SteamActivationTool.zip
- SHA256 9f9a5e56ec6916835f16fcc51cb0e43ba2dafcf63e483710e27084059cd9a473
Overview
overview
7Static
static
3SteamActiv...ol.zip
windows10-2004-x64
1SteamActiv...ol.zip
windows11-ltsc_2024-x64
1SteamActiv...ol.exe
windows10-2004-x64
7SteamActiv...ol.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...zU.dll
windows10-2004-x64
3$PLUGINSDI...zU.dll
windows11-ltsc_2024-x64
3app.7z
windows10-2004-x64
1app.7z
windows11-ltsc_2024-x64
1bin/nod64.dll
windows10-2004-x64
1bin/nod64.dll
windows11-ltsc_2024-x64
1consCn
windows10-2004-x64
3consCn
windows11-ltsc_2024-x64
3consEn
windows10-2004-x64
3consEn
windows11-ltsc_2024-x64
3core.dll
windows10-2004-x64
1core.dll
windows11-ltsc_2024-x64
1dwmapi.dll
windows10-2004-x64
1dwmapi.dll
windows11-ltsc_2024-x64
1hid.dll
windows10-2004-x64
1hid.dll
windows11-ltsc_2024-x64
1versions.dll
windows10-2004-x64
1versions.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SteamActivationTool.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SteamActivationTool.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SteamActivationTool.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
SteamActivationTool.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsis7zU.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsis7zU.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
app.7z
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
app.7z
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
bin/nod64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
bin/nod64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
consCn
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
consCn
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
consEn
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
consEn
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
dwmapi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
dwmapi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
hid.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
hid.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
versions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
versions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target SteamActivationTool.zip
- Size 1.5MB
- Sample260922-kw9blssemb
- SHA256 9f9a5e56ec6916835f16fcc51cb0e43ba2dafcf63e483710e27084059cd9a473
- MD5 d04e1edc42c32d13ad2231a14494d533
- SHA1 76c0e6e3d1e3c7252843382b7eb9dd018136b6b7
- SHA512 ee74ede27fee37ade6257aa7fdaed3ea649391110816c85a0b88f40418eb29610cb769a085baa0d505b085b2975e3635ae4208562cbae178ec80de4e7c2c67f3
- SSDEEP 24576:qQ3nbQmWwoJpgIxYw/VlqylUlBYVMyBkwrLJqkOwK/S5sgJwR3J:q4nhWtpgM/VDSBYRBkfUKksTb
- TLSH T1F965335D3B110C8EC5A1CEB422D2286FCF7F6C71B166471367807F99A514A92FA8C1FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/$PLUGINSDIR/nsExec.dll unpack002/$PLUGINSDIR/nsis7zU.dll unpack003/core.dll unpack003/dwmapi.dll unpack003/versions.dll unpack003/xinput1_4.dll - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/SteamActivationTool.exe unpack003/hid.dll
File Explorer
-
SteamActivationTool.zip.zip 1.5MB
-
SteamActivationTool.exe.exe 1.5MB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/modern-header.bmp25KB
-
$PLUGINSDIR/modern-wizard.bmp150KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/nsExec.dll.dll 7KB
-
$PLUGINSDIR/nsis7zU.dll.dll 313KB
-
app.7z.7z 1.2MB
-
bin/nod64.dll48B
-
consCn128B
-
consEn128B
-
core.dll.dll 2.8MB
-
dwmapi.dll.dll 104KB
-
hid.dll.dll 156KB
-
versions.dll.dll 693KB
-
xinput1_4.dll.dll 144KB
SteamActivationTool.exe
- IMPHASH 7eae418c7423834ffc3d79b4300bd6fb
- SHA256 02d8fcb60e9fdf840ebbb723e91e93bd4af7955146ab115f13888ec3e75ef873
- MD5 e2504c283f08297657bccda9b22468f4
- SHA1 c8659feb5972e1aa41855e116937e4732ff6312c
