Alkalmazások.zip
- SHA256 d296e4dc7d4bb5bf42a385f4ed74464f3609cb905f77bf4ac40551e01cbce942
Overview
overview
9Static
static
9Alkalmazá...ew.chm
windows10-2004-x64
1Alkalmazá...ew.chm
windows11-ltsc_2024-x64
1Alkalmazá...ew.exe
windows10-2004-x64
6Alkalmazá...ew.exe
windows11-ltsc_2024-x64
6Alkalmazá...lp.txt
windows10-2004-x64
1Alkalmazá...lp.txt
windows11-ltsc_2024-x64
1Alkalmazá...ng.lnk
windows10-2004-x64
6Alkalmazá...ng.lnk
windows11-ltsc_2024-x64
3Alkalmazá...st.exe
windows10-2004-x64
3Alkalmazá...st.exe
windows11-ltsc_2024-x64
3Alkalmazá...ew.exe
windows10-2004-x64
9Alkalmazá...ew.exe
windows11-ltsc_2024-x64
9out.exe
windows10-2004-x64
out.exe
windows11-ltsc_2024-x64
Alkalmazá...ew.exe
windows10-2004-x64
9Alkalmazá...ew.exe
windows11-ltsc_2024-x64
9out.exe
windows10-2004-x64
out.exe
windows11-ltsc_2024-x64
Alkalmazá...lp.txt
windows10-2004-x64
1Alkalmazá...lp.txt
windows11-ltsc_2024-x64
1Alkalmazá...ol.exe
windows10-2004-x64
9Alkalmazá...ol.exe
windows11-ltsc_2024-x64
9Alkalmazá...ew.cfg
windows10-2004-x64
3Alkalmazá...ew.cfg
windows11-ltsc_2024-x64
3Alkalmazá...ew.exe
windows10-2004-x64
6Alkalmazá...ew.exe
windows11-ltsc_2024-x64
6Alkalmazá...lp.txt
windows10-2004-x64
1Alkalmazá...lp.txt
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
Alkalmazások/A1/A2/A3/A4/A5/A6/help.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Alkalmazások/A1/A2/A3/A4/A5/A6/help.txt
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Alkalmazások/A1/A2/A3/A4/A5/Everything.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
Alkalmazások/A1/A2/A3/A4/A5/Everything.lnk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
Alkalmazások/A1/A2/A3/A4/A5/ExecutedProgramsList.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Alkalmazások/A1/A2/A3/A4/A5/ExecutedProgramsList.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Alkalmazások/A1/A2/A3/A4/A5/RecentFilesView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
Alkalmazások/A1/A2/A3/A4/A5/RecentFilesView.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
out.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
out.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Alkalmazások/A1/A2/A3/A4/A5/UserAssistView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
Alkalmazások/A1/A2/A3/A4/A5/UserAssistView.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
out.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
out.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Alkalmazások/A1/A2/A3/A4/A5/help.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Alkalmazások/A1/A2/A3/A4/A5/help.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Alkalmazások/A1/A2/A3/A4/A5/journal-tool.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
Alkalmazások/A1/A2/A3/A4/A5/journal-tool.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
Alkalmazások/A1/A2/A3/A4/LastActivityView.cfg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
Alkalmazások/A1/A2/A3/A4/LastActivityView.cfg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
Alkalmazások/A1/A2/A3/A4/LastActivityView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
Alkalmazások/A1/A2/A3/A4/LastActivityView.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
Alkalmazások/A1/A2/A3/A4/help.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Alkalmazások/A1/A2/A3/A4/help.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Alkalmazások.zip
- Size 6.8MB
- Sample260826-rqv1cseq2t
- SHA256 d296e4dc7d4bb5bf42a385f4ed74464f3609cb905f77bf4ac40551e01cbce942
