SecretTweak.zip
- SHA256 d85860f97da9226e7ec67bd51a5377fa67fee244d863f64d4bb54b018b6ed7c9
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SecretTweak/!loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
600 seconds
Behavioral task
behavioral2
Sample
SecretTweak/!loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
600 seconds
Behavioral task
behavioral3
Sample
SecretTweak/SecretTweak.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
600 seconds
Behavioral task
behavioral4
Sample
SecretTweak/SecretTweak.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
600 seconds
General
- Target SecretTweak.zip
- Size 15.5MB
- Sample261011-c82taset21
- SHA256 d85860f97da9226e7ec67bd51a5377fa67fee244d863f64d4bb54b018b6ed7c9
- MD5 04c075a3e11469975adeb86fa0f87aa1
- SHA1 00ac114fe847e4a2d4488164eadda0271c0c721a
- SHA512 c5f7ac84fa7554177c32461056ff17d028515453baa1e3c05ef2a25f44a10cb72631bd10998c757c50602f3e20f75f68892ebb1c387e12facc6276b066a41fc7
- SSDEEP 393216:FJH6wPA6fzUdJBJ6jp5SCTeSkbvjPMTPGJle4XtnQ:Ft4gUdJj66CahbjbLe4W
- TLSH T124F63335CF3662CA593E09E7613FCD51F1CF1726AABCE10AC981297B6299E388770C54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/SecretTweak/!loader.exe unpack001/SecretTweak/BYND-TOOL.exe unpack001/SecretTweak/SecretTweak.exe unpack001/SecretTweak/SecureEngineSDK64.dll unpack001/SecretTweak/stpatch.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/SecretTweak/STKM.sys
File Explorer
-
SecretTweak.zip.zip 15.5MB
-
SecretTweak/!loader.exe.exe 421KB
-
SecretTweak/BYND-TOOL.exe.exe 5.7MB
-
SecretTweak/README.txt3KB
-
SecretTweak/STKM.sys.exe 27KB
-
SecretTweak/SecretTweak.exe.exe 11.4MB
-
SecretTweak/SecureEngineSDK64.dll.dll 28KB
-
SecretTweak/dbghelp.dll.dll 2.1MB
-
SecretTweak/stpatch.dll.dll 48KB
-
SecretTweak/symsrv.dll.dll 413KB
-
SecretTweak/vcredist.url.url 189B
SecretTweak/!loader.exe
- IMPHASH 8e2de105c307122f760ff2390318c9a8
- SHA256 1d6d1019d2ee3ccf602791a9fa4889d65ba5852566483c029ebc5f4e0bfb0418
- MD5 119c35d23debb20c766cab505438abe7
- SHA1 1caa0727edd5ea7cfc60cf3a1b3d53ee52ef55d5
- SHA512 279692272c5b8d752d10a667aa56823a9c2a5181fc3caa69c2372fd1bd969bc3248fea2e8123bc8ee44fc4d169e232c9df483332a2ed238447744f431edfaa10
- SSDEEP 6144:+dQz/gH4HHb/gWjOMqhhcjyxiVGE1DHldU:+y/uSHb39GcjykV1DFO
- TLSH T108947D03F6B1D0A8D446C0B4970B9B534B63F4891B11A6EF2BE535142FA9BE28F3B354
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8419
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntdll
LdrGetProcedureAddress
LdrLoadDll
LdrUnloadDll
NtAlertThread
NtAlertThreadByThreadId
NtAllocateVirtualMemory
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtClose
NtCreateFile
NtCreateNamedPipeFile
NtCreateSection
NtCreateThreadEx
NtDelayExecution
NtDeviceIoControlFile
NtFlushBuffersFile
NtFreeVirtualMemory
NtFsControlFile
NtLockFile
NtMapViewOfSection
NtOpenFile
NtOpenThread
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryObject
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtReadFile
NtResumeThread
NtSetInformationFile
NtSetInformationObject
NtSetInformationVirtualMemory
NtTerminateProcess
NtUnlockFile
NtUnmapViewOfSection
NtWaitForAlertByThreadId
NtWaitForSingleObject
NtWriteFile
RtlActivateActivationContextEx
RtlAllocateHeap
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlExitUserProcess
RtlFreeHeap
RtlGetActiveActivationContext
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
RtlGetSystemTimePrecise
RtlLeaveCriticalSection
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlReleaseActivationContext
RtlReportSilentProcessExit
RtlSetCurrentDirectory_U
RtlUpcaseUnicodeChar
kernel32
CloseHandle
CreateProcessW
GetLastError
GetModuleFileNameW
GetStdHandle
OpenProcess
ReadProcessMemory
ResumeThread
Sleep
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
WaitForSingleObject
WriteFile
WriteProcessMemory
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
52KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.CRT
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SecretTweak/BYND-TOOL.exe
- IMPHASH d8dee0e8ceb0aeb9e20e82406372eff1
- SHA256 5a9bcf994e34bf7d1e9b0e26b378776c52ce26cc18e88f4f5f05ca489b13a401
- MD5 66730f05ac2e357b7cb6adf367581a31
- SHA1 a9e80621394adca11056c878f83b9b8ab635e7b6
- SHA512 d41a4870e15ea833d103b4dc5b960a173f0d4f3027e1c8e1079494a36c44a9edd6da9dae66027a5e39d572de7b78048e4dbf3df819239748eb7f438f91bc3fda
- SSDEEP 49152:X+YK6d7/Y/zsL54Rw/b4/lbJjwnnKk2X8N6uCiKNr8H2/V7tW/tsMnDYD5LHbd+j:7Kh/zW/bil3sN6uCVr22tw6v
- TLSH T12F56BF02E3F545AEE176C2388952E233E7F67C01933587EBE6C45E1B6B13AD84A79311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1703136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
CloseTrace
OpenProcessToken
ProcessTrace
OpenTraceW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegGetValueW
GetTokenInformation
ControlTraceW
FlushTraceW
StartTraceW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
ConvertSidToStringSidW
RegSetKeyValueW
shell32
ShellExecuteW
ShellExecuteA
CommandLineToArgvW
SHGetKnownFolderPath
kernel32
GetProcAddress
LoadLibraryA
GetLocaleInfoA
IsDBCSLeadByte
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetTempPathW
SetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
WaitForSingleObject
FormatMessageA
GetTickCount64
SetLastError
ReplaceFileW
MoveFileExW
GetWindowsDirectoryW
DeviceIoControl
GetFileAttributesW
FreeLibrary
DeleteFileW
ExpandEnvironmentStringsW
GetActiveProcessorCount
GetActiveProcessorGroupCount
GetLogicalProcessorInformationEx
GetSystemCpuSetInformation
CreateProcessW
GetExitCodeProcess
TerminateProcess
CreatePipe
SetHandleInformation
WriteFile
CreateFileW
GetStdHandle
GetLocalTime
GetCurrentProcess
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
OutputDebugStringA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
