Monotone.zip
- SHA256 1aa211329adf1f187e761b63581b187364f81abdef8ba40a59097589a61246d1
Overview
overview
9Static
static
9Monotone.zip
windows10-2004-x64
1Monotone.zip
windows11-ltsc_2024-x64
1Monotone/Box.bat
windows10-2004-x64
3Monotone/Box.bat
windows11-ltsc_2024-x64
3Monotone/Button.bat
windows10-2004-x64
3Monotone/Button.bat
windows11-ltsc_2024-x64
3Monotone/C...rs.exe
windows10-2004-x64
1Monotone/C...rs.exe
windows11-ltsc_2024-x64
1Monotone/C...s2.exe
windows10-2004-x64
1Monotone/C...s2.exe
windows11-ltsc_2024-x64
1Monotone/C...ew.cfg
windows10-2004-x64
3Monotone/C...ew.cfg
windows11-ltsc_2024-x64
3Monotone/C...ew.exe
windows10-2004-x64
3Monotone/C...ew.exe
windows11-ltsc_2024-x64
3Monotone/C...ck.exe
windows10-2004-x64
7Monotone/C...ck.exe
windows11-ltsc_2024-x64
5Monotone/C...te.vbs
windows10-2004-x64
5Monotone/C...te.vbs
windows11-ltsc_2024-x64
5Monotone/C...ss.bat
windows10-2004-x64
5Monotone/C...ss.bat
windows11-ltsc_2024-x64
5Monotone/C...er.sys
windows10-2004-x64
3Monotone/GetInput.exe
windows10-2004-x64
3Monotone/GetInput.exe
windows11-ltsc_2024-x64
3Monotone/Getlen.bat
windows10-2004-x64
3Monotone/Getlen.bat
windows11-ltsc_2024-x64
3Monotone/Monotone.exe
windows10-2004-x64
3Monotone/Monotone.exe
windows11-ltsc_2024-x64
3Monotone/README.md
windows10-2004-x64
3Monotone/README.md
windows11-ltsc_2024-x64
3Monotone/V...64.exe
windows10-2004-x64
1Monotone/V...64.exe
windows11-ltsc_2024-x64
1Monotone/batbox.exe
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Monotone.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Monotone.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Monotone/Box.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Monotone/Box.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Monotone/Button.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Monotone/Button.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Monotone/Commands/Hidden/Adapters.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Monotone/Commands/Hidden/Adapters.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Monotone/Commands/Hidden/Adapters2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Monotone/Commands/Hidden/Adapters2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Monotone/Commands/Hidden/AlternateStreamView.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
Monotone/Commands/Hidden/AlternateStreamView.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
Monotone/Commands/Hidden/AlternateStreamView.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Monotone/Commands/Hidden/AlternateStreamView.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
Monotone/Commands/Hidden/Block.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral16
Sample
Monotone/Commands/Hidden/Block.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral17
Sample
Monotone/Commands/Hidden/UnbanComplete.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Monotone/Commands/Hidden/UnbanComplete.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Monotone/Commands/Hidden/process.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral20
Sample
Monotone/Commands/Hidden/process.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
Monotone/Commands/Hidden/spoofer.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Monotone/GetInput.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Monotone/GetInput.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
Monotone/Getlen.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Monotone/Getlen.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Monotone/Monotone.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
