Zynova.7z
- SHA256 6a5cef231985c1231aca3887baecd5d4de708f08bb79cad15a669d60f8d17536
Overview
overview
5Static
static
5Bin/Files/Patched.dll
windows10-2004-x64
5Bin/Files/Patched.dll
windows11-ltsc_2024-x64
5Bin/Files/...le.dll
windows10-2004-x64
1Bin/Files/...le.dll
windows11-ltsc_2024-x64
1Bin/Files/...on.exe
windows10-2004-x64
5Bin/Files/...on.exe
windows11-ltsc_2024-x64
5Zynova.exe
windows10-2004-x64
5Zynova.exe
windows11-ltsc_2024-x64
5Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Bin/Files/Patched.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bin/Files/Patched.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Bin/Files/ZynovaModule.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Bin/Files/ZynovaModule.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Bin/Files/emulation.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Bin/Files/emulation.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Zynova.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Zynova.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Zynova.7z
- Size 60.7MB
- Sample260930-ptpxeaycmd
- SHA256 6a5cef231985c1231aca3887baecd5d4de708f08bb79cad15a669d60f8d17536
- MD5 e6acc8c212694a4f5821a83174aba1ce
- SHA1 3ec6de38c7d78391f9d7f94569459ccce4551cce
- SHA512 95aa90b7636c7ace1d24637cafd81aaa930e07c8e407bdd805de1db961ed3145da4008eac342f3764c4eeae14a9dc414585192139268a511be4b80a1a5a1d202
- SSDEEP 1572864:OYhqTCVHulilIqNCCmeeoPZDaLWpkTMqCSr1JBw2NGET:OYw6eMCXeeoULMIMNQavS
- TLSH T1D7D7333B5344BC67D4CD863998321A64A1CC6B2813C2F62A59758D40C1DBEFF7A77A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/Bin/Files/Patched.dll - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bin/Files/ZynovaModule.dll unpack001/Bin/Files/emulation.exe unpack001/Zynova.exe
File Explorer
-
Zynova.7z.7z 60.7MB
-
Bin/Files/Patched.dll.dll 21.5MB
-
Bin/Files/ZynovaModule.dll.dll 3.5MB
-
Bin/Files/emulation.exe.exe 32.1MB
-
Zynova.exe.exe 28.5MB
Bin/Files/Patched.dll
- IMPHASH 25a621496d55b63a4a093a58517db840
- SHA256 d6f60d53135dfc351c65936f99739bb3349d2d17474eeaf8d53d2d8474c73848
- MD5 53242f23486a77471a3a039c642024b3
- SHA1 144c456414ed34c0ee2472ab7dc8612ba8d147d1
- SHA512 cc54dfe267db1491af99b488dfabf47988619aaab942457d289d48e1596f8dbe6c2552a61802013cbbc3e7dd9a1a8d81d3e1d34c9bb4797b6f74565b6b9f0f7c
- SSDEEP 196608:xHHpfdBLwIb6MvbVBOGWE0ymAcKtbidzvSApDC:xpfwLlydJtWC
- TLSH T10C37CF4EF8D60AE4D17250B1E55F56D3EA66304C4A6C2EB783D90320367369EB248F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
2c:c3:3b:0c:e7:6f:d1:a8:00:83:5f:82:18:c8:ce:76:3d:2c:a3:33:d3:69:20:1a:28:76:19:3a:5b:c5:a2:d8
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 1, 0001
Subject
SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 19, 2025 - Dec 18, 2026
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
8690424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
loader.pdb
ntdll
NtTerminateProcess
RtlCaptureContext
RtlFreeHeap
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount64
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSRWLockExclusive
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
user32
MessageBeep
run
Name
.rdata
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.byfron
Size
19.3MB
Virtual Size
19.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Bin/Files/ZynovaModule.dll
- IMPHASH de208de497282ac529e542dc4b806bbb
- SHA256 0bea2e3888978397d79f06f070303e036a0693a239fdc5b8f9c7bfbb97a2f850
- MD5 8de4eef4ea1daeffa3b8310c6e10a64e
- SHA1 e36cf3400bae0e3306a7bc0d53060f2e2ec7fddf
- SHA512 16e634d0b1a3b4aaf57b9c9385eca3a0dd32f903bce5df4d0794d65959b267d31a3517a357a18da0e8a57b89c3eb57c6f821e4f1c964b9b58a22922c741722a5
- SSDEEP 49152:iNaSAelexBMQ9ooMlWzaCSWMHPNwg9mchshMnCgs:IaT9oRlWMPHPNwg9mchsQs
- TLSH T19EF5BF9E72AA45EBC097C27CDFD2A923E2F1390123517BEB6681852D2F13BD046F8715
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1703892
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\User\Desktop\Module.pdb
ws2_32
WSACleanup
accept
bind
closesocket
ntohl
