17102026_0316_16102026_M20261015258.2C05F7ECDE6A03E2806.img.zip
- SHA256 2b9a520a118c5f33514abca947a08732a381fc3b0644d9b88831a8d6c15bc342
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ContactActivation.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
CrcLiEnt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
36 signatures
300 seconds
Behavioral task
behavioral3
Sample
CrcLiEnt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
35 signatures
300 seconds
Behavioral task
behavioral4
Sample
M20261015258.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
36 signatures
300 seconds
Behavioral task
behavioral5
Sample
M20261015258.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
34 signatures
300 seconds
Behavioral task
behavioral6
Sample
eapprovp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target 17102026_0316_16102026_M20261015258.2C05F7ECDE6A03E2806.img.zip
- Size 3.9MB
- Sample261017-dsppgach53
- SHA256 2b9a520a118c5f33514abca947a08732a381fc3b0644d9b88831a8d6c15bc342
- MD5 52c5e34187f5ad62f644f7be52138e7a
- SHA1 98647be4723d9c059a8b3f44cc69f332ed003408
- SHA512 6a86244dec734e6e8918b5e6135643217b14a3f2b271522ae8463863f7ee7f7c6e286762f7649a443fac824d4ff89b376ea079817a7f220cbb175d45b5f5eb9e
- SSDEEP 98304:x0ZMn20LLYTEq/aRWIVHzmi4cqKFa9XpdBf0WFljCy:xhb4oq/aLVHSi4FKGX7pjCy
- TLSH T1B7163356C3D8B3186A0F9AB41711B93ACCB4C13A6CD9E0AA7C5C5416354238BD3E7FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/ContactActivation.dll unpack002/CrcLiEnt.dLL unpack002/eapprovp.dll
File Explorer
-
17102026_0316_16102026_M20261015258.2C05F7ECDE6A03E2806.img.zip.zip 3.9MB
-
M20261015258.2C05F7ECDE6A03E2806.img.iso 7.4MB
-
42ee098e-d6d7-4f8d-9344-91a87bd75dff.p7b4KB
-
43269336-c243-49fe-b353-40e79020fcdb.dtd21KB
-
5fe9cdc4-8ee4-44c9-b43e-93d79a846c09.gid26KB
-
7dccf874-bb13-4bea-adfc-a8155f2182c0.dtd27KB
-
ContactActivation.dll.dll 46KB
-
CrcLiEnt.dLL.dll 5.6MB
-
M20261015258.exe.exe 1.1MB
-
eapprovp.dll.dll 43KB
-
f26a21fb-0ac6-4b5c-af83-0683e2a6c8ed.chk3KB
-
fe3057f4-cf0d-4e0a-b0a9-ae9599164857.efi2KB
M20261015258.2C05F7ECDE6A03E2806.img
- SHA256 762e2d651e2ce2cd8b125659e3f8516761ecf3a28e0bc6ae1e47dbc6826233f6
- MD5 2983e43cc75f33a718ef5aabf46efcaf
- SHA1 f076dbd1f8bd4f1292dd50d23df4776d5e00d1f5
- SHA512 154d620faac63e41a0f134dd6d0a94cc609f958b5a63dd9061a01723daaffaa566e170c9655053088e830d06a06b8ed10f0afb0e5a27e52d87016de83ceb44f3
- SSDEEP 98304:9O7L2n0i7nc86NlSCtTKbdo6ClG9UeRPuH/yuK0OFNwIRzl:9O73PNwC6e+DUERz
- TLSH T1DE76C00676F801BDC4B7C175C6678A5FE3B27C450A30DB9F13911A4A6F737A19E2A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
42ee098e-d6d7-4f8d-9344-91a87bd75dff.p7b
- SHA256 ddf9085d3da4de9d82aeba1d383344ef3a87106b1453bb5a435d923fb30493b6
- MD5 df9ff12f2fa9c8b37366bf5812f9485c
- SHA1 e7bea9544dc6cd9286615c835dcfacef165b299e
- SHA512 ceb06028cf1a83d07d5945c9010baf44e12f43e6b157cf1691f4e003b6e2ef126813b6414aefe8b14f255f1b485f30b20973e35051834b0cba4d28b7af8fb6f3
- SSDEEP 96:V7UaxtrEteuYlzV4fDfJfgqywxCuaQ70wr79mnqx/00Bgb:VUaxBEAFlV4frXxCwtrJoG/0AK
- TLSH T152918EF6971C2434C8C65AF23FDA886FA812A00712B54D66156A3365EC33F9740A3FA4
- MD5 SHA1 SHA512 SSDEEP TLSH
43269336-c243-49fe-b353-40e79020fcdb.dtd
- SHA256 8fd089d3be4aa35d21f10249b4c6753f334dfa127739113b7cd2b741fcbfab67
- MD5 f719a8be23328be560293495a8267ec3
- SHA1 f37824b0f7f63bf941df98ec74a04414d1911bdf
- SHA512 746774a781c056b8cc60f5ab3375a35fd5fe6297f609545a18149890867f72e0435e2ca7b0193f9c8ba57a86c06549a625390aa010c08a4aaf9bd61021ddf14d