Monotone/Monotone.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral28
Sample
Monotone/README.md
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
Monotone/README.md
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
Monotone/Volumeid64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Monotone/Volumeid64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Monotone/batbox.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Monotone.zip
- Size 685KB
- Sample260922-yfjynswt5j
- SHA256 1aa211329adf1f187e761b63581b187364f81abdef8ba40a59097589a61246d1
- MD5 e6fd29188087a3f4bdbd4af68fba9400
- SHA1 22a7bc68c313b219903ed8ab18280c2e72fd82e3
- SHA512 08ddfaf0aa73aa4baf22ad23dae7bd32501bdcc52ebe1209f6452da7a707a1049d0b10c0317ea06f84f571bc0450710505c7abf4f4752b699c355208039bf437
- SSDEEP 12288:aKSmTFPvU4UE33I7xmRjJiulBy0WGmUP0asQl5kJOt5iO+0ECJA7KLpB4JiB:abmpXU4rHI7xSiuWDUqI+0tgrBCJCY7j
- TLSH T157E4236C8C355534EA4B6EB14D85A2D0E9FAE2C5BA4F702624C153146F2DAF8790CCDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/Monotone/Commands/Hidden/AlternateStreamView.exe Nirsoft - Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/Monotone/Commands/Hidden/AlternateStreamView.exe - Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/Monotone/Commands/Hidden/Adapters.exe unpack001/Monotone/Commands/Hidden/Adapters2.exe unpack001/Monotone/Commands/Hidden/Block.exe unpack001/Monotone/GetInput.exe unpack001/Monotone/Monotone.exe unpack001/Monotone/batbox.exe unpack001/Monotone/colorecho-vc10-x86_64.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Monotone/Commands/Hidden/AlternateStreamView.exe unpack001/Monotone/Commands/Hidden/spoofer.sys
File Explorer
-
Monotone.zip.zip 685KB
-
Monotone/Box.bat.bat .vbs 5KB
-
Monotone/Button.bat.bat 5KB
-
Monotone/Commands/Hidden/Adapters.exe.exe 335KB
-
Monotone/Commands/Hidden/Adapters2.exe.exe 341KB
-
Monotone/Commands/Hidden/AlternateStreamView.cfg551B
-
Monotone/Commands/Hidden/AlternateStreamView.exe.exe 109KB
-
Monotone/Commands/Hidden/Block.exe.exe 119KB
-
Monotone/Commands/Hidden/UnbanComplete.vbs49B
-
Monotone/Commands/Hidden/process.bat1001B
-
Monotone/Commands/Hidden/spoofer.sys.sys 6KB
-
Monotone/GetInput.exe.exe 3KB
-
Monotone/Getlen.bat.bat 1KB
-
Monotone/Monotone.exe.exe 160KB
-
Monotone/README.md413B
-
Monotone/Volumeid64.exe.exe 165KB
-
Monotone/batbox.exe.exe 1KB
-
Monotone/colorecho-vc10-x86_64.exe.exe 129KB
-
Monotone/host.txt3KB
-
Monotone/hwid.ps1.ps1 3KB
-
Monotone/mac.txt6KB
Monotone/Box.bat
- SHA256 64556d24498bcd280cd7cc248a98ed22c4db921495d825f141af1547c8fdd275
- MD5 a95505942d3ebcf724f080b49d4e981f
- SHA1 ed7202c5dd386d050a2a24745399154218569f81
- SHA512 21046716caec7a2b26516ae37f3295445d8c7f1b3502ebcaf41a84469bea1888f0139e813111f1585eff9b27403674e4c61ef4d4a62503f2c1dd820bde8a3476
- SSDEEP 96:0hsAkUFjSl445cLegeOGe1fjlV/SkJwxwotwb7MEussvil2YTUK:nAkQjSl44yveOb/Skxt7WisY4K
- TLSH T158C156017158335B51F506BB407670E4EB3CD1932B3AE7ACBD2A589B211D57DB0E9ACC
- MD5 SHA1 SHA512 SSDEEP TLSH
Monotone/Button.bat
- SHA256 38aa0c1ad69d96732c776cbd73275f5ccb881d42158158b32815dad869ef9876
- MD5 96fefe69f2facf74197a8af3004a6167
- SHA1 80baf02b5d984dd8055ac3a6f42593ad98b78307
- SHA512 1aa6335a5cc340191613c52fa3e55625ed058abad8bd8d5ed1575bb9cd59b19e1fb3fcf3f5df199ea6f9b9d10bdee45e099c9247457b35ea65c7b1e403f0e888
- SSDEEP 96:X1UCLtcZQBjROHl4EF3r+QOAwD3MMcEzySfuP0wOYwwYW2s:XTeGBlqlXF3yDcMJ2+uP0wuwY7s
- TLSH T1EFB1648971453363A2A2215A1D4F94B1FF2AD8B0767A7E59347F00DD02868FCA1B9DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Monotone/Commands/Hidden/Adapters.exe
