Kainite Spoofer.zip
- SHA256 036587a1174a9b929618ffefc675243a03ac94f7bf8c6d4ec0dbd4e26f707ed2
Password
68579
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kainite Spoofer.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Kainite Spoofer.zip
- Size 2.0MB
- Sample260908-yv55fsxtcv
- SHA256 036587a1174a9b929618ffefc675243a03ac94f7bf8c6d4ec0dbd4e26f707ed2
- MD5 aadaa091811517d18bb846afdffd0dab
- SHA1 6baaffca11e09c5a8cac84e7b58bd96c4fdc48b6
- SHA512 1cf77cf37b5889f028d0a8603c73fc211087d11f8b48b3a1830c13a47c173049091c3535cb1ed0a60ccd401ab2e6dea1b01caf2f8389dc327131906f4133bef4
- SSDEEP 49152:fs850Dz96RE9BIcsDebcDuRi+Co5QvWu61vvifeyucG3Batp:ft0ttEewDuE/gJvpf30T
- TLSH T1D1A53306C2398F2BE30FB21D6164169F4AE7FDBD7A90B786516509A1F1EC3E3B201649
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Kainite Spoofer.exe unpack001/KainiteCleaner.exe unpack001/mapper.exe unpack001/mapper2.exe
File Explorer
-
Kainite Spoofer.zip.zip 2.0MB
-
Kainite Spoofer.exe.exe 2.2MB
-
KainiteCleaner.exe.exe 265KB
-
mapper.exe.exe 143KB
-
mapper2.exe.exe 150KB
Kainite Spoofer.exe
- IMPHASH ed1f7bd639470bfab69e26fd99a7ecb3
- SHA256 78fae44c70768b2aaca9b3c994020ff4fd7c3a64fb53e8bd4ff2ddaeb1349e99
- MD5 7af889eee37a8cca17654b8964dd34bf
- SHA1 0827b539c4007f7e250bc0eec7446f3619a2aec1
- SHA512 567abcbf78f9d9960103d25b1287f936e85cf4d5370c6507fa581d0d36947b4fb5bba34dc255cfb67cf818d10acff5bab91fbb83bb1f604ab541be81db61e617
- SSDEEP 49152:+Sp21nIDzfUlM3XqcW7e/cnaRmSi4lAJkacxdFG3CaY+g:P1Phie0naq3UXFzv
- TLSH T1D3B50205B1E5286FC0B9E03A916E6207FA72785943105EE3B7D0C9BD2BD62EC7775B02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
68579
Minor OS version
0
Major OS version
6
Entry point
546240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Riley\source\repos\Kainite Spoofer\Build\Kainite Spoofer.pdb
kernel32
CloseHandle
lstrcmpiA
IsDebuggerPresent
CheckRemoteDebuggerPresent
Sleep
GetFileInformationByHandleEx
AreFileApisANSI
CreateFile2
CreateToolhelp32Snapshot
GetFileAttributesExW
Process32NextW
FindFirstFileW
FindClose
GetLocaleInfoEx
FormatMessageA
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
GetStartupInfoW
OpenProcess
CreateMutexA
GetCurrentProcess
GetModuleFileNameA
QueryPerformanceCounter
FreeLibrary
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Process32FirstW
GetLastError
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
user32
LoadCursorW
SetCapture
IsWindowUnicode
GetMessageExtraInfo
UpdateWindow
FindWindowA
SetCursor
ScreenToClient
GetCapture
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
GetForegroundWindow
ReleaseCapture
TrackMouseEvent
GetKeyState
ClientToScreen
DefWindowProcW
DestroyWindow
SetWindowRgn
CreateWindowExW
UnregisterClassW
RegisterClassExW
wsprintfA
SetCursorPos
ShowWindow
DispatchMessageW
PeekMessageW
EnumWindows
TranslateMessage
PostQuitMessage
GetClientRect
gdi32
CreateRoundRectRgn
advapi32
SetSecurityInfo
SetEntriesInAclW
shell32
ShellExecuteA
ole32
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
oleaut32
VariantInit
SysFreeString
VariantClear
SysAllocString
imm32
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
msvcp140
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Incref@facet@locale@std@@UEAAXXZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?good@ios_base@std@@QEBA_NXZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Mtx_unlock
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
d3d11
D3D11CreateDeviceAndSwapChain
mpr
WNetGetProviderNameA
bcrypt
BCryptDestroyHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
ws2_32
listen
WSACleanup
WSAStartup
accept
inet_addr
bind
select
send
closesocket
socket
recv
htons
setsockopt
winhttp
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpCloseHandle
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpQueryOption
WinHttpReadData
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
memmove
memcpy
memchr
__std_terminate
strstr
__C_specific_handler
__std_exception_destroy
__std_exception_copy
strrchr
__current_exception
__current_exception_context
_CxxThrowException
memcmp
