DWMBlurGlass_2.3.1_x64.zip
- SHA256 cfda271d28f0fd9bda4978bd8bd793e31957632c5ca442441de9701c47f6707e
Overview
overview
3Static
static
3DWMBlurGla...64.zip
windows10-2004-x64
1ReadMe.txt
windows10-2004-x64
1Release/DW...ss.exe
windows10-2004-x64
1Release/DW...xt.dll
windows10-2004-x64
1Release/da...ek.png
windows10-2004-x64
1Release/da...se.png
windows10-2004-x64
1Release/da...er.png
windows10-2004-x64
1Release/da...ig.ini
windows10-2004-x64
1Release/da....dmres
windows10-2004-x64
3Release/da...DE.xml
windows10-2004-x64
3Release/da...US.xml
windows10-2004-x64
3Release/da...MX.xml
windows10-2004-x64
3Release/da...es.xml
windows10-2004-x64
3Release/da...FR.xml
windows10-2004-x64
3Release/da...ID.xml
windows10-2004-x64
3Release/da...IT.xml
windows10-2004-x64
3Release/da...JP.xml
windows10-2004-x64
3Release/da...KR.xml
windows10-2004-x64
3Release/da...BR.xml
windows10-2004-x64
3Release/da...PT.xml
windows10-2004-x64
3Release/da...RU.xml
windows10-2004-x64
3Release/da...SE.xml
windows10-2004-x64
3Release/da...TR.xml
windows10-2004-x64
3Release/da...VN.xml
windows10-2004-x64
3Release/da...CN.xml
windows10-2004-x64
3Release/da...SG.xml
windows10-2004-x64
3Release/da...TW.xml
windows10-2004-x64
3Release/da...re.pdb
windows10-2004-x64
3Release/da...WM.pdb
windows10-2004-x64
3Release/dbghelp.dll
windows10-2004-x64
1Release/symsrv.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DWMBlurGlass_2.3.1_x64.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ReadMe.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release/DWMBlurGlass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release/DWMBlurGlassExt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release/data/AeroPeek.png
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release/data/btnglow_close.png
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
Release/data/btnglow_other.png
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Release/data/config.ini
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Release/data/defaultres.dmres
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
Release/data/lang/de-DE.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
Release/data/lang/en-US.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
Release/data/lang/es-MX.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
Release/data/lang/es.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
Release/data/lang/fr-FR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
Release/data/lang/id-ID.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
Release/data/lang/it-IT.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral17
Sample
Release/data/lang/ja-JP.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
Release/data/lang/ko-KR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
Release/data/lang/pt-BR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
Release/data/lang/pt-PT.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
Release/data/lang/ru-RU.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
Release/data/lang/sv-SE.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
Release/data/lang/tr-TR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
Release/data/lang/vi-VN.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
Release/data/lang/zh-CN.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
Release/data/lang/zh-SG.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
Release/data/lang/zh-TW.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
Release/data/symbols/dwmcore.pdb/AB3E8DEE7EDC8B1006D8C2FA5917BEE41/dwmcore.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
Release/data/symbols/uDWM.pdb/183C267E422D329FEDB78CD31AC2E1C51/uDWM.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
Release/dbghelp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Release/symsrv.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target DWMBlurGlass_2.3.1_x64.zip
- Size 3.6MB
- Sample260925-pwlmrssvcw
- SHA256 cfda271d28f0fd9bda4978bd8bd793e31957632c5ca442441de9701c47f6707e
- MD5 71b92616e01c69ef0c76689b4531b718
- SHA1 bc8f24dd4ac8fe616091c5a20eb3e8ac8cb00766
- SHA512 a06b1e6b43ec2d369cc152926bb0447552816554c2d3034859fc8ff59d4e1dcc02de67e8be3df8b01ad8d44043a6c0c4f21253ef1268be87a1ba3e9d92fd4575
- SSDEEP 98304:8Pyhph/4w4Lj/d+NhBwxTy1GfFu+O6CerC6+745jtHQ:8qhEw0rwg5kt6C8C6+kHQ
- TLSH T18A0633C4E25F6A6FDA9F9BB49A57443393F035820749C3FEC72A4E290D0053AB19C759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/DWMBlurGlass.exe unpack001/Release/DWMBlurGlassExt.dll
File Explorer
-
DWMBlurGlass_2.3.1_x64.zip.zip 3.6MB
-
ReadMe.txt20KB
-
Release/DWMBlurGlass.exe.exe 1.4MB
-
Release/DWMBlurGlassExt.dll.dll 557KB
-
Release/data/AeroPeek.png.png 142KB
-
Release/data/btnglow_close.png.png 2KB
-
Release/data/btnglow_other.png.png 1KB
-
Release/data/config.ini745B
-
Release/data/defaultres.dmres156KB
-
Release/data/lang/de-DE.xml.xml 6KB
-
Release/data/lang/en-US.xml5KB
-
Release/data/lang/es-MX.xml3KB
-
Release/data/lang/es.xml6KB
-
Release/data/lang/fr-FR.xml.xml 5KB
-
Release/data/lang/id-ID.xml.xml 3KB
-
Release/data/lang/it-IT.xml6KB
-
