KIRKWARE SRC.zip
- SHA256 6a95103ed0be3ea8020375dbe695cb9c0a7b12cae98bad5906f314d8b28c05dd
Overview
overview
3Static
static
3FULL BUILD...er.exe
windows10-2004-x64
1FULL BUILD...er.exe
windows11-ltsc_2024-x64
1build.bat
windows10-2004-x64
3build.bat
windows11-ltsc_2024-x64
3code/driver/valk.sys
windows10-2004-x64
3code/driver/valk.sys
windows11-ltsc_2024-x64
3loader/kir...er.exe
windows10-2004-x64
1loader/kir...er.exe
windows11-ltsc_2024-x64
1tools/BeDaisy.sys
windows10-2004-x64
3tools/BeDaisy.sys
windows11-ltsc_2024-x64
3tools/WdmDiagSvc.sys
windows10-2004-x64
3tools/WdmDiagSvc.sys
windows11-ltsc_2024-x64
3tools/kdmapper.exe
windows10-2004-x64
1tools/kdmapper.exe
windows11-ltsc_2024-x64
1tools/sig_scan.py
windows10-2004-x64
3tools/sig_scan.py
windows11-ltsc_2024-x64
3x64/Releas...re.exe
windows10-2004-x64
1x64/Releas...re.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FULL BUILD/kirkware_loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
FULL BUILD/kirkware_loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
build.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
build.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
code/driver/valk.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
code/driver/valk.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
loader/kirkware_loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
loader/kirkware_loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
tools/BeDaisy.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
tools/BeDaisy.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
tools/WdmDiagSvc.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
tools/WdmDiagSvc.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
tools/kdmapper.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
tools/kdmapper.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
tools/sig_scan.py
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
tools/sig_scan.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
x64/Release/kirkware.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
x64/Release/kirkware.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target KIRKWARE SRC.zip
- Size 10.0MB
- Sample261029-ypncfscc86
- SHA256 6a95103ed0be3ea8020375dbe695cb9c0a7b12cae98bad5906f314d8b28c05dd
- MD5 d78d569ec4ee97bfabb1f70a6928a109
- SHA1 a83b5778a84a3486543fa76f1e01449372b2b17d
- SHA512 111145c77d88bf40019e73cb3146475d921b11f40470169701f86fec98e175440d2ccba45372cf3836ee41ba56dba23c067d6926a03d2c9acff94d279aa82c3f
- SSDEEP 196608:UWNggFzWNggFSNXJ+Sgq/rZ4WnXBPrmi5+MknXsQnEp1lP28Mj4PZGzvp/:UWN1dWN14NZ+Sgq/rlXBjmipasQEhPDU
- TLSH T13EB63315EA2D784CF876D7F7E52878206700DE5EB130689B88C8965CE92937F1F1F286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/FULL BUILD/kirkware_loader.exe unpack001/code/driver/valk.sys unpack001/loader/kirkware_loader.exe unpack001/tools/BeDaisy.sys unpack001/tools/WdmDiagSvc.sys unpack001/tools/kdmapper.exe unpack001/x64/Release/kirkware.exe
File Explorer
-
KIRKWARE SRC.zip.zip 10.0MB
-
FULL BUILD/kirkware_loader.exe.exe 1.2MB
-
Kirk.png.png 224KB
-
boot.log10.7MB
-
build.bat.bat 1KB
-
build.log332KB
-
code/core/Keybind.h10KB
-
code/core/antitamper.h7KB
-
code/core/defs.h11KB
-
code/core/kirkware.h8KB
-
code/core/priv_hook.h3KB
-
code/core/utils.hpp985B
-
code/core/xstring.h233KB
-
code/driver/driver.h11KB
-
code/driver/driverdefs.h4KB
-
code/driver/kdrv_user.h4KB
-
code/driver/ud.h2KB
-
code/driver/valk.sys.sys 27KB
-
code/game/FVector.h14B
-
code/game/kirk_image.h1.4MB
-
code/game/offsets.h2KB
-
code/game/r6_bones.h4KB
-
code/game/r6_dump.hpp19KB
-
code/game/r6_entities.h76KB
-
code/game/r6_scanner.h16KB
-
code/game/r6_vtbl_scan.h5KB
-
code/main.cpp25KB
-
code/menu/features.h1KB
-
code/menu/gui.cpp5KB
-
code/menu/gui.h381B
-
code/res/kirkware.rc1KB
-
code/res/resource.h450B
-
kirkware.sln922B
-
kirkware.vcxproj9KB
-
kirkware.vcxproj.filters4KB
-
kirkware/x64/Release/gui.obj56KB
-
kirkware/x64/Release/imgui.obj1.3MB
-
kirkware/x64/Release/imgui_draw.obj618KB
-
kirkware/x64/Release/imgui_impl_dx9.obj62KB
-
kirkware/x64/Release/imgui_impl_win32.obj76KB
-
kirkware/x64/Release/imgui_tables.obj281KB
-
kirkware/x64/Release/imgui_widgets.obj937KB
-
kirkware/x64/Release/kirkware.exe.recipe302B
-
kirkware/x64/Release/kirkware.tlog/CL.command.1.tlog7KB
-
kirkware/x64/Release/kirkware.tlog/CL.read.1.tlog176KB
-
kirkware/x64/Release/kirkware.tlog/CL.write.1.tlog4KB
-
kirkware/x64/Release/kirkware.tlog/Cl.items.tlog1KB
-
kirkware/x64/Release/kirkware.tlog/kirkware.lastbuildstate166B
-
kirkware/x64/Release/kirkware.tlog/link.command.1.tlog3KB
-
kirkware/x64/Release/kirkware.tlog/link.read.1.tlog6KB
-
kirkware/x64/Release/kirkware.tlog/link.secondary.1.tlog567B
-
kirkware/x64/Release/kirkware.tlog/link.write.1.tlog1KB
-
kirkware/x64/Release/main.obj7.0MB
-
kirkware/x64/Release/vc143.pdb2.6MB
-
loader/kirkware_loader.exe.exe 1.2MB
-
loader/loader.cpp8KB
-
loader/loader.rc394B
-
loader/loader.res1018KB
-
tools/BeDaisy.sys.sys 18KB
-
tools/WdmDiagSvc.sys.sys 20KB
-
tools/kdmapper.exe.exe 150KB
-
tools/offsets.h3KB
-
tools/sig_scan.py5KB
-
vendor/Imgui/imconfig.h10KB
-
vendor/Imgui/imgui.cpp838KB
-
vendor/Imgui/imgui.h364KB
-
vendor/Imgui/imgui_draw.cpp278KB
-
vendor/Imgui/imgui_impl_dx9.cpp19KB
-
vendor/Imgui/imgui_impl_dx9.h1KB
-
vendor/Imgui/imgui_impl_win32.cpp45KB
-
vendor/Imgui/imgui_impl_win32.h3KB
-
vendor/Imgui/imgui_internal.h257KB
-
vendor/Imgui/imgui_tables.cpp238KB
-
vendor/Imgui/imgui_widgets.cpp493KB
-
vendor/Imgui/imstb_rectpack.h19KB
-
vendor/Imgui/imstb_textedit.h55KB
-
vendor/Imgui/imstb_truetype.h194KB
-
vendor/color.hpp21KB
-
vendor/d3d9_x.h2KB
-
vendor/directx9/d3dx9.h1KB
-
vendor/directx9/d3dx9.lib4.2MB
-
vendor/directx9/d3dx9anim.h42KB
-
vendor/directx9/d3dx9core.h23KB
-
vendor/directx9/d3dx9effect.h41KB
-
vendor/directx9/d3dx9math.h58KB
-
vendor/directx9/d3dx9math.inl44KB
-
vendor/directx9/d3dx9mesh.h100KB
-
vendor/directx9/d3dx9shader.h38KB
-
vendor/directx9/d3dx9shape.h7KB
-
vendor/directx9/d3dx9tex.h60KB
-
vendor/directx9/d3dx9xof.h11KB