listen
getaddrinfo
WSAStartup
socket
recv
freeaddrinfo
setsockopt
gethostname
ioctlsocket
getpeername
sendto
recvfrom
htonl
getsockname
connect
select
__WSAFDIsSet
htons
WSAIoctl
ntohs
WSAGetLastError
WSASetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
wldap32
ord27
ord32
ord33
ord22
ord79
ord30
ord200
ord301
ord26
ord35
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
crypt32
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CryptBinaryToStringA
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
normaliz
IdnToAscii
IdnToUnicode
kernel32
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
GetSystemTimeAsFileTime
InitializeSListHead
GetFileInformationByHandleEx
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
CreateDirectoryW
GetModuleFileNameA
ExpandEnvironmentStringsW
OutputDebugStringA
GetCurrentThreadId
Sleep
DisableThreadLibraryCalls
GetLocalTime
GetCurrentProcessId
SetUnhandledExceptionFilter
ReadFile
FindFirstFileW
GetFileSizeEx
HeapFree
UnhandledExceptionFilter
FindNextFileW
WriteFile
RemoveDirectoryW
SetFilePointer
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetLastError
DeleteFileW
CloseHandle
HeapAlloc
GetProcessHeap
VirtualQuery
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
GetSystemDirectoryA
GetEnvironmentVariableA
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerifyVersionInfoW
CreateFileA
RtlVirtualUnwind
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetFullPathNameW
CopyFileW
AreFileApisANSI
GetFileInformationByHandle
GetFileAttributesExW
LocalFree
FindFirstFileExW
GetLocaleInfoEx
FormatMessageA
GetModuleHandleExA
user32
ReleaseCapture
GetClientRect
SetWindowLongW
SetCursor
SetCapture
LoadCursorW
BringWindowToTop
SetFocus
SetLayeredWindowAttributes
GetForegroundWindow
TrackMouseEvent
IsChild
ClientToScreen
GetMonitorInfoW
SetForegroundWindow
keybd_event
GetSystemMetrics
ReleaseDC
MapVirtualKeyA
mouse_event
FindWindowA
CallWindowProcW
IsIconic
GetDpiForWindow
SetWindowLongPtrW
MessageBoxA
GetWindowLongW
DefWindowProcW
AdjustWindowRectEx
GetKeyState
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
CreateWindowExW
ScreenToClient
SetWindowTextW
RegisterClassExW
WindowFromPoint
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
ShowWindow
MessageBoxW
GetCapture
gdi32
GetDeviceCaps
advapi32
CryptDestroyHash
CryptAcquireContextA
CryptDestroyKey
CryptReleaseContext
CryptGetHashParam
CryptImportKey
CryptSetKeyParam
CryptHashData
CryptCreateHash
CryptDecrypt
CryptGenRandom
CryptEncrypt
CryptAcquireContextW
GetCurrentHwProfileW
msvcp140
??0_Lockit@std@@QEAA@H@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Mtx_unlock
_Thrd_detach
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
_Mtx_lock
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
_Query_perf_frequency
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Xtime_get_ticks
_Strcoll
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Id_cnt@id@locale@std@@0HA
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??Bios_base@std@@QEBA_NXZ
_Strxfrm
??1_Lockit@std@@QEAA@XZ
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx
d3dcompiler_47
D3DCompile
bcrypt
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptHashData
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler_noexcept
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memchr
memcmp
memset
memmove
memcpy
wcsrchr
strrchr
__std_terminate
__std_exception_destroy
__std_exception_copy
strstr
strchr
__C_specific_handler
_purecall
api-ms-win-crt-runtime-l1-1-0
exit
_cexit
_beginthreadex
terminate
_invoke_watson
_initterm_e
_errno
_crt_atexit
_execute_onexit_table
__sys_errlist
_register_onexit_function
_initialize_onexit_table
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
abort
__sys_nerr
api-ms-win-crt-string-l1-1-0
strncpy
_stricmp
toupper
isblank
isalnum
isspace
tolower
_wcsnicmp
wcscpy_s
_wcsicmp
strspn
strcmp
strcpy_s
strcspn
strncat
_strdup
islower
isdigit
ispunct
iscntrl
isxdigit
isalpha
isupper
isgraph
strpbrk
strncmp
api-ms-win-crt-heap-l1-1-0