Release/data/lang/ja-JP.xml6KB
-
Release/data/lang/ko-KR.xml6KB
-
Release/data/lang/pt-BR.xml.xml 6KB
-
Release/data/lang/pt-PT.xml.xml 6KB
-
Release/data/lang/ru-RU.xml.xml 8KB
-
Release/data/lang/sv-SE.xml.xml 5KB
-
Release/data/lang/tr-TR.xml5KB
-
Release/data/lang/vi-VN.xml6KB
-
Release/data/lang/zh-CN.xml5KB
-
Release/data/lang/zh-SG.xml5KB
-
Release/data/lang/zh-TW.xml.xml 5KB
-
Release/data/symbols/dwmcore.pdb/AB3E8DEE7EDC8B1006D8C2FA5917BEE41/dwmcore.pdb5.3MB
-
Release/data/symbols/uDWM.pdb/183C267E422D329FEDB78CD31AC2E1C51/uDWM.pdb2.6MB
-
Release/dbghelp.dll.dll 2.1MB
-
Release/symsrv.dll.dll 377KB
ReadMe.txt
- SHA256 40b2f7dd1326995f3beebcd1721d7d36ef91989f14ef0ab59239737c3bafa66c
- MD5 b3f9feb964700e8bb17051afbc916208
- SHA1 a896235b98b50d63534be07532912f8046236d2f
- SHA512 762662e3d91880a473a1d7fe065e21f28e238b7150102ae67de01585c8d7237248aab5548966559fdbe2145fc7eaf8e8e64f5025596e67d807922e4abe71a232
- SSDEEP 384:yNPqt446qE20UyeRhIsRYWRK0Fher5gfNz62dzfYLGbnO+MyPdwnIS+a0g:yND4652X1RmsaW0raNZfYqob+a0g
- TLSH T16DA2F866561E2730032700AE235D94A4B32B1634B737A71DF874D41E2DC9A6EA73B6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/DWMBlurGlass.exe
- IMPHASH 2ca61373b4b115b0dd0691c41354a991
- SHA256 2770e2aed9c70cad1773ed5439c435a0a124a76a8f1261e32f7065132144736d
- MD5 40c016c41fdfd275809617f28c34bb28
- SHA1 6879b4544441e7b34e8e8f624f0d192f9ae9bbe9
- SHA512 38740dc44b5688d0fd96ff39b51a24e3281cc05063d88175559b66c43727920eeabd8b44c021f6bf7856efa08f93e16d89594a74887888809bf611d9d94d845f
- SSDEEP 24576:V0qj6TGhOlrF2dt5beWabVywA5aCNXuSnJztDQGQzz8J:V0qj6EOlZK/beWabVj4uKztDQX8
- TLSH T1EE652A2372AA02F1DCB5D2349F7A15E5E732B852032AC7DF11B6461D0F6B2D12D3A792
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
621824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\Project\DWMBlurGlass\Build\x64\Release\DWMBlurGlass.pdb
kernel32
HeapFree
ReleaseSemaphore
GetModuleHandleExW
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
K32GetModuleInformation
HeapAlloc
CreateMutexExW
GetModuleFileNameA
FreeLibrary
WideCharToMultiByte
DebugBreak
LoadLibraryExW
IsDebuggerPresent
TerminateProcess
ProcessIdToSessionId
CreateProcessW
CreateMutexW
CreateSemaphoreExW
VirtualFreeEx
K32EnumProcessModules
GetModuleHandleW
CreateRemoteThread
GetCurrentProcessId
VirtualAllocEx
GetProcAddress
Process32FirstW
Process32NextW
GetExitCodeThread
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
K32GetModuleFileNameExW
GetLocaleInfoEx
GetCurrentProcess
WriteProcessMemory
SetLastError
CloseHandle
GetPrivateProfileStringW
CreateFileW
GetModuleFileNameW
WritePrivateProfileStringW
GetProcessHeap
GetFileSizeEx
WriteConsoleW
SetEndOfFile
HeapSize
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ReadConsoleW
GetConsoleMode
SetFilePointerEx
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
LCMapStringEx
GetCPInfo
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GlobalAlloc
LoadLibraryW
GlobalLock
GlobalUnlock
MulDiv
RtlUnwindEx
InterlockedPushEntrySList
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReadFile
FindClose
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetStdHandle
WriteFile
GetFileType
user32
EnumWindows
MessageBoxW
KillTimer
SendMessageW
SetTimer
DispatchMessageW
LoadIconW
wsprintfW
IsWindow
RegisterClassExW
CreateWindowExW
TranslateMessage
SetCursor
LoadCursorW
ReleaseCapture
SetCapture
SetFocus
TrackMouseEvent
GetCursorPos
ReleaseDC
SetClipboardData
IntersectRect
GetSysColor
EmptyClipboard
CloseClipboard
ClientToScreen
OffsetRect
OpenClipboard
ScreenToClient
FillRect
GetDC
GetKeyState
SetCursorPos
MonitorFromWindow
EnableWindow
IsIconic
PostQuitMessage
IsZoomed
GetClientRect
SetLayeredWindowAttributes
UpdateLayeredWindowIndirect
MoveWindow
IsWindowEnabled
ValidateRect
GetMonitorInfoW
GetWindowPlacement
GetWindowLongPtrW
SetWindowTextW
SetWindowLongPtrW
SetWindowPos
IsWindowVisible
GetWindowRect
FindWindowExW
SetProcessDpiAwarenessContext
ShowWindow
FindWindowW
InvalidateRect
GetWindowThreadProcessId
GetMessageW
DefWindowProcW
PostMessageW
UnregisterClassW
advapi32
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
RegCloseKey
shell32
ShellExecuteW
SHGetKnownFolderPath
ole32
CoCreateInstance
CoTaskMemFree
CoInitialize
oleaut32
SetErrorInfo
SysStringLen
SysAllocString
VariantClear
SysFreeString
VariantInit
shlwapi
ord12
PathFileExistsW
PathRemoveFileSpecW
dbghelp
SymGetSymbolFileW
SymCleanup
SymSetSearchPathW
SymUnloadModule64
SymInitialize
SymLoadModuleExW
SymRegisterCallbackW64
UnDecorateSymbolName
SymSetOptions
SymEnumSymbols
dwmapi
DwmGetColorizationColor
winmm
timeBeginPeriod
timeEndPeriod
msimg32
AlphaBlend
uxtheme
GetThemeSysSize
gdi32
GetViewportOrgEx
CreateFontIndirectW
CreateSolidBrush
DeleteObject
GetObjectW
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
GetDeviceCaps
GetStockObject
SelectClipRgn
GetCurrentObject
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
gdiplus
GdiplusShutdown
GdiplusStartup
GdipSaveImageToFile
GdipSetStringFormatFlags
GdipDrawLineI
GdipSetStringFormatAlign
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipSaveImageToStream
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipDeleteStringFormat
GdipGetImageEncodersSize
GdipAddPathArc
GdipFillRectangleI
GdipDeleteRegion
GdipCloneBrush
GdipRestoreGraphics
GdipDrawEllipse
GdipGetClip
GdipFillEllipse
GdipCreateFromHDC
GdipDrawString
GdipDrawPath
GdipResetLineTransform
GdipTranslateLineTransform
GdipClosePathFigure
GdipSetClipRectI
GdipAddPathEllipse
GdipSetPixelOffsetMode
GdipFree
GdipGraphicsClear
GdipGetPenWidth
GdipFillPath
GdipCreateRegion
GdipSetStringFormatTrimming
GdipDeleteGraphics
GdipSetInterpolationMode
GdipSetStringFormatLineAlign
GdipCreatePath
GdipSetClipPath
GdipSetSmoothingMode
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCreateBitmapFromStream
GdipDeleteBrush
GdipCloneImage
GdipCreateLineBrushI
GdipSaveGraphics
GdipResetClip
GdipDrawRectangleI
GdipGetImageEncoders
GdipGetRegionHRgn
GdipGetImageHeight
GdipCreateStringFormat
GdipDeletePen
GdipGetFontSize
GdipDeleteFont
GdipSetLineColors
GdipGetSolidFillColor
GdipSetSolidFillColor
GdipSetPenWidth
GdipAddPathStringI
GdipGetPathWorldBounds
GdipGetFontStyle
GdipSetLinePresetBlend
GdipCreateFont
GdipCreateLineBrush
GdipDeletePath
GdipSetPenColor
GdipCreateFontFamilyFromName
GdipGetFamily
GdipDeleteFontFamily
GdipCreateSolidFill
GdipCreateHBITMAPFromBitmap
GetModuleOffset
Name
.text
Size
838KB
Virtual Size
837KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
299KB
Virtual Size
299KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
222KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.DWMBlur
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=179, id=261, version=30795,
count=10, id=259, version=33808,
count=16, id=260, version=33808,
count=107, id=261, version=33808,
count=20, id=260, version=30795,
count=2, id=262, version=30795,
count=31, id=257, version=30795,
count=366, id=1, productName=Unmarked objects,
count=47, id=265, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=151,
count=1, id=258, version=34123,
Release/DWMBlurGlassExt.dll
- IMPHASH 74447a2a85d1bc2b59548aab117fe69c
- SHA256 28daecaae4877d6459a3a04153ca68b4a41183f005b0c9682f6e2517c7eb8f5c
- MD5 3be88664ce422f2b53a7a57ac0d5f2e9
- SHA1 bd0e192f78a35c02bccdd02daa41a20aa593509d
- SHA512 110a753b47f172515915baf87331cf42223e85e16809e3cb915c7a94607a775ebd91fbf83dc7f4fa35f09edb9834bdd98e402190834cbbb60ff3d5bcf7128d26
- SSDEEP 12288:yxG7d/SkC3OU+Z5jjLfph0lhSMXlilveFu1:SYqktU+ZZhh0lhSMXl22E1
- TLSH T14BC49D2673A447FCD86AC27449970A14F773B89407A19BCF22E0826A1F67BE55E7F301
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
267532
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Project\DWMBlurGlass\Build\x64\Release\DWMBlurGlassExt.pdb
kernel32
LockResource
OpenSemaphoreW
LoadResource
FindResourceW
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
DebugBreak
LoadLibraryExW
IsDebuggerPresent
DisableThreadLibraryCalls
CreateDirectoryW
GetCurrentProcess
CreateFile2
SetUnhandledExceptionFilter
GetSystemPowerStatus
VirtualProtect
LoadLibraryW
VirtualQuery
OutputDebugStringW
VirtualAlloc
GetSystemInfo
HeapCreate
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
HeapDestroy
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
ReadFile
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
EnterCriticalSection
LeaveCriticalSection
InterlockedPushEntrySList
RaiseException
GetLastError
FormatMessageW
WaitForSingleObjectEx
FreeResource
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
SizeofResource
GetModuleFileNameA
CloseHandle
GetPrivateProfileStringW
CreateFileW
GetModuleFileNameW
VirtualFree
GetFileSizeEx
RtlUnwindEx
user32
MonitorFromPoint
IsZoomed
IsIconic
GetMessageW
DefWindowProcW
FindWindowExW
DestroyWindow
SetWindowLongPtrW
CreateWindowExW
SendMessageW
UnregisterClassW
IsWindow
DispatchMessageW
UnregisterPowerSettingNotification
TranslateMessage
ChangeWindowMessageFilterEx
RegisterPowerSettingNotification
PostQuitMessage
GetDC
EnumDisplayMonitors
ReleaseDC
PostMessageW
EqualRect
GetMonitorInfoW
MonitorFromWindow
FindWindowW
IsRectEmpty
GetWindowRgn
GetWindowLongPtrW
OffsetRect
GetForegroundWindow
RegisterClassExW
IntersectRect
gdi32
GetCurrentObject
GetTextColor
CreateDIBSection
DeleteObject
GetRegionData
CreateRectRgn
OffsetRgn
EqualRgn
CreateRectRgnIndirect
GetObjectW
GetRgnBox
CombineRgn
advapi32
RegGetValueW
shlwapi
PathFileExistsW
ord12
uxtheme
CloseThemeData
DrawThemeTextEx
OpenThemeData
dwmapi
DwmGetWindowAttribute
DwmFlush
DwmSetWindowAttribute
DwmGetColorizationColor
api-ms-win-core-path-l1-1-0
PathCchAppend
PathCchRemoveFileSpec
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
WakeAllConditionVariable
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
dbghelp
MiniDumpWriteDump
ImageDirectoryEntryToData
api-ms-win-shcore-scaling-l1-1-1
GetDpiForMonitor
ucrtbase
__FrameUnwindFilter
__DestructExceptionObject
__TypeMatch
_CxxThrowException
_local_unwind
__current_exception
__AdjustPointer
_IsExceptionObjectToBeDestroyed
__C_specific_handler
memmove
_purecall
__std_exception_copy
__std_exception_destroy
memcmp
__std_type_info_compare
__processing_throw
__NLG_Return2
memset
_FindAndUnlinkFrame
_CreateFrameInfo
__std_type_info_destroy_list
__current_exception_context
__NLG_Dispatch2
memcpy