- SSDEEP 384:7ELSPT4ijcO7n2ef1r3xJcV7IHbfOrycNy4XuZS4IOwjGQR5TROXT:VT4scAnTMV7IHbfOdl+ZS4ITlTRyT
- TLSH T137A2D05B6343AC48C14A0523E62672788DAFD569BD3EE6D32F3DE014C5E8904D6FAD70
- MD5 SHA1 SHA512 SSDEEP TLSH
5fe9cdc4-8ee4-44c9-b43e-93d79a846c09.gid
- SHA256 f00daf06555788aca888c25d07016e783d3f2c345d4456556401c1d275bc6600
- MD5 9328076514eae27620b16a3e49412948
- SHA1 fd58fc48f6a0e91a81cfe43692357bfab6139137
- SHA512 4929da81380f001956a41bbeb948d4079fe48402fe3536b1cefa0bd93fb4b66d8a7911e9d5f327330719a68417343de1d91c6ed5b836f802f7e0aac67fb6b4ff
- SSDEEP 768:MQOdvHtf5v04AMS4dyHEcAPYxrsPjEtrWGvu:KdvHf1dnMxwjEtrWp
- TLSH T17BC2E1C338ACC946EF8BE9D154BF1C392C8F21B47294A0147533ED69666A7118711FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
7dccf874-bb13-4bea-adfc-a8155f2182c0.dtd
- SHA256 d57384cc8cc0f3eca2baf688cbde48540864440aef78f07078a55d94102347ce
- MD5 21b4ff68dd8131107042d67b5d0ae359
- SHA1 4a880736445d85ece37fdbc7f5febe9d6f1743f1
- SHA512 25594afbf36ba26f43dd8f59cd6c210c9faf87ef19570926074484d3f68131c0d457e6ff817521060704b8a52c380fc57308cb8336edd6a23db7c602031e6192
- SSDEEP 768:KwWaui+gyv4MaIdlkUn/4mfNHbrq6AKo07aF1ckt:KWuwy7lkY/4oNH2N+aF1ckt
- TLSH T1CCC2E131EFC10502BC5CF52A9C332FAE451A2AC19569C05BFCF68CB75AAC5C26871E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
ContactActivation.dll
- IMPHASH 2525b0b82dcc9efdda5a8552f317881c
- SHA256 34e13ed45cbfead366ba88a1afabe8e226ba897ddb4375be19b20210385b88dc
- MD5 f261d92de9efb9b79e8704c02e999f2f
- SHA1 81c4d907d176457ac6b406569f51596f15c581a6
- SHA512 48a205bb8ad6a6bbadc0b03d1130474ede4f1316757d7e5a297a3bd016293d072f52adc3692acbdc80c50a664501d6169b1c19aeb77ecce73c98bbfd5d389742
- SSDEEP 768:PYrAVt1WhuNUWUgIc0g58GRZ9FvVqUXidfY26XeYMLiY/5Eqh63PncU2Omp6UvzF:aAPxUvgIc0g1RZjvVtXieSYMLiY/5Eqp
- TLSH T15F23F5225F9829B1EBA33AB4292EB138942DB9124BF051C70F134AEA5C257D1FD3715F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
10
Entry point
10832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ContactActivation.pdb
msvcrt
_callnewh
_amsg_exit
realloc
_purecall
memmove_s
memcpy
_except_handler4_common
_XcptFilter
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
free
malloc
_initterm
memcmp
memset
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
WindowsIsStringEmpty
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
CreateEventExW
InitializeSRWLock
ReleaseSRWLockShared
SetEvent
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoWaitForMultipleObjects
CoTaskMemAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-shcore-stream-winrt-l1-1-0
CreateStreamOverRandomAccessStream
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
userdatatypehelperutil
ReadStreamContentA
GetStreamSize
AwaitContactPickerResults
ContactToVCardString
DeserializeContactFromString
SerializeContactToString
SerializeContactToVCard
ShowContactPickerAsync
VCardStringToContact
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=26213,
count=14, id=260, version=26213,
count=61, id=1, productName=Unmarked objects,
count=5, id=257, version=26213,
count=6, id=261, version=26213,
count=1, id=256, version=26213,
count=6, id=270, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
CrcLiEnt.dLL
- IMPHASH c180b8f12de0cc1878ec2e0f735ea38a
- SHA256 b9fd61498d6345769dff6a33a8334c24cba3a03b3c0cb65acf95882bdc5670b3
- MD5 7e8d00b667f7368a5e01860342419b07
- SHA1 6a2025bdb833f875779a101aea13557d6c60faf0
