af31149f2cf96b17b3f66813034dc4b2d5dc30b51731cb1b7a4962fd9617431a
- SHA256 af31149f2cf96b17b3f66813034dc4b2d5dc30b51731cb1b7a4962fd9617431a
Overview
overview
6Static
static
5WinNTSetup...FI.vbs
windows10-2004-x64
5WinNTSetup...FI.vbs
windows11-ltsc_2024-x64
5WinNTSetup...sk.dll
windows10-2004-x64
1WinNTSetup...sk.dll
windows11-ltsc_2024-x64
1WinNTSetup...sk.sys
windows10-2004-x64
3WinNTSetup...sk.sys
windows11-ltsc_2024-x64
3WinNTSetup...64.dll
windows10-2004-x64
1WinNTSetup...64.dll
windows11-ltsc_2024-x64
1WinNTSetup...86.dll
windows10-2004-x64
3WinNTSetup...86.dll
windows11-ltsc_2024-x64
3WinNTSetup...64.exe
windows10-2004-x64
WinNTSetup...64.exe
windows11-ltsc_2024-x64
WinNTSetup...ke.exe
windows10-2004-x64
1WinNTSetup...ke.exe
windows11-ltsc_2024-x64
1WinNTSetup...st.exe
windows10-2004-x64
1WinNTSetup...st.exe
windows11-ltsc_2024-x64
1WinNTSetup...eg.dll
windows10-2004-x64
1WinNTSetup...ib.dll
windows10-2004-x64
1WinNTSetup...ib.dll
windows11-ltsc_2024-x64
1WinNTSetup...15.dll
windows10-2004-x64
1WinNTSetup...15.dll
windows11-ltsc_2024-x64
1WinNTSetup...��.cmd
windows10-2004-x64
3WinNTSetup...��.cmd
windows11-ltsc_2024-x64
3WinNTSetup...64.exe
windows10-2004-x64
1WinNTSetup...64.exe
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
WinNTSetup/Diskpart/UEFI.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinNTSetup/Diskpart/UEFI.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
WinNTSetup/Tools/imdisk/cpl/amd64/imdisk.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
WinNTSetup/Tools/imdisk/cpl/amd64/imdisk.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
WinNTSetup/Tools/imdisk/sys/amd64/imdisk.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
WinNTSetup/Tools/imdisk/sys/amd64/imdisk.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
WinNTSetup/Tools/nativevhdboot_x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
WinNTSetup/Tools/nativevhdboot_x64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
WinNTSetup/Tools/nativevhdboot_x86.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
WinNTSetup/Tools/nativevhdboot_x86.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
WinNTSetup/Tools/x64/BootICE/BOOTICEx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
WinNTSetup/Tools/x64/BootICE/BOOTICEx64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
WinNTSetup/Tools/x64/MSSTMake.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
WinNTSetup/Tools/x64/MSSTMake.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
WinNTSetup/Tools/x64/WIMHost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
WinNTSetup/Tools/x64/WIMHost.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
WinNTSetup/Tools/x64/offreg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
WinNTSetup/Tools/x64/wimlib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
WinNTSetup/Tools/x64/wimlib.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
WinNTSetup/Tools/x64/wimlib/libwim-15.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
WinNTSetup/Tools/x64/wimlib/libwim-15.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
WinNTSetup/Unattend/无人值守/跳过你的数据将在你所在的国家或地区之外进行处理.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
WinNTSetup/Unattend/无人值守/跳过你的数据将在你所在的国家或地区之外进行处理.cmd
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
WinNTSetup/WinNTSetup_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
WinNTSetup/WinNTSetup_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target af31149f2cf96b17b3f66813034dc4b2d5dc30b51731cb1b7a4962fd9617431a
- Size 1.5MB
- Sample260806-m7treayhrf
- SHA256 af31149f2cf96b17b3f66813034dc4b2d5dc30b51731cb1b7a4962fd9617431a
- MD5 19ba0966ab5e159842d6a027f83cd5e1
- SHA1 7fa28ad486133569b41fa6d562bb53ecc025f833
- SHA512 1353ec0b20fc494b69861a6a32109009c3d232643199ea63f4c994ac92693f7d1616a126d365b71cc57547988731922b93442c45eb25871fbfff94fe27aa8db7
- SSDEEP 49152:PkwP/vIgic7qJcT00b6/KLHjU1yeHFH1ZUCD85ORh:cgvIgicJwy6yLDMyGDZUCRh
- TLSH T15E753356070A8A83C1DFC1B23CC2238CD855E7F4D3D7BEA056E669C991AE7C5CA143DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/WinNTSetup/Tools/x64/BootICE/BOOTICEx64.exe upx - Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/WinNTSetup/Tools/imdisk/cpl/amd64/imdisk.cpl unpack001/WinNTSetup/Tools/nativevhdboot_x64.dll unpack001/WinNTSetup/Tools/nativevhdboot_x86.dll unpack001/WinNTSetup/Tools/x64/BootICE/BOOTICEx64.exe unpack001/WinNTSetup/Tools/x64/MSSTMake.exe unpack001/WinNTSetup/Tools/x64/WIMHost.exe unpack001/WinNTSetup/Tools/x64/wimlib.dll unpack001/WinNTSetup/Tools/x64/wimlib/libwim-15.dll unpack001/WinNTSetup/WinNTSetup_x64.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/WinNTSetup/Tools/imdisk/sys/amd64/imdisk.sys
File Explorer
-
af31149f2cf96b17b3f66813034dc4b2d5dc30b51731cb1b7a4962fd9617431a.rar 1.5MB
-
WinNTSetup/Compact/WimBootCompress.ini2KB
-
WinNTSetup/DISM/Sample.ini1KB
-
WinNTSetup/Diskpart/BIOS.txt1KB
-
WinNTSetup/Diskpart/UEFI.txt.vbs 1KB
-
WinNTSetup/Diskpart/XP_legacy/BIOS.txt1KB
-
WinNTSetup/MinWin/Default/AntiLog.ini653B
-
WinNTSetup/MinWin/Default/AntiLog.reg621B
-
WinNTSetup/MinWin/Default/Options.ini50B
-
WinNTSetup/MinWin/Default/Reg/Explorer_LaunchTo.reg328B
-
WinNTSetup/MinWin/Default/Reg/GameDVR.reg366B
-
WinNTSetup/MinWin/Default/Reg/Remove_Gallery.reg372B
-
WinNTSetup/MinWin/Default/Reg/Restore_Photo_Viewer_Windows_10.reg23KB
-
WinNTSetup/MinWin/Default/Reg/ShippedWithReserves.reg328B
-
WinNTSetup/MinWin/Default/Reg/StuckRects3-Win10-200X.reg624B
-
WinNTSetup/MinWin/Default/Reg/SysTray_ClassicVolumeControl.reg310B
-
WinNTSetup/MinWin/Default/Reg/SysTray_Network_Flyout.reg428B
-
WinNTSetup/MinWin/Default/Reg/Taskbar.reg514B
-
WinNTSetup/MinWin/Default/Reg/UserSignedIn.reg316B
-
WinNTSetup/MinWin/Default/Remove/Active Setup.reg2KB
-
WinNTSetup/MinWin/Default/Remove/Defender.reg444B
-
WinNTSetup/MinWin/Default/Remove/Defender.txt510B
-
WinNTSetup/MinWin/Default/Remove/DrvStore_Inf.txt2KB
-
WinNTSetup/MinWin/Default/Remove/Edge.reg166B
-
WinNTSetup/MinWin/Default/Remove/Edge.txt543B
-
WinNTSetup/MinWin/Default/Remove/Fonts.txt3KB
-
WinNTSetup/MinWin/Default/Remove/Installed.txt1KB
-
WinNTSetup/MinWin/Default/Remove/Languages.txt7KB
-
WinNTSetup/MinWin/Default/Remove/Media.txt238B
-
WinNTSetup/MinWin/Default/Remove/NetFX.txt821B
-
WinNTSetup/MinWin/Default/Remove/NetFX_Keep.txt2KB
-
WinNTSetup/MinWin/Default/Remove/OneDrive.txt224B
-
WinNTSetup/MinWin/Default/Remove/ProgramFiles.txt1KB
-
WinNTSetup/MinWin/Default/Remove/Speech.txt102B
-
WinNTSetup/MinWin/Default/Remove/SySWoW.txt11KB
-
WinNTSetup/MinWin/Default/Remove/System32-DLL.txt55KB
-
WinNTSetup/MinWin/Default/Remove/System32.txt2KB
-
WinNTSetup/MinWin/Default/Remove/WMP.txt1KB
-
WinNTSetup/MinWin/Default/Remove/WSearch.reg276B
-
WinNTSetup/MinWin/Default/Remove/WUAU.reg225B
-
WinNTSetup/MinWin/Default/Remove/WUAU.txt334B
-
WinNTSetup/MinWin/Default/Remove/WinSAT.txt52B
-
WinNTSetup/MinWin/Default/Remove/Windows.txt884B
-
WinNTSetup/MinWin/Default/Remove/Windows11.txt1KB
-
WinNTSetup/MinWin/Default/Remove/WindowsApps.txt663B
-
WinNTSetup/MinWin/Default/Remove/WindowsPowerShell.txt1KB
-
WinNTSetup/MinWin/Default/Remove/XBOX.reg365B
-
WinNTSetup/MinWin/Default/Remove/XBOX.txt600B
-
WinNTSetup/MinWin/Default/Remove/XPS.txt453B
-
WinNTSetup/MinWin/Default/Services.ini492B
-
WinNTSetup/MinWin/Default/Tasks.ini665B
-
WinNTSetup/MinWin/Default/WinSxS.ini8KB
-
WinNTSetup/MinWin/ReadMe.txt2KB
-
WinNTSetup/MinWin/ReadMechs.txt1KB
-
WinNTSetup/Tools/CATTrim.ini417B
-
WinNTSetup/Tools/MergeIDE_2600.ini7KB
-
WinNTSetup/Tools/MergeIDE_7600.ini7KB
-
WinNTSetup/Tools/MergeIDE_9200.ini189B
-
WinNTSetup/Tools/Win10Builds.ini1KB
-
WinNTSetup/Tools/Win7USB3/ReadMe.txt494B
-
WinNTSetup/Tools/Win7USBBoot.ini393B
-
WinNTSetup/Tools/imdisk/cpl/amd64/imdisk.cpl.dll 113KB
-
WinNTSetup/Tools/imdisk/sys/amd64/imdisk.sys.sys 47KB
-
WinNTSetup/Tools/nativevhdboot_x64.dll.dll 1KB
-
WinNTSetup/Tools/nativevhdboot_x86.dll.dll 1KB
-
WinNTSetup/Tools/x64/BootICE/BOOTICEx64.exe.exe 489KB
-
WinNTSetup/Tools/x64/MSSTMake.exe.exe 114KB
-
WinNTSetup/Tools/x64/WIMHost.exe.exe 88KB
-
WinNTSetup/Tools/x64/offreg.dll.dll 117KB
-
WinNTSetup/Tools/x64/wimlib.dll.dll 481KB
-
WinNTSetup/Tools/x64/wimlib/libwim-15.dll.dll 486KB
-
WinNTSetup/Unattend/Win10 x86 Administrator.xml2KB
-
WinNTSetup/Unattend/Win10-11 x64 Administrator.xml2KB
-
WinNTSetup/Unattend/Win7 x64 Administrator.xml2KB
-
WinNTSetup/Unattend/Win7 x86 Administrator.xml2KB
-
WinNTSetup/Unattend/Win8-8.1 x64 Administrator.xml2KB
-
WinNTSetup/Unattend/Win8-8.1 x86 Administrator.xml2KB
-
WinNTSetup/Unattend/WinXP Administrator sp3 vl.sif703B
-
WinNTSetup/Unattend/WinXP Administrator sp3.sif703B
-
WinNTSetup/Unattend/无人值守/Windows XP/SP3 Pro Retail MSDN/i386/winnt.sif648B
-
WinNTSetup/Unattend/无人值守/Windows XP/SP3 Pro VL MSDN/i386/winnt.sif648B
-
WinNTSetup/Unattend/无人值守/关闭通知网络使用并设置网络连接方式.txt851B
-
WinNTSetup/Unattend/无人值守/内置管理员用户/X64/Panther/Unattend.xml.xml 1KB
-
WinNTSetup/Unattend/无人值守/内置管理员用户/X86/Panther/Unattend.xml.xml 1KB
-
WinNTSetup/Unattend/无人值守/禁用BitLocker自动设备加密/内置管理员用户禁用BitLocker自动设备加密/X64/Panther/Unattend.xml.xml 1KB
-
WinNTSetup/Unattend/无人值守/禁用BitLocker自动设备加密/自定义用户名禁用BitLocker自动设备加密/X64/Panther/Unattend.xml1KB
-
WinNTSetup/Unattend/无人值守/禁用BitLocker自动设备加密/自定义用户名跳过隐私设置禁用BitLocker自动设备加密/X64/Panther/Unattend.xml1KB
-
WinNTSetup/Unattend/无人值守/自定义用户名跳过隐私设置（先编辑用户名再使用）/X64/Panther/Unattend.xml1KB
-
WinNTSetup/Unattend/无人值守/自定义用户名跳过隐私设置（先编辑用户名再使用）/X86/Panther/Unattend.xml1KB
-
WinNTSetup/Unattend/无人值守/自定义用户名（先编辑用户名再使用）/X64/Panther/Unattend.xml1KB
-
WinNTSetup/Unattend/无人值守/自定义用户名（先编辑用户名再使用）/X86/Panther/Unattend.xml1KB
-
WinNTSetup/Unattend/无人值守/跳过你的数据将在你所在的国家或地区之外进行处理.cmd.cmd .bat 2KB
-
WinNTSetup/Unattend/无人值守/跳过你的数据将在你所在的国家或地区之外进行处理.reg498B
-
WinNTSetup/WimScript/WimScript.ini509B
-
WinNTSetup/WinNTSetup.ini.txt2KB
-
WinNTSetup/WinNTSetup_x64.exe.exe 1.0MB
WinNTSetup/Compact/WimBootCompress.ini
- SHA256 ec6819ce8a0ab377d63bdee71157850afbb14e3afa4b4e79e958f97d6d70a4b7
- MD5 c31c1180e9be8f115f2ca27af1faa6b5
- SHA1 6f13d9548d30cef1f8adaf60b08dbec4d0143bb1
- SHA512 a190d125130b2377cb07d5df5c4b70c97c9243342abaac7f34b7ac671a1a5fd1c8071b7f6ed7ca99b0042c8ee4caf0fcb4743c0ba5f1a4fcd30ae10a2eda2752
