111.zip
- SHA256 1bc5307edd98df38a4bf57c76cac67b899643fce672b48e368bbe2482afb718f
Overview
overview
8Static
static
3111.zip
windows11-ltsc_2024-x64
8111/compile.bat
windows11-ltsc_2024-x64
3111/compil...er.bat
windows11-ltsc_2024-x64
3111/kdmapp...lp.dll
windows11-ltsc_2024-x64
1111/kdmapp...rv.dll
windows11-ltsc_2024-x64
6111/kdmapp...ld.sys
windows11-ltsc_2024-x64
8111/loader...er.exe
windows11-ltsc_2024-x64
8111/spoofer.sys
windows11-ltsc_2024-x64
8111/unload.exe
windows11-ltsc_2024-x64
8Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
111.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
900 seconds
Behavioral task
behavioral2
Sample
111/compile.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
111/compile_loader.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
111/kdmapper-source/kdmapper-master/DbgHelp/dbghelp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
111/kdmapper-source/kdmapper-master/DbgHelp/symsrv.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral6
Sample
111/kdmapper-source/kdmapper-master/HelloWorld.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral7
Sample
111/loader_spoofer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
900 seconds
Behavioral task
behavioral8
Sample
111/spoofer.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral9
Sample
111/unload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
General
- Target 111.zip
- Size 1.7MB
- Sample260903-1mtskafr9s
- SHA256 1bc5307edd98df38a4bf57c76cac67b899643fce672b48e368bbe2482afb718f
- MD5 8561d3dcab8e1e02905ae5f4a4d53029
- SHA1 d64120398f553b5577906db5420ed929eb572e65
- SHA512 b81706cb5b4edc49cc194f7d56397e9a6bb3a5dc175aeda31d8aeb6b86db3ecb6a9a2005bd3ad693ad746bbd90cf3fc6dbd1d0609a583608442c6fce70730656
- SSDEEP 49152:ARFM3dMT5yU1OkJUiOGAgVI2DtuEcsIoMfRd6Z/:0MtMbfJyGFVfL2oQP6F
- TLSH T1CD853316C7B9F13CCC0B2DFC4696E648B6554F80E2913C7E4AC573582A7ED8663B68C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/111/kdmapper-source/kdmapper-master/HelloWorld.sys unpack001/111/kdmapper.exe unpack001/111/loader_spoofer.exe unpack001/111/spoofer.sys unpack001/111/unload.exe
File Explorer
-
111.zip.zip 1.7MB
-
111/compile.bat.bat 4KB
-
111/compile_loader.bat343B
-
111/disk.nativecodeanalysis.xml.xml 56KB
-
111/kdmapper-source/kdmapper-master/.gitignore106B
-
111/kdmapper-source/kdmapper-master/DbgHelp/dbghelp.dll.dll 2.1MB
-
111/kdmapper-source/kdmapper-master/DbgHelp/symsrv.dll.dll 413KB
-
111/kdmapper-source/kdmapper-master/HelloWorld.sys.sys 3KB
-
111/kdmapper-source/kdmapper-master/HelloWorld/HelloWorld.sln1KB
-
111/kdmapper-source/kdmapper-master/HelloWorld/HelloWorld.vcxproj5KB
-
111/kdmapper-source/kdmapper-master/HelloWorld/HelloWorld.vcxproj.filters1KB
-
111/kdmapper-source/kdmapper-master/HelloWorld/HelloWorld.vcxproj.user391B
-
111/kdmapper-source/kdmapper-master/HelloWorld/main.cpp260B
-
111/kdmapper-source/kdmapper-master/LICENSE1KB
-
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.cpp3KB
-
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.sln1KB
-
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.vcxproj.xml 7KB
-
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.vcxproj.filters995B
-
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.vcxproj.user165B
-
111/kdmapper-source/kdmapper-master/README.MD4KB
-
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SimplestSymbolHandler.cpp3KB
-
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SimplestSymbolHandler.h536B
-
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SymbolsFromPDB.vcxproj.xml 5KB
-
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SymbolsFromPDB.vcxproj.filters1KB
-
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SymbolsFromPDB.vcxproj.user220B
-
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/main.cpp2KB
-
111/kdmapper-source/kdmapper-master/kdmapper.sln2KB
-
111/kdmapper-source/kdmapper-master/kdmapper/KDSymbolsHandler.cpp1KB
-
111/kdmapper-source/kdmapper-master/kdmapper/include/KDSymbolsHandler.h528B
-
111/kdmapper-source/kdmapper-master/kdmapper/include/intel_driver.hpp.js 4KB
-
111/kdmapper-source/kdmapper-master/kdmapper/include/intel_driver_resource.hpp204KB
-
111/kdmapper-source/kdmapper-master/kdmapper/include/kdmapper.hpp614B
-
111/kdmapper-source/kdmapper-master/kdmapper/include/nt.hpp3KB
-
111/kdmapper-source/kdmapper-master/kdmapper/include/portable_executable.hpp646B
-
111/kdmapper-source/kdmapper-master/kdmapper/include/service.hpp224B
-
111/kdmapper-source/kdmapper-master/kdmapper/include/utils.hpp805B
-
111/kdmapper-source/kdmapper-master/kdmapper/intel_driver.cpp45KB
-
111/kdmapper-source/kdmapper-master/kdmapper/kdmapper.cpp10KB
-
111/kdmapper-source/kdmapper-master/kdmapper/kdmapper.vcxproj.xml 14KB
-
111/kdmapper-source/kdmapper-master/kdmapper/kdmapper.vcxproj.filters1KB
-
111/kdmapper-source/kdmapper-master/kdmapper/main.cpp6KB
-
111/kdmapper-source/kdmapper-master/kdmapper/portable_executable.cpp3KB
-
111/kdmapper-source/kdmapper-master/kdmapper/service.cpp4KB
-
111/kdmapper-source/kdmapper-master/kdmapper/utils.cpp4KB
-
111/kdmapper.exe.exe 399KB
-
111/loader_spoofer.exe.exe 336KB
-
111/main.nativecodeanalysis.xml.xml 59B
-
111/ndis.nativecodeanalysis.xml.xml 53KB
-
111/nvidia.nativecodeanalysis.xml.xml 49KB
-
111/process_helper.nativecodeanalysis.xml.xml 48KB
-
111/smbios.nativecodeanalysis.xml.xml 50KB
-
111/spoofer-driver/disk.c20KB
-
111/spoofer-driver/ndis.c6KB
-
111/spoofer-driver/nvidia.c2KB
-
111/spoofer-driver/process_helper.c1KB
-
111/spoofer-driver/smbios.c18KB
-
111/spoofer-driver/spoofer_driver.c10KB
-
111/spoofer-driver/spoofer_driver.h1KB
-
111/spoofer-driver/tpm.c3KB
-
111/spoofer-loader/buffer_parser.h5KB
-
111/spoofer-loader/main.cpp26KB
-
111/spoofer-loader/parser_tests.h2KB
-
111/spoofer-loader/raii_handles.h3KB
-
111/spoofer-loader/utils.h7KB
-
111/spoofer.sys.sys 33KB
-
111/spoofer_driver.nativecodeanalysis.xml.xml 61KB
-
111/tpm.nativecodeanalysis.xml.xml 51KB
-
111/unload.cpp1KB
-
111/unload.exe.exe 261KB
-
111/unload.nativecodeanalysis.xml.xml 59B
111/compile.bat
- SHA256 82455d4516fd16d3f805160330be0e90693fc283d106065af0740d4438a184bf
- MD5 91f685f11b02db56333a620cc9c22b79
- SHA1 6c9c04714c8f4ad1be3ed6d6da7db18c620d83f2
- SHA512 94d1e077aec70c04ce77660bbefa6bf5451239469462d8b3d8d83b913106852387733f1ec61160978361aeba28831d48006797813a456c9af4b62939c25b9f4c
- SSDEEP 48:+D8P9P6eh6WXysBvqsehgHajdfho1yc5V/WdwUChcpS1d+tw0p7qQdMSfHs9MyDs:+oP9yefpqFhgIZIx5XAS1d+O07xiMq+
- TLSH T1F2917253B81E4C32C499548E4F00978EB7A5435F0EAD8F6830D1239AE624BCD36ED9F5
- MD5 SHA1 SHA512 SSDEEP TLSH
111/compile_loader.bat
- SHA256 6eecec0a991eb4884cc8769d2ee3c4738f8458ea38f6d70b9ce41d7a26817915
- MD5 67db68c06dd5525d71baa103b197ef4a
- SHA1 4d666d5a386584979880bc03fd0375346eb1ca0e