-
vendor/json.hpp912KB
-
vendor/lazy.h24KB
-
vendor/libcurl.lib1.8MB
-
vendor/library_x64.lib3.2MB
-
vendor/stb_image.h291KB
-
vendor/xor.hpp2KB
-
x64/Release/imgui.ini53B
-
x64/Release/kirkware.exe.exe 847KB
FULL BUILD/kirkware_loader.exe
- IMPHASH 5c067986545399df168218f51ced0ce5
- SHA256 793eae8e87722db796d53180f561cf875e462f87b8c5a016a99dcad570baa1f3
- MD5 6c2adcb7bfc7685dfb288cd959835472
- SHA1 5926873043c73fe2c35d0b8e2175fff03724f10d
- SHA512 4e50728117eb57b9f6bc2a320b308c51db2a1e611f31885e1318f11aead0684b1addfe713108bfba63f491a8edc4680e8943258acfc35f4ac6d63ae579667519
- SSDEEP 24576:KFa1GL/EjaRWaAA5vnAqLnr0ZAW8m9VVAPZf4OZ20B/nk:u0K05WnHr019VWPN4OZjB/
- TLSH T1F8459E4BE6A610F9D1BAD038C556651BFEB13895073097CB67D00A662FB37F0AA7E301
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15644
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
ord680
ShellExecuteW
user32
GetAsyncKeyState
kernel32
TlsAlloc
WriteConsoleW
ReadConsoleW
HeapReAlloc
HeapSize
GetStdHandle
CreateDirectoryW
CreateFileW
ReadFile
WriteFile
GetTempPathW
CloseHandle
SetHandleInformation
CreatePipe
WaitForSingleObject
Sleep
CreateProcessW
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleTitleW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
SetFilePointerEx
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
Name
.text
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1018KB
Virtual Size
1018KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=146, id=261, version=33145,
count=13, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=7, id=257, version=33145,
count=111, id=1, productName=Unmarked objects,
count=45, id=261, version=35207,
count=1, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
Kirk.png
- SHA256 f03781177daca04b07efd8f1f98e56b5494d4b70c62e9d4245caeef36b17e48d
- MD5 d324aceb20ebffefd599f2b349b25552
- SHA1 2ceb6beecf6a104ed5bc9433656be5b1f92fb9c2
- SHA512 e724dc40f2fcabf30c1312181aad211b61b915470660b9c8f247ba0ce8242404339b4f9c8c3bf8c9eeaf87e07bc81984b4377a668703359d2116474d59ddc084
- SSDEEP 6144:ok4Y5RHnrmYqCtmZAW81FGomd9VXjw0Y4axM:oRYLnriCtmZAW81o9VXjZY4axM
- TLSH T12B24121EB8075C7DD8ABB86D10684C93E4E584C13366B327BC26F99D1631668E3F5F88
- MD5 SHA1 SHA512 SSDEEP TLSH
boot.log
- SHA256 44caabc3fc0a75c435bec8d0ac385b0c0ea3dbdee8d335719da29253b10853aa
- MD5 f4f3ecb96a198de8cfac088d1aaa259a
- SHA1 8a82fe06fecb3572ca99fc4c76381ae4ccf646c0
- SHA512 ba9f65bafc353b6b7947a6fb9dba8e9f34d6daba3caa715fe58442928376dcc1208b9df3a76f5c18e4f30b28ea5a30bc486525318acac41491dd5ab0833900f1
- SSDEEP 192:o5zG3lcgH6vHLAR0xLVYW5INVg0PvOLWLVs+a2wU3vBwtTtsoWkU3nb1:VVcgavUOU+tS
- TLSH T19FB6134AB6FECA09CF1258B1E1AD08BCDD9E614B322EAF754D19551200FF82AF5CD271
- MD5 SHA1 SHA512 SSDEEP TLSH
build.bat
- SHA256 2375f4d83f86148dbe560b3717e7fc5cea174b03497a4a2a7b926fd221f1d18b
- MD5 9f6ee4859e33d8ed02e6c3406e10e5c6
- SHA1 491978f3510c07b584ffb628e7bd6ccaac103166
- SHA512 182d7c8c56ae4d2be89adea522213a5ffa8c5089500a643b1a2cffabbf4ca75c1f691a3da5acbb51922014be5c75f3e5084a72e8efd23a0aa4c71ec538b8ae08
- TLSH T1033144B6116ED0527022988ED7A108C07DAA66C303395F7E2096512FD1CA7C9F1FDDD1
- MD5 SHA1 SHA512 TLSH
build.log
- SHA256 d41ef74e31879f5d17127dac0f7d46343ea13634d94d135b16625b056dff7b09
- MD5 da1d0d36cb12a327c92a851c49fda81e
- SHA1 13f6f03d059bbdfd50b97ce9d110dddb5b1b48b3
- SHA512 048ae9a99446078fb29a7da008874c45b1297fa517eb0f3cef33ace3b170da385483a0985c0cf38312700b8d6ad616b97c3feab897551b9e61ba76f2651d86c9
- SSDEEP 3072:M/l0wOqsiRFv0P3197QU3PEb5Y9CjAMTk82pW7FqU6hvZMqrpo8RaUsfsrHJkF6D:E98QdTgIaYlisVtM
- TLSH T152740569C955C1DB73327298C3121D38B4D85FD32350AA39B7DC860AD733B99E92D8A3
- MD5 SHA1 SHA512 SSDEEP TLSH
code/core/Keybind.h
- SHA256 994de22a1e38964f81faba4d269035625f34eaf6439e632792fdf63666e4b2c5
- MD5 ca4909d32eb53714b4b5374cef0e82c5
- SHA1 ed10a2993d6e1694147f296d7b3cf8b9a37d54c8
- SHA512 98f4da93839b9174972ebf893023d61f54b1e6abdd8fd293ee30645f9436f6903bf2a9b888b53b50af0a411e45525642887890386660399fb3d5c3b70400ddbd
- SSDEEP 192:gaEoo0MvdtZdt+dtDdtYdtjjhMFLc33AUHPh71:OvdTdodldyd0eAef
- TLSH T1CD32DDDB74EF404F55A46A4142B868B0EBECA33D83626CE0FC5D7E91D432B75421D8EA
- MD5 SHA1 SHA512 SSDEEP TLSH
code/core/antitamper.h
- SHA256 efe15650e9f02f785475647e3a947d7610e7c27e3c374d9e2f8db3a885def434
- MD5 486140ddc19636ebc9a88a19d531cd53
- SHA1 de22ae9ff0471d0e4972cb37de925c7ab710abe6
- SHA512 3ebcd68530e5dea4d8a16357f509036f390a3ac6bc999a124e4139f681e265acf9094a2091a07d218054927e817e8055996ffce392ae26545f74196ba07bf041
- SSDEEP 192:5KD6skPsonNKxTfmARB2nRgR8RyjhNfzMLN7js7Aw:UlBKCOyjHzMljskw
- TLSH T12DE151943A1550426DB73BE9A3878015F239507316E60A04FD7C2A0ADF378A6E5F9ECF
- MD5 SHA1 SHA512 SSDEEP TLSH
code/core/defs.h
- SHA256 debbe168e0033a5ace1b88e31714d2de2abd7c2e0ade7a0917fcb7d9b42b9741
- MD5 55b0dfdeb2f85482395af550847bddd1
- SHA1 35faf389523b5ec9dd4783c27bf448f0fab6ad7b
- SHA512 b62852abd18efb7a132a08aced46939f2b8578a41e7994a759e7527db2b67aa90187eec392fc6ca8eee2d52b6d89f9045d94264d27bf6a3dbfe5d6331ed51c6d
- SSDEEP 192:VY8o94d4p8U++Dlw1cJLIG8PL+BI+tJXv+E+q1XEFIn1alQ:a8o94d4p8UPw1cJuTkXmE+q1XoIn1mQ
- TLSH T1C23283629DD19176353B2026034C8200FB5AEA7349D46AEEF81E489D6F978B1C3F19DE
- MD5 SHA1 SHA512 SSDEEP TLSH
code/core/kirkware.h
- SHA256 9c86633036a48cc300211ff4a863c35cf082fed0ea3ab8e6bc8feb8187a8eeb2
- MD5 f10dbb0b644b60e10670156c7197db4f
- SHA1 69c4cd011fd1ffec5a7e88b198466eaef098d311
- SHA512 2490b907ee958ee01dbfadb211789ddc9f0285bb01a95eaf4e3c546b510facc1aeef1193bb2b82278a6f59ac880a676e726aadddd47b57e22a5ce121fae1b297
- SSDEEP 192:JXaPwWE2FlFo8pBxjVzjXJROvB1A4cu0g5QiSrn4yi:rUjSyvjVzjXJROZ1A20g5/yn4yi
- TLSH T13B0232666AEFD130E02264498E7B08ACF17C696007054C6EF19D19ACBC54F9EC62ED6B
- MD5 SHA1 SHA512 SSDEEP TLSH
code/core/priv_hook.h
- SHA256 67e1f7a273319b95b8d5528043649c7b7038c773495e2464cf31b47319b66aa3
- MD5 1392af5db5286a8138c0c42e75c6a751
- SHA1 5a29e6486b16380cd688f3c7f1d69fd27ae952e9
- SHA512 475d69bf4ea0c23f8918aab4664b4dd0c4570a48d884abbf3a8abcf2ef9f2af1cd4aafbc1b02519c0b4f41f6cb7428fbc7e111c8e206ac843679fccd6340ae6f
- TLSH T18E81628E98D35C2961A7453EEF4BB82A7F98C45712AECD00B90DC056FF850BCC2B5B95