- SHA512 665443461149a9f324a23919347b134efd3dd9d4eea6c342f34bca1d946d098f319417d5884426f3240cd2e8cacd86bed897525bc8d48112c0f5b76ef70ac9fe
- SSDEEP 24576:0Q3nbQmWwoJpgIxYw/VlqylUlBYVMyBkwrLJqkOwK/S5sgJwR3w:04nhWtpgM/VDSBYRBkfUKksTG
- TLSH T17C65335D3B110C8EC5A1CEB422D2286FCF7F6C71B166471367807F99A514A92FA8C1FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
30:8e:e7:1b:22:fd:1f:47:1c:94:f6:0c:8c:4c:2c:ea:d1:81:17:5d:6e:c6:67:7c:71:95:32:82:93:35:90:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US
Chains
Sep 15, 2026
CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US
CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
PE Signature issue
Digest
de:61:bf:c9:82:05:49:bb:53:c5:35:87:25:b9:ba:86:ad:c6:1a:7b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US
Chains
Sep 15, 2026
CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US
CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Subject
CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
43:c1:0b:1c:00:00:00:00:51:d3:73:da
Issuer
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 10, 2015 - Nov 10, 2030
Subject
CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US
Serial Number
50:57:28:6e:40:33:fc:b0:00:00:00:00:55:65:f5:ac
Issuer
CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 4, 2016 - Mar 20, 2017
Minor OS version
0
Major OS version
4
Entry point
13306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
MoveFileW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
lstrcmpW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
ReadFile
MulDiv
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
FreeLibrary
GetPrivateProfileStringW
GetModuleHandleW
LoadLibraryExW
user32
GetWindowRect
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
ScreenToClient
EnableMenuItem
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
SystemParametersInfoW
EndDialog
RegisterClassW
DialogBoxParamW
CreateWindowExW
GetClassInfoW
DestroyWindow
CharNextW
ExitWindowsEx
SetWindowTextW
LoadImageW
SetTimer
ShowWindow
PostQuitMessage
wsprintfW
SetWindowLongW
FindWindowExW
IsWindow
CreatePopupMenu
AppendMenuW
GetSystemMetrics
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
shell32
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHFileOperationW
SHBrowseForFolderW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ord17
ImageList_Destroy
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=164, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- TLSH T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10719
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 8ddea157da0135a978a475b844f31140e80a7914d3bcaf17dd6f4346e640f7fe
- MD5 f1928d020ebd3bf2c54fb46b3253f2a9
- SHA1 420e69ca73d27306dde5fb79c3421b19bf089f1d
- SHA512 9930cf22d313475a01ec6c9d5c916c1326699e7dd94c55791702b432948aed54dc4100d8e86aaa89549166a6616a49aa47fbba5a646f22f33b08b92ca474c813
- SSDEEP 96:9uEW+fNQVVenO/7oTieu8RGGPv/DFYsP:NZlaVB/7eieu8RGGLd
- TLSH T140C2E9AEB933693ECD9911B41164A7FD8B302C5C7A40666E411FF8DD0FF31CA3569852
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
- MD5 3614a4be6b610f1daf6c801574f161fe
- SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
- SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
- SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
- TLSH T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- TLSH T156120992E6A450B3C5E6133F35AA2B2DCBBD5325B0922C0083738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc
user32
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH 488b9c61d28b8855f328d854ae7601be
- SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
- MD5 f27689c513e7d12c7c974d5f8ef710d6
- SHA1 e305f2a2898d765a64c82c449dfb528665b4a892