- MD5 a9b436676c0fa5af4ef36d3035cbf576
- SHA1 bd113483fcd8a71dd3f4c75a9553116bbe7a54c4
- SHA512 fcbe8d28700f48c1438ed33e7af4ce77f6511bcd1e0ac352cc6a5ad98340ddeef695147399bb256ffba58163c16517ce351407ef0e0d4ced6796c4b84a3eea0a
- SSDEEP 196608:0NmsUD03SZJMjhByhAnM/+bu9Nn5d0rAuLTuYgM3JEkwREbGV:0N5UwtjrJMVn5SMufuYgM5EkRw
- TLSH T1157633F4F8C28E239C04C37F4B2542395CE2D26EA9DD7463267EEE5F980E11749AAD50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 5 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.exe Nirsoft static1/unpack001/Alkalmazások/A1/A2/A3/A4/A5/ExecutedProgramsList.exe Nirsoft static1/unpack002/out.upx Nirsoft static1/unpack003/out.upx Nirsoft static1/unpack001/Alkalmazások/A1/A2/A3/A4/LastActivityView.exe Nirsoft - Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/Alkalmazások/A1/A2/A3/A4/A5/RecentFilesView.exe -
resource yara_rule static1/unpack001/Alkalmazások/A1/A2/A3/A4/A5/RecentFilesView.exe upx static1/unpack001/Alkalmazások/A1/A2/A3/A4/A5/UserAssistView.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx unpack001/Alkalmazások/A1/A2/A3/A4/A5/UserAssistView.exe unpack003/out.upx - Untrusted Codesign Signers 3 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Alkalmazások/A1/A2/A3/A4/A5/ExecutedProgramsList.exe unpack001/Alkalmazások/A1/A2/A3/A4/A5/RecentFilesView.exe unpack001/Alkalmazások/A1/A2/A3/A4/LastActivityView.exe
File Explorer
-
Alkalmazások.zip.zip 6.8MB
-
Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.chm.chm 24KB
-
Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.exe.exe 135KB
-
Alkalmazások/A1/A2/A3/A4/A5/A6/help.txt122B
-
Alkalmazások/A1/A2/A3/A4/A5/Everything.lnk.lnk 609B
-
Alkalmazások/A1/A2/A3/A4/A5/ExecutedProgramsList.exe.exe 81KB
-
Alkalmazások/A1/A2/A3/A4/A5/RecentFilesView.exe.exe 46KB
-
out.upx.exe 63KB
-
Alkalmazások/A1/A2/A3/A4/A5/UserAssistView.exe.exe 30KB
-
out.upx.exe 54KB
-
Alkalmazások/A1/A2/A3/A4/A5/help.txt763B
-
Alkalmazások/A1/A2/A3/A4/A5/journal-tool.exe.exe 13.5MB
-
Alkalmazások/A1/A2/A3/A4/LastActivityView.cfg578B
-
Alkalmazások/A1/A2/A3/A4/LastActivityView.exe.exe 130KB
-
Alkalmazások/A1/A2/A3/A4/help.txt331B
Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.chm
- SHA256 d5909ca92c389ab1c01909a6f07fd351e2a655be97931caaecc3307a9e8f26e1
- MD5 ef8d0a30da9ab8cdbbbd62d74bce1187
- SHA1 06441c5dfa4b9577afc989454216ea014a49b8d6
- SHA512 695faa16c29d0ca5bdb2afc5da3e05f25a6b17ce4dbee43aebc9ffdbe18d843273437bb0189bb1ef2a4ececbb236aefe634f38f94a179e593edaa6105fb2e789
- SSDEEP 384:ZaeGDZD/3k0Xb1/WN1iA73A8f2ZVDUDjGTa1Mu72:Za1ZtijuVDUHGO1j6
- TLSH T13CB2C03833810531E06F0E7A5E049BEF76475E9D7BB2634631AA96F51AA2D1C0735DCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Alkalmazások/A1/A2/A3/A4/A5/A6/USBDeview.exe
- IMPHASH db99b31ed7e32faf640113a15d43e404
- SHA256 63012ea9ce8ed335db7bdd33fa7bb449aa1ba31755c6845c1e79c11cb60dc908
- MD5 d0d19f2cccacf70bc84846076acc11c8
- SHA1 21154b5b479aaae4c56aec309bf6964eb52d1ce1
- SHA512 b45a024e3e22821c3a9fec56969fda164acab0f12a28a29a8c9263373004b57a246ff46f90a81b65714b09d788ed8c265de130eab059c546caae79b6d15b73d4
- SSDEEP 3072:xFRB1T0ABjInqx9sKJQ1jrD0ivz0ll27ENCP7g8g3OaAy:xFRBVnj0qxbJQp/0iolGENC6RL
- TLSH T1F7D34943B2E49072E1F72A301EB94B728DF5BC706974C65F93A0694F6CB0A81DD2536B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Digest
52:67:c8:3e:8c:b3:f5:28:4c:ef:9a:c9:bd:97:8c:02:4f:91:47:af:6e:c4:79:a6:3e:4e:f4:80:7b:8a:ad:b2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Chains