- MD5 SHA1 SHA512 TLSH
code/core/utils.hpp
- SHA256 549df1693683212f7c370fcdd3f61ca54903a774f19dc06cd5da379b37b65a10
- MD5 61e7b1399562ea985cc113e2e5cb85fa
- SHA1 d7eab03792f1b672ecb9d0a7d25e960bb4765dea
- SHA512 1af6878649fbac9fde43d7ffc260723cf637e761ee8a70004b5921bbc11fdcac9b5e6b5fd993f06c20e381fab1812da59a32bae4da9b6ff45ecbc5aa5abe2d6c
- TLSH T150119E81ECF97B4787AD11D61975640318B9FCA087B90AF8D2FB60A0750455DC0FD579
- MD5 SHA1 SHA512 TLSH
code/core/xstring.h
- SHA256 839b422f590bbaa9bce54a6855056e9cca5428a7d7b7f6cf4292dd8a7a8c08c6
- MD5 f0b67571aed2c7ca40234c7a8d87a329
- SHA1 9573279da8c80e2b2328ba7eeaf8899e11d3c1fc
- SHA512 fa2e8c2005f41f285739ddfc6050707bec3f71fab8c7921a9b09b2241a49191bd7d79869a463a292bc496c6462a188c9653ec8be4d06d83f0d71b7e869cdac2f
- SSDEEP 6144:UYUKOcznDID7wmJUe4TNO8PK/l4TNP8fS6duqZcXL6d4TIJFTNj9PjlWOpC7RqOc:pnDIDxJUe4TNO8PK/l4TNP8fS6duqZcK
- TLSH T1293483A321D6B44129767396F7831036E7095113B6B1C5E8F9EC86387FB2091D272FEA
- MD5 SHA1 SHA512 SSDEEP TLSH
code/driver/driver.h
- SHA256 bd650f609121e741183e286e3f0110fee22784db0d4dc90f8dcb20a8f78d2002
- MD5 2ab68d85c3702799a583aac5e30ede28
- SHA1 f5ce60b2704b9ba7b5e0e48b1fcbf747cd0fe325
- SHA512 705c929c0f41df8fa34ded76b64701a8438bd8f10d26f9e2a99c82aa43570517d52337523497abfe7fc3119a38ef9e016735670220a51cc9256b7fac45891fad
- SSDEEP 192:5w/kuijiS77NdTJwpzSmqJfJyUykItTryM++wyqJEKyyFQbZlQ+R8uWXDVd6wP3r:5wtiji6C71IANFnfQ+Qpo1c
- TLSH T17132C88A5A85A81764F65E36FF425024FB88886321FF03B5F9ECD2101F79069E5B0FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
code/driver/driverdefs.h
- SHA256 51682bb87a0e68c1969e5689d590e139346bab9f40cfbbed70ca8e44c2a0ca05
- MD5 57624fd261f02382a7a1988046de77ec
- SHA1 43bfc9eaf1cad3a5ead1049230ccb38ab3568185
- SHA512 cc5f904ef99c75f226916964ba43b3d54a432b696283cf26884510e78a123f818d3e4aec2186be30787e597f2de235e6fc17d41d0a2dea1f514b342940cfb012
- SSDEEP 96:RMWYOd3vA0oTWlAVb9zJENRcqjiyw+8/Xh/dsESE:RMid3vA0oTWKVJNELicsXh/dsJE
- TLSH T17CA1B6B18D265065EEF302187BB72884609DB3171A2B9815B50CEF307FAC4E468FA3C9
- MD5 SHA1 SHA512 SSDEEP TLSH
code/driver/kdrv_user.h
- SHA256 99a2513088a9b53cd1995279e378fadfb438bca1f3a251f1feed978d81be682f
- MD5 0d40c5e0faac5b7398b57f1f3e6cf951
- SHA1 a6ee9a8c4d4dcacf8025cb01daf03615406cf8a9
- SHA512 49f52dc8d6899e6f0753783011377de4ce16af68a18808d6f42d951134942f5c337eead6cbf5266844d5861a436c518885209d46f1edd2dc3aab64094fdc56ea
- SSDEEP 96:Ht+YbFIzjpkYphJpAmp63pmcpWEaHgEeLJbOkr50m/1qsyvsqW/YwyvIE:LbcBpLUP/YUtBtQsyvKgwyv5
- TLSH T1658162C61D94501158B6A2766FC64404FAE052A357CD96B4F8AC63307F31CBDC9E1FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
code/driver/ud.h
- SHA256 92c0625911127309a72261f76271ac53ecf6e5e8e4ccbf116eabc357133e7112
- MD5 df447cac9475cb203d5091778b9c2a05
- SHA1 1d772ca9ae3838d5ca00714f49b9f0da2f3f79eb
- SHA512 13326a2f7b62e9a4bf2b7f390064e8efc715a782624e3502b365fe008dbe4b58b2eb2b37e3fbb213944612fae761716b8dcf47912d7e5f94cfad787fd6b04a20
- TLSH T161515BF2EF3CE517CE74342D56CC02156EE8E061F169B9E3E43899E4A065A2E135DA0F
- MD5 SHA1 SHA512 TLSH
code/driver/valk.sys
- IMPHASH 8f671e63bb19366b3c67cb71f3928c87
- SHA256 87cd2d97ccf190fb599d960d319e2c6cdba400b2279503f392d7b3521473563f
- MD5 eb688129bc1fbc5cf717954ea0718ba5
- SHA1 fb9da680674933d45896a48d21749f26f260e301
- SHA512 f91cb342fc964de6e7da252ba08a52a0e7b3c483ecc2e301ac8cadaf2da06a7c963421dcd88acede8c0f84dbc95deb787a10d9a1980362cbc5afbaf984c6fbdc
- SSDEEP 384:uKL22xajr5g5zrrXkR4cTUFg8K2m4qmsammid9kKVZXhGX2CL:uA0tR4cTUFgtfmsammi8KzXhGGa
- TLSH T125C24E8AE3A624F9E5FFC23981B1129BB6717A16431197DF4560C5385D27FE0AD39F00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
10
Major OS version
1
Entry point
7808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntoskrnl.exe
RtlInitUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
ObfDereferenceObject
ZwClose
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ObOpenObjectByPointer
ZwQueryVirtualMemory
MmCopyVirtualMemory
ZwQuerySystemInformation
ZwQueryInformationThread
PsProcessType
PsThreadType
ZwCreateKey
MmGetSystemRoutineAddress
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
RtlFreeUnicodeString
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=262, version=33145,
count=2, productName=Unmarked objects (old),
count=8, id=259, version=33145,
count=8, id=260, version=33145,
count=3, id=257, version=33145,
count=44, id=1, productName=Unmarked objects,
count=1, id=260, version=36256,
count=1, id=255, version=36256,
count=1, id=258, version=36256,
code/game/FVector.h
- SHA256 aecb9819eb04bf5ad6cd2535cfac9b1bed5ef7946e551eff2224759862e16294
- MD5 ac61f8469d49ea745f868f758477499e
- SHA1 cadf9574dfb94e29670aa64c3896e11e85dbe714
- SHA512 2a42c66b4d42a480f371717744221e18677c017cfbd9cdc1e872a25ca1984d8b06b25c41ae15423bcb5569bbf1558d99f39c4ab36cf7291e7f7884c2262c2208
- MD5 SHA1 SHA512
code/game/kirk_image.h
- SHA256 74e6801fbeb8f016c58bb8c9fc29534f33d986d7f8e4723ec9a62dab245bf57e
- MD5 4c520f6f1bc1d4085037a575620c76fd
- SHA1 ec811ba6b926d1e7c04cc865d53b2cffc1b331c8
- SHA512 2128a08af06f0034e75919895aa210515331827f8910d418539ebc75119684360ef81514ae9f79e98f1f1c7fd38a956125b26fa2f4bd0c78011573f265f5d0c0
- SSDEEP 12288:1fV1DPmpWmMU3YroI5mB1R78FL86m/V6bF/4:Q
- TLSH T14065F3DEA30D55D50DEB32A8EB064D63FA849A2606748A4FF7BF844FF56F81580F0906
- MD5 SHA1 SHA512 SSDEEP TLSH
code/game/offsets.h
- SHA256 fa24df3a31b2fe7a9637ab2cb5e3cc72e7bf475a50389d040f4c31c255bdc6a4
- MD5 576eef1402e3e38a692ed947ee6d643a
- SHA1 9d9dab8ff67b0473d49ce014fbc4d800c71b78a1
- SHA512 e5955b45ca4de0204aa9bd5787e3b0555ae0d26e5a3ff3b570c3f1ee412e96b0a19a45c0081331072ec3e578436c3cdbe10f8455c15b046b03aa1b57fc057189
- TLSH T1F9514F9C0147090B5EDB93B9AF5C7611F99B203304E1A404BD5EE5F46F4BD2C4E726AB
- MD5 SHA1 SHA512 TLSH
code/game/r6_bones.h
- SHA256 c50ed3716a2b4c7a3d2daf2df0ba0ed2bd7f5272bc6baaad9547348274563297
- MD5 b433671efc418c62982a75f0a80d44c5
- SHA1 532f4b6f7b3e0f7623ce71139d10b2bac0151001
- SHA512 c9f175674058ba380c19f37acab0c56382b326ed04a49141c081915bec49b962c91512de9943f7ea226ffae4dd92c860aabc6ec93c5d74688fb32493cae7004a