- SHA512 734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
- SSDEEP 96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
- TLSH T1B1E11A7675C03DF7D08988706C1D3A1B93F4D5312BBA01B08EAB29E675E1AE7E538742
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyW
IsDBCSLeadByteEx
CreateProcessW
GetStartupInfoW
CreatePipe
GetVersion
DeleteFileW
lstrcmpiW
lstrlenW
lstrcatW
TerminateProcess
MultiByteToWideChar
MapViewOfFile
CreateFileMappingW
CreateFileW
Sleep
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
GetModuleHandleA
GetCurrentProcess
ExitProcess
lstrcpynW
GetCommandLineW
GlobalReAlloc
CloseHandle
UnmapViewOfFile
CopyFileW
user32
SendMessageW
CharNextW
CharPrevW
FindWindowExW
wsprintfW
CharNextExA
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsTextUnicode
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
418B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsis7zU.dll
- IMPHASH b6854db8fde386e6ef367d623b9e75d8
- SHA256 e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9
- MD5 06a47571ac922f82c098622b2f5f6f63
- SHA1 8a581c33b7f2029c41edaad55d024fc0d2d7c427
- SHA512 04b3d18042f1faa536e1393179f412a5644d2cf691fbc14970f79df5c0594eeedb0826b495807a3243f27aaa0380423c1f975fe857f32e057309bb3f2a529a83
- SSDEEP 6144:rA9ssOlBrbYr5UP4m3mC/FvBbhQ1JzI+yQKiJGxdNtsm0:r2S165UP4mL/FvBtC8zQdSDmm0
- TLSH T196649D22B690C07AC5AF03316D18B7A491FEB6718A34C70BF7D84B5E2E771C29A14B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
190958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LeaveCriticalSection
DeleteCriticalSection
CloseHandle
GetLastError
InitializeCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetStdHandle
ReadFile
WriteFile
WaitForMultipleObjects
AreFileApisANSI
SetFileApisToOEM
SetFileApisToANSI
GlobalAlloc
GlobalFree
lstrcpynW
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
CreateDirectoryW
CreateFileW
DeleteFileW
GetFullPathNameW
EnterCriticalSection
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
lstrlenW
MoveFileW
FindClose
FindFirstFileW
GetFileSize
SetEndOfFile
SetFilePointer
GetCurrentProcess
GetSystemInfo
GetModuleHandleW
GetProcAddress
GetStringTypeW
WriteConsoleW
SetFilePointerEx
SetStdHandle
LCMapStringW
GetVersionExW
VirtualFree
GetTempFileNameW
VirtualAlloc
OutputDebugStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapFree
HeapAlloc
EncodePointer
DecodePointer
CreateThread
GetCurrentThreadId
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
HeapReAlloc
GetCommandLineA
GetProcessHeap
InterlockedDecrement
ExitProcess
GetModuleHandleExW
SetLastError
InterlockedIncrement
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
HeapSize
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
FindWindowExW
SetWindowTextW
GetDlgItem
SendMessageW
wsprintfW
CharLowerW
CharUpperW
oleaut32
VariantCopy
VariantClear
SysAllocStringByteLen
SysAllocString
SysFreeString
Extract
ExtractWithCallback
ExtractWithDetails
Name
.text
Size
218KB
Virtual Size
218KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=207, version=50929,
count=18, id=205, version=50929,
count=110, id=206, version=50929,
count=1, id=188, version=30716,
count=161, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=23, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=119, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
app.7z
- SHA256 0e7293931fa68a052d795015bf7974db31abda38442baf211ec53df94b2974c9
- MD5 cfc881786bfb0b583fce5a1f967906ec
- SHA1 5d624f4249f139154a95fdec1cb4e244a9847237
- SHA512 3e0985f4b0afbb78e9fed783d41ee441e4544fb15a992b6fbb1bb8f5a4098d02cd7fe0e4c1cf8884c1e1f746d4ce1e58a1e06d0a31c43648b60930cbd9f90cb5
- SSDEEP 24576:SnbQmWwoJpgIxYw/VlqylUlBYVMyBkwrLJqkOwK/S5su:SnhWtpgM/VDSBYRBkfUKksu
- TLSH T17945338E3F621D8C8625EAE532C2244BCD7B30B3E55A4325BBC5BD6552046A6B7CC0F7