QueryFullProcessImageNameW
MulDiv
LocalFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetModuleHandleA
GetCurrentThreadId
CreateThread
FlushFileBuffers
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleW
GetModuleFileNameW
OpenProcess
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
SetUnhandledExceptionFilter
GetStartupInfoW
CreateEventW
GetProcessTimes
Sleep
CloseHandle
GetEnvironmentVariableW
GetCommandLineW
CreateFile2
AreFileApisANSI
GetSystemTimeAsFileTime
InitializeSListHead
GetFileInformationByHandleEx
GetLocaleInfoEx
user32
RegisterClassW
IsChild
CloseClipboard
SetPropA
GetPropA
AdjustWindowRectEx
SetCursorPos
SetLayeredWindowAttributes
BringWindowToTop
SetFocus
MsgWaitForMultipleObjects
IsWindowUnicode
SetForegroundWindow
TrackMouseEvent
SetCursor
GetKeyboardLayout
EmptyClipboard
GetMessageExtraInfo
ClientToScreen
WindowFromPoint
TranslateMessage
DispatchMessageW
GetClipboardData
SendMessageW
PostMessageW
WaitMessage
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
GetWindowLongW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
IsIconic
IsZoomed
EnumDisplayMonitors
GetGUIThreadInfo
GetKeyState
GetAsyncKeyState
GetCapture
PeekMessageW
GetAncestor
SetCapture
GetRawInputData
ReleaseCapture
RegisterRawInputDevices
OpenClipboard
GetDpiForWindow
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
EnumDisplaySettingsW
LoadImageW
LoadCursorW
SetClipboardData
GetSystemMetrics
GetWindowThreadProcessId
ScreenToClient
UpdateWindow
GetCursorPos
MessageBoxW
MessageBoxA
GetWindowRect
GetForegroundWindow
GetClientRect
GetDC
ValidateRect
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
SetProcessDpiAwarenessContext
gdi32
DeleteDC
GetDeviceCaps
CreateDIBSection
StretchBlt
SelectObject
BitBlt
CreateCompatibleDC
DeleteObject
msvcp140
_Query_perf_counter
_Query_perf_frequency
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
_Cnd_broadcast
_Cnd_signal
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Random_device@std@@YAIXZ
_Xtime_get_ticks
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?rdstate@ios_base@std@@QEBAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
msvcp140_atomic_wait
__std_atomic_wait_direct
__std_atomic_notify_all_direct
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
wevtapi
EvtQuery
EvtClose
EvtNext
EvtRender
hid
HidD_GetAttributes
HidD_GetPreparsedData
HidD_FreePreparsedData
HidD_SetFeature
HidD_GetFeature
HidP_GetCaps
HidD_GetHidGuid
iphlpapi
IcmpCreateFile
IcmpSendEcho2Ex
GetAdaptersAddresses
vcruntime140
__std_terminate
__intrinsic_setjmp
__current_exception_context
__current_exception
__C_specific_handler
longjmp
strstr
strrchr
strchr
memset
__std_exception_copy
memmove
__std_exception_destroy
memcpy
memcmp
_CxxThrowException
memchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
wcsnlen
towlower
tolower
iswspace
wcslen
strlen
toupper
isspace
strcpy_s
_strnicmp
strncmp
_stricmp
_wcsicmp
strcpy
api-ms-win-crt-heap-l1-1-0
free
_callnewh
_set_new_mode
malloc
api-ms-win-crt-stdio-l1-1-0
fputc
fread
fsetpos
_fseeki64
__p__commode
_set_fmode
fwrite
setvbuf
_get_stream_buffer_pointers
ungetc
__acrt_iob_func
__stdio_common_vsprintf_s
_wfopen
fseek
__stdio_common_vswprintf_s
ftell
__stdio_common_vfprintf
fclose
fgetpos
__stdio_common_vsprintf
__stdio_common_vsscanf
fflush
fgetc
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
pow
_dsign
sinf
acosf
sqrtf
fmodf
cosf
floor
floorf
ceilf
__setusermatherr
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
strftime
_time64
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
wcstoul
strtoull
strtoll
strtod
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_errno
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
exit
terminate
_beginthreadex
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
localeconv
setupapi
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW
CM_Disable_DevNode
SetupDiEnumDeviceInfo
CM_Enable_DevNode
CM_Locate_DevNodeW
SetupDiGetDeviceInstanceIdW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_Device_IDW
SetupDiGetClassDevsW
ole32
CoTaskMemFree
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
509KB
Virtual Size
508KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=253, version=35721,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=39, id=261, version=35721,
count=8, id=257, version=35721,
count=2, id=262, version=33145,
count=8, id=260, version=35214,
count=61, id=260, version=35227,
count=1, id=260, version=33145,
count=29, id=257, version=33145,
count=499, id=1, productName=Unmarked objects,
count=19, id=261, version=36257,
count=1, id=255, version=36257,
count=1, id=151,
count=1, id=258, version=36257,
SecretTweak/README.txt
- SHA256 b68765162202a94d13df2cef6752542180fecddc143f15ef71c4a30be7ef1b02
- MD5 72dba4401161dee10269da6276b1151d
- SHA1 99e18da4b0f5fb949cc2a77258e73dfa4b71e402
- SHA512 877f06081124027c4258dfaa319bbe614dcfb83b69fd5684380bf1f682efb89cbe5b6d94e3f24092e7f8c0899665d4a081b8f1346db1b10bc4390ea85aceb21e
- TLSH T1F08196A0915E34FB0020E65BDE0E380C7ABA54BE6E3B4BB768F05C3E76660B4C23514D
- MD5 SHA1 SHA512 TLSH
SecretTweak/STKM.sys
- IMPHASH 07a0df5c76a6255be0e9a298dc683e15
- SHA256 7a83474024da0840432a52c93545f833d3067b976fdf8fa1670005a2086e3d4d
- MD5 c44f5045d1e11d426ec789b89a604eed
- SHA1 0761f38724be0303176867567da71625079dbfc6
- SHA512 6c822521be718d56e7a9a1946d39eac9316aeb1a9d26c8ded5cc1f17af920de02360c4363d4f40431c5df03cf2168c4cebed695ef39e67467892009968e28582
- SSDEEP 384:A3S+Q7fTKPD5wKaBnB64sa2HId/SzDxoH5HV/auRn+2HX5mkF+5f/DMI8Ir8KPO:sTyTSdJa1JzdaeV/fjLFCMI8cPO
- TLSH T1C6C23A1163D615EEE42AC6BDD2BA1437A7B9B404032348EF35A0C8650FA3FD5E9BC749
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