- SSDEEP 96:uQVh7E9E2/nNPny25PdMmqZbWup7uf6icn:PmjxSmWbWMB
- TLSH T191919733D1FAE1E93815F6FBA22F19107B8593509F69684CE7C7A0543EAA405CC826FD
- MD5 SHA1 SHA512 SSDEEP TLSH
code/game/r6_dump.hpp
- SHA256 2126217d5255c093c23af05970f9a83ab6b7da167b0cfbcf68d00239dcb4e7a6
- MD5 73044beed00fcacb8500eaffa68ebd2a
- SHA1 8510b9d92af4e9d52c8ffd28d4817c83f4af9aa1
- SHA512 1f6e4e09a5e718752bb0fb2adf67b33c4d1b60027f7fd72a2453fe09dfcec66c844c8a790b625fddd827fe1fc7b706f2760bc458e7f38784a0b101208f1c9850
- SSDEEP 384:vmjnZrTntf2ZojTNcSV4KkDO+WUzXLEawieeia:OjnZrTtf2ZojTNcs4O+Wreb
- TLSH T1B5928C9054928816A4465BBB7BE6B038C09D113378D4DCA2F4BF63F453CA53A93B36DB
- MD5 SHA1 SHA512 SSDEEP TLSH
code/game/r6_entities.h
- SHA256 003b34c48fed1699031580b16fd846da27d57ab255ce445a0342e8d622b15146
- MD5 26743a148de2778eafc21c8c6456c34b
- SHA1 bb5e6c6859631ec6acb4a4ebccb151904b4d0403
- SHA512 2e1994bc46a3b44990a18489752d4e4b7c81433ecc689992e122221beee038eca1599c1adbb681f420c66ae1f6b9692989911fb51559c424725aa9a4b4dea446
- SSDEEP 1536:Fe6EchTdzFXy+SRZiZlj0dyyK8TnF6uy+WQuiianVmXRba4RiGa:Fe6EoTdzSZcF0dyyK8TnFNWQcanVmX/a
- TLSH T16E73C88A4156582558F2A63EDF83500AFB5A44B356C51360FE8DC110AFB64EAC3F4FFA
- MD5 SHA1 SHA512 SSDEEP TLSH
code/game/r6_scanner.h
- SHA256 e5d7904f6b28b1b08e8cded4a8687a0f17ca0ae4c11d9cc6f66a8a95d4f912e5
- MD5 4d0832fbdbb42a6d2d49f8ca9a41fdc9
- SHA1 419731728afe635e96103965e442f458cf19b74d
- SHA512 6377ac716eecda1aad57088fa7965a0007321bea59cb6859a9c5b5ce33c428c0236069892f378777c035631a47fdbf84fe348f2cb546765d8321b4ea68f70174
- SSDEEP 384:x3rk2QPiMSX3VFe3gD4sEVdFHDzecrPl+xo:x34/PixX3VFe3gD4zVyElZ
- TLSH T17572A34E50DF282276A7593E8F8B3025B6949443A8DADF40FD5C8380EFC7479C6B1A97
- MD5 SHA1 SHA512 SSDEEP TLSH
code/game/r6_vtbl_scan.h
- SHA256 088e80c79da57389fa9ce3245dcae249405e3f7f61535f2012a4bc973c0ce3f8
- MD5 4e05a926710cd1ce1f60026270c1871f
- SHA1 0ba09687cb547a26c6ee86b8111cbe88b8b6b662
- SHA512 fa276c76f35450a71e4b6a3d7ddd4a0ac875c923cf49125e54e1529bc17519feed0cad45e703ed833bbfc1d3f6672d4b6cf5970bb5b6b757087189ec0db6afb7
- SSDEEP 96:AAStUkwY0swaAHFtDBDK/tcsbe0OkT5E20t777bpzkSLC/nJjyYJ1k0YNbGudmuE:AAStUkhPottDK6iDTH0hbhkICfJjyYJ3
- TLSH T1CCC19610949F590675D3E17E5FCF6082D290605360B2C6607E8DA0809FDE5BEC2B9E7E
- MD5 SHA1 SHA512 SSDEEP TLSH
code/main.cpp
- SHA256 ce0e4aad219fd2a46c474f1ec1fd48e3a0951ae348f31fc68035d162927a5d8a
- MD5 cfffcbd5accee0df33b508850ae95b4f
- SHA1 b66604594301afed5d938c1378c974e36f9cfbd5
- SHA512 ce7f162ad55e09421a2472196f53aa1ffb8c0006235f8649977b967a6a280345e483247cdda703917cba9d0984816392e144f62622e30e18ef63fb82a5f21559
- SSDEEP 384:T5V1NdtNFgmA0pRxX+jDuVT5q4YFYAQQoIQ3TGEAhj/+B4HChm+Fss3JKBM9T0L8:Ts3IvVT5q4DIsGEWWrFss3JwMJ0LwD
- TLSH T1EAC2F7445065761248B3622DDF835304FB7E44B307A96311B89D8299BFB9462CAB8FFB
- MD5 SHA1 SHA512 SSDEEP TLSH
code/menu/features.h
- SHA256 3b13aaf4d6a5b334a28c3c8eb5df98fcf54b09c26c7c9c31ee5d48dc980391db
- MD5 5524280fa535fe9e91d7fff928924549
- SHA1 beb989553578f5cda7b7d0994bc2329cf9b5ac7f
- SHA512 2abddb9cbdef16c11a25df84b5123e938b27dacf59ec79435de7ca534d6be98ff69ff44036b888e1a0043345b8f8e21cd8269c4c7143e2fd1eca094a61c38835
- TLSH T1B94175442231E5684D83F14E0D1B3136F805E1D03A947C32A3CF971BDF2B92AA4562E7
- MD5 SHA1 SHA512 TLSH
code/menu/gui.cpp
- SHA256 d2469482ac93f26d62f579f5b2b9117c734e43ded5ecc984b2b5d88fdc586018
- MD5 c7ff5f77af56f9a854766b753c3036bc
- SHA1 d2479f8cb7731db5ef04132a376e712f00315128
- SHA512 ed53a092b2f0495077d0b67de323f9b7b50135c8cb5d4e7bcd7b0923de5f249d3b8563a572d04f7439e0f6b8b9007568c4d8b4c20c56c9c63de259ef7ebe6f3e
- SSDEEP 96:BgAGMLYPOan0tPZeJFihHrWbNTolASpFiPLhI:WsUHSaeabuFiPe
- TLSH T119C156B945A23C00F133D06C17C3A9119E3979BB3AA4E714B79DB0AC9FDC89514629F7
- MD5 SHA1 SHA512 SSDEEP TLSH
code/menu/gui.h
- SHA256 71e507e45997b6530bd625a04e1b7c74eb4d58ba7a8486bbe15bd7c9210a7eb9
- MD5 29ab284d09321adabef277fd33ab10b0
- SHA1 ba0ecc0619c9535e3eeef7f0a4c39a66396024c4
- SHA512 f2769457934b8387dd0f61ca9490355fd8ec55c9dbd2f4550ec976d5bfae3945ef98f638c13bc80c8c04b06b430b7b67ce90e5bf77c72c6994f34907dca28bab
- TLSH T1EFE0F88373073324201B0321A21B29A3E17E6AE89618DAF0B2F4022FE40C51220E3A32
- MD5 SHA1 SHA512 TLSH
code/res/kirkware.rc
- SHA256 0c8a18061d790131d3133915df9b727299f4d4976f0be129469687b9eb4ce2d4
- MD5 d375d9a0bd9e30e4b1183e441ca85d66
- SHA1 6adbdf3fb778e14931d7af8e65ba16bbd2d06b9e
- SHA512 1e06138573a36b2193d08ee82a4ddaaacb3e57285f9233c7353a90272f4d6b486594b9a32d4c8d0ac9cd7e02a079f7577c9575f396d80e1347c53ab3d7bfe2ac
- TLSH T16D316A61488342738B31B0F07C017A19D2296A6F9B925728B54DF9ED9BA3A5D038DC9E
- MD5 SHA1 SHA512 TLSH
code/res/resource.h
- SHA256 b532e8da61db5d4b1b8216d01c52189ab775b7831b65ade96f6963302795680e
- MD5 c107e2630ff9753a20ec6f8db6c7fce8
- SHA1 bb88871c0ed36920c4fea7f566d6633e87ee091e
- SHA512 70e961a65e8ca179847e4d17c334f91dbe6bb4534524caa13702191a9548472180f81ebcbc615889314f2d63387d32a190208c3f3175dcb0a7d565e084b15d1a
- TLSH T17CF02B394D98C02B5554F0C100061917495CFD9BA6590B7F32CCBCECEF368A903DE04E
- MD5 SHA1 SHA512 TLSH
kirkware.sln
- SHA256 f418ee25d2a3e93a5f8a4cd4ac2d44abeb8cd4a436b532316fe4f208db4c4e8e
- MD5 788c3da768b95a25c2d150d686e3d0be
- SHA1 54739282e1b7a93e1bfd46a5b92d313bf8b99095
- SHA512 b5872e81a76219a8e15d3354f840686b8f4ade972f020816e6f4aaf5ba2a7388584ccff7c1019dc9b488fd4383ae9230e2a42a0038b106cbbd781c8297590bef
- TLSH T19D1197AD746E64B1E54A269FD4850A06BD36029C53AF0F3E08CB90BC7633705460F8EB
- MD5 SHA1 SHA512 TLSH
kirkware.vcxproj
- SHA256 daaf0bac493720b4eedbc0e8c35314d1b976a0fa8775301b089207e36612bcae
- MD5 376bc4b34cb2b0dcec92cbc4d4a59544
- SHA1 864087e901e1fcceaec9b7c8016438b650192184
- SHA512 bb88929c8dd0e107c8c903562875476ba13242828963829640eaf4f0857cc5997092f5fd6360c18b89568ff7a084386066a85e57046ea3779cc6a5f152f727a5
- SSDEEP 192:Bm75TeWITpyCSPd/KPc1/KPcU/ZPcb8ZPcjF/Ldce:Bmv/iC/ir/tG8t+pce
- TLSH T17922FF65E1FC4E9AD1A2013B95C7E9014F70F3C31D9A485CF9AE9799AF9710C2213B72
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware.vcxproj.filters
- SHA256 c17a1851fe54b8dd363fd4691fd7ebf12921840b06dbda7d497dbb65e415726e
