jaffacakes118_7dee7806a3803c89e2277d7774309545b23926456e79f5e19b6467220954a174
- SHA256 7dee7806a3803c89e2277d7774309545b23926456e79f5e19b6467220954a174
Overview
overview
8Static
static
5_Conslt-Or...53.exe
windows10-2004-x64
8_Conslt-Or...53.exe
windows11-ltsc_2024-x64
8dupfdll.dll
windows10-2004-x64
3dupfdll.dll
windows11-ltsc_2024-x64
3mingwm10.dll
windows10-2004-x64
3mingwm10.dll
windows11-ltsc_2024-x64
3~/buovg2.dll
windows10-2004-x64
3~/buovg2.dll
windows11-ltsc_2024-x64
3~/kjxps1.dll
windows10-2004-x64
1~/kjxps1.dll
windows11-ltsc_2024-x64
1~/matv/kkf...t4.pdf
windows10-2004-x64
3~/matv/kkf...t4.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...u8.pdf
windows10-2004-x64
3~/matv/kkf...u8.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...n7.pdf
windows10-2004-x64
3~/matv/kkf...n7.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...o1.pdf
windows10-2004-x64
3~/matv/kkf...o1.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...b3.pdf
windows10-2004-x64
3~/matv/kkf...b3.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...f6.pdf
windows10-2004-x64
3~/matv/kkf...f6.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...j2.pdf
windows10-2004-x64
3~/matv/kkf...j2.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...f5.pdf
windows10-2004-x64
3~/matv/kkf...f5.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...g9.pdf
windows10-2004-x64
3~/matv/kkf...g9.pdf
windows11-ltsc_2024-x64
3~/matv/kkf...10.pdf
windows10-2004-x64
3~/matv/kkf...10.pdf
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
_Conslt-Oria0I1G4sspm-7252XFOVNM9Z5070453.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
_Conslt-Oria0I1G4sspm-7252XFOVNM9Z5070453.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
dupfdll.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
dupfdll.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
mingwm10.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
mingwm10.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
~/buovg2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
~/buovg2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
~/kjxps1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
~/kjxps1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
~/matv/kkfm/xrlqto/adrst/acyet4.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
~/matv/kkfm/xrlqto/adrst/acyet4.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
~/matv/kkfm/xrlqto/adrst/cirkqu8.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
~/matv/kkfm/xrlqto/adrst/cirkqu8.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral15
Sample
~/matv/kkfm/xrlqto/adrst/kfen7.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
~/matv/kkfm/xrlqto/adrst/kfen7.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
~/matv/kkfm/xrlqto/adrst/ksxfo1.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
~/matv/kkfm/xrlqto/adrst/ksxfo1.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
~/matv/kkfm/xrlqto/adrst/lfyb3.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
~/matv/kkfm/xrlqto/adrst/lfyb3.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
~/matv/kkfm/xrlqto/adrst/pfxof6.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral22
Sample
~/matv/kkfm/xrlqto/adrst/pfxof6.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
~/matv/kkfm/xrlqto/adrst/pkmj2.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral24
Sample
~/matv/kkfm/xrlqto/adrst/pkmj2.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral25
Sample
~/matv/kkfm/xrlqto/adrst/touddf5.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
~/matv/kkfm/xrlqto/adrst/touddf5.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
~/matv/kkfm/xrlqto/adrst/tyug9.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral28
Sample
~/matv/kkfm/xrlqto/adrst/tyug9.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral29
Sample
~/matv/kkfm/xrlqto/adrst/zkca10.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target jaffacakes118_7dee7806a3803c89e2277d7774309545b23926456e79f5e19b6467220954a174
- Size 4.1MB
- Sample261024-a5sp4sdh79
- SHA256 7dee7806a3803c89e2277d7774309545b23926456e79f5e19b6467220954a174
- MD5 3b361177300dc81a14433d384beb6dcc
- SHA1 5e6022074f9005801e2b68128663983375d4c553
- SHA512 27340cf096ff2308d2893b74293eb0567ddf857115f111f75abb6c1fba1108d2b0e68b651d35d69271c3b7aed70f5d1d81e75371b7081df412026bbe5e039db6
- SSDEEP 98304:qIDrDyN8hXG/BAdU1+wKy73Z57XLxvZOr7gTKr6jVyk:q+yw2+G+wKSZ5LLpG7gL
- TLSH T19F16330A9EAAD2E7CA579073D0E67E3178F45D22E77D501F1A20123001B7076A77ADEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Malformed data in PDF
A PDF can contain malformed data to evade detection
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/_Conslt-Oria0I1G4sspm-7252XFOVNM9Z5070453.exe unpack001/dupfdll.dll unpack001/mingwm10.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/~/buovg2.xml
File Explorer
-
jaffacakes118_7dee7806a3803c89e2277d7774309545b23926456e79f5e19b6467220954a174.zip 4.1MB
-
_Conslt-Oria0I1G4sspm-7252XFOVNM9Z5070453.exe.exe 2.6MB
-
dupfdll.dll.dll 985KB
-
mingwm10.dll.dll 6.0MB
-
~/buovg2.xml.dll 46KB
-
~/kjxps1.xml.dll 33KB
-
~/matv/kkfm/xrlqto/adrst/acyet4.pdf.pdf 19KB
-
~/matv/kkfm/xrlqto/adrst/cirkqu8.pdf.pdf 25KB
-
~/matv/kkfm/xrlqto/adrst/kfen7.pdf.pdf 79KB
-
~/matv/kkfm/xrlqto/adrst/ksxfo1.pdf.pdf 1KB
-
~/matv/kkfm/xrlqto/adrst/lfyb3.pdf.pdf 1KB
-
~/matv/kkfm/xrlqto/adrst/pfxof6.pdf.pdf 41KB
-
~/matv/kkfm/xrlqto/adrst/pkmj2.pdf.pdf 33KB
-
~/matv/kkfm/xrlqto/adrst/touddf5.pdf.pdf 22KB
-
~/matv/kkfm/xrlqto/adrst/tyug9.pdf.pdf 21KB
-
~/matv/kkfm/xrlqto/adrst/zkca10.pdf.pdf 38KB
_Conslt-Oria0I1G4sspm-7252XFOVNM9Z5070453.exe
- IMPHASH 4025b17e4570c7b59f763658875084ed
- SHA256 98e56c5f902fb825f6f122122ba6a2a0febee1e582a462f74dd1d99b018bf7c0
- MD5 cfbd8d062e9baa98737a0260996f48c6