62:21:52:1d:1e:ca:2c:5a:f3:ef:c1:40:14:e8:98:d2:71:a9:09:7a:7d:79:48:94:42:21:b6:c2:1c:f9:6e:82
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WDKTestCert BYND\,133999996153057023
Chains
Oct 7, 2026
CN=WDKTestCert BYND\,133999996153057023
Subject
CN=WDKTestCert BYND\,133999996153057023
Serial Number
31:9e:20:09:a0:28:06:9a:4c:94:9e:0f:ec:4a:b4:2e
Issuer
CN=WDKTestCert BYND\,133999996153057023
Key Usages
KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2025 - Aug 18, 2035
Minor OS version
0
Major OS version
10
Entry point
16592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\BYND\source\repos\MyDriver1\x64\Release\STKM.pdb
ntoskrnl.exe
RtlFreeAnsiString
DbgPrintEx
KeSetPriorityThread
ExAllocatePoolWithTag
ExAllocatePool2
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetCurrentProcess
RtlUnicodeStringToAnsiString
ObfDereferenceObject
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
ZwWriteFile
ZwClose
PsGetCurrentProcessId
PsGetThreadId
PsGetThreadProcessId
ZwSetInformationThread
SeLocateProcessImageName
ObOpenObjectByPointer
_vsnprintf
__C_specific_handler
strlen
wcscmp
PsThreadType
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlInitUnicodeString
wcsrchr
_stricmp
IoFreeWorkItem
strchr
wdfldr.sys
WdfVersionUnbind
WdfLdrQueryInterface
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=263, version=33140,
count=5, id=257, version=33140,
count=49, id=1, productName=Unmarked objects,
count=6, id=259, version=33140,
count=8, id=260, version=33140,
count=1, id=260, version=35217,
count=1, id=258, version=35217,
SecretTweak/SecretTweak.exe
- SHA256 92a65702c5459eb17d64e89027aed58452d5c2af82b4263416d8d1d0c9707bc7
- MD5 bd976ef6e826044093c2969024b516a2
- SHA1 fee7af9150e6d7e5b2c3bf9cec452292efaed4e5
- SHA512 55e0a4c549d9c26e86d56ac37b2fba872de682928eadebdf5a5ba689bc3b1bbdf543b9aff3bb476a4f51e8afe914e82dd4a4fc10ce6da14eae1672aa57d97c11
- SSDEEP 196608:jxYKmji0bBQVps2n4LEysIFUgCVQ+nfDem5MWqPVAOyMG7Eui/gOR/jbGsI53cx:6thbBQVpRnhygQ+nfDefWqPVA197EuiB
- TLSH T1F2C633220361BCBAF08E07B839B7D4F456765E224FBADA1CF1AF05B7464654D8FB6090
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
21811288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
3.3MB
Virtual Size
7.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
993KB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
15KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
175KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2.0MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
29KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=253, version=35721,
count=10, id=260, version=35721,
count=50, id=261, version=35721,
count=6, id=259, version=35721,
count=6, id=257, version=35721,
count=43, id=260, version=33523,
count=5, id=261, version=35728,
count=123, id=260, version=32535,
count=2, id=123, version=2207,
count=61, id=260, version=35227,
count=825, id=260, version=35214,
count=39, productName=Unmarked objects (old),
count=1, id=262, version=33145,
count=5, id=260, version=33145,
count=43, id=257, version=33145,
count=1024, id=1, productName=Unmarked objects,
count=23, id=265, version=36257,
count=1, id=259, version=36257,
count=1, id=255, version=36257,
count=3, id=151,
count=1, id=258, version=36257,
SecretTweak/SecureEngineSDK64.dll
- SHA256 175a75ca524b269b25fb5144dc0abb4ac9b1673852df3abfbd4f6c449e01827d
- MD5 6d8722b257230e3f691197715ec2b4b1
- SHA1 bf141f3aff5b5e1cd2f02a5d81125931ba4a842d
- SHA512 b6d077c57780ab6d58649cee36a1016573adfcafcfa8c823297a19f8bb1d1ea0c1b613044076bcd805a0c18dc37a78208ebaa4d0e19c192b65415028355f1069
- SSDEEP 192:3Mi08s5GvuxBdzbNEQaSpqX5xS5haVWUcSAfMVIBizxhv:cdZxBhaHfSsA0V
- TLSH T148D2ACAF04B56EFBF91D1CF4059F3A9822C3F3D22DF4866D636E418401EA81B655F289
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ClearEnd
ClearStart
CodeReplaceEnd
CodeReplaceStart
CustomVM00000100_End
CustomVM00000100_Start
CustomVM00000101_End
CustomVM00000101_Start
CustomVM00000102_End
CustomVM00000102_Start
CustomVM00000103_End
CustomVM00000103_Start
CustomVM00000104_End
CustomVM00000104_Start
CustomVM00000105_End
CustomVM00000105_Start
CustomVM00000106_End
CustomVM00000106_Start
CustomVM00000107_End
CustomVM00000107_Start
CustomVM00000108_End
CustomVM00000108_Start
CustomVM00000109_End
CustomVM00000109_Start
CustomVM00000110_End
CustomVM00000110_Start
CustomVM00000111_End
CustomVM00000111_Start
CustomVM00000112_End
CustomVM00000112_Start
CustomVM00000113_End
CustomVM00000113_Start
CustomVM00000114_End
CustomVM00000114_Start
CustomVM00000115_End
CustomVM00000115_Start
CustomVM00000116_End
CustomVM00000116_Start
CustomVM00000117_End
CustomVM00000117_Start
CustomVM00000118_End
CustomVM00000118_Start
CustomVM00000119_End
CustomVM00000119_Start
CustomVM00000120_End
CustomVM00000120_Start
CustomVM00000121_End
CustomVM00000121_Start
CustomVM00000122_End
CustomVM00000122_Start
CustomVM00000123_End
CustomVM00000123_Start
CustomVM00000124_End
CustomVM00000124_Start
CustomVM00000125_End
CustomVM00000125_Start
CustomVM00000126_End
CustomVM00000126_Start
CustomVM00000127_End
CustomVM00000127_Start
CustomVM00000128_End
CustomVM00000128_Start
CustomVM00000129_End
CustomVM00000129_Start
CustomVM00000130_End
CustomVM00000130_Start
CustomVM00000131_End
CustomVM00000131_Start
CustomVM00000132_End
CustomVM00000132_Start
CustomVM00000133_End
CustomVM00000133_Start
CustomVM00000134_End
CustomVM00000134_Start
CustomVM00000135_End
CustomVM00000135_Start
CustomVM00000136_End
CustomVM00000136_Start
CustomVM00000137_End
CustomVM00000137_Start
CustomVM00000138_End
CustomVM00000138_Start
CustomVM00000139_End
CustomVM00000139_Start
CustomVM00000140_End
CustomVM00000140_Start
CustomVM00000141_End
CustomVM00000141_Start
CustomVM00000142_End
CustomVM00000142_Start
CustomVM00000143_End