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/nod64.dll
- SHA256 39d3bab12c1ce54dbd5e870386978517ca52c97e5727ff30e3d8dba706d4bea6
- MD5 fc86ef1e123742d24d74b0cb7b924a7f
- SHA1 5e8d2aa134bc5f4776a96a11f2bef54cad44a3a2
- SHA512 d6ac18616e3381b4343f7721161c371fe58ff9688567a0c4c6e0e8995200d855aba784876f167bb7229fcf6bbfb1c181538ec053cb7c6cf98e1251ed560172b5
- MD5 SHA1 SHA512
consCn
- SHA256 96737e13f3826cfb834940e9a3c73151e48174bd97daf8f5209b904dafdd17f7
- MD5 691f52e60bae6e165bbdec1986498cdf
- SHA1 eb5d11002b6ec238b7ef2a7fd6b476cb5d8c386a
- SHA512 c64239297c48f0881114b04adb95d66f26492da84d774e8679dfbf5ce1d6c2db3b382c921f930b4041c2295c7509e71a55f404bb33a6e07198be8fa7f4ab2fd7
- TLSH T179B02B1840C873C0A016052CC163D80C000D088F504C46B6104CFD450174850074C0D5
- MD5 SHA1 SHA512 TLSH
consEn
- SHA256 96737e13f3826cfb834940e9a3c73151e48174bd97daf8f5209b904dafdd17f7
- MD5 691f52e60bae6e165bbdec1986498cdf
- SHA1 eb5d11002b6ec238b7ef2a7fd6b476cb5d8c386a
- SHA512 c64239297c48f0881114b04adb95d66f26492da84d774e8679dfbf5ce1d6c2db3b382c921f930b4041c2295c7509e71a55f404bb33a6e07198be8fa7f4ab2fd7
- TLSH T179B02B1840C873C0A016052CC163D80C000D088F504C46B6104CFD450174850074C0D5
- MD5 SHA1 SHA512 TLSH
core.dll
- IMPHASH fa0d5486e46c3389586e587a8a377679
- SHA256 c8cde71450b6f21651489c11d7cddaf5a076aa2b5c93f0770df0bf86bfe3030a
- MD5 1b51dbba622efa07e9e9eadd6f26f23b
- SHA1 97aa109c6d27399cbf3bc5dd8a433bc9f7688a84
- SHA512 b2a4da682e59e141432177ccd62a15bb18dfc83f7a6092d8721e40070cae770792a7710ccfb6fc7bfb276d4c11dff48428d0c32a941dcafa6ae2224727a84dee
- SSDEEP 49152:snaEC6Ybl7rbJfdJ3CFL819dXlqiKYgczm0BLEaLk0OB5fy:sYZre8G/czxM
- TLSH T19AD59E16A26840ACD87BC1BCCE575607EBB27C0507609BDF17A0A76A2F73BE5163E710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1721244
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winhttp
WinHttpReceiveResponse
WinHttpWebSocketReceive
WinHttpWebSocketSend
WinHttpSetOption
WinHttpWebSocketClose
WinHttpWebSocketCompleteUpgrade
WinHttpOpen
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpCloseHandle
WinHttpOpenRequest
bcrypt
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptImportKeyPair
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptDecrypt
BCryptEncrypt
BCryptFinishHash
kernel32
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
SetStdHandle
DeleteFileW
CreatePipe
WaitForSingleObject
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
CreateFileA
GetFileSizeEx
CloseHandle
ReadFile
GetCurrentDirectoryA
LoadLibraryA
FreeLibrary
Sleep
GetModuleHandleA
DisableThreadLibraryCalls
K32GetModuleInformation
GetCurrentProcess
OpenProcess
MultiByteToWideChar
QueryFullProcessImageNameA
WideCharToMultiByte
GetExitCodeProcess
GetModuleFileNameA
GetTickCount
CreateThread
CreateFileW
CreateToolhelp32Snapshot
GetSystemDirectoryW
GetWindowsDirectoryW
Module32FirstW
Module32NextW
ReadProcessMemory
K32EnumProcessModules
VirtualQueryEx
GetLastError
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentThreadId
GetTickCount64
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetTempPathW
AreFileApisANSI
GetModuleHandleW
GetCommandLineW
MoveFileExW
GetFileInformationByHandleEx
FormatMessageA
LocalFree
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
WakeConditionVariable
WakeAllConditionVariable
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
LoadLibraryExA
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
FlsGetValue
FlsAlloc
SetFilePointerEx
FlushFileBuffers
GetStdHandle
GetModuleFileNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteFile
ReadConsoleW
GetConsoleMode
GetFileType
SetEnvironmentVariableW
ExitProcess
CreateProcessW
DuplicateHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetProcAddress
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
