SETUP.zip
- SHA256 9b05f1ec83e0f252043c75ebefe40ee640e9f3aaf9e141c27b0bab0dbfab7142
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
300 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
300 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
300 seconds
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
300 seconds
General
- Target SETUP.zip
- Size 10.7MB
- Sample260903-pbtsmsgm6v
- SHA256 9b05f1ec83e0f252043c75ebefe40ee640e9f3aaf9e141c27b0bab0dbfab7142
- MD5 6453bc027147bbbce0ae4aa17396e02b
- SHA1 2529de03de94bdca795772dfb818a474fa803a3c
- SHA512 9a07f58cd257386aeac488ebdde7179d693c13eb883e50a159e73040454ced3b95dd9b224d7b8fd931e925bb41f34e7ca5bc1cd0b59de3db9e26d44bf0af066e
- SSDEEP 196608:LQSOvnQAOFe2d/cJDHIzcoY0cJUmUkhanpQe/+OFtG4/IhnjPk6Q9kneU5MF:LXPAOM21ADHCc0jkonR/whj9hMF
- TLSH T134B633C4FE700D5AD407713EEBFE6D989B9BAFE48114B517E82CB0A98AE4207532DC15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 3 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/Setup.exe unpack001/x64/SQLite.Interop.dll unpack001/x86/SQLite.Interop.dll - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/SHFolder.dll unpack001/WTSAPI32.DLL unpack001/comdlg32.dll unpack001/oleacc.dll unpack001/x64/AdonisUI.ClassicTheme.dll unpack001/x64/AdonisUI.dll
File Explorer
-
SETUP.zip.zip 10.7MB
-
LICENSE11KB
-
Resource/CMap/Identity-H8KB
-
Resource/CMap/Identity-V2KB
-
Resource/CMap/UCS2-GBK-EUC238KB
-
Resource/CMap/UniKS-UTF16-H128KB
-
Resource/CMap/UniKS-UTF16-V3KB
-
Resource/Font/AdobePIStd.otf83KB
-
Resource/Font/CourierStd-Bold.otf29KB
-
Resource/Font/CourierStd-BoldOblique.otf31KB
-
Resource/Font/CourierStd-Oblique.otf31KB
-
Resource/Font/CourierStd.otf30KB
-
Resource/Font/MinionPro-Bold.otf205KB
-
Resource/Font/MinionPro-BoldIt.otf245KB
-
Resource/Font/MinionPro-It.otf246KB
-
Resource/Font/MinionPro-Regular.otf205KB
-
Resource/Font/MyriadPro-Bold.otf88KB
-
Resource/Font/MyriadPro-BoldIt.otf90KB
-
Resource/Font/MyriadPro-It.otf88KB
-
Resource/Font/MyriadPro-Regular.otf88KB
-
Resource/Font/Pfm/SY______.PFM672B
-
Resource/Font/Pfm/zx______.pfm683B
-
Resource/Font/Pfm/zy______.pfm684B
-
Resource/Font/SY______.PFB33KB
-
Resource/Font/ZX______.PFB73KB
-
Resource/Font/ZY______.PFB94KB
-
Resource/SaslPrep/SaslPrepProfile_norm_bidi.spp13KB
-
Resource/TypeSupport/Unicode/ICU/icudt26l.dat209KB
-
Resource/TypeSupport/Unicode/Mappings/Adobe/symbol.txt10KB
-
Resource/TypeSupport/Unicode/Mappings/Adobe/zdingbat.txt12KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/CENTEURO.TXT12KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/CORPCHAR.TXT18KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/CROATIAN.TXT13KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/CYRILLIC.TXT13KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/GREEK.TXT13KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/ICELAND.TXT13KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/ROMAN.TXT14KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/ROMANIAN.TXT14KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/SYMBOL.TXT15KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/TURKISH.TXT12KB
-
Resource/TypeSupport/Unicode/Mappings/Mac/UKRAINE.TXT4KB
-
Resource/TypeSupport/Unicode/Mappings/win/CP1250.TXT9KB
-
Resource/TypeSupport/Unicode/Mappings/win/CP1251.TXT9KB
-
Resource/TypeSupport/Unicode/Mappings/win/CP1252.TXT9KB
-
Resource/TypeSupport/Unicode/Mappings/win/CP1253.TXT8KB
-
Resource/TypeSupport/Unicode/Mappings/win/CP1254.TXT9KB
-
Resource/TypeSupport/Unicode/Mappings/win/CP1257.TXT9KB
-
Resource/TypeSupport/Unicode/Mappings/win/CP1258.TXT9KB
-
SHFolder.dll.dll 32KB
-
Setup.exe.exe 10.5MB
-
SspiCli.dll.dll 300KB
-
WTSAPI32.DLL.dll 1.6MB
-
comdlg32.dll.dll 940KB
-
mpr.dll.dll 142KB
-
oleacc.dll.dll 480KB
-
winmm.dll.dll 215KB
-
x64/AdonisUI.ClassicTheme.dll.dll 287KB
-
x64/AdonisUI.ClassicTheme.xml.xml 146B
-
x64/AdonisUI.dll.dll 164KB
-
x64/AdonisUI.xml.xml 76KB
-
x64/SQLite.Interop.dll.dll 1.7MB
-
x86/BouncyCastle.Crypto.dll.dll 3.2MB
-
x86/BouncyCastle.Crypto.xml.xml 1.7MB
-
x86/SQLite.Interop.dll.dll 1.3MB
LICENSE
- SHA256 c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4
- MD5 86d3f3a95c324c9479bd8986968f4327
- SHA1 7df059597099bb7dcf25d2a9aedfaf4465f72d8d
- SHA512 dc6b68d13b8cf959644b935f1192b02c71aa7a5cf653bd43b4480fa89eec8d4d3f16a2278ec8c3b40ab1fdb233b3173a78fd83590d6f739e0c9e8ff56c282557
- SSDEEP 192:fU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:M9vlKM1zJlFvmNz5VrlkTS07Ht
- TLSH T12432623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/CMap/Identity-H
- SHA256 aae946bc17203b5df12838d07ae5cafc9e85a1d42d1b94d8475ab2d42b77a5cb
- MD5 40f5dc1383e3e8f870ed8f763ed51878
- SHA1 474a429de3b9feba36cfa4ce4edcd4fae3cddc5b
- SHA512 69b6d3af2ccaae9437fe4e0206c44d29ec7a51f39334826737907e1126505071ba888f4134de55a07cf14256b47daf6d29cc73bab60f3c6cd7d8bb30e24778fb
- SSDEEP 192:QJeSrsQrsil/3gU+uSpo4cvkikNwA+KZwOyKXuU8fy:QJhrsQrsWPsu+oVkEKZnNz8fy
- TLSH T1C002EEF24D2C5E4155EFF283E4504C87C279E1BC28C7168EB7A8DB32AF87299685F091
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/CMap/Identity-V
- SHA256 7483db44e4449a7ae232b30d6cba0d8746592757d0e91be82ec45b646c608807
- MD5 b5084cbf0ab0c3deac97e06cd3cb2ecc
- SHA1 c32458cda1951cecffb69aa2f7e3a1ea8bf36251
- SHA512 b15f65a2ab21121a4b815932a7e2dcafcf27f458bce532ae46bbcbd6b1134153027bf3e138fab42457a89bc892256b4796bbb9f1e3a85f9f4c5202015b56e3a5
- TLSH T1F451EAD20D6E066A03B1F7D7E110DD40E2BCB0086D2356CAF6DDAB3942AB31D996D4E6
- MD5 SHA1 SHA512 TLSH
Resource/CMap/UCS2-GBK-EUC
- SHA256 66cdcaed3aa94525c59a82a39a93b96885883bffadea1e572464d559d21443a6
- MD5 fb9d6cd4449ec7478ee8ad1bd7465bf5
- SHA1 3d42495890e0f2acc6b564eaa79fe020fdd2fc79
- SHA512 259467113cda70ba8d399e233bef8a718f76bc6b977ac54c216bd53796a8003e7a7276031388e282f1f4430fc2fcd269b06341f2082a9442a65bbccdeb767eb1
- SSDEEP 6144:JAYrjXraHOiu06s7SSC2RGaC4J7G27r7Sbtg2j35GEE9:JAYrj7aHOip6rShXC4J7G27r7Sbtg2j0
- TLSH T1403434DB40360DC8E60B68F840247DBA9B0CD5B6170DD13B66E87217D6EFD3A6092EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/CMap/UniKS-UTF16-H
- SHA256 ab87d320c81e4c761b7a4cbd342e212db4ebe169b5d10848f2f57d828874e342
- MD5 f65c06189a55139e13885d9716bfe35c
- SHA1 394285fed905d0f4c2c21230da50626b0a31a037
- SHA512 caf07d2623861f60d79acfb313978b89f9cd8feea0bed0fe28d25286d197b62b9ef9a41130586d731dc43aeae817eaaa87c9cac31d9bd1fdb82591146e0fa2cb
- SSDEEP 3072:EbOks6xITS4gmLJpAEhFDDvBB4TS+JjXsc:jjTvIN3
- TLSH T1E3D312BA842CBD841946D8B759201ED3629AE7BC210E8347E378F972FB5B13D3D87950
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/CMap/UniKS-UTF16-V
- SHA256 7e403dae40df21fe3f9b221f7ce750f7f5bff9cc73d82d011c4bcc48a0db60ed
- MD5 aba47550affb435a1dcc6b70efab5b52
- SHA1 754168e2c3b58fcfcb57b3ecf5ca5eebddfa1f47
- SHA512 d46537b67ef7137fc0b715e43f23322dd1189db352235a4a5ad89cb6af3d3fecaa51c1c93dcea2a7e8fb8d25b18c3b0f2ab2f23df7a5a76126a47389ffac00b2
- TLSH T14461F0E24C2E0A6A1270E3D7E000DD40F2BDF0186C1396CAF6EDAB75676731D592E4E6
- MD5 SHA1 SHA512 TLSH
Resource/Font/AdobePIStd.otf
- SHA256 5dbc496c0b5a12d9f9ffdb83a46b9fcda8d1fc1fcd50832c783be5e9277a698e
- MD5 8653bfe4c32a8528e981748e28c59570
- SHA1 dec8dd8cba986f5852286c8b8e45c6270aeab65a
- SHA512 66e39798ca8bba9af51f44e81b77ac1703f488b6361bfb05de632fbb2726e5f1291f0210be0fc933459bea78fa433177b33e34be977c079c97c5330d6590e7fb
- SSDEEP 1536:PmsMC/asb+Q+fGZNbDvdtlT9Mnlx643McbQqc80U0zy26RR38e8kscXqHZ3MD4ea:BMjlINbrdFMnP6hcbQq8Bn6IPksF8E
- TLSH T18983E1F48B2B0388D285A131457F5828776369999BFFF39FE19C0B11A89BF0F9515702
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/CourierStd-Bold.otf
- SHA256 a3c25f2ec60f8d44f150cd4e478067b06cc7267fbaaf844da600ce1c31c6e5c1
- MD5 404952ec4d0ae00dd2f58fb980a99326
- SHA1 2dfa0796be958109d1558b771c3c8c77049a3945
- SHA512 e9f60c1536663b11a8d262a49bd92b80bc619e26408464350a122b4cfa149900da754c78ea7e84a314f4c914497005409cc83dc8b5f55d725bba1bd5acb2ce89
- SSDEEP 768:UYJufmmvVJkJ7pFIJRUQXzUKOXBdbOIYvQXGPgfJVXhU:UYJu+mvPg9eYCzUKOXBdqIWQX4gfVU
- TLSH T136D2C016B763B041F626AD7497E317071B71B3A25E29EB2F8D0D87604CE109C8935FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/CourierStd-BoldOblique.otf
- SHA256 698fd9169ad62bd6faedd1c8e8637abc9cc65b3b1a5ba8698242b1447303fbee
- MD5 6804e7413898972e05823add91b1dfc5
- SHA1 4dfc3cecd9d3c26afaca087a69376eb6abfedeaf
- SHA512 f89a494aa7dae22022cb4bddf911c9fb8f40220c5d49bba79e5b7f97191fcc2740088437d3e56e6903e0b10aaf5535b4ce08dbe793a0e800d23038196ebf5fc6
- SSDEEP 768:edluzc2NPniJMT9BvYsWShVcbZks6AnkXhUZxX:edluz3piJMpusWShVcbZkfAnk2Z1
- TLSH T1A5E2D055732A9080F402AB78429A07179B33E3967E5DBF6FD50E67A14CE12DC897A30B
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/CourierStd-Oblique.otf
- SHA256 c54815a2729d633e400a6835679613090c20b91da6cb40fa761aaa475efb77f5
- MD5 71ec484296a30c9379607e36158ca809
- SHA1 6dba5afa525bfb38b653e30492d59d839dc7a0c9
- SHA512 0a53ed3ebd858d093cdfc2b2acc104453c6e211416ae24a93c2a77feb3c7a5af8e2a27ca367194f8a6d7294cf36bec84a3b0c6af1ccb8047d9b0c72622a9c8df
- SSDEEP 768:jhDq/ufETG+B8jqsYTvBTOYDjcXfwMXY6TnP1xaH9UzGb4dmA:jk/uf3YTpIPzo6TtxY9UzGb6
- TLSH T182E2C054AB23EE38F6130F34CBA1433E66327B846D6BE18AC6585AB20CD21444DB7367
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/CourierStd.otf
- SHA256 54cb5c8e9775cb432afe32b0af688536354ad04ef9c9f1450ee7c88a73bc884d
- MD5 f4c2d3851e2781b2b3ff60a2e34e81ac
- SHA1 779f9fee6d37c37a03601ec1ab406d055e8e7692
- SHA512 218cf55522d6edd88ad92acaa6d440f0f7ff2a0688948a834ef21eff7ca6a915622723720dae234e412e788ee7b722261b1a238a12d05c7f63f24d854fdad43d
- SSDEEP 768:px0Kx7uekYqrdC/MNVO6MFsSStwPHMjz9Qc3:j3RuexqrdGYmJStYHmz913
- TLSH T174D2B042BB7BEB34F2660A7345B207727331FF147C69C77FC11CA4A509A1184486ABA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/MinionPro-Bold.otf
- SHA256 6af523a01b268ddaab5177e6c0df5024f7192d72b0b1ca9523721fbaa2aa9257
- MD5 b3870be83f40b14cb382bd498920a137
- SHA1 08b27bce2db468785348f42e39b2e80d9107fb1a
- SHA512 0979d123ba7d84b564aa0f018ae49ed7a2c4610882e574547abade7abd2e743630ccc82dfe95c3fbe963731e33df5d34c2e307fd28a2e7670e2aacbe3b87f70e
- SSDEEP 6144:3z2HDNf6XZFWrRBPt2a+C5vDgtTBbhRRkBPgdG:3zaNWZFyBPONbhXkBPOG
- TLSH T1D724CFD03342A3D6C2844B7E1994D72B7316B6C8BF0AD31AE470B6917EF8DB01F5466A
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/MinionPro-BoldIt.otf
- SHA256 beb1ca56f9b4f89fb1549fe63a4bc578d2bd8747f967c1df26dacd3ded3f0223
- MD5 a7487befbf3c7ba8c957d269d9ba24e1
- SHA1 75063a3db5e857b5565fe8ac9ceca74440cf2ef2
- SHA512 1694a64790aeac2d789c75a2c664a62d19c3a487730bd368e2c76a78852046e94a158467dbed26783f8eb1c17e0d76e2c3150f6ec82131cc2bbb385ef931c1cd
- SSDEEP 6144:tj64FsxSslGgShJ2rgoyGgg4sB+73Lc8n+zYBYg:R6MsxS5rxglmOg
- TLSH T1C834CEB93A178BD5C58058385975EF392398B086FF4BC324F19672A0ADFD5382B790C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/MinionPro-It.otf
- SHA256 90def22f2b7b3e4aa78a160084a7a2c8f28883b700abaedc004dc74cbc2d9b4c
- MD5 45e2315e99f24ab596f9d3aed29a0fc3
- SHA1 a73342db05275c6858984f25c0d1278e93bfbee9
- SHA512 1d479beda9f70055b0596e18d9f41dace4141defb3ba9d01f21c0262e889fe37b7d9f3558b37e7716196de5c2aa7668bb8b115a5bf4540763239f22a4d530cf9
- SSDEEP 6144:H5Pf8kkiiO4vviV+eehOtHU5VLO+++A3++awYHt:H5n8qrIthf5VU2Ht
- TLSH T12B34D0683363B38ACA0005341570FFF47356B2EABC53CB21F19972A0BE7D6741AA95D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/MinionPro-Regular.otf