- IMPHASH 1e62fe73e112d1e3d22ab62c94aa9edf
- SHA256 b3de6d10d9f94037b88f736609e50a8a4c4d516ca50107dedd575797a654c28e
- MD5 934bbc5411c532964f3bbe42cb1c1785
- SHA1 dcddde340e7f080716abaa456971b9aa85bd084b
- SHA512 8db126cb8381fe84afe25b25e854eb8de25e43f2638e0d87740ce3fe33338b032b09d9551655afedecfe39cb7482f88e72ccdb28afb59684474084a28da71cb2
- SSDEEP 6144:QlGlXIiIGWbsTXO/P/bbUmmUhquD2S6FEJQzZnCvTkJCps9Q18RQj7dVJTrQkEj2:QlGlXIiIGWbsTXO/P/3mUhquD2S6DzZl
- TLSH T1B6746A1AF76504F4E973917C88568686E6B2B8160B71D7EF03A4431E2F376E09D3BB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
79288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Gaming\Desktop\Private\Danger\DarkCleaner\x64\Release\DarkCleaner.pdb
shlwapi
SHDeleteValueW
SHDeleteKeyW
setupapi
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiRemoveDevice
SetupDiEnumDeviceInfo
kernel32
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
HeapAlloc
GetProcessHeap
HeapFree
FindFirstFileW
FindNextFileW
GetTempPathW
DeleteFileW
GetLastError
CreateFileW
WriteFile
CloseHandle
GetACP
SetStdHandle
ReadConsoleW
HeapSize
SetEndOfFile
FindClose
UnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
WriteConsoleW
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
FreeLibrary
LoadLibraryExW
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
iphlpapi
GetAdaptersInfo
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25711,
count=18, id=260, version=25711,
count=182, id=261, version=25711,
count=10, id=259, version=25305,
count=60, id=261, version=25305,
count=36, id=260, version=25305,
count=11, id=257, version=25711,
count=113, id=1, productName=Unmarked objects,
count=2, id=265, version=25548,
count=1, id=255, version=25548,
count=1, id=258, version=25548,
Monotone/Commands/Hidden/Adapters2.exe
- IMPHASH 4d4c7538658d9c5190d62e7ce34041f2
- SHA256 4c831252aa6f193c4474ba74f352bee7d00099dfaf5ac6e98ab1253e21999b4a
- MD5 bb36d4578ce201dc932ab6bbc079875c
- SHA1 f614f8211bba9d578eb19e7d96a0314b5a51e662
- SHA512 ea66cffc96403f69f1b1a3e4f7b0c2fb5045655e2f10772f4d0e5dc9d0243e99c972ae9247c597de680ed7886896a335bc82dde8b162515f15ba368ff25fdebe
- SSDEEP 6144:zlxFkdqBBydxtri9gvdRWKPmawYItN6atI/cFVygZnCv6hqGPs7fYv8dMQZgxiQT:zlxFkdqBBydxtri9gvdRWKPmawYItwax
- TLSH T1A8747C1AF76504F4ED73823CC8628686E6B27C1A0B71D79F1394461A2F376909E7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
82824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Gaming\Desktop\Private\Danger\DarkCleaner\x64\Release\DarkCleaner.pdb
shlwapi
SHDeleteValueW
SHDeleteKeyW
setupapi
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiRemoveDevice
SetupDiEnumDeviceInfo
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
HeapAlloc
GetProcessHeap
HeapFree
FindFirstFileW
FindNextFileW
FindClose
SetEnvironmentVariableW
DeleteFileW
GetLastError
CreateFileW
WriteFile
CloseHandle
DeleteFileA
GetACP
SetStdHandle
ReadConsoleW
HeapSize
SetEndOfFile
GetTempPathW
RtlVirtualUnwind
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
FreeLibrary
LoadLibraryExW
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
advapi32
GetUserNameW
iphlpapi
GetAdaptersInfo
Name
.text
Size
218KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25711,
count=18, id=260, version=25711,
count=182, id=261, version=25711,
count=10, id=259, version=25305,
count=60, id=261, version=25305,
count=36, id=260, version=25305,
count=11, id=257, version=25711,
count=115, id=1, productName=Unmarked objects,
count=2, id=265, version=25548,
count=1, id=255, version=25548,
count=1, id=258, version=25548,
Monotone/Commands/Hidden/AlternateStreamView.cfg