- SHA512 aad599881afda0c1d384adc06ba877e1c12e230f0d150e24690a784a53aca8148c1cc91596e25a94e659a383330a2097f73e39309541315112cab5c0191796cd
- SSDEEP 98304:AO7L2n0i7nc86NlSCtTKbdo6ClG9UeRPuH/yuK0OF:AO73PNwC6e+DU
- TLSH T1DB46CF467AF840BAC4B6C172CA678AAFD3F274410D35DB1F42810A4A6F777619E1B336
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
1641180
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
F:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\vmware-vdiskmanager\x64\Release\vmware-vdiskmanager.pdb
kernel32
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetTimeZoneInformation
GetStartupInfoW
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
SetStdHandle
QueryPerformanceFrequency
VirtualQuery
GetSystemInfo
HeapQueryInformation
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
GetStringTypeW
LCMapStringW
OutputDebugStringW
IsDebuggerPresent
IsProcessorFeaturePresent
FlsFree
SetUnhandledExceptionFilter
VirtualAlloc
HeapAlloc
HeapFree
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
HeapCreate
HeapDestroy
CreateEventA
CloseHandle
WaitForSingleObject
Sleep
SetEvent
FormatMessageW
GetLastError
GetCurrentThreadId
SwitchToThread
SetLastError
CreateEventW
CancelIo
ResetEvent
WideCharToMultiByte
lstrlenW
CreateWaitableTimerW
SetWaitableTimer
LoadLibraryW
GetProcAddress
TryEnterCriticalSection
lstrcpyW
lstrcatW
WriteProcessMemory
MultiByteToWideChar
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
DecodePointer
GetProcessHeap
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileAttributesW
CreateDirectoryW
GetCurrentProcess
SizeofResource
LockResource
LoadResource
FindResourceW
LocalFree
LocalAlloc
CreateFileW
GetTickCount
OpenProcess
DeviceIoControl
ExitProcess
GetLocalTime
SystemTimeToFileTime
CreateMutexW
GetModuleFileNameW
CreateThread
DeleteFileW
GetTempPathW
SetFileAttributesW
CreateThreadpoolTimer
SetThreadpoolTimer
GetModuleHandleExW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WriteFile
GetWindowsDirectoryW
GetModuleHandleW
CreateProcessW
GetSystemDirectoryW
GetExitCodeProcess
TerminateProcess
CopyFileW
GetStdHandle
ResumeThread
lstrlenA
OpenMutexW
GetCommandLineW
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
SetThreadPriority
SuspendThread
GetCurrentThread
GetVersionExW
FreeLibrary
LoadLibraryExW
GlobalDeleteAtom
lstrcmpA
lstrcmpW
SetErrorMode
OutputDebugStringA
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetCurrentProcessId
GlobalGetAtomNameW
FileTimeToSystemTime
EncodePointer
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetCurrentDirectoryW
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
FindClose
FindFirstFileW
FlushFileBuffers
GetFullPathNameW
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
DuplicateHandle
lstrcmpiW
VirtualProtect
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SystemTimeToTzSpecificLocalTime
FindResourceExW
VerSetConditionMask
VerifyVersionInfoW
GetTempFileNameW
GetProfileIntW
SearchPathW
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
VirtualFree
user32
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
LoadImageW
TrackMouseEvent
IntersectRect
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
InflateRect
GetMenuItemInfoW
DestroyMenu
CharUpperW
DestroyIcon
FillRect
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
InvalidateRect
KillTimer
SetTimer
RealChildWindowFromPoint
GetDesktopWindow
ClientToScreen
DeleteMenu
SetCursor
ShowOwnedPopups
SystemParametersInfoW
CopyImage
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
DrawIconEx