- TLSH T1554127ECA336D420C5F48840E66F8BA59724F44BF6A7A77049D134E8FD5205B4A3ADF8
- MD5 SHA1 SHA512 TLSH
WinNTSetup/DISM/Sample.ini
- SHA256 c9c2b6fea3537c5cf06c5a5046e334b9be78886d961c75ea4c627314f40fc9d1
- MD5 3fb99c22a72b538155f060b075fd451b
- SHA1 8d875a424d71a9d179a63c0ffde79eb371bdfb65
- SHA512 232f35c48b93c14de5a41fd8a085aef6b74e6603d31a59dc6796db82db430351cdba6b01d7cedb20a4aa66a0f3ce7c58971f6b68b85a3d27c8d52145ab2b0e20
- TLSH T1BA4155D1DE26E403E97179819C476F96B91F1BE31182FF6011C80828F43FBE7D24A585
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Diskpart/BIOS.txt
- SHA256 91dfac99b31933728bda09fe0cd4117ceb8a3e802155e84dc63f39042599545d
- MD5 9a34853e744b0c84d59c93737cb4cbdc
- SHA1 59731cf2b55d697e6dcbd9f771c4a3cad9cdb07d
- SHA512 466503bad9c9d113ff2e415b0b060994a3d9eac94ee0ed1d9f9d0eadaaf7100c43a11e1f58e86db4633a7b03541ab8515cc6a26b8bb769a4631b2d3297c1d1a3
- TLSH T118119E16A0D2573A4C93860350BEB1B9FA701050CD765068F86FC5DEA326F78C36EB59
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Diskpart/UEFI.txt
- SHA256 7528de99315f8a092d5fbe2f994b0386be6180e830050834092108cd66d1b122
- MD5 0878e4b7937bebda3e7efd8c9c34e216
- SHA1 4f47b3f2af35ab2ad610e49baef88329626080ad
- SHA512 cf2d7b3daee7cbb360ab797eeae2a977a5bac9712bc696bd229c5cf47d2bba5285648cb6451874f7def77b509c1db1ce96b078c1a513396297e753bff006d1ed
- TLSH T13131BE16A2D21636CD63851311BD7074BAB034508AE2905CF86FC2DEF326F78C26EB68
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Diskpart/XP_legacy/BIOS.txt
- SHA256 60062cf813cd2edcf18db92c78b72722bc5a5b314fd6066f5326bbbab51f338d
- MD5 1c192a1d87c5e85d52d7f61dec39a959
- SHA1 b8888c3cf18831a0aa04728989f2360edaf97e59
- SHA512 f0a54896dcce33d508fa261bb472ff5cf877e34868c65121fb309c9093f324310cfa5cee87b9cbcd4d7b657fcd27bda9fb69109a05ffb41452a91224fbdd3179
- TLSH T17F119E15A0D2563A4C93861350BFB1B9FA701060CD665068F86FC1EEB326F78C36EB59
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/AntiLog.ini
- SHA256 e9030a9189ef0104a1bbf7d30d94003f47f7e9ee288ae5657af8da4a50dfc68b
- MD5 ffa13864d796480b3f5f0b86ac1b2a3c
- SHA1 37c344e7cb41de20b4581c519abee636821fe021
- SHA512 4c48d300c9fa6dce66963910de805bdf8c8a17feeb78cadec26428db43cc4634dc7d8aed57fe586d0a7a607a6098f81b9b33dccc30a13214edb7059a3c8ef84b
- TLSH T1DBF02B81D52D841AF0743018079BC702757AF6EB7C46AB0002E1E96EED8220EC29EAA9
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/AntiLog.reg
- SHA256 6da69a36c8bd5942ca77c8566c9395acd56b391e6b5ccd1c4ed1bd3e93fc4618
- MD5 6b4d1b828eedf012258e03353d8ebf3b
- SHA1 d023899c233631f065c8cd6622b1a2cad90cc293
- SHA512 51a9dc93f29255f49d1f0b72318d0ec29e2fa8d6438bd829b16cbd516d2cfc749763bb72c8f16656a0b1cf0bd29572012063f94265409c40af61a7739b3ab6ae
- TLSH T141F0FF364922C08AD1A1B1000A66B9D137F87A3725CBEF1010C8928237E3DD7C0AD49F
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Options.ini
- SHA256 d15e86461866bcd2d99208a07f2f6fe90ae9991451c50450329ff9b509394a27
- MD5 beb4679f4724cc9408f805b1047c9421
- SHA1 14f6d801e11df2aaf83af36fdba7bfaa0e649ede
- SHA512 120aa1e610abb366b0ab5a8314201b628568be5e05935e81584662944c14dd8ca9c161e2ae28b09737447b86a6d4e0bfe30c39763d5850f9cdaff71574c6097f
- TLSH T15B900247B31E6BAC0C8200428450018B507BC244622143859077B7C50B82103850E020
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/Explorer_LaunchTo.reg
- SHA256 7fc519582ee0b23bbf96bbfe5b3d3d637ba3dfe64992576c788f158ad24bbfc9
- MD5 034a48b1ca6ed904962637f70ab33bcd
- SHA1 f829cdd2029a873bdd8f33d84959f10452feb724
- SHA512 a9356e2884509a641eae7ca5d1a2f91a51ba7063f1b711c08f472b5a98bcf012d63a67a1da881dded78702f73747feecd3bb530abf52f1cc89d069d9b854857b
- TLSH T1E4E0E21217F28459F6B71B419AF8A55B9A36B8952A38D09D1188870E8CB2B1088317BB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/GameDVR.reg
- SHA256 e3d92cf1846fec5736610a2d52d5a2ad7ee0e6c5ff139c65ee087f188a818e11
- MD5 426796970af067da446e2df5fb853de0
- SHA1 19ec9be4b3818cbf00aa12f3f468cfdec673d67d
- SHA512 9adbc9ab5b859d16e6f92e5f72707bc54eabeba6fac14a49dadb89bd829962457badf0e0726792502e0600b9037f8fa45d21f63f4f19a1fb29dd3cb1bdd923a4
- TLSH T133E08C9227F54408F2F30F898AF5E4AB9732B8A51D64D88E10D4830F88F1B10C4303BB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/Remove_Gallery.reg
- SHA256 0bd32267ba2659f2b70119e7850164420b80ed424cfa24d5debf933e5692d8c8
- MD5 3fa78d8343c0f7a62eb12495cd0d9e9a
- SHA1 13eecd7ce24961ef763a6833186bcfeb04801943
- SHA512 21da800c7e5a07fe0c477e0228d05e2c5955b5a858584f2658a1ae69a94cc2fd092dccd145708e8fafc7680433de03407bec3356a3bc4a7d24e2813f9eb111c6
- TLSH T106E0862936E44559F2F7DF80C9F8E0579A20B8A51E14D99E11C4131F48A2A12A921BBB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/Restore_Photo_Viewer_Windows_10.reg
- SHA256 13ad818ded583833fe1a93641f0b090b0b427579d9e8d714252f4aa683462ab2
- MD5 f20307429e49d4ae9c9173c25f31a28e
- SHA1 bd07e1348e37baedccaf90979698b8214cafd49b
- SHA512 9ab5eb3f1ae720e2e870d3f51ff83c57169513d52dc6eabfe9de35c03cfcb3a302aa6110a1bf3224ba0ecb44c9b4173785f8d04bccbe40fddc04b6de3ccc8199
- SSDEEP 384:Vl5MFd5fkZn5+r15t0c5yhirl5MFd5fI95kFdqZn5+r15t0c5yhiul5MFd5f495d:cITnE6G7
- TLSH T1A2B28D7AEBF6254593739EA8DFE34423FA6A7413352DD94900C31B090491A89F4B27BF
- MD5 SHA1 SHA512 SSDEEP TLSH
WinNTSetup/MinWin/Default/Reg/ShippedWithReserves.reg
- SHA256 c97fc52991e95e2141e43052c0e236e4611350d2b2346892c439fab09dbe328d
- MD5 0336e3b46d90cbc76a84e67970bb6412
- SHA1 8973bb426f948f90bf46c969c5ce2acb8fa5e5a3
- SHA512 b749cc1ab3d0c5cd1b05dcce3bb4a70be9c0d502872432142f4bc672694b095d1d02d20b93d9bcd80289611ee9003f1ab4435ff1029de0dfaab5f1befc531ddd
- TLSH T190E0C2020BF12809F2FB6E8506F4E5279B33B9841D69C08D11C4430E44F0310C470777
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/StuckRects3-Win10-200X.reg
- SHA256 e53a759828909e1ccb2e5c97f7ccdac2f8dbf248e1173752a94377fad62c7282
- MD5 6c2143d12e9af127fdee7939bc1da61b
- SHA1 8d33fcbcaef150d12b00a4775637910f9b0582bd
- SHA512 d51c02355e4c10fc58f965a2a29a18080b4f7ecc5eb8dab2dd06d4bff43e961b83b295b9070a9a15743e6237eb685e9697dadc1b0c21cd6ea72716a0d590cc3c
- TLSH T114F03012DBF1441AE2B24FA5DEFA842786777847293CD48E01C4070A05F3A4484217BB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/SysTray_ClassicVolumeControl.reg
- SHA256 f1c22064dbc6d9fe467973714c29fd98b44bf364c9c1ae3c3df82b23ca704ae3
- MD5 65c07daefffbc2a6756920f35ed8b589
- SHA1 5023e7b55c37885fb1cee7d0152c2c204865c984
- SHA512 cbbb4ce8171e3670087d0efcc88b3b1fc000934f9ba985175f0815043443cf6b860dac334bec7acf872db34fcb181fcc4e929cbcc7e23b323ab030a9e5389253
- TLSH T190E0C21107F01409F2F31A854AF8A91B5F33E9A41935C88C1184834D49B0B20887077B
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/SysTray_Network_Flyout.reg
- SHA256 37671441e0775a56a16329e9fa3e8c88c51562c25a6851e644e777d3cc63fdd7
- MD5 52af0727764f3404b37fd5682476ce0f
- SHA1 af0de11a10f12a50b0996f2613d2334e57bf1d08
- SHA512 0a058efb764492d33bea150c2781833e70b2c6047f9587cb20ae287f6b1950276e684920a59d709188928d425c81369fb8ee23a7b28aebe8ec8a6e04f6b0c7d2
- TLSH T135E09A010BF22009F6B31F955EF9E9178A36BD941D29D0DD01D4434F4AB0B94C831BBB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/Taskbar.reg
- SHA256 8aadf23860220412ced3cd763fe44290106bc91c19e316520534851287fd6ba6
- MD5 7eda4bb7149c965adf787b847522ded2
- SHA1 3eef5912dd5ab3e4d1b94a4409ee8dc4ff7fe250
- SHA512 f3555c29a9448f2fb28d6727e6f879be654582728dbb2fae8f90fe6490380969d3b8b96779dad34cd234f87b6c187db9f0251d9b31da657c606920c8e89acca6
- TLSH T1C2F039070BB25409F6B31F8559E5A47B973379492968C0ED10C40B0E8DB1754D4B07BB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Reg/UserSignedIn.reg
- SHA256 b4e1ccbe425bd918638d4df6d7bb9acedfd5ffc1f9a8ea211841f95a7a6b8733
- MD5 ab24991d7d8e966b0899b3106555cf28
- SHA1 f64263af21f56ad95c3e9d5bbce482120c12a34f
- SHA512 4b6461d69706bf0fd2360cc7a4bc40550bbc1748a82ab33425a65066984b55f6d97813b35511d2aae614069baf9025e2e76b831de7d1ae9e726cd82dc385bf01
- TLSH T129E012111BF58419F6F74F45DAF8D55BA636BC941D38D09D1198430E48B1614C4317BB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Active Setup.reg
- SHA256 a25a61070ce7b3db7081b2a7d8a246e0f457effa9f57e558cdccb5348848b37e
- MD5 14c47a68966b4d778ad6175e3f50198f
- SHA1 f0928e5834e4bc538f7f2334aa54e6c42b5ff62e
- SHA512 07397388da6fd5c14dfe89d7c59ed87a5b297580b6feb238b396f62bb5ca8ffda4f1d7fb2c26fc0503481e951b516e459e9dd6ab660f8009594c76f50cc89f56
- TLSH T1B6514D1276F4111AA3B3AFD5AFF495228B3BBC691D1AEC5C0190438D09E4A50F871F7B
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Defender.reg
- SHA256 4ba2b0cad2d5bdf8068be66bd71559f4e7314a53fdabdeec4dae41873f23d3d2
- MD5 783df74207682b151953da1d5c5bd9ee
- SHA1 42ea46897db719a5e1d0c2518449faa7ac0aebd0
- SHA512 43deb4acf271b1b102966912220f303711b54ebefa89b20d566968d1707ff053314f763a6682e8f4375f8a10d6ef4f2980953d96fa38d2b5a0b34e6d6dfbe1bb
- TLSH T1CBF0A05308BF8166843298051FBAE4C23A28C2227347EF0511C0A89276E2CCB452E19F
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Defender.txt
- SHA256 0349b644229edae72c5ebacaa7cc608e6df9ab07bcb7c18d45b2bc5e34e24231
- MD5 a996744f2ab509a5b4920a4dc71b1ba0
- SHA1 e9def617173f79e282a60273ca90d87e19b15649
- SHA512 f0a5032eb606001a2fb777429d4054ea00159a6eeb33ff3b85b18126dc421f4d6ca51c5f6ed75ada308a3c154aa16682fc59405d76194964744cef9ad79a9849
- TLSH T172F03AE8A33FD0B0D4B11C40835E6E1B5321F41AF20BA273578062AAF88154F4B25DFC
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/DrvStore_Inf.txt
- SHA256 5b725c62d24e08c24278fe674a2bfc91c9e5031b3ba8eae3b8eb468dcf2f9dfd
- MD5 16a7daf0cb272f16ff38870c968fd6cf
- SHA1 73724af1573cd4ca29f99d70ff72e76b86e75d6a
- SHA512 365d3a515c0e0f5f5cd55008b0fc12377e0b5ccd1d8aa4dd3cf00950636f552972f76b7f2a3d36b08df8284f8df2f688d9fb28649c0534f0a8a9d4a0e707e38a
- TLSH T1994198EEA3B55613C0A45B46A30F4BF14716F0CEE3FA9AB144873081FA5851A8724EFD
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Edge.reg
- SHA256 3685f8602269bdb280f282a0ca0faf94538af2dab6ea413d231b604d9bc91821
- MD5 5973e6637c6f517e8ac2da0570369364
- SHA1 ce56bce30ccab3dc5cf816998f96c0a782c0e5ca
- SHA512 05d657a4cbaafa87e6da8217ef226d097fedfaba826ac3f545edd1adfd6b569c1b50b329f7b355b773d092fe2c16167bea2c4074312ed7021b867a35bed8850e
- TLSH T148C080F544108006D2A3B110450679537BF9751668C7C910D4C4918535D38C7C3554AB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Edge.txt
- SHA256 2176bee939025fce0eb0e990e2c828df6894f62fb7005cfbebb8350bdf589eb9
- MD5 fd872ef2ce187adaf5b510eede5ea9b1