- SHA1 7bc79e8bbff363b41fd73f9bea102ddc4a404cbe
- SHA512 4335a0e58eb853c6b113f28f306acf2e4cddf130f98e10e1e85e6df65addeabee422530e46ceea07a50119de8f9ef48a1ea9a1c6ebd7e46ac5d35af46ce98b9b
- SSDEEP 49152:1jPP4L8GNZGMyYDSHolOO7oxKQx9Ov9MAo0wqUh9YGnbAYpkQKDLk9KNTY6pbNns:1zQL8GNZGMLDSHBEGK+9Ov9MAo5qo6G4
- TLSH T1C2C51A1DA34141B6D97304F156AB2BFB8B346A395420D50EEB80DE1DABB7DC1FA1A313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AdjustTokenPrivileges
GetUserNameW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
comctl32
CreateStatusWindowW
CreateUpDownControl
ImageList_Add
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_Draw
ImageList_EndDrag
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
InitCommonControls
comdlg32
ChooseColorW
ChooseFontW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
PageSetupDlgW
PrintDlgW
gdi32
Arc
BitBlt
CloseEnhMetaFile
CombineRgn
CopyEnhMetaFileW
CreateBitmap
CreateBitmapIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateDIBitmap
CreateEnhMetaFileW
CreateFontIndirectW
CreateHatchBrush
CreateICW
CreatePalette
CreatePatternBrush
CreatePen
CreatePolygonRgn
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
Ellipse
EndDoc
EndPage
EnumFontFamiliesExW
EqualRgn
ExcludeClipRect
ExtCreatePen
ExtCreateRegion
ExtFloodFill
ExtSelectClipRgn
GdiFlush
GetBkColor
GetCharABCWidthsW
GetClipBox
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileHeader
GetEnhMetaFileW
GetMetaFileBitsEx
GetNearestPaletteIndex
GetObjectW
GetPaletteEntries
GetPixel
GetRegionData
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextColor
GetTextExtentExPointW
GetTextExtentPoint32W
GetTextMetricsW
GetWinMetaFileBits
LineTo
MaskBlt
MoveToEx
OffsetRgn
PatBlt
Pie
PlayEnhMetaFile
PolyBezier
PolyPolygon
Polygon
Polyline
PtInRegion
RealizePalette
RectInRegion
Rectangle
RestoreDC
RoundRect
SaveDC
SelectClipRgn
SelectObject
SelectPalette
SetAbortProc
SetBkColor
SetBkMode
SetBrushOrgEx
SetMapMode
SetMetaFileBitsEx
SetPixel
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextAlign
SetTextColor
SetViewportExtEx
SetViewportOrgEx
SetWinMetaFileBits
SetWindowExtEx
SetWindowOrgEx
StartDocW
StartPage
StretchBlt
StretchDIBits
TextOutW
kernel32
AddAtomA
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindAtomA
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FormatMessageW
FreeLibrary
GetACP
GetAtomNameA
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceW
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProfileStringW
GetShortPathNameW
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetTempFileNameW
GetTempPathW
GetThreadLocale
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalSize
GlobalUnlock
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockResource
MultiByteToWideChar
OpenProcess
OutputDebugStringW
PeekNamedPipe
ReadFile
ReleaseMutex
ReleaseSemaphore
ResumeThread
SetCurrentDirectoryW
SetEnvironmentVariableW
SetErrorMode
SetFileTime
SetLastError
SetNamedPipeHandleState
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WideCharToMultiByte
WriteFile
mingwm10
__mingwthr_key_dtor
msvcrt
_fdopen
_ftime
_read
_strdup
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_beginthreadex
_cexit
_close
_commit
_ctype
_endthreadex
_errno
_fdopen
_filelengthi64
_fstati64
_get_osfhandle
_getcwd
_iob
_isctype
_lseeki64
_onexit
_open_osfhandle
_pctype
_read
_setmode
_telli64
_timezone
_waccess
_wcsdup
_wcsicmp
_wcsnicmp
_wfopen
_wgetenv
_wmkdir
_wopen
_wremove
_wrename
_write
_wrmdir
_wsetlocale
_wtoi
_wtol
abort
atexit
atof
bsearch
calloc
ceil
clearerr
cos
ctime
difftime
exit
fclose
fflush
fgetpos
floor
fopen
fprintf
fputwc
fputws
fread
free
fseek
fsetpos
ftell
fwrite
getc
gmtime
iswctype
localtime
malloc
mbstowcs
memchr
memcpy
memmove
memset
mktime
pow
putc
qsort
realloc
setlocale
setvbuf
signal
sin
sprintf
sqrt
sscanf
strchr
strcmp
strcoll
strcpy
strftime
strlen
strncpy
strstr
strtod
strxfrm
swprintf
swscanf
time
tolower
toupper
towlower
towupper
ungetc
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsspn
wcsstr
wcstod
wcstol
wcstombs
wcstoul
ole32
CoCreateInstance
CoInitialize
CoLockObjectExternal
CoUninitialize
OleFlushClipboard
OleGetClipboard
OleInitialize
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
oleaut32
SysAllocString
shell32
DragAcceptFiles
DragFinish
DragQueryFileW
DragQueryPoint
ExtractIconExW
ExtractIconW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
user32
AdjustWindowRectEx
AppendMenuW
BeginDeferWindowPos
BeginPaint
BringWindowToTop
CallNextHookEx
CallWindowProcW
ChangeDisplaySettingsW
CheckMenuItem
CheckMenuRadioItem
ChildWindowFromPoint
ClientToScreen
CloseClipboard
CopyRect
CreateAcceleratorTableW
CreateDialogIndirectParamW
CreateDialogParamW
CreateIconIndirect
CreateMenu
CreatePopupMenu
CreateWindowExW
DdeClientTransaction
DdeConnect
DdeCreateDataHandle
DdeCreateStringHandleW
DdeDisconnect
DdeFreeDataHandle
DdeFreeStringHandle
DdeGetData
DdeGetLastError
DdeInitializeW
DdeNameService
DdePostAdvise
DdeQueryStringW
DdeUninitialize
DefFrameProcW
DefMDIChildProcW
DefWindowProcW
DeferWindowPos
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawStateW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndPaint
EnumClipboardFormats
EnumDisplaySettingsW
EnumWindows
ExitWindowsEx
FillRect
FlashWindow
GetActiveWindow
GetAsyncKeyState
GetCapture
GetClassInfoW
GetClassNameW
GetClientRect
GetClipboardData
GetClipboardFormatNameW
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetMenuItemCount
GetMenuItemInfoW
GetMenuState
GetMenuStringW
GetMessagePos
GetMessageTime
GetMessageW
GetParent
GetScrollInfo
GetSubMenu
GetSysColor
GetSystemMenu
GetSystemMetrics
GetUpdateRect
GetUpdateRgn
GetWindow
GetWindowDC
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
HideCaret
InflateRect
InsertMenuItemW
InsertMenuW
InvalidateRect
IsClipboardFormatAvailable