- MD5 de2f995d6045bd887946904a72bb4aaa
- SHA1 8126c9b024c65e2865fa993628e2091c0d48edde
- SHA512 64297ad42f9c031fdd16b39706e78409ad3a1641f648b84c73354ed210b2a1992ea8a12bb9f90b3963fcfe169a53b4a95ea83a64a184eb0ecda7fe07979252a2
- SSDEEP 48:3dKPRIpP0pPC8GfSXkYKmLZBpKqYZlPInrTOYuDTB0OP5:tqM8QSXkYRLZBpKqklPInnOYuDTB7R
- TLSH T161A12732D2FC1E8C51221957F798DD004F28B3E7A49A510D7EA9E68BFFD750AC11B268
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/gui.obj
- SHA256 901bc959dc1920be2501afee4b43e30e01c8d762736a555bdff53f26886b0d62
- MD5 4e5dc416a9d8a4c977a9e405fb8f5d3e
- SHA1 2ac00b7dc11bf383f5ba7c241b0c5b4df70f737a
- SHA512 a38f2067f6f4d037a6058a92192cebe80a1b80a1b24bf9bac5341ad2bb5289142da4f6ecdd37ef51b57707556271675a049f9d185763cd974cfb1b2c81a79425
- SSDEEP 768:vQl029UI6SQQ+oDpaRpphuOWuN1IV00JSOcqOZGWqD9wgHupI3r1az:vQlj2I6SlCVhuOWuN1IrgfZGWqxwgnIz
- TLSH T10D43E746C51D8A70F922C67662738A0F63E0BA2A7F371352438AA557FCC560537AF8F1
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/imgui.obj
- SHA256 76c903d6c9b17cc8225234b1d32e06d9d5c03a9d37e332f95f633fc21e9434e4
- MD5 f7e0e46b71ab435e877a11c8a2caf61a
- SHA1 b8f890ffdfbe7518671fbfc8cc65a6fe152730b9
- SHA512 abed3b4f2d3e894ed5e72da2f6520bab6d20ef067b6872f7d770894f4f346b534326eb87e0998922d5b8e385e5e9377ef1424ae615962cf8b3acd455923bca9e
- SSDEEP 24576:+HPDkl0aE6sWOqNNmy8oe6kvRUwoDirbf1YTK/D:uKDNN2ZZ
- TLSH T11A55E8977AD8CA15EE3D41B1E9DF0EAEB331F1E2099B4B072A5C605C7D533607A4B10A
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/imgui_draw.obj
- SHA256 57d7af1703fbfd03cb81e8f2f3998bad25f9eacf32a15e924b08a321954c167d
- MD5 034cdb57dc1dba82a601341ef68f0222
- SHA1 6d75ee78d7770e4ca18a3b4281332a4ae0cbd999
- SHA512 9bdf5e932ea490cc05e31516b7a8f17d81e47f9459c3069579d40971f664a04c2db9eed11eeea60de59f387547e5c2a1086c5565dce2b6fcaa98172e5e767030
- SSDEEP 6144:2wHdGJ/KziXpTxjOKyV/usM//GLXyhf44LbL2+dyCiRxvsZK6JT0MSznknuv/ep:2wHdEXB8KiBXmgD6WjzS
- TLSH T1DAD41856FADCDE41ED291335A5EB0F5EB332E89A065B47072B8C435CBE53384BD8A105
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/imgui_impl_dx9.obj
- SHA256 29f4e9fa070d2d3748ea372aed5f8221e94564da9fa2a17beea92b87e9e4bffa
- MD5 3daa47a911141195f683254da5a26e4c
- SHA1 6ac7d90ec3fea945fbb77f0c4064ae15cc45982a
- SHA512 f28a530022bba246b458f9c930c740406b86cb358fa589b9c2f6445852a8ef604860d8ba5f8f83dc90a3c4d8baf1f8dce8db7fb52cd84919046a73eb2b9ea132
- SSDEEP 1536:xVgjA4M6S+T9B6kXpNLLM6InRMA2RsRaSH7:xVgEX6S+99oWA2ADH7
- TLSH T1A553C842991D99B0FA21853A62228E4F53E0FA1B7F375382439EB757FCC51113B6E4B2
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/imgui_impl_win32.obj
- SHA256 57cfa9b6aeaa1108531998569ce9bfddad637120ab305609b147bad9011c131a
- MD5 a4da9e7d5a109526202cc7c6a970c339
- SHA1 07219cafe0f3a9ba226cddd5944e8b76aa1aa2ea
- SHA512 5fd68de22c5d7acf78b78cef579a354b1a42dfaf536d2102ec4f450922843b22d903a3930057b21094bd52fb5ceb20deb756dcb9456fca9b8a3e8fd5202f1376
- SSDEEP 768:7VrBgL4mWDme6Smgrc/DD0DMJhgljuOuomMU6P/q4vSls85s8ip6mG0uhzk:ZBzT6Si4DM7qzuomcPiipL/
- TLSH T17773D781D55CC56BEE3A8A7693B30F1EA7B0F9623B9743134248A26EFDD13003B1E556
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/imgui_tables.obj
- SHA256 8c9ce51601cb80f74e83a37c6632338a19cfd02a55473a5e897d9c77d7962e6e
- MD5 56fa51f5cc0c290b095decaa5426c2d5
- SHA1 1ae7c60bedaddfe9932e700318ce7c556532e496
- SHA512 d9868572a229495b02f55589fe1009da6fd237f31ecbf22fa72a46d2a48d73ac45b2192c84308a434824fba25bfecfcecfe68a94829b614c6402251391ff70b4
- SSDEEP 6144:e66I/KR6iTeAOzcbJMyv7llV0Xz+7b5LeRbqav:Fq6iyWuqlL5w
- TLSH T1EC54E6C6BBD8DA27DA3E8130F1DB0E5EB771E9A2074A8357274CA03D6D53301AD4A617
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/imgui_widgets.obj
- SHA256 93e23c97b0deb53f6381ee26179795b54ee436138849f51da6b8a8d792b00b94
- MD5 63f818d36f81dd5d08777fc7c848ebd8
- SHA1 13f2a1a462fd3551641658fa4aa9e407dfa56a8c
- SHA512 12cb606de4a820b1a7f8ab6bd791110749fe7a0744fbfc59da2f591a97dbd9475d32da24faceae0180cce228ca044143cd383a709c20429c9c53d86393e26a54
- SSDEEP 12288:icOVe27TZz2Sw8dJC2JbHS3Vu68LRE5fHD/s47cHYNs3vpN0Q:eVpjX70/Z7c4NUpNp
- TLSH T193151A897AC8CB15E9390171E5D70E6DB732E5A67A9B4743670CDAAC7D13300BA4B20F
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/kirkware.exe.recipe
- SHA256 8bd99520b427b888bc77fa92b9a4372a3389ec4a600d2145a1bafb87df056dcf
- MD5 7898fbe0a73d28af095d98dd3783ea39
- SHA1 9cda1ba528c63d7a5f42c624834a9776043f390f
- SHA512 fe29870279e3ee7d80364232308c5a70f572be850d2b20b13bcdd01b5d2a45f4e574a75fe90e46f3c907b82620c6cd4093ba9e51ad93b72701c40a71330b3719
- TLSH T142E08C6A59C0E142A7B10111923D4A6DEA9AB9C306350CA034A4CD6B0F5304804034A7
- MD5 SHA1 SHA512 TLSH
kirkware/x64/Release/kirkware.tlog/CL.command.1.tlog
- SHA256 0ebfe6ef7de4bbf44d9bd59e681367817ad1639fddfdd111f6e18694026a1cbe
- MD5 6151e393669673cf5c28a74914a90a5d
- SHA1 7bccb17befe2f79f64054d9dcc8fd32cc54a06bb
- SHA512 3facdcb790bcbe98b5897e829b9cd02582ffee848b2ed1de7cb6410ab764ae69a2a26ee364de3162599835174ab0667c31357af6a29dd799e7c105f5078bed82
- SSDEEP 96:jWGmOWGmjWGmtWGmYWGmTWGmI9WGmGfWMmM:jJcyPUP9Jfz
- TLSH T11DF1A27475FD554B93627ADE6FFEC0ABC9A4B7E9C8B3112B2570124707A0D04AE10B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/kirkware.tlog/CL.read.1.tlog
- SHA256 134822df94ef5c55de5c314f1f2b4e6317550e5d1935059bc46bb848c7adf709
- MD5 73d55d0bcf975bb8209bab6b738fb249
- SHA1 9a38f83e77a778ac18a4ca2c2b4a198dd1f8f024
- SHA512 966e0d60229ea5bab4c6278bbbd209e6cabc735ee878e943a5612b7ddd1a514dd22453fa0bcf57cb8304a18eceb55fb0fc899c25cf89c3e4306dfa1902148145
- SSDEEP 384:iDvrDRDgvCY2vrDRDgvRDvrDRDgvsJ37P34SrDRDgvf3TDvrDRDgvQjouCduPf:Guvsuv1uvjTvPuvQjouCi
- TLSH T1E3044C2C70EA22495316F2C29BCBA65BD327F2A8D63B536F61D453030390A135E95FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/kirkware.tlog/CL.write.1.tlog
- SHA256 9e9e5747b0c7d4bdfd81385288c18442886f21573041db8857cb601c35d927f2
- MD5 51c893ca09e7924bb83473e16ff5ba6b
- SHA1 5e2c10d2ec3c92e315508af15a33b58c07abad56
- SHA512 1430d862ab498546805a98193b51605e19c2c865efa9ddafa18696ddcdc56a2abe5404a9eeb09fae15a4f6e67a349ad25f6ba15d57a669c7fe266bbb91b01cdf
- SSDEEP 48:wPHux7/L4tv6lHWOGC4515CWocM4tWwLTlhPEv6V7v6n:wHQ