api-ms-win-crt-convert-l1-1-0
_wtoi
_wtof
_wtoll
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_invalid_parameter_noinfo
_errno
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_beginthreadex
terminate
_initialize_onexit_table
abort
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm_e
_initterm
api-ms-win-crt-string-l1-1-0
iswspace
_wcsicmp
_stricmp
api-ms-win-crt-math-l1-1-0
_fdsign
_dsign
_ldsign
ceilf
roundf
round
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
_callnewh
api-ms-win-crt-time-l1-1-0
wcsftime
_localtime64_s
api-ms-win-crt-locale-l1-1-0
__pctype_func
___mb_cur_max_func
___lc_codepage_func
localeconv
setlocale
_unlock_locales
_lock_locales
___lc_locale_name_func
ole32
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
oleaut32
SysStringLen
GetErrorInfo
SetErrorInfo
SysAllocString
SysFreeString
Name
.text
Size
286KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
222KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=2, id=257, version=32217,
count=1, id=259, version=32217,
count=3, id=261, version=32217,
count=1, id=261, version=31935,
count=1, id=259, version=31935,
count=56, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=30795,
count=4, id=259, version=33808,
count=8, id=260, version=33808,
count=69, id=261, version=33808,
count=1, id=260, version=30795,
count=21, id=257, version=30795,
count=300, id=1, productName=Unmarked objects,
count=26, id=265, version=34123,
count=1, id=255, version=34123,
count=1, id=151,
count=1, id=258, version=34123,
Release/data/AeroPeek.png
- SHA256 e8d37b88ef974f8c0ad0484908d573753ac12db69c6991b17da34f19311c7b20
- MD5 c5193f32f17ce6b13aa4ec1c1eb53e58
- SHA1 41ff6b576e35903c79d776ec87350cb9a768faba
- SHA512 1a3e91940a400fd41bf783dbf3545a2eba67eefe08664f08202b3772f726e2978f19e24a0a4bd5c6cf2a02e3f48fcbc0053dca2e99112dc75bb533ca8bda2716
- SSDEEP 1536:SBB3joMaqAWm1Nc1dssrbKumOYZYcTKpAcbggjdGLvsPIzpRpmjIrjtbl4RzPBia:SSqS7AD2YIgJggjd4swzvpmctR4NZCBM
- TLSH T1F4E3F2DE7F2B9C940CE7CE633661F648062CEC77285EF545E908B9C6CAEBD7010A1161
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/btnglow_close.png
- SHA256 0e65281e1e1bd40c89d99a847b85cd7795026bebd59cc141bdbf01defa4abd46
- MD5 37f7405232baa2dad24d640436bf2ad7
- SHA1 aa9e74e31c4d467a5a71ac603fee37b14e557aa1
- SHA512 d1ded1ded17a59898839e9d418f1cf34af109df5ec7ddd8f79b3f873dc66015aade6551ca8f2cb6d05762861139a15d5c3e459ddca1d251b599c0aba270ad76e
- TLSH T166412D67EB9D6CB0C05FCEE45333806F02215D5050113B179EB9AA5781A514A3FD57FB
- MD5 SHA1 SHA512 TLSH
Release/data/btnglow_other.png
- SHA256 0746d063c0b02c37d4fb689dd52d2be3ae9770b7af6070ea07eb8be43791248d
- MD5 65d4ec586a91d0cdbee17a887fdbae76
- SHA1 9d80ef11ee696a3e93df5b3ad1e1e3cd0c5234db
- SHA512 8978d14f42276ae49d99cf2dce8c19d3f95b1643d004e2b72bf32c5ced39b73472807cde882749330f81d0066d4935dcda2420adafb62ed7948b6b9875529e28
- TLSH T125412AD951F14CFD5D6B5412AB62668C4BF4A84A82D0C326D92E673A30AD18CFF1242F
- MD5 SHA1 SHA512 TLSH
Release/data/config.ini
- SHA256 d486dea362d5a862752ac3112978cf66098143bb588adf9b64ca6446b5106924
- MD5 6bc2a15b78ffd8b2a0db6df7ecc86e5c
- SHA1 a6058f091ee5a53c70eecf2584796997b7687764
- SHA512 68d120f0eb2b7d0f76369698e000aadcf1a658281c9aed4c863ceab5058c12c7d36953c69d1871f6b8d7f93659ea43c683e2e6e564203e99aa6a21c90eaafc73
- TLSH T1590128A138693934CA15C5DDAED27A43D283778BDEEEF0C0B6C4003536CAD8A2854A87
- MD5 SHA1 SHA512 TLSH
Release/data/defaultres.dmres
- SHA256 ce8dff320b50e97ea1d9818afcde23ba1b225ee6dbdb6566af77d8d38f801cd7
- MD5 b3465b72bfad7e74981a51b83d11b893
- SHA1 15276d0043e6bfa19dfa60d237de6fa45c1232cd
- SHA512 fb422ae3e153e79273ad4e912c767ddaa8a6b81f7133d320fca718fabb77246d6afc93f447062949235d7f2bd4154b488f18d143f0ff16fef688928b686c3e8d
- SSDEEP 3072:oTFu4We6u9lcXcVqe22j0r5oOiBKv52hUrfl6wZ/e8SZLm:ACsrcXcV32eglik8hgswhe8SZ6
- TLSH T1BCF322D1A03F2500C07E957469EAF2EA82E12D56F247E3819AD4D12FF94BE5EFE00785
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/de-DE.xml
- SHA256 134eaf45c976f60c24bfcb5ba4c12dd7da5b87bc28b2bcea9a103563215b107d
- MD5 ff0c80c42b8c95723abd2190e2f1bf04
- SHA1 c03cd04801a3dd5459b7f8750e5a9d80627ca7df
- SHA512 bb11619c68b436d7ebfd7628045aa35947ae1f06a6528c1d0555f8d8493fb4d6a2e193a02a333f236a65adc63aa4a4af2b93b8742c5dbc4eb4f11a3453910cad
- SSDEEP 96:gXi4nENx0YiBAOAWAAhV1LmTmM0MC2B+GWyux4H9UnMmzM28TqK0QZD8fAovkfnR:54gx0D1LmTmM0MPBxWyNKtHK0QOYiS
- TLSH T188D1F72269E672079747078F6233CD957A2ADB530373728431DAA03773875B2BA4D357
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/en-US.xml
- SHA256 58e0a3628add3933e01eb7bb4bf9accfe63c0d5c3c88c39a88eb83e2c19d8d77
- MD5 e4958acd5052a38d85a66671ff891878
- SHA1 d097dc7a3f11c0bb5a851350c0dd7b89df41ad6f
- SHA512 f4a98480495343fe3ec8ec2e563954786c4e2e2eca72da17ab841074de9eeeacdb72d8a7114d22cc3f0bf9f3459896690db1c7114a71cde89d409a1ebf7cefad
- SSDEEP 96:wc/2E9rczjQlNTc0ewyM40M5+FBL2IC578zD5Urs+A80z/c08/NBw2Jz:wc2E9Kjsc0ewyM40M5sIrs+Ooz
- TLSH T1F9C1782A9B1037731F83019E62BBAE113B2605D7437B915130E9613FF38E4A6B6867D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/es-MX.xml
- SHA256 b88ec2ee7b80fd1df5a752c9a4e13c0f010b47d30a4fedb21c3f49a39edc7ef1