- SHA1 c21d8b213944d60141d7473ba8ab0cbf5a5f04bc
- SHA512 359b90c98bb9b496cced22dc9871e8c1da48d48a219701084141b01226e4cef20233003898f6ee8a5e87440b605db9aab181c3a8495cb58f17163d4a68453bbf
- TLSH T1CAF014ECE265C4A1E3B03CC063268E206324F95BF181EB3251941A85D8836CB6B26CF9
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Fonts.txt
- SHA256 d5153f1a47162ecddc3d71a797aa3be8358974266eb2d2a318a09e1123def8c0
- MD5 56e8d4f5f1c425ebf3e85650bd451321
- SHA1 52c6189463d92184810d031acc227b6ed2466520
- SHA512 249e7ccbf928fa695ecdabdaea656b10997d95b459978743c9f3a98f35157c139508c71cb8431df6c175cb9138d2c2a48d02e0e0ec6047731dea9958e7bfa378
- TLSH T13B617BB8A874C11AC5B8ED44369F47A3CE19F805BAF6D90B0520E4ADBDDF1930C7D9A4
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Installed.txt
- SHA256 712644daed4555e1c824d41c2cdc4405cdc8180e188aa178f3cc9499e8f568cc
- MD5 8d5d7e1cd543b63e42b24e20dbc9848a
- SHA1 437f0b15625d47837e7792acb494e4619d1c98dc
- SHA512 9c130f82021eb49e3ea9f0f7a738bb7cd8f91ca934cf692f030fbb8426403bbeaed647287ecd3fb503f3c7d82e58df6e695f0b417ef704d0a18435bd5efe91b9
- TLSH T1513126C5E826C1E1B479389173930E106525AC8F7365A7A12284EB5FE4C2B59A37ECE2
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Languages.txt
- SHA256 ca533a9477d0b2617b5edb0a09df5108cf869e86fdcfd8689f6224bc52006181
- MD5 b99d25b63876f014d928f882c46f8ceb
- SHA1 cfb1e0e1e527ff589da457289e1847b15cc8096c
- SHA512 fbac9bb8059c65e91b2811976992df5a827e7f233c0eba8a384074b14435c5f3dd2dcbec64a215eb60aed2ddfa98099d14efc4cadd1ff93d4073daca45af3615
- SSDEEP 48:AxEprOWFi4ESwm5KYh3Xi/63ETw3f7G/I3Eho5uGlE9zySXEfeBNE:c4yWFiyRXi/oPBKglo2SOeBNE
- TLSH T1EEF18AF551305126E0305C70ABABA3B59FA2F61EF07678FB4218A790FC180D716957FA
- MD5 SHA1 SHA512 SSDEEP TLSH
WinNTSetup/MinWin/Default/Remove/Media.txt
- SHA256 8ce8d154cdeabfde524396a94b098c08503263ea9686ca43109a27f9b99d7d61
- MD5 7265a8adf5ab144a65022e58d5689111
- SHA1 67b627a64b0a33943eb624634c19141ed7d8082a
- SHA512 58c28564a4d9e139e19f1be9fcc275589367ac3aba596a2a03f8174e586664db4f2c30c5d06f18462501a92cd125839a90bd8516ddb508b2e9f723ee25b5ff5f
- TLSH T10DD012E8B0B20A02DAB51DF535DFABA33708F1407313A941E7349917FC5A6870A1B6F6
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/NetFX.txt
- SHA256 b5a0135292437236b049e8b0afb9fa8a393ea02dbb8d27f734eb51011248e1b0
- MD5 115ef7c2c59ea4dd2db5c949321a8ebf
- SHA1 251ae6258d38e151ea5c340390db9a95a4b34b83
- SHA512 6f8b320148fddbe266c2bda4721adc2dab8ae6944ffe4277a9a2123de913e886dba03c6012172ea65d15330dccd64e1d00cdecb2b780c2c467d0aafc93820eaf
- TLSH T1DE0156ECF2398062F2F16C80670B9F58831EFA06B74653212524668EE491A171628EF5
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/NetFX_Keep.txt
- SHA256 089299f0dd505809bc916dd18a9c8904138c4ff876abff89681ae6ebbf78b0ef
- MD5 68386cb40a4c892fae36b0af6290df0a
- SHA1 7e183e9826d89ba69172232ce255a318f9db8fe9
- SHA512 8245127010feed1191727669807e0ca09fa08a302ad14d9431d1d5337c6919e919ce1e054ae182523131a8ca7ebe4dafa5141e6de96f18857d9257bb5574ab7b
- TLSH T14751466C913E8975D174387179472A49730EA38B7006BE10A1D9E867FDB3BDA4A007FB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/OneDrive.txt
- SHA256 2fc3a64d4bde17981ea3f041e6e6e9504f7553584978161261e153e1348bbbe5
- MD5 5c4d2fe8548d3ef9a318f55bd64f3e5c
- SHA1 caef862120b3f51d7b2cc7c73580a51f6cda68d4
- SHA512 bac216c6c670bd20d3730d19abf082e06264ee6740e8b60ff46d787425090b3cbc5fc4fd2b6d6ef5828483867d3e1919f73eb7f880ace1c0c79ee90888433ec0
- TLSH T152D0C7FC9230C959D2A22848825F9B184250F54BB141A732049431D8F84BA8F66E48E7
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/ProgramFiles.txt
- SHA256 784ad9ee34957bf4d37a89219a3563db6db1e83490e34e047ddaf54a47670263
- MD5 4d5c2fcc273685b60fa9c0cf1fd44988
- SHA1 958f25f0d221399e9c6b53e19894662be8e023fa
- SHA512 6a2cb89954353197a8a3f071c65a097e4ca0f596c4accb6130f76f4da6bd13197a137826007c92bf131491782b9b8d6aaa7e8e5a134792e18eeffe4acfd68244
- TLSH T1323163C1E431D0D2F1B335C0178AAF0AB148CD4A778DA667668CA71FE88AB62D47D1E1
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Speech.txt
- SHA256 87cc3cde964d7a91257f4539c2b1e4bde6c7ebf161d4fb8f43256175a2a803dd
- MD5 7669151975cf88145ca4a4cfcb7aef51
- SHA1 bd9f6b649979ff2a8e1e25bb2ebf1e74643ec165
- SHA512 b468a56cb336c2c755a9b315b6047037dee76c679d4463ae03fd1e046705d4bc8f8497398805df1152f4ac691976fba5fdde6386b7a57b15a690104e5a2a675e
- TLSH T1B3B002FA72F84312C0A019C5430E67B09A90F595AA0264B413402194FC0004A465DCBC
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/SySWoW.txt
- SHA256 49b97774b210a0a55e56f19a9da0b67e5ee6d0aa8757724742605c000ad66ab3
- MD5 7cbcb5c3a0aed91517c7ad6d4fbbe6ff
- SHA1 e10e406203b4d21fbb7feb29a3567a14a08d103a
- SHA512 e61409b0f8d5c453e5e10584558c294be4b7df0460576f454668f46ee9897c5d30763a9b597b1aa70899b7186ff4e1bb5c694ba31eba458f12859da3461ea006
- SSDEEP 96:7ZpPUkQQ47xy6VKrFdwc+ytXoNOpqg4WQkO8Uo21Q8:7RQt7hVYvwcRuI6kSh
- TLSH T18B324ED991372895F030397027BF2A6DFB59B237B6207AB8142521D5FCA739709403BB
- MD5 SHA1 SHA512 SSDEEP TLSH
WinNTSetup/MinWin/Default/Remove/System32-DLL.txt
- SHA256 c3ffe15236a96e0fe2084d02c9b545909b3efc6c90608fde0385b9f94e563eef
- MD5 a6b655334239353c41cf650d8b975fb4
- SHA1 906e2b417771256f5ca20172e692cdae7d3058ee
- SHA512 ec9dd578ba3a7a8ac7801da0c3b0832c738ae4776a9288afaf61b72795296d878760c82ed86fd644d6a289f85ec4395b5a0aa6f3586eae703c1f9c71fd22117e
- SSDEEP 384:DAhbGqXFQoPYVPEYQiJR0RR1s2oCwdqntbFWBIP4sCrRtrwSev4QVr:obGqQoiEY5+S2hwdERWcarRixPr
- TLSH T1AC43A2FDA7798425D2F40DA0AA1FDBA89735F01EB682B73085A534C4FC5A04F5A60CF9
- MD5 SHA1 SHA512 SSDEEP TLSH
WinNTSetup/MinWin/Default/Remove/System32.txt
- SHA256 f81eee3e27f5087e9b4bf5cd9f3333629874ff68778517d5abe56b94218e86de
- MD5 e1007249e239e132d94d3db39cae5fa8
- SHA1 a8f8f34fb5e2e52d743af0b1eae49b15c7bbb825
- SHA512 b6c81c0db083cd6f938eaf875cc7d8e450856a16844504a3bd1c5aaba51ab56bc5c1a2002bc47375f8a0c5cdee4d151c34a9023bf598ea466fcbbb3076cb620b
- TLSH T14E51D5D9A2399162D5F23D80438FDF18D260F94AF24AF73704C4659EFD0A6078A79CD9
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/WMP.txt
- SHA256 cf1b158d598b21f704e03dc6210519101626ef921583d7f523188d6eb9527880
- MD5 1dbb1e2eb35d482c1b4bdcc30a2db24b
- SHA1 f0eec958816bf9f2842b552d280f40ccd15c4772
- SHA512 efa4819a1a741b2b358403d5d9024dfd1a527fca77a667c3672ec7610c4fb8cb39bc14cf994b65055095aeb77a7e5e898558da49f4cfbacba114e03ef006f285
- TLSH T1CB111FFDA37AC421D6E45C00DB0A9AE9E265F50EB616F63492D531C4E82911F2B21CF8
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/WSearch.reg
- SHA256 cd6b046e3808bd52ee6ef4857cbc0c8dec7f75cae880380839be366b7e36d6e5
- MD5 f23af77c551f1ea3d304160a47e4c426
- SHA1 16a0701552bb13d829654fc6fed2ddc810e299bb
- SHA512 1ffc0c8fde1f666a66624a35b3d39ba7926ad6aa4228fe806309ddc72ede49e1cb8327dc242452097c01ec18e9062d8fa0c68f6adaf70d5a48b11124ef37d729
- TLSH T1C0D0C7A3087B82AF823348000FE6A4C23A65B02263C3EE0400C4A84239E3CC700AE0AE
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/WUAU.reg
- SHA256 49a2bbad2623eb597a2b7a1fe769491333d2125e67f8e86187a02453aa2aeca7
- MD5 00ae326ca1cbabde2ab752d79474c42f
- SHA1 496c5c48e83e29bbc2fffd9b0d925957c9d01bcd
- SHA512 39d12719e18e280e6442ca83177cad4c343a43f6913bd715beab970113c137c4b5e13a3840370a31ffec163fbd56d65d1f050e429ddc3ed316266f006d9bf8c2
- TLSH T1EFD0A7930CFB4EA5003644163F35E4C42435A5319789EE0601C49C4235E7CC7063F02E
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/WUAU.txt
- SHA256 34410d5bd1e00204371cef636ff3f088d3895e3d8b3e2b986f6daabb719db21f
- MD5 c0d9b4de3736fd978366d06414010287
- SHA1 8d97e0b5ec2964cd243f2c407ad33750fd06e2dc
- SHA512 6075526a70d7c0fa3f5e0ab1f4b2e0dd5d3cfcc7a9a25946812b10f472a10ee57263e4cbb8f21bb1c57eb24c4a1734f642c8d2e98cbbe2c9896afbe990643d7a
- TLSH T15FE07EEAE332C024C1E20C41931A8BA49732F0ABF546A27410E024C0FD2501F1B26EF8
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/WinSAT.txt
- SHA256 5b419a0540fbffdc703d3a6d11858c2e0ee9ec694c3e3bbe0a0030ea34876c20
- MD5 312894bd852a4f22351d3765f1039ca1
- SHA1 a5de7de6a7ef5e96a037d6e7c98c02342ffaf640
- SHA512 ecb2a5014c0c39bf1a74dcbe96a05d6fd94c4bc93305cba49793bb2b359e3cc32be5e74e92ede60962bcb75c1ca04462d4a78922ebc11b930caa3dbcabc427b4
- TLSH T12A9002A5D7B05112C0B01D44428A57925616B255B041962645712041E80101A0658D98
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Windows.txt
- SHA256 14a2019390703f5d18d87d2030dcf2f16cb92952bd95a38d8bebc0d0d1c54d5a
- MD5 e8d841c7aa4bdab88e5d34fa826bd880
- SHA1 58b6503a6ef169916c876256c713f333544d1ed8
- SHA512 e0d4ca041156c2adfb193df42dbebe8495fcbea55228bb4601dd050c4aa08f011f7afa3cce4a4d734bc4aba43bcbacf67fbac58f08b4d1d517802f434fda5b36
- TLSH T1EA115EEDF17801A5C5BAAE2A3F4F8F531B11F194F20B5572169118C4FC95A8B0361ED4
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/Windows11.txt
- SHA256 30de61b485d4cf82e3c01926c188989cd36e4c7051e74891d2cc7db8db26c24f
- MD5 8080d247323e2f15154334b8f5baf2c4
- SHA1 16463d301c579102c212b576479df58ae56d406a
- SHA512 224e05a675b869c14066151b41b8f94d623287d6ff06d4c5a51b6db1875f01523233093704a7d27d73ae6fbef0bc6c7c45dafa84840670de20959e61f6e51283
- TLSH T149415DB18A6A9171C1366C61D60F9769B634F09BB119ED3115832084FC8329B6FB28FF
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/WindowsApps.txt
- SHA256 97cfcc1ab4e1ea595aa283f4b05f2a9d8df3bcd64fb6ca2085f7d39ab35fb5ca
- MD5 2e138e8407c66c6035a74f381fe77d63
- SHA1 3b725f743a68e8be65c3b4e98cb23f62cf518432
- SHA512 8fb8c405ace510f021b7be29056d556204c85bc1a45b23a29ce6e69188cf573319f9d7f1bec59d299fdf5cc9fedcf3db105a7dcefb8dadd6cf6250e44312d43a
- TLSH T12F01D6D0C922D852E0773C9153CF5F91B624E54B3504A9B23285C20BFD53BAB4F281EE
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/WindowsPowerShell.txt
- SHA256 693eca763c8ea4ea4d316b45622f531d5af2c95eb95d2fb9ee950e9967907e12
- MD5 3fa7f12fc5085be995240fa685f2ba08
- SHA1 f71902f147e13a2d5e06c8d3e5b1cea94429bcf1
- SHA512 7b6c2715eb09408317d0b966a099ef9e91ba075bdd3644b67d175547f840ef004fad873a079a27794488510a90d882f0a01b47aa9dd5e00776f5303af13894ac
- TLSH T1EF214EBD9139C266E5F63825228B5B05F31E978B714DBF102294C167FC63BA2C2146FA
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/XBOX.reg
- SHA256 e7dcd63524e0be92ed40f9f45170d68b6cdf387225add99e09a49830619b7d56
- MD5 f2bba158e3f07879cce1c4844b7a6080
- SHA1 51e88cdcaf5ee469c0176bebb932b18a2f3518a9