Aug 30, 2022
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Serial Number
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 9, 2019 - Sep 9, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
87548
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\Projects\VS2005\USBDeview\Release\USBDeview.pdb
msvcrt
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
_onexit
__dllonexit
_mbsrchr
atol
qsort
_strlwr
_mbsicmp
_mbschr
memmove
_strnicmp
free
strtoul
modf
strchr
memcmp
_memicmp
strrchr
strcmp
malloc
_strcmpi
srand
rand
abs
_strupr
_itoa
??3@YAXPAX@Z
??2@YAPAXI@Z
strlen
memcpy
_purecall
_stricmp
_snprintf
atoi
strcpy
memset
strncat
sprintf
strcat
comctl32
CreateToolbarEx
ord6
ImageList_Create
ImageList_SetImageCount
ImageList_AddMasked
ImageList_Add
ws2_32
WSASetLastError
closesocket
send
WSAAsyncSelect
WSAAsyncGetHostByName
connect
inet_addr
htonl
WSAGetLastError
htons
bind
socket
WSAStartup
WSACleanup
kernel32
Process32Next
OpenProcess
SetEnvironmentVariableA
GetCurrentThreadId
DeviceIoControl
GetStartupInfoA
FreeLibrary
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
ExitProcess
GetCurrentProcessId
Sleep
SetErrorMode
ExpandEnvironmentStringsA
CreateProcessA
GetStdHandle
GetProcAddress
GetPrivateProfileStringA
WinExec
GetModuleFileNameA
GetComputerNameA
GetLastError
CompareFileTime
FileTimeToSystemTime
LoadLibraryA
GetModuleHandleA
SystemTimeToFileTime
GetLogicalDrives
GetWindowsDirectoryA
GetDriveTypeA
GetDiskFreeSpaceExA
CreateFileA
GetTickCount
WriteFile
ReadFile
FlushFileBuffers
CloseHandle
DeleteFileA
CreateThread
GetCurrentProcess
GetFileSize
GetTempFileNameA
GetSystemDirectoryA
GlobalAlloc
GlobalLock
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetTimeFormatA
GlobalUnlock
FileTimeToLocalFileTime
GetTempPathA
LocalFree
GetFileAttributesA
SystemTimeToTzSpecificLocalTime
FormatMessageA
LoadLibraryExA
GetDateFormatA
GetPrivateProfileIntA
WritePrivateProfileStringA
EnumResourceNamesA
user32
GetWindowThreadProcessId
SetForegroundWindow
AttachThreadInput
EnumWindows
GetMessageA
RemoveMenu
GetSysColorBrush
ShowWindow
LoadCursorA
SetTimer
GetDC
ReleaseDC
SetCursor
GetWindow
GetClientRect
SetDlgItemTextA
DrawFrameControl
GetDlgItemTextA
SetWindowTextA
GetSystemMetrics
SendDlgItemMessageA
GetWindowRect
GetDlgItemInt
DeferWindowPos
EndPaint
EndDialog
GetDlgItem
CreateWindowExA
InvalidateRect
SetDlgItemInt
BeginPaint
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
SendMessageA
RegisterClassA
UpdateWindow
LoadImageA
GetWindowLongA
SetWindowLongA
GetSysColor
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetWindowTextA
CheckMenuItem
OpenClipboard
GetMenu
EmptyClipboard
EnableMenuItem
GetParent
GetClassNameA
CloseClipboard
GetMenuItemCount
SetClipboardData
EnableWindow
MapWindowPoints
GetSubMenu
GetMenuStringA
GetCursorPos
CheckMenuRadioItem
MoveWindow
InsertMenuItemA
GetDlgCtrlID
DestroyMenu
DestroyWindow
EnumChildWindows
GetMenuItemInfoA
LoadMenuA
LoadStringA
ModifyMenuA
CreateDialogParamA
DialogBoxParamA
CreatePopupMenu
LoadIconA
SetMenuItemInfoA
GetKeyState
TranslateMessage
KillTimer
IsDialogMessageA
DrawTextExA
InsertMenuA
TrackPopupMenu
RegisterWindowMessageA
PostQuitMessage
DispatchMessageA
ChildWindowFromPoint
gdi32
GetTextExtentPoint32A
SetBkMode
SetStretchBltMode
StretchBlt
GetStockObject
SetBkColor
GetPixel
GetObjectA
DeleteDC
CreateFontIndirectA
GetDeviceCaps
DeleteObject
SetTextColor
CreateCompatibleDC
SelectObject
SetPixel
CreateCompatibleBitmap
