Free AEYTHYR.zip
- SHA256 0c7a70656d6b42aaa07c6335fc83954b35a6613e6bd779cb8046f6ea20b3a445
Overview
overview
3Static
static
3Free AEYTH...yr.exe
windows10-2004-x64
1Free AEYTH...yr.exe
windows11-ltsc_2024-x64
1Free AEYTH...XX.dll
windows10-2004-x64
1Free AEYTH...XX.dll
windows11-ltsc_2024-x64
1Free AEYTH...lp.dll
windows10-2004-x64
1Free AEYTH...lp.dll
windows11-ltsc_2024-x64
1Free AEYTH...re.dll
windows10-2004-x64
1Free AEYTH...re.dll
windows11-ltsc_2024-x64
1Free AEYTH...rv.dll
windows10-2004-x64
1Free AEYTH...rv.dll
windows11-ltsc_2024-x64
1Free AEYTHYR/vmm.dll
windows10-2004-x64
1Free AEYTHYR/vmm.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Free AEYTHYR/Aethyr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
Free AEYTHYR/Aethyr.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
Free AEYTHYR/FTD3XX.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Free AEYTHYR/FTD3XX.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
Free AEYTHYR/dbghelp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
Free AEYTHYR/dbghelp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
Free AEYTHYR/leechcore.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
Free AEYTHYR/leechcore.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
Free AEYTHYR/symsrv.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Free AEYTHYR/symsrv.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
Free AEYTHYR/vmm.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
Free AEYTHYR/vmm.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target Free AEYTHYR.zip
- Size 11.1MB
- Sample260830-2yt35stwhy
- SHA256 0c7a70656d6b42aaa07c6335fc83954b35a6613e6bd779cb8046f6ea20b3a445
- MD5 59a5d86599c4d486ee3d99fcbafb0b0e
- SHA1 7f02d1571ad5295ab0e06fa94e4184c15235665b
- SHA512 f63409e624f0ce59749ea9581999f816210210a6fda6f9db9beca04d102cb2cb0d11a3485340077ccb37798c3c3c2ff3d0eb39586aed8223ad61d786da1c796c
- SSDEEP 196608:vemR1omrWWNTBzR5OO0N+38SGI9NhCL9v12Im87RUrGo9MmG5PHYprQuBBJbpfE3:WjgfsO0N/hI9CL9zmIc8P4prDBBTU
- TLSH T1D6C633CEA8689357E86704F749335F424AEF631F90CD9578EE2234046BB7B68250B3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Free AEYTHYR/Aethyr.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Free AEYTHYR/dbghelp.dll unpack001/Free AEYTHYR/symsrv.dll
File Explorer
-
Free AEYTHYR.zip.zip 11.1MB
-
Free AEYTHYR/Aethyr.exe.exe 3.7MB
-
Free AEYTHYR/FTD3XX.dll.dll 501KB
-
Free AEYTHYR/Symbols/ntkrnlmp.pdb/1924BC23550919F88B17A384B944B5431/ntkrnlmp.pdb10.9MB
-
Free AEYTHYR/Symbols/ntkrnlmp.pdb/72C69E726C648BC18257AF38FA78A2F21/ntkrnlmp.pdb10.9MB
-
Free AEYTHYR/configs/default.cfg19KB
-
Free AEYTHYR/configs/moderate.cfg19KB
-
Free AEYTHYR/dbghelp.dll.dll 1.5MB
-
Free AEYTHYR/imgui.ini160B
-
Free AEYTHYR/info.db4.9MB
-
Free AEYTHYR/leechcore.dll.dll 150KB
-
Free AEYTHYR/logs/session.log2KB
-
Free AEYTHYR/mmap.txt186B
-
Free AEYTHYR/symsrv.dll.dll 145KB
-
Free AEYTHYR/vmm.dll.dll 2.3MB
Free AEYTHYR/Aethyr.exe
- IMPHASH 321aebf297232ce09d81c32059b639a1
- SHA256 1a6c20968902d279bbb99afefa8d7adacf9a4ee35ea696dd7e09a1783f4969cf
- MD5 8a5a67496b22450ba5f762bb63bb1c52
- SHA1 1ec8a7bb56338f72be5c743b38044c2465345f7b
- SHA512 d15b925b5a19e8ea3faf1db11e3d927f38e804c0b44892ae5e2eab88bead69b5bfdbbe352260cca0aa7f7015f6b73d656ad8c9a5bc7c3d10e6333d3a168d1573
- SSDEEP 49152:Vfr8a8iu5yikWj4lxLzCldnYajHYQz1xAMfo/Y7wjgTm0PxAwJHE6h6ErcWA:iYIja84QzDo/Y7mgTm05AwJHE6h
- TLSH T16006D047F3E6869FD26666B8C566D323E7767C180B3143EF2AC40564EEAB1E04A35F40
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
973864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Abdul Chaudhry\Desktop\Free Version AEYTHR\bin\Aethyr.pdb
d3d11
D3D11CreateDeviceAndSwapChain
ws2_32
setsockopt
sendto
htons
recvfrom
socket
WSACleanup
WSAStartup
inet_addr
kernel32
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
IsDBCSLeadByte
GetProcAddress
FreeLibrary
QueryPerformanceCounter
SetConsoleTextAttribute
Sleep
GetLocalTime
K32EnumDeviceDrivers
ReadFile
GetModuleFileNameA
SizeofResource
Process32First
SetPriorityClass
SetConsoleTitleA
GetCurrentProcess
GetStdHandle
K32GetDeviceDriverFileNameA
WriteFile
TerminateProcess
Module32Next
SetThreadPriority
FindResourceA
Module32First
OpenProcess
CreateToolhelp32Snapshot
GetTempPathA
GetTickCount64
QueryFullProcessImageNameA
CreateFileA
GetCurrentThread
LockResource
GetCommState