IsDialogMessageW
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorFromFileW
LoadCursorW
LoadIconW
LoadImageW
MapWindowPoints
MessageBeep
MessageBoxW
ModifyMenuW
MoveWindow
MsgWaitForMultipleObjects
OffsetRect
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RedrawWindow
RegisterClassW
RegisterClipboardFormatW
RegisterHotKey
ReleaseCapture
ReleaseDC
RemoveMenu
ScreenToClient
ScrollWindow
SendMessageW
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemInfoW
SetParent
SetScrollInfo
SetTimer
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowCaret
ShowCursor
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateAcceleratorW
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnregisterClassW
UnregisterHotKey
UpdateWindow
ValidateRect
WaitForInputIdle
WindowFromPoint
keybd_event
dupfdll
_Z13CreateSymLinkRK8wxStringS1_
_Z14GetPathSepCharv
_Z15CreateHardLinkWRK8wxStringS1_
_Z17StringToULongLongRK8wxStringR17wxULongLongNative
_Z18IsSymLinkSupportedv
_Z19IsHardLinkSupportedv
_ZN20DuplicateFilesFinder13GetDuplicatesEv
_ZN20DuplicateFilesFinder18FindDuplicateFilesEv
_ZN20DuplicateFilesFinder5ResetEv
_ZN20DuplicateFilesFinder7AddPathERK14SearchPathInfo
_ZN20DuplicateFilesFinderC1EP7GuiInfob
_ZN20DuplicateFilesFinderD1Ev
_ZN4FileD1Ev
_ZNK20DuplicateFilesFinder14CalculateStatsER19DuplicateFilesStats
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
257KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
dupfdll.dll
- IMPHASH 80df80f42b439d7c189711d499842574
- SHA256 fad1e9d507c7021a62998a547ab53b3ee438846f7ae753285fdb3917dd2dcdfa
- MD5 e882ee4a643b00871c98bcfe4b4d7cd1
- SHA1 e6ae8be61928e1279190b0df28ac8ad94f3ac29d
- SHA512 f7e5e8b7cb8a74d502e3853abfeb9eedb4ae8486a5656226e92b48e6af1fde6ef31bec55d4d4bbdc28bc4496999e95eacbbceda7b1fa9000e59e491480ecae9d
- SSDEEP 24576:NULN6sC5vqMYmVsMKJhG+8cYtd8J1sAN703TnPNJS:yLN6Z5vassHJhG+R703TnPNJS
- TLSH T1C7251A5DA34241B7D9B301F0165B2BBB8B3096294424D91EAB80DE5DFF779D0F92E322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
GetUserNameW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
kernel32
AddAtomA
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindAtomA
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetACP
GetAtomNameA
GetCPInfo
GetComputerNameW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceW
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProfileStringW
GetShortPathNameW
GetStdHandle
GetSystemInfo
GetTempFileNameW
GetTempPathW
GetThreadLocale
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatus
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryW
LocalFileTimeToFileTime
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringW
PeekNamedPipe
ReadFile
ReleaseMutex
ReleaseSemaphore
ResumeThread
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileTime
SetLastError
SetNamedPipeHandleState
SetThreadLocale
SetThreadPriority
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WideCharToMultiByte
WriteFile
mingwm10
__mingwthr_key_dtor
msvcrt
_fdopen
_ftime
_read
_strdup
_write
__dllonexit
__mb_cur_max
_assert
_beginthreadex
_close
_commit
_ctype
_endthreadex
_errno
_fdopen
_filelengthi64
_fstati64
_get_osfhandle
_getcwd
_iob
_isctype
_lseeki64
_open_osfhandle
_pctype
_read
_telli64
_timezone
_waccess
_wcsdup
_wcsicmp
_wfopen
_wgetenv
_wmkdir
_wopen
_wremove
_wrename
_write
_wrmdir
_wsetlocale
_wtoi
abort
atof
bsearch
calloc
clearerr
ctime
difftime
exit
fclose
fflush
fgetpos
fopen
fprintf
fputwc
fputws
fread
free
fseek
fsetpos
ftell
fwprintf
fwrite
getc
gmtime
iswctype
localtime
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
mktime
putc
qsort
realloc
setlocale
setvbuf
sprintf
strchr
strcmp
strcoll
strcpy
strftime
strlen
strtod
strxfrm
swprintf
swscanf
time
towlower
towupper
ungetc
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsspn
wcsstr
wcstod
wcstol
wcstombs
wcstoul
ole32
CoCreateInstance
shell32
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
user32
CreateWindowExW
DdeClientTransaction
DdeConnect
DdeCreateDataHandle
DdeCreateStringHandleW
DdeDisconnect
DdeFreeDataHandle
DdeFreeStringHandle
DdeGetData
DdeGetLastError
DdeInitializeW
DdeNameService
DdePostAdvise
DdeQueryStringW
DdeUninitialize
DefWindowProcW
DestroyWindow
EnumWindows
ExitWindowsEx
GetWindowThreadProcessId
MessageBeep
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
PostThreadMessageW
RegisterClassW
SendMessageW
WaitForInputIdle
_Z13CreateSymLinkRK8wxStringS1_
_Z14GetPathSepCharv
_Z15CreateHardLinkWRK8wxStringS1_
_Z17StringToULongLongRK8wxStringR17wxULongLongNative
_Z18IsSymLinkSupportedv
_Z19IsHardLinkSupportedv
_Z8TraverseRK8wxStringPS0_iiR17wxExtDirTraverser
_Z9IsSymLinkRK8wxString
_ZN17wxExtDirTraverser9OnExtFileERK8FileData
_ZN17wxExtDirTraverserD0Ev
_ZN17wxExtDirTraverserD1Ev
_ZN20DuplicateFilesFinder10UpdateInfoEPK8wxString
_ZN20DuplicateFilesFinder12CompareFilesER4FileS1_RK17wxULongLongNative
_ZN20DuplicateFilesFinder13GetDuplicatesEv
_ZN20DuplicateFilesFinder13GetEqualFilesEv
_ZN20DuplicateFilesFinder17YieldAndTestAbortEv
_ZN20DuplicateFilesFinder18FindDuplicateFilesEv
_ZN20DuplicateFilesFinder19ConstructResultListEv
_ZN20DuplicateFilesFinder19UpdateStatusDisplayEv
_ZN20DuplicateFilesFinder22RemoveUnimportantSizesEv
_ZN20DuplicateFilesFinder5OnDirERK8wxString
_ZN20DuplicateFilesFinder5ResetEv
_ZN20DuplicateFilesFinder6OnFileERK8wxString
_ZN20DuplicateFilesFinder6OnFileERK8wxStringPK17wxULongLongNative
_ZN20DuplicateFilesFinder7AddPathERK14SearchPathInfo
_ZN20DuplicateFilesFinder8TraverseEPK14SearchPathInfo
_ZN20DuplicateFilesFinder9FindFilesEv
_ZN20DuplicateFilesFinder9OnExtFileERK8FileData
_ZN20DuplicateFilesFinder9ResetLineEv
_ZN20DuplicateFilesFinderC1EP7GuiInfob
_ZN20DuplicateFilesFinderC2EP7GuiInfob
_ZN20DuplicateFilesFinderD0Ev
_ZN20DuplicateFilesFinderD1Ev
_ZN20DuplicateFilesFinderD2Ev