comdlg32
ChooseFontA
FindTextA
GetSaveFileNameA
advapi32
ControlService
ChangeServiceConfigA
CloseServiceHandle
OpenSCManagerA
RegCloseKey
QueryServiceStatus
RegCreateKeyA
StartServiceA
OpenServiceA
RegConnectRegistryA
RegLoadKeyA
RegUnLoadKeyA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptHashData
shell32
SHGetFileInfoA
ShellExecuteExA
ShellExecuteA
Shell_NotifyIconA
ole32
CoCreateInstance
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=18, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=338, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=33, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Alkalmazások/A1/A2/A3/A4/A5/A6/help.txt
- SHA256 a98bf5fae4acdc9598e49640346d5fef832b50084073a21daf7f899d028a79e1
- MD5 b5ff8866103110a6e177aedf7d2a24b8
- SHA1 2aa15a11d71e4cab13cb01cd05abf818a50ff3d2
- SHA512 6dfd94adf81a7b14877a46e4d964cf50390171cf8d3bdfb16004ed5c75efd388bac4c5cb4a6862c4d451365f4b6af00050210a4bdc1a464f9f6316fb742a1e54
- TLSH T146B09B5471FFC56A74013B558B00C418E102534C00D537591BC75457F42017DDD864FD
- MD5 SHA1 SHA512 TLSH
Alkalmazások/A1/A2/A3/A4/A5/Everything.lnk
- SHA256 0d1ba5089494ed0384117da3592aea539b74af8adbe8cf823eada983a93fb0df
- MD5 1290f7650fb1b027780072e073411444
- SHA1 996e44a4fa348f5edf3923373c393abd562050aa
- SHA512 c591955d9b69f7b159953a06e6bcc150f54d8e3a667873a1a4f93f108881919b5b94eaf39fe745488c16d76323bc10ebc4384c6e12f5a14c795dd92f7c35f3e0
- TLSH T11AF09E230BC3587AF4E14275CD27DBA1EF4CF48942C8807F9746604819B72414888A7A
- MD5 SHA1 SHA512 TLSH
Alkalmazások/A1/A2/A3/A4/A5/ExecutedProgramsList.exe
- IMPHASH f9f666a7dc93e67d08bf8ce4f69a541d
- SHA256 e3af98717bf1cda7dc4aacb5b34d111ac237604161cd96f7929ec33f2ff260b6
- MD5 7366668cc7eaa1068a38cc2761217fc4
- SHA1 a6790473129e7298185ef4ee4e0badbdecc50040
- SHA512 5af36447a1d29c2024b83cf08bb9cfc2c360e02d819eb7b238e1e9f774aef6e5930f5f33b9f64d62e4e958911493338a0d95b58b22b076c4e9025abe6f3f0b4a
- SSDEEP 1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q
- TLSH T1B8836B0363E44072FAB31A709AB36A664BFA7D225A74C50F8BA4B94E6CF0741D531397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
eb:92:d0:76:1a:1f:ce:64:36:38:d9:f0:c3:5a:e9:55:0a:6f:37:92
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Mar 18, 2016
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2014 - Sep 12, 2019
Minor OS version
0
Major OS version
4
Entry point
46820
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Projects\VS2005\ExecutedProgramsList\Release\ExecutedProgramsList.pdb
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
__p__commode
__dllonexit
_wcslwr
strlen
qsort
_purecall
_itow
_wcsnicmp
malloc
wcscmp
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_onexit
wcschr
free
modf
_wtoi
_memicmp
memcmp
wcstoul
wcsrchr
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcslen
_wcsicmp
wcscpy
memset
wcscat
_snwprintf
wcsncat
comctl32
ord17
ImageList_Add
ImageList_Create
ImageList_SetImageCount
ImageList_AddMasked
CreateToolbarEx
CreateStatusWindowW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
kernel32
GetStdHandle
GetModuleHandleA
EnumResourceTypesW
GetTickCount
SetErrorMode
DeleteFileW
GetCurrentProcess
ReadProcessMemory
GetCurrentProcessId
ExitProcess
GetLogicalDrives
GetStartupInfoW
OpenProcess
GetVolumeInformationW
QueryDosDeviceW
FileTimeToSystemTime
SystemTimeToFileTime
GetDriveTypeW
CompareFileTime
GetModuleHandleW
LoadLibraryW
GetProcAddress
FreeLibrary
FindClose
GetFileSize
GetVersionExW
FindFirstFileW
GetTimeFormatW