free
calloc
realloc
malloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
_wfopen_s
_lseeki64
_read
_open
fputc
fopen
__stdio_common_vsprintf_s
feof
__stdio_common_vswprintf
fputs
_get_stream_buffer_pointers
_write
_fseeki64
fgets
fsetpos
_fileno
fgetc
ftell
_close
__acrt_iob_func
__stdio_common_vfprintf
setvbuf
__stdio_common_vsscanf
fread
fgetpos
__stdio_common_vsprintf
_wfopen
fwrite
ungetc
fflush
fclose
fseek
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
wcstombs
strtod
strtoull
strtoul
atoi
strtol
api-ms-win-crt-math-l1-1-0
exp
floorf
cosh
cosf
cos
_dsign
ldexp
round
log
ceil
modf
floor
atan2
log2
atan
pow
asin
_dclass
powf
tan
_fdclass
sin
log10
sinf
fmod
frexp
ceilf
sinh
acos
sqrt
tanh
sqrtf
_fdopen
llround
acosf
api-ms-win-crt-time-l1-1-0
_gmtime64
_localtime64_s
_gmtime64_s
_difftime64
_time64
clock
strftime
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_unlink
_access
_stat64
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=28, id=261, version=35207,
count=6, id=257, version=35207,
count=125, id=260, version=33519,
count=12, id=260, version=34120,
count=530, id=1, productName=Unmarked objects,
count=25, id=257, version=33145,
count=88, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
Bin/Files/emulation.exe
- IMPHASH 4d11c56f70292ba122fcc6acfffb220e
- SHA256 6140aa8327fc6df9037cec2a9348f78356f88a7f2877e07aa793b28aea3b56bd
- MD5 be2c860a7c83a9693c3db44e09bead8f
- SHA1 e150cd38be8b34cb8bc61f6d2634292c21e0cd45
- SHA512 471188e4510eebc197676fe9c935d4a7ae4f4f1f51144e536f27236b93443612699684ab71964df7057a4899ae351663fa2c97583c61ff8ef416c6c9cabfc484
- SSDEEP 393216:VxRZKw1pIHYM9iXqHrzJ40rA7mobz8jYKjvuN6EneS+KJEIVHNZLvaOXB1OaDpUv:DRZKw4Y81Hm6YuG6EmcPXBcalUCRun7
- TLSH T1AC77239A66E5F3C48BC34984278E11DA21D2A4BE84EE453C3EC75C03A534DEB559CEB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
34984593
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntdll
NtQueryObject
kernel32
WideCharToMultiByte
advapi32
SetNamedSecurityInfoW
msvcp140
_Thrd_join
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.Y;Z
Size
Virtual Size
19.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.5mi
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.(+K
Size
32.1MB
Virtual Size
32.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Zynova.exe
- IMPHASH 2a9e39b8a35d6a7acb4014f9a2d35f8e
- SHA256 3c00ee919b4e30197066e670cbd54ee8a9c9fad43d78e390307a60fad272acfd
- MD5 f1eadff53b0de21d7ce7395e84daf94f
- SHA1 66dccb6f311aa47f598d6c8977d83aa7eec510bf
- SHA512 a52d4dde989f2fafc5dd54c8963b8f8af65670d9f67c3082f7780e9982901679cbffa518daccb61b150d293f871579c2b7d5e392748fbf888dcf8ce6451f22f3
- SSDEEP 393216:A2AdEXIWMqDhG0FLdj1mg3UN2Oa2NVH8p99pBW7ys1x+l6UB+ENhC3GLbkKd+/s1:PAr7q9GUjYgPiNVcp9J5rD0ELC3Y1+E
- TLSH T1F36723A675D6B2D887C30A48638E13DB50C1B57645F994343EC71803E920DEF7A8AEB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
31864245
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WaitForSingleObjectEx
user32
AppendMenuW
shlwapi
SHCreateMemStream
ole32
CoInitializeEx
comctl32
SetWindowSubclass
shell32
SHOpenFolderAndSelectItems
advapi32
RegGetValueW
EventSetInformation
oleaut32
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
bcryptprimitives
ProcessPrng
ntdll
NtOpenFile
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
gdi32
DeleteObject
dwmapi
DwmGetWindowAttribute
combase
CoTaskMemAlloc
imm32
ImmGetCompositionStringW
ws2_32
WSAStartup
pdh
PdhCloseQuery
powrprof
CallNtPowerInformation
psapi
GetModuleFileNameExW
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-string-l1-1-0
wcscmp
api-ms-win-crt-convert-l1-1-0
_ultow_s
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
6.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
408KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.$+!
Size
Virtual Size
15.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.Fsz
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.h<<
Size
28.5MB
Virtual Size
28.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