_ZN4File10GetBufSizeEv
_ZN4File11ReleaseDataEv
_ZN4File12MAXCACHESIZEE
_ZN4File14ReleaseExtDataEv
_ZN4File16RoundUpToBufSizeEj
_ZN4File4OpenERK17wxULongLongNative
_ZN4File4ReadEPPcRj
_ZN4File4initEv
_ZN4File5CloseEv
_ZN4File7BUFSIZEE
_ZN4File7RestartEv
_ZN4File7SetNameERK8wxString
_ZN4FileC1ERK8wxString
_ZN4FileC1ERKS_
_ZN4FileC1Ev
_ZN4FileC2ERK8wxString
_ZN4FileC2ERKS_
_ZN4FileC2Ev
_ZN4FileD1Ev
_ZN4FileD2Ev
_ZN4FileaSERKS_
_ZNK20DuplicateFilesFinder14CalculateStatsER19DuplicateFilesStats
_ZTV17wxExtDirTraverser
_ZTV20DuplicateFilesFinder
Name
.text
Size
872KB
Virtual Size
871KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
mingwm10.dll
- IMPHASH 4c5585c0a67b57af9efe8be19aea2547
- SHA256 1b2fe30c5bf57f9623efb34688580fe5bbb2c55351c5a07a6c4313bb6faa29f1
- MD5 f0f428f7d9d4592ff018fd20b81d6134
- SHA1 c571888b27c1bd42469976d4be43438d0c64b638
- SHA512 20dc124d5066d9b4137af6aee2f7969cd09cf24ff2a29e8f80002394af4e068615ce349f8c370c7232c3df4ae6559d9773dcd3ccda9ddf8f9edd92ccb104d965
- SSDEEP 98304:us0Sjc5B5ZDU/KQxcJg5MVj5DL5TVVVdyrNT9:usA5Z6csMVVxTVUf
- TLSH T1BB567E13B384653FD4671B3A483BA654683F76B13A168C9B6BF4094C8F39A813D3A747
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5394588
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
timeGetTime
wininet
InternetCloseHandle
InternetReadFile
InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
winspool.drv
DocumentPropertiesW
ClosePrinter
OpenPrinterW
GetDefaultPrinterW
EnumPrintersW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
comctl32
ImageList_GetImageInfo
FlatSB_SetScrollInfo
InitCommonControls
ImageList_DragMove
ImageList_Destroy
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_Add
FlatSB_SetScrollProp
ImageList_GetDragImage
ImageList_Create
ImageList_EndDrag
ImageList_DrawEx
ImageList_SetImageCount
FlatSB_GetScrollPos
FlatSB_SetScrollPos
InitializeFlatSB
ImageList_Copy
FlatSB_GetScrollInfo
ImageList_Write
ImageList_DrawIndirect
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Replace
ImageList_GetImageCount
ImageList_DragEnter
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Read
ImageList_DragLeave
ImageList_LoadImageW
ImageList_Draw
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetOverlayImage
shell32
SHGetFolderPathW
DragQueryPoint
DragQueryFileW
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHAppBarMessage
ShellExecuteW
user32
MoveWindow
CopyImage
SetMenuItemInfoW
GetMenuItemInfoW
DefFrameProcW
GetDlgCtrlID
FrameRect
RegisterWindowMessageW
GetMenuStringW
FillRect
SendMessageA
IsClipboardFormatAvailable
EnumWindows
ShowOwnedPopups
GetClassInfoW
GetScrollRange
SetActiveWindow
GetActiveWindow
DrawEdge
GetKeyboardLayoutList
OemToCharBuffA
LoadBitmapW
EnumChildWindows
GetScrollBarInfo
UnhookWindowsHookEx
SetCapture
GetCapture
ShowCaret
CreatePopupMenu
GetMenuItemID
CharLowerBuffW
PostMessageW
SetWindowLongW
IsZoomed
SetParent
DrawMenuBar
GetClientRect
IsChild
IntersectRect
IsIconic
CallNextHookEx
ShowWindow
GetWindowTextW
SetForegroundWindow
IsDialogMessageW
DestroyWindow
RegisterClassW
EndMenu
CharNextW
GetFocus
GetDC
SetFocus
ReleaseDC
ExitWindowsEx
GetClassLongW
CharToOemBuffA
SetScrollRange
DrawTextW
PeekMessageA
MessageBeep
SetClassLongW
RemovePropW
GetSubMenu
DestroyIcon
IsWindowVisible
PtInRect
DispatchMessageA
CharPrevW
UnregisterClassW
GetTopWindow
SendMessageW
GetLastInputInfo
LoadStringW
CreateMenu
CharLowerW
SetWindowRgn
SetWindowPos
GetMenuItemCount
GetSysColorBrush
GetWindowDC
DrawTextExW
CharLowerBuffA
EnumClipboardFormats
GetScrollInfo
SetWindowTextW
GetMessageExtraInfo
GetSysColor
EnableScrollBar
TrackPopupMenu
DrawIconEx
GetClassNameW
GetMessagePos
GetIconInfo
SetScrollInfo
GetKeyNameTextW
GetDesktopWindow
SetCursorPos
GetCursorPos
SetMenu
GetMenuState
GetMenu
SetRect
GetKeyState
ValidateRect
GetCursor
KillTimer
WaitMessage
TranslateMDISysAccel
GetWindowPlacement
CreateIconIndirect
CreateWindowExW
GetDCEx
DrawCaption
PeekMessageW
MonitorFromWindow
GetUpdateRect
SetTimer
WindowFromPoint
BeginPaint
RegisterClipboardFormatW
MapVirtualKeyW
OffsetRect
IsWindowUnicode
CharToOemA
DispatchMessageW
CreateAcceleratorTableW
DefMDIChildProcW
GetSystemMenu
SetScrollPos
GetScrollPos
InflateRect
DrawFocusRect
ReleaseCapture
LoadCursorW
ScrollWindow
GetLastActivePopup
GetSystemMetrics
CharUpperBuffW
SetClipboardData
GetClipboardData
ClientToScreen
SetWindowPlacement
GetMonitorInfoW
CheckMenuItem
CharUpperW
DefWindowProcW
GetForegroundWindow
EnableWindow
GetWindowThreadProcessId
RedrawWindow
EndPaint
MsgWaitForMultipleObjectsEx
LoadKeyboardLayoutW
ActivateKeyboardLayout
GetParent
MonitorFromRect
InsertMenuItemW
GetPropW
MessageBoxW
SetPropW
UpdateWindow
MsgWaitForMultipleObjects
OemToCharA
DestroyMenu
SetWindowsHookExW
EmptyClipboard
GetDlgItem
AdjustWindowRectEx
IsWindow
DrawIcon
EnumThreadWindows
InvalidateRect
GetKeyboardState
ScreenToClient
DrawFrameControl
SetCursor
GetNextDlgTabItem
CreateIcon
RemoveMenu
GetKeyboardLayoutNameW
OpenClipboard
TranslateMessage
MapWindowPoints
EnumDisplayMonitors
CallWindowProcW
CountClipboardFormats
CloseClipboard
DestroyCursor
CharUpperBuffA
CopyIcon
PostQuitMessage
ShowScrollBar
EnableMenuItem
HideCaret
FindWindowExW
MonitorFromPoint
LoadIconW
SystemParametersInfoW
GetWindow
GetWindowRect
GetWindowLongW
InsertMenuW
IsWindowEnabled
IsDialogMessageA
FindWindowW
GetKeyboardLayout
DeleteMenu
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
oleaut32
SafeArrayPutElement
SetErrorInfo
GetErrorInfo
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData
SysReAllocStringLen
SafeArrayCreate
CreateErrorInfo
SafeArrayGetElement
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopyInd
VariantChangeType
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
advapi32
RegSetValueExW
RegConnectRegistryW
RegEnumKeyExW
RegLoadKeyW
AdjustTokenPrivileges
GetUserNameW