- SHA256 327cb2238a82a89176ff6601139cbd0a5cdd8f8e1e057343eae13fa9b1e10ab8
- MD5 a4ea2690cfd854b24c968ac6cdce9c33
- SHA1 efc3bc793479df1a34d76c42063997ad0e73c6b6
- SHA512 f722b32c397179b25e33b88771cb588c6f23a615533e3dcb21b34052e2930f935dab58b7ee5a3098912a41e6266b5f26b86602cf57bff41917d634e55a86c52e
- SSDEEP 3072:kP2Ea79vZp3MeJymLbVQbKH3L9jLU2jRM5eUlVsXGUPHTfeoAL3sBgL/4tHRkBDB:kP2h76QRMUoVsXdwsBw/kxkBgW
- TLSH T13C24D0A63B411BC6C529553E0BA5DB38B361F2873E039765E0B072ECBA7E7702D5C41A
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/MyriadPro-Bold.otf
- SHA256 2d09971801f2c18fc5a825379404113db237866073ab463a9bf0f3da8c62459a
- MD5 e6d1585e6c81e3206948d8548d914fec
- SHA1 4bfa4d5ad9995bd89e2d443009e4ffb728a1f74b
- SHA512 058cf93ea2be4e98e752a4090f295e00bad37b7db9d4461cf7484409af5087853653fd82aa7475a85950b48367a1d9168cc8983791b78dabeb8af4f84397a264
- SSDEEP 1536:ruMpOn479vZp3MeJymLbVQbZg8Lm52cqU5mJm2Tg9gHsF+JSqyi+GGGCRqBtUwah:CU179vZp3MeJymLbVQbZ3CrqUwJmStEh
- TLSH T1C193C045B7DA5F28C2109D3D1E96D3302335F489CE16C319FA9CA1603DE75502EDABE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/MyriadPro-BoldIt.otf
- SHA256 7bcfa54cb8fb5b64dfe36f411d5265f7f71dc6f3b685c7ed0eb3753ee194bb45
- MD5 01e3d8472c3cbc43799fed290b0dc219
- SHA1 916a7e55b47d079e0bf0e3fea9ef8f48af3d53c4
- SHA512 e70a72670e5267582bd652abc73de091d8978856b757001c7b5efcc110a331b45ee0334c5864685c3054b627e0c750a050396842ed66c43a8b43aa33e6342b1c
- SSDEEP 1536:fpMBiTX79vZp3MeJymLbVQbaRRQQmzcJfttExKBUBq8YRfyraMvxvxM+RP/YxTRV:hA879vZp3MeJymLbVQbaRRQzzcJfttEo
- TLSH T18E93CF66BB037B08D6418C354F93D360331AF0089D1BC719FADEEA70ADE31A41BA5766
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/MyriadPro-It.otf
- SHA256 f234adafb66ad5e47a024ff4881c2edc347d0453c15e811288ef10eb573cc33e
- MD5 4413059068c27d82ad49621ae4aaeb5b
- SHA1 ca0e2f5ce7303031e1b97f6eb3402e45e3786a3b
- SHA512 5f68440fb0fe825a3742bdeb5ea089bb124d878de7cea74ab3270b888125f66d3e0ec62d562bceea194dc68ce9a40ea1bef5d5980ce7ea207d91f04a20298412
- SSDEEP 1536:E5Mgi/379vZp3MeJymLbVQbnbkVGcjf0DoEgNT8QcZaQwHhFzeKuvGujl2u1X2Y2:AFi79vZp3MeJymLbVQbnqVjf1EAXcN0D
- TLSH T1A393D05777A6AB15D1428D3D5F12C320B366F50CDE16CB04F9AEE4E07EDE1E02A95360
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/MyriadPro-Regular.otf
- SHA256 c812279db1ed52876e3b59791645424cb4714cb710f60da45f1b40757c3263e3
- MD5 1aed3bcf1b764f4ac6d9b988b0e724c0
- SHA1 6e149809ff93e683307ab3154fdd57eb24c5e9a3
- SHA512 8fb3591513bee4d9c77eb6380d9f05e7e423434bf667759765d14ce8cdc89d969230516f271b28f508ba5fba0e21b7623239e16c02599fa36b0900d199805bc4
- SSDEEP 1536:SVM7Ouk79vZp3MeJymLbVQb2RG4m1Gnb0LBaJx1llp8PUUNMF7BM7omdoZNaDq5i:2QK79vZp3MeJymLbVQbtf1GRxH8sUN20
- TLSH T19993D04ABB52978DE9148F384F92C3343375F80C4F22C71EF5AC9964AC9A1643F45AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/Pfm/SY______.PFM
- SHA256 035af7591938139c78f8ad715047c16cd439c6a7791035deec013439921e6925
- MD5 692b5b1be7394e93fd6e0750cae81474
- SHA1 208ceb86c2dde35c78fb40ac0f2573f4e4ff499c
- SHA512 9b7ef79d488361bd1e94072b4fdaf17854881e673dc4a2981c31a65a185de987ec6c605753e1a645e74acd9fb030cfd81f5f0bb81661b3c43dfaa5ef46e0caeb
- TLSH T1C40122F1043BBF9AD21EB03CA940B04559A805DDC99DD272EDBCC9F9729391422A0E08
- MD5 SHA1 SHA512 TLSH
Resource/Font/Pfm/zx______.pfm
- SHA256 b3e66a48a576f1d90277aefb89af9cfd370e7c216978234bfe66b6ab6fa2c0fd
- MD5 705cd85804c3dc1eef81b624ea813bfb
- SHA1 5d5807713d14f45b9e5bce0576ade157bad5a701
- SHA512 dbbf44d7fc2087e5318fca440eb4c0396a9166aab64de31a901c0fe3c049a5577c021e43406e611d9eada020233c1ba008db46026f5a88d5c26c25125fae46ba
- TLSH T1A5012DB72C358664E091043FA190C40A2F16324C078EEC23E40E8DCCFA6BF45222876F
- MD5 SHA1 SHA512 TLSH
Resource/Font/Pfm/zy______.pfm
- SHA256 1a5660f3f8bb9d18fd6a710d70af26cf1e167fe040d7daf3ce41e527236e1fec
- MD5 7d3be2ec810fa01a9ea7d2a26551cff7
- SHA1 7962465ce36a83666fe7a3edcb31e125ed597e93
- SHA512 cd4ba616364f37aa8294c9a2a6b64ed3cf0b011cfcffa9056295b5fc23348c2b3cfa96a25954c6dc472053daa1f9f4b08176a515c95abab6ffd7077deb8d7959
- TLSH T13901993C77BA4159C1334FB4D3A18A5424649B4D324ADCE1B808DE9460D0AC0DE78363
- MD5 SHA1 SHA512 TLSH
Resource/Font/SY______.PFB
- SHA256 b0480c6f9cee6bb87c1ae159a89a8a9d1ffa46e0ab70461fdf2fc291e2c94b4a
- MD5 6fd0724d1fee177adad6a13c65af5268
- SHA1 6efe2355d68306e2d5083895ced81002f7934ebc
- SHA512 61185eafc64bf732a07add78ff6cf1ba3d0c988b64097f376018e5e710e35840a2556523ae6634c27ce45e47ffbdf36778452ccb3fa1f015dbcb02689f1e1797
- SSDEEP 768:2igXv39LX995GGTC4/HrcgXB7qtyiq/wX7RUzKR5tn:2dXv3JAGTC4DdHiAwlUzKR7n
- TLSH T1CDF2BF94D94B2107C42278CBE9C5F36898FBF1B597C19DDFE3840E582C9148426FABD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/ZX______.PFB
- SHA256 ba8f3996fad32c042bf1f474a08b7452f252060882dc4de5a97ec389209e2301
- MD5 5eb6497ffaa36909f6b2a824054bd4d9
- SHA1 cc04c0ccad1e9c10552f1ab7fac45b0b529de299
- SHA512 dd7a1b26dd041266404d86d6616c765eedbfc71460cbcf15fcc02de1704ae7e2892b25b6134017621f470768d4eb4a64010ec7ffec459d0c669f107c66841caa
- SSDEEP 1536:TGYo+k47OpUT9E64XnuCibOb9z6DU40fbmbZUHs:I47Opy9EBXVbVsUnTmbZR
- TLSH T18773F1E3914B212BE44424BAB842BBAE417F703596C8CDD7DEA1ED74104988663FDBD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/Font/ZY______.PFB
- SHA256 1182fcc2fb887713fb954a804f83fae3417c27b6929ecb07c5034dac24586e8b
- MD5 72abd7f6b6b7e6f2ccb06626aa8b46f1
- SHA1 f9cc5efb748f4068aa08290ee58aa41f8bd4bb81
- SHA512 d34a8d9fac3efea7504f87b203c9074f7589cc726fce0b23132eb14d75d2f9a5d67c13952f0f1fce02fa44b786bdd17828c355471bd974b8d78a29abfc8c7823
- SSDEEP 1536:SnSFGnyhqkcpFyFmkscxLFNv2FRle4Y/p+Nsz8Rc1wNbsGvStIjQIRiCt6b7VkV/:ESFSiqJKskP2FurRjp1cVvRj2j6/YhM
- TLSH T1A39301A31155346FEC56487CE9437AEA223BB9F17BEAA6C44C95AE4140C82057BFC7C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/SaslPrep/SaslPrepProfile_norm_bidi.spp
- SHA256 f2501579fc7ab062324b4e1a45428f69f9a37e0363a4fc1d3734157b587b92e1
- MD5 787dcae108ef9d5fcd9f60ce6387e7b1
- SHA1 83a906239423183910e617273d6023c534e47e5c
- SHA512 c65d3bc01406054d9932e2c840980978a5be4bed7bf8dd60a063304017f0d8b8618d7e7688b365110976822896256cb98ed6ce40c2b6032e0d06637d73c8e283
- SSDEEP 24:j2Lc2SuJAoYYY6JB/BsSh7F3eQfWiLLN+LEEEEEEEEEEEEEEEEEEEEEEEEEEEEp:2c29CoX5JBNhCiLx+l
- TLSH T1A0526B16E89F59E6E29B057188E3FBF5EA662C5C8D3EA41FB8C03B1B614FC052D011D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/ICU/icudt26l.dat
- SHA256 b388595d6e96e51430bec6022b1a5635ca541e60936abd73342ae8319dfe6802
- MD5 525de57b8d1167a4efb7eb00c013354f
- SHA1 3f1ac2d2b6807c3ed2fc41351262712b72fad749
- SHA512 dfd950d1220f46bf5f75c4130902bb63a4447c435d25386461a4e4653e73dc6780577fb51b14b182a1f2b1a38585914237625b199d806b6f80f9becc64eeff32
- SSDEEP 3072:C5em1am14oBR+pa3sHxW5D+eXHdsdj5xkq7KV2Sq71c64ZAr3Abyc7dAzATXcErQ:CR1R/UFTSO1TPcaMm
- TLSH T1CE24706377933C69E9AAC53161A737393F26200A9341CD462CEDDC8674BF29D22D49CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Adobe/symbol.txt
- SHA256 52dbabcdebe38f3e19e9071d6796fe49f1463f03d2d82064aab4a10bfbd4dddf
- MD5 31d752fa13b4d1fc7b7b4747a3f6d3f9
- SHA1 eaafd280b2ea187f078674b9a1d5a8206ccf4a13
- SHA512 ed402d201b19c9edeeefa17d2f82a480b8d16ce3235668a91bdd0e6f3b59cbb55bc7119a272c34d1c4e88999b6fe08697d65d65e7b4de44c197e57f2ff44f079
- SSDEEP 192:sRDIlhfxjh5/q7Wr6KyfyHnW9WSQftm15VkCnl2moTTEmbZ3mrZWlBAjnBmnVRn8:sVCx27WuKy0W9WDlSVPlwd3C/BCVBFyB
- TLSH T17D227348F78715D12376C5E342AF92E8F70E0261A939E441782FF3D5137153BAA369CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Adobe/zdingbat.txt
- SHA256 e7651bcf12532af30c79c499e7a280ccbcd7f208436999a21b1500b07149bc95
- MD5 691886379048a5f9065ee903757af29b
- SHA1 9f6453e6f027e771602ad98c5379eaa2b2469463
- SHA512 e2934bd4f36cc21e1d71c4fcfc3c31d091a54f04762b0cf7b20fd6bf70ce30fd209a406020c82c565005bc0677471eb524b5a537059e29e4231955fc9307216c
- SSDEEP 192:IcRDIlhXomP1RueMV1tQdS6t0Ftjzt8CFrMbyaYQgtrtXiPIn:IcV+ombupV1mdS5SC+20I
- TLSH T13A42B53C5B43D8B0C212C72740ED99D073EAD599B63460E5642F9B0172AFD6AF3629EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/CENTEURO.TXT
- SHA256 ae8fdf0311fe249ee1a3e08fe36c394ca2da791c622b665ddebcb623ac248903
- MD5 3ea4a9a2765040c721374ccbb8e7bd59
- SHA1 bae4c79a9e9c27cbb7308bb364f69566387cce45
- SHA512 1a86665a081c73d170ac6ba9a3abfbedecd71557b274d99e254a446e852e6c62cc0bf383eeafbfc1722f63af65b4e4bc73f9e0ebc6fd790317b08ffd488be289
- SSDEEP 192:X1ei8BsiHo6ZD5OSlEZGWRBnBb7ec56ZXj3nZv0CU8+zLtVoeuq/W+vsAfzMUMQi:FeDsiV4SlTWRRBb7e6b6D
- TLSH T1014223706E822C14A33D9E6C4A9B37C4D2C811C31CA5EA6B7C0F52D65334E69AB38DD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/CORPCHAR.TXT
- SHA256 83246b8c942cbacf1031445a99e62acbb4733ef4167bebfba2bd852869824eab
- MD5 0fbad8e1c335ac42617936aa6f89ec89
- SHA1 02ba453abfbe24b25c35a2d75c6134714b3d7d43
- SHA512 ab9e0bb4cae4c72cbccf7d061f1f181dc86277e8e59424802422c6641bec864d3e87b2261d56cb7991e3f60c5c6f56a814073f7d180745b8499c05c39f93842a
- SSDEEP 384:+aT8iQfVsEByru8n1ePc1RJ1lX1HEvSZ3:dIqEc/X1kvSZ3
- TLSH T142820535AA4A1A0D0B723AE4281FF096D53C906663D79DC3B39C73CAF39DDB40079699
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/CROATIAN.TXT
- SHA256 f353d83def5c9632ffd1925a0f1480e3dc0e00c096aff5680e448cbfd97fad05
- MD5 5c36e2cba7fdd612c575d50974ef708a
- SHA1 b7a92b10de26a0e23434152694302e4867b011dc
- SHA512 9a2a71bf2de141f7e0a295ad40824e63b7b18f1d530d90b5edeec78dd23eaab733d40f95ec320ee2c7686a113bee58fb92d48875d347c669c4c82f9ac27af76e
- SSDEEP 192:xO1i8BsiHo9EB0QguBwjEZGWRBnBb7ec56ZcjVNs0sDTZLzPF5Ofzwswsc3ATpGE:A1Dsi1BwjTWRRBb7e6vY9PspP
- TLSH T1A4528AB07E821854E37EDEA81A6F37C0D29D15C71DA1E95A3C0E92C15334B25AB38DE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/CYRILLIC.TXT
- SHA256 10738cd5bba3b23c02d3655bf2afdf72daeaaef778cda562c6d10ae8d25ca591
- MD5 db4ed5c205fddd693dc9ce69cccad036
- SHA1 ffae0be88d51d71fb1e496156564e55f874efad9
- SHA512 0402d575c17d03e7af8bf44f36ead7d4ccd283375b65d94597ed927a3975d5427483c681a2c604b6f61d796e9c92868620594b7661de6321920c23a6ba281c96
- SSDEEP 192:BWDRi8BsiHopYZXC4JqANEZGWRBnBb7ec56ZmuZ6VfDjCfzB+CXp1:kDRDsiZZXC4qWTWRRBb7e6/o6NIXD
- TLSH T12C5277A47E805810F3699F343A2FBAD4D18D15830C99BA493C1E81DB537867ABB3D8D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/GREEK.TXT
- SHA256 1ce082e86367551b2a21465d1b1c2edc103242f7d565411dcea0762e3dd63aa1
- MD5 962d73ae58ea74dfa492bda68064f130
- SHA1 b3ecd08894988a66c190ab75b88c3cc752aba34f
- SHA512 5c3c8ee79c6714097b58276905f2532b1d8be07fbe8db129624f130bd6622bba604393673d2932a08df79eea83caeaf2ce157893ede76bef6fc1027573ea8592
- SSDEEP 192:mHQSi8BsiHoGHUdfJt8skBEZGWRBnBb7ec56ZSj2z0sVRQvWJ9mfzDmb+mtGf0D:yhDsiydb8siTWRRBb7e6qvVCe8X2
- TLSH T1345289607E831910F37DDEA9069F32C4E29D11C30CE0E9563C1F91C25371A2AAB799EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/ICELAND.TXT
- SHA256 e04b3c96f65a27030b5e4b071d8e61b8ede1d94cf7bf7845262b29be2b7656ac
- MD5 48f0f1332aca28076f1d479d8a1c0447
- SHA1 e19b21754d221f5fa53aecfb01b2578d9974f35d
- SHA512 7360aab0683f102420e850e5b0ca7e366f605aec7a3be4305dc0fb27270209a006dc5ae1a28f68a7c4241bd1a674a215ce9c197e25aa3e18744691c1b987abe6
- SSDEEP 192:496i8BsiHo4wg68wkw3EZGWRBnBb7ec56ZcjVNs0sDTZLF8GYpfzIiB7Ubc3jTpM:66Dsi61kw3TWRRBb7e6vYMGPaO
- TLSH T1C0529B707E821960E37DDE680AAF37C0E29D15C31CA1E95A3C0E52C15374B69EB399E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/ROMAN.TXT
- SHA256 a58f56f7cf7767658cff9fdfd1ba182cc74a513b3a2b6f34e44625ff811f53dd
- MD5 94a43862cb0159469484841d8370e552
- SHA1 45afc896bb3ef65a7c77550244a52e7212de89ad