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
ftell
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-string-l1-1-0
wcslen
strnlen
strcat_s
towlower
strncpy_s
strcmp
strlen
tolower
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-runtime-l1-1-0
_exit
_initterm_e
_c_exit
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_set_app_type
_seh_filter_exe
abort
_initialize_onexit_table
_configure_narrow_argv
_cexit
_crt_atexit
_errno
_register_onexit_function
_register_thread_local_exe_atexit_callback
terminate
exit
_beginthreadex
system
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
log2
ceilf
sinf
__setusermatherr
acosf
sqrtf
cosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
Name
.text
Size
547KB
Virtual Size
547KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.vlizer
Size
1.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35721,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=39, id=261, version=35721,
count=2, id=123, version=2207,
count=3, id=260, version=35222,
count=33, id=257, version=35222,
count=345, id=1, productName=Unmarked objects,
count=11, id=265, version=36247,
count=1, id=255, version=36247,
count=1, id=258, version=36247,
KainiteCleaner.exe
- IMPHASH 3f84bd6d70a3c62c12c3f3729dd0e096
- SHA256 fc149d9723de969001e545f33b7e3bbc03ae8b782ddcf3d96fc41d318c61839f
- MD5 dfcdb246b853acef5465c3acd7eca0b7
- SHA1 440b4318803fad3d34461ed282a5bfcdb87a754d
- SHA512 a1e65c40db7f8d5b20300b1312737c9c2a42b1caad13db0b834b1a1c6b2c1829e7293161e8ee9cd6775e4c232f42698d8fb9ec20b283bd6ef5d37ceb959b9f9c
- SSDEEP 6144:PUm3OLY2B+Bp7/dACoaTFX0hCU2uhSk2Y:8m3OM2Up7/dAIFXG
- TLSH T165441B427B654064E8767332D2161E05ABB272ABE501E7D603D452294EA3BC7CFB93CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
68579
Minor OS version
0
Major OS version
6
Entry point
14768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
ShowWindow
kernel32
EnterCriticalSection
WriteConsoleW
GetStdHandle
GetCommandLineA
GetEnvironmentVariableA
CreateFileA
DeleteFileA
GetFileSizeEx
ReadFile
SetFileAttributesA
SetFilePointer
SetFilePointerEx
WriteFile
GetTempPathA
GetTempFileNameA
CloseHandle
SetHandleInformation
GetLastError
CreatePipe
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
Sleep
ExitProcess
TerminateProcess
CreateProcessA
GetModuleFileNameA
lstrcpynA
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
AllocConsole
SetConsoleTitleA
GetConsoleWindow
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
RtlUnwindEx
SetLastError
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetModuleFileNameW
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=140, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=40, id=261, version=33030,
count=16, id=260, version=33030,
count=17, id=259, version=33030,
count=5, id=257, version=30795,
count=108, id=1, productName=Unmarked objects,
count=1, id=260, version=33135,
count=1, id=255, version=33135,
count=1, id=258, version=33135,
mapper.exe
- IMPHASH 7156fe31464be3accd1d42564a61316b
- SHA256 5586c8e188517af925d75b3b741e3c88ea22f5064b5cfbbb30515b2f04d5e066
- MD5 c2f4fc57c1a85661a9fdeaedc6c6cce9
- SHA1 86635ed430198ae897c4e0bc4b2309f8a5960885
- SHA512 bfd42b6287ce3c8cd035274ec6ea5be058085802876acb80302c91d47dc8b7c33e8bf72675a64cbf4052698231ce086add98f16ea68f2d892d780c113e30c773
- SSDEEP 1536:4jRuyAaUcQej+TGnrhcqA6ZjVX7U1X4GAjFEwk4FKSLIuiYhRPQH0:43N+TGqKZVX7SAjFEwk4MIhQU
- TLSH T1B4E33C16A7A51069E2B6DAB8CEA24502FB727C414778D7CF175049B90F32BD07F3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
68579
Minor OS version
0
Major OS version
6
Entry point
74668
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Riley\Downloads\RTCore64_Vulnerability-main\RTCore64_Vulnerability-main\x64\Release\RTCore64_Vulnerability.pdb
kernel32
GetCurrentThreadId
GetModuleHandleA
OpenProcess
GetLastError
CreateFileA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateFileW
DeviceIoControl
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
SetUnhandledExceptionFilter
GetTempPathW
GetModuleHandleW
FormatMessageA
GetLocaleInfoEx
VirtualAlloc
VirtualFree
SetLastError
