadIoPortWord
ReadIoPortWordEx
ReadPciConfigByte
ReadPciConfigByteEx
ReadPciConfigDword
ReadPciConfigDwordEx
ReadPciConfigWord
ReadPciConfigWordEx
SetPciMaxBusIndex
WriteIoPortByte
WriteIoPortByteEx
WriteIoPortDword
WriteIoPortDwordEx
WriteIoPortWord
WriteIoPortWordEx
WritePciConfigByte
WritePciConfigByteEx
WritePciConfigDword
WritePciConfigDwordEx
WritePciConfigWord
WritePciConfigWordEx
Wrmsr
WrmsrPx
WrmsrTx
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=125, productName=VS2005 build 50727, version=50727,
count=25, id=110, productName=VS2005 build 50727, version=50727,
count=68, id=109, productName=VS2005 build 50727, version=50727,
count=7, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=98, id=1, productName=Unmarked objects,
count=4, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
WinRing0x64.sys
- IMPHASH d41fa95d4642dc981f10de36f4dc8cd7
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- TLSH T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Chains
Jul 26, 2008
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Subject
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Serial Number
01:00:00:00:00:01:15:37:24:21:a8
Issuer
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Revocation Status
Not revoked
Timespan
Sep 24, 2007 - Sep 24, 2008
Subject
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:00:f9:7f:aa:2e:1e
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 16, 2003 - Jan 27, 2014
Subject
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:1c:d6
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 28, 1999 - Jan 27, 2014
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d
Serial Number
04:00:00:00:00:01:10:92:eb:82:95
Issuer
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 5, 2007 - Jan 27, 2014
Subject
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:24:48
Issuer
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 22, 2004 - Jan 27, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
6
Entry point
20488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoCreateDevice
MmMapIoSpace
KeBugCheckEx
IoCreateSymbolicLink
MmUnmapIoSpace
IofCompleteRequest
__C_specific_handler
hal
HalSetBusDataByOffset
HalGetBusDataByOffset
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
380B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
546B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=113, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
demo.bat
- SHA256 26673a45ecd9335be8062d70a20bc303b3bb6f6ad2f6d5c4f4d93d355bb87cb3
- MD5 2b1aa83eea0d99f70ceebc46c1aa52fc
- SHA1 a698db0aa01fcb4c06b45b469e2e7767da99cd5d
- SHA512 96063c6f6d270384e451a48669c2ca19c842bc18828facc3f55e54a957f124aa37830bfa03e515868cec98ae918275f9eddc6f5c68c2740bf276a45c77689151
- TLSH T10FB09248000D8578F7C143F2B030F506286870381A5B24886C18A2213CAD050435140B
- MD5 SHA1 SHA512 TLSH
inpoutx64.dll
- IMPHASH e3492ab84389ec220c847d561b8eb7cd
- SHA256 5f27ed4d5cd58a1ee23deeb802e09e73f3a1d884ce2135f6e827f67b171269e7
- MD5 ac0c3ae82ec0764c605fa59e7bf05614
- SHA1 3d4980be66fe424475e73c45a2d14a73ff4197f0
- SHA512 27468b3708e11bd598f0c7293f6b51e3ff2928568b174691e00067359ce76c6d1c95a51115f83fee0cccf1df58744785e0076d599f73f01f53c1b92e0a2c2fab
- SSDEEP 1536:Mtd/d3mXwZIBrv9aWWIRkuLoN/e9Lu1pnI0jqSG0jVG:Mz/d3mAZuv9a12V0N/e9Lu1FwSR