RegDeleteKeyW
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegQueryInfoKeyW
RegUnLoadKeyW
RegSaveKeyW
RegDeleteValueW
RegReplaceKeyW
RegFlushKey
RegQueryValueExW
RegEnumValueW
GetTokenInformation
RegCloseKey
RegCreateKeyExW
RegRestoreKeyW
msvcrt
memcpy
memset
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpWriteData
WinHttpSetCredentials
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSendRequest
WinHttpQueryOption
kernel32
SetFileAttributesW
GetFileType
SetFileTime
QueryDosDeviceW
GetACP
CloseHandle
LocalFree
GetCurrentProcessId
SizeofResource
TlsAlloc
TerminateThread
QueryPerformanceFrequency
IsDebuggerPresent
FindNextFileW
GetFullPathNameW
VirtualFree
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
GlobalSize
GetLongPathNameW
RtlUnwind
GetCPInfo
EnumSystemLocalesW
GetStdHandle
GetTimeZoneInformation
FileTimeToLocalFileTime
GetModuleHandleW
FreeLibrary
TryEnterCriticalSection
HeapDestroy
FileTimeToDosDateTime
ReadFile
DosDateTimeToFileTime
GetUserDefaultLCID
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
GlobalAlloc
GlobalUnlock
FindResourceW
CreateThread
CompareStringW
CopyFileW
MapViewOfFile
CreateMutexW
LoadLibraryA
GetVolumeInformationW
ResetEvent
MulDiv
FreeResource
GetDriveTypeW
GetVersion
RaiseException
MoveFileW
GlobalAddAtomW
FormatMessageW
SwitchToThread
GetExitCodeThread
OutputDebugStringW
GetCurrentThread
LocalFileTimeToFileTime
GetFileAttributesExW
GlobalMemoryStatusEx
LoadLibraryExW
LockResource
FileTimeToSystemTime
GetCurrentThreadId
UnhandledExceptionFilter
GlobalFindAtomW
VirtualQuery
GlobalFree
VirtualQueryEx
Sleep
SetVolumeLabelW
EnterCriticalSection
SetFilePointer
FlushFileBuffers
LoadResource
SuspendThread
GetTickCount
WritePrivateProfileStringW
GetTempFileNameW
GetFileSize
GlobalDeleteAtom
GetStartupInfoW
GetFileAttributesW
SetCurrentDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GetThreadPriority
GetCurrentProcess
GlobalLock
SetThreadPriority
VirtualAlloc
GetTempPathW
GetCommandLineW
GetSystemInfo
LeaveCriticalSection
GetProcAddress
ResumeThread
GetLogicalDriveStringsW
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
LCMapStringW
GetDiskFreeSpaceW
VerSetConditionMask
FindFirstFileW
GetUserDefaultUILanguage
TlsFree
GetConsoleOutputCP
UnmapViewOfFile
GetConsoleCP
GlobalHandle
lstrlenW
CompareStringA
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
GetLocaleInfoW
CreateFileW
SystemTimeToFileTime
EnumResourceNamesW
GetSystemDirectoryW
DeleteFileW
IsDBCSLeadByteEx
GetEnvironmentVariableW
GetLocalTime
WaitForSingleObject
WriteFile
CreateFileMappingW
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
SetErrorMode
GetComputerNameW
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
RemoveDirectoryW
GlobalMemoryStatus
CreateEventW
GetPrivateProfileStringW
WaitForMultipleObjectsEx
GetThreadLocale
SetThreadLocale
shfolder
SHGetFolderPathW
wsock32
htons
ntohs
setsockopt
WSAStartup
WSACleanup
listen
gethostname
closesocket
inet_ntoa
socket
recv
ioctlsocket
WSAGetLastError
shutdown
inet_addr
WSACancelAsyncRequest
send
WSAAsyncGetHostByName
gdiplus
GdipFillEllipseI
GdipFillPolygonI
GdipGetHatchForegroundColor
GdipGetPointCount
GdipDrawBezier
GdipCreateMatrix3I
GdipLoadImageFromStream
GdipCreateFont
GdipSetClipPath
GdipCreateLineBrushFromRectI
GdipIsMatrixIdentity
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipResetClip
GdipFillRectangle
GdipFillPath
GdipCreateLineBrushFromRect
GdipAddPathRectangle
GdipDrawString
GdipGetImageGraphicsContext
GdipGetTextureImage
GdipGetMatrixElements
GdipCreateTexture2I
GdipCreateTextureIA
GdipCloneImageAttributes
GdipSetMatrixElements
GdipGetTextureWrapMode
GdipSetImageAttributesThreshold
GdipAddPathPolygon
GdipCombineRegionPath
GdipDeleteFontFamily
GdipSetStringFormatLineAlign
GdipGetStringFormatLineAlign
GdipResetPath
GdipGetFontSize
GdipResetImageAttributes
GdipAddPathEllipse
GdipGraphicsClear
GdipAddPathPie
GdipSetWorldTransform
GdipDrawEllipseI
GdipAddPathCurve2I
GdipDeleteRegion
GdipGetGenericFontFamilySerif
GdipLoadImageFromFileICM
GdipSetImageAttributesRemapTable
GdipCreateTexture
GdipDrawLine
GdipCreatePath2
GdipGetPathWorldBounds
GdipCreateHatchBrush
GdipSetLineGammaCorrection
GdipSetPenDashStyle
GdipGetPenDashStyle
GdipGetFamily
GdipDrawPath
GdipLoadImageFromFile
GdipGetPenFillType
GdipDrawRectangle
GdipTranslateTextureTransform
GdipScaleMatrix
GdipSetImageAttributesNoOp
GdipSaveImageToFile
GdipTranslateMatrix
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipAddPathLine
GdipDeleteStringFormat
GdipSetImageAttributesToIdentity
GdipSetPenEndCap
GdipGetGenericFontFamilyMonospace
GdipGetImageThumbnail
GdipGetCompositingQuality
GdipSetCompositingQuality
GdipAddPathString
GdipGetImageWidth
GdipTransformMatrixPoints
GdipCreateFromHDC
GdipSetImageAttributesColorKeys
GdipSaveAddImage
GdipCreateSolidFill
GdipGetGenericFontFamilySansSerif
GdipSetImageAttributesOutputChannelColorProfile
GdipSetStringFormatAlign
GdipGetStringFormatAlign
GdipInvertMatrix
GdipGetHatchBackgroundColor
GdipDeletePath
GdipSetImageAttributesGamma
GdipScaleWorldTransform
GdipShearMatrix
GdipCreateFontFamilyFromName
GdipDisposeImageAttributes
GdipIsMatrixInvertible
GdipCreateMatrix2
GdipCreateMatrix3
GdipRotateWorldTransform
GdipCreateRegionRect
GdipSetStringFormatTrimming
GdipGetImageRawFormat
GdipCreateMatrix
GdiplusShutdown
GdipSetLinePresetBlend
GdipScaleTextureTransform
GdipLoadImageFromStreamICM
GdipSetImageAttributesColorMatrix
GdipAddPathRectangleI
GdipGetHatchStyle
GdipGetFamilyName
GdipCreateStringFormat
GdipCloneMatrix
GdipDrawArc
GdipResetWorldTransform
GdipAlloc
GdipDeleteMatrix
GdipDrawBeziers
GdipRotateTextureTransform
GdipSetClipRegion
GdipMultiplyWorldTransform
GdipClosePathFigure
GdipDrawImageI
GdipAddPathCurve
GdipDrawEllipse
GdipGetPathPoints
GdipAddPathArc
GdipGetStringFormatTrimming