CustomVM00000143_Start
CustomVM00000144_End
CustomVM00000144_Start
CustomVM00000145_End
CustomVM00000145_Start
CustomVM00000146_End
CustomVM00000146_Start
CustomVM00000147_End
CustomVM00000147_Start
CustomVM00000148_End
CustomVM00000148_Start
CustomVM00000149_End
CustomVM00000149_Start
CustomVM00000150_End
CustomVM00000150_Start
CustomVM00000151_End
CustomVM00000151_Start
CustomVM00000152_End
CustomVM00000152_Start
CustomVM00000153_End
CustomVM00000153_Start
CustomVM00000154_End
CustomVM00000154_Start
CustomVM00000155_End
CustomVM00000155_Start
CustomVM00000156_End
CustomVM00000156_Start
CustomVM00000157_End
CustomVM00000157_Start
CustomVM00000158_End
CustomVM00000158_Start
CustomVM00000159_End
CustomVM00000159_Start
CustomVM00000160_End
CustomVM00000160_Start
CustomVM00000161_End
CustomVM00000161_Start
CustomVM00000162_End
CustomVM00000162_Start
CustomVM00000163_End
CustomVM00000163_Start
CustomVM00000164_End
CustomVM00000164_Start
CustomVM00000165_End
CustomVM00000165_Start
CustomVM00000166_End
CustomVM00000166_Start
CustomVM00000167_End
CustomVM00000167_Start
CustomVM00000168_End
CustomVM00000168_Start
CustomVM00000169_End
CustomVM00000169_Start
CustomVM00000170_End
CustomVM00000170_Start
CustomVM00000171_End
CustomVM00000171_Start
CustomVM00000172_End
CustomVM00000172_Start
CustomVM00000173_End
CustomVM00000173_Start
CustomVM00000174_End
CustomVM00000174_Start
CustomVM00000175_End
CustomVM00000175_Start
CustomVM00000176_End
CustomVM00000176_Start
CustomVM00000177_End
CustomVM00000177_Start
CustomVM00000178_End
CustomVM00000178_Start
CustomVM00000179_End
CustomVM00000179_Start
CustomVM00000180_End
CustomVM00000180_Start
CustomVM00000181_End
CustomVM00000181_Start
CustomVM00000182_End
CustomVM00000182_Start
CustomVM00000183_End
CustomVM00000183_Start
CustomVM00000184_End
CustomVM00000184_Start
CustomVM00000185_End
CustomVM00000185_Start
CustomVM00000186_End
CustomVM00000186_Start
CustomVM00000187_End
CustomVM00000187_Start
CustomVM00000188_End
CustomVM00000188_Start
CustomVM00000189_End
CustomVM00000189_Start
CustomVM00000190_End
CustomVM00000190_Start
CustomVM00000191_End
CustomVM00000191_Start
CustomVM00000192_End
CustomVM00000192_Start
CustomVM00000193_End
CustomVM00000193_Start
CustomVM00000194_End
CustomVM00000194_Start
CustomVM00000195_End
CustomVM00000195_Start
CustomVM00000196_End
CustomVM00000196_Start
CustomVM00000197_End
CustomVM00000197_Start
CustomVM00000198_End
CustomVM00000198_Start
CustomVM00000199_End
CustomVM00000199_Start
CustomVM00000200_End
CustomVM00000200_Start
CustomVM00000201_End
CustomVM00000201_Start
CustomVM00000202_End
CustomVM00000202_Start
CustomVM00000203_End
CustomVM00000203_Start
CustomVM00000204_End
CustomVM00000204_Start
CustomVM00000205_End
CustomVM00000205_Start
CustomVM00000206_End
CustomVM00000206_Start
CustomVM00000207_End
CustomVM00000207_Start
CustomVM00000208_End
CustomVM00000208_Start
CustomVM00000209_End
CustomVM00000209_Start
CustomVM00000210_End
CustomVM00000210_Start
CustomVM00000211_End
CustomVM00000211_Start
CustomVM00000212_End
CustomVM00000212_Start
CustomVM00000213_End
CustomVM00000213_Start
CustomVM00000214_End
CustomVM00000214_Start
CustomVM00000215_End
CustomVM00000215_Start
CustomVM00000216_End
CustomVM00000216_Start
CustomVM00000217_End
CustomVM00000217_Start
CustomVM00000218_End
CustomVM00000218_Start
CustomVM00000219_End
CustomVM00000219_Start
CustomVM00000220_End
CustomVM00000220_Start
CustomVM00000221_End
CustomVM00000221_Start
CustomVM00000222_End
CustomVM00000222_Start
CustomVM00000223_End
CustomVM00000223_Start
CustomVM00000224_End
CustomVM00000224_Start
CustomVM00000225_End
CustomVM00000225_Start
CustomVM00000226_End
CustomVM00000226_Start
CustomVM00000227_End
CustomVM00000227_Start
CustomVM00000228_End
CustomVM00000228_Start
CustomVM00000229_End
CustomVM00000229_Start
CustomVM00000230_End
CustomVM00000230_Start
CustomVM00000231_End
CustomVM00000231_Start
CustomVM00000232_End
CustomVM00000232_Start
CustomVM00000233_End
CustomVM00000233_Start
CustomVM00000234_End
CustomVM00000234_Start
CustomVM00000235_End
CustomVM00000235_Start
CustomVM00000236_End
CustomVM00000236_Start
CustomVM00000237_End
CustomVM00000237_Start
CustomVM00000238_End
CustomVM00000238_Start
CustomVM00000239_End
CustomVM00000239_Start
CustomVM00000240_End
CustomVM00000240_Start
CustomVM00000241_End
CustomVM00000241_Start
CustomVM00000242_End
CustomVM00000242_Start
CustomVM00000243_End
CustomVM00000243_Start
CustomVM00000244_End
CustomVM00000244_Start
CustomVM00000245_End
CustomVM00000245_Start
CustomVM00000246_End
CustomVM00000246_Start
CustomVM00000247_End
CustomVM00000247_Start
CustomVM00000248_End
CustomVM00000248_Start
CustomVM00000249_End
CustomVM00000249_Start
CustomVM00000250_End
CustomVM00000250_Start
CustomVM00000251_End
CustomVM00000251_Start
CustomVM00000252_End
CustomVM00000252_Start
CustomVM00000253_End
CustomVM00000253_Start
CustomVM00000254_End
CustomVM00000254_Start
CustomVM00000255_End
CustomVM00000255_Start
CustomVM00000256_End
CustomVM00000256_Start
CustomVM00000257_End
CustomVM00000257_Start
CustomVM00000258_End
CustomVM00000258_Start
CustomVM00000259_End
CustomVM00000259_Start
CustomVM00000260_End
CustomVM00000260_Start
CustomVM00000261_End
CustomVM00000261_Start
CustomVM00000262_End
CustomVM00000262_Start
CustomVM00000263_End
CustomVM00000263_Start
CustomVM00000264_End
CustomVM00000264_Start
CustomVM00000265_End
CustomVM00000265_Start
CustomVM00000266_End
CustomVM00000266_Start
CustomVM00000267_End
CustomVM00000267_Start
CustomVM00000268_End
CustomVM00000268_Start
CustomVM00000269_End
CustomVM00000269_Start
CustomVM00000270_End
CustomVM00000270_Start
CustomVM00000271_End
CustomVM00000271_Start
CustomVM00000272_End
CustomVM00000272_Start
CustomVM00000273_End
CustomVM00000273_Start