- SHA512 eb6454659fd8cb0a631875e27bba01023eb3c75740379c2deb514bc08577221a7914f2717f141134aebc596cb4b34a523548a50f3448abede2b87b4ccfcb93d5
- SSDEEP 192:5iQi8BsiHo/F876g2pSSwpEZGWRBnBb7ec56ZcjVNs0sDTZLzGYpfzwUbc3jTpGN:VDsi88PSwpTWRRBb7e6vY9GcaO
- TLSH T1C852CBB07E821850E23EDEA81A6F37C0D29D15C31DA1ED5A3C1E52C55334B29EB389E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/ROMANIAN.TXT
- SHA256 ff13110e8b448b033f464184a1a07b4cd32f0f0fea203a4401c284073fffad66
- MD5 d39f6c0a8cfe6f118ffd105cf44dea90
- SHA1 6c0ae83fd83e5b1af2d288b149e0f7907dd378cc
- SHA512 75a42575a542e95a9736deac09fe5480a52d514d9b09c2542a9bf7af1de104a3f83b29bf0c317b4d593d572bc1548728f2fb68115ab1506c5784528ae33710ed
- SSDEEP 192:boRi8BsiHo/rUgyxUHwsEZGWRBnBb7ec56ZcjVNs0sDTZLzDvXYpfzTUbc3jTpGN:sRDsifxUHwsTWRRBb7e6vY9rhaO
- TLSH T17362CD707E821864E37E9E680AAF77C0D29D15D72CA1ED5A3C1E42C15334B25AB38DE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/SYMBOL.TXT
- SHA256 c57c451d4a524159bf143573cd0568869c8eed814a999bff7f3e560dabd39f1d
- MD5 46485e1a024abc31e8b9d2b4ca9a3b39
- SHA1 57f5f3109969a8dd8e71e1e925dee37f2b61c016
- SHA512 fbaff075b556b461ba6dd731ec52dfe9d3a2be202995e8da1d4794aedb812652a198ffcdaa0052c95fa57f94edb5d51342b1a38e10f62a7ca506c41b759195e3
- SSDEEP 384:UDsinsKkRUJXEe3fLMxtASwgzWgfL3SR14oLLQQU0Kp9b:UY/wufLiR9LLQQUjp9b
- TLSH T1FB628250BF832660D377C016025FB0C0F35C616725E2A5593C5EA2C5237EBAA27BDADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/TURKISH.TXT
- SHA256 9ecde6f591caed9c2ce4438884da5f22e35fbdbb97e8d80b43129b23a6791891
- MD5 6bfac3d4ab3ac941a0b2a29a56de6f64
- SHA1 cdc38c3e0de96c3f2b50448cf3dcf42d52e7e243
- SHA512 1e2645df84c5392b09e85dac63970ba49dec9dee63c06548f7717fbfca2643646c1668202217ec836a663c4938fa45774d3c7a9a7254b926d75b0a32c90fd3ee
- SSDEEP 192:y7gi8BsiHoGV1zjbweEZGWRBnBb7ec56ZcjVNs0sDTZLzGYpfzRzUUbc3jTpGNlw:WgDsiX1zjbweTWRRBb7e6vY9Gka3
- TLSH T13E4279B07E821864E27D9E681AAF37C0D2DD15C31CA1E95A3C1E52C15374B29EB38DE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/Mac/UKRAINE.TXT
- SHA256 98dd24a56e7d0e2bd2fc6a8bf429aa7bd3820b0d2d90456b972914639d2278ed
- MD5 96431211151b2e58c23262cce683e033
- SHA1 ff90820ba88a249c4f8bb605d6f9d6cfcb896257
- SHA512 28dcd7c9e41cd378f88a14dafa5ae4cec291206feea3bae7a26c6f5681059ccbbf54a59c075a19f752e48658204c388b4495b707e7249f3622e827c24c83630b
- SSDEEP 96:OEyDE8TDyKJzAfa4evYBTY/qHoUbExiNU/qnTxFA:gD2i8BsiHobGHA
- TLSH T1C5913716AF426551A331C4C9522DE0F5E33AA6B72ED33B09349C528C23BE769433DDD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/win/CP1250.TXT
- SHA256 cf79ba755416ae5628a9dd1f870306b5a45fd6b256efed0c2ac1cc2ccb3307f0
- MD5 3c9476725fbfeeffb9f549d995ee2815
- SHA1 8e2502eb4fc5137ae6e776d1f1804a3afb6eae31
- SHA512 ff35c0a6a878c303567d957c0e465cd9bcd0678c1be3953b3438c686b4f739fb6f47a465465119b474d468d46b19397955e688fc2b92f71abbec276be072f5c8
- SSDEEP 192:a0LuVb+Mu1eIqY/tJVLTjbew68i/+raRKUWKfThEYh4AIhvDHFzxn62hxSAWUMuA:aV3+qw7VLTjbewlKfn+Qx
- TLSH T1481234B87DA22C54F26CAE740EE737C1D24C15C318E5E66A6E0F92D2A124D79AF34817
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/win/CP1251.TXT
- SHA256 f87ed4480cfddb8f5f6226292338ca407ccc7b1a543f3832f1d20aff6cb72a58
- MD5 2926366654dbc6711ee71ba2589161c3
- SHA1 455e6e5e78d03349454cb1c6b0175e9bf2b943ce
- SHA512 a9a69e32a16ecf7de291e4fa00c6cb349048ceb2f4070406c16b050439a4c2420a7da0f1fc9a0b76e21439b8deabcdd2085c3c14411a6032226c74274dd1e49b
- SSDEEP 192:3BHVb+Mu1eIqY/tJVLTjbew6a7ifHYhgjVJa66Oz9L:3v3+qw7VLTjbew/3GMOd
- TLSH T171127AE87E949814F32D6F302EEB7AD5914D14C90895FA543D0F42D390684BAFFB08A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/win/CP1252.TXT
- SHA256 fca3ab5882f0a562794f05d7f15a39157c59d7c07fcbac79ab7cf3d12c979541
- MD5 93fb108016f8a1e87e4129b21fe9984b
- SHA1 f6d6b1cac29fdffe774e5175cb60970ba373a656
- SHA512 e0679ddb288423557170c09bf6848d6d8d74f9e70bd751131db7bd248446606db856a86af7ac8e3500b2950261de199a5ede444d8bf451ee1ccc6cc854151342
- SSDEEP 192:YUsVb+Mu1eIqY/tJVLTjbew6SiNNzu6NSCYyhrt0K5n9dWGufxvH+Gv:Y93+qw7VLTjbewtUSLO+RV
- TLSH T11C126AB87DA21C54F27D6E741EE73BC1D14D15C218E1E6A92E0F92C2A134979EB30D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/win/CP1253.TXT
- SHA256 2d36bec3e1ecbf2b6de8a37c98717ae21ca8c5bc0b487556996b3fff2b6f6fd9
- MD5 6b77baac03038b028948d2a667efdaa1
- SHA1 6afbc63ab3a2b0bf10cbe802f7633da3e3198417
- SHA512 d7541266b100ac879be8139108344121b10390350b93d26c6f5c5279c18503d7b6829332281a892369de4d578090987d1310201262c181addbc3b9d9495bd209
- SSDEEP 192:Nz9Vb+Mu1eIqY/tJVLTjbew6Si/0eTmVvZOzdTWb7D:Nr3+qw7VLTjbewGsB
- TLSH T1FC129EA4BD921814F3BCAE710FA732D4A15D15C128E4E6643D1FD2D2A27187AFF3192B
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/win/CP1254.TXT
- SHA256 32fa83c6f8ad346e66e544640942906e0a91cc0d2075324b7f244695de5740a5
- MD5 65d7c9205e1a1393b8530670add4e596
- SHA1 535cada91e5fba038e0fd9f2214f91a83c3be45d
- SHA512 95798f9e068a82380bdbdf649a2dd2f7cc72206444de0a7b9ab2de2cbd9938dc0856f2a0faeb29bcc965900448dfb0e7dddef0cc8e1c5711896f1b82d40a3ca1
- SSDEEP 192:uWKVb+Mu1eIqY/tJVLTjbew6SiNAH6NSCYyhrUJ0KXdWG0xvfxvHZ:ul3+qw7VLTjbewfUSL5y/D
- TLSH T185127AB87DA21C54F27D6E741EE73BC1D14D15C218E1E6A92E0F82C2A134979EB30D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/win/CP1257.TXT
- SHA256 7cb16a0b949f8573b06f22f091c44a1ea251cc9904591fceb2743475302c4640
- MD5 002134c7ea7f619246bbf445caad9f08
- SHA1 def97351b77ebf6210b6bfb69b8bc3a4f9a64c36
- SHA512 95e4620258b0189b993bb56f2219f73d84145bd8e5b45f9ad70899d8da0e742bb3ead8697e5335e4de895bed925f6212d96f813b0ce9383ae42a967cca2730ca
- SSDEEP 192:BPJVb+Mu1eIqY/tJVLTjbew68i/vgIey4tvPhSiY+21KBrNbxlv0:BT3+qw7VLTjbew9Wo77A
- TLSH T1221258B87DA22C54F67D6E740EE737D0D25C14C218E5A6697E0F82D2A224D7AEF30817
- MD5 SHA1 SHA512 SSDEEP TLSH
Resource/TypeSupport/Unicode/Mappings/win/CP1258.TXT
- SHA256 f53d0ffb7f3c8182794331cfdd2fbcf77ff6dbdb05b415c98cc8d6fc49dce2fb
- MD5 88e9b5216b90d0332bd2cd4fcee88a22
- SHA1 748ec8b8b4427f3b48b23b3b224c1cffea2dd169
- SHA512 9d5d6e0cf41e9054d3c9253cec0a482dd97e412794523e352c06d39666931b1d8291fef1c5bbef629eb7c1bb53d866fe2eb925cb314026bf027eaabb1208f0bb
- SSDEEP 192:Sy2Vb+Mu1eIqY/tJVLTjbew6SiNne6NSCYh3hDDEYx1W/nxKHK:S13+qw7VLTjbew/USLkfz
- TLSH T1091289B87DA21C54F27D6E741EE73BC1D15C15C218E1E6A93E0F92C2A134979EB3092B
- MD5 SHA1 SHA512 SSDEEP TLSH
SHFolder.dll
- IMPHASH d2fff14c18f4e8778408477f9b3defe6
- SHA256 13c479b1a4e2da092811ec64179eb12689eb1a5a4078c59eee890f1dfb90eb24
- MD5 1f0cbb7b7644967660993411af8baaa3
- SHA1 c5a9f5c356db9f8a923ff1083603234911ebbc98
- SHA512 9315c8b63e7d063ae88e5ba27d3de09b33134cf4e0fb8487d24797c64ec469afeabb4b4e3d338b4914ad1de6808f5f86b36e49e5b548864d49477fa188869f7a
- SSDEEP 96:p0nivWPdbUp2QD6kvLHwxeIJ4/hsc5TfdswPcKJVYGKEW8MWw0vEqH:jMDULT+4/hsupswPdJ2GXW8MW7EqH
- TLSH T134E2C84673758EA9F06257B9402B1A066E2571204BA346FF8330524B2DBABD4793DFF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
shfolder.pdb
msvcrt
__C_specific_handler
_XcptFilter
_initterm
malloc
free
_amsg_exit
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
shell32
SHGetFolderPathA
SHGetFolderPathW
SHGetFolderPathA
SHGetFolderPathW
Name
.text
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33136,
count=4, id=259, version=33136,
count=26, id=1, productName=Unmarked objects,
count=5, id=257, version=33136,
count=1, id=256, version=33136,
count=2, id=264, version=33136,
count=1, id=255, version=33136,
count=1, id=258, version=33136,
Setup.exe
- IMPHASH cd6bd29e5e200cee2f7763f04ee163f7
- SHA256 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39
- MD5 7dbe5a7928c4048d67413510bf15f3b2
- SHA1 a6737313438f77142c2ac7c878dd40a31341d52f
- SHA512 adf50f9432559b245c5029cbed4c91a8b0783078112a9f5985618ac6054b3f95e1c36b17fd4706c9e8eb01736205ca2e95d2c072e88f2fe7ffd5c6b3b1cff141
- SSDEEP 98304:zOPwW4aV15KImMX+wP4UzFmt2a+sBZp5Fre0x7ahqR:GwW4ad6MuwPlz8Lp5Fre0xzR
- TLSH T187B65C6F72A8C12AC16EC27EC1A78F50ED33B0B51736C2FF529052655F12AC49E7E660
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
79:97:1a:cc:27:53:a9:17:08:ba:f2:da:e4:cf:db:cb:a9:f0:58:f3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=1988665,CN=Antibody Software Limited,O=Antibody Software Limited,ST=Bay of Plenty,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a
Chains
Mar 22, 2026
SERIALNUMBER=1988665,CN=Antibody Software Limited,O=Antibody Software Limited,ST=Bay of Plenty,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=1988665,CN=Antibody Software Limited,O=Antibody Software Limited,ST=Bay of Plenty,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB
Serial Number
a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2025 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Subject
SERIALNUMBER=1988665,CN=Antibody Software Limited,O=Antibody Software Limited,ST=Bay of Plenty,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a
Serial Number
81:23:2f:e4:83:2f:5a:ea:c9:c6:de:08:bc:f7:8e:69
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 21, 2023 - Sep 20, 2026
Minor OS version
1
Major OS version
5
Entry point
7997648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mpr
WNetGetConnectionW
winmm
timeGetTime
oleacc
LresultFromObject
winspool.drv
DocumentPropertiesW
ClosePrinter
OpenPrinterW
GetDefaultPrinterW
EnumPrintersW
comdlg32
FindTextW
GetSaveFileNameW
GetOpenFileNameW
comctl32
ImageList_GetImageInfo
FlatSB_SetScrollInfo
InitCommonControls
ImageList_DragMove
ImageList_Destroy
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_Add
FlatSB_SetScrollProp
ImageList_GetDragImage
ImageList_Create
ImageList_EndDrag
ImageList_DrawEx
ImageList_SetImageCount
FlatSB_GetScrollPos
FlatSB_SetScrollPos
InitializeFlatSB
ImageList_Copy
FlatSB_GetScrollInfo
ImageList_Write
ImageList_DrawIndirect
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Replace
ImageList_SetDragCursorImage
ImageList_GetImageCount
ImageList_DragEnter
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Read
ImageList_DragLeave
ImageList_LoadImageW
ImageList_Draw
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetOverlayImage
shell32
SHBrowseForFolderW
DragAcceptFiles
ord18
SHGetFileInfoW
SHGetFileInfoA
ILCreateFromPathW
SHGetDesktopFolder
SHFileOperationW
SHFileOperationA
ShellExecuteW
SHMultiFileProperties
DragQueryFileW
SHGetSpecialFolderLocation
Shell_NotifyIconW
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteExA
ILGetSize
SHGetPathFromIDListW
SHGetDataFromIDListA
SHGetDataFromIDListW
DragFinish
SHGetMalloc
ILFree
ILClone
SHAppBarMessage
user32
CopyImage
MoveWindow
SetMenuItemInfoW
GetMenuItemInfoW
DefFrameProcW
CharToOemBuffW
GetDlgCtrlID
FrameRect
RegisterWindowMessageW
GetMenuStringW
FillRect
ClipCursor
SendMessageA
IsClipboardFormatAvailable
EnumWindows
ShowOwnedPopups
GetClassInfoExW
GetClassInfoW
GetScrollRange
SetActiveWindow
GetActiveWindow
DrawEdge
GetKeyboardLayoutList
LoadBitmapW
EnumChildWindows
GetScrollBarInfo
UnhookWindowsHookEx
SetCapture
GetCapture
CreatePopupMenu
LoadMenuW
ShowCaret
GetMenuItemID
DestroyCaret
CharLowerBuffW
PostMessageW
IsZoomed
SetParent
DrawMenuBar
InvalidateRgn
GetClientRect
IsChild
IsIconic
CallNextHookEx
ShowWindow
SetForegroundWindow
GetWindowTextW
GetAsyncKeyState
IsDialogMessageW
DestroyWindow
RegisterClassW
EndMenu
CharNextW
GetFocus
GetDC
SetFocus
ReleaseDC
SetScrollRange
DrawTextW
PeekMessageA
MessageBeep
LockWindowUpdate
RemovePropW
AttachThreadInput
GetSubMenu
DestroyIcon
IsWindowVisible
PtInRect