CloseHandle
GetFileAttributesW
GetWindowsDirectoryW
FileTimeToLocalFileTime
ReadFile
WriteFile
GetModuleFileNameW
GetNumberFormatW
CreateFileW
LockResource
LocalFree
FindResourceW
LoadResource
lstrlenW
lstrcpyW
SystemTimeToTzSpecificLocalTime
GlobalAlloc
GlobalUnlock
LoadLibraryExW
WideCharToMultiByte
GetTempPathW
GetLastError
GetLocaleInfoW
FindNextFileW
SizeofResource
GlobalLock
GetDateFormatW
GetTempFileNameW
FormatMessageW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetPrivateProfileStringW
GetLongPathNameW
user32
GetMenuItemInfoW
GetMessageW
PostQuitMessage
TrackPopupMenu
RegisterWindowMessageW
BeginDeferWindowPos
GetKeyState
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
GetClientRect
CreateWindowExW
SendDlgItemMessageW
EndDialog
SetWindowLongW
GetDlgItem
GetWindowRect
GetDlgItemInt
SetWindowTextW
InvalidateRect
UpdateWindow
SendMessageW
SetWindowPlacement
SetDlgItemTextW
GetWindowPlacement
SetDlgItemInt
GetSystemMetrics
DeferWindowPos
SetMenu
LoadAcceleratorsW
PostMessageW
DefWindowProcW
TranslateAcceleratorW
RegisterClassW
MessageBoxW
LoadImageW
GetSysColor
GetWindowLongW
SetFocus
CheckMenuItem
GetMenuItemCount
CloseClipboard
GetCursorPos
GetParent
SetClipboardData
EnableWindow
MapWindowPoints
GetMenu
GetSubMenu
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
MoveWindow
GetMenuStringW
ModifyMenuW
SetCursor
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
LoadStringW
DestroyWindow
SetWindowPos
GetDesktopWindow
GetWindowTextW
LoadMenuW
LoadIconW
DestroyIcon
IsDialogMessageW
TranslateMessage
DispatchMessageW
DrawTextExW
EndDeferWindowPos
gdi32
GetTextExtentPoint32W
SetBkColor
GetStockObject
GetDeviceCaps
GetPixel
DeleteDC
SetPixel
SelectObject
CreateCompatibleDC
GetObjectW
SetTextColor
CreateFontIndirectW
SetBkMode
DeleteObject
comdlg32
GetSaveFileNameW
FindTextW
advapi32
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
ShellExecuteW
SHGetFileInfoW
ShellExecuteExW
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=18, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=285, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=26, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Alkalmazások/A1/A2/A3/A4/A5/RecentFilesView.exe
- SHA256 80930766283e9575617cd03ea31e575c091fb2148e08c37874afe40371cfd5a3
- MD5 4d27a0ef39f71709510662519553b24d
- SHA1 35adea46f3fde61c14230c67b687086429fc8438
- SHA512 8f9fe1b9d0d93aa80520319de07e7a53fe2eb51020da207007ac0b74412bfe896ee664778d001709d29b6ce3e533d611de62734854bd8037979ee59f19a600d4
- SSDEEP 768:QxKVTfbKrhSUN53TiDNoG3+MUAkow8HMcZwS62qGFh7JzbiyiyO:ZfbWNomnMUhZKBsC5Jzbiv
- TLSH T12323D0D38D747A50EA850D34A5F7DB37AEB2FA825A54439674AED09DBCD03E07D1800B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
18:30:04:81:57:f7:64:ab:79:f0:db:42:ad:23:c7:4b:fb:ec:e8:e2:f1:d4:07:77:ad:ce:ab:fd:52:a5:53:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Feb 19, 2017
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
8a:ba:65:93:92:48:ce:e9:49:47:12:09:31:f9:0c:8d:8b:1f:27:f9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Feb 19, 2017
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2014 - Sep 12, 2019
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Mar 30, 2016
Timespan
Mar 30, 2016 - Jun 30, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
82512
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=261, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=23, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 b881e20c1189ca4ad34a4a8c275348eb05b97cc609333298e65585bb884e8647