GdipCreateLineBrushFromRectWithAngle
GdipAddPathCurveI
GdipCreatePath
GdipGetPathTypes
GdipAddPathLine2I
GdipCreatePen1
GdipCreatePen2
GdipSetStringFormatHotkeyPrefix
GdipVectorTransformMatrixPoints
GdipGetFontStyle
GdipCloneStringFormat
GdipGetImageAttributesAdjustedPalette
GdipDeletePen
GdipRotateMatrix
GdipDeleteGraphics
GdipDeleteFont
GdipCreateLineBrushFromRectWithAngleI
GdipFree
GdipCreateTexture2
GdipSetImageAttributesOutputChannel
GdipResetTextureTransform
GdipCreateTextureIAI
GdipReleaseDC
GdipAddPathPolygonI
GdipSetStringFormatFlags
GdipGetStringFormatFlags
GdipGetPenBrushFill
GdipSetPenBrushFill
GdipGetImagePixelFormat
GdipGetStringFormatHotkeyPrefix
GdipTranslateWorldTransform
GdipGetImageHeight
GdipGetDC
GdipSetTextureWrapMode
GdipCreateRegionPath
GdipCreateImageAttributes
GdiplusStartup
GdipDeleteBrush
GdipCombineRegionRegion
GdipCreateLineBrushI
GdipCreateLineBrush
GdipTransformMatrixPointsI
GdipFillPolygon
GdipDrawImageRect
GdipDrawImageRectRect
GdipImageRotateFlip
GdipFillEllipse
GdipAddPathBezier
GdipSaveImageToStream
GdipVectorTransformMatrixPointsI
GdipMultiplyMatrix
GdipMeasureString
GdipDisposeImage
GdipSetImageAttributesWrapMode
GdipFlush
GdipSetClipRect
ole32
RevokeDragDrop
CoCreateInstance
CoUninitialize
RegisterDragDrop
IsEqualGUID
CreateStreamOnHGlobal
OleInitialize
CLSIDFromProgID
OleUninitialize
CoInitializeEx
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
DoDragDrop
gdi32
Pie
SetBkMode
CreateCompatibleBitmap
CreatePolygonRgn
BeginPath
GetEnhMetaFileHeader
RectVisible
AngleArc
CloseFigure
ResizePalette
SetAbortProc
SetTextColor
StretchBlt
RoundRect
SelectClipRgn
RestoreDC
SetRectRgn
FillPath
GetTextMetricsW
GetWindowOrgEx
CreatePalette
CreateDCW
PolyBezierTo
CreatePen
CreateICW
GetStockObject
CreateSolidBrush
Polygon
MoveToEx
PlayEnhMetaFile
Ellipse
StartPage
GetBitmapBits
StartDocW
AbortDoc
GetSystemPaletteEntries
GetEnhMetaFileBits
GetEnhMetaFilePaletteEntries
CreatePenIndirect
CreateFontIndirectW
PolyBezier
ExtCreatePen
EndDoc
GetObjectW
GetCurrentObject
GetWinMetaFileBits
SetROP2
GetEnhMetaFileDescriptionW
ArcTo
Arc
SelectPalette
ExcludeClipRect
MaskBlt
SetWindowOrgEx
CreatePatternBrush
EndPath
EndPage
DeleteEnhMetaFile
Chord
SetDIBits
SetViewportOrgEx
CreateRectRgn
RealizePalette
SetDIBColorTable
GetDIBColorTable
CreateBrushIndirect
PatBlt
StrokePath
SetEnhMetaFileBits
Rectangle
SaveDC
DeleteDC
BitBlt
FrameRgn
GetDeviceCaps
GetTextExtentPoint32W
AbortPath
GetClipBox
IntersectClipRect
Polyline
CreateBitmap
CombineRgn
SetWinMetaFileBits
GetStretchBltMode
CreateDIBitmap
CreateDIBSection
SetStretchBltMode
GetDIBits
LineTo
GetRgnBox
EnumFontsW
CreateHalftonePalette
SelectObject
DeleteObject
ExtFloodFill
UnrealizeObject
CopyEnhMetaFileW
SetBkColor
CreateCompatibleDC
GetObjectA
GetBrushOrgEx
GetCurrentPositionEx
GetNearestPaletteIndex
CreateRoundRectRgn
GetTextExtentPointW
ExtTextOutW
SetBrushOrgEx
GetPixel
GdiFlush
SetPixel
EnumFontFamiliesExW
StretchDIBits
GetPaletteEntries
__dbk_fcall_wrapper
__dbk_fcall_wrapper
__mingwthr_key_dtor
__mingwthr_remove_key_dtor
dbkFCallWrapperAddr
dbkFCallWrapperAddr
Name
.text
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
52KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
69B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
429KB
Virtual Size
428KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
296KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
~/buovg2.xml
- IMPHASH 83575ad6aced1d50ea51ef6b9838d7c1
- SHA256 992484d2d4aa3d9522406823c5fafe7809be48ee4bc13733bf14eea333c61234
- MD5 5e84f38f9b3b0b3cd01babaadf33abc1
- SHA1 d2514ed1befed05329a23e648f50f9344e246a61
- SHA512 5f7d308fb98cefbdd6102fb93d3ead85f3475a57eb846763497b6bc1a5186eb645cec7e100c609b8af969e2d4a0237affffc703ee2efbf1d2cc8192aecb55ddf
- SSDEEP 768:wiO8S6pjf11dUBBBI4JDOE7YeQ7yx5Kri5fDnuGGHdSLJ4:wixzpFURPJDOE7lQ2KrilbuGGHYy
- TLSH T1BE235B66AD0040B3FEE10636EBFE9C8A5EBC61161B2CA0E72777409D6D546D36B30B46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7f:58:2d:d9:ae:64:00:02:d4:5d:8b:da:6f:49:17:27:7f:1b:3d:de
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Chains
Mar 30, 2012
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Serial Number
15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 15, 2010 - Dec 14, 2012
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
5
Entry point
14880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GlobalLock
GlobalAlloc
GlobalSize
GlobalHandle
GlobalReAlloc
GlobalUnlock
GlobalFree
lstrcmpA
GetTickCount
CreateFileA
DeleteFileA
SetFilePointer
GetFileSize
GetModuleHandleA
GetLastError
WriteFile
lstrlenA
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
WaitForMultipleObjects
CreateEventA
CreateThread
ResumeThread
GetVersion
GetSystemInfo
GetPrivateProfileIntA
CloseHandle
WaitForSingleObject
ResetEvent
SetEvent
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
ReadFile
FreeResource
IsDebuggerPresent
user32
SetRect
UpdateWindow
InvalidateRect
EndPaint
BeginPaint
FillRect
GetSysColorBrush
FrameRect
IsWindowEnabled
RegisterClassA
UnregisterClassA
ReleaseCapture
GetAsyncKeyState
GetCursorPos
SetCapture
GetDlgCtrlID
DefWindowProcA
RegisterWindowMessageA
SetPropA
IntersectRect
MoveWindow
IsWindow
ClientToScreen
GetParent
GetDesktopWindow
GetWindowRect
GetSystemMetrics
GetWindowLongA
ScreenToClient
SetWindowPos
GetDlgItem
SetFocus
GetWindowTextA
SendMessageA
MessageBeep
SendDlgItemMessageA
RemovePropA
GetPropA
GetDialogBaseUnits
DialogBoxIndirectParamA
InflateRect
DrawFocusRect
DrawTextA
GetDC
ReleaseDC
MessageBoxA
GetClientRect
GetSysColor
LoadCursorA
GetActiveWindow
GetDlgItemTextA
SetDlgItemTextA
TranslateMessage
DispatchMessageA
GetQueueStatus
PeekMessageA
LoadStringA
LoadStringW
EndDialog
gdi32
CreateSolidBrush
ExtTextOutA
SetBkColor
SetBkMode
RoundRect
CreatePen
SelectObject