- SHA512 e58e681cb8f1f4279749d5a5c522a81f4a4e21e6fcef23fb0c08c29706570ba756257ad952545572b865f1762d7c138390bbb6c2cc0e1a16e899263cc3fb7c93
- TLSH T170E0C003B005CAF1E007AC48A0055D85708981870D599DAE33A485EFB1F5784B5DD4D9
- MD5 SHA1 SHA512 TLSH
111/disk.nativecodeanalysis.xml
- SHA256 3bdd6716c6f6d71dc7d89c86715d1de1b6e6552618c0644e4f16c9df4532f341
- MD5 4d48fdf1585b5f4e9110a43c9508db39
- SHA1 e8e294dea3e2ff13740968685d4f51de6639ad47
- SHA512 17ae49904133738841bced26b0e3a340c69051576cba4746dd1ae9f06b17f7197a553ec5f2ceeef854e16cbf50c26dcf49475972c4bc956916934a99c5c84f11
- SSDEEP 768:s1TAXtPaQQQQQQQQQQQ044444444444344444444444Y:s1TAXtPl
- TLSH T1A843381E65D88E944AB1C1EAE30C7A0CEF616443B1781701B59E527F7FB8C9A8397732
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/.gitignore
- SHA256 9161fc1c641c46e5ff1d3b633becf2c1b0136d8a33f6b8df2dcb595a4e3b4ee4
- MD5 3739913e13eebce6dc9df4da70cfb31a
- SHA1 173cb1b3e393bac5dc0793ae1a0f7e200df5ba6d
- SHA512 5d5b2b19ca1e82e2bfeae71e80c3706288bc1eca3a07f974f07641948ec9b729a333cf2f7f9bfbf75271e40d79bb487d4f56a8746dce981ded6689f0c54eaf99
- TLSH T147B01204DC8A3405C548054F2080780615B36F68804273513FDC135C3090880836BA60
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/DbgHelp/dbghelp.dll
- IMPHASH e55df7193a9c7f507fc48c3b3f033447
- SHA256 2ed18fdb0bfea3c3297230ee57ba7e05a23c09bc929bf1aaf23dcd2d83bf5024
- MD5 21454155086ee542ca313157a4aba0f7
- SHA1 bd8bc1f4905308c8db664449545ea004cf55070b
- SHA512 ac48c0e05219f2a77b5eda8a5086f8dd08ed36dea4d4f8d6158a343274336be7922aa2f8c96940254ada5acb24aad5e2c5fce914d7628ccde48e0d4d1ec59479
- SSDEEP 24576:UC5peoantYTNCFNgmYrrDaPFmWzbuNtI2dFDwDJonMFt6TmFHpgw73JfhQf:UC5koantYTUzgmYX0mWiIKDwDaD0awZO
- TLSH T1AAA57B1B56E800A8D67AE23DD267560BD7F274060321A7DF1260876E6F33FE51ABE311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
68:6d:18:aa:c3:a2:b2:38:81:24:10:52:07:6c:bd:2c:2d:e6:a6:94:e0:48:fd:c6:aa:ca:64:e1:8e:7e:02:df
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e8:50:b0:80:cf:2b:72:99:4d:00:01:00:00:01:e8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
40096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dbghelp.pdb
api-ms-win-crt-string-l1-1-0
memset
strcspn
wcsnlen
wcsncmp
strnlen
strlen
strcmp
strncmp
wcscmp
api-ms-win-crt-time-l1-1-0
_time64
_ctime64
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
api-ms-win-crt-runtime-l1-1-0
__doserrno
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__filelengthi64
_o__free_base
_o__fullpath
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__ldclass
_o__lseeki64
_o__ltoa
_o__malloc_base
_o__mbscmp
_o__memicmp
_o__open_osfhandle
_o__purecall
_o__read
_o__register_onexit_function
_o__seh_filter_dll
_o__splitpath_s
_o__stricmp
_o__strlwr
_o__strnicmp
_o__aligned_malloc
_o__wcsdup
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wctime64
_o__wdupenv_s
_o__wfsopen
_o__wfullpath
_o__wgetenv
_o__wmakepath_s
_o__wsplitpath_s
_o__wtoi
_o_abort
_o_atoi
_o_atol
_o_bsearch
_o_calloc
_o_ceilf
_o_fclose
_o_fflush
_o_fread
_o_free
_o_frexp
_o_fseek
_o_ftell
_o_isspace
_o_iswprint
_o_iswspace
_o_iswxdigit
_o_localeconv
_o_malloc
_o_qsort
_o_realloc
_o_setlocale
_o_strcat_s
_o_strcpy_s
_o_strncat_s
_o_strncpy_s
_o_terminate
_o_tolower
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstoul
_o_wmemcpy_s
__uncaught_exception
_CxxThrowException
_o__aligned_free
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o__execute_onexit_table
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o__errno
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o__dclass
_o__crt_atexit
_o__configure_narrow_argv
_o__close
_o__cexit
_o__calloc_base
_o__callnewh
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
wcsrchr
strstr
wcsstr
wcschr
__C_specific_handler
__CxxFrameHandler3
strchr
memcpy
memmove
memcmp
__unDName
strrchr
__unDNameEx
api-ms-win-core-file-l1-1-0
GetFileAttributesW
FindClose
GetFullPathNameW
DeleteFileW
SetFilePointer
GetFinalPathNameByHandleW
CreateDirectoryW
CreateFileW
SetFilePointerEx
WriteFile
SetEndOfFile
ReadFile
GetFileType
RemoveDirectoryW
CreateDirectoryA
SetFileTime
SetFileAttributesW
GetFileSize
FindNextFileW
CreateFileA
GetFileAttributesA
GetFileSizeEx
FindFirstFileW
GetFileInformationByHandle
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException
SetErrorMode
api-ms-win-core-synch-l1-1-0
OpenProcess
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
AcquireSRWLockExclusive
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
ExpandEnvironmentStringsW
SetEnvironmentVariableA
api-ms-win-core-misc-l1-1-0
LocalFree
Sleep
LocalAlloc
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
TerminateProcess
TlsFree
GetCurrentThread
GetCurrentProcess
TlsGetValue
TlsSetValue
TlsAlloc
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleFileNameW
LoadLibraryExA
GetModuleHandleA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
SystemTimeToFileTime
GetTickCount
GetSystemDirectoryW
GetTickCount64
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-security-base-l1-1-0
AccessCheck
ImpersonateSelf
GetFileSecurityW
RevertToSelf
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
UnmapViewOfFile
MapViewOfFileEx
MapViewOfFile
VirtualQuery
CreateFileMappingW
ReadProcessMemory
VirtualProtect
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-localization-l1-1-0
LCMapStringEx
LCMapStringW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
ntdll
RtlUTF8ToUnicodeN
RtlRunOnceExecuteOnce
RtlGetVersion
api-ms-win-downlevel-kernel32-l2-1-0
CreateFileMappingA
api-ms-win-core-localregistry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-threadpool-l1-1-0
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk2
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymAllocDiaString
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFreeDiaString
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetDiaSession
SymGetDiaSource
SymGetExtendedOption
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrEx
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameEx
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextEx
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevEx
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetParentWindow
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileChecksum
SymGetSourceFileChecksumW
SymGetSourceFileFromToken
SymGetSourceFileFromTokenByTokenName
SymGetSourceFileFromTokenByTokenNameW
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenByTokenName
SymGetSourceFileTokenByTokenNameW
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymRegisterGetSourcePathPartCallback
SymRegisterSourceFileUrlListCallback
SymSearch
SymSearchW
SymSetContext
SymSetDiaSession
SymSetExtendedOption
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSetServiceManager
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
_EFN_DumpImage
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
lmsourcesinfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
vc7fpo
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
400KB
Virtual Size
398KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
84KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=257, version=33136,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1268, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33136,
count=5, id=259, version=33136,
count=1, id=256, version=33136,
count=100, id=264, version=33136,
count=2, id=253, version=33136,
count=37, id=261, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
111/kdmapper-source/kdmapper-master/DbgHelp/symsrv.dll
- IMPHASH c8f45ab7d0aa1910ed31f28a3532dc3a
- SHA256 fea493309d3d5640df85f4b5523ea0091d4705780df5ca471a75cba9f0bac232
- MD5 837eb266ee187c14160ed9918683380b
- SHA1 f5663762dd0f24435412531de59c52e1f1bd4d5e
- SHA512 a7dc96c992a1566a8954e817aadff42f92fb092c0d5a35ebf12c70f36ce37e8bcc22e9a790add7eb41198359dfb253136d1f23caf287d5b30767fd04138cc753
- SSDEEP 6144:vYvMwXLY++txRdoR1XlVaoQbvnei1uppJXxBVuiHqYs1QarNrFdkbB69RYxP0j:2pedoHXioQb/ei1upvXtuiHXeQj1mRDj
- TLSH T1D794182DE7E80465E1B2A5788AB3C605D7B278A81735D3CF1194C13E5E27FD4AA34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f0:2d:7c:a3:d3:42:7a:a1:27:58:4f:3c:7f:e0:ea:b0:9d:e8:36:d1:3e:d8:bb:de:41:06:c8:5b:45:ef:c8:b4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ea:9a:24:72:d5:59:3f:61:63:00:01:00:00:01:ea
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
symsrv.pdb
msvcrt
_wtoi64
getenv
strnlen
_vsnprintf_s
swprintf_s
wcsnlen
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_vscwprintf
_stricmp
_vscprintf
_vsnwprintf_s
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
vswprintf_s
tolower
memmove
_wmakepath_s
_wcsdup
_XcptFilter
_amsg_exit
swscanf_s
_wcsicmp
??_V@YAXPEAX@Z
fclose
wcsncpy_s
_wcsnicmp
wcschr
??0exception@@QEAA@AEBV0@@Z
_errno
_initterm
_lock
??0exception@@QEAA@XZ
_unlock
__dllonexit
_onexit
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
free
__CxxFrameHandler3
_wcslwr_s
wcsrchr
fgetws
wcsstr
iswspace
_wfopen
strpbrk
strstr
realloc
iswprint
??0exception@@QEAA@AEBQEBD@Z
memcpy_s
towlower
wcsncmp
strcpy_s
_wcsupr
malloc
strcat_s
isspace
_wcslwr
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_vsnwprintf
wcscat_s
strrchr
memcmp
memset
__C_specific_handler
wcscpy_s
calloc
wcscmp
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleExW
LoadLibraryExA
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
CreateThread
TerminateProcess
GetExitCodeThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-misc-l1-1-0
FormatMessageW
LocalReAlloc
Sleep
LocalAlloc
GlobalFree
LocalFree
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
EqualSid
GetTokenInformation
FreeSid
api-ms-win-core-file-l1-1-0
GetFileAttributesExW
CreateDirectoryW
GetFileTime
GetDriveTypeW
SetFilePointerEx
WriteFile
RemoveDirectoryW
GetFileSizeEx
CreateFileW
GetFileAttributesW
GetFinalPathNameByHandleW
GetFullPathNameW
GetFileSize
FileTimeToLocalFileTime
DeleteFileA
CreateFileA
LocalFileTimeToFileTime
GetFileInformationByHandle
SetFilePointer
SetFileTime
ReadFile
DeleteFileW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetErrorMode
RaiseException
SetLastError
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetVersionExW
GetSystemInfo
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObject
SetWaitableTimer
AcquireSRWLockShared
CreateMutexExW
InitializeCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockShared
DeleteCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
SetEvent
OpenMutexW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ResetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockExclusive
CreateEventW
api-ms-win-core-handle-l1-1-0
CloseHandle
rpcrt4
UuidCreate
api-ms-win-core-localregistry-l1-1-0
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ws2_32
WSACleanup
WSAStartup
FreeAddrInfoW
GetAddrInfoW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
oleaut32
SysFreeString
shlwapi
PathFindFileNameW
kernel32
CancelSynchronousIo
IsProcessorFeaturePresent
WaitForMultipleObjects
ntdll
RtlRunOnceExecuteOnce
RtlUTF8ToUnicodeN
crypt32
CryptStringToBinaryW
CryptBinaryToStringW
bcrypt
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-core-threadpool-l1-1-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexAndChecksumsW
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptionData
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerPingWEx
SymbolServerSetHttpAuthHeader
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
SymbolServerWEx
SymbolServerWithChecksumsW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile
Name
.text
Size
220KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33136,
count=26, id=260, version=33136,
count=296, id=1, productName=Unmarked objects,
count=9, id=257, version=33136,
count=14, id=261, version=33136,
count=1, id=256, version=33136,
count=49, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
111/kdmapper-source/kdmapper-master/HelloWorld.sys
- IMPHASH 66dc18523bff00fb828ce26e549a3c36
- SHA256 4f7f5d4cf54079dbfac47d6bc08fc7c4d5ca03b4f5c09b3c998b8f6bd125d82a
- MD5 bf7fe8993701d97706fe258fa3ba69b1
- SHA1 e0240fd7ab9056bc95764621432f34857ed648dd
- SHA512 773e0bd04b3e9f9a33cee600b6c4f3d7117f04c80580ba2f96331dde1351d5fd76fe4217a40738f4240e67df3f12885d95638c367ec51843b08e41875212bc69
- TLSH T1F651478BB76619FAF528937D80C3E96163BE753003E34B085E40501A74C6E2E7E6EE42
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Hello World Driver For Kdmapper Example By TheCruZ
ntoskrnl.exe
DbgPrintEx
Name
.text
Size
512B
Virtual Size
37B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
372B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=257, version=27412,
count=2, id=1, productName=Unmarked objects,
count=1, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
111/kdmapper-source/kdmapper-master/HelloWorld/HelloWorld.sln
- SHA256 9f2f948d1e726cb1839fc02cf68e0aa87df4767e086f675e9753012ba21b250b
- MD5 85572733693e437860215295909f1dfd
- SHA1 a45bee6c72d4749fe1cf2351928fe4ff25552d40
- SHA512 20e39d503dd7411c8c807e83217f2965d6d39f79738380d07331560b28ac1373c999d0a78342a355724fad85a768fab48c2eb5488173094180c8b2bc76a200ed
- TLSH T1043106DE01BE55F0A48F115BD06929CA6D7BF35C418A5BBE294300987F3B242022F4F6
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/HelloWorld/HelloWorld.vcxproj
- SHA256 61cccceeb62fdd1813dbaa55e1e5b9d87289145323a03faaf7515a43de5add41
- MD5 5931fbf5996a6f7073a124e31c747ba7
- SHA1 d76f032fc42632658360855b6fce0975de86b2eb
- SHA512 86d5a8c964b3e75b3e75faf2d628034d540b55535dd028a27e6dae223cc4e0f1e200730073514515b88e753eff738456560c2f3f765a80f7e000ccf148c25947