Process32Next
CloseHandle
LoadResource
GetThreadContext
CreateFileMappingA
GetFileSize
ReadProcessMemory
GetCurrentProcessId
GlobalUnlock
QueryFullProcessImageNameW
CreateProcessA
SetConsoleOutputCP
MapViewOfFile
SetCommTimeouts
SetCommState
AllocConsole
IsDebuggerPresent
VirtualQueryEx
CheckRemoteDebuggerPresent
FlushFileBuffers
GetExitCodeProcess
OutputDebugStringA
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
GetModuleHandleA
WideCharToMultiByte
GlobalLock
GlobalFree
MultiByteToWideChar
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GlobalAlloc
GetModuleHandleW
GetStartupInfoW
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleWindow
user32
OpenClipboard
LoadImageA
FillRect
GetIconInfo
DestroyIcon
DrawIconEx
GetWindowThreadProcessId
DispatchMessageA
GetWindowRect
DestroyWindow
IsWindowVisible
SetWindowPos
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
IsWindow
GetAsyncKeyState
MessageBoxA
EnumWindows
DefWindowProcA
SetLayeredWindowAttributes
SetFocus
TranslateMessage
CloseClipboard
mouse_event
PeekMessageA
EmptyClipboard
GetCursorPos
ReleaseDC
SetCursorPos
ReleaseCapture
IsWindowUnicode
SetProcessDPIAware
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetDC
LoadCursorA
GetMessageExtraInfo
GetKeyState
DefWindowProcW
GetWindowTextW
SetForegroundWindow
UpdateWindow
FindWindowA
SetWindowLongPtrA
PostQuitMessage
GetWindowLongPtrA
GetClipboardData
SetClipboardData
GetClassNameW
gdi32
GdiFlush
DeleteDC
CreateDIBSection
SelectObject
CreateSolidBrush
GetObjectA
CreateCompatibleDC
DeleteObject
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
shell32
ShellExecuteA
ShellExecuteW
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_yield
_Thrd_hardware_concurrency
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_detach
_Thrd_join
_Mtx_unlock
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
??Bios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
_Xtime_get_ticks
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
vmm
VMMDLL_Scatter_Clear
VMMDLL_Initialize
VMMDLL_Scatter_ExecuteRead
VMMDLL_Scatter_PrepareEx
VMMDLL_Map_GetModuleFromNameW
VMMDLL_Close
VMMDLL_MemWrite
VMMDLL_Map_GetEATU
VMMDLL_VfsListU
VMMDLL_MemReadEx
VMMDLL_WinReg_QueryValueExU
VMMDLL_Scatter_Prepare
VMMDLL_PdbLoad
VMMDLL_ProcessGetInformationAll
VMMDLL_PdbSymbolAddress
VMMDLL_Scatter_Read
VMMDLL_Map_GetPhysMem
VMMDLL_MemFree
VMMDLL_ConfigSet
VMMDLL_Scatter_Initialize
VMMDLL_Map_GetModuleFromNameU
VMMDLL_InitializePlugins
VMMDLL_VfsReadW
VMMDLL_PidGetFromName
VMMDLL_ConfigGet
leechcore
LcCommand
LcClose
LcCreate
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
wintrust
WinVerifyTrust
setupapi
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__current_exception_context
__current_exception
wcsrchr
__C_specific_handler
strstr
__std_exception_copy
memmove
__std_exception_destroy
__std_terminate
memcmp
memchr
memcpy
strchr
api-ms-win-crt-stdio-l1-1-0
fflush
fseek
feof
__stdio_common_vfprintf
__acrt_iob_func
ftell
fwrite
_wfopen
__p__commode
__stdio_common_vsprintf
ferror
freopen
_set_fmode
fread
__stdio_common_vsscanf
fputc
fclose
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fopen_s
fgetc
__stdio_common_vsprintf_s
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-string-l1-1-0
strcmp
toupper
strncmp
_stricmp
strncpy
_wcsicmp
tolower
isdigit
api-ms-win-crt-heap-l1-1-0
calloc
malloc
_set_new_mode
realloc
free
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoll
strtoull
strtod
atoi
strtol
atof
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_exit
exit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_beginthreadex
_cexit
abort
terminate
_errno
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_register_onexit_function
_initialize_onexit_table
_invoke_watson
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
roundf
_dsign
ldexp
_dclass
_ldsign
_fdclass
_ldclass
acosf
asin
atan2
atan2f
powf
_fdsign
pow
logf
log
tanf
fmodf
cosf
__setusermatherr
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
___lc_codepage_func
Name
.text
Size
1007KB
Virtual Size
1006KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
648KB
Virtual Size
667KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=34810,
count=6, id=257, version=35207,
count=1, id=253, version=35207,
count=16, id=259, version=35207,
count=11, id=260, version=35207,