PtInRect
EqualRect
CopyRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
IsZoomed
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
GetSystemMenu
BringWindowToTop
SetCursorPos
PeekMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
UnregisterClassW
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongPtrW
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
SetWindowLongW
DrawFrameControl
MessageBoxW
CharUpperBuffW
GetMenuStringW
GetMenuState
SetRect
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
GetMessageW
SendMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
PostMessageW
PostQuitMessage
UnhookWindowsHookEx
EnableWindow
IsWindowEnabled
GetWindowLongW
GetParent
GetWindowThreadProcessId
GetLastActivePopup
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
LoadCursorW
GetWindowTextW
GetWindowTextLengthW
GetFocus
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
DestroyCursor
GetWindowRgn
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
GetUpdateRect
IsClipboardFormatAvailable
RegisterClipboardFormatW
ModifyMenuW
GetDoubleClickTime
SetMenuDefaultItem
LockWindowUpdate
RedrawWindow
gdi32
GetTextFaceW
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
OffsetRgn
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExW
GetTextMetricsW
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
CombineRgn
GetTextExtentPoint32W
CreateFontIndirectW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
DeleteObject
GetObjectW
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps
CreateDCW
CopyMetaFileW
msimg32
TransparentBlt
AlphaBlend
winspool.drv
DocumentPropertiesW
ClosePrinter
OpenPrinterW
advapi32
SystemFunction036
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteTreeW
RegCreateKeyExW
DeleteService
ControlService
QueryServiceStatusEx
StartServiceW
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
CheckTokenMembership
FreeSid
EqualSid
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
shell32
ShellExecuteExW
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetFolderPathW
DragFinish
DragQueryFileW
SHGetDesktopFolder
shlwapi
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
PathFileExistsW
StrFormatKBSizeW
uxtheme
DrawThemeBackground
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize
ole32
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
DoDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CreateStreamOnHGlobal
CoInitializeEx
CoCreateInstance
CoDisconnectObject
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoGetObject
CoInitialize
OleGetClipboard
oleaut32
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
VariantClear
VariantCopy
VariantChangeType
VarBstrFromDate
VariantInit
SysAllocString
LoadTypeLi
SysFreeString
urlmon
URLDownloadToFileW
ws2_32
select
WSAIoctl
connect
htons
recv
socket
closesocket
setsockopt
WSACleanup
WSAStartup
send
WSAGetLastError
WSACreateEvent
gethostbyname
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
WSACloseEvent
shutdown
WSASetLastError
WSAEventSelect
winmm
PlaySoundW
timeGetTime
ntdll
RtlInitUnicodeString
oleacc
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
gdiplus
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdiplusShutdown
imm32
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
??4Cvmwarevdiskmanager@@QEAAAEAV0@$$QEAV0@@Z
??4Cvmwarevdiskmanager@@QEAAAEAV0@AEBV0@@Z
?VMnetDHCP@Cvmwarevdiskmanager@@SAHPEB_W@Z
?vmnetAdapter@Cvmwarevdiskmanager@@SAHPEB_W@Z