SetLastError
OutputDebugStringA
GetLogicalProcessorInformation
InitializeSRWLock
InitializeConditionVariable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
user32
EnumWindows
EnumChildWindows
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextW
advapi32
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegGetValueA
shell32
ShellExecuteA
wininet
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetReadFile
InternetOpenUrlA
HttpQueryInfoA
ws2_32
recv
send
closesocket
crypt32
CryptStringToBinaryA
dbghelp
SymFromAddr
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
579KB
Virtual Size
579KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
126KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp00
Size
117KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
233B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
dwmapi.dll
- IMPHASH e44a8b52d6c96b6d42123e58873167aa
- SHA256 874ea6c0b448ccd86de9046fbce4239a03cea599ba5795790608e05fd8d7d9f9
- MD5 bde1bebbe4c514cd7d4e0d943e01db90
- SHA1 304676191ec3f07806aaeae2deac99eb4033a7eb
- SHA512 c9c78f2d5b1821d0935355c0d82ca3de1e9b86279f3722b1163db2dfe29aa23c40f219f635610901d05f93c220839140009d432a9b16919152de12fb0fc6c7e6
- SSDEEP 1536:Z4rCGnpYpx/hfYv1uEdETHbSMGnb8uLop94Nr9EYsW9ydZ9dl6ayq1t:ZQSbAfdY7ne8uL1Nr9vYRcqf
- TLSH T134A34A5777E500BBE1778A78C8A31E059772F8160B509BEF43A0465E2F633E14E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5348
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
GetModuleFileNameA
LoadLibraryA
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
LoadLibraryExW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DllCanUnloadNow
DllGetClassObject
DwmAttachMilContent
DwmDefWindowProc
DwmDetachMilContent
DwmEnableBlurBehindWindow
DwmEnableComposition
DwmEnableMMCSS
DwmExtendFrameIntoClientArea
DwmFlush
DwmGetColorizationColor
DwmGetCompositionTimingInfo
DwmGetGraphicsStreamClient
DwmGetGraphicsStreamTransformHint
DwmGetTransportAttributes
DwmGetUnmetTabRequirements
DwmGetWindowAttribute
DwmInvalidateIconicBitmaps
DwmIsCompositionEnabled
DwmModifyPreviousDxFrameDuration
DwmQueryThumbnailSourceSize
DwmRegisterThumbnail
DwmRenderGesture
DwmSetDxFrameDuration
DwmSetIconicLivePreviewBitmap
DwmSetIconicThumbnail
DwmSetPresentParameters
DwmSetWindowAttribute
DwmShowContact
DwmTetherContact
DwmTetherTextContact
DwmTransitionOwnedWindow
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties
DwmpAllocateSecurityDescriptor
DwmpDxGetWindowSharedSurface
DwmpDxUpdateWindowSharedSurface
DwmpDxgiIsThreadDesktopComposited
DwmpEnableDDASupport
DwmpFreeSecurityDescriptor
DwmpGetColorizationParameters
DwmpRenderFlick
DwmpSetColorizationParameters
DwmpUpdateProxyWindowForCapture
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=139, id=261, version=33145,
count=12, id=260, version=33145,
count=7, id=259, version=33145,
count=9, id=259, version=35403,
count=14, id=260, version=35403,
count=31, id=261, version=35403,
count=3, id=257, version=33145,
count=90, id=1, productName=Unmarked objects,
count=1, id=261, version=35729,
count=1, id=256, version=35729,
count=1, id=255, version=35729,
count=1, id=258, version=35729,
hid.dll
- IMPHASH a194adedf2e90a682dbf72fd0081b08f
- SHA256 335799bac6fa8fdc391da594444a50e4dbf5494f79e51b038011d9af64a9ef76
- MD5 d0279d81b9f8428f710b2d0e3c3c684e
- SHA1 e5059aef07e96a3975eccd74ce41cc8487b3f621
- SHA512 0731d38897e0ba1b359d72a52ce0eb1ef0dde4f67e32912cc2292c1a77cd304b2b03c29e9bf01603fa52f3aa7491b3d57a5bf7d19a445ccd98f407420890baac
- SSDEEP 1536:GI9dwVtYxK8J8Ujkfc4lrt2LZIidk8GVu1F8TH4SM/BC/RMgnEwUUsWzdX9dlEUY:5HwOr2lPKdkozwYrZC/RHEEXV2LdGS
- TLSH T116F36B07B3B544BBF1B7823489A30647E772781217609BDF03A4467A1F273E5AD3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
