6901303bfbdb56883352a60f66884a09401ed3cb773726ce952a18319da64998
- SHA256 6901303bfbdb56883352a60f66884a09401ed3cb773726ce952a18319da64998
Overview
overview
3Static
static
3系统引�...64.exe
windows10-2004-x64
1系统引�...64.exe
windows11-ltsc_2024-x64
1系统引�...86.exe
windows10-2004-x64
3系统引�...86.exe
windows11-ltsc_2024-x64
3系统引�...23.dll
windows10-2004-x64
1系统引�...23.dll
windows11-ltsc_2024-x64
1系统引�..._7.dll
windows10-2004-x64
1系统引�..._7.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
系统引导修复工具v1.3.1/BootFix_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
系统引导修复工具v1.3.1/BootFix_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
系统引导修复工具v1.3.1/BootFix_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
系统引导修复工具v1.3.1/BootFix_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
系统引导修复工具v1.3.1/Data/EFI/bootmgfw_2023.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
系统引导修复工具v1.3.1/Data/EFI/bootmgfw_2023.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
系统引导修复工具v1.3.1/Data/EFI/bootmgfw_7.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
系统引导修复工具v1.3.1/Data/EFI/bootmgfw_7.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 6901303bfbdb56883352a60f66884a09401ed3cb773726ce952a18319da64998
- Size 2.5MB
- Sample260820-datwga1wfs
- SHA256 6901303bfbdb56883352a60f66884a09401ed3cb773726ce952a18319da64998
- MD5 53ada8fb64dcc6395edf251d61333991
- SHA1 e3e7b8fe6472e371bc2f5633930bdd9e2b6cef67
- SHA512 145545084106f7bda7af1df762c2b480dcc38612250ea428fd657a650a0d911fad1e1fa366cc525cbb8ab55d7832e0c266239018f4b5af94604b5ca09cb7a674
- SSDEEP 49152:OGPM3qPnqpkeJV1Ymt5Bnwz1+g4tc+MssjS1zzzZnJzw0nuF:OJ2qpkupto0g4+zLuJzszF
- TLSH T12BC533AE9B1B88EDEA15E83B70319B99434FE6C90934693C9DD54EC42C7F2B9C325131
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/系统引导修复工具v1.3.1/BootFix_x64.exe unpack001/系统引导修复工具v1.3.1/BootFix_x86.exe unpack001/系统引导修复工具v1.3.1/Data/EFI/bootmgfw_7.efi
File Explorer
-
6901303bfbdb56883352a60f66884a09401ed3cb773726ce952a18319da64998.zip 2.5MB
-
系统引导修复工具v1.3.1/BootFix_x64.exe.exe 979KB
-
系统引导修复工具v1.3.1/BootFix_x86.exe.exe 948KB
-
系统引导修复工具v1.3.1/Data/EFI/bootmgfw_2023.efi.dll 2.7MB
-
系统引导修复工具v1.3.1/Data/EFI/bootmgfw_7.efi.dll 785KB
-
系统引导修复工具v1.3.1/使用须知.txt2KB
系统引导修复工具v1.3.1/BootFix_x64.exe
- IMPHASH ecb6494f937f907af4124a955770dae6
- SHA256 0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8
- MD5 ab7a4163bebcfed7c56d0f16a42602e8
- SHA1 446cdf1e5ada75531f76980e2002872037822d60
- SHA512 d42c1697b1c532e97dbee1e07c21e43dad747571f78c9ca6701b318c524a9d562aa3704545f74840b2e5bc4521ccd4414e590dd508046edb399ec2e355d1ae55
- SSDEEP 12288:Sq+EqLXIwFed5BmbnW2WivZXHe+DHJC141NTX4Hu8rSfDc7:SpEqmrNevZXe+DprNTX4HBrSfDc7
- TLSH T1DE25D30266F90554F1F77A745AB59AA48A3BBC916E39CA4E039C405E1FB3E80CD31B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
46628
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
crypt32
CertGetNameStringA
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
gdiplus
GdipCreateFont
GdipDeleteFontFamily
GdipCreateStringFormat
GdipFillPath
GdipFillPolygon
GdipFillRectangleI
GdipFillRectangle
GdipDrawPath
GdipDrawRectangle
GdipDrawLine
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipDeleteStringFormat
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdiplusStartup
GdipFree
GdipAlloc
GdipDrawString
GdipSetStringFormatAlign
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipCreateFontFamilyFromName
user32
SetProcessDPIAware
LoadIconA
LoadCursorA
SetCursor
MessageBoxW
ValidateRect
ReleaseDC
GetDC
GetSystemMetrics
ReleaseCapture
UpdateLayeredWindow
ShowWindow
CreateWindowExW
RegisterClassExA
PostQuitMessage
DefWindowProcA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
TrackMouseEvent
gdi32
SelectObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