- SHA512 c758f93f2e9dc2a9e0b78698eb17d4f051c5fb2ccdb63920a9e5135f6a7b45d5076cd80657f6e8c849371bcffa72a23577347c44bbb5f2a1a6e6efb9faa3a669
- TLSH T1F3E0DF931CFB4AA2802645262F36E4C42425F532A385FE0A01C46C0635F3CDB063F12E
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/XBOX.txt
- SHA256 4a7c64cf7ccd95e44ffbc2514a6f234e1086ffba9a308d7e703620851deae08a
- MD5 ead97849c013ba9c8f7d5b8780be86c9
- SHA1 90e44dabaf9dd3cf76e075de732d583112615f34
- SHA512 1ad97f9f04339a1174053ba60ea43f4e4ce295983bd27979ed99efd794731caa7622c62dcddd2e1f00b9b730fdb8e5f47929798346cc62fc608d7bbf01f1d694
- TLSH T1ACF0B6EEAB704060D3E91811434EAEA99321F51BB202B735016432DDFD1318B0B22CFC
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Remove/XPS.txt
- SHA256 5fd351e2ec123e6092696d9e3f8ce9bf9c001613873e9e8da447601499468cb5
- MD5 c2e9bac3a00f144d2259b63535ad85e4
- SHA1 9f61ead136a5db66cc5f81b21d1bd6a621bf70db
- SHA512 ac06bad9a0d1f8ead4e660e1e82e3481552f3ac034429790beb31b772843829a9d9cf8d643e01a7eb13b90388e3ed48832dfc99127a17d9a6b19bc838a28d950
- TLSH T1EFF012DDB2324562F2E12C0C831F8A98D355F547B292733100A021E2EC53D9B6A20CFE
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Services.ini
- SHA256 b41c25544100db5057c816c1176332b4b499a58c3c8f4f8059cd262b3b7e8913
- MD5 8dc12e210db9591cf48e48c67b06918a
- SHA1 b44be2d421bef36fa7ecd2de5f30c007b179b141
- SHA512 35cc5a075789993e630383709f1fea0a7bfc3c07ebc91724efe9430f75ca9e5b1948cf64f23f92a71c46b82ba0869befef0c5eee049c0afaeb28683acd636968
- TLSH T141F0DC26E5EB05FA809C3D22F8139902F25E37024511308866FB27897BC9D4C2DAF59A
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/Tasks.ini
- SHA256 f026474a283e5cde614027ad2cf794b216aea02104a7fc9a91ebbfddcef2e2a5
- MD5 c644cb8c37a4c1adac7a248e98e2dfa4
- SHA1 59bd15d858ad3af2abf1daabcce00180851c0b89
- SHA512 4d2048248691181c74716e42cc4ebd1dbef0a18d94b89a1ed15fb30d26ee2753a4a3e9fe47e6016052e87a35e0e8a5c4e9ee220603581ca1e9c124466d6fcb02
- TLSH T1AB018C8A967CC127E1397C59908F0B4A2B0DE2833456EB020591A1E5FCA2BA3C62D0CE
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/Default/WinSxS.ini
- SHA256 f79cf2a5adf4d6a4aabe7ae072095986a7b9b7626b1ed22a6f6bdc59e7dbdee9
- MD5 fa21ab3fcbcf38437deec1cffa1fb55d
- SHA1 253b73f14d497afb28bb62b171e58d47ba22620c
- SHA512 833a10c2b3229619ea3f74eac78b25e1c494b0ec8f96a6c5360f7ec2468bb08268c8918ad586bc4d332a32ccaba65c4306b4cbfcc79c7d3f0d30ecb1e573146e
- SSDEEP 192:LWe4dKA6jOR8AnAmyleE97BZt1AtV+qKK0DEBY9vw4b3CEw:LWe4dKA6jm8AnAmyll97BZt13K0DEBYg
- TLSH T19102566499375783E3B42CA063FF0741FACF522A7443A09D77ED3065FE961ABC2219A4
- MD5 SHA1 SHA512 SSDEEP TLSH
WinNTSetup/MinWin/ReadMe.txt
- SHA256 a04d022aa814bf93c6f47ce4eb1e9b1cc3c15dd4d8afdfd6f30a5cebacce28db
- MD5 e66c4dafc4aa1017343961db532c801e
- SHA1 fc802699632c20e54ac379fb4f4bd485683a1af0
- SHA512 770dc521ce968d4c7d1d2f333bf99f2596eec1506b6c21ba619bb77b8631b313ca3006e4026d0863e278a9206b4a448e290564f9429c967db2c8b4b704439a98
- TLSH T1314185BBA59B56A5182170E2717FACCAD72CE07473D29660308B518CBD5246307DBCFE
- MD5 SHA1 SHA512 TLSH
WinNTSetup/MinWin/ReadMechs.txt
- SHA256 b983b7b5c9294af350f2170c33b6caadc6847cddc2aab41e88144181947cb270
- MD5 85eb52cdcc128d8bf227a6c47507dd1b
- SHA1 3d793c217d6ed6b793e5e11f89c279e3c2089115
- SHA512 173100fce0d929d5aac211cc81096f42082f76074d9b2ea5800a8d93988ba410f28a6a0cc5145cff2774e68ecf0e4c70d13c5d411e66d4d5266542abcabcbe44
- TLSH T10E31666660636152DE18A460F17F0EAE95A7E5BB32C03561315D01D0FF0013719762FE
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Tools/CATTrim.ini
- SHA256 376e88bbfdc51d60c1264ec9a11baa0a70b54c6caa9e98c4702f5f9fee4bd02d
- MD5 a4742ff448db61deefdfd03a5a5a73f9
- SHA1 73108f0e0232ba441487d5a6f7872bf8a37565f0
- SHA512 448ca31f2092d1cae30c51d3a2944416577620d842e1c4a6ba8bd9fb0d855a1bd3da9b1e6d4685316b2abc0b51de32f31d1aaf3e8c6a6e59ea8f254c4fc2d6ff
- TLSH T12DE0D88ED0A72F51B50747C867610EDD501B10023778277C666165CD1DEB00FDB8A331
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Tools/MergeIDE_2600.ini
- SHA256 c26402ad4b1f8c53fba80f730750b498510cb8959b5268152d3c2d04dacf40c4
- MD5 c838c51ef3ea0e8572d5778a81cb77c1
- SHA1 c3d3c6c377df29961a18e051e3849aaaba81468e
- SHA512 7ff0558ebf845153b046ec70640a1f4f0df16df19ef2a107d2ba789e714009e932cbeda97c33787c29826175c4b4aaf2616c7494c7c64b1bb95f725e8a7ccb41
- SSDEEP 96:PK1pam7LTihIDh1JAKzE4/WxVeH1mKxUw3e1rr85UjlM:Ps8rllM
- TLSH T1D6F16BA38D7747FA805AC5A83B36DCC23445F16946C98D0F6069EB0234D6DDBB29F48E
- MD5 SHA1 SHA512 SSDEEP TLSH
WinNTSetup/Tools/MergeIDE_7600.ini
- SHA256 9bff6d3f9f0fe1eaca62e4f3a8136da1dbe15077be9c5d7c05a5cd26ad773a1b
- MD5 bb3e0008c8ab841498c88d9b8f6f9f7c
- SHA1 2291dd1b1c04db45f8b2bdcc022e2e473313613d
- SHA512 8af8d65f09ad3413366f4a8b1721958cf3faf9fe6296609506e6ab899ace50ecb07b283e3e10885f1227dd85bf0b6a79d7cb5dc0b8918eb3b4010202f3be5042
- SSDEEP 96:Pt1pam7LTihIDh1JAKzE4/WxVeH1mKxUw3e1rr8ZAnlM:PL8rzlM
- TLSH T1B0F17CA38D7747FA805AC5A83B36DCC23445F16946C98D0F6069EB0234D6DDBB29F48E
- MD5 SHA1 SHA512 SSDEEP TLSH
WinNTSetup/Tools/MergeIDE_9200.ini
- SHA256 0a10b9e53a614433b26ef923cb8c9c35826b3b60ef536a7b74b8c9a9fdd9b23f
- MD5 cb554a4b61036af4a5bcdf4bfb796fee
- SHA1 f9c755ab49dcb79dbea5558df5b8afc73512af5b
- SHA512 47ff89c1eff11e62d50b10e562b278bb70ed577485da6ecb911bb2f240f0d2231a08c348617da7c6b084ff62e22ba03b32722aca99fc65296542cf2d4d646e75
- TLSH T141C022504443C2A7C280A0099B31B28371F2B1943EE99A5221D44D8030C288E018E0AF
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Tools/Win10Builds.ini
- SHA256 b292827a92b0168b75884696d995431058af058e9462d025960050b7cea01668
- MD5 b9dae38cb982520eecdc6c65c91390cf
- SHA1 7b87dffba771cddc2e86603a14aaf3ad2bf4094f
- SHA512 4dac286c6058c1ecffede8f99b26eab318e3123cb25d04b2e5a44442d43d14e03b03e86600fa9e270584d4ed5164ddfaa1866d856de1a69ec5703a8ab0ce570c
- TLSH T1D2214D8A611D590D6D80A9CE2324540EFE423F4F8E43F1F796C289776F8341BD98F400
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Tools/Win7USB3/ReadMe.txt
- SHA256 1db00f059a6ab76f224d8a8798e9a74ea9c5a3fa9318319d0d87c59e60e9788d
- MD5 04b1c15090f4efdb80205fb054649c6d
- SHA1 cf20439b05310f756afe72b4c3ff13ae719ea970
- SHA512 5ccf44810d26519bd385de3619a708203ed97d0a3446357e24c6d3bc1433c83939bc93b883a35f95207ab49765b70df86b9494be2d670155b2d0362f31bf2036
- TLSH T191F02E6FA922E482077B8C0019BDEEC0E4361300FEF3748D68EC9157F941E626F2509E
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Tools/Win7USBBoot.ini
- SHA256 1a68379eaddbf5621a59a3ae2690357225ed826cf0ece5e2ae02e8862c1c7a8e
- MD5 e28ee51c898e15366e0e2c38f1570f8e
- SHA1 e920547b80776fd795a98c30d1d0bd5d1abbeb0b
- SHA512 0bb200298722bb5dfde176ea6189e1c31cf24b8fc3346ac39fae2e4e0a0f1f13ae82c84203fcb8cff576e9f6bf1a317e2ef5893c65a172364fc45bacd51d80ce
- TLSH T189E02B8DC1D2554C2022BDD62D53014EA03F8590A8881743906D9AE21ADCD0DC5C692F
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Tools/imdisk/cpl/amd64/imdisk.cpl
- IMPHASH 279416a3dfe8386ca2bd447389b068d7
- SHA256 eb5b467f230bb85a74620a52f139cc35772e89ea9b8ffa2a64e10f878aa7b417
- MD5 a19a0f76956805a157281a3998f06a29
- SHA1 eb2e8fece8f2ffd2ef605a000fdbfe46bc97067a
- SHA512 5f4a013e28fdb2b67883144772afd717813d96f84d9eb680ad016fd78d0d8cc8061b5dd78d07238fd648c62dd1b09a8a0a752575a826bc1c96cdded84635f9db
- SSDEEP 3072:yQzTkHAMuaNaGnkuXOfJX928aTCbIrNZgN8IKm7kZtt9Ettt:4AR/GnkoyJX88YKIr/grKkkZtt9Ettt
- TLSH T18EB3C602E3E54298E5B6AA705AF50235AAB1BC446F35D7CF0150BD0E3E71EC18C7A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
65024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
x:\imdisk_source\cpl\amd64\imdisk.pdb
msvcrt
malloc
wcstoul
wcsncat
_beginthreadex
??3@YAXPEAX@Z
wcstod
towupper
wcstok
??2@YAPEAX_K@Z
fwprintf
_fgetwchar
strchr
_XcptFilter
fflush
wcschr
_initterm
_amsg_exit
__C_specific_handler
fprintf
toupper
_fgetchar
free
wcsncmp
wcsrchr
wcsncpy
_snwprintf
_wcsicmp
_iob
memcpy
memset
kernel32
SetUnhandledExceptionFilter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetFileSize
SetFilePointer
SetEndOfFile
HeapAlloc
HeapFree
GetLogicalDrives
VirtualFree
GetProcessHeap
WaitNamedPipeW
WriteFile
Sleep
FormatMessageW
ReadFile
CreateFileW
FlushFileBuffers
GetLastError
SetLastError
VirtualAlloc
DefineDosDeviceW
LocalAlloc
CreateEventW
DeviceIoControl
CloseHandle
LocalFree
GetDriveTypeA
MultiByteToWideChar
SetCurrentDirectoryW
GetWindowsDirectoryW
HeapReAlloc
WaitForSingleObject
SetEvent
GetTickCount
QueryDosDeviceW
WaitForMultipleObjects
DeleteFileW
GetVolumeInformationW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
advapi32
CloseServiceHandle
OpenServiceW
RegCreateKeyW
RegQueryValueExW
RegOpenKeyW
InitializeSecurityDescriptor
RegDeleteKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
QueryServiceStatus
StartServiceW
SetSecurityDescriptorDacl
OpenSCManagerW
user32
GetWindowTextLengthW
GetDlgItemInt
SetProcessDPIAware
TrackPopupMenu
PostMessageW
GetSubMenu
GetParent
SetFocus
GetDC
SetDlgItemInt
GetMenu
LoadIconW
GetAsyncKeyState
SetClassLongPtrW
ReleaseDC
EnableMenuItem
EndDialog
SendDlgItemMessageW
CheckDlgButton
DispatchMessageW
GetPropW
SetWindowTextW
MessageBoxW
SendMessageTimeoutW
ShowWindow
GetDlgItem
PeekMessageW
IsDialogMessageW
TranslateMessage
SetPropW
RemovePropW
IsDlgButtonChecked
DialogBoxParamW
DestroyWindow
EnableWindow
MapWindowPoints
SendMessageW
SetDlgItemTextW
GetDlgItemTextW
GetSystemMetrics
DrawMenuBar
CreateDialogParamW
shell32
ShellExecuteW
SHFormatDrive
SHChangeNotify
gdi32
GetDeviceCaps
comctl32
ImageList_Create
ImageList_ReplaceIcon
comdlg32
CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW
ntdll
RtlFreeUnicodeString
RtlNtStatusToDosError
NtClose
NtOpenFile
RtlDosPathNameToNtPathName_U
RtlCreateUnicodeString
RtlInitUnicodeString
CPlApplet
ImDiskAdjustImageFileSize
ImDiskAllocPrintF
ImDiskBuildMBR
ImDiskChangeFlags
ImDiskCheckDriverVersion
ImDiskConsoleMessageA
ImDiskConsoleMessageW
ImDiskConvertCHSToLBA
ImDiskConvertLBAToCHS
ImDiskCreateDevice
ImDiskCreateDeviceEx
ImDiskCreateMountPoint
ImDiskExtendDevice
ImDiskFindFreeDriveLetter
ImDiskFlushWindowMessages
ImDiskForceRemoveDevice
ImDiskGetAPIFlags
ImDiskGetDeviceList
ImDiskGetDeviceListEx
ImDiskGetFormattedGeometry
ImDiskGetFormattedGeometryIndirect
ImDiskGetOffsetByFileExt
ImDiskGetPartitionInfoIndirect
ImDiskGetPartitionInfoIndirectEx
ImDiskGetPartitionInformation
ImDiskGetPartitionInformationEx
ImDiskGetPartitionTypeName
ImDiskGetRegistryAutoLoadDevices