- MD5 d00f5a79dc5294faef0fabbf1a3430a3
- SHA1 d4b0f888ba5d1511b1dc6e9a15384f109b799225
- SHA512 49cc41a675b4f851a27d39d22bff8b6da2665b25828af24bbf6c830bd4e0931ea64dc8935d211f40297377ea179b88b055595abc191e9d8d8acf06b55e9f666c
- SSDEEP 768:KEEFSGQ6oHcpU82vKJgrGeEdU0G2oy5+sGkopsmXsEhaTj4p+Ut9R:sRm82vKJmj2J58k+bXsEgYcULR
- TLSH T174533A0376F09075E5F31A702E3A5A114AFEBD305534CA0F8B946D0F6CB2656EE2A357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43372
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=261, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=23, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Alkalmazások/A1/A2/A3/A4/A5/UserAssistView.exe
- SHA256 bc11c4150bbc6f8b2cf7bc96bedbb183c61d53ab8e4052b15d58bad6b6d1befa
- MD5 f36530f46a34516be38521ee9a134d28
- SHA1 47f0553e0a0febbef59fd9a32149497bbdd5229c
- SHA512 5c1a1282ffc25409d0044770c80e92f7a89fb40567dbb24f64f46750083bb30b842a63ef58b8b9433fa5a5903a5aa7bf71ee941709365c6bc17a9f4d85b1ad5d
- SSDEEP 384:IecsPHRggjhCnMgZas8+oAEqPm63AovtX625wWMPODVDSt/U/BEUxhUp5Erzrbqu:HhCWSrPlX62arODxS1U/Br9nrbqUo
- TLSH T103E2D04AEAE45536E0E16D3900A347275748F8124FB807D72B90CA4FBD20BA1AF237A0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
25KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=254, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=22, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 33b2fce3e8f8f62d4b73825289f855bdefe32c8c77a38886a1ca25523cb931ca
- MD5 36583477674dd4ad3c18a1fa9dcff4e7
- SHA1 27b693cc59e54f1132aacd26ce6e4cbd6fa17232
- SHA512 4689125013e574111ded9b148a9ace3c8e121cb96973851dbfe656756b283b442f82d03c3b3cbc84d03d1beb5f7186abf78fd4afe44adc69d0b507fe19f70864
- SSDEEP 768:Mgb2LcKcqcJ95WFyDLmnj7FhJfmazCcQISvxCQI2QGoY5tt:GcTWILYj7PJfmVHJtoM7
- TLSH T1D3432B0376F98071EDB31A305E376A159ABE79205A38CB4F8B946D0E6CF1790D936363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=254, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=22, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Alkalmazások/A1/A2/A3/A4/A5/help.txt
- SHA256 a09c5d9fbe34aa75f695a89edace7bca953103fa7399fc9eb7eaf19f035a0877
- MD5 8d4fcd856f4b2af3ba2d42915d8ed1ac
- SHA1 91c64dc74d50c83231c4cd7be7e97d817d41c486
- SHA512 076d1e097eb5fcdcc14ba58e27f51a1b658630a8b25b9a55c06166ad33f696c02fceafbe188dbd2f73d21ea2a157f8e269dfdc4500bf2ce8d000dac5c31f1e9b
- TLSH T11601D094931FC3B4B4B61E2A9415AF096347EB9697C8363438C3405BF4093AD184E2FE
- MD5 SHA1 SHA512 TLSH
Alkalmazások/A1/A2/A3/A4/A5/journal-tool.exe
- SHA256 8226b5885ea94def0a895da5a98fdcbd826da231a0eaded5bfa380a84cf8d0d9
- MD5 445fbbeb5d7ab4cf029200c856b20d05
- SHA1 50023e87a4b53e23f5b3437aa13f99d7ec887020
- SHA512 83735ccd417acba82064391174587e4de7d53b546c7eb902d756ba068518d7ef4bf59ec47e54089d09cb58b702baf7f4fcbf79c25b1327c9db3d6e9e383a1176
- SSDEEP 196608:CcfvFlLGQXArrpgVutHN5cmhJxmzwmjUg35Z6:C8vhXiAutHvgwyUcq
- TLSH T10FE67D47F59254E8C1AAD170822AD2B3BA307C550B3467E72B50FB792F76BD05EBA310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ae:b0:d3:11:06:0f:81:c0:90:8a:80:09:1d:6e:b8:c9:fb:6c:f9:db:37:ef:b0:ed:2d:41:9f:18:3a:c3:0b:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=13017981,CN=Inspect Element Ltd,O=Inspect Element Ltd,L=POOLE,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Aug 31, 2022