count=39, id=261, version=35207,
count=1, id=260, version=35222,
count=29, id=257, version=35222,
count=493, id=1, productName=Unmarked objects,
count=10, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
Free AEYTHYR/FTD3XX.dll
- IMPHASH 94eff8313f705d14c2421a2e17c00648
- SHA256 3c0fc158fd4aa604c526d58ed8274ae830d53e69e01210cc5b5fa54ec5a9b7c0
- MD5 f7a94af3b5f2f815866f97e8e0e393de
- SHA1 b9bcaad236c9ce5e938c7477e79e13e621c962af
- SHA512 7877f2a3d78a7a3cf72d117b4111a83f67f9e193c7c1f6daa29cd08e3d0833533aebc34c1e3cbdb17f0b243c963443790880e6ad9ced2a7c3171ef6f2fe6d1b8
- SSDEEP 6144:wOJfCxZ2hUellRG5MJV8SAzLk5MKOE3LwEDHYG4LWNE7W5oP8E:dC/2LzG4leI5MKf3LtrCWCig
- TLSH T1C4B48D1673A503B5E0B7D139CA568E85FAB2BC550720E74B03F496B62F237A0563F326
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d9:5c:ac:00:16:9d:ec:c9:e9:0e:e9:09:1c:00:26:82:3b:38:45:0e:51:ba:8d:3a:1f:80:20:11:47:fe:98:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=SC136640,CN=Future Technology Devices International Ltd,O=Future Technology Devices International Ltd,L=Glasgow,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Jun 18, 2024
SERIALNUMBER=SC136640,CN=Future Technology Devices International Ltd,O=Future Technology Devices International Ltd,L=Glasgow,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=SC136640,CN=Future Technology Devices International Ltd,O=Future Technology Devices International Ltd,L=Glasgow,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=SC136640,CN=Future Technology Devices International Ltd,O=Future Technology Devices International Ltd,L=Glasgow,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
0d:33:e9:cf:fb:d8:97:32:48:3f:b9:94:35:b5:b7:8e
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 1, 2024 - Mar 27, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
18996
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Work\Project\D3xx\trunk\D3XX\d2xxdll\x64\Release\FTD3XX.pdb
setupapi
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
kernel32
ExitThread
WriteConsoleW
OutputDebugStringW
ReadConsoleW
ReadFile
SetFilePointerEx
CreateFileW
CloseHandle
GetLastError
DeviceIoControl
GetOverlappedResult
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
WaitForMultipleObjects
GetFileSizeEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
CreateThread
RtlUnwind
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetCurrentThread
HeapFree
HeapAlloc
MultiByteToWideChar
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
FT_AbortPipe
FT_ClearNotificationCallback
FT_ClearStreamPipe
FT_Close
FT_ControlTransfer
FT_Create
FT_CreateDeviceInfoList
FT_CycleDevicePort
FT_EnableGPIO
FT_FlushPipe
FT_GetChipConfiguration
FT_GetConfigurationDescriptor
FT_GetDescriptor
FT_GetDeviceDescriptor
FT_GetDeviceInfo
FT_GetDeviceInfoDetail
FT_GetDeviceInfoList
FT_GetDriverVersion
FT_GetFirmwareVersion
FT_GetGPIO
FT_GetInterfaceDescriptor
FT_GetLibraryVersion
FT_GetOverlappedResult
FT_GetPipeInformation
FT_GetPipeTimeout
FT_GetStringDescriptor
FT_GetSuspendTimeout
FT_GetVIDPID
FT_InitializeOverlapped
FT_IsDevicePath
FT_ListDevices
FT_ReadGPIO
FT_ReadPipe
FT_ReadPipeEx
FT_ReleaseOverlapped
FT_ResetDevicePort
FT_SetChipConfiguration
FT_SetGPIO
FT_SetGPIOLevel
FT_SetGPIOPull
FT_SetNotificationCallback
FT_SetPipeTimeout
FT_SetStreamPipe
FT_SetSuspendTimeout
FT_WriteGPIO
FT_WritePipe
FT_WritePipeEx
Name
.text
Size
384KB
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=136, id=261, version=30795,
count=10, id=260, version=30795,
count=35, id=261, version=32533,
count=14, id=260, version=32533,
count=9, id=259, version=32533,
count=5, id=257, version=30795,
count=108, id=1, productName=Unmarked objects,
count=2, id=261, version=32824,
count=1, id=256, version=32824,
count=1, id=255, version=32824,
count=1, id=151,
count=1, id=258, version=32824,
Free AEYTHYR/Symbols/ntkrnlmp.pdb/1924BC23550919F88B17A384B944B5431/ntkrnlmp.pdb
- SHA256 d644000dd6a4e95772ea2693d10133962c17e1c7f09a7024cf3e0a440331b33d
- MD5 ee4e498f0e411fade6bb34a852743c32
- SHA1 560d451884a0802afb9d1e5ef9a51336ac62eea8
- SHA512 6cd92be6bdf163c89f565da866513510ac910986425eb9645402d5f568d2ca045ba0affff4ef37ec53b713bd8e26f027bb6337afa10a91cc5532cca3adc38557
- SSDEEP 49152:xVedDF3LrTob5o8n3idNil5I5Sjx/VUopxhIdrlvnHbhy3pCSrSzp1LezfLZThJ/:xVedDF3ao8IHAapqfF4GfGNm