kernel32
HeapSize
SetFilePointerEx
GetProcessHeap
LCMapStringW
VirtualProtect
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
HeapReAlloc
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CreateFileW
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentVariableA
CreateFileA
DeleteFileA
GetFileAttributesA
GetFileSize
ReadFile
SetFilePointer
WriteFile
GetTempPathA
CloseHandle
SetHandleInformation
GetLastError
CreatePipe
DeviceIoControl
WaitForSingleObject
CreateMutexA
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
GetFirmwareEnvironmentVariableA
FindResourceA
CopyFileA
MultiByteToWideChar
GetUserDefaultUILanguage
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EnterCriticalSection
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
Name
.text
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.intg
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
767KB
Virtual Size
766KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=145, id=261, version=33145,
count=12, id=260, version=33145,
count=10, id=259, version=33145,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=45, id=261, version=35207,
count=15, id=257, version=33145,
count=183, id=1, productName=Unmarked objects,
count=1, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
系统引导修复工具v1.3.1/BootFix_x86.exe
- IMPHASH 1ac8c7770314906cfeef6be73ce0654c
- SHA256 7d806e876623f2b22d7c15d18663bf2f2beedfbd08c6eedb6e4f5b23265cf24b
- MD5 e128b582535823cb2a6d43b6946ff77f
- SHA1 23b6c8e5749b4f695ec232d9cd4c1e8f832fd671
- SHA512 f67d6726f9cbafbcb7ebbb6a512ed522718ae3d73c9fa4f31a8860bb25eedaf9fe2a9e1895f697b061dd2c7994fe09a9196cd15b266ef9c5113cf1c9be1673cf
- SSDEEP 24576:yqiOJwVUrNevZXe+DprNTX4HBrSfDc7cmK:9JNNmvpAB+A7cl
- TLSH T12025D40266F94115F1F77A701AB59AB48A3BBCA16E39C64E138C415E1BB3E80CD31B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
48034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
crypt32
CertGetNameStringA
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
gdiplus
GdipCreateFont
GdipDeleteFontFamily
GdipCreateStringFormat
GdipFillPath
GdipFillPolygon
GdipFillRectangleI
GdipFillRectangle
GdipDrawPath
GdipDrawRectangle
GdipDrawLine
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipDeleteStringFormat
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdiplusStartup
GdipFree
GdipAlloc
GdipDrawString
GdipSetStringFormatAlign
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipCreateFontFamilyFromName
user32
SetProcessDPIAware
LoadIconA
LoadCursorA
SetCursor
MessageBoxW
ValidateRect
ReleaseDC
GetDC
GetSystemMetrics
ReleaseCapture
UpdateLayeredWindow
ShowWindow
CreateWindowExW
RegisterClassExA
PostQuitMessage
DefWindowProcA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
TrackMouseEvent
gdi32
SelectObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
kernel32
HeapSize
SetFilePointerEx
GetProcessHeap
LCMapStringW
VirtualProtect
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
HeapReAlloc
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CreateFileW
FreeEnvironmentStringsW
GetEnvironmentVariableA
CreateFileA
DeleteFileA
GetFileAttributesA
GetFileSize
ReadFile
SetFilePointer
WriteFile
GetTempPathA
CloseHandle
SetHandleInformation
GetLastError
CreatePipe
DeviceIoControl
WaitForSingleObject
CreateMutexA
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
GetFirmwareEnvironmentVariableA
FindResourceA
CopyFileA
MultiByteToWideChar
GetUserDefaultUILanguage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EnterCriticalSection
RtlUnwind
RaiseException
SetLastError
EncodePointer
WriteConsoleW
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.intg
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
767KB
Virtual Size
766KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=33145,