- SSDEEP 96:cQF33t87f+UhZoUhZX/UhZlgUhZT7yaLuppIpCmE8C:3F33t6hZXhZMhZJhZSBmy
- TLSH T167B1DE8ADAF48EE7C1A60623E1C710844FB0538319B65C6CF69EA7185B3B14C6307377
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/HelloWorld/HelloWorld.vcxproj.filters
- SHA256 d0e0a9381600b90905528a9092c40e0c0f3cbf8ff309581d657a97d0f0a6216e
- MD5 1784e6d233f8e0e6f2c3683f3f996e30
- SHA1 43691def0ba7283ec11e96114f57a6576732ffa2
- SHA512 ce5adb2047c98db7bb9b2ef9a672530c2c666a5e158355d767045480593e0c2ca0bd1dfe44be3b9eeab5c60868b4332483f35a30c01e2b1acca7192cc99cf732
- TLSH T16B218C20C8FC1BC46026AC2BFBC0C606AFA9A1F731D4214079EDC4033BF6308652B768
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/HelloWorld/HelloWorld.vcxproj.user
- SHA256 f427ff08b6cf1a714251ceef089455ada20b4ddfadc4c4bd4d93482586286d23
- MD5 6434cb4bd68d368bf8f9eb9ac8ff7d32
- SHA1 40efda2e27e2e3740995f77bfcecd7f83d4b3309
- SHA512 51fdf45756a4676b26987b5443fc99021225d6a5ea78258e0ea176a880c84f266cbb1fd65db9103c65f388bb045731b3c0fb59f8211d2c69cf078dd0e7aea51a
- TLSH T1C1E0D887D5409817D1AF8932E2DD519486B162674DF5489CFBBED21C121B256310B733
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/HelloWorld/main.cpp
- SHA256 ddd2ad33081596b059166db5eaf0f75874b86ab01441f34bcbbd0bad8aadedb5
- MD5 9d973999770797153716af4f5b2619dc
- SHA1 59c90b572afb24edcbe4fdc2f64f4ae4462f4d37
- SHA512 5d70b914b6ba053b3d8a30b17c360878447e1583275b214a61ee7810fa117ec4dbab9e14f026923b05f8e6440c70741c60dd456328b4f0b19bfab87a7763003a
- TLSH T1FDD05B51F477635531540E6E891B6E9C43BE5F373A14131C8786A30C228CC9612956D6
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/LICENSE
- SHA256 c78d76de7817daf78ea4012befa950f219cfad8e10c8fa555ae27560a05235f2
- MD5 cb57f5320dfec3e4b873d44476453d3b
- SHA1 cbfc997730e9270f398c14b6ebc616ac2f09d912
- SHA512 3750eed6abb9ee46000c014b215ee9182f0883d5e6a73e5fd88c336d537ed91fce23beec405ba84c33c3fd1b8ad46ded3b52272b6519bda4de31df18c2ef3a8c
- TLSH T11A11751E72510772189B13605979ACD9F23BB25F7A5F2A84246DF345233A07CC5FF840
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.cpp
- SHA256 b9b8f3cffc4476eff990339da6354285c0763ece4157f4de5598836da5d9fe49
- MD5 d8113edd9033bfda235a010968567697
- SHA1 6662273f666b2d725429ce5e02c7063825a6c3a4
- SHA512 ab8820fe86a12c3836eb09808edc3a413325b8ed84857b589c3ba8db129beeb2e202216355ee8673d2a9ab99a00f7b45a1d7f37bc559ba23d87f7078f93b68c6
- TLSH T162519660F6A8BD6776B31295DF034A8F35D851BB7BF04B1A82C34384B18542FA0F2972
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.sln
- SHA256 95de1a248ede2d9b042c892847830a3c24ff052e03e20f03ae2d8e77f4c6d3a3
- MD5 05bdbb95d97805361c368b44e30dfb99
- SHA1 b0f5cb4f8047e9c4ebfcb6eef9f2b3500e4537ec
- SHA512 9259376b1b1e490d8545dfb00fa13b1b5cd19b4be2c5658bc6422bbf19d7bde4281367a11f6d142791af6bea92dcaf7d765c52be55a1fc39d5df4c09736ee81a
- TLSH T1DA116DAC643E74E2404713DFE1D80C8A7E76A68492A9593D18E39048BE13FC5961F95B
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.vcxproj
- SHA256 06c29179593f0bf9f6997b4774b1e077745ea6bf11457ee69ec6c2a54be9901e
- MD5 67ab96097320ce91c07bd367338f4f2b
- SHA1 3c77c199de2b63745e7dbd9c521545a8cc6bcc53
- SHA512 851f18a7078bca9cbd09a5c3cb1c8c5e658aaa2e858d37531d1dd56119a5a26b44d8d5b3a9d2830d32c3d1bcaa3ad9983959ac93b85799f0e6baa604b4d0b8a8
- SSDEEP 192:Um+wTeWITpW4/yPcg/hPcJ/KPc+p/ZPcEb:Uma/q5/VY/iZ/td
- TLSH T19EE1FB94D0F01A67D1D7022BE5E659518EB1D3831D5A8C6CF69FE7584F2B6483323B32
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.vcxproj.filters
- SHA256 cc32158440e50ca022f285b39ac4b9b67a98336cca7e026d451d8d54f58843cf
- MD5 09a96077642a74ba06eb0c1e05a36bbb
- SHA1 473474a6f275b177b979567f7befeeac5c2657cf
- SHA512 63df58cd79410c2606ad9e3ce2be9970a55c4594533eabc671c10ca6fb1ebbfc212b07a5a98b1883ba28f45df656bace8a221ad0cc198416abefc02c4b16cf18
- TLSH T14B117A2098FC6BE561659C26FBC08A0EBFA9A2F335D5508076FAC4432B967086827758
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/LibUsageExample/LibUsageExample.vcxproj.user
- SHA256 c65b2b1a71dcd26333d8dc209ffeb90a906ddd8bbab6d45dada8e3bc84c30226
- MD5 b97115c31582bcb2b6ab5f6f834db248
- SHA1 f75316dc9ee719d300a59bcb8a0f92b26c66b6ba
- SHA512 d585275eb78134367cec02a2104256966c7505e0c5c622ddcc188503191cf4ce5d61ed34fff889063fbc4b4860214008557082fe559ffe9cc4d147e2717c0c22
- TLSH T1F8C08C81E600D021F2A0AA6083ACD438E3FAB2A324F084ACF6E4C90C21071A960243A7
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/README.MD
- SHA256 c0a2de773da6a81d51c99be83fa542f25c68e7df184ceaa9c768b31dcf99cccc
- MD5 1d4c96cfe0ecb2c08a828d4c937ba895
- SHA1 6717d47fe22733416575f738e6f9ddf331f8d5ca
- SHA512 f3021bebd3304ba35774c835f4e07278a8498c6c2cce7f3df94a54100dc09c9e6ddb121b7851526e3c1597d709c3c355ace484ade374e31e095fdb2c0a18eb02
- SSDEEP 96:LPwNjSoqXfejaDQaebvcsUHITFLD48FYThyAb25gz8N/2t2P:LPVoqX9QaebcsZBHASvNv
- TLSH T10DA1F91BD3267239862243DD513762A1F774E0AE53FA8054189CC01CB12A46DC23FDEF
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SimplestSymbolHandler.cpp
- SHA256 a59baed67a2b2c3076bb139c537b0a562cebc9d9e24bfab8629a06f9ed72bf18
- MD5 ce90ac6721160cc6a464ff6be6e45a82
- SHA1 8df7e808ca82dbb6afdebe868f8b2a2bfe83bf0b
- SHA512 320a599c5dfc14da6cfcd0f533b133ee0dbcea813850a559b915a0cba57307d6fb5dc23fb12aa21eb713de4afc6bfe3e905dce71d340556b3271e41bd4fc16db
- TLSH T18C718407CAB8742314693663171E00464D9D7119ABF0DF63F44F8298B79409FA8F2BE1
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SimplestSymbolHandler.h
- SHA256 8ac089c7e085c362a7d64437fba32df3c0809942748dedf065c21d90c989348e
- MD5 28a2db00b488c862edce78b7fabcaa8b
- SHA1 328f8143fdd9862e43f5c038d2c8e67f8e374e9d
- SHA512 9eec9c733dd0466a5e345e25f3bd9ec0fb023f27706c2f8c14e4c54a8ead5c15d9d80b0c1f75a40255d79b045addbd9e4859a44faa1e2514594b77101961f929
- TLSH T15AF0E257E5FDE6A03DA62217968F5A1B248C60C1B3606EF0E0DB204469E605A6FBB3C5
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SymbolsFromPDB.vcxproj
- SHA256 364da856b9e3a2c5e4f028713b98743a99f9776a5e0e2a9737201eccb5bb4157
- MD5 4bda9760cbadb7bc8ed3f87a8b7db653
- SHA1 9f9d9febd27aedd05533115efeb90627aae193d9
- SHA512 905fa17f03dc460e451e4d829707a5c8756e890bee5c45c6561c445abe178e0d7037cadb8cdfe1d1623f03de9df0e48eb3f0968cd10da8d2c89951076d85fd27
- SSDEEP 96:C0kbf1UWVUWhQCyaLoyaLCZAA/zlPcWAA/zlPck7:pkmWqWLF/ZPc6/ZPcW
- TLSH T190B10C90E0F45AB7A1A6033BA5DB5C419EB2D3831E6A4C6CF69EDB585F135482313B33
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SymbolsFromPDB.vcxproj.filters
- SHA256 22646878650485e9975615d29599e0de463c58c0a504dd6f46b03c2f932683e5
- MD5 3be9fe01eff98f6589ccaca8c0e8aa52
- SHA1 aa3c196c3c071b76b71b0afe3cdfe8800e8090a9
- SHA512 f5423c3acbe5e69cbc735fee7e0659be04e7e610baa189a49da1b1ccd2f8c41c60497b7e63abf6e73bb127242acff6636cb6cfa5c850b1e2a8c8932093d4cf75
- TLSH T113217931C4FC2B9961256D17FBC4C9096FA8F2F360D0204576EEC0072BE3308A927B68
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/SymbolsFromPDB.vcxproj.user