SetTextColor
DeleteDC
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
LineTo
MoveToEx
DeleteObject
msvcr100
_crt_debugger_hook
_except_handler4_common
memset
rand
strtol
_ltoa_s
memcpy
malloc
free
wcsncpy
strncpy
_CIatan
_CItan
AboutDlgProc
AllocPointer
AllocSlider
AngleFromSlope
BlockMove
BlockMoveData
BufferedDraw
CalcProxyRect
CalcProxyRectCore
CenterWindow
CentreDialog
CheckProxiesSupported
CstrToUnicode
DefPaintBack
DefPlotThumb
DeinitializePIExpressDialogs
DisposPtr
DisposeHandle
DisposePtr
DoYield
DragThumb
DrawSmallButton
DrawTheSmallButton
DrawTicksBack
DupHandle
EditFail
EmptyRect
FSClose
FSGetForkPosition
FSGetForkSize
FSRead
FSReadFork
FSSetForkPosition
FSWrite
FSWriteFork
FSpCreate
FSpDelete
FSpOpenDF
Fix2Frac
Fix2Long
Fix2X
FixATan2
FixDiv
FixHypot
FixMul
FixRatio
FixRound
FixSqrt
Frac2Fix
Frac2X
FracCos
FracDiv
FracHypot
FracMul
FracSin
FracSqrt
FreePointer
FreeSlider
GetDlgItemRect
GetEOF
GetFPos
GetHandleSize
GetIndString
GetIndStringPreferred
GetSliderPos
GetSliderRange
GetThumbRect
HLock
HUnlock
HandFromPtr
HostAddPIResource
HostAllocateBuffer
HostAllocateStripBuffer
HostBufferProcsAvailable
HostBufferSpace
HostCountPIResources
HostDeletePIResource
HostDisposeHandle
HostFreeBuffer
HostGetHandleSize
HostGetPIResource
HostHandleProcsAvailable
HostLockBuffer
HostLockHandle
HostNewHandle
HostResourceProcsAvailable
HostSetHandleSize
HostUnlockBuffer
HostUnlockHandle
Hypot
InitCursor
InitEditWnd
InitHypotTable
InitializePIExpressDialogs
Interpolate1D
Interpolate1DMulti
Interpolate2D
Interpolate2DMulti
InvalThumbRect
LockSliderData
Long2Fix
Long2X
LongHypot
LongMul
LongSqrt
MPSafe_Random
MPSafe_SetRandomSeed
MacToWinRect
MapRect
MemError
MoveHHi
NewCalcProxyRect
NewHandle
NewHandleClear
NewPtr
NewPtrClear
Num2Comp
NumToString
OutputMessage
PIDMDisposeDialog
PIDMExpressHandleDialog
PIDMExpressResDialog
PIDMGetControl
PIDMGetControlIndex
PIDMGetMacDialog
PIDMModalDialog
PIDMNewHandleDialog
PIDMNewResDialog
PIDMWinExpressDialog
PIExpressDialogsAvailable
PIInsetRect
PIOffsetRect
PIPtInRect
PIQuickZResToCString
PIQuickZResToPascalString
PIQuickZToCString
PIQuickZToCStringLen
PIQuickZToCStringW
PIQuickZToPascalString
PIQuickZToPascalStringLen
PISetRect
PIThreadsDoAll
PIThreadsEndThreads
PIThreadsGetNumThreads
PIThreadsGetParamsPtr
PIThreadsInit
PIThreadsStart1
PIThreadsWaitForCompletion
PIZGetIndString
PIZGetIndStringPreferred
PIZGetIndStringPreferredW
PIZLoadString
PIZLoadStringW
PIZNoteAlert
PIZStopAlert
PIZToUnicodeCString
PIZToUnicodeStringLen
PackBits
PaintSlider
ParamText
Random
RegisterSlider
SectRect
SetFPos
SetHandleSize
SetPIExpressDialogSuiteVersion
SetSliderData
SetSliderFlags
SetSliderMax
SetSliderMin
SetSliderPos
SetSliderProc
SetSliderRange
SetSliderThumbOff
SetSliderThumbSize
ShortHypot
ShortMul
ShowAlert
ShowOutputBuffer
SliderWndProc
SlopeFromAngle
SnapToLogPos
TickCount
TranslatePos
TruncateFileName
UnRegisterSlider
UnlockSliderData
UnpackBits
UserChangedEditText
UserInputAvail
UtilReadDescriptors
UtilReadPlatformFilePathDescriptor
UtilReadPointDescriptor
UtilReadPointListDescriptor
UtilWriteDescriptors
UtilWriteNoDescForceUI
UtilWritePlatformFilePathDescriptor
UtilWritePointDescriptor
UtilWritePointListDescriptor
ValidateDlgLong
WAllocBuffer
WFreeBuffer
WSizeBuffer
WarnHostAdvanceStateAvailable
WarnHostBufferProcsAvailable
WarnHostHandleProcsAvailable
WarnHostResourceProcsAvailable
WinToMacRect
X2Fix
X2Frac
X2Long
map_one
map_to_logical
map_to_physical
sASZString
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
~/kjxps1.xml
- IMPHASH 83e23a14e1e222ef4b0713f51daf296d
- SHA256 4653e55b1186b8198e72b198c49643c7e7d00bfed3520f360cf1879c8c27760d
- MD5 55f1b951724adc8d47a909cd6befe88f
- SHA1 13d012694cb5c69161dc6f53c61c297dccc3ee56
- SHA512 cdbf3a7c8ce9393f0f8d313ade2169b8441a1d859546eee8b6143b75ae636ac71723a16af4dd1456d5ae342ca76959cffe7242698a47a91840f82321e5d79ed9
- SSDEEP 768:44Wy+V9/3uhfPsCkhv3RoQA45YiQbj5ALS:QTV9uhfPohv3RoQA457y
- TLSH T13CE27C4BD7D80855D47B9670A8E34A1BEAB2F9105F6283CF2220815E0F627D13B7D7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ce:0c:32:6d:fb:6d:9d:e5:3b:5a:93:3e:80:96:e6:78:bc:01:81:43:38:c7:f3:10:a7:2f:de:b3:64:1a:55:bc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jul 29, 2025
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=5280394,CN=Dell Technologies Inc.,OU=Client Software,O=Dell Technologies Inc.,L=Round Rock,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0c:23:0f:03:f9:1c:89:5d:2a:5e:e9:6d:b0:0a:18:e6
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 12, 2024 - Nov 11, 2025
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
9256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\bamboo-agent-home\xml-data\build-dir\DDD-DBP-JOB1\dotnet\proj\Dell.D3.HSA.Server\x64\Release\Dell.D3.HSA.Server.pdb
rpcrt4
NdrClientCall3
RpcServerRegisterIf3
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerUnregisterIf
RpcServerInqBindings
RpcBindingToStringBindingW
RpcServerUseProtseqEpW
RpcBindingVectorFree
RpcServerInqCallAttributesW
NdrServerCall2
NdrServerCallAll
RpcStringBindingParseW
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorDacl
EqualSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetTokenInformation
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-security-base-l1-2-2
DeriveCapabilitySidsFromName
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
vcruntime140
__C_specific_handler
__std_terminate
memset
__std_type_info_destroy_list
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initialize_onexit_table
_cexit
_crt_atexit
_initterm
_execute_onexit_table
_register_onexit_function
_seh_filter_dll
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
HSAServerDisconnect
HSAServerSend
HSAServerStart
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=26706,