58:a6:21:cd:58:65:d7:7f:4c:d9:63:46:4d:5f:58:88:6d:3e:2b:2e:10:df:06:9c:f6:19:b1:db:2f:90:a6:f1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
Chains
Sep 15, 2026
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 6, 2011 - Oct 6, 2046
Subject
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
Serial Number
28:58:83:6e:bd:cb:ee:61:83:c6:a9:1e:ac:d2:3c:26
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 30, 2025 - Jun 30, 2026
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Minor OS version
0
Major OS version
6
Entry point
9028
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\vs\steam\劫持\hid\bin\x64\Release\hid.pdb
kernel32
GetModuleFileNameA
GetSystemDirectoryW
GetCurrentDirectoryA
GetModuleHandleA
CopyFileA
DisableThreadLibraryCalls
LoadLibraryA
lstrcatW
LoadLibraryW
CreateThread
GetProcAddress
FreeLibrary
WriteConsoleW
CreateFileW
CloseHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
user32
wsprintfW
MessageBoxW
HidD_FlushQueue
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetConfiguration
HidD_GetFeature
HidD_GetHidGuid
HidD_GetIndexedString
HidD_GetInputReport
HidD_GetManufacturerString
HidD_GetMsGenreDescriptor
HidD_GetNumInputBuffers
HidD_GetPhysicalDescriptor
HidD_GetPreparsedData
HidD_GetProductString
HidD_GetSerialNumberString
HidD_Hello
HidD_SetConfiguration
HidD_SetFeature
HidD_SetNumInputBuffers
HidD_SetOutputReport
HidP_GetButtonArray
HidP_GetButtonCaps
HidP_GetCaps
HidP_GetData
HidP_GetExtendedAttributes
HidP_GetLinkCollectionNodes
HidP_GetScaledUsageValue
HidP_GetSpecificButtonCaps
HidP_GetSpecificValueCaps
HidP_GetUsageValue
HidP_GetUsageValueArray
HidP_GetUsages
HidP_GetUsagesEx
HidP_GetValueCaps
HidP_GetVersionInternal
HidP_InitializeReportForID
HidP_MaxDataListLength
HidP_MaxUsageListLength
HidP_SetButtonArray
HidP_SetData
HidP_SetScaledUsageValue
HidP_SetUsageValue
HidP_SetUsageValueArray
HidP_SetUsages
HidP_TranslateUsagesToI8042ScanCodes
HidP_UnsetUsages
HidP_UsageListDifference
Name
.text
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=138, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=36, id=261, version=35207,
count=5, id=257, version=33145,
count=104, id=1, productName=Unmarked objects,
count=1, id=259, version=35222,
count=1, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
versions.dll
- IMPHASH 3104e0cb29f70a82ba364a281db36f5d
- SHA256 7ed7cc50f9f8375aa71039a89c83adc50ecaa937062696eccc41c4b645f362f3
- MD5 d0a5f3edca57cadc58f2d2a8d77ea670
- SHA1 e17e921ca519d040f69c1714aee8f4d21fb2030a
- SHA512 6c5b88d92e70ae1e39351d7798a4bf9c54b44b7ba1ec9e9f19b9356eeb97bec747a4f55b3bd781a460391387cf22b4957d2a8753ff29fc21a38ea5f87c1e9fbc
- SSDEEP 6144:913g7/uovpRH50+Ic5xCzLqwabPzuTp0gCGNOmX6epRPtUhAUEaGaZxjC8/mJc93:PL+HxT7zuh5OapRPtsA4fYZJxV/cERe
- TLSH T125E46D26AB9401BCE0B6C179CE578D52FB71780903B1AADF07D04AA69F277E44E3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
353644
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
F:\Summary\BIN\video.pdb
crypt32
CryptStringToBinaryA
winhttp
WinHttpSendRequest
WinHttpWebSocketSend
WinHttpSetOption
WinHttpWebSocketReceive
WinHttpWebSocketClose
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpWebSocketCompleteUpgrade
WinHttpOpenRequest
bcrypt
BCryptGetProperty
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptSetProperty
BCryptCreateHash
BCryptDestroyKey
BCryptGenerateSymmetricKey
kernel32
CreateFileW
GetFileAttributesW
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
GetLastError
Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
MoveFileExW
CreateProcessW
WideCharToMultiByte
WinExec
MoveFileW
OutputDebugStringA
ReadProcessMemory
GetCurrentProcess
lstrcmpW
SetLastError
LocalFree
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameA
FindClose
GetSystemInfo
GetProcAddress
CreateFileA
GetSystemDirectoryW
LoadLibraryW
ExitProcess
FreeLibrary
WaitForSingleObject
CreateEventW
CreateThread
GetCurrentProcessId
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
GetModuleFileNameW
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
WriteFile
ReadFile
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
SetStdHandle
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
WriteConsoleW
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwindEx
LoadLibraryExW
VirtualAlloc
SuspendThread
VirtualFree
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
VirtualQuery
ResumeThread
RtlUnwind
VirtualAllocEx
VirtualQueryEx
VirtualProtectEx
WriteProcessMemory
SetEndOfFile
GetCurrentThread
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
CreateDirectoryW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
RtlPcToFileHeader
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetTickCount64
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
user32
wsprintfW
wsprintfA
MessageBoxW
TranslateMessage
RegisterHotKey
DispatchMessageW
UnregisterHotKey
GetMessageW
advapi32
RegSetKeySecurity
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
CryptAcquireContextW
RegNotifyChangeKeyValue
RegCreateKeyA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
CryptDestroyHash
shell32
CommandLineToArgvW
ShellExecuteA
ws2_32
bind
listen
closesocket
send
socket
recv
htonl
htons
setsockopt
WSACleanup
WSAStartup
accept
iphlpapi
GetTcpTable
psapi
GetProcessImageFileNameA
rpcrt4
UuidToStringA
RpcStringFreeA
UuidCreate
DetourFinishHelperProcess
RestartPIDW
Name
.text
Size
513KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=190, id=261, version=33145,
count=9, id=259, version=33145,
count=4, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=19, id=260, version=33145,
count=1, id=262, version=33145,
count=91, id=261, version=35207,
count=31, id=257, version=33145,
count=319, id=1, productName=Unmarked objects,
count=20, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
xinput1_4.dll
- IMPHASH 73b5f5cf5786efe212f075d86ed3096c
- SHA256 b5f273b58e374f2bc4f2004130b39b79fc442bcbcdfc80859863632c6fcec1b6
- MD5 d4d27175d026a3a499489a247c3891ec
- SHA1 e67fba95dda43e915c2b0a07e07a7dbfdb3c57b7
- SHA512 5c3b662b4535a99ec269dfa499634009ec2a22e23c442e70b4992b17c5d248d1d92068fade79bf64097f1f8158fe79d7cc5e60cb24bd966012a679274596770d
- SSDEEP 1536:tqGJz5MZE/5SClK51ybX/x9/5Y3ZwqkcGkUD6OTxad7HRSiNCXw6gW8otwcjHsWZ:00KepvD/WDG0usxAXw6PttSv/NyiS
- TLSH T1F7E35A57B2A500FBE1B78238C9630A05F772B81247609BEF43A847752F277D19D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12100
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\vs\steam\劫持\xinput1_4\bin\x64\Release\xinput1_4.pdb
kernel32
GetModuleHandleExW
OutputDebugStringA
GetSystemDirectoryW
GetCurrentDirectoryA
GetModuleHandleA
CopyFileA
DisableThreadLibraryCalls
LoadLibraryA
lstrcatW
LoadLibraryW
GetProcAddress
FreeLibrary
WriteConsoleW
CreateFileW
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetLastError
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleFileNameW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
user32
wsprintfW
MessageBoxW
DllMain
XInputEnable
XInputGetAudioDeviceIds
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetKeystroke
XInputGetState
XInputSetState
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=35215,
count=12, id=260, version=35215,
count=8, id=259, version=35215,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=32, id=261, version=35207,
count=5, id=257, version=35215,
count=119, id=1, productName=Unmarked objects,
count=1, id=259, version=35221,
count=5, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,