- SHA256 27b3f5d0019f0b79850184e0c27a7384bf8b1335bb9e4aa2e2d414a341e6209a
- MD5 dc2b99f2f6a1411d967726dac3cb24a2
- SHA1 1e2a9de214f40e210695cf3c63a312729519904e
- SHA512 5dc64771a98b9a5a602e2c273015d989c6134c98342c43128e3a9a342c7a0456307197d6a85af16cb86c44d40be63877093b4e37258e743863ad80b779c51726
- TLSH T1AED02250C200A232F2A42730832CD83CE3F6F7A318F058E8F3E0D90C111B06AA0197B7
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/SymbolsFromPDB/main.cpp
- SHA256 9fc0e4f6455cd27ab5cf85eeab9f7b80550c41157dc65c901cbc060978e52f23
- MD5 aa730b6bb0fe1509c112f5264ac5d8e6
- SHA1 21b66383c3ee4ad42ad02177bfa6195e5c0757c0
- SHA512 bee0cf0c6d2307d3b50ec273335eca51a85c79b27eb0ca264f04a488346385c78d019e8788ae8e13b3607b9d7b2981a4e970535768e26aaaf15f025bae41d800
- TLSH T1D55143078A7DFC529A722256238F061D10AD3C08AB3103F4FAEB0258E65C42A61BA774
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper.sln
- SHA256 a8e6c8d04ff00cc290cf9618b1d030b3d1281f5bd80c935d543446f459d93961
- MD5 24e5487c9ae7122c890566b850bd4561
- SHA1 fc61eb1e2369c3dd28c7cb7cbc70cfbfba671671
- SHA512 f532d619b38aabb3faf75158fab0b9343fcecdab7c51748e2777affc4b8d2db59fb54d97c7b9d5091ae7291cbc2066ea391dfc0ae17ac22ad2971c297c630690
- TLSH T10D515DEE614CE653B0A713BAC1B828C228BB824943515D7DFC83449DF39B87A07975A6
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/KDSymbolsHandler.cpp
- SHA256 5fc17f75023582a6befb30529c56d20b11d770a79d4c78c1f0fd042858a860b9
- MD5 a81ca8c722c22259e3b4e6825c33ee13
- SHA1 3e616ce2ba117cb2028b1e0d426d43b4aaad13e1
- SHA512 22fcd3b4bc9af37a56971e1bc9f37a775532f17419df745a6a192c78e6884d420031ecf5ba5829928e14b9656c589aefe1268a9a7f2e242b46d8a9a65edde6e2
- TLSH T15C41230ADFB8E86655B2626A0718209E78E874774F6447BAD4CF4048779C14F98B9364
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/include/KDSymbolsHandler.h
- SHA256 edb5f753a4ace77a2103e5d13d1053a4ee14d16442e5f5584129b7c214a9e0fb
- MD5 fae7d5f771e47c5a2d63c04f3393e36f
- SHA1 95492bcc71618cff676a045542224a36b7189a17
- SHA512 4c41c7d207098eedb51c7f7ebf2d8874fda1d86d61de8d6c46018b6e52193026aaa4ab16b08786c362fd0d744ae83fb5c065471d714779aa46de7b7e493f2dc0
- TLSH T12EF0051A9AFCD192FAAF1127055A2D0324DB9991B36665F1F04F4084FD9104359BB3D0
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/include/intel_driver.hpp
- SHA256 478d43faa2c6a01728187ce210232c2d5fdea74dcb78f8a7fc22022ce52977c3
- MD5 1098f18d502f4de08d48e425c22247fa
- SHA1 02fc409406d74acc7c2a7a3bef07f47e22028ec5
- SHA512 28485b184bb77aa2843a923cc1350903ca0a88380f5c2526646467687c42cbbba0cb8d840ae7adf5bae0827ecef6be1f443fbf054604568b24b4585fcf0d733a
- SSDEEP 96:Thu27caTAj4i4P4CN4XBdHvCGV/twMgsvEUGxd/ME6b4B5B1BC8:ThbYaTA4FiXXHvCGptwMgsEU0/T6QC8
- TLSH T13FA18789E69CE88732B301BA474F516CE07910B029D60CD2E76DC3B46EB75EFC556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/kdmapper/include/intel_driver_resource.hpp
- SHA256 6164e8bfb5d8933f425b78202b038d13b99a0520404f7c6c35bd41b20be9e9a8
- MD5 e669f082a1d0637f4154edcad9cfd616
- SHA1 460007650bbdba04a41f3a05aa08444bb38cf163
- SHA512 1188fa27a35cbc1690bdfc78fa8f49da7fa024b2c0d5829a88936f8b64f8f0093870028646ad4752a969247e49c95349018b35ed93c5fc4de7a6f58fa87379cd
- SSDEEP 768:HxNcIZf2vwD8/tZ9DwDcHEURtO4euF5glrAYnbrh1UDihGzaMQh7UP7QGFIXY0Uv:hZoVtj2C
- TLSH T1A714DAD5B71C48DE3A9B3A9CCB418992DA4DE57007E8424AFA6DC91BF0CF56580E0F1E
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/kdmapper/include/kdmapper.hpp
- SHA256 a50535aed12a7539f558867ba20a50c7495faa39925edf7342b33e317dbf2dea
- MD5 3583ad0840ad3256ad023fa80685b299
- SHA1 acad4d839161ed02695e0043ab2dfc4113be624e
- SHA512 ce65862f9dc34f46be134d1b537d18ce87917b512aa496d3c0a96f3ff9b032c018e675025cebdb3721eba043a154ec6a340c98ecfbfcb20785f8281a10b86972
- TLSH T101F028C68536115CCAF293D3FE8E0EA31DBB48BABF65801554684A18A25CB3D5382592
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/include/nt.hpp
- SHA256 b06eb1ff0e30be675628d020755119693e3bd7a75b118310a9ee699334e7108e
- MD5 bd1cc5ab7c98aa79c220f580e944806f
- SHA1 cdf6ccf12a8878c7e893f5651dcf22517233e07e
- SHA512 64e620891d8056ae8de7d3222806176d12ecfc45f474704ab6d7159c72f5aceefdb8ba91bc0e745161bdaa6d0792d1f3cf8c0567d2149e5681bcd4bf27ebe46c
- TLSH T1B67161B8E73D6904F27E8D7F65AE209A07AA1331D434DCE05826617178EC0FD01ED2B9
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/include/portable_executable.hpp
- SHA256 b530d0142ba0c7a063a6cea166104660520ce2e7a7e9a9fb01813585752edb90
- MD5 c60f1f27a0ee414c31de18380f2b1152
- SHA1 94fda9a16f7eb73851799b62dd4f515d1e40c318
- SHA512 2ba2dc756c80c2d49627e330d73f4cd1beb64a62efec38b27ab8541cd0f9cadc801b534ebc7d12b39930adb4508832af2c67b8c630075e970d3d496a9967542f
- TLSH T1F9F07B55A578F9D1543F5C92E58B210204A020D9B7429D86E47B03B86FF46645F37C5B
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/include/service.hpp
- SHA256 cd2ea0ef0f75645a587d1d2a03096a536a7649cedaad229ac6ffecbaa38a6d0e
- MD5 e781c89b10d9b3299a2c3c46fe3f9436
- SHA1 ae64bce803e29fa571b61465675d581ccb0367e9
- SHA512 698de8c1195ac59cae4ee4e49d8163ad467817b4b60bfa8388350c42426a829a476fd9330732527bd5535b034036e68bb29cf6b2eabcd4fafbb6e5276b96787a
- TLSH T1AAD0A940E0FEBC9BEAB258C24993510A254E3140FB30EBF3DEFA00A0B0C384CA032642
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/include/utils.hpp
- SHA256 b0f41ea726fdb233066809946c09de96d30a1e22f0018d3b7e5caa87063ef660
- MD5 ba70d9b059642940cf01d68de18e34db
- SHA1 afbc888333f27353096b052e15ac5b870f240b56
- SHA512 bf17feddeadd84dcbeb1457488151e36525d272e1469d2cd3e1afd75991fdc809242c0340140a80a1dde92cfd46a7393fd9f1ed78f6c8849f3576b1f1bbd43e1
- TLSH T18C01A611E8B8AC86CAFB45D2524A7004D042C1B6B3714FF19A9EA0A83EA2081E8732D5
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/intel_driver.cpp
- SHA256 3c1faf0330817168a14b7c21947746947abd48294cdbad4da6346f5fcd69b9a2
- MD5 9d37a90fc74560c4ccf003d63fd93223
- SHA1 7744c7c640e8a2448dbd91c2002753b49a78b1a9
- SHA512 f61c76b2bbcec54f9b81fdae505585030ebef8bd29efb8e60d3777c7af82b32dbe0db29edc1d3eab6e075afd7d330f16b49288a6941e713ba1252455bead5094
- SSDEEP 384:xDu5OgX94aWEPs4p9eR7e4qe+ABHm8s13tGpIZoi6egaT154uknlDmSoEGRIWZ:xDuQ24aWEPprAZm8s176YkmTEMZ
- TLSH T19723A6D23D7BAC1E21A31681E2361422F9ACC4B502B50379F5DE4321B77A05FD1FA8A9
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/kdmapper/kdmapper.cpp
- SHA256 44c500d182dab272eef694fd37bcb85a125cc40380e8987b30303243214525aa
- MD5 e33630adef577ca6c116c8ad9c8ed622
- SHA1 4128ef0fb8a6c94b1a43041e9c595742150729e4
- SHA512 7704c048bf481746aedf7d1b50ada6891cae26a96b0b1146626c042f00e842c101e0376573af3a45747e102e5db7be861cb4a0a7cc4eeae9312dfa53ab6f11b3
- SSDEEP 192:kaFI3Y2b63OdaDw0JXyvwW43Fe0nLTW4AlkcmckZx:xFuY3OEDw0JXyoWXPFmH
- TLSH T17522C8963D3FB84E02E11790E23A45769DCCC054263A433A75FA8215736D06DD6BB8FE
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/kdmapper/kdmapper.vcxproj