?vmnetBridge@Cvmwarevdiskmanager@@SAHPEB_W@Z
AddCRCustomData
AdobeCrashReporterEnableSignalHandling
CrashReporterInitialize
DisableCRDunamisExitEventCapture
GetCRDialogOptions
GetCRLastErrorCode
GetCRReportSendPreference
SendCRErrorEventToDunamis
SetAppIntegrityLevelLow
SetCRDialogOptions
SetCRDialogScalingFactor
SetCRDialogUserEmail
SetCRDisplayName
SetCRHighbeamSessionId
SetCRHighbeamSessionInfo
SetCRIMSUserGuid
SetCRLocale
SetCRParentWnd
SetCRPostHandler
SetCRPostHandlerPassingExceptionInfoAndContext
SetCRPosthandlerThreadPreference
SetCRPreHandler
SetCRReportSendPreference
SetCRSessionNonGenuine
SetCRSignatureVerificationPreference
SetDunamisExitNormal
SetDunamisSessionId
SetDunamisSourceAppName
ShowCRDialogOnlyOnFirstCrash
ShowCRNativeDialogOnCrash
vmdbCOM
vmnetDHCP
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
670KB
Virtual Size
669KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gxfg
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gehcont
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.数据�
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=30795,
count=34, id=260, version=30795,
count=194, id=261, version=30795,
count=1, id=262, version=30795,
count=39, id=257, version=30795,
count=850, id=1, productName=Unmarked objects,
count=67, id=260, version=23013,
count=9, id=259, version=23013,
count=365, id=261, version=23013,
count=18, id=265, version=23026,
count=1, id=256, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,
count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,
M20261015258.exe
- IMPHASH 0049e6f108de46d48987026bcfe54955
- SHA256 81cf4d59df869abfe5034d160090d88bc9c573e8c5daf284fd29417d48411d5b
- MD5 8cf96be406d5b55912e4d79c2a533568
- SHA1 6f6a4f2802e72ce4b0eaad1094bb53a585bdf5d2
- SHA512 83175422ed11d694d31f23b71daf2992c1794be2250023a580490464e57bf3c8731a407d3a50bfb681f5c22fa76de2d82a88b9d1b3c4c591603dd7fc0e53ba3d
- SSDEEP 24576:+8q1L8bEuXsj6ME5pvOIogH5zpPNTKGKmmUYUsK2:FIL8bdXS6MSpvOIokpVTCUYU+
- TLSH T1FA356C0793E902ADE0B7E13C89678906E2767C5A07709ACF13A0795A2F737E19F79311
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
d0:67:6a:d8:71:5e:4d:34:92:75:72:63:7d:4c:06:7c:5d:6a:09:fc:dd:ef:f2:4d:96:f8:df:c0:75:d4:37:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 3, 2024
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
09:8a:2f:31:3a:b2:c2:9c:d4:2b:06:2a:0e:46:7b:0c
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 3, 2023 - Nov 4, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
501840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Jenkins\workspace\ccd-app\main\native\win64\build\msvs_win32_x64\Release\x64\sym\CreativeCloud\CreativeCloud\Creative Cloud.pdb
kernel32
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
InitializeCriticalSectionEx
LockResource
LoadResource
CreateProcessW
SetDllDirectoryW
RtlUnwind
GetProcAddress
LoadLibraryW
CloseHandle
Process32FirstW
DeleteFileW
Process32NextW
LeaveCriticalSection
MultiByteToWideChar
CreateToolhelp32Snapshot
SetFileAttributesW
OpenProcess
WaitForSingleObject
FindClose
EnterCriticalSection
GetTempPathW
RemoveDirectoryW
TerminateProcess
FindNextFileW
FindFirstFileW
AcquireSRWLockShared
DecodePointer
RaiseException
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLastError
EncodePointer
GetModuleFileNameW
WideCharToMultiByte
CopyFileW
Sleep
FreeLibrary
GetPackageFamilyName
GetCurrentProcess
FindResourceW
InitOnceExecuteOnce
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStdHandle
GetTimeZoneInformation
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
GetCPInfo
LCMapStringEx
GetCurrentProcessId
WriteFile
SetFilePointer
CreateFileW
GetCurrentThreadId
lstrcmpW
ReadFile
LocalAlloc
GetFileAttributesW
LocalFree
MoveFileExW
FlushFileBuffers
GetUserDefaultLangID
GetUserDefaultUILanguage
TerminateThread
CreateThread
GetFileInformationByHandle
HeapFree
SetLastError
HeapSize
CreateEventW
ProcessIdToSessionId
SetEvent
GlobalFree
HeapReAlloc
ResetEvent
HeapAlloc
GetProcessHeap
GetModuleHandleW
QueryFullProcessImageNameW
lstrcmpiW
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
SystemTimeToFileTime
GetDateFormatW
CreateMutexW
ReleaseMutex
OpenMutexW
GetVersionExW
GetCurrentThread
VerSetConditionMask
VerifyVersionInfoW
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreW
SetEndOfFile
SetFilePointerEx
ResumeThread
GetSystemTimeAsFileTime
SetThreadPriority
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
GetExitCodeThread
GetStringTypeW
user32
IsWindow
PostMessageW
GetMessageW
DialogBoxParamW
GetDlgItem
ShowWindow
SetWindowTextW
EndDialog
RegisterWindowMessageW
TranslateMessage
DispatchMessageW
advapi32
LookupAccountSidW
SetNamedSecurityInfoW
CreateWellKnownSid
SetEntriesInAclW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetTokenInformation
GetUserNameW
ConvertSidToStringSidW
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetKeyValueW
ImpersonateLoggedOnUser
ConvertStringSidToSidW
AllocateAndInitializeSid
RevertToSelf
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetNamedSecurityInfoW
shell32
SHGetFolderLocation
SHGetFolderPathW
SHGetPathFromIDListW
CommandLineToArgvW
ord51
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ord680
ole32
CLSIDFromString
CoInitialize
CoUninitialize
CoAddRefServerProcess
OleRun
StringFromCLSID
CoTaskMemFree
CoRegisterClassObject
CoResumeClassObjects
CoRevokeClassObject
CoCreateGuid
StringFromGUID2
CLSIDFromProgID
CoReleaseServerProcess
CoCreateInstance
crclient
CrashReporterInitialize
DisableCRDunamisExitEventCapture
ShowCRDialogOnlyOnFirstCrash
ShowCRNativeDialogOnCrash
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoRegisterActivationFactories
RoGetActivationFactory
RoRevokeActivationFactories
RoUninitialize
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
winhttp
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpReadData
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpSetCredentials
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpOpen
WinHttpSetTimeouts
shlwapi
PathRenameExtensionW
PathIsFileSpecW
PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW
PathFindFileNameW
PathIsRootW
PathAppendW
PathIsSystemFolderW
PathRemoveExtensionW
PathAddExtensionW
oleaut32
VariantCopy
GetErrorInfo
SysAllocString
SysFreeString
VariantClear
VariantInit
Name
.text
Size
697KB
Virtual Size
696KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
212KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=193, id=261, version=27412,
count=17, id=260, version=31616,
count=10, id=259, version=31616,
count=104, id=261, version=31616,
count=6, id=261, version=31630,
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31937,
count=29, id=260, version=27412,
count=2, id=262, version=27412,
count=27, id=257, version=27412,
count=370, id=1, productName=Unmarked objects,
count=87, id=265, version=31630,
count=1, id=255, version=31630,
count=1, id=151,
count=1, id=258, version=31630,
eapprovp.dll