- TLSH T17EB61719BA937EF6DD1A41BFA016432DFAF546C6039946D33D46B3AA0DC2652CF2E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Free AEYTHYR/Symbols/ntkrnlmp.pdb/72C69E726C648BC18257AF38FA78A2F21/ntkrnlmp.pdb
- SHA256 522bcca703a7f5036a5c0b01080bd1a65a25f006a84da6cebd20cd59f3526722
- MD5 c67fda30807ae215d035e145ed4504c7
- SHA1 f5e58248984c8efdb94379a022415a7502795a58
- SHA512 b4b1d0881603fd43c7850352ab1639d5b885fddeea338eeb3e7b7aaa5c508db8d6b72024a183dfd4f87f34a4eea715d13921a1ee6039e0dddcca172cd44572fe
- SSDEEP 49152:IORqMjB0YvuqbLW6bFiC7fejveaSNOMlXvYnA6wjVpileigeivWrFylFRPe2fUZp:IORqHpmFhaG7mkf8cf4Ny2R
- TLSH T1F9B61719BB927EF6DD1A41BFA016432DF6F546C6039946D33D46B3AA0DC2662CF2E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Free AEYTHYR/configs/default.cfg
- SHA256 bd6a72eacfea28bd6b9c02f77d526a4e3ae2a204f431737c45571dcea43d2497
- MD5 982befff6df31ed4a0f0e88f473bda59
- SHA1 932bf61782d1853cd34fa3f6599a7a3a33d1c7ea
- SHA512 e07aa60ace864d6cb01143f3f909bc0e81cd028f43836031dfcb90f0e4e258505220fcef49f7c8cc47378c4c47b87add4b2e3fa8318c0e7969e09919f3cebb1a
- SSDEEP 192:cX9wySJyYbiuHNKtU8S4tgDOHGz2pYPGaWtPUX5/tHHRAVvah0RYDesdOIhDTvtJ:Qx7++tglThVd
- TLSH T16F920323C2100DBCF8BDC53C9D25AA81D6D1739B2D902C1BB3BC948E5FB3A359A8D559
- MD5 SHA1 SHA512 SSDEEP TLSH
Free AEYTHYR/configs/moderate.cfg
- SHA256 ca1bd836b4f474abbdb2948e2126b29566ee742125a41c1333bb2099c9a39b64
- MD5 d07c6a91ca9608292de4f5cf59614b52
- SHA1 412fde9562c613fc771e4d29eeb44c024e72d62c
- SHA512 096582d39d5a9bfa13ac3369e1298efe3cf9b72840cc4d32b5a4696d59c46df337c737ea13cfb349b32457edc6de6acaf920e7a3ca1550e51521917557d3adae
- SSDEEP 192:cX9wySJyYbiuHNKtU8S4tgDOHGzhpYPGaWtPUX5/tHHRAVvah0RYDeQ5OIhDqvtJ:QxO++tgNThed
- TLSH T1D5920323C6100DBCF8BDC53C9D25AA81D6D1739B2D902C0BB3BC948E5FB3A359A8D559
- MD5 SHA1 SHA512 SSDEEP TLSH
Free AEYTHYR/dbghelp.dll
- IMPHASH 3d64c0b7659a72157d6f0180ea1141c1
- SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
- MD5 a5e4b3ff51cf5b7926d9651908feb666
- SHA1 4ef5d229709e40f3f84e46c3a28341eadbd1a044
- SHA512 0615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
- SSDEEP 24576:xU5lL6v/X5lknycQFrQ8gKt/X95WqbQLZopKjMcqpzd1YWLfY:Kni/X5lknDFUCaQLq8
- TLSH T1A975299BF97941F5DCBAC039D662A627F9B13859832497C367908B562F23BF4983D300
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
e8:5b:d3:92:b4:88:bf:c8:c3:bd:86:0c:de:15:56:93:dd:70:8d:9c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 1, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:f7:1e:00:00:00:00:00:32
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 13, 2009 - Oct 13, 2010
Subject
CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:b5:29:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2010 - Jan 4, 2013
Subject
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Serial Number
79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 9, 2001 - May 9, 2021
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 25, 2006 - Jan 25, 2017
Minor OS version
1
Major OS version
6
Entry point
723792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dbghelp.pdb
msvcrt
_isatty
_write
_lseeki64
_fileno
_read
__pioinfo
__badioinfo
??1type_info@@UEAA@XZ
ferror
wctomb
_snprintf
_iob
isleadbyte
__mb_cur_max
mbtowc
_onexit
_lock
__dllonexit
_unlock
_CxxThrowException
memset
memcpy
_ismbblead
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
memmove
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
_wctime
time
??_V@YAXPEAX@Z
_ltoa
_strnicmp
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
free
_strlwr
wcsrchr
strstr
_wcsicmp
qsort
iswxdigit
wcsncmp
_vsnwprintf
iswprint
fprintf
fflush
atol
fclose
__unDName
iswdigit
memcmp
bsearch
_wfsopen
fread
fseek
wcstol
strchr
??_U@YAPEAX_K@Z
_time64
_wfullpath
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
_wgetenv
wcsstr
wcschr
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_wsopen
kernel32
MoveFileW
SetFilePointer
DeleteFileW
CreateDirectoryW
FlushViewOfFile
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
__chkstk
CreateFileMappingW
LCMapStringW
LocalFree
GetVersion
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
VirtualQueryEx
GetThreadTimes
GetThreadPriority
GetPriorityClass
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
IsProcessorFeaturePresent
GetSystemInfo
GetSystemTimeAsFileTime
lstrcmpiW
Sleep
DelayLoadFailureHook
LoadLibraryExA
ReadProcessMemory