DispatchMessageA
UnregisterClassW
GetTopWindow
SendMessageW
GetMessageTime
NotifyWinEvent
GetComboBoxInfo
GetWindowLongPtrW
SetWindowLongPtrW
CreateMenu
LoadStringW
CharLowerW
SetWindowRgn
SetWindowPos
GetMenuItemCount
GetSysColorBrush
GetWindowDC
DrawTextExW
CharLowerBuffA
EnumClipboardFormats
ScrollDC
GetScrollInfo
SetWindowTextW
GetMessageExtraInfo
GetSysColor
EnableScrollBar
TrackPopupMenu
DrawIconEx
GetClassNameW
GetMessagePos
GetIconInfo
SetScrollInfo
GetKeyNameTextW
GetDesktopWindow
SetCursorPos
GetCursorPos
SetMenu
GetMenuState
GetMenu
SetRect
GetKeyState
IsRectEmpty
ValidateRect
IsCharAlphaW
GetCursor
KillTimer
BeginDeferWindowPos
WaitMessage
TranslateMDISysAccel
GetWindowPlacement
GetClipboardFormatNameW
CreateIconIndirect
GetMenuItemRect
CreateWindowExW
GetDCEx
InsertMenuItemA
PeekMessageW
MonitorFromWindow
RegisterDeviceNotificationW
GetUpdateRect
MessageBoxA
SetTimer
AllowSetForegroundWindow
WindowFromPoint
BeginPaint
RegisterClipboardFormatW
MapVirtualKeyW
OffsetRect
IsWindowUnicode
DispatchMessageW
TrackPopupMenuEx
CreateAcceleratorTableW
DefMDIChildProcW
GetSystemMenu
SetScrollPos
GetScrollPos
InflateRect
DrawFocusRect
ReleaseCapture
LoadCursorW
ScrollWindow
GetLastActivePopup
GetCursorInfo
GetSystemMetrics
CharUpperBuffW
SetClassLongPtrW
GetClassLongPtrW
ClientToScreen
SetClipboardData
GetClipboardData
SetWindowPlacement
GetMonitorInfoW
CheckMenuItem
CharUpperW
DefWindowProcW
GetForegroundWindow
ToAscii
EnableWindow
GetWindowThreadProcessId
RedrawWindow
EndPaint
MsgWaitForMultipleObjectsEx
LoadKeyboardLayoutW
GetMenuItemInfoA
ActivateKeyboardLayout
GetParent
CreateCaret
MonitorFromRect
InsertMenuItemW
GetPropW
MessageBoxW
SetPropW
UpdateWindow
MsgWaitForMultipleObjects
DestroyMenu
SetWindowsHookExW
EmptyClipboard
GetDlgItem
AdjustWindowRectEx
IsWindow
DrawIcon
EnumThreadWindows
InvalidateRect
SetKeyboardState
GetKeyboardState
ScreenToClient
DrawFrameControl
IsCharAlphaNumericW
BringWindowToTop
SetCursor
CreateIcon
RemoveMenu
SubtractRect
GetKeyboardLayoutNameW
OpenClipboard
TranslateMessage
MapWindowPoints
EnumDisplayMonitors
CallWindowProcW
CountClipboardFormats
CloseClipboard
DestroyCursor
CharUpperBuffA
CopyIcon
PostQuitMessage
ShowScrollBar
EnableMenuItem
DeferWindowPos
HideCaret
EndDeferWindowPos
FindWindowExW
MonitorFromPoint
LoadIconW
SystemParametersInfoW
GetWindow
GetWindowRect
InsertMenuW
IsWindowEnabled
IsDialogMessageA
GetMenuDefaultItem
FindWindowW
DeleteMenu
GetKeyboardLayout
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
oleaut32
SafeArrayPutElement
GetErrorInfo
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
GetActiveObject
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopyInd
VariantChangeType
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
advapi32
RegSetValueExW
RegSetValueExA
RegConnectRegistryW
RegEnumKeyW
RegCreateKeyW
GetUserNameW
RegQueryInfoKeyW
RegUnLoadKeyW
RegSaveKeyW
RegOpenKeyW
RegReplaceKeyW
GetTokenInformation
RegCreateKeyExW
RegLoadKeyW
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyExA
RegOpenKeyExW
OpenProcessToken
RegDeleteValueW
RegFlushKey
RegQueryValueExA
RegQueryValueExW
RegEnumValueW
ConvertSidToStringSidW
RegCloseKey
RegRestoreKeyW
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpWriteData
WinHttpSetCredentials
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSendRequest
WinHttpQueryOption
kernel32
GetFileType
RtlUnwindEx
QueryDosDeviceW
GetACP
GetStringTypeExW
CloseHandle
LocalFree
GetCurrentProcessId
SizeofResource
VirtualProtect
ReadProcessMemory
TerminateThread
QueryPerformanceFrequency
IsDebuggerPresent
FindNextFileW
GetFullPathNameW
VirtualFree
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
GlobalSize
WriteProcessMemory
RtlUnwind
GetCPInfo
EnumSystemLocalesW
GetStdHandle
GetTimeZoneInformation
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
GetModuleHandleW
FreeLibrary
TryEnterCriticalSection
HeapDestroy
FileTimeToDosDateTime
ReadFile
GetUserDefaultLCID
GetDiskFreeSpaceA
FindFirstFileA
GetLastError
GetModuleFileNameW
SetLastError
GlobalAlloc
GlobalUnlock
FindResourceW
OpenMutexW
lstrlenA
CreateThread
CompareStringW
CopyFileW
lstrcpyA
MapViewOfFile
CreateMutexW
LoadLibraryA
GetVolumeInformationW
ResetEvent
MulDiv
CreateFileA
FreeResource
GetDriveTypeW
GetVersion
RaiseException
GlobalAddAtomW
FormatMessageW
OpenProcess
SwitchToThread
GetExitCodeThread
ReadDirectoryChangesW
OutputDebugStringW
GetCurrentThread
GetFileAttributesExW
IsBadReadPtr
LockResource
LoadLibraryExW
FileTimeToSystemTime
GetShortPathNameW
GetCurrentThreadId
MoveFileExW
UnhandledExceptionFilter
GlobalFindAtomW
VirtualQuery
GlobalFree
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
ReleaseMutex
GetStringTypeExA
LoadResource
SuspendThread
GetTickCount
WritePrivateProfileStringW
lstrcmpiA
FindNextFileA
GetFileSize
GlobalDeleteAtom
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
VerLanguageNameW
GetThreadPriority
GetCurrentProcess
GlobalLock
SetThreadPriority
VirtualAlloc
GetTempPathW
GetCommandLineW
GetSystemInfo
LeaveCriticalSection
GetProcAddress
ResumeThread
SearchPathW
GetLogicalDriveStringsW
GetVersionExW
GetModuleHandleA
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
DeviceIoControl
LCMapStringW
SignalObjectAndWait
GetDiskFreeSpaceW
VerSetConditionMask
FindFirstFileW
GetUserDefaultUILanguage
GetConsoleOutputCP
UnmapViewOfFile
GetConsoleCP
lstrlenW
CompareStringA
QueryPerformanceCounter
SetEndOfFile
WaitForSingleObjectEx
HeapFree
WideCharToMultiByte
MultiByteToWideChar
FindClose
LoadLibraryW
SetEvent
GetLocaleInfoW
CreateFileW
EnumResourceNamesW
GetSystemDirectoryW
GetDriveTypeA
DeleteFileW
IsDBCSLeadByteEx
GetEnvironmentVariableW
GetLocalTime
WaitForSingleObject
WriteFile
CreateFileMappingW
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
SetErrorMode
GetComputerNameW
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
RemoveDirectoryW
CreateEventW
GetPrivateProfileStringW
WaitForMultipleObjectsEx
GetThreadLocale
SetThreadLocale
shfolder
SHGetFolderPathW
ole32
CreateDataAdviseHolder
StgCreateDocfileOnILockBytes
OleRegEnumVerbs
CoCreateInstance
OleGetClipboard
OleSetClipboard
IsEqualGUID
OleFlushClipboard
CreateStreamOnHGlobal
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
CoGetClassObject
CoInitialize
OleDraw
CoTaskMemAlloc
DoDragDrop
StringFromCLSID
CoMarshalInterThreadInterfaceInStream
RevokeDragDrop
IsAccelerator
CoGetInterfaceAndReleaseStream
CoUninitialize
ReleaseStgMedium
RegisterDragDrop
OleInitialize
ProgIDFromCLSID
CoInitializeEx
OleUninitialize
CoDisconnectObject
CoTaskMemFree
OleSetMenuDescriptor
api-ms-win-crt-string-l1-1-0
memset
gdi32
Pie
SetPaletteEntries
SetBkMode
GetRandomRgn
CreateCompatibleBitmap
GetEnhMetaFileHeader
CloseEnhMetaFile
RectVisible
AngleArc
ResizePalette
SetAbortProc
SetTextColor
GetTextColor
StretchBlt
RoundRect
SelectClipRgn
RestoreDC
SetRectRgn
GetTextMetricsW
GetWindowOrgEx
SetPixelV
CreatePalette
CreateDCW
CreateICW
PolyBezierTo
GetStockObject
CreateSolidBrush
GetBkMode
Polygon
MoveToEx
PlayEnhMetaFile
Ellipse
StartPage
GetBitmapBits
StartDocW
AbortDoc
GetSystemPaletteEntries
GetEnhMetaFileBits
CreatePenIndirect
GetEnhMetaFilePaletteEntries
SetMapMode
GetMapMode
CreateFontIndirectW
PolyBezier
LPtoDP
EndDoc
GetObjectW
GetCurrentObject
GetWinMetaFileBits
SetROP2
GetEnhMetaFileDescriptionW
ArcTo
CreateEnhMetaFileW
Arc
CreateRectRgnIndirect
SelectPalette
SetGraphicsMode
ExcludeClipRect
MaskBlt
SetWindowOrgEx
CreatePatternBrush
EndPage
DeleteEnhMetaFile
Chord
SetDIBits
SetViewportOrgEx
GetViewportOrgEx
CreateRectRgn
RealizePalette
SetDIBColorTable
GetDIBColorTable
CreateBrushIndirect
PatBlt
SetEnhMetaFileBits
Rectangle
SaveDC
DeleteDC
BitBlt
SetWorldTransform
FrameRgn
GetDeviceCaps
GetTextExtentPoint32W
GetClipBox
GetClipRgn
Polyline
IntersectClipRect
CreateBitmap
CombineRgn
SetWinMetaFileBits
CreateDIBitmap
GetStretchBltMode
CreateDIBSection
SetStretchBltMode
GetDIBits
ExtCreateRegion
LineTo
GetRgnBox
EnumFontsW
CreateHalftonePalette
SelectObject
DeleteObject
ExtFloodFill
UnrealizeObject
CopyEnhMetaFileW
OffsetRgn
GetMetaFileBitsEx
SetBkColor
GetBkColor
CreateCompatibleDC
GetBrushOrgEx
GetCurrentPositionEx
SetDCPenColor
GetNearestPaletteIndex
CreateRoundRectRgn
GetTextExtentPointW
ExtTextOutW
SetBrushOrgEx
GetPixel
GdiFlush
SetPixel
EnumFontFamiliesExW
StretchDIBits
GetPaletteEntries
ntdll
NtOpenFile
NtClose
NtQueryDirectoryFile
RtlInitUnicodeString
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
7.8MB
Virtual Size
7.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
651KB
Virtual Size
651KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
961KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
115B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
664B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
109B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
354KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
400KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
SspiCli.dll
- IMPHASH 07a76aeaf1db7fd5ee653602abcf0c84
- SHA256 8b1134784d8babc6ef24569abba93e20917679c51cd777de972bdc6fee2fca22
- MD5 5368a0eda501b5bd821bb55664d04f6f
- SHA1 b43e4c935b2ecda48a88ff79868a41610f029cf4
- SHA512 df26d13641892e5ac17951fcca3c4b9a85dd3974622907e32a08c03251fbdf21fdfcdf16a4d6f0b012dc226791a50d8087b52bda9a284fe3a797bb6a11cb0c86
- SSDEEP 3072:uksV22GHg8RMkkKht2MST0SwDiANhsXmB/0WHZOVYOPaq0CQlmz3G7d:ukseHHRMkOMST0SwDiANmX+tZ/ZmY
- TLSH T1C564291EF6A548A9DC7AC23DC5478226A7F2B9601352C7CF06508639EE1B7DA2F35F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
18:70:1c:ea:d7:d1:98:46:06:dc:49:e2:77:34:03:23:22:40:1e:e4:6a:74:a3:3c:8a:14:4c:e4:7e:a5:8f:66
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 25, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
60304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
sspicli.pdb
api-ms-win-core-crt-l1-1-0
memmove
_wcsnicmp
wcscmp
memcpy
memcmp
memset
_wcsicmp
_vsnprintf_s
strcpy_s
wcsstr
wcsrchr
wcschr
memmove_s
memcpy_s
_vsnwprintf_s
__C_specific_handler
strncpy_s
api-ms-win-core-crt-l2-1-0
_purecall
__dllonexit3
_onexit
_initterm
_initterm_e
ntdll
RtlNtStatusToDosError
RtlxAnsiStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
NtAllocateLocallyUniqueId
RtlValidSid
RtlCheckTokenMembershipEx
RtlEqualSid
RtlNtStatusToDosErrorNoTeb
NtDuplicateObject
RtlCompareUnicodeString
RtlDeleteResource
NtQueryInformationThread
NtWaitForSingleObject
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
RtlInitializeResource
RtlGetNtProductType
RtlLengthSid
RtlAcquireResourceShared
RtlReleaseResource
NtSetInformationThread
RtlAcquireResourceExclusive
RtlFreeHeap
RtlAllocateHeap
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
NtQueryInformationToken
NtOpenThreadTokenEx
NtOpenProcessToken
NtOpenFile
RtlGetElementGenericTableAvl
NtOpenThreadToken
RtlCopySid
NtClose
RtlCaptureContext
NtQueryEvent
NtOpenEvent
RtlInitUnicodeString
NtFreeVirtualMemory
NtDeviceIoControlFile
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableFullAvl
RtlInitializeGenericTableAvl
RtlLeaveCriticalSection
RtlInitString
RtlInitializeCriticalSection
RtlDeleteCriticalSection
RtlEnterCriticalSection
DbgPrintEx
RtlCreateUnicodeStringFromAsciiz
RtlStringFromGUID
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlUnicodeStringToAnsiString
rpcrt4
I_RpcMapWin32Status
RpcBindingUnbind
RpcBindingFree