ImDiskGetSinglePartitionInfoIndirect
ImDiskGetSinglePartitionInformation
ImDiskGetVersion
ImDiskGetVolumeSize
ImDiskImageContainsISOFS
ImDiskImageContainsISOFSIndirect
ImDiskMsgBoxPrintF
ImDiskNativePathToWin32
ImDiskNotifyRemovePending
ImDiskNotifyShellDriveLetter
ImDiskOpenDeviceByMountPoint
ImDiskOpenDeviceByName
ImDiskOpenDeviceByNumber
ImDiskOpenRefreshEvent
ImDiskQueryDevice
ImDiskReadFileHandle
ImDiskRemoveDevice
ImDiskRemoveMountPoint
ImDiskRemoveRegistrySettings
ImDiskSaveImageFile
ImDiskSaveImageFileInteractive
ImDiskSaveRegistrySettings
ImDiskSetAPIFlags
ImDiskStartService
RunDLL_MountFile
RunDLL_MountFileW
RunDLL_RemoveDevice
RunDLL_SaveImageFile
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=153, id=1, productName=Unmarked objects,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
WinNTSetup/Tools/imdisk/sys/amd64/imdisk.sys
- IMPHASH ca1b7a99c1db8c685051151b20cecfd0
- SHA256 6702202220268787e361f5a82dae53362c8e6c6dcd240bb01b44dd77ae0788da
- MD5 85e0e6a2e0ff7c2ea46a0ebc9af0e628
- SHA1 66fac892b0c1f5104c3e5da09cfba64236e3b017
- SHA512 1f3644cc0f00c62005a26cc5d2e6bc5d21806770f9dd43933cc5e77a4b32c39f3ee88d15ca588155e82d2c3ae3f0d274e5890c13d9a2a32be992d90026d6be8c
- SSDEEP 768:CuWLlETh9IlP49QX6C431Z7XLDIwsGT82Lq9KPikQ:xaEtm9X6vfXsP2L0eikQ
- TLSH T1B5236C83E1A941CDD9AAC1B6C7E946B7EB31B80467751ACF489087256F12FE0EB3C315
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
5c:42:5e:bf:54:48:19:7c:ad:73:70:15:5e:09:9d:b5:dd:f6:67:8b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Lagerkvist Teknisk Radgivning i Boras HB,O=Lagerkvist Teknisk Radgivning i Boras HB,ST=-,C=SE,1.2.840.113549.1.9.1=#0c10696e666f406c74722d646174612e7365
Chains
Dec 14, 2015
CN=Lagerkvist Teknisk Radgivning i Boras HB,O=Lagerkvist Teknisk Radgivning i Boras HB,ST=-,C=SE,1.2.840.113549.1.9.1=#0c10696e666f406c74722d646174612e7365
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:35:5c
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2019
Subject
CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 5, 2015 - Dec 31, 2015
Subject
CN=Lagerkvist Teknisk Radgivning i Boras HB,O=Lagerkvist Teknisk Radgivning i Boras HB,ST=-,C=SE,1.2.840.113549.1.9.1=#0c10696e666f406c74722d646174612e7365
Serial Number
11:21:42:a1:2c:75:7c:ec:88:72:b6:e2:03:ec:d4:ea:64:91
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 17, 2013 - Mar 18, 2016
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
1
Major OS version
6
Entry point
52344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
z:\kod\imdisk\sys\amd64\imdisk.pdb
ntoskrnl.exe
ExAllocatePoolWithTag
ZwCreateEvent
IoDeleteSymbolicLink
ExFreePoolWithTag
_snwprintf
RtlSetDaclSecurityDescriptor
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
RtlAppendUnicodeToString
KeInitializeEvent
KeDelayExecutionThread
PsCreateSystemThread
ZwQueryValueKey
IoCreateUnprotectedSymbolicLink
ExEventObjectType
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDevice
ObReferenceObjectByPointer
DbgPrint
RtlCreateSecurityDescriptor
KePulseEvent
ZwOpenKey
KeClearEvent
KeReadStateEvent
IoBuildSynchronousFsdRequest
ZwReadFile
IoGetRelatedDeviceObject
IoCancelIrp
KeWaitForMultipleObjects
IofCallDriver
ZwFsControlFile
KeReleaseInStackQueuedSpinLock
_wcsnicmp
ZwMapViewOfSection
KeAcquireInStackQueuedSpinLock
ZwSetInformationFile
SeCreateClientSecurity
IoFileObjectType
ZwWaitForSingleObject
ZwCreateFile
SeImpersonateClient
ZwFreeVirtualMemory
RtlAppendUnicodeStringToString
ZwDeviceIoControlFile
ZwQueryInformationFile
ZwOpenSection
SeTokenType
ZwAllocateVirtualMemory
IoBuildDeviceIoControlRequest
NtWriteFile
KeSetPriorityThread
NtFsControlFile
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
IofCompleteRequest
NtReadFile
SeSinglePrivilegeCheck
IoFreeMdl
IoFreeIrp
IoAllocateIrp
MmUnlockPages
ZwOpenEvent
ZwUnmapViewOfSection
KeBugCheckEx
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=69, id=1, productName=Unmarked objects,
count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=8, id=138, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
WinNTSetup/Tools/nativevhdboot_x64.dll
- SHA256 9e533d246c17994339660a273d3ebcf7db532f440c089cd4f8e103a4d2ac74d9
- MD5 893c137479848a119677a251c390c63b
- SHA1 a72017ba34c83c76fa039c1a354182fe946fd6a5
- SHA512 e6638220ad7413b447d47fc6b571f63bb0feebff9bf37bb204750b191e3988f549c9ef2b8c7c11eb248067f00e42cf9ef1145599ae2443f25cd26a40366ddcb3
- TLSH T18E31C22120D5C1EAD15CE574067B2C14B592752047B2FB493A5844B72A32AF8CF6AB1D
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
WinNTSetup/Tools/nativevhdboot_x86.dll
- SHA256 7319eaa311a8a808f0af09be14ef24182c3fe4ea80e5f84145f4a3829b37d98b
- MD5 2090bd824412787b0dfdaf045857941a
- SHA1 95b066d61531d1f6f4404fdb56d5a70303fc8099
- SHA512 078684c645b9818c28be6ce15bcb00d3454b01c7995faa1532eef4c247425e66ba43bd79b4df850364c6ccb04146937032af1a3e92bd1f43ce447eb89ec05076
- TLSH T17B318B4EEAE041BEC819217806A38BAA3FB03E0116D0D63736397F3A2DAD1B51D61312
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
1024B
Virtual Size
858B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
WinNTSetup/Tools/x64/BootICE/BOOTICEx64.exe
- SHA256 e1cb831ac9213b52066f934ba0fa80ea8a9de48932452d4142fa085a2ba24fc2
- MD5 7ddd108c095016b0e2e8d6b5b04f93b8
- SHA1 3764d75c02c8ce8d2c78203aa9eb7f8018a112e1
- SHA512 36c77eaafed04eb3a337a909a90d4c3eb66e1d36531c6248095906332ea6d03dffc9abd7fbcb3c2101065110e4536c0a89b6320dcab386871b3f9d9e34e40bad
- SSDEEP 6144:4v/DcaTr3TNUkgs01v610dZlfLw8Not8jfCHGSLs/u3fvItKDm1bVcYGz9qA/8qI:k/DfGVBcXfHGSQ6nwUm1q5z9l8M
- TLSH T138B401217E4D96A4C10804744C96DE242272AC22F81A7B1B63DFF74FF97A331DC2D699
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1523424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
451KB
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=41, id=207, version=50929,
count=108, id=206, version=50929,
count=9, id=205, version=50929,
count=7, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=188, version=30716,
count=333, id=1, productName=Unmarked objects,
count=23, id=185, version=30716,
count=80, id=211, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
WinNTSetup/Tools/x64/MSSTMake.exe
- IMPHASH 6929a6376371544b1e02fafed262c6a8
- SHA256 360fdca4daeb6ada1f76b8940af9d509624ace6db03d1a735b2e393c6d2b4cf1
- MD5 64d41e1e1a0410bf669c1d0820ed4c1f
- SHA1 c5e9017f725df051a620d6e565b14e994549f6c6
- SHA512 4c5dfcd8b42f095749d00bfbec2c7c84f9bbaa6a8cb13891d1c7ccb70cfbffa418eb849e64f0c85129eac55a467af39b07d2381cdb98678dcc1dc0e580305500
- SSDEEP 3072:swvKErKi7TeSS2wpdhBMo/VRCMIB9dWIA5TO7Agyh:sWrKITRStDhqcVPIxWIA0A/
- TLSH T176B33916A7A560F9D863C570CDB3A623B73038699378A3EF47546E260F323909D3D369
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
6924
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileSize
lstrcmpA
MoveFileExA
lstrcpynA
ExpandEnvironmentStringsA
GetFileAttributesA
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
GetLastError
SetLastError
RemoveDirectoryA
CopyFileA
SetFileAttributesA
FindClose
FindNextFileA
GetCurrentDirectoryA
CloseHandle
DeleteFileA
lstrcpyA
SetFilePointer
CreateFileA
WritePrivateProfileStructA
MapViewOfFile
UnmapViewOfFile
SetConsoleTextAttribute
WritePrivateProfileSectionA
WriteFile
GetPrivateProfileIntA
WideCharToMultiByte
Sleep
ReadFile
lstrcatA
GetStdHandle
GetPrivateProfileStringA
GetLocalTime
WriteConsoleA
CreateFileMappingA
GetConsoleScreenBufferInfo
WritePrivateProfileStringA
GetPrivateProfileStructA
LoadLibraryW
lstrlenA
GetFullPathNameA
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetVersion
HeapSetInformation
DeleteCriticalSection
GetStartupInfoW
HeapReAlloc
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
RtlUnwindEx
GetModuleFileNameW
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
DecodePointer
HeapFree
HeapAlloc
LCMapStringW
MultiByteToWideChar
RaiseException
RtlPcToFileHeader
GetProcAddress
GetModuleHandleW
ExitProcess
user32
CharNextA
CharUpperA
advapi32
IsTextUnicode
shlwapi
wnsprintfA
PathCombineA
PathSearchAndQualifyA
PathAddBackslashA
PathIsRelativeA
PathAppendA
PathIsDirectoryA
setupapi
SetupFindNextLine
SetupGetLineCountA
SetupDiGetActualSectionToInstallExA
SetupOpenInfFileA
SetupGetLineTextA
SetupGetFileCompressionInfoExA
SetupGetLineByIndexA
SetupGetSourceFileLocationA
SetupDecompressOrCopyFileA
SetupFindNextMatchLineA
SetupCloseInfFile
SetupGetFieldCount
SetupFindFirstLineA
SetupGetStringFieldA
SetupEnumInfSectionsA
SetupGetIntField
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=26, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=66, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=136, id=1, productName=Unmarked objects,
count=2, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
WinNTSetup/Tools/x64/WIMHost.exe
- IMPHASH 8782d1aa94ea232fef594c5a8f27e336
- SHA256 7320b23d0143f2727074f413c3bff7f78ad43f8b5f8593fae3b1373ad17bbf09
- MD5 abb6ef6b02381d752191258a1fa08d81
- SHA1 65c2794551c0b478649bbc1ecedfb489292153ae
- SHA512 1eef297b078a1b039b53aaa236cb638ff7dc20f7b90650d4be5e72a248a40cee43c9bc84e12b0b8c7ea1946c3b4c474739178ccc14fcc0639394d4355247b4c2
- SSDEEP 1536:IjyiyB9p853bTbogk74LOIN8zl82fC4jpJKv:IjDSp2nboN4iy858gHKv
- TLSH T1FE93F742A2A6B0BCD52AC17553666471BA71F4855B327EEF4360C7301FA6EC07E38F29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
74368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Coding\PureBasic\WinNTSetup\src\WimHost\x64\gWIMHost.pdb
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
OpenServiceW
ControlService
StartServiceW
QueryServiceStatus
CloseServiceHandle
SetFileSecurityW
ntdll
RtlCreateUnicodeString
RtlUpcaseUnicodeString
RtlInitUnicodeString
RtlIsNameInExpression
RtlFreeUnicodeString
RtlAdjustPrivilege
NtQueryVolumeInformationFile
NtFsControlFile
NtWriteFile
RtlNtStatusToDosError
RtlMoveMemory
RtlCreateUnicodeStringFromAsciiz
RtlUpcaseUnicodeChar
RtlMultiByteToUnicodeN
RtlGetNtVersionNumbers
NtSetInformationFile
NtReadFile
ole32
CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
shlwapi
PathAddBackslashW
StrToIntW
PathSearchAndQualifyW
StrFormatByteSizeW
PathAddExtensionW
PathRemoveExtensionW
StrStrIW
StrToInt64ExW
PathFileExistsW
PathFindExtensionW
PathRenameExtensionW
PathMatchSpecW
PathRemoveFileSpecW
StrCmpLogicalW
StrTrimW
PathCombineW
PathFindFileNameW