count=145, id=261, version=33145,
count=19, id=260, version=33145,
count=21, id=259, version=35207,
count=17, id=260, version=35207,
count=42, id=261, version=35207,
count=15, id=257, version=33145,
count=179, id=1, productName=Unmarked objects,
count=1, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
系统引导修复工具v1.3.1/Data/EFI/bootmgfw_2023.efi
- SHA256 5e97e7d15609fe298f87a8891e5f8ecc2bfd4e196531349a0b7145fab3dd9684
- MD5 ea956876e95c2975c0339eb3b308a2cc
- SHA1 2a9c3f5b829071103f92d76b8530c7da9a2620da
- SHA512 dd182e9f38a02bfdd4a8fbea1a6634923cdbd83b57c010deda5ee0f0fd6b0df0a3f8a384453d070280096cf8dbac502cab2c775fc4423c0a81b39eb9a8e17350
- SSDEEP 49152:WBX8sDNWlH3fq7RDKM/nQhhBlKuEXHHm+nD/Lwua4bL:WF8qNUu8iHHTL
- TLSH T101D59F47A3F511F5E5BBC274C66B861BEBF278062234875F43A4C9991F23B319A2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
47:c1:2c:1f:26:50:f9:fb:a4:60:41:95:50:9d:0c:40:40:cc:4e:28:4d:a4:5e:64:39:c1:1e:8d:bb:c5:4d:a9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 26, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Windows UEFI CA 2023,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0a:a0:8b:e0:09:5b:22:dc:dc:00:00:00:00:00:0a
Issuer
CN=Windows UEFI CA 2023,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Windows UEFI CA 2023,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1a:88:8b:98:00:56:22:84:c1:00:00:00:00:00:1a
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 13, 2023 - Jun 13, 2035
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
0
Entry point
232064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_EFI_APPLICATION
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
bootmgfw.pdb
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
TRANSIT
Size
512B
Virtual Size
29B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=33138,
count=49, id=260, version=33140,
count=21, id=261, version=33140,
count=28, id=259, version=33140,
count=753, id=264, version=33140,
count=1, id=256, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
系统引导修复工具v1.3.1/Data/EFI/bootmgfw_7.efi
- SHA256 cf2dbfac10441f1a4ba5d9edf2301f4d772f77f426efd91774d7d655c3b63ccd
- MD5 6b742429f77fb4b4d4ba0bc99e6b979f
- SHA1 811e05f72477ea8a0176950d4436445305031661
- SHA512 32898b252f98cc0fd11d3573ea274f4873961f042154faba02b309c24df71e906c8d00a7eaa9beff74bb227ec2cf018767b953dd7ee1dc8ac0b46898d4c523fb
- SSDEEP 12288:FQ0Afkp5OCzERWL569X2zu6eyoArHkW3y9qn6EQ8UPsJV:VAfa44bL569X2zreyoApW+6B8UP2
- TLSH T1FF056C43E3F611A4F6BBD675CD360276EBB378412534C74E03A8499E8F63B619A29313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
1037516
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_EFI_APPLICATION
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
bootmgfw.pdb
Name
.text
Size
485KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGER32C
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGER32R
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INITDATA
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGEDATA
Size
512B
Virtual Size
1B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pretext
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.predata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=8, id=206, version=65501,
count=2, id=205, version=65501,
count=54, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
系统引导修复工具v1.3.1/使用须知.txt
- SHA256 9e73017205c062c1dec6b2293c0dea5c3160d154c1818fca9788cf0d1a89e087
- MD5 fbdc26a3e6d013027486ecdc53bb8417
- SHA1 154b715f659e7ea0a95d0c00afb23ea4d7bd017a
- SHA512 9cb6839162a7d3506153cd765cc59864c3d27281eaaebc4c62097d2def238529b52b5ae09e0f97afa6c6eeac8148d9bbb833a2ed2b3d56fe4abee0786ffd0630
- TLSH T12A4177BD075094F816A152C707D78A6FB40BA41E7BA99BDCEBC5A002998463B230B717
- MD5 SHA1 SHA512 TLSH