- SHA256 dd88538490fabe9c5e3ce76de6b8d5f50fbe8da0e65f32b66c1f76b51e700c54
- MD5 ce833c3744e730bf54898e45440c1469
- SHA1 54523b2254cabf30a6f593776ea2d201efb1677e
- SHA512 fa8a2d3f1c61dafc3f5f6699d8579c7df282bee097483d0f00da5ba385f0f7c96c42488dbee9661a6ebca5e5ba11a99a2a80d437af4aa60a71d59e6b1c649c84
- SSDEEP 192:yubJ0ImpxTBFJP/nPcWB/nPc6Q/nPcuj/nPcngB/nPcSI/nPc7gHO:yubC/PFB/P1Q/PTj/PKe/PDI/Pa+O
- TLSH T15962F192D0F46E26A1B34227E1D74982EE71E3830D974C58F59EA75B6F3B418A213733
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/kdmapper/kdmapper.vcxproj.filters
- SHA256 b701c8b28009157a5bce6443d0a793d18331a413ed33e17e41af70396bcbb0a0
- MD5 6f55a312cb151fc5eda7b504d9768db4
- SHA1 29791adc616286cd8e59eb35413874810b44c818
- SHA512 aca227ce24afed8fdc089ec6b87cb46a066c40ec72a53f5619887a184afeab0239629df9a79738120e3ef475966eb174e8a8f6e38065957a78a94ebc8d085660
- TLSH T1FE316121EAFC2EAD2232083BB755DE06DEA973E351821549726CE1C7FFA714CC117215
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/main.cpp
- SHA256 0a4ef3987d5715a68f3d8f1599b68de8677eb0431aeeafb34a835e8bff7a93f2
- MD5 1ddff49afeaae74c8fe79f9380066c43
- SHA1 f806a47920b30cb04ca5a41286137868d3e24f0f
- SHA512 0245b3a83c7c1ebcdb4101ff04c6be6ad7451c1485fc5e21d439a7bbeaa7de3e9e92bf945569b6cef88091ca21aa3d042cbdeaee85c0a21ebbe78130fccac099
- SSDEEP 96:31ibWy2904meO0VMN8a9VZyZdKCICJ1bNSRMCtJJ2GKH/MhZEQvVG:vy29w0g80wQCICJCWWJKUfEQv0
- TLSH T1D6D18290781B6D5A879327D9DB344A63ACFD94AD3BF5A27C70C98780785C00EA2F15A4
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/kdmapper/portable_executable.cpp
- SHA256 8b817679d1ce08eee18b07a5a6f5e36c70bfb699d1582755e54e0a3eb6ce5c2e
- MD5 1af65829cc7cdfb67349cf220dd248db
- SHA1 8796f8b6f4bda5ae3184824350845e5b95473388
- SHA512 9b191ba6f84f4dfd4328a73c8cb2cb3d37db0688f88e6dadae1162c920924c741e28491763376051ee306e402290ddd0139c06d79ef9a7422e60100ec5b13aa8
- TLSH T1A97125FF25A7F4F28B225A20F829C97A046685A522038353E33DC39E13941DDD65756E
- MD5 SHA1 SHA512 TLSH
111/kdmapper-source/kdmapper-master/kdmapper/service.cpp
- SHA256 01eef0820a733253f0b983a084fcc76626ef4b0634fbb80bee8844b2b01868a6
- MD5 3f1a60a60884654a19b2620e9d227919
- SHA1 46f4d6416d21c6198630e517e89e5b3c1925fab9
- SHA512 93959a67e069719a371b1240117311126ff0813376f249c0c6c4da82b63ec2eede4718bc37634cb5773d0dc2cc13ac61896d66a4bec7924cf183a022c033b90c
- SSDEEP 96:f1DEbSH5nTKExDO0AAWiYCb2jx5mCv6Lj0AxlyXnnO:fJjNTJVOVuA6Lj0O
- TLSH T13DA174136DB3243F5DA106118F37D8027DEC54696772B37292ED5351B2EAC8E84789F4
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper-source/kdmapper-master/kdmapper/utils.cpp
- SHA256 5aeefcf8824414562df43d55974c67ccc47d58650af9489d7a9ad2bc30950d85
- MD5 24369b9596cc8aa90d902496fe3b7965
- SHA1 be93de182f593b4da88982dbfb309eea5aa5ccf7
- SHA512 ce7cbe72db777dc8ce89bce22582c89949ddbaa494293156b7711cea6dca1f11e068f66b8d1ec270040385bf9deb0d9e103ece8746bdb6f8386c261f1ea883a5
- SSDEEP 48:azTWjqx38fh8Tw8u4Ti8d07PykSbdPkndP6XJkCnTJV+J//nXL/nofE1/nU2XGzR:aXPYXR86paU5gaATIn7YE1fUwDxY
- TLSH T1D4816385B8FA78066AD33A66F270451DD8E4D0B263294778E6FC24D176E0029CBF25DB
- MD5 SHA1 SHA512 SSDEEP TLSH
111/kdmapper.exe
- IMPHASH 0959368de52096c290b5b7fea432048c
- SHA256 3ead5cb4983a2692a9031bb9190a4e8e7df60590f9f494f245f9695bfa0d1c04
- MD5 a463a7f1b64dc9ccb67ceff8de9207fa
- SHA1 e4b2a2666fc99fe32dcb299f7b4edaab0b4a5832
- SHA512 be214e129ae46278b5ede8de9ca85950f6f33619444f40b458d1633e6a4d210becb2a2eab760a7d1d33bdb51e85df50b57e042fdf85c306c55f1bc58fdcd06c3
- SSDEEP 6144:8o9ShY3AhvKEMr2L9fF5IfgmWjC1Md2Al9dt8I9OMFfWljXunLXl:8kAh3LZ4jWPZl9dt8sOMU1Xun
- TLSH T1ED947D56F7A404F9E277D578C9724502EA727C5A0770E6CF13A8499A1F23BD08E3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
105280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
RegDeleteTreeW
RegSetKeyValueW
RegCloseKey
RegOpenKeyW
RegCreateKeyW
ntdll
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
NtUnloadDriver
NtLoadDriver
RtlInitUnicodeString
RtlAdjustPrivilege
NtQuerySystemInformation
RtlUnwind
kernel32
GetACP
AcquireSRWLockExclusive
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
CreateFileW
CloseHandle
DeviceIoControl
GetCurrentProcessId
GetCurrentThreadId
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetTempPathW
GetModuleFileNameW
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
LocalFree
GetLocaleInfoEx
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
ReleaseSRWLockExclusive
IsValidCodePage
WakeAllConditionVariable
SleepConditionVariableSRW
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapReAlloc
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
DeleteFileW
IsProcessorFeaturePresent
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
GetOEMCP
Name
.text
Size
241KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=178, id=261, version=35222,
count=17, id=260, version=35222,
count=7, id=259, version=35222,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=86, id=261, version=35721,
count=9, id=257, version=35222,
count=140, id=1, productName=Unmarked objects,
count=7, id=261, version=36252,
count=1, id=258, version=36252,
111/loader_spoofer.exe
- IMPHASH 892eb8560f8d88871e9cc4c198d61f91
- SHA256 4502bfea0d3e3abeabdaeb693fd3f87cb4e94ca00946b97637b55d33c1777575
- MD5 7be808b06cb44adee9b9b36d16aa71b3
- SHA1 4eebf1f31a804b787b1d9a3123a62801cfea562e
- SHA512 1f48540fccab754c8576cea3b4d0fe80d9df7d517c839cb0caf2af6ffc663dc1f75eb8c8d5c29e01f88dba9fb5cc8d40b7b33ea2404e0542469863777f9ecb27
- SSDEEP 6144:PqptxxniN9/2nldg06Evo74Pv9hliG0FaPiC90/2LI:PqpNM2gHEAEPvj0FaPKaI
- TLSH T1E8747E29F7A414FDE177D178C9524906EB727C4A0371AACF23A00A961F376E49E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
89872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
OpenProcessToken
GetTokenInformation
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
OpenServiceA
StartServiceA
CredEnumerateA
CredDeleteA
CredFree
kernel32
GetStdHandle
GetEnvironmentVariableA
CreateDirectoryA
DeleteFileA
FindFirstFileA
FindNextFileA
GetFileAttributesA
RemoveDirectoryA
SetFileAttributesA
CloseHandle
GetLastError
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessA
GetSystemDirectoryA
GetModuleFileNameA
MoveFileA
MoveFileExA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
CreateProcessW
GetFileAttributesExW
GetFileType
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
CreateFileW
RtlUnwind
Name
.text
Size
228KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=179, id=261, version=35222,
count=17, id=260, version=35222,
count=7, id=259, version=35222,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=83, id=261, version=35721,
count=5, id=257, version=35222,
count=129, id=1, productName=Unmarked objects,
count=1, id=261, version=36252,
count=1, id=258, version=36252,
111/main.nativecodeanalysis.xml