RpcSsDestroyClientContext
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrClientCall3
NdrServerCall2
NdrServerCallAll
RpcExceptionFilter
I_RpcExceptionFilter
RpcBindingCreateW
RpcBindingBind
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
GetModuleFileNameW
DisableThreadLibraryCalls
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegDeleteKeyExW
RegOpenKeyExW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
WaitForSingleObject
LeaveCriticalSection
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
DeleteCriticalSection
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
TlsAlloc
GetCurrentThread
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsFree
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalFree
LocalAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetComputerNameExW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AcceptSecurityContext
AcquireCredentialsHandleA
AcquireCredentialsHandleW
AddCredentialsA
AddCredentialsW
AddSecurityPackageA
AddSecurityPackageW
ApplyControlToken
ChangeAccountPasswordA
ChangeAccountPasswordW
CompleteAuthToken
CredMarshalTargetInfo
CredUnmarshalTargetInfo
DecryptMessage
DeleteSecurityContext
DeleteSecurityPackageA
DeleteSecurityPackageW
EncryptMessage
EnumerateSecurityPackagesA
EnumerateSecurityPackagesW
ExportSecurityContext
FreeContextBuffer
FreeCredentialsHandle
GetSecurityUserInfo
GetUserNameExA
GetUserNameExW
ImpersonateSecurityContext
ImportSecurityContextA
ImportSecurityContextW
InitSecurityInterfaceA
InitSecurityInterfaceW
InitializeSecurityContextA
InitializeSecurityContextW
LogonUserExExW
LsaCallAuthenticationPackage
LsaConnectLocalUser
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaLogonUser
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
LsaRegisterPolicyChangeNotification
LsaSetMachineCertificate
LsaUnregisterPolicyChangeNotification
MakeSignature
QueryContextAttributesA
QueryContextAttributesExA
QueryContextAttributesExW
QueryContextAttributesW
QueryCredentialsAttributesA
QueryCredentialsAttributesExA
QueryCredentialsAttributesExW
QueryCredentialsAttributesW
QuerySecurityContextToken
QuerySecurityPackageInfoA
QuerySecurityPackageInfoW
RevertSecurityContext
SaslAcceptSecurityContext
SaslEnumerateProfilesA
SaslEnumerateProfilesW
SaslGetContextOption
SaslGetProfilePackageA
SaslGetProfilePackageW
SaslIdentifyPackageA
SaslIdentifyPackageW
SaslInitializeSecurityContextA
SaslInitializeSecurityContextW
SaslSetContextOption
SealMessage
SecAllocateAndSetCallTarget
SecAllocateAndSetIPAddress
SecCacheSspiPackages
SecDeleteUserModeContext
SecFreeCallContext
SecInitUserModeContext
SeciAllocateAndSetCallFlags
SeciAllocateAndSetCallTarget
SeciAllocateAndSetIPAddress
SeciFreeCallContext
SeciIsProtectedUser
SetContextAttributesA
SetContextAttributesW
SetCredentialsAttributesA
SetCredentialsAttributesW
SspiCompareAuthIdentities
SspiCopyAuthIdentity
SspiDecryptAuthIdentity
SspiDecryptAuthIdentityEx
SspiEncodeAuthIdentityAsStrings
SspiEncodeStringsAsAuthIdentity
SspiEncryptAuthIdentity
SspiEncryptAuthIdentityEx
SspiExcludePackage
SspiFreeAuthIdentity
SspiGetComputerNameForSPN
SspiGetTargetHostName
SspiIsAuthIdentityEncrypted
SspiLocalFree
SspiMarshalAuthIdentity
SspiPrepareForCredRead
SspiPrepareForCredWrite
SspiSetChannelBindingFlags
SspiUnmarshalAuthIdentity
SspiUnmarshalAuthIdentityInternal
SspiValidateAuthIdentity
SspiZeroAuthIdentity
UnsealMessage
VerifySignature
Name
.text
Size
140KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
112KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=1, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=14, id=260, version=33145,
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=180, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=41, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
WTSAPI32.DLL
- IMPHASH b96c3cdb0d69bbcf4e7174a68d554fc2
- SHA256 64773e9b66825e3e3d653b730f2994eac6635d8166707d076371bb2ff2f7f434
- MD5 a14313f547139025473612833687c1a5
- SHA1 9c91b00f37e2c91ec52f60a7d3115ea824c6d2c6
- SHA512 73b1fd2e942bb283b5d93735f4bfd07ebee6ddf68318a0b7aa5dbe3cad030411467074e461a11becf7abe8112b282cfcfe6a6a3b9b706a35fd5d48684ca9f7d6
- SSDEEP 24576:3HMe8e18KimZP1k26rnWodwwz6JreJRa6K1jytX7q3iVF1N+DU7DGb7ohyy:3Hn8eCRxldwwz6JCJwPgqSH1FDeowy
- TLSH T13785DF05A3E80AB5D6B7D334CA675632D7B1785107709ACF02A4DA5E2F33BD06E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
301644
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
RegisterEventSourceW
ReportEventW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
bcrypt
BCryptGenRandom
kernel32
InitializeCriticalSection
CloseHandle
CopyFileExW
CreateDirectoryW
CreateEventExW
CreateFileW
CreateProcessW
DuplicateHandle
FindClose
FindFirstFileExW
FormatMessageW
FreeLibrary
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessorNumberEx
GetCurrentThread
GetEnvironmentVariableW
GetFileAttributesExW
GetFullPathNameW
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetProcAddress
GetStdHandle
GetThreadContext
GetThreadPriority
GetTickCount64
LoadLibraryExW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseFailFastException
ReadProcessMemory
ResumeThread
SetEvent
SetLastError
SetThreadContext
SetThreadErrorMode
Sleep
TerminateProcess
VirtualAlloc
VirtualAllocEx
VirtualFree
WaitForMultipleObjectsEx
WideCharToMultiByte
WriteFile
WriteProcessMemory
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
ExitProcess
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
IsProcessorFeaturePresent
HeapAlloc
HeapFree
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleMode
SetFilePointerEx
WriteConsoleW
RaiseException
AddVectoredExceptionHandler
RtlRestoreContext
VerSetConditionMask
ResetEvent
WaitForSingleObjectEx
CreateEventW
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
FlushProcessWriteBuffers
CreateMemoryResourceNotification
QueryInformationJobObject
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
ole32
CoUninitialize
CoInitializeEx
CoGetApartmentType
CoWaitForMultipleHandles
vcruntime140
__C_specific_handler_noexcept
strrchr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memmove
memset
__C_specific_handler
__std_type_info_destroy_list
__std_terminate
__CxxFrameHandler3
memcpy
_purecall
vcruntime140_1
__CxxFrameHandler4
1Rw2zQCyVD9DEE
2TFfCd5KIW76qmRiDr6X
2dbxotvgpByKwa87OjKd
3ZnYXgdfx1mi
4eaVUjp3e2WMJRuFebjbdFueDrHx
4mB2zpGId
4zIKO80o1Sve18cK7fJhrZqJ
55x12ksU3fFzoNileeZkSyyFIkiLvX
6VyxE185zhbK5HcNtyubhlH2EDdO8ZjT
9W465RLdsJtlSz27VPPvHzDGR6MXNdU
BilCppjjnl
Bx5iVRcIuzTEp4VoL
EIlkk8exwz2krT
F1gVB0cbS6ISQWqLj
FiNuHertkQEk8dHdhhmmaPHtIJ5Ag
Gr0E6OwGQrX6KqIWniU
HURGcBrg6pFE
HnUDL5pyXjc1DNrFg1OCrvS
I245fn2sTVTj
IsInteractiveUserSession
K1P1BSFEywO6n5k4S5uYzMK
K4qiNBAiOKPyrA7kqgF9aAt
LiOV3RRPjkhb
MNtB9p4nWNQLcIqW3
MWvPXuLgOgYEsnDNl7
OVYEQ0BtpRO0ZWrR
PRO5cKfsDsH9hda3x
QR2bYKavuDcu7Ykic3zkzW
QXntjByEB0D2
QueryActiveSession
QueryUserToken
RegisterUsertokenForNoWinlogon
SJ1Wx2cdLyENDFcnyz2auXOT
ScbGNRQDeNnxKgc
TA21a7cDvUnwKEXFaBudHQVdOHOvRGA
TvOPdzb9XnXGFg6j7bYg5I0r2t7
UPQZOwOzGaCP18CTDo4aXH
Vg8TC7vO7JJfoTfs
VvyFczEbRx96POwQsjin85qeBdrDDy
WTSActiveSessionExists
WTSCloseServer
WTSCloudAuthClose
WTSCloudAuthConvertAssertionToSerializedUserCredential
WTSCloudAuthDuplicateSerializedUserCredential
WTSCloudAuthGetServerNonce
WTSCloudAuthNetworkLogonWithSerializedCredential
WTSCloudAuthOpen
WTSConnectSessionA
WTSConnectSessionW
WTSCreateListenerA
WTSCreateListenerW
WTSDisconnectSession
WTSEnableChildSessions
WTSEnumerateListenersA
WTSEnumerateListenersW
WTSEnumerateProcessesA
WTSEnumerateProcessesExA
WTSEnumerateProcessesExW
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSEnumerateServersW
WTSEnumerateSessionsA
WTSEnumerateSessionsExA
WTSEnumerateSessionsExW
WTSEnumerateSessionsW
WTSFreeMemory
WTSFreeMemoryExA
WTSFreeMemoryExW
WTSGetChildSessionId
WTSGetListenerSecurityA
WTSGetListenerSecurityW
WTSIsChildSessionsEnabled
WTSLogoffSession
WTSOpenServerA
WTSOpenServerExA
WTSOpenServerExW
WTSOpenServerW
WTSQueryListenerConfigA
WTSQueryListenerConfigW
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserConfigW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSRegisterSessionNotificationEx
WTSSendMessageA
WTSSendMessageW
WTSSetListenerSecurityA
WTSSetListenerSecurityW
WTSSetRenderHint
WTSSetSessionInformationA
WTSSetSessionInformationW
WTSSetUserConfigA
WTSSetUserConfigW
WTSShutdownSystem
WTSStartRemoteControlSessionA
WTSStartRemoteControlSessionW
WTSStopRemoteControlSession
WTSTerminateProcess
WTSUnRegisterSessionNotification
WTSUnRegisterSessionNotificationEx
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelOpenEx
WTSVirtualChannelPurgeInput
WTSVirtualChannelPurgeOutput
WTSVirtualChannelQuery
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSWaitSystemEvent
X8IoqWCxQQN59yodeL0mUcYE8X00
Y1mdILAhNFaU8hRVF
Y71FHWqNlB
ZjGRgynq
Zr3OQx7HIA0Mcj6SuRTu
bFBJ2daiojygInUwZyHekiZrOS8
bIzMCbAyJ7yab3
d8XVci7vcjKf9J
e5Fkm7LdAEnk5aWA9e5nScc2CJzTV3
eIT1AYsjQntk1Ni9PExzNr
eKLwvwLRGH8NjaNMW2fZcP8J2
fgOz69zUa7btJInVJ5RlYTg7KFQX
g624JLbf7nlvw5
hW2AuIXW8OGxekAxrMUItd
hpFgc2wiRMVEMOFfDgZo77
i9eQHtZiKLVYFLkXx
ixiotJiKKz50wXPbnY
jwm21AQRzl2xOvnwuyULaTmVd
kCUbufziwzy6yNa22SsmU9mo4OQ
lGHkVdzIcmKJ4loL
lfarVk2CcMtXzq6AZLRioqoObYNBu2Bx
lvLbM3bWyZ7WSMktxcHcQVHyePKmVSo
msBBvcUaTwdHh
mz4c58267dxb9H9Ab41z6gzg
mzHO7ccPX5skv8Xi
pC9K9sIfB7NU
qiUnu0R
rjpUvnbdCgrBECxlbMBRKTT4PdH5P3
rmMyxk3remA3J
sudSWH35SEzDyc7894K
tEJ0sAx4EtyqGNrIDA0
tFqsEvRZ2kup4sdZrLQI4B1
tuECfaYhL2HJIsAO9f9ekik8iBxRyye
uKK7PSn8zAVbONMxOMD36z
x8LETpqU6YIRgWQZE
xYkxCKxSgKOfvdju2XQ8sGRTbh
y0Ooisu7XZv0av3o4tgRr7
Name
.text
Size
635KB
Virtual Size
635KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
930KB
Virtual Size
930KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
62KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
comdlg32.dll
- IMPHASH b8af2c3fa48603dbd6984d8eb200299e
- SHA256 277f03b537f9c808f573d29ae6089c1e13b61531329c25314a4513c93f5be67c
- MD5 9fc5d875b32f15003a1b15fd5aa8d009
- SHA1 e0a0e6d523ebd3dc950f4c860fa9e6c631de9bdc
- SHA512 f8488a2abcf65d101dd5f43f32b7d1e25aa70e5f1854d693e0b3a0264c9cfc06a8537e508df65bd7391d208cc51469afc5328004547a0ba084579caeb23f4543
- SSDEEP 12288:+3a1OBSpcy+lC8M2N8MWlYBeNVUOPFgKX1yT6wqD4nogilAYdUJ+SOf5fZpk7:LOBIC2MrQQKHUT6J4nonAY+oNlT8
- TLSH T173255B1E26FC01D6DA7AD17CCA13860AE6B2747513226ACB0150C67DBF2BFE46539F21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
284432
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
comdlg32.pdb
msvcp_win
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-string-l1-1-0
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__wcsicmp
memmove
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_wcstok
_o_wcstok_s
__CxxFrameHandler4
__std_terminate
strchr
__CxxFrameHandler3
__current_exception
__current_exception_context
_o__set_errno
_o__seh_filter_dll
_o__register_onexit_function
_o__purecall
wcschr
wcsrchr
wcsstr
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler
_CxxThrowException
memcmp
memcpy
api-ms-win-core-heap-l2-1-0
LocalReAlloc
LocalFree
GlobalFree
GlobalAlloc
LocalAlloc
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
FindStringOrdinal
LoadResource
GetModuleHandleW
GetProcAddress
LockResource
FindResourceExW
GetModuleHandleExA
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleExW
SizeofResource
FreeResource
DisableThreadLibraryCalls