SERIALNUMBER=13017981,CN=Inspect Element Ltd,O=Inspect Element Ltd,L=POOLE,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=13017981,CN=Inspect Element Ltd,O=Inspect Element Ltd,L=POOLE,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=13017981,CN=Inspect Element Ltd,O=Inspect Element Ltd,L=POOLE,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
01:8c:52:ec:df:d9:ae:65:be:45:96:45:8b:4c:31:af
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 2, 2021 - Dec 16, 2022
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
26976344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
_cgo_dummy_export
glowDebugCallback_glcore32
goCharCB
goCharModsCB
goCursorEnterCB
goCursorPosCB
goDropCB
goErrorCB
goFramebufferSizeCB
goJoystickCB
goKeyCB
goMarkdownImageCallback
goMonitorCB
goMouseButtonCB
goScrollCB
goWindowCloseCB
goWindowContentScaleCB
goWindowFocusCB
goWindowIconifyCB
goWindowMaximizeCB
goWindowPosCB
goWindowRefreshCB
goWindowSizeCB
iggAssert
iggInputTextCallback
iggIoGetClipboardText
iggIoSetClipboardText
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
618KB
Virtual Size
617KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
8.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
754B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
15KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.edata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
Alkalmazások/A1/A2/A3/A4/LastActivityView.cfg
- SHA256 0163c60e48ee8874dfc528a87781cf81ab04e9d881962111763ece783fc9a302
- MD5 0cc42dfa3eed5fb7d87c61a88b8a4892
- SHA1 b78e984d8ef36163485549d054f8bfd5a55078df
- SHA512 1e4c303942d6a39b98d7b900cbfa33ef2bda78c5120cd209d3472e925a459d6797931befccec8c1d7727f27327400825283d6d09a291f9a7a550b3ea50d56b39
- TLSH T137F0E90298CB086ED1C15FACF0F9392004F56E973CC408F0AF6F1708CFC659ADA86140
- MD5 SHA1 SHA512 TLSH
Alkalmazások/A1/A2/A3/A4/LastActivityView.exe
- IMPHASH 28d54068583ea348b007c0eb72f71f9c
- SHA256 b1b7a772c927b4d3e2e4d59ba69e3fe955506ff80cee0947d54c6b3fabef6860
- MD5 a19eb1487622a13402c0d63eede58f59
- SHA1 c662772fcd96c7d6decd629af28f26014c506a30
- SHA512 6b7b676ebac4e3127a63cc1fbde85144d551c7d38330c516ccb0aeaa7558155eefc1dfba3f3d7b18510f8e099c37fa2504f1ff00607f52187a03780fd7f75f94
- SSDEEP 3072:gnk4eDEnIUuBkxlXvVbZTK1TT4ik69L1X7Bom:gngdBeXvpZTK1P4Kp
- TLSH T1B8D37C4273E54071F5F31A726EB65A3ACAB6FD705B34DA0B97906C4E2CF1640D9223A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
04:ed:51:36:7d:e2:1c:df:1f:c6:58:22:a8:7d:53:17:ef:07:89:ba
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Jul 18, 2019
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 27, 2011 - May 30, 2020
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Issuer
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - May 30, 2020
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2014 - Sep 12, 2019
Minor OS version
0
Major OS version
4
Entry point
76414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Projects\VS2005\LastActivityView\Release\LastActivityView.pdb
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__p__fmode
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
calloc
__set_app_type
_controlfp
_except_handler3
_wcmdln
realloc
_msize
_wcslwr
strlen
_purecall
_itow
_wcsnicmp
qsort
free
modf
_memicmp
_wtoi
memcmp
wcstoul
wcsrchr
swscanf
malloc
_ultow
wcscmp
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcslen
wcscpy
memset
_wcsicmp
wcschr
_snwprintf
wcscat
wcsncat
comctl32
CreateStatusWindowW
CreateToolbarEx
ImageList_SetImageCount
ImageList_Create
ord17
ImageList_Add
ImageList_AddMasked
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