- MD5 a6e7ff9939605b6882d1dc1eb39bcd65
- SHA1 43a5f94afc522fec25de1688d3398ffa50312bbf
- SHA512 e7dd66f8ce18fd88fc37af9dd01da568fdb86e93b05d795c9bcc5d971025a7b0401a68744a9f9c8a746d426257778d8a9a62fe03c70d27e1c9a37b7fcd229d4e
- TLSH T12F81643EE9842B233E8211AD5063D957B5860BD1237AC2C072FE66375285CDCFA4579B
- MD5 SHA1 SHA512 TLSH
Release/data/lang/es.xml
- SHA256 1fafffda648b1f3fb32b370fda6cdf3a469763cf00047f2261f41945f94b1697
- MD5 e61cf3b3c8dbb897d975faaa4e022c23
- SHA1 a24e893e585fe895c51fe887dc2c72f3c5bfb82f
- SHA512 a265a3f265b595def15cb7b1ec716c0406fb2b216ae9ebcf5986ebb21c3883b855150a4eef757711ac26e792345b7335d70988de501b3092499b27454b310c62
- SSDEEP 96:i5iLTbRPQVsf7k4y1mMkM1+D6P+IQZgYoOxg+Sa4n8W4ChXS6Ed89e9rtAeFjK:vRP1Ly1mMkM1E5Na+SFn8W4ChKriT
- TLSH T1AED18639B9C52A236A93118D91B3EA07B5460AD7373AC2C1B1AF123B61C49DCE942B47
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/fr-FR.xml
- SHA256 ef5be282ff3374f20c4e2bb8d8f699ecb6dc2cde3fdc5f71757e021206964e31
- MD5 aec35bf3d663e6c5f9529c0fd08db59f
- SHA1 5556453f4cac1fbd231bb964dd2854e3e7192f2b
- SHA512 cf3ed58dd47edebf56581c1e3c5f387f3b19ccdb76a836dce8cb92c209fb2aeaafb8998ec5a5c98651aa091db31bbeac882c02918155177080482d763626d038
- SSDEEP 96:GWKINgHw6c8y5wMIMEB+OodCQ3h+ie5eHcnOoPiV+08415iBRUg:GWOfPMIMEBWw5edoP83cGg
- TLSH T10EC1C92BA1D136832EC2139BF133ED1374390946137BE65075DB6677938D4BCB60A6E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/id-ID.xml
- SHA256 c1a39a9fe9c5f14c3fd4209daef743ce2e704368cc5fbea2eae139a33a61b74d
- MD5 82a5adf6aa93ba289f82769c53beb1f3
- SHA1 3b60b14d13027b560ebc5341d579439378bc85df
- SHA512 5c17cb638c62dc6efda9acf42831328578416a9ede4e546db2ed8337b7824ed3793bf77e3854cc7957bf8504f60919b00028cd2b623d0728010d034aa13d6140
- TLSH T16F71531AE44836131D6307DC91B75C16288F07E223BB665A3754BFFB12C59B0B747A1E
- MD5 SHA1 SHA512 TLSH
Release/data/lang/it-IT.xml
- SHA256 e7f0ad5b38e91d315dfaa88233f776b3f6d47fae5255a9be814bc740989b32c0
- MD5 be114dba448eb341a3ff08173e065ed8
- SHA1 fdc3bcf7494948c6984719248573c82af0fc0dd4
- SHA512 ab03831aeb6c2a2f3c83fd3df70984dad2a535269d91310644a1d54745cbd084e51f2da259e03a490944782e78ea3ceb1f8ea6eaace2e8d607400fc69c5b6eea
- SSDEEP 96:R+wRYDrAwZkU23BlYgJjDSMJIMVz+nTObRW73RzDQZ414tqJYo+ykfRB+t2087qa:xwt2RlzMM6MVzATjh2tqJr+HCW7B2TC
- TLSH T11BD1B63AE55162236F93138DC073B147FA7E0DC56B772A503097273FE2CA9A4355868B
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/ja-JP.xml
- SHA256 040ad4c056cb099659b84eb2fb637ccf22350509ba246865858040f732859946
- MD5 432b48e3d46af4c84226d3cd0c394174
- SHA1 ae27191f6247929dbc6881c5ef46ad06373612e8
- SHA512 5180f1f7f2adc468b18925b22c4e71b1ffada9e9437d80c7c1f8603799d3ab0a2aacb3ad37f57061745a18be6933cde06d2be55788e42d763b936fcdcf2365ea
- SSDEEP 192:emazW/elSTIKMQ5hMP0L7E6uaif/8/ebfn:ecelSsXQ5aP03GGM
- TLSH T13CE1323DE3C066239EA1427A143FB28166424C97CDB7B632202EE036BB5459EF517FB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/ko-KR.xml
- SHA256 84a676d13931d6c2ace39cad9f41e4669b25e4d9c63206ba9ba2319a866c8bde
- MD5 6f91163063d3cff324145cd0f78d4f53
- SHA1 a0255775169d142aa735f8fa8d52c56445a8cd61
- SHA512 25059d0cad4c4cff875880e0d31c215a0ded1d3eb14b412d280b9aba94ae81a40f3f90d42ecfe3b91d748fe09a840bb5eb435c252fab7c2adffc3f7081be0a48
- SSDEEP 96:rz4SkV85yRDfxZjVfT5oRK8nzb9dMMMKV+qqMbQuVJFUcrS1LZv/MimrTuHcTi2Y:rzr0fF5U1zjMMMKVRqMEvdJJxE7LqV
- TLSH T1F7D1C9B199D727841BC38A89B9F3F60443824662577351807CC5AD33DAA88D7BD429BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/pt-BR.xml
- SHA256 1be1ce3e9d3da3eab9874860b9a73dae0f9ba378ea66071660629c7bfb6d4ff5
- MD5 8d1007492e590246a2aac6c2f33493b4
- SHA1 e98b45dae919c4887cd5e22574308443e3663e12
- SHA512 fb8d87e77d7051dbe6ed8aae89f6ca51c13bbc4472edca96b951383e335f6aefa021d632be2fe31432af99e6c22c4423d0f65b09a9defb97b75c234e74f33db9
- SSDEEP 96:Fu0jy4P0JoRMWEMp+YjbsYxEYj57WQm6huMHf/Y+D4AHN08VgILoFuS:FrjyVJqMdMp7jzEMfgslpS
- TLSH T192D1E83F99901B271F0303C956379E0B66490B935B3BC4C16B9F673BB2C5985BA43647
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/pt-PT.xml
- SHA256 d2fe9bfded7d0d1b8405c80edd5397cc40c2bc9cbf1f1cfc5ff4017d4f37fc18
- MD5 32f1f279f542f91fbd65d2512a8fe4e5
- SHA1 8235e08ab51d6f8c96c88e2c80de700e401fe13c
- SHA512 536ed7f1a8aae0173c56c8699e737ae0c3a8671780a7e2464689c85c1862b5cfa05e770c8ebc25a0465b6b40b92837fc9c6915acab8810346290e2e74f4fa954
- SSDEEP 96:132zBtk+rGQXZOucI4bm4ltY5bWQmZtENx55r/YeBbk5rM08wgI+I:1GzBt3GkoucI4j305rgakX
- TLSH T1E8D1943A89D01A630B33034A5752AE0FEE4907935607C5C077DF870B6FF68958647B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/ru-RU.xml
- SHA256 b831117b3927cd8bdc33f32ad3360a8596c96b4ffe06ecd1ff6f12006ecd72d5
- MD5 db63ecf3f78c15cf39066f610b280109
- SHA1 2628452c9ac726d277fbab16d7ce7bb10d17a575
- SHA512 e01895df60bc533e71059fc2744f8c199e4f5db1c8a20b81c0a7f4acb184567647b87ff3ce24f7c92426fb43cf2c502d77013cc7606e82f4945370da90811ac2
- SSDEEP 192:Sn1yO/6IgMFMPISjs5R+siNg+UD/Cqzb0:aQ46IJ2PISjy+M4
- TLSH T12602FF31959A70AB0602B54BD81BBE0678AB45FE3FBB976315A03C3F71F6020C72D656
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/sv-SE.xml
- SHA256 456e80eda4aed352bfa0222438bdf72709b337245beb2b3803b70ab045cb10e2