FreeLibraryAndExitThread
FreeLibrary
api-ms-win-core-processthreads-l1-1-0
GetProcessVersion
TerminateProcess
OpenThreadToken
TlsGetValue
CreateThread
TlsAlloc
TlsFree
GetCurrentThreadId
GetCurrentThread
TlsSetValue
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
SetErrorMode
GetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-localization-l1-2-0
GetThreadPreferredUILanguages
GetACP
GetLocaleInfoW
FindNLSStringEx
SetThreadUILanguage
GetThreadUILanguage
SetThreadPreferredUILanguages
FormatMessageW
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
api-ms-win-core-string-l2-1-0
CharLowerW
CharNextW
api-ms-win-core-file-l1-1-0
GetFileAttributesW
GetVolumeInformationW
GetFullPathNameW
CreateFileW
GetDriveTypeW
FindClose
FindNextFileW
FindFirstFileW
GetShortPathNameW
GetVolumePathNameW
api-ms-win-core-synch-l1-1-0
CreateEventExW
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexExW
InitializeCriticalSectionAndSpinCount
CreateEventW
OpenSemaphoreW
ResetEvent
WaitForSingleObject
ReleaseSemaphore
SetEvent
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreExW
InitializeCriticalSection
AcquireSRWLockShared
OpenEventW
ReleaseSRWLockShared
InitializeCriticalSectionEx
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegGetValueW
RegDeleteValueW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CLSIDFromString
CoGetMalloc
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
PropVariantClear
CoTaskMemRealloc
CoCreateInstance
StringFromGUID2
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchSkipRoot
PathCchAppend
PathCchRemoveBackslash
PathIsUNCEx
PathCchAppendEx
PathCchStripToRoot
PathCchRemoveFileSpec
PathCchIsRoot
PathAllocCanonicalize
PathCchAddExtension
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount64
GetVersionExW
GetTickCount
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
rpcrt4
UuidCreate
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ntdll
RtlIsNameLegalDOS8Dot3
RtlUnicodeToMultiByteSize
EtwEventRegister
EtwEventWriteTransfer
EtwEventUnregister
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
EtwEventSetInformation
EtwEventActivityIdControl
WinSqmAddToStream
EtwEventEnabled
EtwEventWrite
EtwCheckCoverage
NtQueryWnfStateData
WinSqmIncrementDWORD
RtlQueryWnfStateData
RtlNtStatusToDosError
RtlIsDosDeviceName_U
NtFsControlFile
NtQueryInformationFile
RtlInitUnicodeStringEx
NtSetInformationProcess
api-ms-win-shcore-scaling-l1-1-1
GetProcessDpiAwareness
user32
CreateDialogIndirectParamA
MsgWaitForMultipleObjects
SetMenuDefaultItem
ClientToScreen
RegisterClassW
GetComboBoxInfo
DestroyMenu
TrackPopupMenuEx
CreatePopupMenu
InsertMenuItemW
GetMenuItemCount
GetWindowTextLengthW
CreateDialogIndirectParamW
SetParent
RedrawWindow
GetClassNameW
GetLastActivePopup
MsgWaitForMultipleObjectsEx
PostQuitMessage
TranslateMessage
DispatchMessageW
SetActiveWindow
GetActiveWindow
IsWindowVisible
SetForegroundWindow
ChangeWindowMessageFilterEx
EnableMenuItem
TranslateAcceleratorW
CallNextHookEx
GetNextDlgTabItem
GetMessageTime
GetMessagePos
DestroyIcon
PeekMessageW
MapDialogRect
GetWindow
DestroyAcceleratorTable
UnhookWindowsHookEx
SetWindowsHookExW
LoadAcceleratorsW
GetSystemMenu
MonitorFromWindow
KillTimer
DeferWindowPos
EnumChildWindows
GetDlgCtrlID
CopyIcon
GetClassLongPtrW
SendMessageTimeoutW
GetAncestor
OffsetRect
EnumDisplayMonitors
MonitorFromRect
GetMonitorInfoW
EndDeferWindowPos
BeginDeferWindowPos
GetDpiForWindow
SystemParametersInfoForDpi
SetThreadDpiAwarenessContext
GetThreadDpiAwarenessContext
AreDpiAwarenessContextsEqual
DeleteMenu
GetForegroundWindow
ord2707
SetTimer
SystemParametersInfoW
RegisterClipboardFormatW
SetWindowPlacement
GetWindowPlacement
DrawIcon
GetKeyState
LoadImageW
LoadIconW
DrawTextW
GetKeyboardLayout
IsWindowEnabled
MessageBoxW
GetWindowTextW
DialogBoxIndirectParamW
NotifyWinEvent
GetDlgItemTextA
CheckRadioButton
SendDlgItemMessageA
SetDlgItemTextA
DestroyWindow
RegisterWindowMessageW
RegisterWindowMessageA
IsWindow
CreateDialogIndirectParamAorW
GrayStringW
DefWindowProcW
IsDlgButtonChecked
MessageBeep
DlgDirListW
PostMessageW
CheckDlgButton
SetDlgItemTextW
SetWindowTextW
GetWindowLongA
CreateWindowExW
ScreenToClient
GetSystemMetrics
GetDialogBaseUnits
LoadCursorW
SetCursor
ShowCursor
EqualRect
IntersectRect
GetSysColorBrush
CallWindowProcW
GetParent
SetWindowLongW
MoveWindow
AdjustWindowRect
ShowWindow
GetClientRect
SetWindowLongPtrW
FillRect
DrawEdge
GetWindowLongW
DrawFocusRect
InflateRect
FrameRect
GetSysColor
EndPaint
BeginPaint
SetWindowPos
GetWindowRect
EnableWindow
SendDlgItemMessageW
GetDlgItemTextW
UpdateWindow
SetDlgItemInt
GetDlgItemInt
SendMessageW
EndDialog
RemovePropW
InvalidateRect
ReleaseCapture
SetFocus
GetFocus
GetDlgItem
ChildWindowFromPoint
ValidateRect
ClipCursor
MapWindowPoints
CopyRect
SetCapture
ReleaseDC
GetDC
PtInRect
SetPropW
GetPropW
GetWindowLongPtrW
DialogBoxIndirectParamAorW
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
lstrlenA
lstrcmpiW
lstrcmpW
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
api-ms-win-shcore-unicodeansi-l1-1-0
SHAnsiToUnicode
SHUnicodeToAnsi
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrStrW
QISearch
StrChrW
StrStrIW
StrPBrkW
StrCmpW
StrRChrW
StrCmpIW
StrCmpNIW
StrIsIntlEqualW
StrCmpICW
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsFileSpecW
PathGetDriveNumberW
PathCombineW
PathFindFileNameW
PathFindNextComponentW
PathFindExtensionW
PathIsValidCharW
PathIsUNCServerW
PathRemoveBackslashW
PathSkipRootW
PathRemoveBlanksW
PathMatchSpecExW
PathIsRelativeW
PathFileExistsW
PathIsRootW
PathIsUNCW
PathAddBackslashW
PathRemoveExtensionW
PathMatchSpecW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
LocalSize
GlobalReAlloc
GlobalLock
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
FindResourceA
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-shcore-stream-l1-1-0
IStream_Write
IStream_Read
SHCreateMemStream
IStream_Reset
IStream_Size
api-ms-win-shcore-comhelpers-l1-1-0
IUnknown_QueryService
IUnknown_SetSite
IUnknown_Set
api-ms-win-shell-shellcom-l1-1-0
SHCoCreateInstance
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-url-l1-1-0
UrlIsW
PathIsURLW
api-ms-win-shcore-path-l1-1-0
ord170
ord172
api-ms-win-shcore-registry-l1-1-0
SHRegGetValueW
api-ms-win-shcore-thread-l1-1-0
SHCreateThread
shlwapi
ord619
ord172
ord175
ord168
ord271
ord197
ord355
ord225
ord266
ord630
ord163
ord178
ord638
ord478
ord481
ord479
AssocGetPerceivedType
ord204
ord514
ord164
ord24
StrRetToStrW
ord540
ord476
StrRetToBufW
ord270
ord618
ord388
gdi32
BitBlt
PatBlt
GetNearestColor
CreateCompatibleDC
Rectangle
SelectObject
GetStockObject
CreatePen
CreateSolidBrush
RealizePalette
SelectPalette
DeleteDC
MoveToEx
GetGlyphIndicesW
GetTextCharset
GetTextExtentPointW
SetBkMode
SetTextColor
GetTextCharsetInfo
SetBkColor
GetTextMetricsW
CreateDiscardableBitmap
GetObjectW
CreateDIBitmap
CreateCompatibleBitmap
DeleteObject
CreateFontIndirectW
ExtTextOutW
GetLayout
CreateDIBSection
SetWindowOrgEx
OffsetWindowOrgEx
GetTextExtentPoint32W
ExcludeClipRect
EqualRgn
CombineRgn
SetRectRgn
CreateRectRgn
GetCharWidth32W
CreateDCW
CreateICW
SelectClipRgn
CreateRectRgnIndirect
CreateFontW
GetDeviceCaps
TextOutW
EnumFontFamiliesExW
TranslateCharsetInfo
LineTo
comctl32
ord336
ord16
ord324
ord335
ord332
ord328
ord385
ord331
ord329
ord386
ord334
CreatePropertySheetPageW
PropertySheetW
ord412
ord413
ord410
ord326
ord323
ord322
ord320
ord388
ord341
ImageList_Destroy
ord338
ImageList_GetIconSize
ImageList_Draw
CreateToolbarEx
ord236
ord339
InitCommonControlsEx
shell32
ord100
SHGetSpecialFolderPathW
ord714
SheChangeDirExW
ord25
SHParseDisplayName
ord155
ord19
SHGetIDListFromObject
SHGetSpecialFolderLocation
ord18
SHBindToParent
SHCreateItemFromIDList
SHGetKnownFolderPath
ord23
ord95
SHBindToFolderIDListParent
ord942
SHCreateShellItemArrayFromIDLists
SHCreateShellItemArray
ord64
ord853
ord654
SHChangeNotifyRegisterThread
ord778
SHAddDefaultPropertiesByExt
ord68
ord644
ord645
ord903
ord28
ord71
ord4
ord2
ord89
ShellExecuteExW
ShellExecuteW
ord152
SHCreateItemInKnownFolder
ord2000
ord921
ord787
ord195
ord761
SHGetFolderLocation
ord77
ord24
ord153
ord16
ord17
SHBindToObject
SHCreateShellItemArrayFromShellItem
SHCreateItemFromParsingName
SHCreateShellItemArrayFromDataObject
SHGetDesktopFolder
SHCreateItemWithParent
ord21
SHGetKnownFolderItem
ord850
SHGetFileInfoW
SHGetKnownFolderIDList
SHBindToFolderIDListParentEx
kernel32
CreateActCtxW
ActivateActCtx
DeactivateActCtx
ReleaseActCtx
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
ChooseColorA
ChooseColorW
ChooseFontA
ChooseFontW
CommDlgExtendedError
DllCanUnloadNow
DllGetClassObject
FindTextA
FindTextW
GetFileTitleA
GetFileTitleW
GetOpenFileNameA
GetOpenFileNameW
GetSaveFileNameA
GetSaveFileNameW
LoadAlterBitmap
PageSetupDlgA
PageSetupDlgW
PrintDlgA
PrintDlgExA
PrintDlgExW
PrintDlgW
ReplaceTextA
ReplaceTextW
Ssync_ANSI_UNICODE_Struct_For_WOW
WantArrows
dwLBSubclass
dwOKSubclass
Name
.text
Size
728KB
Virtual Size
724KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
148KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=132, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=29, id=260, version=33145,
count=5, id=259, version=33145,
count=1895, id=1, productName=Unmarked objects,
count=17, id=257, version=33145,
count=31, id=261, version=33145,
count=1, id=256, version=33145,
count=78, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
mpr.dll
- IMPHASH 38f885962cb4c73d355b356d1a7b9606
- SHA256 8bb319c8c8255e915c05c03eccc24981cf9653025d2f720fb7fffdd4d524309c
- MD5 270e57ac9dbbd5ee4425532bfa4a9e50
- SHA1 235e781c4b5d40fbe8cab0228c1c0976f5278a42
- SHA512 a82bcb4cf3d5ce223370683c823f10de784d0d0f815cc6f37a3b05428bce0467c6874284ec3d70eee053f72a551866875ecf5971e285cfdcc35cd237e5a6f8cc
- SSDEEP 1536:donUKXu43rN5KDnX56J/jMIR/QXwjyeJQ/wyI4jsAuBE4RM87ximtb1sZiP5zQG:qnRX/3bKDeIUjJQoyIPHj7xFtb1sYREG
- TLSH T184E3282E76B93095E5BAC2B884525605E732B47123116BFF06D0CA788F277D8BE39F41
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
18:ec:59:10:81:3a:55:9a:6a:6c:5c:86:e5:ba:a3:45:06:6e:b0:ec:9c:be:3d:40:49:92:5e:1e:1c:c1:2e:86
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 24, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
47616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mpr.pdb
ntdll
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
_wcsnicmp
wcsncmp
RtlInitUnicodeString
RtlInitAnsiString
RtlDeleteResource
wcscat_s
RtlUpcaseUnicodeChar
iswalpha
RtlReleaseResource
RtlAcquireResourceShared
RtlCaptureContext
_wcsicmp
RtlCopyUnicodeString
RtlAcquireResourceExclusive
RtlLookupFunctionEntry
RtlInitializeResource
RtlNtStatusToDosError
RtlEqualUnicodeString
__C_specific_handler
RtlVirtualUnwind
RtlInitializeCriticalSection
memset
RtlUnicodeStringToAnsiString
wcsncat_s
RtlxUnicodeStringToAnsiSize
_ultow
wcsncpy_s
wcschr
swprintf_s
wcscpy_s
_vsnwprintf
NtQueryInformationToken
memcpy
wcscmp
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
OpenEventW
SetEvent
CreateEventW
WaitForMultipleObjectsEx
ResetEvent
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-file-l1-1-0
DefineDosDeviceW
GetLogicalDrives
WriteFile
GetVolumeInformationW
GetDriveTypeW
QueryDosDeviceW
api-ms-win-core-libraryloader-l1-2-0
FreeLibraryAndExitThread
GetProcAddress
LoadLibraryExW
LoadStringW
DisableThreadLibraryCalls
FreeLibrary