- TLSH T1A3A36BD6739550B9E8B3C238C9E38B16E672F4050B7553CF16348A9A1F637E05A3E326
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
LockResource
LoadResource
FindResourceA
SizeofResource
GetVersionExA
GetProcAddress
GetModuleHandleA
WriteFile
GetLastError
DeviceIoControl
OutputDebugStringA
GetSystemDirectoryA
CloseHandle
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
ExitProcess
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
Sleep
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSection
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
FlushFileBuffers
advapi32
StartServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
DlPortReadPortUchar
DlPortReadPortUlong
DlPortReadPortUshort
DlPortWritePortUchar
DlPortWritePortUlong
DlPortWritePortUshort
GetPhysLong
Inp32
IsInpOutDriverOpen
IsXP64Bit
MapPhysToLin
Out32
SetPhysLong
UnmapPhysicalMemory
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
734B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=125, productName=VS2005 build 50727, version=50727,
count=88, id=109, productName=VS2005 build 50727, version=50727,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=99, id=1, productName=Unmarked objects,
count=33, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
installServiceTask.bat
- SHA256 fc0e1df23bb0d4101ce2461c4b41a71f53ca3b3b843e799366294b46d0dbac0e
- MD5 a317a317cc2f7c53a7709b779316ae47
- SHA1 df63e123177aad7945d7269064e74b5d9e1da7be
- SHA512 1aab3ae02544a2f339681fd30e95c88ceb28e53a27c2b7663817b69ad7d7974130c31151c5930b021e1bbcbf069bfffe474e697ef536c220623624406e8f4aa6
- TLSH T124212482949271FD6A521A39556F2AC93F381086812D3485B6FB851C21CCDBCA9D7BCD
- MD5 SHA1 SHA512 TLSH
libryzenadj.dll
- IMPHASH 55cc9447330c7705609d181f77aa15b4
- SHA256 6ba6667d00a21b0109eaa1b84d12ed3b1c89936b88768f49e548aa1e51d134c0
- MD5 d8c39fb4d43de749a7db4cd2794797dd
- SHA1 219c4f3c10ffeb7db8806728e55131e8acf82a9f
- SHA512 898371385f87c5386adbb4ea885fb5912835f8d4bc6b739773231c4c3811eecbc0f7515d0faaf66c0eef881c5145a5eb5ea90f1c97408411c8d8b8ec4252ca0b
- SSDEEP 768:DcGr2lex1d3vOKlGfIKfMRtlr2MuZosAZ3jrvLg4ec6t7/PAJsuhJ:DL1VOgGfIeMRt5kos6vLMd/4a
- TLSH T11F5373282080AA14E8FB53382E5205D0D49A7EC01BCA7BDFEB9DE95E57304D5C7776B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
48576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winring0x64
ord8
ord1
ord86
ord83
ord7
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
vcruntime140
__C_specific_handler
__std_type_info_destroy_list
memcpy
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_execute_onexit_table
_initialize_onexit_table
_initterm
api-ms-win-crt-string-l1-1-0
strncmp
cleanup_ryzenadj
get_apu_skin_temp_limit
get_apu_skin_temp_value
get_apu_slow_limit
get_apu_slow_value
get_bios_if_ver
get_cclk_busy_value
get_cclk_setpoint
get_core_clk
get_core_power
get_core_temp
get_core_volt
get_cpu_family
get_dgpu_skin_temp_limit
get_dgpu_skin_temp_value
get_fast_limit
get_fast_value
get_fclk
get_gfx_clk
get_gfx_temp
get_gfx_volt
get_l3_clk
get_l3_logic
get_l3_temp
get_l3_vddm
get_mem_clk
get_psi0_current
get_psi0soc_current
get_slow_limit
get_slow_time
get_slow_value
get_soc_power
get_soc_volt
get_socket_power
get_stapm_limit
get_stapm_time
get_stapm_value
get_table_size
get_table_values
get_table_ver