CustomVM00000274_End
CustomVM00000274_Start
CustomVM00000275_End
CustomVM00000275_Start
CustomVM00000276_End
CustomVM00000276_Start
CustomVM00000277_End
CustomVM00000277_Start
CustomVM00000278_End
CustomVM00000278_Start
CustomVM00000279_End
CustomVM00000279_Start
CustomVM00000280_End
CustomVM00000280_Start
CustomVM00000281_End
CustomVM00000281_Start
CustomVM00000282_End
CustomVM00000282_Start
CustomVM00000283_End
CustomVM00000283_Start
CustomVM00000284_End
CustomVM00000284_Start
CustomVM00000285_End
CustomVM00000285_Start
CustomVM00000286_End
CustomVM00000286_Start
CustomVM00000287_End
CustomVM00000287_Start
CustomVM00000288_End
CustomVM00000288_Start
CustomVM00000289_End
CustomVM00000289_Start
CustomVM00000290_End
CustomVM00000290_Start
CustomVM00000291_End
CustomVM00000291_Start
CustomVM00000292_End
CustomVM00000292_Start
CustomVM00000293_End
CustomVM00000293_Start
CustomVM00000294_End
CustomVM00000294_Start
CustomVM00000295_End
CustomVM00000295_Start
CustomVM00000296_End
CustomVM00000296_Start
CustomVM00000297_End
CustomVM00000297_Start
CustomVM00000298_End
CustomVM00000298_Start
CustomVM00000299_End
CustomVM00000299_Start
CustomVM00000300_End
CustomVM00000300_Start
CustomVM00000301_End
CustomVM00000301_Start
CustomVM00000302_End
CustomVM00000302_Start
CustomVM00000303_End
CustomVM00000303_Start
CustomVM00000304_End
CustomVM00000304_Start
CustomVM00000305_End
CustomVM00000305_Start
CustomVM00000306_End
CustomVM00000306_Start
CustomVM00000307_End
CustomVM00000307_Start
CustomVM00000308_End
CustomVM00000308_Start
CustomVM00000309_End
CustomVM00000309_Start
CustomVM00000310_End
CustomVM00000310_Start
CustomVM00000311_End
CustomVM00000311_Start
CustomVM00000312_End
CustomVM00000312_Start
CustomVM00000313_End
CustomVM00000313_Start
CustomVM00000314_End
CustomVM00000314_Start
CustomVM00000315_End
CustomVM00000315_Start
CustomVM00000316_End
CustomVM00000316_Start
CustomVM00000317_End
CustomVM00000317_Start
CustomVM00000318_End
CustomVM00000318_Start
CustomVM00000319_End
CustomVM00000319_Start
CustomVM00000320_End
CustomVM00000320_Start
CustomVM00000321_End
CustomVM00000321_Start
CustomVM00000322_End
CustomVM00000322_Start
CustomVM00000323_End
CustomVM00000323_Start
CustomVM00000324_End
CustomVM00000324_Start
CustomVM00000325_End
CustomVM00000325_Start
CustomVM00000326_End
CustomVM00000326_Start
CustomVM00000327_End
CustomVM00000327_Start
CustomVM00000328_End
CustomVM00000328_Start
CustomVM00000329_End
CustomVM00000329_Start
CustomVM00000330_End
CustomVM00000330_Start
CustomVM00000331_End
CustomVM00000331_Start
CustomVM00000332_End
CustomVM00000332_Start
CustomVM00000333_End
CustomVM00000333_Start
CustomVM00000334_End
CustomVM00000334_Start
CustomVM00000335_End
CustomVM00000335_Start
CustomVM00000336_End
CustomVM00000336_Start
CustomVM00000337_End
CustomVM00000337_Start
CustomVM00000338_End
CustomVM00000338_Start
CustomVM00000339_End
CustomVM00000339_Start
CustomVM00000340_End
CustomVM00000340_Start
CustomVM00000341_End
CustomVM00000341_Start
CustomVM00000342_End
CustomVM00000342_Start
CustomVM00000343_End
CustomVM00000343_Start
CustomVM00000344_End
CustomVM00000344_Start
CustomVM00000345_End
CustomVM00000345_Start
CustomVM00000346_End
CustomVM00000346_Start
CustomVM00000347_End
CustomVM00000347_Start
CustomVM00000348_End
CustomVM00000348_Start
CustomVM00000349_End
CustomVM00000349_Start
CustomVM00000350_End
CustomVM00000350_Start
CustomVM00000351_End
CustomVM00000351_Start
CustomVM00000352_End
CustomVM00000352_Start
CustomVM00000353_End
CustomVM00000353_Start
CustomVM00000354_End
CustomVM00000354_Start
CustomVM00000355_End
CustomVM00000355_Start
CustomVM00000356_End
CustomVM00000356_Start
CustomVM00000357_End
CustomVM00000357_Start
CustomVM00000358_End
CustomVM00000358_Start
CustomVM00000359_End
CustomVM00000359_Start
CustomVM00000360_End
CustomVM00000360_Start
CustomVM00000361_End
CustomVM00000361_Start
CustomVM00000362_End
CustomVM00000362_Start
CustomVM00000363_End
CustomVM00000363_Start
CustomVM00000364_End
CustomVM00000364_Start
CustomVM00000365_End
CustomVM00000365_Start
CustomVM00000366_End
CustomVM00000366_Start
CustomVM00000367_End
CustomVM00000367_Start
CustomVM00000368_End
CustomVM00000368_Start
CustomVM00000369_End
CustomVM00000369_Start
CustomVM00000370_End
CustomVM00000370_Start
CustomVM00000371_End
CustomVM00000371_Start
CustomVM00000372_End
CustomVM00000372_Start
CustomVM00000373_End
CustomVM00000373_Start
CustomVM00000374_End
CustomVM00000374_Start
CustomVM00000375_End
CustomVM00000375_Start
CustomVM00000376_End
CustomVM00000376_Start
CustomVM00000377_End
CustomVM00000377_Start
CustomVM00000378_End
CustomVM00000378_Start
CustomVM00000379_End
CustomVM00000379_Start
CustomVM00000380_End
CustomVM00000380_Start
CustomVM00000381_End
CustomVM00000381_Start
CustomVM00000382_End
CustomVM00000382_Start
CustomVM00000383_End
CustomVM00000383_Start
CustomVM00000384_End
CustomVM00000384_Start
CustomVM00000385_End
CustomVM00000385_Start
CustomVM00000386_End
CustomVM00000386_Start
CustomVM00000387_End
CustomVM00000387_Start
CustomVM00000388_End
CustomVM00000388_Start
CustomVM00000389_End
CustomVM00000389_Start
CustomVM00000390_End
CustomVM00000390_Start
CustomVM00000391_End
CustomVM00000391_Start
CustomVM00000392_End
CustomVM00000392_Start
CustomVM00000393_End
CustomVM00000393_Start
CustomVM00000394_End
CustomVM00000394_Start
CustomVM00000395_End
CustomVM00000395_Start
CustomVM00000396_End
CustomVM00000396_Start
CustomVM00000397_End
CustomVM00000397_Start
CustomVM00000398_End
CustomVM00000398_Start
CustomVM00000399_End
CustomVM00000399_Start
CustomVM00000400_End
CustomVM00000400_Start
CustomVM00000401_End
CustomVM00000401_Start
CustomVM00000402_End
CustomVM00000402_Start
CustomVM00000403_End
CustomVM00000403_Start
CustomVM00000404_End