GetProcessHeap
LoadLibraryW
GetSystemDirectoryW
GetFileAttributesA
SetErrorMode
GetVersionExW
OutputDebugStringW
OutputDebugStringA
WriteFile
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetCurrentProcess
DuplicateHandle
VirtualProtect
VirtualAlloc
CreateDirectoryA
GetFileAttributesW
GetFullPathNameW
WideCharToMultiByte
MultiByteToWideChar
SetLastError
FindFirstFileW
FindClose
FindNextFileW
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
CreateFileA
GetFileSize
ReadFile
CloseHandle
GetLastError
TlsGetValue
TlsSetValue
LoadLibraryA
GetProcAddress
FreeLibrary
TlsAlloc
TlsFree
GetVersionExA
InitializeCriticalSection
HeapCreate
HeapDestroy
DeleteCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
IsDBCSLeadByte
GetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
CopyFileW
ExpandEnvironmentStringsW
DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=52, id=171, version=20824,
count=1, id=170, version=20824,
count=1, id=158, version=20804,
count=15, id=171, version=20804,
count=260, id=1, productName=Unmarked objects,
count=7, id=156, version=20804,
count=63, id=170, version=20804,
count=1, id=155, version=20804,
count=45, id=175, version=20804,
count=1, id=126, version=50727,
count=1, id=154, version=20804,
count=1, id=157, version=20804,
Free AEYTHYR/imgui.ini
- SHA256 de447e51e939cd213cc691cb890ac781796dc542190aae05fe883100dc850de2
- MD5 5f048c4d2e9c67b0e7cdb5c18d5207d3
- SHA1 f7435ca0ff63311aa1e3557d3423343cfc834039
- SHA512 cb58d44b601f26e62b95b6acbc63a236fd925447818223b4608c75cd1409d411ec9de262c12c995320fbc4cf4ce24ec7e56b5733888db3bd6fece08bd0eb1b01
- TLSH T1F1C08C123331006D84F2808CD23B33F236CE6600F046B8C020902013BE9BA33108B0C8
- MD5 SHA1 SHA512 TLSH
Free AEYTHYR/info.db
- SHA256 8b4a8c871b9ca505f3acf75a905d95a006b2707c66953ab12fd1f4b6e7207f86
- MD5 4b841b6c6f98dd770f9f3de220846118
- SHA1 876e790bbe3f2b6a140a52d761f399ad1300245e
- SHA512 8213cb4261cfaf44b6bc3b04fd7775fa9b53b5a6bc72dddb0cacb7fed2076ba9d17428e909807f41d40f97857f09271067eabc3d1faf958e6b92bde4ab899a9b
- SSDEEP 49152:F5M64ayJ0f+Joy444mlC73eZFjiv9Rv9RJwI4yUg2lIUs:F5ML1TgceLJBd2lIB
- TLSH T1CA367D9D23536B1CC7E29EFACFBF2938DD432221B52A3DCC80579D46A352966142E5C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Free AEYTHYR/leechcore.dll
- IMPHASH d21a9e8cc4c45a2d0dd2fedf01166d30
- SHA256 280352dddcfe2c6d6aaa9e81bfb366e559d80d179b1e52d9e384706e3761f45c
- MD5 d2b4de2ff19f79a93fc6a4fc66c802e9
- SHA1 444abb7239d520c17aa728173e4f5962f81d0a06
- SHA512 ec3b4d6ecf927e12cb8bc0156c0ed9cf19eebd366547ebf4a9acaa50ba91d0e94cdfa6b6c2d2deba6690a1f1d407833c81dedf6c0d1a3c22f71ffe3e84d25114
- SSDEEP 3072:HNanSnPXqG3iCtAx+WOCMbUdKOT+7EQisJIbC0D+uBL:taSPZnGEb8KZ7EQisJIbCJs
- TLSH T187E34B4BB7A414BAC967C138D956931BFAB3B81813206BEF0260C6B52F537E17A3D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
77:0f:f2:db:f5:7f:3d:cc:9b:d3:d3:14:14:22:71:ba:c3:77:29:0d:24:13:2c:7a:8d:f9:a4:8f:de:8e:30:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Ulf Frisk,O=Open Source Developer,L=Stockholm,ST=Stockholm,C=SE
Chains
May 13, 2026
CN=Open Source Developer\, Ulf Frisk,O=Open Source Developer,L=Stockholm,ST=Stockholm,C=SE
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Open Source Developer\, Ulf Frisk,O=Open Source Developer,L=Stockholm,ST=Stockholm,C=SE
Serial Number
03:05:5a:50:76:3b:06:c8:e6:f1:69:ac:51:6e:3a:8a
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 15, 2025 - Oct 15, 2026
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
106016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Github\production\LeechCore\files\lib\leechcore.pdb
credui
CredUIPromptForWindowsCredentialsW
CredUnPackAuthenticationBufferW
rpcrt4
NdrClientCall3
RpcBindingSetAuthInfoExA
RpcBindingFree
RpcStringFreeA
RpcBindingSetAuthInfoExW
RpcStringBindingComposeA
RpcBindingFromStringBindingA
secur32
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
LsaConnectUntrusted
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
winusb
WinUsb_WritePipe
WinUsb_Free
WinUsb_SetPipePolicy
WinUsb_ReadPipe
WinUsb_Initialize
ws2_32
setsockopt
WSAGetLastError
htons
recvfrom
connect
socket
send
inet_addr
WSAStartup
closesocket
ioctlsocket
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
LoadLibraryW
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeSRWLock
LocalAlloc
LocalFree
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetTickCount64