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetStdHandle
api-ms-win-core-console-l1-1-0
WriteConsoleW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyExW
RegOpenKeyExW
RegFlushKey
RegQueryValueExW
RegEnumKeyExW
RegOpenCurrentUser
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumValueW
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-processthreads-l1-1-0
SetThreadToken
CreateThread
TerminateThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
ResumeThread
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DoBroadcastSystemMessage
DoCommandLinePrompt
DoPasswordDialog
DoProfileErrorDialog
I_MprSaveConn
MultinetGetConnectionPerformanceA
MultinetGetConnectionPerformanceW
MultinetGetErrorTextA
MultinetGetErrorTextW
ShowReconnectDialog
ShowReconnectDialogEnd
ShowReconnectDialogUI
WNetAddConnection2A
WNetAddConnection2W
WNetAddConnection3A
WNetAddConnection3W
WNetAddConnection4A
WNetAddConnection4W
WNetAddConnectionA
WNetAddConnectionW
WNetCancelConnection2A
WNetCancelConnection2W
WNetCancelConnectionA
WNetCancelConnectionW
WNetClearConnections
WNetCloseEnum
WNetConnectionDialog
WNetConnectionDialog1A
WNetConnectionDialog1W
WNetConnectionDialog2
WNetDirectoryNotifyA
WNetDirectoryNotifyW
WNetDisconnectDialog
WNetDisconnectDialog1A
WNetDisconnectDialog1W
WNetDisconnectDialog2
WNetEnumResourceA
WNetEnumResourceW
WNetFormatNetworkNameA
WNetFormatNetworkNameW
WNetGetConnection2A
WNetGetConnection2W
WNetGetConnection3A
WNetGetConnection3W
WNetGetConnectionA
WNetGetConnectionW
WNetGetDirectoryTypeA
WNetGetDirectoryTypeW
WNetGetHomeDirectoryW
WNetGetLastErrorA
WNetGetLastErrorW
WNetGetNetworkInformationA
WNetGetNetworkInformationW
WNetGetPropertyTextA
WNetGetPropertyTextW
WNetGetProviderNameA
WNetGetProviderNameW
WNetGetProviderTypeA
WNetGetProviderTypeW
WNetGetResourceInformationA
WNetGetResourceInformationW
WNetGetResourceParentA
WNetGetResourceParentW
WNetGetSearchDialog
WNetGetUniversalNameA
WNetGetUniversalNameW
WNetGetUserA
WNetGetUserW
WNetLogonNotify
WNetOpenEnumA
WNetOpenEnumW
WNetPasswordChangeNotify
WNetPropertyDialogA
WNetPropertyDialogW
WNetRestoreAllConnectionsW
WNetRestoreSingleConnectionW
WNetSetConnectionA
WNetSetConnectionW
WNetSetLastErrorA
WNetSetLastErrorW
WNetSupportGlobalEnum
WNetUseConnection4A
WNetUseConnection4W
WNetUseConnectionA
WNetUseConnectionW
Name
.text
Size
76KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=141, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=10, id=260, version=33145,
count=4, id=259, version=33145,
count=1, id=256, version=33145,
count=24, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
oleacc.dll
- IMPHASH 5dc333bb99b10c2a84d4940a0340ee89
- SHA256 40d73e20a9f008aa05ac0d57c31f8513d01f21b8070ac201124a8afa8f82586c
- MD5 7515532e5734298091a7d8831fb5bfcb
- SHA1 ac0e058aab48dc56ec5a570c1af8e3bd9f7649c8
- SHA512 d6af9b86ff0e1d8cc78ffe0df223a101aa1762de4914b03943992c163e3e76de2233e6bb84e6ab39ddf4122c4e17d6a7fc1ca873b28d42cd6008eca0717f859c
- SSDEEP 6144:Iyzofc8zZzmfADzi+LjmCUtxU0SuXigOCF+HPyP0jQssehKuVb:/zQDX/FuygOCF+vyP0hPV
- TLSH T1F4A4185E72A844EAC93AC17CC957420AD7B1B821175197CF1260E67DEF3FBE42A39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
130512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleacc.pdb
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcslwr_s
_o_free
_o_malloc
_o_strncpy_s
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
__current_exception
__current_exception_context
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
__std_terminate
__C_specific_handler
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
ntdll
EtwEventSetInformation
EtwEventUnregister
EtwLogTraceEvent
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwEventWriteTransfer
NtAllocateVirtualMemory
NtFreeVirtualMemory
EtwUnregisterTraceGuids
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwEventRegister
api-ms-win-core-sysinfo-l1-1-0
GetVersionExW
GetSystemTimeAsFileTime
GetVersionExA
GetTickCount
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
LoadStringW
GetModuleHandleExW
LoadLibraryExW
FindResourceExW
LoadResource
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
rpcrt4
IUnknown_Release_Proxy
NdrOleAllocate
NdrStubCall3
NdrOleFree
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
WideCharToMultiByte
api-ms-win-core-string-l2-1-0
CharNextW
CharLowerBuffW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
CreateEventW
WaitForSingleObjectEx
OpenMutexW
CreateMutexW
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockShared
CreateMutexExW
ReleaseSemaphore
ReleaseMutex
InitializeCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
SetEvent
DeleteCriticalSection
WaitForSingleObject
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
VirtualFreeEx
VirtualAllocEx
ReadProcessMemory
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetExitCodeThread
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
CreateThread
TerminateProcess
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
GlobalAlloc
GlobalFree
api-ms-win-core-localization-l1-2-0
GetLocaleInfoW
FormatMessageW
GetThreadLocale
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-security-base-l1-1-0
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation
GetSidSubAuthority
FreeSid
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-psapi-l1-1-0
K32GetModuleBaseNameW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrcmpW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-atoms-l1-1-0
GlobalAddAtomW
GlobalDeleteAtom
GlobalGetAtomNameW
GlobalFindAtomW
api-ms-win-core-marshal-l1-1-0
HMENU_UserFree64
HWND_UserFree
HWND_UserSize64
HMENU_UserFree
HMENU_UserMarshal
HWND_UserUnmarshal
HWND_UserSize
HMENU_UserMarshal64
HMENU_UserUnmarshal
HWND_UserMarshal64
HMENU_UserSize
HMENU_UserUnmarshal64
HWND_UserFree64
HWND_UserUnmarshal64
HMENU_UserSize64
HWND_UserMarshal
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AccGetRunningUtilityState
AccNotifyTouchInteraction
AccSetRunningUtilityState
AccessibleChildren
AccessibleObjectFromEvent
AccessibleObjectFromPoint
AccessibleObjectFromWindow
AccessibleObjectFromWindowTimeout
CreateStdAccessibleObject
CreateStdAccessibleProxyA
CreateStdAccessibleProxyW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetOleaccVersionInfo
GetProcessHandleFromHwnd
GetRoleTextA
GetRoleTextW
GetStateTextA
GetStateTextW
IID_IAccessible
IID_IAccessibleHandler
LIBID_Accessibility
LresultFromObject
ObjectFromLresult
PropMgrClient_LookupProp
WindowFromAccessibleObject
Name
.text
Size
316KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1420, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33145,
count=5, id=259, version=33145,
count=20, id=261, version=33145,
count=1, id=256, version=33145,
count=65, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
winmm.dll
- IMPHASH 4e3f2ad1875e8e87b497a0bd31de7821
- SHA256 95f9d6069156740b12c125fb6f84e65de9a235b70c61369229f388c7cae8621c
- MD5 aba93c1d598db2eb33a58503aa356acf
- SHA1 c34d1f4daa75f8e522c62c6864d7ce3b502eb736
- SHA512 dbe424060de8dd04e78b568b3cd993d782d49b7349ac4746114e27bac210fbb26dbe17e45e9130cca333a864e9c88cc7a6818819e09525f8a3ecd7511f169dd6
- SSDEEP 3072:MKygNSd/Rd1gtxW/uTWC/Brx8AoanT6tnuY7BhT1hDzGR0ginHRRbyTZLhfZpk/:MJgURd1+W/jqnnT6tuYvH8inHuhL
- TLSH T1B5244A6D77EC10A6E97B9738C8A24A15F672F8341B1283DF02D0827D1E27FD8A934B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5f:3c:32:1a:de:50:b9:42:79:b6:11:18:f8:16:2f:21:a4:ae:c7:87:d4:c5:a8:5f:a0:56:ed:fc:b9:9f:8d:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 25, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0c:b9:64:e3:35:9c:ec:f4:ae:00:01:00:00:02:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
53616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winmm.pdb
ntdll
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
memmove
RtlGetActiveConsoleId
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
wcsstr
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteN
wcschr
__C_specific_handler
_vsnwprintf
NtQueryTimerResolution
NtCreateTimer
NtWaitForMultipleObjects
NtSetEvent
NtCreateEvent
NtCancelTimer
NtClose
NtSetTimer
__chkstk
memcmp
memcpy
EtwTraceMessage
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_CxxThrowException
_o__wcslwr_s
_o_free
_o_iswdigit
_o_malloc
_o_terminate
_o_towlower
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
api-ms-win-mm-time-l1-1-0
timeBeginPeriod
timeGetDevCaps
timeGetTime
timeGetSystemTime
timeEndPeriod
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegGetValueW
RegOpenCurrentUser
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
CreateSemaphoreExW
WaitForSingleObjectEx
AcquireSRWLockShared
InitializeCriticalSection
CreateEventA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ResetEvent
InitializeCriticalSectionEx
CreateEventW
SleepEx
OpenEventW
CreateMutexExW
WaitForSingleObject
LeaveCriticalSection
OpenSemaphoreW
ReleaseSemaphore
EnterCriticalSection
ReleaseMutex
ReleaseSRWLockShared
SetEvent
api-ms-win-core-processthreads-l1-1-0
ExitThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentThread
ProcessIdToSessionId
TlsAlloc
TlsFree
CreateThread
SetThreadPriority
GetCurrentProcessId
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
FreeResource
LoadStringA
SizeofResource
GetProcAddress
LockResource
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameW
LoadLibraryExA
FreeLibrary
LoadLibraryExW
LoadResource
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-kernel32-legacy-l1-1-0
PulseEvent
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
HeapSize
GetProcessHeap
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
SetCurrentDirectoryW
SearchPathW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-errorhandling-l1-1-0
SetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-core-privateprofile-l1-1-0
GetPrivateProfileStringW
GetProfileStringW
api-ms-win-core-file-l1-1-0
GetFileTime
GetFileAttributesW
GetFileSize
CompareFileTime
CreateFileW
api-ms-win-core-path-l1-1-0
PathCchIsRoot
PathCchStripToRoot
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetACP
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-core-util-l1-1-0
Beep
api-ms-win-core-kernel32-private-l1-1-2
CheckForReadOnlyResource
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-kernel32-private-l1-1-0
_lread
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
CloseDriver
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
OpenDriver
PlaySound
PlaySoundA
PlaySoundW
SendDriverMessage
WOWAppExit
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
joyConfigChanged
joyGetDevCapsA
joyGetDevCapsW
joyGetNumDevs
joyGetPos
joyGetPosEx
joyGetThreshold
joyReleaseCapture
joySetCapture
joySetThreshold
mciDriverNotify
mciDriverYield
mciExecute
mciFreeCommandResource
mciGetCreatorTask
mciGetDeviceIDA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDFromElementIDW
mciGetDeviceIDW
mciGetDriverData
mciGetErrorStringA
mciGetErrorStringW
mciGetYieldProc
mciLoadCommandResource
mciSendCommandA
mciSendCommandW
mciSendStringA
mciSendStringW
mciSetDriverData
mciSetYieldProc
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
mmsystemGetVersion
sndPlaySoundA
sndPlaySoundW
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetSystemTime
timeGetTime
timeKillEvent
timeSetEvent
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.guids