get_tctl_temp
get_tctl_temp_value
get_vrm_current
get_vrm_current_value
get_vrmmax_current
get_vrmmax_current_value
get_vrmsoc_current
get_vrmsoc_current_value
get_vrmsocmax_current
get_vrmsocmax_current_value
init_ryzenadj
init_table
refresh_table
set_apu_skin_temp_limit
set_apu_slow_limit
set_coall
set_cogfx
set_coper
set_dgpu_skin_temp_limit
set_disable_oc
set_enable_oc
set_fast_limit
set_gfx_clk
set_max_fclk_freq
set_max_gfxclk_freq
set_max_lclk
set_max_performance
set_max_socclk_freq
set_max_vcn
set_min_fclk_freq
set_min_gfxclk_freq
set_min_lclk
set_min_socclk_freq
set_min_vcn
set_oc_clk
set_oc_volt
set_per_core_oc_clk
set_power_saving
set_prochot_deassertion_ramp
set_psi0_current
set_psi0soc_current
set_psi3cpu_current
set_psi3gfx_current
set_skin_temp_power_limit
set_slow_limit
set_slow_time
set_stapm_limit
set_stapm_time
set_tctl_temp
set_vrm_current
set_vrmcvip_current
set_vrmgfx_current
set_vrmgfxmax_current
set_vrmmax_current
set_vrmsoc_current
set_vrmsocmax_current
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=3, id=259, version=35721,
count=8, id=260, version=35721,
count=13, id=261, version=35721,
count=2, id=257, version=33145,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=42, id=1, productName=Unmarked objects,
count=4, id=265, version=36252,
count=1, id=256, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
pmtable-example.py
- SHA256 a5b8a0c050fecb28f3adbdd5fb87e6f7a27b07187abc6ea3742e4be1c64f06c2
- MD5 92b84014913ddfeec42d7308936d064e
- SHA1 41c14b0b1cb2661ff05c5d391f9696e4bec66ad8
- SHA512 df79afa818887def05248b741e50c67c65a040da62e69d8ef80cdf4973c234c66e459d901ceba771302bdc020f739dc0d1c0b39dc21255b1bdcb4a9ae9145cb6
- TLSH T15F41DE225E577520B1BAEA198986CD785B1302234E325837BDCD94544FB0C35453EE7A
- MD5 SHA1 SHA512 TLSH
readjust.py
- SHA256 000b90dc4fcea055eced9f0a044eb5a83567a93ccc247abb4176a6adfc342510
- MD5 754b97387d7671ad8e6e72bbc394898b
- SHA1 1f5cbd632bdf08a5767452c16f35c976daee0cc3
- SHA512 2ebcaaf6aa7a0e6e564d90694bc4529b9b9f57f3bdffd3537a99b39ffdf583624cf348193268501a52f281d7743fc830206a78720ec9b3105e2e5465c35734c4
- TLSH T1F2412F028C577832B8B3C3389A178548D63620734BBA3A037ADC50D89F7CC29C166E7A
- MD5 SHA1 SHA512 TLSH
readjustService.ps1
- SHA256 61c2e0e293226e87c9d149b2304799c064b83051e70e41e1a305159621a0196c
- MD5 5bd7ee9dec279d1932c3af0473c4dba5
- SHA1 2af3b111d0333e716f2f9a31042f64f2acd0d333
- SHA512 59d442e83c83cf632b27d9043f1248b002bf46beaf3ebd8af2f1b72cec65d8b56ce1d922d377d4da71a176f87a67cd77dee2b37ac97cce899007655a01ffb4af
- SSDEEP 384:bxslEuM3NtqpQsfj38y0rr+Yw3plKTlSgSb:bxUpQ0zFcri3n6lSgc
- TLSH T1E8B272146D4099268BF267289489C57CEF23A1333DA71650F9FC15806FA6424CBBEF7B
- MD5 SHA1 SHA512 SSDEEP TLSH
ryzenadj.exe
- IMPHASH 0d3b2a01309e098ae9e46aa6de0e20e4
- SHA256 68c274068b03d78e6b797e4033f57fa4eae4ab25fc81307b1ff2d19c5cdec954
- MD5 1ad5c6cd37df7554a065ab4d42d96ed6
- SHA1 a857edf825dfd14bad5f75af406a23b7b8641c00
- SHA512 bdebbbe2e3596d13d6d58fc9cd3d1f2e3f9a2b8dc6b8929b8b232b6f97487fc0b87b581835045082d4b89f4cc9b49d13af5bce59d92b24559c97aa7ab824bb6c
- SSDEEP 1536:5+Wr8vIk+cO/CzWD+FsgAgUplIvA6m923gxxBYV98SG/v4YM:5+WwvIk7/C/IvR6drmnhG/v4Y
- TLSH T19293D42825849A74E4FB42741E5114E1D9DA7AD017C5B7CFB7ACE84E1B340E4CB3B6B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