- TLSH T1D191933534E9A9CB83873AD35FFBD6A9C65177EAD983223F3984A34727C080542046B6
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/kirkware.tlog/Cl.items.tlog
- SHA256 6df08dcca36e799c4a8bcc0245fa17994d0c1b5c4b02463dc405e31d77f68025
- MD5 805ad074bf9489084eaa8d94cd00dabb
- SHA1 b2f7bb627f39d9a530f791d8a2ee76b753941824
- SHA512 aea1aa5f3ed63c9fd9500b7b941f108028ef0ac5d466b91169b3600cb09bc6ddc8579b042315d4aa10c1884542455da35b6d6e413feec350c6c32bd4c9fc8bc2
- TLSH T1081100FDA3B1C55B421775C7CFB513DC58E0A4C2097292FB8FF86923D915896448B2A3
- MD5 SHA1 SHA512 TLSH
kirkware/x64/Release/kirkware.tlog/kirkware.lastbuildstate
- SHA256 6f98da3c99bb75804b4ed994e1db82a4db1fe416f10519beb24208e960593743
- MD5 9f93a685a52df520c7be4f540a69eb29
- SHA1 441a1d432ed3636770a34a9a9f63f8e1f295156d
- SHA512 b86ddf7492c6416146a8f2d08fea6fedcf423523cc806c27d62b21a3958cab4d2b3c5397492c95dcd3326fa50d7732f1eb6e03c3e61a2c9187d23977c5d81e39
- TLSH T1AEC0C00C5350C6F37412A00500E000CD13F060511071700C4DA0271E5F470080003233
- MD5 SHA1 SHA512 TLSH
kirkware/x64/Release/kirkware.tlog/link.command.1.tlog
- SHA256 4735d3d59067562e197b9def546fc89b4ae8aeff1bf2e5c0ca5ad5f12afccfce
- MD5 ae2cc00203b6b43e3738ae256fb8bf94
- SHA1 1ced690f29639a19297d2f48cd01e8a12814a81a
- SHA512 336c7300437c87bda3db9ce4acdd7992d35a073e5ea8e0abec8a06aa0a18a2cdda260cac098e8d9fa8070ba4d4130716a40e81f6ef9bd68fd8c3719bd9d4f4ac
- TLSH T10C616F3934E8758F8342758B0FFAC2BAC7593B99E896533F3EE0974F4391906A501631
- MD5 SHA1 SHA512 TLSH
kirkware/x64/Release/kirkware.tlog/link.read.1.tlog
- SHA256 0145497cd5d5e0cf5185fc0c210ec8aa46a9be256ffbfc89fcbd7bbccc3fa98a
- MD5 3aecd0712082379ab9aa42ae3a0d8572
- SHA1 e14ab2e02169b240553edd65dbfe8cd2ce43dda7
- SHA512 74f9252953cfe593cfb1ae3279e82eccf686e119ba71ffccda22cc4af64bb0c2310e95bc9e7e4ef7423ebf062b1b0f3ae9266cd0e291a2c7ddb1fddc6b60e9ba
- SSDEEP 96:Wqb5VsSZGE8MwwtAZl9tY1dtPpz7RrZOwPx3Qrhvxv:Wqb5VsSdfB0v
- TLSH T183D1A93930E6268B4345B6C34FEBE26BD312B7A5DE6B137F79C0834713915079602A79
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/kirkware.tlog/link.secondary.1.tlog
- SHA256 aebed4e6e3526161e4badd311529684be586f51a36043a7b7393c31e9f1b9991
- MD5 4fca719f40799c4841cdcda52620ec59
- SHA1 51c00b075a1bd4a9a730af16eace82b82ba60bc4
- SHA512 ddb7fd1393693bb422288b6c99a4ccd1a64394b048a35ddf33276e8534dfabab8467965255cd2ba50b0ce0c75fd55de6b653e039cb22990f1d81f6fafe4071ed
- TLSH T1EBF0C74CCAF840AB49023E274351D4C9EAC0F16692A0192D0D78FE15ABCE3CFC60B282
- MD5 SHA1 SHA512 TLSH
kirkware/x64/Release/kirkware.tlog/link.write.1.tlog
- SHA256 ee3c37e388b8f0fc477d50189ab662ba71e54f0ad183dd679e4e31417153abcc
- MD5 c37e3507a308e54c69e5f63bb9060846
- SHA1 98837c3439cbf8176a7c21635aa4353b7a459fe8
- SHA512 daa9ca5a9729955fcd492105fe4474795e815820416a2326e8c2adb65684163dde79925138890dfa19dd71570fa2f306892b38cc2fe4f40c799df142cc367e85
- TLSH T1B821923930E9A9CB878639D35FFBD2A9C6953BEADC83123F3E80D74753409054604672
- MD5 SHA1 SHA512 TLSH
kirkware/x64/Release/main.obj
- SHA256 e14c201e8f59e18279b3fe5b4b1305234c288210d68a105d69db7cdff4f339ff
- MD5 25011c1e63db5659a2fd8653cfd3944f
- SHA1 86cdb5d116cb88f17e253121b78aa1d83d755b5d
- SHA512 d2ff391e2e07d1e9584396a616d76a045d091111b5a2457db9c801958c43dc5a501e7f0c40bdfc4c9d600f9bb11fd67cbe45a226261c1803418ff4078c80c18e
- SSDEEP 98304:l19Ek1IXpJr1y5yy4mVgbvaUERmmfIKpRBWcU:lEQecU
- TLSH T1A976825193994A53E86F33B5ECE3183A7275BC93BB55A7031097A0161FB334CBBA3990
- MD5 SHA1 SHA512 SSDEEP TLSH
kirkware/x64/Release/vc143.pdb
- SHA256 23e0a0b67a414d679b80fcb7b0cd3117f5cd06372ba7dc43ebf9c3f3eca3fbad
- MD5 287d974325ec2a8700722a2d5cdf3460
- SHA1 ab5197ae8606425db3848e226d230977e5b01009
- SHA512 0646e74078fec7314186098715cb565f5bb6cf4e4f6e8efdfa18389edd89823565a5c4556a2ebed015e11166507853e678d8a2856749ea85a56ec681634c5eb7
- SSDEEP 49152:by+Ka4lGS8Ek4N+x5mjHLHLgeEzM6HhHWHQHfHlHWDqIz7rUJL8Ga9CXHSJnoyhb:bNH
- TLSH T11FD5E8B1D1919D23E47F273A9492126033295E46E7CD7BCF008BA1295EEB348DF6F981
- MD5 SHA1 SHA512 SSDEEP TLSH
loader/kirkware_loader.exe
- IMPHASH 5c067986545399df168218f51ced0ce5
- SHA256 793eae8e87722db796d53180f561cf875e462f87b8c5a016a99dcad570baa1f3
- MD5 6c2adcb7bfc7685dfb288cd959835472
- SHA1 5926873043c73fe2c35d0b8e2175fff03724f10d
- SHA512 4e50728117eb57b9f6bc2a320b308c51db2a1e611f31885e1318f11aead0684b1addfe713108bfba63f491a8edc4680e8943258acfc35f4ac6d63ae579667519
- SSDEEP 24576:KFa1GL/EjaRWaAA5vnAqLnr0ZAW8m9VVAPZf4OZ20B/nk:u0K05WnHr019VWPN4OZjB/
- TLSH T1F8459E4BE6A610F9D1BAD038C556651BFEB13895073097CB67D00A662FB37F0AA7E301
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15644
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
ord680
ShellExecuteW
user32
GetAsyncKeyState
kernel32
TlsAlloc
WriteConsoleW
ReadConsoleW
HeapReAlloc
HeapSize
GetStdHandle
CreateDirectoryW
CreateFileW
ReadFile
WriteFile
GetTempPathW
CloseHandle
SetHandleInformation
CreatePipe
WaitForSingleObject
Sleep
CreateProcessW
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleTitleW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
SetFilePointerEx
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
Name
.text
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1018KB
Virtual Size
1018KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=146, id=261, version=33145,
count=13, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=7, id=257, version=33145,
count=111, id=1, productName=Unmarked objects,
count=45, id=261, version=35207,
count=1, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
loader/loader.cpp
- SHA256 2b092b6112c657206cbb54926ae433a99d9f6f0bc8687d0a45cbfbcbb4a54704
- MD5 b05c13c71b8add087e3074a931c7f3b9
- SHA1 4bf4311bdc60d62cd1594a4b54e4fce7c1c5c65b
- SHA512 275782aa12dd448629e424a65e7edcf2510692ef7e18b389ca1ed5875e59505a39c99b2dd41dab0711c5509554ab28acf905b6ca9c053313247959aea9a2370a
- SSDEEP 192:MOUiQSzwmIlYrfg4oWdPc+u4H8cQXuLTPuZBeE9B1fOzRZgusBcEI06gumqM/sDp:HvQu/Pc2dkBrGZgVD3/sd
- TLSH T14302437155F7A5683573D02EAB4B6402B624F4173329C929FD6DB1045FEC33862B0AF6
- MD5 SHA1 SHA512 SSDEEP TLSH
loader/loader.rc