- SHA256 ba052e3b011b8f8a3e59a7b5c3120d3c9496a6c3e2fd73c55013bde5e2642bc5
- MD5 a7dbbbf2986f5cede292d22989281c57
- SHA1 15a3e3b72c1c8ebe3c1faf763fd9a61f08c91a71
- SHA512 0fe59e86cb11a6b3a118c819ee3a142325287e05f940f58dd8f7fb393e816adcbd3a2dcd95b8f52a0015704d81fe367ab3b7cf0523f0ccf0ae6a85aac3656236
- TLSH T1E3A002446311DC3109A28F340769C9087374613D04D005465AE109920A150E60F44295
- MD5 SHA1 SHA512 TLSH
111/ndis.nativecodeanalysis.xml
- SHA256 d527caa6fbe2b31a2e7fab0a02044fd8477f83ef4fca6a80e7bde0807eb00989
- MD5 23bacba01d2bdb217211840db2155049
- SHA1 25643ca60ea64c47eed6ff5bc4dc014684fcfccc
- SHA512 4f051a45b25b8e8e0b5dbebca905aa3bd2b8c2af302e25498fef1005d25f434ff667faf4a4ca21a8247d31b37a46b44a3d047dce2c3c495904c024877032cac4
- SSDEEP 768:s1TAXtPaQQQQQQQQQQQ044444444444344444444444ui:s1TAXtPw
- TLSH T14133271E65D88F944AB1C1EAE30C7A08EF616443B1781701B59E527F7FB8C9A8397732
- MD5 SHA1 SHA512 SSDEEP TLSH
111/nvidia.nativecodeanalysis.xml
- SHA256 2572e6855ee395f7b98eab4249673c7ea5c62c445413342c045d4d59e70f32c3
- MD5 714ac3aca66406f19b8210f487d507c7
- SHA1 ef2fa414cfd903e3f736e2773f42d932d7023266
- SHA512 35e1433a20f302eea161a17e8dbd016057fc3f5d2c87b0bbf5d58cdfaad45ef7696e0c0d8a719f1216814bf4d20db975208e4eb4f1836cfef82952f3a980ce64
- SSDEEP 768:s1TAXtPaQQQQQQQQQQQ044444444444344444444444f:s1TAXtPs
- TLSH T1D133181E65D88F944AB1C1EAE30C7A08EF656443B0781711B59E527F7FB8C9AC287732
- MD5 SHA1 SHA512 SSDEEP TLSH
111/process_helper.nativecodeanalysis.xml
- SHA256 6c396c1ba5d7e121ec9bd1b41f0182c39b9f664f2e9441d4ca22f8c21bde2655
- MD5 8425b840a87083c2da4edf585f1185f7
- SHA1 c79d79bb07fa9be3760140d7c2ce07d3bfabc5c7
- SHA512 42d7cdf6fca913beb44de2d0e94b07c87c9d17bdad376e77457115d4b2220bafa14fbdddba89b672c14702cb9b9866517be8b19c1725e7841531a299b908be76
- SSDEEP 768:s1TAXtPaQQQQQQQQQQQ044444444444344444444444o:s1TAXtPD
- TLSH T11523071E65D88F944AB1C1EAE30C7A08EF656443B0781711B69E527F7FB8C99C287732
- MD5 SHA1 SHA512 SSDEEP TLSH
111/smbios.nativecodeanalysis.xml
- SHA256 e7d74814b2566e1b45499e02286b4a6a146a590e3319401ac83cc23578a18438
- MD5 e8ddf55de1f6e102c72df258f87dbd52
- SHA1 fe8a0e3db33fa164bf6c01eb90f4269219de92db
- SHA512 75ee86538e6d8f7f1aa7f8be2ba25a052dbfad2bec003a11f383f62b8654370e5d75c97f93c83a3c2d65d1946dc42122a906c194d7725711c229f77b456d924c
- SSDEEP 768:s1TAXtPaQQQQQQQQQQQ044444444444344444444444EVBC:s1TAXtPZVBC
- TLSH T11433281E65D88F944AB1C1EAE30C7A08EF656443B0781711B59E527F7FB8C9A8387732
- MD5 SHA1 SHA512 SSDEEP TLSH
111/spoofer-driver/disk.c
- SHA256 d21adb40a5cb207e0170f8e2225e2b2c40f97b2145aa0a734e51f57d31e07997
- MD5 f0e80d0d25d6ac09a7241bac0769b591
- SHA1 2be00c43f6944c1c6e02845d88095d59ffee545a
- SHA512 e217b2f306e9a25a5c38cbc600284a88eab294ae124b3ca9d69f638eaea69c2b6ee2b1617bcf73f8fc683b676debb0921e7712c77578073f883ec37c4ccd448f
- SSDEEP 384:CxZHCcU9lUQklU4xvsAcAhdU1Hku0jD6ZVEwbuSn7a82C4K7lu4K7UuHIP67Kv42:rlUNlU5kMmuL6IPU2
- TLSH T197A2B8091F939149A5637E7D67E3892EB5B200032A1BDA09BC8CD7D4DFF4D7883B0699
- MD5 SHA1 SHA512 SSDEEP TLSH
111/spoofer-driver/ndis.c
- SHA256 bde1ee9c4655362677f70101955d19144722ac0f1fd5abc7ba23ee0a99bbeadc
- MD5 2b45e8b27b8f35a8511a40f22591c727
- SHA1 e7389bbdf43f6c56fc36333f0f6ee11da3dc091a
- SHA512 0ea75005232ce23cb4aa06938d12593b00aad48577ccc1c99713ec64a3e75e67adde3019115d6369881bdf0002ee7726c6753f5d55d4be16b95e6487fe86fd96
- SSDEEP 192:jqezUbCt3WedeGsi69FrxQ3teGsix8FIQQx8rZyn1DVU4:NUbCdkDrDO0+
- TLSH T16FD161142AABE2596A436EBE3FC34CADD57A001B225BDD04F80DE7E0DFEE53441B0646
- MD5 SHA1 SHA512 SSDEEP TLSH
111/spoofer-driver/nvidia.c
- SHA256 6d497289e3e6eee200ac27a69bbb187105a5920f5ed322fad1a5dbbc1c49852c
- MD5 9b2ac7fc1daa3cdfd07aab5c86837148
- SHA1 08cc55b690065f1413bd14d64f402c209f69d8b3
- SHA512 a9ff01a42908fefe0079c57c42648713e57203b19c9f5e2eb638056314bc96fcc256df15f5f3623c6d882b5c1d880bd16967883b10a4eda3da25d3f240b818e0
- TLSH T1AE41F0022457B45E665B6EBDAB539C09E9D805370726F940F80CE3E8EF9EA18C07C667
- MD5 SHA1 SHA512 TLSH
111/spoofer-driver/process_helper.c
- SHA256 6daf088c0b6b4b2d07ed92a1c28b844796740bcf49381d3494b4ee332b476054
- MD5 147f34ea7ab3f6053574f62b689b0eaf
- SHA1 9850366e73b7c6493a9a985de21e0ca43c370aec
- SHA512 162db817b19d8ae2a23497950ccaf963b46987feaaa51ae2e453f871d279af43d9ccb42e83a9c4026e53c2e3dc981e8c85a64391977d80df0ffd6be678117fb3
- TLSH T18541EFC09DA7284091C760385797901EA8E9411334BA9E35FE2CE2702FDD1F55671B5D
- MD5 SHA1 SHA512 TLSH
111/spoofer-driver/smbios.c
- SHA256 74ff78080d03f2cd638b573c52b5bfb06515cc5a08c6cd70467d0c1de591fdd7
- MD5 49dc5df3b380095609301cfa03bfae34
- SHA1 c05b2346e305043521bb55e6ebaeb968d258581b
- SHA512 3a0ea3d15140f0a905f7901a688d79fbb01b535f3bbff4a1892428cdf2ea8dc307a62def84c6d0be7ecb6a0f42a6f850c82d3e18db550c1725085cc7e187f443
- SSDEEP 384:9/6dwb7Rc0ctpUEAr3jH0R+LudamYvMLhh2F2nAB212G5W2bkOnXpTnw4B7AMUYk:hlbavtHAxvihh2ZBqPnZTnw4BskydOEf
- TLSH T1CE92C34A1BFBB445A443E93DAB9B8C09A9BA5013022ACF11FC0CD760DF9663D66F1F44
- MD5 SHA1 SHA512 SSDEEP TLSH
111/spoofer-driver/spoofer_driver.c
- SHA256 d682c2dd2e2501977fdd7c264de6e28c378acb827e20a3f5d5d6cfa87387adf3
- MD5 98ff5b5ead0399139e1984fc97fc5edc
- SHA1 c370053dac961615a42cb322a4979d9d9b26ec7f
- SHA512 b10271ab3ff3fd929cfca39486d2fb31598a5b2a20b6d6f4a44358b29e3b3af8e56c126887bcef3369e8029aed941ea6da94a72353640547d3240edf1953ca2f
- SSDEEP 192:uZqWYDi+hthojd+yiScCViQd8loDr0MrSdGXGg5McMCt7CgcgvQ/VaAu57kEwhGr:gqA+h4MM7psVKL
- TLSH T1FC226301A8AF500176B3282E5BC7880A5AB60593272AEE10FC4DD790DFBD57899B4777
- MD5 SHA1 SHA512 SSDEEP TLSH
111/spoofer-driver/spoofer_driver.h
- SHA256 a385f628e7fa889622bdd676ae5d8c167cf61e865af1dabc8ab610ca8d59094b
- MD5 10b603e13a0a2b40b41af755f4a780a3
- SHA1 70c9e8ecd75ae61aee40f94264c46cc0cd439930
- SHA512 298048706a318bf92c26af5aafaf9b57803968d482671aa6f616f412abc18ebcfee6fadc20b1a07b91ff6249448b00f555bcd6937fdbdd78b102a0cd833728bd
- TLSH T1BB3112033A7C614513F751DA792B223E4AC472031636E1217853FB31AFBD19C64BA6F6
- MD5 SHA1 SHA512 TLSH
111/spoofer-driver/tpm.c
- SHA256 64af160c55d0043c3741deafcb017b1479b770d4a8c9b631ed47df2cd65797a7
- MD5 7036108e0f78ad9c3e14cfbd9a947045
- SHA1 d69a28e364006631687867b64a765f2d00533a7a
- SHA512 3ec2daf18b4ab96e59afcac13e23c405862b24313a9c2ae468dd1b76e03ca451b5ac706f4a1cbce71e179924fd07bb9ea271aeec08a5cfe780aa200064df781f
- TLSH T1BD8101856653A0A872478D3DAB538D49FEE80433071BED40BC4DD2E4EF9EA18C07569B
- MD5 SHA1 SHA512 TLSH
111/spoofer-loader/buffer_parser.h
- SHA256 8f185a6a6c2e95f9f44d4ed1ef134431c15a126cb00924b3fbc6f435e2cd1ed8
- MD5 fc83019704a307a7184915669fdd13a6
- SHA1 7dbe7d67657e64f2fd2ee1dc319bdd2426f3ba6a
- SHA512 c44a990497022385bd0b1f57f874b8aa1a9d96239aa615528f9c8231bbe4436971fb6e1e1335d31c20658c30acc5e4e4d00450fb66bb6b859b1671e5390d1b81
- SSDEEP 96:WFJiQ26MO0tm9lGE/CUylIh5h0S3enI3I6W5CyP9wb56:WFJiQhMPtmBCUKkP0SOnI3I6W5CyFwbc
- TLSH T15AB12A470AF2A0225A13A23D8B9E903671759023016DCF24FD8C53557F826FD99F6E9B