GetFileAttributesExA
CreateDirectoryA
GetModuleFileNameA
InitializeSListHead
GetSystemTimeAsFileTime
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
LocalFree
user32
GetShellWindow
GetWindowThreadProcessId
advapi32
RegCloseKey
RegDeleteTreeW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
ole32
StringFromGUID2
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1_Lockit@std@@QEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
ntdll
RtlAdjustPrivilege
NtQuerySystemInformation
NtUnloadDriver
NtLoadDriver
RtlInitUnicodeString
dbghelp
SymCleanup
SymLoadModuleEx
SymUnloadModule64
SymSetOptions
SymInitialize
SymFromName
urlmon
URLDownloadToFileA
shlwapi
PathFileExistsA
PathRemoveFileSpecA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
__std_terminate
memcmp
__std_exception_copy
__std_exception_destroy
memcpy
memset
_CxxThrowException
memmove
__current_exception_context
__current_exception
wcsstr
api-ms-win-crt-convert-l1-1-0
_itoa_s
wcstombs_s
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fread
fsetpos
__acrt_iob_func
ungetc
__stdio_common_vfprintf
_set_fmode
fputc
setvbuf
fgetpos
__stdio_common_vsprintf
fwrite
_get_stream_buffer_pointers
__p__commode
fgetc
fflush
fclose
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_initialize_wide_environment
__p___argc
__p___wargv
_configure_wide_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_invoke_watson
terminate
_crt_atexit
abort
_initialize_onexit_table
_seh_filter_exe
_c_exit
_cexit
_register_onexit_function
api-ms-win-crt-filesystem-l1-1-0
_wremove
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsicmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=17, id=257, version=33145,
count=268, id=1, productName=Unmarked objects,
count=7, id=265, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
mapper2.exe
- IMPHASH fe1529edef766e6c0d25b8ae1722ece5
- SHA256 147ed184ad10de228555bb14fb95ec7a11e99a4d8ca9c1ffcce144f4da97bbc8
- MD5 6cfdd01a1d3e84dd6d048ff226ed5fe8
- SHA1 9a9d6091d8118e00da130a79f205e6a0fedbed88
- SHA512 ee3d3b6473888310b0d854014d59c2c888f1eb404df6055a4a041b28f6942e35891d7ed858c9be196d683889678912913c3685f007e4f14ced3a27724d643ea1
- SSDEEP 3072:WoRUjZEY7IDfVETlwkwUmJTQSaMm5/6oaXh4NqO+w:fUZEY7qfol5cWlTr+
- TLSH T112E32A1797A5106EE1B7D6B9CAB24911EB727C550B74D2CF135048BA0F32BD0BA3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
68579
Minor OS version
0
Major OS version
6
Entry point
64844
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Riley\Downloads\kdmapper-master\x64\Release\kdmapper_Release.pdb
kernel32
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetModuleHandleA
GetTempPathW
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
CreateFileW
VirtualAlloc
DeviceIoControl
SetUnhandledExceptionFilter
VirtualFree
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
user32
GetShellWindow
GetWindowThreadProcessId
advapi32
RegCloseKey
RegDeleteTreeW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
ntdll
NtLoadDriver
NtUnloadDriver
NtQuerySystemInformation
RtlAdjustPrivilege
RtlInitUnicodeString
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
_CxxThrowException
__std_terminate
wcsstr
__std_exception_copy
__std_exception_destroy
memset
__current_exception_context
__current_exception
__C_specific_handler
memmove
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fread
fsetpos
ungetc
_get_stream_buffer_pointers
fputc
setvbuf
fgetpos
fwrite
_set_fmode
__p__commode
fgetc
fflush
fclose
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
_invoke_watson
__p___wargv
_get_initial_wide_environment
_initterm
_configure_wide_argv
terminate
_c_exit
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
__p___argc
abort
_register_thread_local_exe_atexit_callback
_initterm_e
_exit
exit
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_wremove
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsicmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=235, id=1, productName=Unmarked objects,
count=7, id=265, version=35220,
count=1, id=255, version=35220,
count=1, id=258, version=35220,