- SHA256 2e44dad813efa86ddbd849a53962c5bdcacc9bcc2039dc09bcb2c25c770f3d8b
- MD5 d298348206017d0cb04217887a677334
- SHA1 8fd2cf9e5e39213c5316f36b463948c52ca83017
- SHA512 517a9d78ba3529308066d619a11d8a3684aaf7428041fae2eb8520f30fc7ec9553f6f58011b63bce030391c2d24fb7b5f7385ec2da21a51ca1264dc7a513b5d9
- TLSH T16EF0E202480F205CD092AF5C96F87A3001F05C5335E05CFA57DF6B94DECDC8A6A45440
- MD5 SHA1 SHA512 TLSH
Monotone/Commands/Hidden/AlternateStreamView.exe
- IMPHASH f138e4730386413f2628136f90bd9356
- SHA256 669ce40107a2e05fc93dd37df55c77eb155705b449b2e236423e8bb96b9985f0
- MD5 caede4f12ac17f3e0ad8e3c923fd510a
- SHA1 107616433f973110664ceda2ca64c21fb7a92825
- SHA512 69898a4d39ba4415da8c8e5eb8a1a012d4db87f24e61f63a50b3af07e65d2aed6cc4b24ed315e5a20dea91fa1903fac92a5eefbbff8b8cb90c7259413cd93162
- SSDEEP 3072:6SuY8BQkSJllKctuKvF2CIlMd1krc1uRCiOoCW7ZlFzG:E0wY25facROh
- TLSH T1F9B3398663F806D8E86BCA35CD724A27D7B0BC955934C72F07A4DD8A1F63361BC24726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
87:eb:98:6a:0c:a1:92:c8:63:fc:46:4a:4e:76:44:22:0c:a2:73:82:15:1a:8e:de:6a:cc:7e:5c:a1:4b:16:30
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Oct 21, 2017
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
09:12:e0:49:76:6b:80:68:84:18:3a:33:10:d3:00:58:fa:b0:24:17
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Oct 21, 2017
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2014 - Sep 12, 2019
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Mar 30, 2016
Timespan
Mar 30, 2016 - Jun 30, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
68672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\Projects\VS2005\AlternateStreamView\x64\Release\AlternateStreamView.pdb
msvcrt
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_exit
_c_exit
__setusermatherr
__C_specific_handler
_onexit
__dllonexit
_wcslwr
strlen
wcsrchr
_commode
_fmode
__set_app_type
_XcptFilter
malloc
_memicmp
_wcsicmp
free
modf
memcmp
wcstoul
_itow
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
_wtoi
wcslen
memset
wcscpy
wcscmp
wcschr
memcpy
wcscat
_snwprintf
wcsncat
comctl32
ImageList_SetImageCount
ord17
ImageList_Create
ImageList_AddMasked
CreateToolbarEx
CreateStatusWindowW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
GetCurrentProcess
GetCurrentProcessId
ExitProcess
CreateProcessW
GlobalFree
SetErrorMode
DeleteFileW
EnumResourceNamesW
GetPrivateProfileIntW
ReadProcessMemory
OpenProcess
EnumResourceTypesW
GetStartupInfoW
LoadLibraryW
WritePrivateProfileStringW
GetPrivateProfileStringW
WriteFile
GetFileAttributesW
CreateFileW
GetProcAddress
CloseHandle
ExpandEnvironmentStringsW
GetModuleHandleW
ReadFile
CompareFileTime
FileTimeToSystemTime
FreeLibrary
SystemTimeToFileTime
FindResourceW
GetModuleFileNameW
LoadResource
GetWindowsDirectoryW
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
GlobalAlloc
LoadLibraryExW
GetSystemDirectoryW
lstrlenW
LocalFree
GetNumberFormatW
WideCharToMultiByte
LockResource
lstrcpyW
SetFileAttributesW
GlobalUnlock
GetTempPathW
GetLocaleInfoW
GetDateFormatW
GetTempFileNameW
GlobalLock
SizeofResource
GetFileSize
GetLastError
FormatMessageW
FindFirstFileW
GetVersionExW
FindNextFileW
FindClose
GetTimeFormatW
user32
PostQuitMessage
TrackPopupMenu
RegisterWindowMessageW
DrawTextExW
IsDialogMessageW
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
SetWindowTextW
UpdateWindow
SetDlgItemTextW
GetDlgItemTextW
GetClientRect
GetSystemMetrics
DeferWindowPos
CreateWindowExW
SendDlgItemMessageW
EndDialog
GetWindowRect
GetDlgItem
GetDlgItemInt
InvalidateRect
EndPaint
GetWindow
DrawFrameControl
SetDlgItemInt
GetWindowPlacement