msvcrt
wcstok_s
floor
strrchr
wcslen
wcsncmp
wcstoul
__wgetmainargs
wcscat
swscanf
realloc
wcschr
_wcsnicmp
fclose
fwprintf
_wfopen
wcscpy
wcsrchr
malloc
_wcsicmp
_snwprintf
memcpy
_wcsdup
free
calloc
wcsncpy
memset
kernel32
ExitProcess
GetFinalPathNameByHandleW
GetFileType
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetFilePointer
QueryDosDeviceW
GetVolumeInformationW
GetDriveTypeW
lstrcpynW
MultiByteToWideChar
GetFileSize
SetFilePointerEx
SetLastError
GetDiskFreeSpaceExW
GetPrivateProfileSectionW
GetFileSizeEx
GetModuleHandleW
SetEnvironmentVariableW
Sleep
ReadFile
QueryPerformanceFrequency
DeleteFileW
GetLastError
DeviceIoControl
GetDiskFreeSpaceW
CreateFileW
GetVolumeNameForVolumeMountPointW
CloseHandle
RemoveDirectoryW
SetFileAttributesW
CreateDirectoryW
GetCurrentProcessId
lstrcmpiW
RegisterWaitForSingleObject
OpenEventW
GetLongPathNameW
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileExW
GetPrivateProfileIntW
lstrcatW
GetTempPathW
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
LoadLibraryW
GetProcAddress
FreeLibrary
FormatMessageW
lstrcpyW
LocalFree
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetFileAttributesW
lstrlenW
WideCharToMultiByte
WriteFile
WriteConsoleA
VirtualProtect
QueryPerformanceCounter
GetEnvironmentVariableW
Name
.text
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=257, productName=VS2017 v15.9.4 build 27025, version=27025,
count=2, id=203, version=65501,
count=5, id=257, version=29395,
count=138, id=1, productName=Unmarked objects,
count=6, productName=Unmarked objects (old),
count=1, id=255, version=34810,
count=1, id=258, version=34810,
WinNTSetup/Tools/x64/offreg.dll
- IMPHASH 9fb70bcbb2c24e9538c79a79e1f5a64d
- SHA256 6ff59490887dfa4ad0589a64adc539ee87366be2e85705397b83487e5d0bbd9f
- MD5 c01eaffb542126a5a702cadc03d5c8e9
- SHA1 1607d40e49d04e243ce79b2aaf7f2fe8bcdf288c
- SHA512 7f65f208a1ec9ba4020d1d68b9586fc79f478b98675030f644c3a9beb67881991e8cee723d458b5011e83d68186f7f32b03ff1e4d97c35145b56a1a003678974
- SSDEEP 1536:O2ctxyL6tEFjp7uSO/39Zn2izA9qLUEsIg26QnFMoa58zi:O2wx66I97uSu9Z2is8Y2TXe8O
- TLSH T14EC39E1E73B821B6E4668278C459430BE776B16623249BDF02E0CA7D5F13BD6AE3C741
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a2:eb:9a:db:50:96:0b:26:5c:e2:b0:ee:c9:76:82:bc:3d:c3:66:6b:bd:de:98:c5:29:c0:75:2d:a6:e7:6b:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 30, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:fe:59:ca:b7:e6:2a:a5:22:c1:00:00:00:00:04:fe
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d0:77:08:aa:ef:a3:17:c6:dd:00:01:00:00:01:d0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
58720
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
offreg.pdb
msvcrt
_amsg_exit
free
malloc
_initterm
__C_specific_handler
memmove
_XcptFilter
_wcsnicmp
wcsncpy_s
wcscat_s
wcsnlen
_aligned_malloc
_aligned_free
qsort
_wcsicmp
memcpy
memcmp
memset
kernel32
FlushFileBuffers
CloseHandle
CreateFileW
SetEndOfFile
WriteFile
GetFileSizeEx
ReadFile
GetFinalPathNameByHandleW
TlsSetValue
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
TlsFree
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointerEx
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
EnterCriticalSection
advapi32
GetAce
GetSidSubAuthority
GetSidLengthRequired
CreatePrivateObjectSecurityWithMultipleInheritance
InitializeSid
IsValidSid
InitializeAcl
SetPrivateObjectSecurityEx
GetLengthSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
GetSecurityDescriptorControl
IsValidSecurityDescriptor
InitializeSecurityDescriptor
MakeSelfRelativeSD
SetSecurityDescriptorGroup
DestroyPrivateObjectSecurity
GetSecurityDescriptorLength
ntdll
RtlInitUnicodeString
RtlUpcaseUnicodeChar
RtlRunOnceComplete
RtlRunOnceBeginInitialize
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
ORCloseHive
ORCloseKey
ORCreateHive
ORCreateHiveEx
ORCreateKey
ORDeleteKey
ORDeleteValue
OREnumKey
OREnumValue
ORFlushHive
ORGetKeySecurity
ORGetValue
ORGetVersion
ORGetVirtualFlags
ORMergeHives
OROpenHive
OROpenHiveByHandle
OROpenKey
ORQueryInfoKey
ORQueryInfoKeyEx
ORQueryInfoKeyValueEx
ORRenameKey
ORSaveHive
ORSaveHiveEx
ORSaveHiveToHandle
ORSetKeySecurity
ORSetValue
ORSetVirtualFlags
Name
.text
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGECMRC
Size
4KB
Virtual Size
130B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30795,
count=5, id=259, version=30795,
count=111, id=1, productName=Unmarked objects,
count=9, id=257, version=30795,
count=1, id=256, version=30795,
count=50, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
WinNTSetup/Tools/x64/wimlib.dll
- IMPHASH 91ac1c219b128fd269b4a1137bdbc40a
- SHA256 dd19c49b8143b8b3910c5ef1d430dcae8bab2197094fff5b96bd5844aa5046c4
- MD5 834db85f8cadc30f8de15a3676f9faa3
- SHA1 67d59e47bb56ec69a391d39dcfbfba2bec2ae1a5
- SHA512 9989aae6223c8dc52a1eb5296bcccfea1de2ab59a90ab8cfa1492d8e6e18368b9a3a09e8267a3ee4f4d54e26ac537bea47722cca7314fbb5e137edcae4cf2666
- SSDEEP 6144:5Z2P2tYqmBaY6u0AMcusIrxmIlbQCDBXyVtDSPKbMsjsss:5ZXtVPAMcl2PbBXOq1
- TLSH T119A44B06E3F6516CF2F7E6305A7A5672A9337C155530EE6E1248C67D2F33E40CA28B26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetDiskFreeSpaceExW
GetEnvironmentVariableA
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetLastError
Sleep
SleepConditionVariableCS
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_close
_errno
_fdopen
_fstat64
_get_osfhandle
_gmtime64
_initterm
_lock
_lseeki64
_open_osfhandle
_telli64
_unlock
_waccess
_wassert
_wcserror_s
_wcsicmp
_wgetenv
_wmkdir
_wopen
_wstat64
_wtempnam
_wunlink
abort
calloc
fclose
feof
fflush
fgetwc
fputc
fputwc
fputws
fread
free
fwprintf
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
qsort
realloc
strchr
strerror
strlen
strncmp
towlower
ungetwc
vfprintf
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstoul
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
sha1_final
sha1_init
sha1_update
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_image_path
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_free_memory
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_load_text_file
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_read_image_file
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
339KB
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
720B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
644B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
WinNTSetup/Tools/x64/wimlib/libwim-15.dll
- IMPHASH 4b6458ba0e2044382e5f1f2dc14818e6
- SHA256 ba853ee1e3fc5f5798581f02e8e066ba07a0a2375f0bf444fe981431fd508495
- MD5 db1ef5ed32577db5433ce471ffb4b531
- SHA1 32baffa86cd54fe25d09ba937ee71094b55af7c8
- SHA512 99115190b1ed4cd32986ad1cb8778573b33d6b0d092d90a4ebd070ec0d123f4105bf66c07a389e2a0fcee1816f0fac1250c5f36030c9e3865c5f29b53482df13
- SSDEEP 6144:zC3LLufFLXCHlKyTgOSFuhLTmpkOLNw73ErtrZtkJGM2XbBz:zC3LafFLXdyUO9LT9gW7ErFZMGMa
- TLSH T103B43B02E3F311BCF2B7D6305A779A7269337C515830EE7E4198C6792E72E508A25B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetLastError
Sleep
SleepConditionVariableCS
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
api-ms-win-crt-convert-l1-1-0
mbrtowc
wcrtomb
wcstol
wcstoll
wcstoul
wcstoull
api-ms-win-crt-environment-l1-1-0
_wgetenv
getenv
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_waccess
_wmkdir
_wunlink
_wstat64
_fstat64
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
___mb_cur_max_func
localeconv
api-ms-win-crt-math-l1-1-0
_fdopen
api-ms-win-crt-private-l1-1-0
memchr
memcmp
memcpy
memmove
strchr
wcschr
wcsrchr
wcsstr
api-ms-win-crt-runtime-l1-1-0
_errno
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
_wassert
_wcserror_s
abort
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vswprintf
_get_osfhandle
_lseeki64
_open_osfhandle
_telli64
_wopen
_wtempnam
fclose
feof
fflush
fgetwc
fputc
fputwc
fputws
fread
fwrite
putc
ungetwc
_close
api-ms-win-crt-string-l1-1-0
_wcsicmp
iswctype
memset
strlen
strncmp
strnlen
towlower
wcscmp
wcscpy
wcslen
wcsncmp
wcsnlen
wcspbrk
api-ms-win-crt-time-l1-1-0
_gmtime64_s
wcsftime
api-ms-win-crt-utility-l1-1-0
qsort
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_load_text_file
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
351KB
Virtual Size
351KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
720B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
656B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
WinNTSetup/Unattend/Win10 x86 Administrator.xml
- SHA256 f5ea59583b6c6bf26075698dcd8ac6c6dda3efe5eef1bd9fafc5521499a0a69e
- MD5 02468184863efbdbd339f6d46c7229e5
- SHA1 70ac87e395e1c03869a04bb5e9f8767f8de7bb48
- SHA512 4a5430b4cddeadd863b8c33f2edfc1f0c5ab3fa7563c3323d4a303c0b2bd52957a474ff2e18c5f44b2c92ca367e5f20936ac2d3a2a63031941d3fa738541804d
- TLSH T1B2515314F1EDAF2E5A02492761B79342253FDF3795ED07A0B1FDB53762811CA46168C2
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/Win10-11 x64 Administrator.xml
- SHA256 ac8f22ecc4f7c89c3a9bcc572443f8f13477bd504711d162d543cd313296f70a
- MD5 038194bf9306c612277fcc2bfe4f3219
- SHA1 d1d9ed1f57ae27e33721478a9a6a9514612a31d0
- SHA512 6a37a500168614e52fc25458a8109ff11e98ea6f1451f7417d1d76006ac0492df79ad5d4c8ee1d577a4a7ccedd95ea4b066a407d0f739ced6ec64733a9b4d85e
- TLSH T17E516314F1EDAF2E89024D2761B39342253FDF3795EE06A0B1FDB47762811C616168C2
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/Win7 x64 Administrator.xml
- SHA256 b26be6f4a8e489a5379ef41eee99989e46a28e28e37c89b52fbf8396ee4e8df8
- MD5 ff9b72a0bb457a101a51f4f3389fbe8b
- SHA1 3c6cafcf46c7ad83a4abdbea75a3913b9933954c
- SHA512 07f7456defa266e5bc5f509553791a4ed4cd617dee2b75d9435cd73696fb9136658cdb12f0fac43b5f5bfb9ebfaf7b030ef683fa124d1bcc5c4067ef229496a3
- TLSH T127416444F1EC9F3A5502892B11B39342247FDF3796AE06A0B1FDB977A3C11C616158C2
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/Win7 x86 Administrator.xml
- SHA256 fdb61fb9ceef96062c9411c5acb6bfdf86a71bf151cd0ced7f98677bb96386c3
- MD5 8c8f8f81bba8a71f3fd5a66933db245e
- SHA1 25174c1cc0c406d4689bfbbbdbcbb5bed8acc59d
- SHA512 137c148bdba0aca319dfe0550b337793e8eec6f3b8397df9427a6a98c667d1aee3e0158f629dd9639fd22742770da235d61c05430bff5c2983aa5a996200e548
- TLSH T156416444F1ED9F2A5502892B11B79342247FDF3796ED07A0B1FDB977A3C118A06168C2