GetCurrentProcessId
ExitProcess
GetLogicalDrives
GetLongPathNameW
QueryDosDeviceW
GetVolumeInformationW
OpenProcess
EnumResourceTypesW
GetModuleHandleA
GetStartupInfoW
FreeLibrary
ReadProcessMemory
DeleteFileW
SetErrorMode
CloseHandle
GetFileSize
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetDriveTypeW
CompareFileTime
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetTickCount
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetLastError
GetCurrentProcess
GetDateFormatW
FindNextFileW
SizeofResource
GetTempFileNameW
GlobalLock
FormatMessageW
FindFirstFileW
GetVersionExW
FindClose
GetTimeFormatW
GetFileAttributesW
FileTimeToLocalFileTime
ReadFile
FindResourceW
WriteFile
GetModuleFileNameW
LocalFree
LoadResource
CreateFileW
TzSpecificLocalTimeToSystemTime
LockResource
SystemTimeToTzSpecificLocalTime
lstrcpyW
MultiByteToWideChar
lstrlenW
LocalFileTimeToFileTime
LoadLibraryExW
GlobalAlloc
GetSystemDirectoryW
GlobalUnlock
WideCharToMultiByte
GetTempPathW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
user32
ChildWindowFromPoint
LoadCursorW
SetCursor
GetSysColorBrush
ShowWindow
GetDlgItemInt
SetDlgItemInt
DeferWindowPos
CreateWindowExW
BeginPaint
EndPaint
GetWindow
GetClientRect
SendDlgItemMessageW
DrawFrameControl
EndDialog
SetWindowLongW
GetDlgItem
SetWindowTextW
UpdateWindow
SendMessageW
SetDlgItemTextW
InvalidateRect
GetDlgItemTextW
GetWindowRect
GetSystemMetrics
RegisterClassW
PostMessageW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPos
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
LoadImageW
GetSysColor
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
KillTimer
SetTimer
GetParent
MoveWindow
OpenClipboard
CheckMenuItem
GetMenuStringW
GetMenuItemCount
CloseClipboard
CheckMenuRadioItem
SetClipboardData
EnableWindow
GetCursorPos
MapWindowPoints
GetMenu
GetSubMenu
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
DestroyWindow
LoadStringW
GetDesktopWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DestroyIcon
LoadIconW
DrawTextExW
GetKeyState
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage
CreatePopupMenu
CallWindowProcW
gdi32
CreateFontIndirectW
SetTextColor
DeleteObject
DeleteDC
GetObjectW
SetBkMode
GetStockObject
GetTextExtentPoint32W
SetBkColor
GetDeviceCaps
GetPixel
SetPixel
SelectObject
CreateCompatibleDC
comdlg32
FindTextW
GetSaveFileNameW
advapi32
RegEnumValueW
RegConnectRegistryW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
OpenServiceW
OpenSCManagerW
ControlService
StartServiceW
QueryServiceStatus
CloseServiceHandle
RegCloseKey
shell32
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHBindToParent
SHGetDesktopFolder
SHGetMalloc
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
VariantTimeToSystemTime
SysFreeString
SysAllocString
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=20, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=64, version=9210,
count=11, id=28, version=9178,
count=305, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=41, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Alkalmazások/A1/A2/A3/A4/help.txt
- SHA256 02a7244713b321fcbf19fb1e668f16a36d17ce991b12db71adbe9a844c6c4c8f
- MD5 e41f592d2ab01319cd10eccad14a3ce8
- SHA1 f5c52d405ecb8c5f1998927072e065b6523b4948
- SHA512 05a36ed37a5ee4e29d583cb9b85acbebf43631aba7e5867bd8a1c49368ae307ba27538b64ac8639edc44858e6787872b0efd69dc5ad88594bb4545dc756712b5
- TLSH T1DDE0C08C07CEF2C3E550254332412E05640BC986578985581AC38047B40624D9FE300F
- MD5 SHA1 SHA512 TLSH