GetForegroundWindow
LoadAcceleratorsW
DefWindowProcW
SendMessageW
PostMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPlacement
LoadImageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetWindowLongW
SetWindowLongW
SetFocus
EndDeferWindowPos
BeginDeferWindowPos
CloseClipboard
GetMenu
GetParent
EmptyClipboard
GetDC
EnableMenuItem
ReleaseDC
GetClassNameW
MoveWindow
OpenClipboard
GetSubMenu
GetMenuItemCount
CheckMenuItem
GetCursorPos
GetMenuStringW
SetClipboardData
GetSysColor
EnableWindow
MapWindowPoints
SetWindowPos
DestroyWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
LoadStringW
DestroyIcon
LoadIconW
GetMessageW
BeginPaint
gdi32
DeleteObject
GetStockObject
GetTextExtentPoint32W
SetBkColor
GetDeviceCaps
SelectObject
SetTextColor
CreateFontIndirectW
SetBkMode
comdlg32
FindTextW
GetSaveFileNameW
advapi32
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
shell32
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW
ole32
CoUninitialize
CoInitialize
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=12, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=262, id=1, productName=Unmarked objects,
count=21, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=26, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Monotone/Commands/Hidden/Block.exe
- IMPHASH 7182b1ea6f92adbf459a2c65d8d4dd9e
- SHA256 dfd08e1d7a34bae6836b3915b45b8637b85cdc998198c5bf148fba5e96f15c21
- MD5 5782b8d469bbc9045ebd2316c2aefbd5
- SHA1 f679adea19ac0e88a50cfefb88825a086102f77d
- SHA512 e57ed92d3c916b89e5f830fb52a63b330e404ea91a7cc0e0b0e8cfb03f9bea7252f1fa8fcf3950ae2bd404dcd189eeac27bcdc1cf529acd8ebde0bc5f457d023
- SSDEEP 3072:u2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXnI:PbJhs7QW69hd1MMdxPe9N9uA0hu9TBKI
- TLSH T1F5C33966B2E01198DBB581F6D9921706EB7074761B15A3DB2BB853B31B2B4C68F3C3D0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
memcpy
tolower
wcscat
malloc
kernel32
GetModuleHandleW
HeapCreate
GetStdHandle
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
GetExitCodeProcess
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetShortPathNameW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
Sleep
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
TerminateProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
DuplicateHandle
RegisterWaitForSingleObject
shell32
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
winmm
timeBeginPeriod
ole32
CoInitialize
CoTaskMemFree
shlwapi
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
user32
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
GetWindowLongPtrW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
DestroyWindow
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
GetSystemMetrics
CreateWindowExW
SetWindowLongPtrW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
Name
.code
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Monotone/Commands/Hidden/UnbanComplete.vbs
- SHA256 537f70f7b018610dfedd4bcecf041d845eab0c673e129185c2345eb68a95fe77
- MD5 4edf8ecaf575c93e307bdce09aa46e8c
- SHA1 76c189b32fd69a3694e1dd14776cee1c1cc6c483
- SHA512 ce5921344aadcc9fce5141d416ca92e5772c1c37a0e8724c09c6c2ac579528a21e5fc8659c91db68810763b403fd9760d75102f6c22db84f8f5fe13fefaf6f1a
- MD5 SHA1 SHA512
Monotone/Commands/Hidden/process.bat
- SHA256 ef702ce2f8fb1bc71fb60e8b95cb83cef4fa66aa96afd7ca4fd67c96530b6e53
- MD5 2d3f9b2d001abd6e58ac6f0e7337c619
- SHA1 7053a604a394f479b643783098adb056d69a404b
- SHA512 60d4a7e203e37194f4a78f1c581728197b3cd6581d70e185ba6d0d8206aca3a732319b28fef776028015615ebc0ab164a9c935081cd2496b866c63ad6358fccf