CustomVM00000404_Start
CustomVM00000405_End
CustomVM00000405_Start
CustomVM00000406_End
CustomVM00000406_Start
CustomVM00000407_End
CustomVM00000407_Start
CustomVM00000408_End
CustomVM00000408_Start
CustomVM00000409_End
CustomVM00000409_Start
CustomVM00000410_End
CustomVM00000410_Start
CustomVM00000411_End
CustomVM00000411_Start
CustomVM00000412_End
CustomVM00000412_Start
CustomVM00000413_End
CustomVM00000413_Start
CustomVM00000414_End
CustomVM00000414_Start
CustomVM00000415_End
CustomVM00000415_Start
CustomVM00000416_End
CustomVM00000416_Start
CustomVM00000417_End
CustomVM00000417_Start
CustomVM00000418_End
CustomVM00000418_Start
CustomVM00000419_End
CustomVM00000419_Start
CustomVM00000420_End
CustomVM00000420_Start
CustomVM00000421_End
CustomVM00000421_Start
CustomVM00000422_End
CustomVM00000422_Start
CustomVM00000423_End
CustomVM00000423_Start
CustomVM00000424_End
CustomVM00000424_Start
CustomVM00000425_End
CustomVM00000425_Start
CustomVM00000426_End
CustomVM00000426_Start
CustomVM00000427_End
CustomVM00000427_Start
CustomVM00000428_End
CustomVM00000428_Start
CustomVM00000429_End
CustomVM00000429_Start
CustomVM00000430_End
CustomVM00000430_Start
CustomVM00000431_End
CustomVM00000431_Start
CustomVM00000432_End
CustomVM00000432_Start
CustomVM00000433_End
CustomVM00000433_Start
CustomVM00000434_End
CustomVM00000434_Start
CustomVM00000435_End
CustomVM00000435_Start
CustomVM00000436_End
CustomVM00000436_Start
CustomVM00000437_End
CustomVM00000437_Start
CustomVM00000438_End
CustomVM00000438_Start
CustomVM00000439_End
CustomVM00000439_Start
CustomVM00000440_End
CustomVM00000440_Start
CustomVM00000441_End
CustomVM00000441_Start
CustomVM00000442_End
CustomVM00000442_Start
CustomVM00000443_End
CustomVM00000443_Start
CustomVM00000444_End
CustomVM00000444_Start
CustomVM00000445_End
CustomVM00000445_Start
CustomVM00000446_End
CustomVM00000446_Start
CustomVM00000447_End
CustomVM00000447_Start
CustomVM00000448_End
CustomVM00000448_Start
CustomVM00000449_End
CustomVM00000449_Start
CustomVM00000450_End
CustomVM00000450_Start
CustomVM00000451_End
CustomVM00000451_Start
CustomVM00000452_End
CustomVM00000452_Start
CustomVM00000453_End
CustomVM00000453_Start
CustomVM00000454_End
CustomVM00000454_Start
CustomVM00000455_End
CustomVM00000455_Start
CustomVM00000456_End
CustomVM00000456_Start
CustomVM00000457_End
CustomVM00000457_Start
CustomVM00000458_End
CustomVM00000458_Start
CustomVM00000459_End
CustomVM00000459_Start
CustomVM00000460_End
CustomVM00000460_Start
CustomVM00000461_End
CustomVM00000461_Start
CustomVM00000462_End
CustomVM00000462_Start
CustomVM00000463_End
CustomVM00000463_Start
CustomVM00000464_End
CustomVM00000464_Start
CustomVM00000465_End
CustomVM00000465_Start
CustomVM00000466_End
CustomVM00000466_Start
CustomVM00000467_End
CustomVM00000467_Start
CustomVM00000468_End
CustomVM00000468_Start
CustomVM00000469_End
CustomVM00000469_Start
CustomVM00000470_End
CustomVM00000470_Start
CustomVM00000471_End
CustomVM00000471_Start
CustomVM00000472_End
CustomVM00000472_Start
CustomVM00000473_End
CustomVM00000473_Start
CustomVM00000474_End
CustomVM00000474_Start
CustomVM00000475_End
CustomVM00000475_Start
CustomVM00000476_End
CustomVM00000476_Start
CustomVM00000477_End
CustomVM00000477_Start
CustomVM00000478_End
CustomVM00000478_Start
CustomVM00000479_End
CustomVM00000479_Start
CustomVM00000480_End
CustomVM00000480_Start
CustomVM00000481_End
CustomVM00000481_Start
CustomVM00000482_End
CustomVM00000482_Start
CustomVM00000483_End
CustomVM00000483_Start
CustomVM00000484_End
CustomVM00000484_Start
CustomVM00000485_End
CustomVM00000485_Start
CustomVM00000486_End
CustomVM00000486_Start
CustomVM00000487_End
CustomVM00000487_Start
CustomVM00000488_End
CustomVM00000488_Start
CustomVM00000489_End
CustomVM00000489_Start
CustomVM00000490_End
CustomVM00000490_Start
CustomVM00000491_End
CustomVM00000491_Start
CustomVM00000492_End
CustomVM00000492_Start
CustomVM00000493_End
CustomVM00000493_Start
CustomVM00000494_End
CustomVM00000494_Start
CustomVM00000495_End
CustomVM00000495_Start
CustomVM00000496_End
CustomVM00000496_Start
CustomVM00000497_End
CustomVM00000497_Start
CustomVM00000498_End
CustomVM00000498_Start
CustomVM00000499_End
CustomVM00000499_Start
EncodeEnd
EncodeStart
MutateEnd
MutateStart
RegisteredEnd
RegisteredStart
RegisteredVMEnd
RegisteredVMStart
SECheckCodeIntegrity
SECheckDebugger
SECheckProtection
SECheckRegistration
SECheckVirtualPC
StrEncryptEnd
StrEncryptStart
StrEncryptWEnd
StrEncryptWStart
UnprotectedEnd
UnprotectedStart
UnregisteredEnd
UnregisteredStart
VMEnd
VMStart
Name
.text
Size
1024B
Virtual Size
843B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=125, version=2207,
count=1, id=122, version=2207,
count=1, id=120, version=2207,
SecretTweak/dbghelp.dll
- IMPHASH e55df7193a9c7f507fc48c3b3f033447
- SHA256 b6455531a84ee1ceb101cd14f0e2be7750f4d5f958ec5a9460a09d011f14a3f8
- MD5 08219271a68c50cd39c74305e25d803c
- SHA1 2de9e5659b95686f51e8d0577718e2b7f2f2a0d9
- SHA512 d08763371c4044dd5b86409cc71b93315886be8fce9e3214e77858d2aef2ee58671a073b6d6c990a6a3f9f4ea9336efa6328c406cec97c967c5dde5f9f20b474
- SSDEEP 49152:0N0tGoich4Jm+qbApekXO0hIuxO/rMoE/26esP:0N0Wg4Jm+qbS1XxTcU
- TLSH T1BBA58B0757EC00A8D67AE23DD267560BD7F2B4110321A7DF126486AE6F23FE51ABE311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
57:a5:49:a2:2a:2a:c7:d1:8f:c2:78:ed:6b:78:6b:bf:68:94:c1:76:35:65:91:31:d9:fc:c0:7b:3a:f6:5f:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 19, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:a6:58:10:67:4b:3d:6c:7c:f6:00:00:00:00:05:a6
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2024 - Jul 5, 2025
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:00:0b:d7:aa:7f:1b:2a:17:56:00:01:00:00:02:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