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LoadLibraryA
CloseHandle
CreateThread
SwitchToThread
GetProcAddress
FreeLibrary
ReadFile
DeviceIoControl
GetLastError
CreateFileA
SetFilePointerEx
VirtualFree
VirtualAlloc
CreateFileW
VerSetConditionMask
VerifyVersionInfoW
WriteProcessMemory
GetCurrentProcess
K32GetModuleFileNameExW
OpenProcess
K32EnumProcesses
ReadProcessMemory
K32GetMappedFileNameW
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
SetEvent
QueryPerformanceFrequency
ResetEvent
QueryPerformanceCounter
IsProcessorFeaturePresent
advapi32
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
OpenSCManagerW
CloseServiceHandle
CreateServiceA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
StartServiceA
ole32
CoTaskMemFree
vcruntime140
memset
__C_specific_handler
memcpy
strstr
__std_type_info_destroy_list
memcmp
wcsstr
api-ms-win-crt-string-l1-1-0
strncpy_s
wcsncpy_s
strtok_s
wcsncat_s
_wcsicmp
wcscpy_s
strcat_s
strncat_s
_stricmp
_strnicmp
strcmp
strcpy_s
api-ms-win-crt-stdio-l1-1-0
_wfopen_s
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
fread
fclose
__stdio_common_vfprintf
fwrite
__acrt_iob_func
getchar
__stdio_common_vsnprintf_s
_fseeki64
__stdio_common_vsprintf
_ftelli64
api-ms-win-crt-convert-l1-1-0
atoi
strtoull
_itoa_s
strtol
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_seh_filter_dll
_initialize_onexit_table
_initterm
_cexit
_execute_onexit_table
_initialize_narrow_environment
_initterm_e
LcAllocScatter1
LcAllocScatter2
LcAllocScatter3
LcClose
LcCommand
LcCreate
LcCreateEx
LcDeviceParameterGet
LcDeviceParameterGetNumeric
LcGetOption
LcMemFree
LcMemMap_AddRange
LcMemMap_GetMaxAddress
LcMemMap_IsInitialized
LcRead
LcReadScatter
LcSetOption
LcWrite
LcWriteScatter
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=13, id=261, version=35207,
count=19, id=257, version=33145,
count=168, id=1, productName=Unmarked objects,
count=20, id=264, version=35226,
count=1, id=256, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,
Free AEYTHYR/logs/session.log
- SHA256 b4ea567c191f93bff0b4268f58ff2c9e0a584523736af4e4a403e565ef2e8c80
- MD5 9e05c2f2664dc9bd750f2c7a7a3711d3
- SHA1 0a1a41a28c0d3c956d0b9945875ad2431adceaa2
- SHA512 8be7e4114c8cc403161b93ccf36c0a0821df0c8937d0fb6f85c4e72e084b1f305b3760ed75d94768f4b4848f4f0025db50e9f1dca7ca262a01b551385152be71
- TLSH T18F51230253FE50E54FA7C60EE13B1ADB242B7A827B0C6A1CBFB051184AC5953CEF5B94
- MD5 SHA1 SHA512 TLSH
Free AEYTHYR/mmap.txt
- SHA256 65f1aed01104afbf4d2adb2e8b46b86811f381c81835c0196e449bc99ffb77f5
- MD5 39986df5f87f390f7774088dab8df8d3
- SHA1 ed4f5ff6ac44f668cd6ab41e0537a4f727067f8e
- SHA512 475d6ebe6bc48004447e4373701c6852ec8ddd91cc50b53d870e2d2a8a992a565b7e6b325c53462f180a4d97f4fc8bccee96eb8f1ddaa1910053d268e5c7d114
- TLSH T147C08C4430090CA2D3CBB10B403F318C011EFB9EC2C822F421C5FBF20C12C270A6B860
- MD5 SHA1 SHA512 TLSH
Free AEYTHYR/symsrv.dll
- IMPHASH 5d54f5d721e301667338323ac07578e3
- SHA256 c67be7d3f54d44ac264a18e33909482f1f8ca7b7fbaaf5659ef71ed9f8092c34
- MD5 65fb3391eb26f5ac647fc40501d8e21d
- SHA1 4b46db2a99a47ff6a6ee376f4d79f5298bff28a2
- SHA512 e283d5ee8813eba8114f1315eaf9b1e057b8b81823747a7a2d467bff0e3b06b9e0b377fc570bc258b6c63c8691cb1577f6f1bd7edbaa62932cad47f6419b98e2
- SSDEEP 1536:BfIlifuqTuGqr/nmjzzw61yrsyvvZ4b6x59ZUMz2/jBar7wM99mYivhx8JD7v8Si:BLB6GonmYv02CeDb8S/fC
- TLSH T18DE3F887B6F810F9D4F5D23C8AA2212BFA7174AD573443CBA651491A0F63BE49E3C742
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
42:7a:2b:33:4d:c7:52:a5:93:71:4e:8a:01:94:82:dd:13:04:5b:13
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 1, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:f7:1e:00:00:00:00:00:32
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 13, 2009 - Oct 13, 2010
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:03:dc:f6:00:00:00:00:00:0c
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2011
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 25, 2006 - Jan 25, 2017
Minor OS version
1
Major OS version
6
Entry point
104548
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
symsrv.pdb
msvcrt
_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
ferror
wctomb
_itoa
_snprintf
_iob
isleadbyte
__mb_cur_max
mbtowc
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
_errno
_wtoi64
_wcslwr
strrchr
wcsstr
??2@YAPEAX_K@Z