- TLSH T1C011584C13D648479499A012C8090986E7D83FB2637DF990D05934D1F71397EDBF7C15
- MD5 SHA1 SHA512 TLSH
Monotone/Commands/Hidden/spoofer.sys
- IMPHASH 917798694e8c78c6e26f61304feccd33
- SHA256 1992c044963f5c77aa7b5462e2bb69a37c66bc0e13032524fb1663c0314fd420
- MD5 96756deaff1b2667883d4a21e43f4f65
- SHA1 bce3d6fb9eec3f2d2695d96e61442a58039d594a
- SHA512 b6f472c8296bbef5da4baf638e98c2e0c42ba3fa783c69a6c0cc1e2f92f4c365d6d1c0bcf26e1644bacd4a001fd97c19b5fe2b616ba3c0982fc7edefcb59ef7f
- SSDEEP 96:eA/w8VE6wC4NrkXyhWZ2JMQ4LI5aUZ1ZM2a3:v/f/skjZAMTOA2a3
- TLSH T1FBD109FEA159D283E7AD447A965B5655F332B2D00B00834FE8F868996483FE3392C715
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
99:95:e0:f4:6c:fa:4c:57:58:e5:d5:22:dd:45:40:41:f5:61:f6:f0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WDKTestCert VentrixCode\,131717327640159255
Chains
Sep 22, 2026
CN=WDKTestCert VentrixCode\,131717327640159255
Subject
CN=WDKTestCert VentrixCode\,131717327640159255
Serial Number
5c:63:39:e7:9d:25:ce:89:46:0d:1f:98:8a:0b:6c:44
Issuer
CN=WDKTestCert VentrixCode\,131717327640159255
Key Usages
KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2018 - May 25, 2028
Minor OS version
0
Major OS version
10
Entry point
4304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntoskrnl.exe
RtlInitUnicodeString
KeQuerySystemTimePrecise
ExAllocatePool
ExFreePoolWithTag
RtlRandomEx
ObReferenceObjectByName
IoDriverObjectType
Name
.text
Size
1024B
Virtual Size
922B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
524B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
270B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=8, id=1, productName=Unmarked objects,
count=3, id=257, version=25711,
count=1, id=260, productName=VS2017 v15.7.2 build 26429, version=26429,
count=1, id=258, productName=VS2017 v15.7.2 build 26429, version=26429,
Monotone/GetInput.exe
- IMPHASH efb2c106be6c2bc8cffe4984e09370b9
- SHA256 3f5c64717a0092ae214154a730e96e2e56921be2e3f1121a3e98b1ba84627665
- MD5 2ba62ae6f88b11d0e262af35d8db8ca9
- SHA1 69d4ccb476cfebdf572134fead42a12750580e4b
- SHA512 a984212245e401b68872623437a512898a00d71cca7d7b0aa6733663020cae92d50ce1ae3abafbd811542a77e72c8b6a5755492c07d6ddeb2642d908142c2ccb
- TLSH T134719637E7A08971CF046BB4124794A3E41A753022A74907B7E84FF97D329113FA6B2A
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
FillConsoleOutputAttribute
GetConsoleMode
GetStdHandle
ReadConsoleInputA
ReadConsoleOutputAttribute
SetConsoleMode
WaitForSingleObject
GetCommandLineA
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=12, id=19, version=8078,
count=2, id=18, version=8444,
Monotone/Getlen.bat
- SHA256 83ce5342710a2f2e385a363402661e3426728dd6bcfe9d87e22f2fb858b07bde
- MD5 8c1812e76ba7bf09cb87384089a0ab7f
- SHA1 d3edf2ba081073139960a955e812e6bb7f63817b
- SHA512 618abe11f65fe95cdc1f1834bf24ddbbea789c971788af7d2248b880e53d11a3c4302bd8e3c3c36b934f5f7d975d1b142fae8fd23c9ed6cfa118c97e01f6fd14
- TLSH T14741339022E523A652A2882B7E4E52D4D74BD0A56B2CB39DB4F6404E030B5BC20F9DCE
- MD5 SHA1 SHA512 TLSH
Monotone/Monotone.exe
- IMPHASH f326f88ca83c9aacaa44acfb8884f1d4
- SHA256 0f7f86530b7fa2e693a2a3a5bf69957e61c2f45d39418d077285a1ea6f4bb992
- MD5 cd6cddac2686df01814705f21e6da343
- SHA1 f29ad4efdc160ffba5cb63e01349ec9b84123e30
- SHA512 a673d521f316d3e0fa87a99effa33c5dc4fde315e72b7f6cbb828a94ffe8ebeed4bf9ca6fe858b3c69327aa4ce05ae02b37e2a392abb7cc728c4bbe2ab9a6de4
- SSDEEP 3072:yuo1MlSEqhqJhJy0WTHW69B9VjMdxPedN9ug0/9TBfsdZK0:y5oaqJhJMHW69B9VjMdxPedN9ug0/9Tk
- TLSH T184F3389672A01189DAB181B6D592C776E6707C760714A3CB1BE45FB73B2B4CA8F3C390
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
wcscat