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/Win8-8.1 x64 Administrator.xml
- SHA256 50cb2d52ecb0117a567bf2dd4410f67071b10bcd78e5080fe1da27bdad956531
- MD5 f268ff29a5b4962aaa9fcd8ddf677c30
- SHA1 ba5dd6559f8673d256d2151f4e22a539d0ed708b
- SHA512 5d24e1f03c78ab86495c9419e068b0e723f8e050b1b5b8068492f508cdd95723bf7617bf01d23cc1c32f81eb592d01a1265360fe61956cccd628c1e260c39afa
- TLSH T114518314F1ED9F2A89028D2B21B35382153FDF3795EE06A0F1FDB47362C11C616168C2
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/Win8-8.1 x86 Administrator.xml
- SHA256 d5697d2fca8e06806c9201628a9f2ff60de48c81e4e71f5210de3177d8c8ab86
- MD5 adba66805b3ceb3ba5be4f0549f2680d
- SHA1 ad6a86d69b2f7414f0153ff82b162c6184e501fa
- SHA512 f90f57326363cac24887d967ff9e58552151e6d9709164d2d2d744bc49dd44f7443c806e2ebf167dcfdcb2304a8f0e68ebf52a086379c2eca015d26b2bc644ca
- TLSH T122517514F1ED9F2A8A02892B61B35386157FDF3795EE07A0F1FDB53762C11CA06168C2
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/WinXP Administrator sp3 vl.sif
- SHA256 3741801b269a72d3b456ce2c8207d3b477f878fd3fc61808450f6de06dc80ebb
- MD5 543bf7268a4aee9a861eb13640c904c7
- SHA1 cf93f5da1894a9e1d239ca7908ce47b8a72ce160
- SHA512 cc9d947a37b829dd91237bd5d9204a06353f830b170383d02e1891aff39c37bc9fe0cca049df4ceca9ae7f816e50e5d1953e18c5b3ab1b6e706bd07dcabd3971
- TLSH T13801F9736E0B8D15303BC0A02C264B82F0618437DA860800F4F21D900F3A8063BBEABB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/WinXP Administrator sp3.sif
- SHA256 696ea26e6920496507bc14a40f5da38dd95a5d02b520ad3921f59874e81927c0
- MD5 cce2c8099d613701c9be5b5f2e68b01d
- SHA1 98dcab86ce7f89f8fda03afddfbb6e1cd4e60cda
- SHA512 84964818d187a8c95b70e485aa9c0943d8932d319336d28066aa4871045349dd1d28644c7b2a2201ee6f93b858c111af68cc09252133bb8e7a278ff98a906817
- TLSH T14C019E736E079D05307AC0A46D675B86F0608437DE860540F4F11D544F3A90A3BBD6AB
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/Windows XP/SP3 Pro Retail MSDN/i386/winnt.sif
- SHA256 e5c51a3c5eba5bd6fce100b4d3e8f9df98e1af063612e635aeba7c62453f6d97
- MD5 f70ef746e1663ef53c65bfb331fc878d
- SHA1 00da9fe789185dfef232b767e2e5ddb4dc6ac4d0
- SHA512 233faf3adbc1cd0a3c901e833fae50e0461df8c2dab96be1121e7604b7f5a6fed2a3e62b529a046608edbfdc827aaf0fa21062a39bfc1f0301b16d609ed21fa5
- TLSH T10DF07D725E425995B176C0646F655BC6F061017FF9470C51F4F129404F39C02375E5B7
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/Windows XP/SP3 Pro VL MSDN/i386/winnt.sif
- SHA256 6508c7983941ed44ce7a5e39304df3100b999796010b40bb624e584d01c871b6
- MD5 aacb5f63905d0038b4e9d250a8ddec1f
- SHA1 737edba609993a333d6281007b9a810dee57a5c3
- SHA512 f73aac8397bbd0c776b0e5a43b7b6e03a7d5ba54a228930a2ecfda72a99cb72c92dbf506c6d8ecbc76cdc4a917a7e6758d0a5417e70d70ac1f071a43d140ea89
- TLSH T156F078725E025996B27AC0646F369B82F0A1047FF9470856F4F519800F3AC023B9EAA7
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/关闭通知网络使用并设置网络连接方式.txt
- SHA256 2822d6ab830fec1dc1ce6d4910a0146e0e6344ee6dc2bd09127a025115e89f85
- MD5 99bb81c98d9ffda3918101a54a4fc811
- SHA1 04b4af1b8fe696dadc06bb5eadb9465364fd3bd4
- SHA512 f6207819c6224a5dd5565359c9597e695ce79c88bea88e51bf6e051971c27ffaa78dd04c3f422e1500dafbde63bd010268f5a76f3259e22893787584e436ed88
- TLSH T16401523642BE5235E853584BB3C2BA244956610600D78DD3702C5A167F75CC7C13B5DF
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/内置管理员用户/X64/Panther/Unattend.xml
- SHA256 70f4ab3bbaa7be6f9992c71e9719ab5a1b2ee98ba0957790c5bc035fc43efbf7
- MD5 4d134a975e4a52cd2b9bb4020397a6d1
- SHA1 5d000f86f6f59b8e5e68cee09129ef4130dbae14
- SHA512 dc98a7f406725354c03c3032fbdec7f5b17597620554f528ea81725a9ef4d4f569f98a51a8f0d948d5f0ecc04b3b15807f1b3c9aa95d79afeeee15acdb672c8e
- TLSH T190212138F1E89B26A132C93162624303FED15323128456B4F8FC2A2F8F7148306278A3
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/内置管理员用户/X86/Panther/Unattend.xml
- SHA256 0ae82e53c1b35743d6c1c053e38cce9ecddd7381d4066a353bf79fe68864e594
- MD5 b16d5c97fae0054c74ca025a5a45c5f0
- SHA1 5b3fad7ffdda5f2a242649c6da4895f7a022253f
- SHA512 8c6c72673a24db7e960670d19060de8ea5ee0be2257c3b09051f60ddd599d6abb470e3891cb45c64424a7e3dd49f8efc9ab17b98895685a3b339c71712f5d92c
- TLSH T135212138F1E89B16A132C93162634303FED15323128456B4F9FC2A2F9F7148306278A3
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/禁用BitLocker自动设备加密/内置管理员用户禁用BitLocker自动设备加密/X64/Panther/Unattend.xml
- SHA256 507056a8694e1a5edc2e54b4476b11aee26dcd76d0389351156f0c21bfad8b3d
- MD5 eb57e3faa98e2ee985a786919f866fb8
- SHA1 a4a5d7326348a21df0c5601101b582e5e4d26e1b
- SHA512 2b1b2f5b7da8e7a136f182b90cc27ef35be9243ddb0d6312ab9237edfe6fdb6b2966a4f31b0755e6eb0035e5c807748826c5ce826cdd0a2b7b5db2c238bd52a7
- TLSH T1E9313168F0E89E26E573CD3166724703FEA1436742844AA4F9FC2A2B9F7108645138D3
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/禁用BitLocker自动设备加密/自定义用户名禁用BitLocker自动设备加密/X64/Panther/Unattend.xml
- SHA256 2006499cf1b25b96a83e973e5d8f9219f043d28527ec01bea676a9051f99e574
- MD5 8d90b17bf206dd67692c610971b9660a
- SHA1 65a0458a2693c62661f3d2a0b3fb1062c184248b
- SHA512 459d0946365e54891203a0798d9d69bd5bc30ed1777d388099c8e8f6b77838eb891250f5bdf57c11d25f32fb2388918d6bdcfb7a42075cf46f17fa9d7116cbe1
- TLSH T18931F058F0E48D17A9738D25B773470BEF51036B51490AA0F9FCB92B4F714CA4017892
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/禁用BitLocker自动设备加密/自定义用户名跳过隐私设置禁用BitLocker自动设备加密/X64/Panther/Unattend.xml
- SHA256 3396c30f8a8a765747342b0fbf47c8a4f4c16401003319e3a1799d3d08063fea
- MD5 3ce49a5024098f5837ea2bfa6f083208
- SHA1 f363cefcb039d5c8b5de8eab3395eb6ad82d7b02
- SHA512 ff5ba6686474978169a6b78c6d83924cbcdf8db353e9d0c8a8feca05aeccc6cb83ff6ef63b911dcb3ff241bfe434ecb7921bafbb7e9ecf6390dc66b89dde98a9
- TLSH T1CD411058F0E49D1BA9738D25B773870BFF61036B51894AA0F9FCB92B4F710CA4017992
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/自定义用户名跳过隐私设置（先编辑用户名再使用）/X64/Panther/Unattend.xml
- SHA256 645fcd4265d1cd3ae02757b5cf8374e91422fb2cbe391d8ffb09b73508b282ea
- MD5 157c2a239328e5002d3b12079bc40000
- SHA1 012b820452d610e0bed82ab4591c339340b7694e
- SHA512 7881f56090a126e167bbff0df291d23029c0d49d9a113634f5207d8df11155e16d3df305f867fa21b2d2296d5ad3346213a7103a1bbab6af121eb84aa101ee92
- TLSH T172312368F1E49D1B7932C9357373870AFF90032751895660F8FCB91B4F304C60117AA2
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/自定义用户名跳过隐私设置（先编辑用户名再使用）/X86/Panther/Unattend.xml
- SHA256 87b96db24b64eb131f48fe1833029f1661b41043c171fb44bd91e7cd434488c4
- MD5 062bfc388821ffcc57744d334a7c184a
- SHA1 af9e29385508eba6fadd2a099a28005fd0b7b0d5
- SHA512 2ee7839d9ce6424dbb134f275bb2a866b07bec271055b042adfbab2e94fad00e43cd20a3fae9dcd3378965e137a47ca98d43be1046ff4bc862a210c49991dea4
- TLSH T1FF312368F1E49D1B7A32C9357373870AFF90032751895660F9FCB91B4F304C60117A62
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/自定义用户名（先编辑用户名再使用）/X64/Panther/Unattend.xml
- SHA256 5114792c00f5733cd494e1ca3020d730ef7cc6de1487fb3588c1294b7e8bd6e8
- MD5 28417648b94598ba8f0611d1f933d132
- SHA1 4fc57fca020ac6114f94207342d5bfa1a4cb9590
- SHA512 3144c92b59c6500ade7444286834de05a04dce54b95c074aa0e6c35573c063c2cc9d930fec83e076edaa300d341d9010582e61e26cc1c45cf02f2f662c266ce7
- TLSH T19631F068F1E49E176A32C9357373434AEF91132B514956A0F9FCB92B4F304C601279A1
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/自定义用户名（先编辑用户名再使用）/X86/Panther/Unattend.xml
- SHA256 c843ecfec41c6659aa24269b1e7cafcfcd7a1f3e3a8efc86b844c756c0640420
- MD5 23bd07d4244d4d51f7624b0b886122a5
- SHA1 1fab5f381c0d83a15da23eda4208ef3a17e24799
- SHA512 6c4eb7473dcc3af8041f716991dda91895272fac6ea60c99bcd79c285e8fa87290b740e8a8948347f374a27953ddffe689e16d3c91af899740bd0b71e80f20ba
- TLSH T18131F068F1E49E176A32C9357373434AEF91132B518956A4F9FCB92B4F304C601279A1
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/跳过你的数据将在你所在的国家或地区之外进行处理.cmd
- SHA256 0f557d1136325720f087de4d2b65ed911a06636dc019881cf2d5f975cfb5ad48
- MD5 2f45a9b44471d84b18aea31f2af8ce75
- SHA1 f4a14ce2d9b5db99e45450b81444095d440816d0
- SHA512 27db6fe789ab21c7a3cd98e9e226d01abad7136e48d4c81488f8e7b6f7d91aea8a37b47db9d5139dfea25d2e5647b344b02673710d5c7f5885f1331146d8eddb
- TLSH T1E0512E143024083A4535FE61CE6B5393F339688705010A8E3E9E95B02F72CEA6BFA6C9
- MD5 SHA1 SHA512 TLSH
WinNTSetup/Unattend/无人值守/跳过你的数据将在你所在的国家或地区之外进行处理.reg
- SHA256 27c8ea7bfbb00f7bc5a631d16e19179bb2a198a4f525fc475dc6dfb0e1c2deee
- MD5 555f1f58c19b59c7d30cebc60fd2cbf7
- SHA1 6384bbd5fe7a6f88288e3095b41bb891833e7859
- SHA512 97b7dbed4ff4ac16b0ccf84e15a5c9fd3966b5a82cc73958609316cceb58712581b474c5cc50f53d6c48f018e1ff0ecd4201bd87e270155fbad433b6ae3092c6
- TLSH T152F0E9A09977D016E2E0B570874B9E8337E5B2AB24CF5654569C2840BDDD84B93640EE
- MD5 SHA1 SHA512 TLSH
WinNTSetup/WimScript/WimScript.ini
- SHA256 bdcf33d2f68b32779de95b40e5aca6f348a05a45892b96672e20ae70d88ade7e
- MD5 fdcd3c4ee285d446bcf4ad90690be968
- SHA1 a7a57e6255f785e4861c1e85e1e0e5b02221c447
- SHA512 449945641e7c453057f5b96b40b2671d93f7dcdef1ff565f2029f44236470fbd74d2cd5686ffb88c86b1576eaec7b0de1643d8030507c5721ebf9afb5651d63e
- TLSH T176F09EE96636C036886CDCB0837BDB54E6B0B4157593A0304542D04CFD45A0FBBE9CEE
- MD5 SHA1 SHA512 TLSH
WinNTSetup/WinNTSetup.ini.txt
- SHA256 f3a7e0a51c83fd7e168cd2f76d6d386e48973817f5928a5c7146c794a4308ec2
- MD5 dce02e3a485540dcc76393bc9596566d
- SHA1 3d7b0de7ecfc1745970ec4e5639a504e728eecf1
- SHA512 af332cd01b766a1bd307079b8bdf2e58a963b9de1bbdde3889cfd8a6edefd23a743cdb4b60f68a47622b6219877d606d105ff5f46325fe167394849e6c2c1a0c
- TLSH T18E51810D8A0F68EDD63B281637B1893DB3DC75F1D8032181BA5C48A86E58C69423BD7A
- MD5 SHA1 SHA512 TLSH
WinNTSetup/WinNTSetup_x64.exe
- IMPHASH 8fbed8325d39c82450612677fbd44b1e
- SHA256 5236a34ab904d14ec4b0d37b89f584756f16caf70f1b6296e1020ba8f6b0de4b
- MD5 ac12027e637978a927c436909a508226
- SHA1 84c961a99b4dcc71477746a347721261a27d4f13
- SHA512 87c083273349b99a3d0bcd8f51892a4161f3980f369cd9502808c9353b9f353ae69978866170b5c1b573c12ff9d6e0bd78f47444a48128c0d01a45203e84ffb5
- SSDEEP 24576:vnswxOPG3vs4hfOlCH2Tp1WkRbRNOGLF:vsR+fVhfOlC0p1Wk11L
- TLSH T1C9356B0BB2E9015CE07AD2B5572A5122FAF3BC446E31FE9F42605A151FB2F50A73D70A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
9847
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Coding\PureBasic\WinNTSetup\WinNTSetup_x64.pdb
advapi32
OpenProcessToken
GetTokenInformation
SetEntriesInAclW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