- MD5 SHA1 SHA512 SSDEEP TLSH
111/spoofer-loader/main.cpp
- SHA256 dc7628908fc89565fa2b1c88fe4ccf273d6ddfe772fbab470d702bae83e459e5
- MD5 64372fd3fd18efe2fcb79b3f5a10870f
- SHA1 c1f8b719b063517a870e3d96ca4c42603bc080c1
- SHA512 28f122f6c16cfc8bbe9e041edc5e64605e5ad07083cf5bbb42d0ade2e41d34d16fcdc6ceb34ac92da49efa093d8ea77c26ea9acbdd8ce26fd4450800f63626bf
- SSDEEP 768:hhx7kB23565VViAz2vcncG0HZ+GiJ2IqniHF:hhxQB2p65VViAz2vcncG0HZDiJ2IA0
- TLSH T134C2A60998F33D24640366298B6A411625175103EF3ACF36FC4F17C16FA4B6AA6F47BE
- MD5 SHA1 SHA512 SSDEEP TLSH
111/spoofer-loader/parser_tests.h
- SHA256 a8fe470ed2dd9ca980dc2091e219c81876e053e9822c984b6107f176f15621c8
- MD5 5373541894979cb10fcdeeb7182cbf87
- SHA1 bfa378ec1e1db4c9a4a91e7f9664e5aaa3e00300
- SHA512 9e04745eaf3a519053a51f1e737c93f56a468a4cf107e5e73d13294e45da7106969f289b5e6616bb006849fe2b5814402efd77db12f2f03697b0e600ed1490da
- TLSH T12E51F4619CEE9D561333C58E1F9E081A752A4023C658CF72FD4C97291F4B4CEE5F6261
- MD5 SHA1 SHA512 TLSH
111/spoofer-loader/raii_handles.h
- SHA256 a3ce3f7189849ede433e58bf78ce950b8d1bb2634fc7a85be10091d1455cfb74
- MD5 b50f16274e266e7f3a17f6120c12f766
- SHA1 d91f30f0baa8f54dab3a10b0b151d0bc593784fc
- SHA512 3ac6bd4fe048e0bc6703632cf40ecea8c488454a5ebb84d58b7cd7cd55eaa18f1b415b6578c000d2424768fa470bb3aaccd82491fb0b38108fcccc6baa2d2e0c
- TLSH T1B8511BC282CFE15250A1737647970142BABC6A43729ADFF47B4C3350EFA62507A74394
- MD5 SHA1 SHA512 TLSH
111/spoofer-loader/utils.h
- SHA256 da3a0aaf95a7152669d67a1e1b24e79b5cae4e7519f232aa7def85444a1e40d9
- MD5 1316cb398a17468cbf74daa12df75474
- SHA1 1d05c3e107c270e08b17b13f6dbec1c7eee8c7b6
- SHA512 4f43f19b884dad7bf39e0299e1b4a01716cc960749d82316fffb51aad36cb7684a4b2c599ac3368d92accccdb509eef70c03708de4952c0246c2f66c3c6b7fa0
- SSDEEP 192:Bv0ee4DVQI4flLYZMMDwBqxOXr9tiSCyiIqzBdofGyi7wv3HiFaOyiHyrZ7L:yeXcgDM98Uz/
- TLSH T1F2F1730881F73861690326695F574112351A0603A73DDF66BD4E03C1AFEDBF9DAB83AD
- MD5 SHA1 SHA512 SSDEEP TLSH
111/spoofer.sys
- IMPHASH 6acf38c28c9794937f01c35168e185be
- SHA256 719e611b009468d99321432d98dcde33c71abbe9e3a7575b3d824c5552ca0d03
- MD5 dd753ec29e29e97cac6b436339c3663c
- SHA1 77272f46327c4ad14c689bfb1a9837722fdc8d4c
- SHA512 400bc8cd1423d06996f4b2971b8ffee941ab03c4588a7af4f02fd01a191f0b79ca3c93aca9d729bbb841bed95cc48f39f42025e516309a44b48134678110115b
- SSDEEP 768:Erh2oWy61tx/sgRiPm9RI91Cc2RAW2Rt:UsoWy6NhiO3m1h2R
- TLSH T197F2499982A110E4E577D1F8D7B61F69E5BB30912322AACF4710C5784F33EE12A3E365
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntoskrnl.exe
KeGetCurrentIrql
KeClearEvent
KeReadStateEvent
KeDelayExecutionThread
KeWaitForSingleObject
PsCreateSystemThread
PsTerminateSystemThread
IofCompleteRequest
IoCreateDevice
IoCreateNotificationEvent
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandle
ObfDereferenceObject
ZwCreateFile
ZwWriteFile
ZwClose
DbgPrint
PsGetProcessImageFileName
PsLookupProcessByProcessId
IoGetCurrentProcess
KeInitializeEvent
ExAllocatePool2
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetLowerDeviceObject
ObReferenceObjectByName
strlen
IoDriverObjectType
MmMapIoSpace
MmUnmapIoSpace
MmIsAddressValid
ZwQuerySystemInformation
strncmp
RtlUnicodeToMultiByteN
PsGetCurrentProcessId
RtlInitUnicodeString
KeBugCheckEx
hal
KeQueryPerformanceCounter
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
544B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=261, version=35222,
count=1, id=262, version=35222,
count=1, productName=Unmarked objects (old),
count=7, id=259, version=35222,
count=16, id=260, version=35222,
count=5, id=257, version=35222,
count=43, id=1, productName=Unmarked objects,
count=7, id=260, version=36252,
count=1, id=258, version=36252,
111/spoofer_driver.nativecodeanalysis.xml
- SHA256 40ae5463fef898deca4930e399b99a685f550a5722607be122a7547642fc736e
- MD5 735986f6cffb1652aaa43e997eb7e39d
- SHA1 8a1e336d10ee1f365b4758600c0506b679d5feb0
- SHA512 9a423e23401640f7bc2b9ae4c92064ae57a0c2136590453c9a94b67f3544ecc6e5cf898c1a03dc2028893ddb853ac3e0d45f663da781a6c928529c9d54fac1b1
- SSDEEP 768:s1TAXtPaQQQQQQQQQQQ044444444444344444444444+:s1TAXtPl
- TLSH T13A53391E25D84E944D71C1AAE3187A0DFF216443B1781711BAAE527F7FB8C99C287732
- MD5 SHA1 SHA512 SSDEEP TLSH
111/tpm.nativecodeanalysis.xml
- SHA256 6dcaecc14ddd7527930600e7fd20860b9191bff64fd206643b9743991991a6b7
- MD5 8da4771d0278680ca5837a2c84755884
- SHA1 54b14b8bc0f136c39956c274b7266e5ebe52db55
- SHA512 748ad6f5346a1c8d145208e5de04db463c7c62c87eb2adb894d06bf2fba01879dd85d029f92dba635975d4a3ec17aa98092b091a6f468591ee40c33a97cfb0c8
- SSDEEP 768:s1TAXtPaQQQQQQQQQQQ044444444444344444444444+/:s1TAXtPt
- TLSH T10433271E65D88F944AB1C1EAE30C7A08EF656443B0781711B59E527F7FB8C9A8387732
- MD5 SHA1 SHA512 SSDEEP TLSH
111/unload.cpp
- SHA256 0ee394ebd5178ac7c8d48d82ce1d0a10cee216eec47c5847337648ea640be4b3
- MD5 2d1df87eb7ab2878eb631ee313947026
- SHA1 58764338466aa61c93ba65e1001e5adadc49f3b9
- SHA512 261ba9db8e4295ea785a0a8c48cb4eb890a4ee80694b67c48c34bd9749ddc7c7d2a51ffd2b10dbf4653fae2ce23a76b5e8c47363bf738f297ea2ca98d805114d
- TLSH T1BB119E488CB97D60A2A35918C346410A19160147DB78CF02398F6FA6BF97743E8F96F2
- MD5 SHA1 SHA512 TLSH
111/unload.exe
- IMPHASH 6c476854c047cd6de3ed3fe87b1a120f
- SHA256 c8ca0ec9414ab5c677733264f811db59fe0949e22b100ae9abaccd1ef50d52cc
- MD5 06076d835d86c162c9cf3e63878a4286
- SHA1 df9bbbc2822b46ccc57971ec72047c6d7a066f1c
- SHA512 2cb7f1a53f601697ea1bd5136d905f96cca7886f2137bf5161a418fa13932941befa511e2396878bb8e2b2a2c0f4137a62d63b25e1f63a12ca3ad1c55752fc22
- SSDEEP 3072:5THS/oPSmrRSdcd6mETV8C2PVAqNvl0p8hqrJ3nC2Y70JPdo3hKKUMqp/8fEw:rCKC2PVAqN90iq93C6dBl
- TLSH T1EC448D55B7E50CFAE967857DCC524906EA72BC524760E6CF03A00AA71F23BE09D3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
36320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
GetLastError
SetEvent
OpenEventA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsProcessorFeaturePresent
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
CreateFileW
RtlUnwind
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=167, id=261, version=35222,
count=17, id=260, version=35222,
count=7, id=259, version=35222,
count=3, id=257, version=35222,
count=96, id=1, productName=Unmarked objects,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=80, id=261, version=35721,
count=1, id=261, version=36252,
count=1, id=258, version=36252,
111/unload.nativecodeanalysis.xml
- SHA256 ba052e3b011b8f8a3e59a7b5c3120d3c9496a6c3e2fd73c55013bde5e2642bc5
- MD5 a7dbbbf2986f5cede292d22989281c57
- SHA1 15a3e3b72c1c8ebe3c1faf763fd9a61f08c91a71
- SHA512 0fe59e86cb11a6b3a118c819ee3a142325287e05f940f58dd8f7fb393e816adcbd3a2dcd95b8f52a0015704d81fe367ab3b7cf0523f0ccf0ae6a85aac3656236
- TLSH T1E3A002446311DC3109A28F340769C9087374613D04D005465AE109920A150E60F44295
- MD5 SHA1 SHA512 TLSH