count=19, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=259, version=26706,
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=89, id=1, productName=Unmarked objects,
count=4, id=264, version=27054,
count=1, id=256, version=27054,
count=1, id=255, version=27054,
count=1, id=151,
count=1, id=258, version=27054,
~/matv/kkfm/xrlqto/adrst/acyet4.pdf
- SHA256 1bb9dcb4941df4c2975a03a6ef71cbadfa31117fe19b56fdc8c3b12be714c414
- MD5 12b5eb021903bbf1084fb64b0acf614b
- SHA1 da73294db8b2e569a89e136afa6837b65e143d0b
- SHA512 add97a632391450beb80e8148a889a76c9424bc497d816291e1c87bae0b1ff3878f0cbe3e89dd7ade3db03248dc6c94cc9755b81b855853b825ee60754dd685a
- SSDEEP 384:9Pv9G/z//S03wj/hSlBaDEX4XGkWl127Zwc35N:9Pv9MwVuUtfD7ZN35N
- TLSH T1C1929FB3E6E41C8CE8828A579D693DD4449DF023D3CC3CD124B94781B695E3DBA125EE
- MD5 SHA1 SHA512 SSDEEP TLSH
~/matv/kkfm/xrlqto/adrst/cirkqu8.pdf
- SHA256 3176dfdf46fe6b350ecfee47ca0e24fda18cfd972752903ec4e40d056f1e3f1e
- MD5 12590d714ab1ea408ad7311334828f27
- SHA1 1f18d0e38ba02e58c3f782df0dd8330e1eeb3d7e
- SHA512 b90b3df644ab3895b50ce762ad1cd10059363fe23947f5e064b5072f4ecddd0c350fa9d0c84e5648bd3d9a14ed74aff6e750bed0c2f9563381a03018de02b3fe
- SSDEEP 768:HNKhMN8MHi0CpVxevSBn924anU6FFqKIU9R:HNg6G0CPISt9unBFpH
- TLSH T1E8C29E192007D895DF5387CAFF1D1662664D730F52A0A8A27D2C8C168A97FF8F61D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
qr https://verificacfdi.facturaelectronica.sat.gob.mx/?id=5F408E0B-1BA5-48FA-9B50-A77B4C55B65B&re=EGU810928RB2&rr=IMH240401J77&tt=15793.17&fe=f2WuSw==
~/matv/kkfm/xrlqto/adrst/kfen7.pdf
- SHA256 8432848916b62e651f7bc10eedef9dec0087f6ebf022e128cd640171033c12d1
- MD5 b3fc50eac6c21715d016bf0e45402547
- SHA1 d72b82c279841174f65e15fee717cea005c40e27
- SHA512 37cdab027317349c3d4aeaf5009a3a3d6187987ab6106d29ec7c0e641e3a4cce131bc2312a63c45c3273e14b0b34067d115cad79af90016ff000b5fc9114cd8d
- SSDEEP 1536:iISV+cfeY/y8SIWI2MoE98zu7KKHm3N03Povj2cvXU:iBVReY/yv8loE6cK2m903Mj2QU
- TLSH T1D0838D53CE099B879548C3F97F172D6C2B1D330DA9C57AFE10220F8ABF989616C5906B
- MD5 SHA1 SHA512 SSDEEP TLSH
~/matv/kkfm/xrlqto/adrst/ksxfo1.pdf
- SHA256 4fdbed98b298ed09be27d9e0ea6f82c09183cd968d023c26a5effa60a2ca32a6
- MD5 c65d6f20d5961398a84ad0f38c70b941
- SHA1 87549af4c34881c5592cf262c1ecf1e1b5357297
- SHA512 930f83fbe6876487ffc440bc6ccba3ee0ec2bc11c455178bd501be11bfdb77b23ed4ec6e02cf955ad2850f78dd4394e51254f8115681bb487dd4836f2a70083f
- TLSH T18E415414E9C81CDCE4E64A437B0FB857B969710315ECA5D1016CD20F908DF95A9A3A27
- MD5 SHA1 SHA512 TLSH
~/matv/kkfm/xrlqto/adrst/lfyb3.pdf
- SHA256 473a670c7bcb56d7dea0aa53e7dc6129fa1b074f006bde8aa89fd1df9eb850c5
- MD5 dc3211db2ed08ac2b83b9e9223c4fdc1
- SHA1 d026aa69735c640a4486ac99eee6c776cc80f7aa
- SHA512 84108f8224316feae0b46c8b991a0f6b069ba40d3ee8edc0ec5e7461f4fa4f77e392ed04c7999f64c228ea1660f40b777299295daed4b1036621ebd2b8e331fe
- TLSH T11A414214888C5CECE4A65342BF2FF88BB579724316EC79D5006DCA0B808AF99AC5331F
- MD5 SHA1 SHA512 TLSH
~/matv/kkfm/xrlqto/adrst/pfxof6.pdf
- SHA256 99b16b54e191aa926f7b7c305b31440b696ef038357d1283a1a3939ad1e6b08c
- MD5 b6658bbe5cc145192adb4dbe87333b3a
- SHA1 94730a85e41c8ff76d194e2463f17bde3567a958
- SHA512 e29f8543820ec189a97d36c8e0bedb1744af0f16d1b48979c025de7d55c8daab9b648e96323a1f54abe13da203cbc0e2c0c464bfd020fac57db6eb24cc069d00
- SSDEEP 768:j9h+k/q5z2NgW0Qz0IQc4rnPF1N/JE9J/xE+YlO71sSA3yXUMkcqKIAdpLW:j9T/qdY0Qz0IQc6PFr/qZhY871s9CXWL
- TLSH T1A113CE561003C4B5DA07ABE6FF3D6C42452DB36BE5DC99A22C2CCD125A8BFE6F5490C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
qr https://verificacfdi.facturaelectronica.sat.gob.mx/?id=12F5ECEB-6046-4F09-90F4-4A2843CC5387&re=GEN700527K14&rr=CRI060109PD2&tt=0&fe=yPzSFA==
~/matv/kkfm/xrlqto/adrst/pkmj2.pdf
- SHA256 56d870a75385026c575569f0f0d89d757d73e827c1b9f890b4da7d5c53516bae
- MD5 70ebf93e7bbe30714bcf9ecb40760610
- SHA1 759f9713986c8b9f9ee2debd83da6adefb8627cd
- SHA512 e35368ff20401cf1fa05057dd1344e202bb27a1faffaabb726a570b2893aaa3a9689f782a3c604c0dda45c0f4b5d4df3ff6dc17064f5223f6db8c935246d23e2
- SSDEEP 384:QnY3q6OvFOx03wj/hSlBaDEXqGJWl127wwc35JJEccWLcy5hRxoN8yT2zk+M+5:QiNswVuUWD7wN35wbKtSKP4+v5
- TLSH T19DE2BFB3F1F518CCEC8647468A593DE9085EF127C5C83CC220798786A585F6DB7225DE
- MD5 SHA1 SHA512 SSDEEP TLSH
~/matv/kkfm/xrlqto/adrst/touddf5.pdf
- SHA256 224bd6620702bac590613ca035bd19580d9236ff37788b533e1595237a70b594
- MD5 8eabf381f589e9110ac0eec81d7e95b1
- SHA1 d40aa7f374a2ccb6092e0c3ec909233ce06c1ea4
- SHA512 e67090eb019d2ba4ed27c606488a69d4a7a981924e7e4eea1d9a8fe00ffe55b9d081523c59fa05738827f314b7ade122c0c2f020a37e39e55bfa48e49183b00a
- SSDEEP 384:4evTt6zbgNIwi8903wj/hSlBaDEXbkGQWl1272wc35j042:4wt6/t8IwVuUkAD72N35i
- TLSH T138A209B2D9A41D8CDC82CF8A44A53DA4046DF623E2CC7CD454B45F85B98DE9C7B131EA
- MD5 SHA1 SHA512 SSDEEP TLSH
~/matv/kkfm/xrlqto/adrst/tyug9.pdf
- SHA256 0893250096e4e2eace96e4a1605b2d13348770a0339a7a30598a967df5e5ba8e
- MD5 1a0dcafda9cd9664df53da25d8b0e2c7
- SHA1 27a62e71dcdddf670411f5f433b23b660ec70c85
- SHA512 b08f22f0c79e6969fc1d4fb30aca30adda00450fa760cf19c85b3c453cacd44660284437bbaa4fa80316b0d40f3f8f22d95f3cc245a38d55ea0d900f81421810
- SSDEEP 384:szMb0ccsPH3VpFdH9G5bBxJYfDx2RbH1EGRAzyw6N7V2lCIas/xnOh3q4q:JAiXVpFeyabH1CzRcQwIdN
- TLSH T160A2656E2763C998D8152B8DEA9467869334333617404F31FBAD2604D7C4F17BD5E8CA
- MD5 SHA1 SHA512 SSDEEP TLSH
~/matv/kkfm/xrlqto/adrst/zkca10.pdf
- SHA256 fb83dc5c94b5356bbf08a5c3dc9efa6d8812b270132151368d4889f4d926e6da
- MD5 617d685270333d15dc6396c6fbc137af
- SHA1 83284779920af6efdfc446c93cd311c2e61c38f0
- SHA512 5e0fb70babc5bd019665e61bb09dc33a56bea963703ed8d94568b89b2cbb1f7ab28a51954dac4ec263ac89f4023e3c55cfbed488147eb7e9c36f5cc57ea363f9
- SSDEEP 768:L6IlCJijP4KMByHhpNEOcpzI0iZGIqwFxMO1DdUD3mxDYvz4VdmfiIvftKu//31v:L6IygwK9BpNOzrGMmxDMz4V2vfvPFuQl
- TLSH T13403E1B06231B809EAD7675DBFA13D49458E3A42CDD128C3D8618AFF7574AD39862EC0
- MD5 SHA1 SHA512 SSDEEP TLSH