- SHA256 95f555ee3306e988912488e4874d8de966e987cf334864b780beacb51da73ba5
- MD5 77f8bfa18d97e0194ab4ac08ceaaf9ee
- SHA1 82a7ba53efd4aa944b46a00ae42252e54be3fa6f
- SHA512 6640f68032eed2cb343e0e6658fbc8967fa8a5e6828b06bb7b5dcf845b51dbedf5ab3084db8e623065dc9a6d8509eedc7cadbcddafa8ea9ae36bf89f2654cdc6
- TLSH T1DAE02B21F2F9DB33A921450D00CA9DD794AE99D7437D712A2AC0211C90550ED02AD4C3
- MD5 SHA1 SHA512 TLSH
loader/loader.res
- SHA256 d383a655c200ba3fbd55b020f4c1297f4b280a78715c4e05eac5f055b2091f26
- MD5 ee12aabe3bdb8981782a93f00e8a7204
- SHA1 1207d0f5e33d4fb338e5f2359d3539ce0130815c
- SHA512 aacc6c41996b802ea5460bfcbb800403fb40dd70dd19b6b498c77929d4b50a3411276a556a75e19a116c8785446e6fba08e874d8f8b8325786d4479280618e79
- SSDEEP 24576:aa1GL/EjaRWaAA5vnAqLnr0ZAW8m9VVAPZf4OZh0B/nk:a0K05WnHr019VWPN4OZ+B/
- TLSH T124259E4BE6A210F5D1BAD038C596712BFDB13895073497CB67D04A563BB2BF0AA7E340
- MD5 SHA1 SHA512 SSDEEP TLSH
tools/BeDaisy.sys
- IMPHASH 3803ac984b44d93e5b67a787365cd79f
- SHA256 35b0d79631b6c0e13569b35fea3371e540e1e24a1ad240aa4095bc003312463b
- MD5 4c0c465499d6ee54352570d2807d12d8
- SHA1 332a6b3bf722e97780d09328d420fc8815f8e514
- SHA512 53124eadac016c0ad5c2937d09a8a37a4fabda32b56bb3fb90defdab9fa2ba149841056f992e0fb7154308aa71b4f5352a5dcbb5d7ddecf0b5aa036f1899c5ce
- SSDEEP 384:e2regI48Iq1qhvYoP6MUMv5g5M/b0475a:eaUi/UMvTJa
- TLSH T15C822CC3A39C58E5E31DC1BB46661A27D1B2BC25272377DF0251C13A2757AE8753AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\User\Desktop\driver and inj\bin\Release\KernelDriver.pdb
ntoskrnl.exe
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
MmIsAddressValid
KeGetCurrentIrql
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
RtlEqualUnicodeString
ExFreePoolWithTag
ProbeForRead
ProbeForWrite
MmMapIoSpace
MmUnmapIoSpace
IoGetCurrentProcess
ObfDereferenceObject
ZwClose
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
PsGetProcessPeb
PsGetProcessWow64Process
ZwProtectVirtualMemory
__C_specific_handler
PsProcessType
MmBuildMdlForNonPagedPool
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
IoAllocateMdl
IoDeleteSymbolicLink
IoFreeMdl
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
MmProbeAndLockPages
MmUnlockPages
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
PsGetThreadId
PsGetThreadProcessId
PsIsThreadTerminating
PsLookupThreadByThreadId
PsGetContextThread
PsSetContextThread
PsThreadType
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=33145,
count=1, id=260, version=33145,
count=3, id=257, version=33145,
count=51, id=1, productName=Unmarked objects,
count=6, id=260, version=34810,
count=1, id=258, version=34810,
tools/WdmDiagSvc.sys
- IMPHASH 22f65252df23d629dfa859ab7effefd8
- SHA256 48e670cf6ee75e7d139e74aaa3c5531f42dede80c03218dd5773988f35fff957
- MD5 ce95344e1d78eec761fd3e5363c3b097
- SHA1 df4a40f8c06edde365f36f37bdc49fb1b0717328
- SHA512 8ea6f7965d8ccc4fc7cb62245490e1dfa26ff18784339919676003a6756e7091dd4b27262f0c0be5232bc7b5377a2a8518e9480e692af447c6a7b7e591422b99
- SSDEEP 192:uh009g77XA1uvF0o52OS4+KEQRg+R7P/Xr6G61VqG/XddwvKklHVdvG5Sg:Eg77JF92OS1K95XgkG/PwvS
- TLSH T1E69283D7E2F651E8D4F6D93581467A2ABD72B42587208BCF1950890B1FB2FE0B93C784
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
10
Major OS version
1
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntoskrnl.exe
__C_specific_handler
_wcsicmp
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
114B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=35222,
count=5, id=260, version=35222,
count=3, id=257, version=35222,
count=2, id=1, productName=Unmarked objects,
count=1, id=260, version=36418,
count=1, id=258, version=36418,
tools/kdmapper.exe
- IMPHASH fe1529edef766e6c0d25b8ae1722ece5
- SHA256 3d0326be77fd736ee57d9ec3722c1e7be2d7ecfb1b3e56adcc4f055198263d84
- MD5 103349d9ab1968719b2f6f7e8e57b1bf
- SHA1 ec2b4dcc62038becd7dd7458c704ab8df4cd638b
- SHA512 b2315dc066803a7b4c86c05a7d0b71f8d36682da7728c7aef6783895094343b826cea7b88ef6427efff29d81218e2e4e2957cedb18ad1c9e029da2d1f0db6f0f
- SSDEEP 3072:eEQeuLZ8OB7/Uc7sMDcFS0Dzri2kwBmJTQSaMm5/6YjCNHwU3:lgNpBDUc7ncFSQniXJWljuQU
- TLSH T15CE32A5787A9106DF1B7D6B9CAB24911EB717C950B74D2CF135048BA0F227D0BA3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
64908
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Downloads\kirkware util base\kirkware_mgr(jsboxes)\newkirkware_mgr\kdmapper-master\x64\Release\kdmapper_Release.pdb
kernel32
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetModuleHandleA
GetTempPathW
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
CreateFileW
VirtualAlloc
DeviceIoControl
SetUnhandledExceptionFilter
VirtualFree
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
user32
GetShellWindow
GetWindowThreadProcessId
advapi32
RegCloseKey
RegDeleteTreeW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
ntdll
NtLoadDriver
NtUnloadDriver
NtQuerySystemInformation
RtlAdjustPrivilege
RtlInitUnicodeString
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
_CxxThrowException
__std_terminate
wcsstr
__std_exception_copy
__std_exception_destroy
memset
__current_exception_context
__current_exception
__C_specific_handler
memmove
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fread
fsetpos
ungetc
_get_stream_buffer_pointers
fputc
setvbuf
fgetpos
fwrite
_set_fmode
__p__commode
fgetc
fflush
fclose
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
_invoke_watson
__p___wargv
_get_initial_wide_environment
_initterm
_configure_wide_argv
terminate
_c_exit
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
__p___argc
abort
_register_thread_local_exe_atexit_callback
_initterm_e
_exit
exit
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_wremove
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsicmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=35222,
count=235, id=1, productName=Unmarked objects,
count=7, id=265, version=35229,
count=1, id=255, version=35229,
count=1, id=258, version=35229,
tools/offsets.h
- SHA256 a5cedb63db98a2b72736da5e5272e5cb1b6be07c16338daaaf0e2e4b1786182d
- MD5 175e11ff5e59fab4fafd189ecb7a3dba
- SHA1 ae7fc01169f3de75d9e3f287a896bb372ef06ca2