40096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dbghelp.pdb
api-ms-win-crt-string-l1-1-0
memset
strcspn
wcsnlen
wcsncmp
strnlen
strlen
strcmp
strncmp
wcscmp
api-ms-win-crt-time-l1-1-0
_time64
_ctime64
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
api-ms-win-crt-runtime-l1-1-0
__doserrno
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__filelengthi64
_o__free_base
_o__fullpath
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__ldclass
_o__lseeki64
_o__ltoa
_o__malloc_base
_o__mbscmp
_o__memicmp
_o__open_osfhandle
_o__purecall
_o__read
_o__register_onexit_function
_o__seh_filter_dll
_o__splitpath_s
_o__stricmp
_o__strlwr
_o__strnicmp
_o__aligned_malloc
_o__wcsdup
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wctime64
_o__wdupenv_s
_o__wfsopen
_o__wfullpath
_o__wgetenv
_o__wmakepath_s
_o__wsplitpath_s
_o__wtoi
_o_abort
_o_atoi
_o_atol
_o_bsearch
_o_calloc
_o_ceilf
_o_fclose
_o_fflush
_o_fread
_o_free
_o_frexp
_o_fseek
_o_ftell
_o_isspace
_o_iswprint
_o_iswspace
_o_iswxdigit
_o_localeconv
_o_malloc
_o_qsort
_o_realloc
_o_setlocale
_o_strcat_s
_o_strcpy_s
_o_strncat_s
_o_strncpy_s
_o_terminate
_o_tolower
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstoul
_o_wmemcpy_s
__uncaught_exception
_CxxThrowException
_o__aligned_free
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o__execute_onexit_table
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o__errno
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o__dclass
_o__crt_atexit
_o__configure_narrow_argv
_o__close
_o__cexit
_o__calloc_base
_o__callnewh
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
wcsrchr
strstr
wcsstr
wcschr
__C_specific_handler
__CxxFrameHandler3
strchr
memcpy
memmove
memcmp
__unDName
strrchr
__unDNameEx
api-ms-win-core-file-l1-1-0
GetFileAttributesW
FindClose
GetFullPathNameW
DeleteFileW
SetFilePointer
GetFinalPathNameByHandleW
CreateDirectoryW
CreateFileW
SetFilePointerEx
WriteFile
SetEndOfFile
ReadFile
GetFileType
RemoveDirectoryW
CreateDirectoryA
SetFileTime
SetFileAttributesW
GetFileSize
FindNextFileW
CreateFileA
GetFileAttributesA
GetFileSizeEx
FindFirstFileW
GetFileInformationByHandle
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException
SetErrorMode
api-ms-win-core-synch-l1-1-0
OpenProcess
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
AcquireSRWLockExclusive
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
ExpandEnvironmentStringsW
SetEnvironmentVariableA
api-ms-win-core-misc-l1-1-0
LocalFree
Sleep
LocalAlloc
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
TerminateProcess
TlsFree
GetCurrentThread
GetCurrentProcess
TlsGetValue
TlsSetValue
TlsAlloc
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleFileNameW
LoadLibraryExA
GetModuleHandleA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
SystemTimeToFileTime
GetTickCount
GetSystemDirectoryW
GetTickCount64
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-security-base-l1-1-0
AccessCheck
ImpersonateSelf
GetFileSecurityW
RevertToSelf
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
UnmapViewOfFile
MapViewOfFileEx
MapViewOfFile
VirtualQuery
CreateFileMappingW
ReadProcessMemory
VirtualProtect
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-localization-l1-1-0
LCMapStringEx
LCMapStringW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
ntdll
RtlUTF8ToUnicodeN
RtlRunOnceExecuteOnce
RtlGetVersion
api-ms-win-downlevel-kernel32-l2-1-0
CreateFileMappingA
api-ms-win-core-localregistry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-threadpool-l1-1-0
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk2
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymAllocDiaString
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFreeDiaString
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetDiaSession
SymGetDiaSource
SymGetExtendedOption
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrEx
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameEx
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextEx
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevEx
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetParentWindow
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileChecksum
SymGetSourceFileChecksumW
SymGetSourceFileFromToken
SymGetSourceFileFromTokenByTokenName
SymGetSourceFileFromTokenByTokenNameW
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenByTokenName
SymGetSourceFileTokenByTokenNameW
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymRegisterGetSourcePathPartCallback
SymRegisterSourceFileUrlListCallback
SymSearch
SymSearchW
SymSetContext
SymSetDiaSession
SymSetExtendedOption
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSetServiceManager
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
_EFN_DumpImage
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
lmsourcesinfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
vc7fpo
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
400KB
Virtual Size
398KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
84KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=257, version=33140,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1268, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33140,
count=5, id=259, version=33140,
count=1, id=256, version=33140,
count=100, id=264, version=33140,
count=2, id=253, version=33140,
count=37, id=261, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
SecretTweak/stpatch.dll
- IMPHASH da6577a4c4d55a06bea9c85a61d2f01c
- SHA256 941c0b17b324017a96fee40b92c284faf6cad6c21c1772f92776810f2b5e8cda
- MD5 55ea10fc1dfbe298ef31bd121145388c
- SHA1 288ed449fd7319b28b1606b5e99548451a6c79af