AllocateAndInitializeSid
CheckTokenMembership
OpenSCManagerW
CreateServiceW
CloseServiceHandle
RevertToSelf
SetThreadToken
IsWellKnownSid
DuplicateTokenEx
OpenServiceW
RegCreateKeyW
RegOpenKeyW
RegEnumValueW
StartServiceW
QueryServiceStatus
CreateProcessWithTokenW
CreateProcessAsUserW
RegQueryInfoKeyW
RegUnLoadKeyW
RegLoadKeyW
RegQueryValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
GetFileSecurityW
IsValidSecurityDescriptor
SetNamedSecurityInfoW
ControlService
RegEnumKeyExW
cfgmgr32
CM_Get_Device_IDW
CM_Get_Parent
comdlg32
GetSaveFileNameW
GetOpenFileNameW
ntdll
NtTranslateFilePath
NtQueryInformationFile
NtFsControlFile
RtlDosPathNameToNtPathName_U
NtOpenFile
RtlComputeCrc32
NtClose
NtQueryDirectoryObject
NtOpenDirectoryObject
RtlInitUnicodeString
NtQueryInformationProcess
RtlCompareMemory
RtlMoveMemory
RtlFreeHeap
NtQueryVolumeInformationFile
RtlAllocateHeap
RtlGetProcessHeaps
RtlGetNtVersionNumbers
RtlGetVersion
NtShutdownSystem
RtlFreeUnicodeString
RtlIsNameInExpression
RtlCreateUnicodeStringFromAsciiz
RtlUpcaseUnicodeString
NtReadFile
RtlNtStatusToDosError
RtlRandom
RtlAdjustPrivilege
RtlZeroMemory
NtCreatePagingFile
NtQuerySystemInformation
RtlCreateUnicodeString
RtlGetLastNtStatus
ole32
RevokeDragDrop
CoCreateGuid
CoCreateInstance
CLSIDFromString
CoTaskMemFree
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
oleaut32
SafeArrayLock
VariantClear
SafeArrayUnlock
SafeArrayCreate
SysAllocString
SafeArrayDestroy
SysFreeString
rpcrt4
UuidCreate
setupapi
SetupGetStringFieldW
SetupFindFirstLineW
SetupOpenInfFileW
SetupIterateCabinetW
SetupDecompressOrCopyFileW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupCloseInfFile
SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupGetLineCountW
SetupGetLineByIndexW
SetupGetFieldCount
SetupGetBinaryField
SetupGetIntField
SetupDiDestroyDeviceInfoList
SetupEnumInfSectionsW
shell32
SHParseDisplayName
SHCreateShellItem
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteExW
SHGetImageList
SHFormatDrive
SHGetFileInfoW
SHDefExtractIconW
SHGetStockIconInfo
StrStrIW
SHGetDesktopFolder
user32
SendMessageW
CreatePopupMenu
InsertMenuW
IsChild
DefFrameProcW
GetFocus
AdjustWindowRectEx
UnregisterClassW
RegisterClassW
SetWindowLongPtrW
GetWindowLongPtrW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
IsZoomed
GetMenu
DestroyAcceleratorTable
CreateAcceleratorTableW
LoadIconW
SetActiveWindow
DrawFrameControl
GetScrollPos
RegisterClassExW
SetScrollPos
GetWindowDC
GetAsyncKeyState
GetWindowLongW
DrawStateW
ReleaseCapture
SetCapture
GetWindowTextLengthW
RedrawWindow
IntersectRect
EnableWindow
DestroyWindow
GetClassNameW
FindWindowW
GetDlgCtrlID
DestroyCursor
CloseClipboard
SetClipboardData
EmptyClipboard
SetPropW
SetWindowCompositionAttribute
CreateIconIndirect
TranslateAcceleratorW
OpenClipboard
ClientToScreen
CopyImage
GetForegroundWindow
IsIconic
SetCursor
LoadCursorW
MoveWindow
SetRectEmpty
IsWindowVisible
GetWindowThreadProcessId
DisplayConfigSetDeviceInfo
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
ChangeDisplaySettingsW
EnumDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
GetDoubleClickTime
CheckMenuItem
SetMenuDefaultItem
CheckMenuRadioItem
AppendMenuW
SetMenuItemInfoW
CreateWindowExW
InvalidateRect
SetTimer
GetWindowPlacement
SetWindowPlacement
UpdateWindow
SetFocus
PostMessageW
MsgWaitForMultipleObjects
EndPaint
GetDC
ReleaseDC
GetClassInfoExW
RegisterWindowMessageW
GetSystemMetrics
SystemParametersInfoW
GetIconInfo
RemovePropW
CallWindowProcW
DrawIconEx
SetProcessDefaultLayout
ValidateRect
InflateRect
SetRect
GetUpdateRect
MapWindowPoints
DrawTextW
CallNextHookEx
GetClassLongPtrW
WindowFromDC
FrameRect
GetActiveWindow
GetProcessDefaultLayout
GetSysColor
KillTimer
SetForegroundWindow
MessageBoxIndirectW
GetKeyState
DestroyMenu
SetParent
GetWindow
GetWindowRect
ShowWindow
EnumWindows
CharLowerW
EnableMenuItem
CharUpperW
SetWindowTextW
FillRect
CopyRect
BeginPaint
DefWindowProcW
SetClassLongPtrW
EnumChildWindows
LockWindowUpdate
GetComboBoxInfo
FindWindowExW
SetWindowPos
GetClientRect
IsWindowEnabled
GetSysColorBrush
GetPropW
GetDlgItem
UnhookWindowsHookEx
SetWindowsHookExW
MessageBoxW
LoadStringW
GetWindowTextW
GetParent
GetClassWord
TrackPopupMenu
RealChildWindowFromPoint
ScreenToClient
WindowFromPoint
FlashWindowEx
MessageBeep
TrackPopupMenuEx
GetMessagePos
DestroyIcon
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msvcrt
_snwprintf
memcmp
free
_wcsicmp
strstr
wcscat
wcscmp
_wcsnicmp
wcsncpy
memcpy
_stricmp
memset
wcstok_s
_vsnwprintf
calloc
_wtoi
_itow
_mktime64
tolower
floor
memmove
_gmtime64
wcsstr
wcstoul
_localtime64
wcsspn
wcschr
_time64
wcstol
fputs
fputc
fseek
fread
fclose
realloc
strlen
strchr
fgets
_wfopen
_wstati64
wcsncmp
__wgetmainargs
wcscpy
wcstod
swscanf
wcslen
malloc
sqrt
_wcsdup
ceil
strrchr
_strnicmp
_wsystem
_wtol
gdi32
CreateBitmap
CreateRectRgn
FrameRgn
ExtTextOutW
CreatePen
Rectangle
MoveToEx
LineTo
GetStockObject
CreatePatternBrush
SetViewportOrgEx
OffsetViewportOrgEx
GetObjectType
ExcludeClipRect
CreateDCW
CreateRectRgnIndirect
GetClipRgn
SetLayout
CreateCompatibleDC
StretchBlt
SetBrushOrgEx
GetDIBits
SetPixel
GetTextMetricsW
EnumFontFamiliesW
AddFontResourceW
SelectObject
SetBkColor
SetBkMode
CreateFontW
CreateFontIndirectW
CreateCompatibleBitmap
GetObjectW
DeleteObject
CreateSolidBrush
DeleteDC
GdiAlphaBlend
SelectClipRgn
GetDeviceCaps
SetStretchBltMode
ExtSelectClipRgn
GetTextExtentPoint32W
SetTextColor
CreateDIBSection
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
WTSEnumerateProcessesW
comctl32
ImageList_Remove
ImageList_AddMasked
ImageList_Replace
ord412
ImageList_GetImageCount
ImageList_Draw
ImageList_Add
ImageList_DrawEx
ImageList_GetIconSize
ord413
CreateToolbarEx
InitCommonControlsEx
ord410
ord381
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Merge
ImageList_Create
uxtheme
DrawThemeBackground
GetThemeInt
OpenThemeData
GetThemePartSize
EndBufferedPaint
BufferedPaintSetAlpha
DrawThemeText
BeginBufferedPaint
SetWindowTheme
GetThemeFont
DrawThemeTextEx
BufferedPaintInit
virtdisk
AttachVirtualDisk
GetVirtualDiskInformation
GetVirtualDiskOperationProgress
CreateVirtualDisk
GetStorageDependencyInformation
GetVirtualDiskPhysicalPath
DetachVirtualDisk
OpenVirtualDisk
kernel32
ReadConsoleOutputW
SetConsoleCtrlHandler
AllocConsole
AttachConsole
GetPrivateProfileSectionW
GetLocaleInfoW
LocaleNameToLCID
WritePrivateProfileStringW
SetFilePointerEx
GetTimeFormatW
GetLocalTime
EnumResourceLanguagesW
ReadProcessMemory
QueryFullProcessImageNameW
OpenProcess
WriteConsoleW
lstrcatW
lstrcpynW
MultiByteToWideChar
lstrlenA
FindVolumeClose
FindNextVolumeW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetVolumePathNamesForVolumeNameW
lstrcmpW
FindFirstVolumeW
SetErrorMode
GetPrivateProfileStringW
FormatMessageW
GetSystemInfo
K32GetModuleInformation
SetConsoleTitleW
SetFileAttributesW
GetPrivateProfileIntW
GetEnvironmentVariableW
GetNativeSystemInfo
GetCurrentThread
GetLogicalProcessorInformation
GetLogicalDrives
QueryDosDeviceW
GetDriveTypeW
GetLogicalDriveStringsW
CreateDirectoryW
Sleep
SetFirmwareEnvironmentVariableW
GetFirmwareEnvironmentVariableW
ReadFile
DeviceIoControl
lstrcpyW
lstrlenW
GetFinalPathNameByHandleW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
lstrcmpiW
GetCurrentThreadId
lstrcmpA
GetFileAttributesW
SetEvent
CopyFileW
EndUpdateResourceW
UpdateResourceW
EnumResourceNamesW
BeginUpdateResourceW
WriteFile
VirtualProtect
DefineDosDeviceW
DeleteFileW
WaitForSingleObject
FindClose
FindNextFileW
FindFirstFileExW
MulDiv
QueryPerformanceFrequency
LoadResource
FindResourceW
SetEnvironmentVariableW
FreeLibrary
LoadLibraryExW
QueryPerformanceCounter
GetConsoleScreenBufferInfo
GetFileType
GetStdHandle
ExitProcess
HeapDestroy
GetProcAddress
LoadLibraryW
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetUserDefaultLocaleName
GetUserDefaultLCID
GetSystemWindowsDirectoryW
GetModuleFileNameW
GetLongPathNameW
GetTempPathW
HeapCreate
GetModuleHandleW
SetFileTime
SystemTimeToFileTime
GetSystemTime
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
GetConsoleWindow
SetConsoleTextAttribute
FindFirstFileW
MoveFileW
GetFileSizeEx
WideCharToMultiByte
WriteConsoleA
GetFullPathNameW
SetConsoleCursorInfo
FindFirstFileNameW
FindNextFileNameW
FindResourceExW
SizeofResource
LockResource
FreeResource
CreateEventW
GetDiskFreeSpaceW
SetLastError
RemoveDirectoryW
GetCurrentDirectoryW
SetConsoleCursorPosition
SetCurrentDirectoryW
GetDateFormatW
LCIDToLocaleName
SetEndOfFile
SetFileValidData
SetFilePointer
GetTickCount
SetVolumeMountPointW
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
SetThreadExecutionState
GetCommandLineW
GetProcessId
FlushFileBuffers
GlobalMemoryStatusEx
FileTimeToSystemTime
WritePrivateProfileSectionW
GetFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
SystemTimeToTzSpecificLocalTime
GetTempFileNameW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
HeapAlloc
HeapFree
DuplicateHandle
CreatePipe
CreateProcessW
PeekNamedPipe
GetExitCodeProcess
HeapReAlloc
GetVersionExW
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteCriticalSection
RegisterWaitForSingleObject
SetDllDirectoryW
UnregisterWait
shlwapi
PathAddBackslashW
PathFileExistsW
PathFindExtensionW
StrCmpLogicalW
PathMatchSpecW
PathFindFileNameW
PathIsRelativeW
PathRemoveFileSpecW
StrFormatByteSizeW
StrToIntW
StrToIntExW
PathIsNetworkPathW
StrTrimW
PathRemoveExtensionW
PathParseIconLocationW
PathRemoveBackslashW
StrTrimA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
PathCombineW
PathIsDirectoryW
PathSearchAndQualifyW
PathStripToRootW
PathCompactPathExW
StrStrNIW
PathCompactPathW
PathGetArgsW
fltlib
FilterLoad
FilterAttach
Name
.text
Size
702KB
Virtual Size
702KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
172KB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
137KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=257, productName=VS2017 v15.9.4 build 27025, version=27025,
count=2, id=203, version=65501,
count=4, id=257, version=26715,
count=13, id=257, version=29395,
count=627, id=1, productName=Unmarked objects,
count=273, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=36, productName=Unmarked objects (old),
count=1, id=255, version=34810,
count=1, id=151,
count=1, id=258, version=34810,