fclose
??3@YAXPEAX@Z
wcsrchr
fgetws
_wfopen
_stricmp
getenv
iswspace
tolower
isspace
towlower
_wcsnicmp
_wcsicmp
wcschr
memcmp
kernel32
SetLastError
FreeLibrary
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
Sleep
GlobalFree
ReleaseMutex
OpenMutexW
LoadLibraryW
GetSystemDirectoryW
GetPrivateProfileSectionW
GetPrivateProfileIntW
GetModuleFileNameW
LocalFileTimeToFileTime
ExpandEnvironmentStringsW
DeleteFileA
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFileTime
SetFilePointer
CreateFileA
DosDateTimeToFileTime
FileTimeToDosDateTime
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetSystemTime
DeleteFileW
GetFileTime
CreateWaitableTimerW
MoveFileW
ReadFile
WaitForSingleObject
SetWaitableTimer
CopyFileExW
GetFileSize
LoadLibraryA
LocalFree
DebugBreak
CloseHandle
RemoveDirectoryW
LocalAlloc
GetProcAddress
MultiByteToWideChar
CreateFileW
LocalReAlloc
GetVersionExW
FormatMessageW
WideCharToMultiByte
WriteFile
GetSystemTimeAsFileTime
GetModuleHandleW
OutputDebugStringW
CreateDirectoryW
GetCurrentProcess
CopyFileW
LeaveCriticalSection
GetFileAttributesW
GetLastError
GetEnvironmentVariableW
EnterCriticalSection
RaiseException
advapi32
RegQueryValueExW
GetTokenInformation
RegCloseKey
RegOpenKeyExW
RegEnumValueW
OpenProcessToken
FreeSid
AllocateAndInitializeSid
EqualSid
EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=158, version=20804,
count=15, id=171, version=20804,
count=209, id=1, productName=Unmarked objects,
count=7, id=156, version=20804,
count=1, id=132, productName=VS2008 build 21022, version=21022,
count=58, id=170, version=20804,
count=1, id=155, version=20804,
count=14, id=175, version=20804,
count=1, id=126, version=50727,
count=1, id=154, version=20804,
count=1, id=157, version=20804,
Free AEYTHYR/vmm.dll
- IMPHASH 159e4c251eed54e507068d7a0f7fa807
- SHA256 8a02bd6bf16081f901a2924cd672b4f0189d468d43f6a0d7afb1d1778d81f1fd
- MD5 d0d4f4778c9faefc8bf4b951b3c2223b
- SHA1 1cc244b1990cef5d578b8d83f21d3bd63189cb74
- SHA512 87151b69eb77af84f4210929d3ea75c5a3a4a08ecf5a038a34e9ab498c01c8e4da969c315dff219fa62a4eb393bf420be329db0e1fe1af6fc342485e949326b9
- SSDEEP 49152:9K5rmmAH6fuvXXk5TApqNKiS9mFhNmXaxNbzk3gjfiZIzloROG0cEwPrVP:6q6fufXk5TTNK/9Zubzk3g+OI
- TLSH T132B58E47B7A800B9C46BC139C91A5F07E6B170052364AADF76ACC5A92F63FF2127E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a9:5c:b4:67:ea:8f:e8:c3:8c:54:a0:59:b7:62:c4:f5:cd:e9:b3:47:01:24:b6:ba:c4:f9:04:4d:ea:2a:a8:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Ulf Frisk,O=Open Source Developer,L=Stockholm,ST=Stockholm,C=SE
Chains
May 13, 2026
CN=Open Source Developer\, Ulf Frisk,O=Open Source Developer,L=Stockholm,ST=Stockholm,C=SE
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Open Source Developer\, Ulf Frisk,O=Open Source Developer,L=Stockholm,ST=Stockholm,C=SE
Serial Number
03:05:5a:50:76:3b:06:c8:e6:f1:69:ac:51:6e:3a:8a
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 15, 2025 - Oct 15, 2026
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
1816260
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Github\production\MemProcFS\files\lib\vmm.pdb
leechcore
LcRead
LcCreateEx
LcClose
LcSetOption
LcReadScatter
LcAllocScatter1
LcWriteScatter
LcGetOption
LcCommand
LcAllocScatter2
LcMemFree
bcrypt
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
crypt32
CertCreateCertificateContext
CertFreeCertificateContext
CertGetNameStringW
shlwapi
StrStrIA
ws2_32
inet_ntop
kernel32
UnhandledExceptionFilter
RtlCaptureContext
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
IsProcessorFeaturePresent
GetCurrentProcess
LoadResource
ResetEvent
FindClose
LocalAlloc
LocalFree
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
RaiseException
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetLongPathNameW
WaitForMultipleObjects
CreateEventW
GetTickCount64
SetEvent
GetLocalTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
VerSetConditionMask
VerifyVersionInfoW
LoadLibraryExW
QueryPerformanceFrequency
GetModuleFileNameA
SizeofResource
GetModuleHandleExW
GetModuleFileNameW
FileTimeToSystemTime
LockResource
LoadLibraryExA
FindResourceW
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList
QueryDepthSList
GetStdHandle
ReadConsoleA
SwitchToThread
CreateThread
FindFirstFileW
FindNextFileW
advapi32
LookupAccountSidA
RegDeleteValueA
IsValidSid
ConvertStringSidToSidA