- SHA512 0628394f649234f88950395fb4edf4b88e98fd6b60968bb03219dd01f398f62dd70272091801466a1f7cedb6b06dc28021d2aac5d7eeafd01b83363020899d93
- SSDEEP 1536:oo16fs0e1vdsqpdHM6dIhf3TPH/xFgW8Smb6RJn6JRGlV/CNJL:es0a
- TLSH T13D2395E5BFD56EC6D954633822EA9122377DF9E086430B0BB52856311B13BD03EED34A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4847
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FlushInstructionCache
FreeLibrary
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
api-ms-win-crt-heap-l1-1-0
calloc
free
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
fclose
fopen
fputc
api-ms-win-crt-string-l1-1-0
strlen
strncmp
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
202B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/91
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SecretTweak/symsrv.dll
- IMPHASH c8f45ab7d0aa1910ed31f28a3532dc3a
- SHA256 5fcebebe39fb70368ab3f91ae48234a887f284c0a80d018d0dcf7ee0e992b444
- MD5 ac540c9135582ab683f5015e44de1660
- SHA1 b20cffcd98c96c27634ada81e594ea8bc77dd0a5
- SHA512 fee5454f0801396c31cb7623a3ce7da5bc1dc47c4700c7d9f6bc1e755253ce5169c036624f39b590c7c151161339efa6cc8fb18d20488c0b5f9eccf6890ef88d
- SSDEEP 6144:bYvMwXLY++NxRVwR9HFNioYbXCmKduoph3xBV+iXqYs1QamNrFd6bBI9RYxwJR:6peVwfHioYbymKduoH3t+iXXeQ41IRVR
- TLSH T18794182DE7E80465E1B2A5788AB3C605D7B278A81735D3CF1194C13E5E27FD4AA34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:e2:cd:e2:0b:68:1d:3f:ed:63:e2:5f:26:f5:f5:12:57:e1:74:5e:cd:17:63:a1:07:6e:8b:be:7e:b5:46:a1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 19, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:a6:58:10:67:4b:3d:6c:7c:f6:00:00:00:00:05:a6
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2024 - Jul 5, 2025
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:01:d1:45:59:98:10:cc:42:4f:00:01:00:00:02:01
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
symsrv.pdb
msvcrt
_wtoi64
getenv
strnlen
_vsnprintf_s
swprintf_s
wcsnlen
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_vscwprintf
_stricmp
_vscprintf
_vsnwprintf_s
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
vswprintf_s
tolower
memmove
_wmakepath_s
_wcsdup
_XcptFilter
_amsg_exit
swscanf_s
_wcsicmp
??_V@YAXPEAX@Z
fclose
wcsncpy_s
_wcsnicmp
wcschr
??0exception@@QEAA@AEBV0@@Z
_errno
_initterm
_lock
??0exception@@QEAA@XZ
_unlock
__dllonexit
_onexit
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
free
__CxxFrameHandler3
_wcslwr_s
wcsrchr
fgetws
wcsstr
iswspace
_wfopen
strpbrk
strstr
realloc
iswprint
??0exception@@QEAA@AEBQEBD@Z
memcpy_s
towlower
wcsncmp
strcpy_s
_wcsupr
malloc
strcat_s
isspace
_wcslwr
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_vsnwprintf
wcscat_s
strrchr
memcmp
memset
__C_specific_handler
wcscpy_s
calloc
wcscmp
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleExW
LoadLibraryExA
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
CreateThread
TerminateProcess
GetExitCodeThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-misc-l1-1-0
FormatMessageW
LocalReAlloc
Sleep
LocalAlloc
GlobalFree
LocalFree
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
EqualSid
GetTokenInformation
FreeSid
api-ms-win-core-file-l1-1-0
GetFileAttributesExW
CreateDirectoryW
GetFileTime
GetDriveTypeW
SetFilePointerEx
WriteFile
RemoveDirectoryW
GetFileSizeEx
CreateFileW
GetFileAttributesW
GetFinalPathNameByHandleW
GetFullPathNameW
GetFileSize
FileTimeToLocalFileTime
DeleteFileA
CreateFileA
LocalFileTimeToFileTime
GetFileInformationByHandle
SetFilePointer
SetFileTime
ReadFile
DeleteFileW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetErrorMode
RaiseException
SetLastError
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetVersionExW
GetSystemInfo
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObject
SetWaitableTimer
AcquireSRWLockShared
CreateMutexExW
InitializeCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockShared
DeleteCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
SetEvent
OpenMutexW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ResetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockExclusive
CreateEventW
api-ms-win-core-handle-l1-1-0
CloseHandle
rpcrt4
UuidCreate
api-ms-win-core-localregistry-l1-1-0
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ws2_32
WSACleanup
WSAStartup
FreeAddrInfoW
GetAddrInfoW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
oleaut32
SysFreeString
shlwapi
PathFindFileNameW
kernel32
CancelSynchronousIo
IsProcessorFeaturePresent
WaitForMultipleObjects
ntdll
RtlRunOnceExecuteOnce
RtlUTF8ToUnicodeN
crypt32
CryptStringToBinaryW
CryptBinaryToStringW
bcrypt
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-core-threadpool-l1-1-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexAndChecksumsW
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptionData
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerPingWEx
SymbolServerSetHttpAuthHeader
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
SymbolServerWEx
SymbolServerWithChecksumsW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile
Name
.text
Size
220KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=26, id=260, version=33140,
count=296, id=1, productName=Unmarked objects,
count=9, id=257, version=33140,
count=14, id=261, version=33140,
count=1, id=256, version=33140,
count=49, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
SecretTweak/vcredist.url
- SHA256 b3edff656ecca49b2f4c2e0d1140d65ee04a26e748c4001903dac21dab5734fd
- MD5 6e7140aecdbf70b31d0f43a37398e367
- SHA1 3416b971b6fc26b6962e641b9e7eec74dea8e0c9
- SHA512 84fadb92841a01280b48ce0e1cdb65137e30b26db26905934a8db09b4b9a535d84387d2a6b0255de35908a8b3c8c2fe45adba3140645c62404a0507933d3b584
- TLSH T194C0225D8C47C286C1418A0A50B0B2418C0FB56019C1C0DD6500CC894809092C028F27
- MD5 SHA1 SHA512 TLSH