- IMPHASH f88974e78e2c3f1a9a1febf3d5395cd3
- SHA256 e421ad26faf20c23543278c6ff9cacd57472ab7999d9dd4eac94a24858a527f8
- MD5 9010139e7422b62726f30ada72b89223
- SHA1 89fe41c54c0644f09f1bf95be0d330cc463b24e5
- SHA512 4294e2dc779e48b629b12a71755c8ec23207878f81fcf0f77d55c6929f2a2fd58c29105d007838df54f50cbd802371e4f02e227e75eec18aa8a244d12fa4fe59
- SSDEEP 768:y90w06opKx2bmnHy71uRoHkBilp6/c6g9:+A6o9mnHy71uRdBi36/c6
- TLSH T1DE13D500E7D948B5F7F23BF224BA562A4D3BBC505E71C9CE1122875D7831A82E872727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
10
Entry point
34224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
eapprovp.pdb
msvcrt
strncat_s
strcpy_s
strcat_s
strchr
strnlen
memcpy
_vsnwprintf
_except_handler4_common
?terminate@@YAXXZ
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
memset
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegLoadKeyW
RegUnLoadKeyW
RegQueryValueExW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
CreateMutexW
CreateEventW
ResetEvent
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
SetEvent
LeaveCriticalSection
ReleaseMutex
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
RevertToSelf
ImpersonateLoggedOnUser
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-security-credentials-l1-1-0
CredUnprotectW
CredIsProtectedW
CredWriteA
CredReadW
CredFree
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
FreeLibrary
LoadLibraryExW
crypt32
CertCloseStore
CryptUnprotectData
CertDuplicateCertificateContext
CryptBinaryToStringW
CryptDecodeObjectEx
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertFindExtension
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
iphlpapi
ConvertInterfaceGuidToLuid
GetIfEntry2
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
wkscli
NetGetJoinInformation
netutils
NetApiBufferFree
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-file-l1-1-0
CompareFileTime
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
ntdll
RtlNtStatusToDosError
RtlGetPersistedStateLocation
EapProvPlugGetInfo
EapProvPluginDeinitialize
EapProvPluginInitialize
EapProvPluginTestForAuthenticatingWlanInterfaces
EapProvPluginWlanCloseHandle
EapProvPluginWlanOpenHandle
EapProvPluginWlanRegisterNotification
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=62, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=259, version=26213,
count=13, id=260, version=26213,
count=143, id=1, productName=Unmarked objects,
count=5, id=257, version=26213,
count=3, id=261, version=26213,
count=1, id=256, version=26213,
count=13, id=265, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
f26a21fb-0ac6-4b5c-af83-0683e2a6c8ed.chk
- SHA256 b01c203988506a0879dcce3caa6d30c71415df58b8459f96f6dcedd6ec213701
- MD5 25963a30dadd58def669ed587b21d5ea
- SHA1 94fc14eb235743ca57cfd177ebe5501c965023d9
- SHA512 d5540aba7552367b319af0c50ca282d5da191f1198cd81c4ec76a6f3c62a90edb01434efb58e830a4879eca8e05d45d67a2cf719e2edd0627cc78670313f9f70
- TLSH T11A615BBFA60831D23A7262CA90A9735205B59D06E0C94013EEBB5FD5D712D49E092ABF
- MD5 SHA1 SHA512 TLSH
fe3057f4-cf0d-4e0a-b0a9-ae9599164857.efi
- SHA256 e0155753e1b43c5c5a0fe2d965505afb885ad43897299722b3f5e85928a92efb
- MD5 9bb85a2c9df95c50017a233c2e79de3a
- SHA1 bce9cd4b5c2d5a9bf8aa3b81c9276e6466c7caec
- SHA512 de3997b0446581e3111733ae0b1b59a2d7e0d9b71a3802af3958ce22db651c021831da080f22987fc7f1500b8a3d70ddbcc58d2ba31a5ef759d99b78c295c1e7
- TLSH T1BC515D3A46FFFCD5F901146183068DF7796040BE726E1852C7B08B96CB67BB1139A931
- MD5 SHA1 SHA512 TLSH