RegCreateKeyA
RegCloseKey
RegGetValueA
RegSetValueExA
RegOpenKeyExA
ConvertSidToStringSidA
vcruntime140
strrchr
strchr
__C_specific_handler
memset
memchr
memcmp
memcpy
memmove
strstr
__std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
wcscat_s
toupper
_wcsnicmp
strncmp
strcspn
strcmp
strtok_s
strcat_s
strnlen
strcpy_s
_stricmp
strncpy_s
strncat_s
strspn
wcsnlen
_strnicmp
api-ms-win-crt-heap-l1-1-0
malloc
realloc
_msize
free
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_beginthreadex
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
exit
_endthreadex
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-stdio-l1-1-0
tmpnam_s
__stdio_common_vsprintf_s
fwrite
__stdio_common_vsnprintf_s
__acrt_iob_func
__stdio_common_vfprintf
_wfopen_s
__stdio_common_vsprintf
fclose
fread
__stdio_common_vsnwprintf_s
__stdio_common_vsscanf
_fseeki64
fflush
_fsopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoull
strtoul
api-ms-win-crt-filesystem-l1-1-0
_access_s
remove
api-ms-win-crt-math-l1-1-0
log10
floor
log2
VMMDLL_Close
VMMDLL_CloseAll
VMMDLL_ConfigGet
VMMDLL_ConfigSet
VMMDLL_ForensicFileAppend
VMMDLL_Initialize
VMMDLL_InitializeEx
VMMDLL_InitializePlugins
VMMDLL_LicensedTo
VMMDLL_Log
VMMDLL_LogCallback
VMMDLL_LogEx
VMMDLL_Map_GetEATU
VMMDLL_Map_GetEATW
VMMDLL_Map_GetHandleU
VMMDLL_Map_GetHandleW
VMMDLL_Map_GetHeap
VMMDLL_Map_GetHeapAlloc
VMMDLL_Map_GetIATU
VMMDLL_Map_GetIATW
VMMDLL_Map_GetKDeviceU
VMMDLL_Map_GetKDeviceW
VMMDLL_Map_GetKDriverU
VMMDLL_Map_GetKDriverW
VMMDLL_Map_GetKObjectU
VMMDLL_Map_GetKObjectW
VMMDLL_Map_GetModuleFromNameU
VMMDLL_Map_GetModuleFromNameW
VMMDLL_Map_GetModuleU
VMMDLL_Map_GetModuleW
VMMDLL_Map_GetNetU
VMMDLL_Map_GetNetW
VMMDLL_Map_GetPfn
VMMDLL_Map_GetPfnEx
VMMDLL_Map_GetPhysMem
VMMDLL_Map_GetPool
VMMDLL_Map_GetPteU
VMMDLL_Map_GetPteW
VMMDLL_Map_GetServicesU
VMMDLL_Map_GetServicesW
VMMDLL_Map_GetThread
VMMDLL_Map_GetThread_CallstackU
VMMDLL_Map_GetThread_CallstackW
VMMDLL_Map_GetUnloadedModuleU
VMMDLL_Map_GetUnloadedModuleW
VMMDLL_Map_GetUsersU
VMMDLL_Map_GetUsersW
VMMDLL_Map_GetVMU
VMMDLL_Map_GetVMW
VMMDLL_Map_GetVadEx
VMMDLL_Map_GetVadU
VMMDLL_Map_GetVadW
VMMDLL_MemCallback
VMMDLL_MemFree
VMMDLL_MemPrefetchPages
VMMDLL_MemRead
VMMDLL_MemReadEx
VMMDLL_MemReadPage
VMMDLL_MemReadScatter
VMMDLL_MemSearch
VMMDLL_MemSize
VMMDLL_MemVirt2Phys
VMMDLL_MemWrite
VMMDLL_MemWriteScatter
VMMDLL_PdbLoad
VMMDLL_PdbSymbolAddress
VMMDLL_PdbSymbolName
VMMDLL_PdbTypeChildOffset
VMMDLL_PdbTypeSize
VMMDLL_PidGetFromName
VMMDLL_PidList
VMMDLL_ProcessGetDirectoriesU
VMMDLL_ProcessGetDirectoriesW
VMMDLL_ProcessGetInformation
VMMDLL_ProcessGetInformationAll
VMMDLL_ProcessGetInformationString
VMMDLL_ProcessGetModuleBaseU
VMMDLL_ProcessGetModuleBaseW
VMMDLL_ProcessGetProcAddressU
VMMDLL_ProcessGetProcAddressW
VMMDLL_ProcessGetSectionsU
VMMDLL_ProcessGetSectionsW
VMMDLL_Scatter_Clear
VMMDLL_Scatter_CloseHandle
VMMDLL_Scatter_Execute
VMMDLL_Scatter_ExecuteRead
VMMDLL_Scatter_Initialize
VMMDLL_Scatter_Prepare
VMMDLL_Scatter_PrepareEx
VMMDLL_Scatter_PrepareWrite
VMMDLL_Scatter_PrepareWriteEx
VMMDLL_Scatter_Read
VMMDLL_UtilFillHexAscii
VMMDLL_UtilVfsReadFile_FromBOOL
VMMDLL_UtilVfsReadFile_FromDWORD
VMMDLL_UtilVfsReadFile_FromPBYTE
VMMDLL_UtilVfsReadFile_FromQWORD
VMMDLL_UtilVfsWriteFile_BOOL
VMMDLL_UtilVfsWriteFile_DWORD
VMMDLL_VfsListBlobU
VMMDLL_VfsListU
VMMDLL_VfsListW
VMMDLL_VfsList_AddDirectory
VMMDLL_VfsList_AddDirectoryW
VMMDLL_VfsList_AddFile
VMMDLL_VfsList_AddFileW
VMMDLL_VfsReadU
VMMDLL_VfsReadW
VMMDLL_VfsWriteU
VMMDLL_VfsWriteW
VMMDLL_VmGetVmmHandle
VMMDLL_VmMemRead
VMMDLL_VmMemReadScatter
VMMDLL_VmMemTranslateGPA
VMMDLL_VmMemWrite
VMMDLL_VmMemWriteScatter
VMMDLL_VmScatterInitialize
VMMDLL_WinGetThunkInfoIATU
VMMDLL_WinGetThunkInfoIATW
VMMDLL_WinReg_EnumKeyExU
VMMDLL_WinReg_EnumKeyExW
VMMDLL_WinReg_EnumValueU
VMMDLL_WinReg_EnumValueW
VMMDLL_WinReg_HiveList
VMMDLL_WinReg_HiveReadEx
VMMDLL_WinReg_HiveWrite
VMMDLL_WinReg_QueryValueExU
VMMDLL_WinReg_QueryValueExW
VMMDLL_YaraSearch
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
339KB
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=12, id=261, version=35207,
count=12, id=257, version=33145,
count=3, id=257, version=35226,
count=224, id=1, productName=Unmarked objects,
count=115, id=264, version=35226,
count=1, id=256, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,