- MD5 bfddd9a82959407949141b6298d265b9
- SHA1 5573c0ca2a880f3cee24a72cb7de46d9d2626038
- SHA512 a81f581dd4c829e9474c6b2960782f193c50f9de003479d921931a22508ae4a76234180d30a64e3e01f7255cd53241dd8b93687185f2099fe2e470e0cfc0205c
- SSDEEP 96:mJQkPo8NyYF0N1UVXBMROMi+6Hp9rIrc1OHw87mgqot08MQmysS7:EQ6fy7vUDMUMirHn4z3sS7
- TLSH T1D4B1D6179E60F2637A030A8FA1776D1711FE869553FB108530C9993FB38E4E2B19BB46
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/tr-TR.xml
- SHA256 313f7ff5612dc0eb14b4ec5c08a2826aa132eeb772b792acd2ab25ab6b79c4bc
- MD5 df7894d75044f54423667e3459727b62
- SHA1 3ced10f5a2d9ec81a35f0f7ce83285e0ca789672
- SHA512 be6be3a0a70e071a77fe53e456b455164749de69f7be71f18ddcef2c58fc43f83ecc4bc215345cb0cbe26c9fe95b373dcfee69ca6194b2aad16696bd00b3c2c5
- SSDEEP 96:WbgVBGan5+fjxGfWNgvyJI+6UTVYMTMh+yK/IS9vJUKlCP18oia0QWdWF0GDc1zc:WbgVBG4oLofEgvyJF6UTVYMTMhxKdLvU
- TLSH T180C1D514FCA53C195F9717CE80B38A1AD05B0B536333B9C57155A933B3892867687B0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/vi-VN.xml
- SHA256 3a2af7a3fdeadab501d36f33bd42e29c835b8137cf275d225a5b74c3286aec67
- MD5 42ccb78e5c4ae1bca23c6653354bb27e
- SHA1 7df983fb29ee2bbbb53c489c149e68c322ff349c
- SHA512 c8dca0866120957af6796c95d38155da4dc9744634225b5cdbf399b131d1d8e973d2862a79abcb35d5f1a6481744f43e57371bdb01b001fbb8b8e13b21cd7e79
- SSDEEP 96:SES3HBI8pWl/FN6ZT944BMD4FsxMUf+zPJsvjh8fFkx4/eKe1SG7oqVFB5TGuc3O:S88pK6ZTWSM8sM2WO69gbhW/Q
- TLSH T1A3D1622112903123866E462EC1EFD80D6BCE695FE3F38E8039F0257BAA514957F06F4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/zh-CN.xml
- SHA256 5849fb257954f4c31cd49ee1a527d5f4c49a1cb5feee1cdc99d4087cf35376c5
- MD5 74bdf7ba72c6ad892284d2a735d89ffc
- SHA1 404117e4cafb05f68114190bd6421df48005b444
- SHA512 43e1dd3bba3c1b00a7418371e3d645bfd15ddce4a574fa145285db2e09cfc946abc5ff4140ea33f3a59c5a9ad7ec6206826cdfd7c5be974aa7958781333eda76
- SSDEEP 96:E10HXbXKJ6GmYgFhcOxJQCMmtzMl1+OmlxjLkO6M3Y0SAwpWVeWc2VhXF:EW2J6GmY+hcOxJQCMmtzMl1Uxv6MIMVF
- TLSH T124B1C735A2042BAA1B4322CD127BE62AF1051B861377FA907285743B724986D7F43F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/zh-SG.xml
- SHA256 e5e7f07441b6e53871f9e8edc5b6418f0af19bc34f6603c9ae0007c7352b8071
- MD5 8057d4a04472d178338b66771cecbe6f
- SHA1 72ffaff5a05475e517fc0f49fb2b298e4bff49de
- SHA512 5be68f056008e80935e691f79430a8f725b764996aa1b84028ece2297c8d66066232440b13243824ab5195d9e2e748236ad89e3cbc461cba79cfc26cf96da0a8
- SSDEEP 96:h10HXbXKJ6GmYgFhcOxJQCMmtzMl1+OmlxjLkO6M3Y0SAwpWVeWc2VhXF:hW2J6GmY+hcOxJQCMmtzMl1Uxv6MIMVF
- TLSH T15DB1C835E2042BAA1B4322CD137BE62AF1051B861377FA907285743B724986D7F43F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/lang/zh-TW.xml
- SHA256 322a40da382a76fd3b19181a7803e710c3980d31d9e5a959ec92389f7aee8f43
- MD5 01ea1d33a2ad8e26e77f8b19328a5496
- SHA1 eedf563f630d54da57b7603232ed6c409d8d04a1
- SHA512 98393965755bc45d6bdfb8e80a7c64af1ce3e551f56d2750b420f5a54b0a7e5e7e470481c090c0557f86425cccb7578e5da885a58891a901ac6cf0fb432d2783
- SSDEEP 96:6q2XzLb5tr/7RBLJceOzWpVaFyIJhHAM/MT+WVRLXu2XYTGM23VedN1CY0GIWrbq:Kzv7r/7RTceOzWpuyIJhHAM/MTPRLXu+
- TLSH T1C9B1FA74C81522AF0B6195DD11B7AB03643516426373AE92701AB0737F8C86A3E03F4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/symbols/dwmcore.pdb/AB3E8DEE7EDC8B1006D8C2FA5917BEE41/dwmcore.pdb
- SHA256 78cd1f7bf193a89b936b88c92c550f50ae630ab9a0c8dc08002e6711ac911a33
- MD5 1501588b057d505f59e41e25ad2303e7
- SHA1 1f42a2bcb11248dd95048618f71c4240809615eb
- SHA512 ce2a2fa3a1758545c1fcaef55410842a6021613c413cfddcae2fe825c8822e62136885c660ef742c57129ac7655d0da01440ba3f1ddfab2734cfe9f64e3fdfd7
- SSDEEP 49152:dO5EWKYtzGDsggktHQLE91BWL9eQOrqjpCOS6Zrmuh3Zprd2xHviKfNDKmXUz4UM:dbZE3Y
- TLSH T1A446F812775B98F2C82B533B9096074DF6B8CE8293A7C65F695A33352DD3346CE9A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/data/symbols/uDWM.pdb/183C267E422D329FEDB78CD31AC2E1C51/uDWM.pdb
- SHA256 4a5dbbccb3d1432e86815d104ea6d62311b960de2a19380f2db11255f48c9bbc
- MD5 0db870a7c6b965fe15d5fea1565d9d85
- SHA1 c23e14fe850f51a098f88070c4924457dffc71aa
- SHA512 92ab9838f276afa842fac56d213ac06ac3e0630798475401edcab781daeea39ac032e0ef9bc1a73b1ff7649f39133d3c19fab87341448cf81c264f54ff0a4ed9
- SSDEEP 49152:AjLRQb/LZann0elfZoR0HX9+0jCmAvID+jinVkuHTzQFMfD4LWgSv+NQwX+2kdPP:AMuHTzQFMfD4LWgSv+GwX+2kdPKi0Npg
- TLSH T18BC5F825676B5AE3CD2F437A45D61359BAB8DF8123A3855F386672322CD3202CF9F640
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/dbghelp.dll
- IMPHASH c2a265611426f9f34c59e87a7c46fba1
- SHA256 131493d48eeec95099053066c90fa2a56adaede68aadf81c2f0201316598ca8a
- MD5 68e66b04c1d3289b0cc96391060c922a
- SHA1 4176b12cc308f697ee49430c27f351c46f41e7eb
- SHA512 611e0f416e8ccd39bd61a25e290c09596e8f33999af608f77461d57b33cc13753614d72f2f57800a715a5eed1414338095004c09eba9a8be9bb6d29ddb4de7a1
- SSDEEP 24576:oUaCbolDmqg16nkCCYJ+Wd+rxGJa1/XgvwmfCt0QdWFPTgZp2z3skeK:oUaCbolDM16njtKg8rVt0QdCTY2z3b
- TLSH T1E8A58D4796EC00A8DD7AE13CC69B520BE3F2781617209BDF1294876E2F73AE55A3D305
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
09:70:ab:d3:15:f7:38:3e:7d:64:17:6f:2e:ac:ed:4e:4a:35:e9:64:5a:34:86:4e:96:d3:c3:b7:ca:00:30:87