memcpy
tolower
malloc
kernel32
GetModuleHandleW
HeapCreate
GetStdHandle
SetConsoleCtrlHandler
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetShortPathNameW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
Sleep
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
PeekNamedPipe
TerminateProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateProcessW
GetExitCodeProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
shell32
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
winmm
timeBeginPeriod
ole32
CoInitialize
CoTaskMemFree
shlwapi
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
user32
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
GetWindowLongPtrW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
DestroyWindow
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
GetSystemMetrics
CreateWindowExW
SetWindowLongPtrW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
Name
.code
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Monotone/README.md
- SHA256 4abfd24b7422ee66d5849fda386dfd1318db4615f9126899a27fdb5a4ffa3d0d
- MD5 699d03e1e8ed798aeb721e8fd561682b
- SHA1 b0682fcadec2a52af958c6445b9755622b5111d0
- SHA512 fd71ce13f0930115bd4c4577cd6618aa37645df1a8b10a47789adc9f663edc9c5cdf82e385cb760444808268163922df9e53af103f0971f23c608929cb6a08e0
- TLSH T198E05C6DA03808A679426D9A654A76AC9A46400F6D05837EF4798354203E5DA13C518E
- MD5 SHA1 SHA512 TLSH
Monotone/Volumeid64.exe
- IMPHASH 735aed1002ee8ff1be0e1dee668e8b0d
- SHA256 fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd
- MD5 81a45f1a91448313b76d2e6d5308aa7a
- SHA1 0d615343d5de03da03bce52e11b233093b404083
- SHA512 675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d
- SSDEEP 3072:PngbfXWm18pX82lOl7NuT7DLM5Weo5UFs5QM8JwDmtFk1glurXEa:/gbfXWVoRNuT7DkbFsKM1glI
- TLSH T1A8F34A5233E410F9E1F3AB7089B55515EB36BCA65B34C78E162041AD5E72BD0EE38B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
65:97:9c:4b:c0:56:29:3c:65:68:1d:c8:51:cc:90:6a:97:43:fe:d9:91:a6:db:5c:b9:5c:47:8e:bf:73:7b:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 13, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
25:f3:81:49:d7:50:ad:69:9f:da:99:18:45:e2:bd:84:7c:66:4c:a4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 13, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 30, 2016 - Jun 30, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:99:ba:af:8b:e3:04:38:6b:88:00:00:00:00:00:99
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 27, 2016 - Jul 27, 2017
Minor OS version
2
Major OS version
5
Entry point
23260
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
FormatMessageA
GetDriveTypeA
CreateFileA
GetVolumeInformationA
GetVersionExA
LCMapStringW
CloseHandle
GetStringTypeW
OutputDebugStringW
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
GetLastError
GetCommandLineW
GetVersion
LoadLibraryA
GetModuleHandleA
GetStdHandle
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetFileType
ReadConsoleW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetProcessHeap
LoadLibraryExW
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
user32
SendMessageA
DialogBoxIndirectParamA
EndDialog
GetDlgItem
SetWindowTextA
SetCursor
LoadCursorA
InflateRect
GetSysColorBrush
gdi32
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage
comdlg32
PrintDlgA
advapi32
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegSetValueExA
version
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeA
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=225, version=20806,
count=125, id=224, version=20806,