62688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winring0x64
ord1
ord86
ord8
ord7
ord83
kernel32
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
InitializeSListHead
QueryPerformanceCounter
GetCurrentThreadId
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetCurrentProcessId
GetModuleHandleW
vcruntime140
__current_exception_context
__current_exception
__C_specific_handler
memcpy
memmove
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
calloc
malloc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
_set_fmode
fputc
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___argv
_get_initial_narrow_environment
_initialize_narrow_environment
__p___argc
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm
exit
_errno
_exit
_initterm_e
_set_app_type
_seh_filter_exe
strerror_s
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0
strtol
strtof
strtoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strncmp
strlen
cleanup_ryzenadj
get_apu_skin_temp_limit
get_apu_skin_temp_value
get_apu_slow_limit
get_apu_slow_value
get_bios_if_ver
get_cclk_busy_value
get_cclk_setpoint
get_core_clk
get_core_power
get_core_temp
get_core_volt
get_cpu_family
get_dgpu_skin_temp_limit
get_dgpu_skin_temp_value
get_fast_limit
get_fast_value
get_fclk
get_gfx_clk
get_gfx_temp
get_gfx_volt
get_l3_clk
get_l3_logic
get_l3_temp
get_l3_vddm
get_mem_clk
get_psi0_current
get_psi0soc_current
get_slow_limit
get_slow_time
get_slow_value
get_soc_power
get_soc_volt
get_socket_power
get_stapm_limit
get_stapm_time
get_stapm_value
get_table_size
get_table_values
get_table_ver
get_tctl_temp
get_tctl_temp_value
get_vrm_current
get_vrm_current_value
get_vrmmax_current
get_vrmmax_current_value
get_vrmsoc_current
get_vrmsoc_current_value
get_vrmsocmax_current
get_vrmsocmax_current_value
init_ryzenadj
init_table
refresh_table
set_apu_skin_temp_limit
set_apu_slow_limit
set_coall
set_cogfx
set_coper
set_dgpu_skin_temp_limit
set_disable_oc
set_enable_oc
set_fast_limit
set_gfx_clk
set_max_fclk_freq
set_max_gfxclk_freq
set_max_lclk
set_max_performance
set_max_socclk_freq
set_max_vcn
set_min_fclk_freq
set_min_gfxclk_freq
set_min_lclk
set_min_socclk_freq
set_min_vcn
set_oc_clk
set_oc_volt
set_per_core_oc_clk
set_power_saving
set_prochot_deassertion_ramp
set_psi0_current
set_psi0soc_current
set_psi3cpu_current
set_psi3gfx_current
set_skin_temp_power_limit
set_slow_limit
set_slow_time
set_stapm_limit
set_stapm_time
set_tctl_temp
set_vrm_current
set_vrmcvip_current
set_vrmgfx_current
set_vrmgfxmax_current
set_vrmmax_current
set_vrmsoc_current
set_vrmsocmax_current
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=20, id=261, version=35721,
count=2, id=257, version=33145,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=63, id=1, productName=Unmarked objects,
count=6, id=265, version=36252,
count=1, id=256, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
uninstallServiceTask.bat
- SHA256 0aa9a4472767cb1529c0964209c6daade4114b69232a2443700f2ac2b010609d
- MD5 b2d554205a5ae117c7c2d925ccdf7d70
- SHA1 133a15df8c30230e267a593210fb95a85aa3f477
- SHA512 70f2eb242ff4740a6a10957e503d611909cef18538d78710febc062cc18f99c4f49eff37dee0a33d8e4efe13ed5819c392a893d455c79382e9e3983a1add8bea
- TLSH T144F08471B01321E8AF012B56E82622C7FB1D46C8C02370DBB2B5113129484BCDDC224D
- MD5 SHA1 SHA512 TLSH