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 12, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:fe:59:ca:b7:e6:2a:a5:22:c1:00:00:00:00:04:fe
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ba:1f:3f:19:f7:c1:75:bd:7c:00:01:00:00:01:ba
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
516656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dbghelp.pdb
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
strlen
wcsncmp
strcmp
strcspn
strncmp
wcscmp
api-ms-win-crt-time-l1-1-0
_time64
_ctime64
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
api-ms-win-crt-runtime-l1-1-0
__doserrno
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__filelengthi64
_o__fullpath
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__lseeki64
_o__ltoa
_o__mbscmp
_o__memicmp
_o__open_osfhandle
_o__purecall
_o__read
_o__register_onexit_function
_o__seh_filter_dll
_o__splitpath_s
_o__stricmp
_o__strlwr
_o__strnicmp
_o___stdio_common_vsprintf_s
_o__aligned_malloc
_o__wcsdup
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wctime64
_o__wdupenv_s
_o__wfsopen
_o__wfullpath
_o__wgetenv
_o__wmakepath_s
_o__wsplitpath_s
_o__wtoi
_o_abort
_o_atoi
_o_atol
_o_bsearch
_o_calloc
_o_ceilf
_o_fclose
_o_fflush
_o_fread
_o_free
_o_frexp
_o_fseek
_o_ftell
_o_isspace
_o_iswprint
_o_iswspace
_o_iswxdigit
_o_localeconv
_o_malloc
_o_qsort
_o_realloc
_o_setlocale
_o_strcat_s
_o_strcpy_s
_o_strncat_s
_o_strncpy_s
_o_terminate
_o_tolower
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstoul
_o_wmemcpy_s
__uncaught_exception
_CxxThrowException
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__close
_o__aligned_free
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
wcsrchr
strstr
_o__cexit
_o__calloc_base
_o__callnewh
wcsstr
wcschr
__C_specific_handler
__CxxFrameHandler3
memcpy
__unDName
strchr
strrchr
__unDNameEx
memcmp
memmove
_o___stdio_common_vswprintf_s
_o___stdio_common_vsscanf
api-ms-win-core-file-l1-1-0
CreateFileA
GetFinalPathNameByHandleW
RemoveDirectoryW
SetFilePointerEx
GetFileSize
DeleteFileW
FindClose
CreateFileW
SetEndOfFile
GetFileType
SetFileAttributesW
SetFileTime
GetFileInformationByHandle
GetFileSizeEx
GetFileAttributesA
CreateDirectoryW
FindNextFileW
FindFirstFileW
WriteFile
ReadFile
SetFilePointer
CreateDirectoryA
GetFileAttributesW
GetFullPathNameW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetErrorMode
GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
OpenProcess
LeaveCriticalSection
EnterCriticalSection
TryAcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
AcquireSRWLockExclusive
DeleteCriticalSection
ReleaseSRWLockShared
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
ExpandEnvironmentStringsW
SetEnvironmentVariableA
api-ms-win-core-misc-l1-1-0
FormatMessageW
Sleep
LocalAlloc
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentThread
TlsGetValue
OpenThreadToken
TlsFree
TlsAlloc
GetCurrentProcessId
TlsSetValue
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-sysinfo-l1-1-0
GetVersionExA
GetSystemInfo
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
SystemTimeToFileTime
api-ms-win-core-libraryloader-l1-1-0
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
LoadLibraryExA
GetModuleHandleExW
api-ms-win-security-base-l1-1-0
GetFileSecurityW
AccessCheck
RevertToSelf
ImpersonateSelf
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualQuery
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
VirtualAlloc
VirtualProtect
MapViewOfFileEx
ReadProcessMemory
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
DebugBreak
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-localization-l1-1-0
LCMapStringW
LCMapStringEx
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
ntdll
RtlUTF8ToUnicodeN
RtlRunOnceExecuteOnce
api-ms-win-downlevel-kernel32-l2-1-0
CreateFileMappingA
api-ms-win-core-localregistry-l1-1-0
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-threadpool-l1-1-0
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk2
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymAllocDiaString
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFreeDiaString
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetDiaSession
SymGetDiaSource
SymGetExtendedOption
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrEx
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameEx
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextEx
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevEx
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileChecksum
SymGetSourceFileChecksumW
SymGetSourceFileFromToken
SymGetSourceFileFromTokenByTokenName
SymGetSourceFileFromTokenByTokenNameW
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenByTokenName
SymGetSourceFileTokenByTokenNameW
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymRegisterGetSourcePathPartCallback
SymRegisterSourceFileUrlListCallback
SymSearch
SymSearchW
SymSetContext
SymSetDiaSession
SymSetExtendedOption
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSetServiceManager
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
_EFN_DumpImage
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
372KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=261, version=30625,
count=8, id=260, version=30625,
count=4, id=257, version=30795,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1266, id=1, productName=Unmarked objects,
count=12, id=260, version=30795,
count=4, id=259, version=30795,
count=1, id=256, version=30795,
count=99, id=264, version=30795,
count=2, id=253, version=30795,
count=34, id=261, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Release/symsrv.dll
- IMPHASH 3176d2caa21b7195b44c14757c825d9f
- SHA256 0c86ecde02f6f1914bb28cee8f0fe24d61514b64ec245e2205058bfbcddffe82
- MD5 497fa5a31783c8c4f01868f148af3051
- SHA1 b1eeb2cd1b5830d04b2e7af8f77f7f29d92051e7
- SHA512 f8df4f56086bd6013b3fb4644bca586f7685a42c7181dfccf55fae07354173b69884438dc1e79705423cded01be7a96a0b9bc550dd7a75febedbe55bb9a2f7f3
- SSDEEP 6144:QaTukwLaV09TycV2GTEGkzYiYSmav6LtHNQbgjpeWhSGu:QtGV0pycV2kFkzHYSp6LccleN
- TLSH T1A084071DA2E85469F1B2B5788AB7C515E7B278601735C3CF1190C13E2E67FD4AE38B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
19:37:36:78:bc:6c:cb:e8:76:40:a8:31:23:30:9b:5d:42:27:84:b2:a2:61:1c:27:2d:46:6f:e7:49:ae:8e:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 12, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:fe:59:ca:b7:e6:2a:a5:22:c1:00:00:00:00:04:fe
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ba:1f:3f:19:f7:c1:75:bd:7c:00:01:00:00:01:ba
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
192208
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
symsrv.pdb
msvcrt
_stricmp
_errno
getenv
fclose
swprintf_s
_wfopen
??1type_info@@UEAA@XZ
fgetws
_vscprintf
_wcsdup
_vsnwprintf_s
vswprintf_s
memcmp
wcsrchr
_wcslwr_s
__CxxFrameHandler3
tolower
_wmakepath_s
_wtoi64
free
swscanf_s
strnlen
wcsnlen
_wcsicmp
isspace
__C_specific_handler
wcsncpy_s
_wcsnicmp
wcschr
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
strcpy_s
memset
_onexit
??0exception@@QEAA@XZ
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
??0exception@@QEAA@AEBQEBD@Z
wcsncmp
_wcsupr
?terminate@@YAXXZ
wcsstr
calloc
iswspace
malloc
strpbrk
strstr
realloc
iswprint
_wcslwr
memcpy_s
towlower
strcat_s
_unlock
__dllonexit
wcscat_s
strrchr
_CxxThrowException
memcpy
memmove
_vsnwprintf
??_V@YAXPEAX@Z
wcscpy_s
_XcptFilter
_amsg_exit
_initterm
_lock
_vscwprintf
wcscmp
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleExW
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExA
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetExitCodeThread
GetCurrentThreadId
OpenProcessToken
TerminateProcess
GetCurrentProcessId
CreateThread
api-ms-win-core-misc-l1-1-0
LocalFree
LocalAlloc
GlobalFree
FormatMessageW
Sleep
LocalReAlloc
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-security-base-l1-1-0
GetTokenInformation
FreeSid
AllocateAndInitializeSid
EqualSid
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileTime
GetFileSizeEx
CreateDirectoryW
SetFilePointerEx
DeleteFileW
GetDriveTypeW
RemoveDirectoryW
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileAttributesW
GetFileAttributesExW
GetFileSize
FileTimeToLocalFileTime
DeleteFileA
CreateFileA
LocalFileTimeToFileTime
GetFileInformationByHandle
SetFilePointer
SetFileTime
ReadFile
WriteFile
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
SetErrorMode
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
ExpandEnvironmentStringsW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetVersionExW
GetTickCount
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
OpenSemaphoreW
TryAcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
ReleaseMutex
CreateMutexExW
ReleaseSRWLockShared
CreateSemaphoreExW
AcquireSRWLockShared
InitializeCriticalSection
SetEvent
SetWaitableTimer
DeleteCriticalSection
LeaveCriticalSection
OpenMutexW
ReleaseSemaphore
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
ResetEvent
AcquireSRWLockExclusive
CreateEventW
api-ms-win-core-handle-l1-1-0
CloseHandle
rpcrt4
UuidCreate
api-ms-win-core-localregistry-l1-1-0
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ws2_32
GetAddrInfoW
WSAStartup
FreeAddrInfoW
WSACleanup
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
oleaut32
SysFreeString
shlwapi
PathFindFileNameW
kernel32
WaitForMultipleObjects
IsProcessorFeaturePresent
CancelSynchronousIo
ntdll
RtlRunOnceExecuteOnce
RtlUTF8ToUnicodeN
crypt32
CryptStringToBinaryW
CryptBinaryToStringW
bcrypt
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-core-threadpool-l1-1-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexAndChecksumsW
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptionData
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerPingWEx
SymbolServerSetHttpAuthHeader
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
SymbolServerWEx
SymbolServerWithChecksumsW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile
Name
.text
Size
200KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=30795,
count=17, id=260, version=30795,
count=295, id=1, productName=Unmarked objects,
count=9, id=257, version=30795,
count=14, id=261, version=30795,
count=1, id=256, version=30795,
count=61, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,