count=9, id=223, version=20806,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=126, id=1, productName=Unmarked objects,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
Monotone/batbox.exe
- IMPHASH 273dc8f282b4ad3b1aadadf381d5b7f0
- SHA256 9553bc17fa0fd08e026c1865812b3388e3d5495a5394bbf671e5a8f21c79989a
- MD5 cb4a44baa20ad26bf74615a7fc515a84
- SHA1 2581868c3d560e2b200d4f21d83271430167b377
- SHA512 d19e6d0ccd89e52efdd2363185564cf83fcf3a37b55659dd1fd8b6574cf45b6147989b2c7b1e8029ce8136aa7ff74900494c1a30bbb65b96d9880ab7f77b6140
- TLSH T15531141E089C95FDD53B4D305D9B8913875BD8700A9E7B438FB8815EA0B6170EF58349
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
printf
_getch
__getmainargs
exit
_kbhit
strtol
kernel32
GetStdHandle
SetConsoleMode
SetConsoleTextAttribute
SetConsoleCursorPosition
ReadConsoleInputA
Sleep
SetConsoleDisplayMode
Name
.flat
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Monotone/colorecho-vc10-x86_64.exe
- IMPHASH 0cf008e765e0f9b5de4f59b06751286e
- SHA256 76fe5f9cef2c3a5c4f765d4c45167f4cf26cc6d469031f0d195d96724e9d82a8
- MD5 e2f377052409beeebf852803734e007a
- SHA1 4d5e977acc59912bd451edae77ad58d977ed086b
- SHA512 d88d3319a32ec3a8475fae03c74b1a5d7d8e92f3f5ffa1bc3326779d7d39e0bd18928a511be1ac965fb1c2e2da1cf0935fea38bbf847f54033887c62b6c842d7
- SSDEEP 3072:tJ45PBQ7m0bOfTbaeFCF5DCqzDlKOOXiX1w/A:n4pAmlTWPFhCg01iX
- TLSH T1D9D3294B727460F4E0BBC138C892560AE772B87B4B75938F1354876B2F236E19D39362
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
30260
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetConsoleTextAttribute
GetStdHandle
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetLastError
HeapFree
GetCommandLineW
GetCPInfo
HeapAlloc
LCMapStringW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
GetCurrentProcess
SetStdHandle
GetProcAddress
GetModuleHandleW
ExitProcess
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetLocaleInfoW
ReadFile
SetFilePointer
CloseHandle
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
LoadLibraryW
WriteConsoleW
CreateFileW
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=1, productName=Unmarked objects,
count=10, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=109, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=44, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Monotone/host.txt
- SHA256 ecf34c7bc93d5b7f1ea5d8d17e488946eed415128658da3ba2d02633c543234b
- MD5 cdda0101630962eaee1ef0305c2028c0
- SHA1 9ad08997104c48cc56536e08d743041d44f507cd
- SHA512 9cb0bbda17fbe3c25279649aa13be42f1c6f66cb37a2b67426a3f125fde32c68e9ade55ef327b4f0dfb1102f7bc5ff9ba831ec1e06cc8946c443f148aa0cb4e6
- TLSH T17171CC4F601C9A4CA1A801FEE113D14EFBD81EDA88CE47E99BE6A12FB1F1154855CCDD
- MD5 SHA1 SHA512 TLSH
Monotone/hwid.ps1
- SHA256 c7c54526b07f457e58d423ab22d61a0efd78ad112be2ef0a1efe6c25013df185
- MD5 05673d49cc5f31e3d4812b7cb7419641
- SHA1 07b3b298b067439da6e6ae37e51bb1701c33165a
- SHA512 5f5f380a3cad0cf1aa95244d6b1fca4ccdd10c8c882e045405d5600f242b8ed3306f485a3396db9c362f345b79b03d2db79aad7a1d92f09167beea0acf524d32
- TLSH T11E61EE52BA23C58B43F41D3E9EA1441CDE912037C1A25448F64C83C4FF76696E1EA6DE
- MD5 SHA1 SHA512 TLSH
Monotone/mac.txt
- SHA256 e53a19f0f36d7e7be98522239e8ac2af3248f4fe4b046d9fe270e3907ce11401
- MD5 58726bcb98b77afe581a7833c8f35f9a
- SHA1 7dcf281240fcdb4b8485a7df76644be817f29cab
- SHA512 34c5ca63ac4d86b8bce0a6a2676aa8c51bab85f673cc7463ec66e505730878d5803bc0897f94a7e5e7b1832a977a728c3899d70fb08ff9a11211b18a5437cce5
- SSDEEP 192:sNwBAoTrUETdTG3gUoaVLYIRH/kK7rLktmdcRwx7CNraxc1HL:sNtKJaXoi0MH2NRGc1r
- TLSH T15DE194BE442B1ADC1D6311D0983E329B6ECC97F9C50B4268BBF25D18772A53FC1D5A18
- MD5 SHA1 SHA512 SSDEEP TLSH