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=82, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=21, id=261, version=33145,
count=14, id=260, version=33145,
count=3, id=257, version=33145,
count=1402, id=1, productName=Unmarked objects,
count=1, id=256, version=33145,
count=21, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
x64/AdonisUI.ClassicTheme.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8103f2cce6a864ceefe6c5b0c05087ac85ab04a2abf150e93bc9db90c54d9d20
- MD5 8a1b183bca062f48402c74f2daba7b92
- SHA1 d9417bf78b3b37d668c08e67f3c0f21dbc6dc11e
- SHA512 0f5120fa9ed24d2a49b82cdc62113302002ccc5e1cf389cc28830f36b2915f876bdf77094fa6dfa312fc01b6f482465297fa734509511fa7e72285569ce57e87
- SSDEEP 6144:aMNTja9KIKf5RCs1ussMKlzI5iJQn9gu5DPOvObo:5Za9KIjs1ussMKlzI5lo
- TLSH T18B542B8429204C79DA368B7BDEC2A40D3F3D805C96F1A5176DDA3E5CDCAE24B0A2517F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
299130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\src\AdonisUI.ClassicTheme\obj\Release\net45\AdonisUI.ClassicTheme.pdb
mscoree
_CorDllMain
Name
.text
Size
284KB
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
x64/AdonisUI.ClassicTheme.xml
- SHA256 e97828272a7a30780a4b92c791ae94b3adc4268463c53f81df0a27a372c77348
- MD5 68a996036a022036a7260c21aca60d8d
- SHA1 f7ccc93b98ede087327b9a2ee33b49084adaaa7f
- SHA512 0106caeecb55ff8599bc6f666e19306354e53bf2638c6298c8148a1e956ef7fdd04d79575abebd25e4df9d7e21f5996b49b293e0f2b03b53d81ebe95a1759997
- TLSH T1C0C09B02D5D4951A0D33151B6FF3E801FE05D71750D1103AB4AC1B475F3544812A7535
- MD5 SHA1 SHA512 TLSH
x64/AdonisUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 db46b6106dc1b30041ce3f287ded91166895ff3f1928250fc79dd46c444b1e45
- MD5 3d4c8b6aad28ec574e56ccda22b34ef3
- SHA1 bc22ac7097e597fba3d7367b2fd5c61adff28941
- SHA512 fc56241e65dc7bcc678a2af92f79bda017ceb3f7c4f203c7e9ce753d573da868608a6f56545c0d181a625737278b7b73223e5dcce85bf1f3c5b7b1b06e5c5739
- SSDEEP 3072:fuZPAdWKbu3355s555GPQKljrKxX0yAbTxin1YzqHf0llbS1sjZ73h39Iwj:GydWDrKxG3h39Iw
- TLSH T123F32A8423BB493EF7BF4BB4987520194F76E5971593CB0E4E8430ED9A6A70E06522F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
173338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\src\AdonisUI\obj\Release\net45\AdonisUI.pdb
mscoree
_CorDllMain
Name
.text
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
x64/AdonisUI.xml
- SHA256 3dbc7b701f01ca178359a1de543792c919ed49c16dfa06d766c545c8ffa51c50
- MD5 a310f32ce7eb9a28e9b0fa5e87ac71de
- SHA1 bb8204232932dfea23d2fa76b44954ac559922aa
- SHA512 3ca0a763383092c5df00efed0a02a13b2413a17e6b0f966364bfe932a2cf8992450778dad730d9afcdc7b8ee090e3e7c124d3f38e92a213403f38120e87f6805
- SSDEEP 1536:sBjMs3uxMVuQHWVhVRVeHELtQyVuHEItQyk3n2q6RD3CKlJvJk3IwniCbgnHCoaf:sg8MA0OhcSc
- TLSH T1C573CC687AC88F36587A010AFF96F889FE1548330059682B388D3D579FBBC86527F5D1
- MD5 SHA1 SHA512 SSDEEP TLSH
x64/SQLite.Interop.dll
- IMPHASH a42f73521c784fa06f1d886fcbcefcba
- SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
- MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
- SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
- SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
- SSDEEP 24576:YPUxmkgSxPgobZPRjZ22H6edtOZzWySRO3mlE0i/Yl5P+qF+8k+ao/si6:8UxXPgo8e6WYBSJZSS5P97I
- TLSH T154858D4AB3B8019DD567C17DC6675B07EBB174022310ABDB17A08AAA2F13FE5177E324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
6140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo
wintrust
WinVerifyTrust
kernel32
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
WriteConsoleW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
AreFileApisANSI
SetEnvironmentVariableA
RaiseException
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
lstrcmpiW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
SI00b5de0dbe05adc8
SI00f2097672333949
SI013768ea228eaf06
SI03ee1370ff2172fd
SI050169b0f137dcac
SI061f9351f6b79d40
SI066df4a47deb7b95
SI075258fe7332f5c9
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0b65268e19d3b81d
SI0e7c9abcb195c68c
SI0f556a49067bf550
SI0fe7fecb92f1b44b
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI15d5f41c81892f13
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI24f5c83eaddd65e8
SI252aeb4a9d3dc2ff
SI2b074e8cf29cb472
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI349980d776ee39ac
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3974af1f94b94613
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI57335d3e329eea8d
SI5887bf867911838d
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI64119fb980b7e962
SI6479b9cf07b87f67
SI674c3bc07fc17979
SI6901b186cfd089f2
SI690ffdcfd9cda629
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI6e6c544c028b2de9
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI72b05b1ad5f34d61
SI75fe921d50a95fe0
SI768767362ea03a94
SI77ffe3fede90bfbb
SI783104ea11038afc
SI79f6c64948ab63d2
SI7a4943591207dd14
SI7b97ee05aa1e64c7
SI7c373366af3ee2f7
SI7cd7250399b1ea60
SI7da3b9691a73b4a2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8dd2c969f2a6a31e
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9bf461db9bf83c22
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SI9ea49276dcf9849f
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa1d7e21a548b910c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIa8e1a742a358dc07
SIa9b758d3ae2e9aea
SIab3ed5feb3c43f0c
SIada7f27769d7f95b
SIae9562605f0b7c06
SIb391996b7b633820
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIb84ee16d149e7562
SIb94a6bc97d77e69f
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc0bb4eab77f5a999
SIc21d402df09e0c69
SIc26100c97b176329
SIc28b5d2d1f102994
SIc2d8715ee8c9e908
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIc5d5610a73781fac
SIc8c63d94dd03040b
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd2334250b08e199
SIcd6b4ac0aeff7202
SId00f524badf4f5cf
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdbbe1b52f304f379
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIdca7c218fe9393fb
SIde347320a2d725fa
SIdeb28053ce71d5b4
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe2cb515ade8c0235
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIeea5cda6d9846aa5
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8090240c1414098
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfcfad09d1b0a60ec
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
263KB
Virtual Size
263KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=128, id=243, version=40116,
count=37, id=242, version=40116,
count=7, id=259, version=24123,
count=21, id=261, version=24123,
count=16, id=260, version=24123,
count=8, id=203, version=65501,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=153, id=1, productName=Unmarked objects,
count=1, id=264, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
x86/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
- MD5 0cf454b6ed4d9e46bc40306421e4b800
- SHA1 9611aa929d35cbd86b87e40b628f60d5177d2411
- SHA512 85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
- SSDEEP 49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
- TLSH T15EE57B0577F81E67E56ACBB7D1B14012D3F1F82AB363DB5B5882633A1C13B805D826A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 19, 2021
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 18, 2020 - Mar 23, 2023
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
3221146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BouncyCastle.Crypto.pdb
mscoree
_CorDllMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
x86/BouncyCastle.Crypto.xml
- SHA256 de94c224474fad71cd45a2fcd802976f16b8edf7dc290f1e353752d495703e10
- MD5 253aec9d04057e346233763b2ae93a11
- SHA1 2a08b5e3f527b717aae41b0a295b6b4b4a446e9f
- SHA512 7f71600be96bcf1df1748e3715ecb939706d19ea3e19b6d67497718a57ce6b0c8b985aab2b24bf3a2f8a58f471b03e0f807ef3b7927192d341609975e7edbd23
- SSDEEP 12288:Pky4oeqjABNM7fN62FuyEyp/0nNe8C2cjkTYExbXAJv:PkHoeqUBiZoPYYbXk
- TLSH T1F18573147FC1DA621CB283115D24F680FE292E23211A9E24B0DDAE5B5F77E5AE3FB540
- MD5 SHA1 SHA512 SSDEEP TLSH
x86/SQLite.Interop.dll
- IMPHASH 39ace63b362beb47a2a7a8202a5c4f2d
- SHA256 83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae
- MD5 8be215abf1f36aa3d23555a671e7e3be
- SHA1 547d59580b7843f90aaca238012a8a0c886330e6
- SHA512 38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b
- SSDEEP 24576:eiDAYMz2epP8AEXn8z7qsyb8c+gntHKuvKtBLtTvD0nsrFSK96fYlYyv:1AYMza36enEuyjpTV96A2yv
- TLSH T1D5558C26FA8390A1EDD610B592FE6FB76C3D120A431808E7E3A41CB55A601D3767E74F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
5844
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo
wintrust
WinVerifyTrust
kernel32
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
WriteConsoleW
lstrcmpiW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SetEnvironmentVariableA
AreFileApisANSI
DecodePointer
SetStdHandle
RaiseException
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
MapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
SI00b5de0dbe05adc8
SI00f2097672333949
SI03ee1370ff2172fd
SI066df4a47deb7b95
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0e7c9abcb195c68c
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI252aeb4a9d3dc2ff
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI674c3bc07fc17979
SI6901b186cfd089f2
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI75fe921d50a95fe0
SI768767362ea03a94
SI783104ea11038afc
SI79f6c64948ab63d2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIae9562605f0b7c06
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc26100c97b176329
SIc28b5d2d1f102994
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd6b4ac0aeff7202
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIde347320a2d725fa
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
_SI013768ea228eaf06@8
_SI050169b0f137dcac@12
_SI061f9351f6b79d40@8
_SI075258fe7332f5c9@0
_SI0b65268e19d3b81d@12
_SI0f556a49067bf550@8
_SI0fe7fecb92f1b44b@12
_SI15d5f41c81892f13@8
_SI24f5c83eaddd65e8@4
_SI2b074e8cf29cb472@16
_SI349980d776ee39ac@12
_SI3974af1f94b94613@12
_SI57335d3e329eea8d@12
_SI5887bf867911838d@12
_SI64119fb980b7e962@12
_SI6479b9cf07b87f67@8
_SI690ffdcfd9cda629@8
_SI6e6c544c028b2de9@4
_SI72b05b1ad5f34d61@12
_SI77ffe3fede90bfbb@32
_SI7a4943591207dd14@4
_SI7b97ee05aa1e64c7@12
_SI7c373366af3ee2f7@4
_SI7cd7250399b1ea60@4
_SI7da3b9691a73b4a2@12
_SI8dd2c969f2a6a31e@12
_SI9bf461db9bf83c22@8
_SI9ea49276dcf9849f@12
_SIa1d7e21a548b910c@4
_SIa8e1a742a358dc07@8
_SIa9b758d3ae2e9aea@12
_SIab3ed5feb3c43f0c@0
_SIada7f27769d7f95b@4
_SIb391996b7b633820@36
_SIb84ee16d149e7562@12
_SIb94a6bc97d77e69f@8
_SIc0bb4eab77f5a999@20
_SIc21d402df09e0c69@8
_SIc2d8715ee8c9e908@4
_SIc5d5610a73781fac@12
_SIc8c63d94dd03040b@44
_SIcd2334250b08e199@112
_SId00f524badf4f5cf@20
_SIdbbe1b52f304f379@4
_SIdca7c218fe9393fb@24
_SIdeb28053ce71d5b4@12
_SIe2cb515ade8c0235@12
_SIeea5cda6d9846aa5@12
_SIf8090240c1414098@4
_SIfcfad09d1b0a60ec@20
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=241, version=40116,
count=128, id=243, version=40116,
count=39, id=242, version=40116,
count=23, id=259, version=24123,
count=22, id=261, version=24123,
count=15, id=260, version=24123,
count=8, id=203, version=65501,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=152, id=1, productName=Unmarked objects,
count=1, id=264, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,