- SHA512 2db23be6bb893f314f6755866e4669577cad06987bb6a77b9a2803bf18c73793b8460920b8852b17e34e78276994b0b19d425de07d509e9639d27f047504cb0a
- TLSH T12651678405660817D48A91B85BCBB030D4DE3063B9C1D4EAF9EFE3D49F8593686939EF
- MD5 SHA1 SHA512 TLSH
tools/sig_scan.py
- SHA256 9bf75511e252c2e9c17993169cf60ed2618a5da0d47414aa48124b18dfc3da6b
- MD5 74b8cac1999fab71da07e00eb5d1b99c
- SHA1 81526998e1d8f21840977d2bbd2a45bf9447c822
- SHA512 df7b63b4773b53003461dc853d2ac9e1dac13b0c1db27dba39c607ff324480a48a8d21c4886b65267b86f1fd018a398f8aca1a43b5b4896d8716d4a09abe356a
- SSDEEP 96:xI+UVlObmSbn62WwZFMiPPMZxEBBmY2sg7O+hZXh:xI+oAbd+wZeiKabmY2sOOUj
- TLSH T1ABB1238AD4B42CDD92069D5B2F5E9806B61DA90719456E3CB86F517C1F0E93C83B08FD
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imconfig.h
- SHA256 a768dd48f4b2ee7ccbb6684de45c3dcf94d46a9eca6b833a47e0bd3cc5ebfba0
- MD5 f571d206cc541c6624af560251d69984
- SHA1 0aca8bf97aedae58312d91e38214c26e280ac736
- SHA512 1fbbae4fb45d784b7da2701369276ed35214cb58e536671d9d2496dfdf3c5165d40108f50d7de6304b48db97713b70d74eb48d60d69afef9df13ecc20b7636c1
- SSDEEP 192:cfgoLRD2IuDKRvx4JzdCcQqCbqwG4lH12BwcD0aUjn5XV+TmYU+xhQft+6HM/:cflDc6AdCcQq0/HlH12BwcD0aCn5lOVz
- TLSH T18032D60B3C5622500971E570B75E9175CB19CE7B7340F0D8717EA65C272882A12FEBF9
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imgui.cpp
- SHA256 b8bc1b553f08520415cec9a89088e101b1f74d4cae758d9c7c393d8946057ef6
- MD5 ce45fed0078341ecaeb121ef1670b053
- SHA1 89fa8d1270053da8b438dcb995b88e7722cf3102
- SHA512 ae88d0a85c1bc84a83c0c3df3e5d87fa8acd7676dd72ceb187003a82c5f404c452b5227a05c7241dcc4021fc9273f40285889960560baafff8a1de4f59ab70a6
- SSDEEP 12288:a3HCfV/16XDttisildx/vi2eqqkixVCLzo3fbRMCQMzqeEEQ1eLUoQmCn7OP:GHWCQMDTb
- TLSH T17D05E7A61C6335169932E5395BC7A346E73A493367D4C5107A4D238CBF8403386BEBEB
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imgui.h
- SHA256 c58550e250f134e215bda1861d779f32a1b67ceb7fe232e4fda8fab0c672089d
- MD5 e9278e6486b638be0741e6214c5a957b
- SHA1 8a07b1913ad25b5708e8e7621b733372f84b7a1a
- SHA512 a2c8095419ab091bce391aa3febd130ca345d8ef957c380221124c448254dcb195fc5360ef0fde3f524150693566cb0aa4f94d5a5dfafa14fd673e0033036730
- SSDEEP 6144:sSaY1sYwHb81AKF0XvyERrTLAdGDvE2x/prVhnvGfkgMsHwKfLu:YYw78UXvXRrTLAgDvBTIsgMwu
- TLSH T1668409472E013221CD32D2916BD6E552DB384436BBF0D6A0764F639C6F4642A427EFEB
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imgui_draw.cpp
- SHA256 a8c94a8012eb3ad9dfbf5a985d10d01cdce6e97bf09c0e64cff6e97cf6fee874
- MD5 4feac9dddf3dd680c08e0763e7ee2b6d
- SHA1 c8232980fa73b4b0c1f471c48f92beb4496cff12
- SHA512 7e09c4d5d031f1206ec25a0a5fe18dfc2dc8116eaf5b8ea8b89dae2ed12a3419999a4977b652de22f16047eebe77337dc3331e8478c519dc687da2625b6f8214
- SSDEEP 3072:AL7s8XV0HzJCMTWZSzpew1v1KrBvx6fVs4e1kPg80HwCmI2b:AL7sNJCMTsSzZOvxyxexHe
- TLSH T119541A490D5312531E63D47C2B97918DE74EC8A3AAD8DA04BD4E538C6F81428CFBDB9E
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imgui_impl_dx9.cpp
- SHA256 c5d2b39270ad53ecd63727a3af42f0e724ce0562e276058074f1bedd23014b8a
- MD5 4ce7e7daa1b0268f61ea7aebc1be0429
- SHA1 39d12b264be09525594633efbb06ac9f6aa37f05
- SHA512 becf47d4661ef4867fa57078d4651f80c28581a9e00e05e3fefe934a6cd2823421f408d0798614dc45417f956655bd04a2886ea0ac9c0a50e4136fe1104f459e
- SSDEEP 384:bm8StKKckiigx7UaRlLyKgJag0hxYsiGFnRFneKf4OpMqOzHOAhgkjO2jvkBArM:Ly0x7U4LymbeNHfhgkjXvk+rM
- TLSH T12D9287C974633D429D7360254FCA9A4A970878AB27BCE6C8B94C12452FC41B0D97EB9F
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imgui_impl_dx9.h
- SHA256 b494bd91c3aec6d7972f29c16abe992c2008e15c168b48cba0bcbced882c7260
- MD5 89fad0e65d1214e68d78a8323c5ac6c5
- SHA1 d8f71174d49c5b0ed3dcad04911d0bf62d3d426a
- SHA512 a1e7c832ac17651df2df3a6bd2959f17a76715217a044f34f5e117ecbe94b860da137ed114a1f99152a39b9e5844f73b84d99e86b987578748c4c4ff3b1bcfc6
- TLSH T13B311286127175D04BB209809980DB87F30A6ED8ABDCF3FDF66EE14827944362066D73
- MD5 SHA1 SHA512 TLSH
vendor/Imgui/imgui_impl_win32.cpp
- SHA256 3ecbcf5821d585a868124fecdb370595eaf94539fa6a1883d861697142902c62
- MD5 02db4d55dd7e8f0d77e2243d863b6120
- SHA1 ac1aad9db2bba54bf591412957148b55ab235fb0
- SHA512 a828833725682af19dfd4eb3742a678db53d6fe38993f4e3a5837737451434c73f10d15744628f75a89d51c86418227c0b85d1dbe781c17edf7c494a83be066f
- SSDEEP 768:zO6HufrBQiy2y7/saxQ3RKNIDvRhh/tZWqNcN/NWJ6mjncH++/ZHcfnl67JhM:ONWbGUQAtNWGtcsq
- TLSH T15823A6C15D5770520A32C2946BE76542FA388C7766D5DA68FA4CE04CAF58132832EBFF
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imgui_impl_win32.h
- SHA256 02e1762148172d480cfdef1dab08ee7255ffade2a445379fdd005a301bf28214
- MD5 3619974b627fc510db22f8ad73dc0009
- SHA1 af59f3aebe232aeacc1221e7a45e81cfb80001ac
- SHA512 df41218b1445466e5d245a7a1db140f42fc15fae7e5ed94889d6ac601c3afd2c8a5518ca2fa825e3afb560a19a0fa5b4fb4cbeedda0d57ec1eac53b9609e24cc
- TLSH T17C61C907031470D086315644DBECDA97762EBAB8ABD6CFECB42DE14C07650675127EB7
- MD5 SHA1 SHA512 TLSH
vendor/Imgui/imgui_internal.h
- SHA256 c8ee6d9f388f0dbfed33072ca6e92bc300e6baea3c48f77e85e1768612b6e392
- MD5 596737fb7eabde82f61b864ea685e789
- SHA1 1ef513a11188f9cee65b9e86058f18b39c839919
- SHA512 496b620e1bf7eabf1c2a33f08f9294405075165551caa5b1b856d7a1a00098a659435068ac2ec91576c42d6fdf07a43e5cf4df0d58929232d0d2e6ebe0830329
- SSDEEP 3072:yyLS21PdC9yiYqhTW1A1gviRtMdRZT1q3AMJsHoUE7:yyL9uYqhTW1+jtMDXqJaa
- TLSH T1334496932E027621CD32D16167D2E541DB395873AFE0D260378E739CAF4641A827EBE7
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imgui_tables.cpp
- SHA256 8d8f1062c39d60f1c8658a3552d2459d290d7dbfdc2b49adbbdfbee9989ddfe3
- MD5 f2c2fa3755af6cb375b2aeeea72fa8ec
- SHA1 7e092ec0fef3c14ec8c5b35854083280bb0bf69d
- SHA512 5ffd8d20dceb1a77f6ffd51e57d4fb79cea24a77b87dc5c629f472f50ccdad04ddc95d2181fb2ac9657d8f26de5e4eb6e5646a956de9e33f8c2a21948c7761cb
- SSDEEP 6144:tGdMdGbp5SjTDYkrQivPyLo5GQav5Uhx43wRluTpN7AZfVf:tGdAGbr2YkrR6JQc5Uhx43wRluTpN7A/
- TLSH T1303473976F2232158923E02563CE566FDF2614235B44A1F03D5DD24D2F828A38FBDEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imgui_widgets.cpp
- SHA256 8496cbb911218dbca748504972bd06ecd7da0df41e08a884155e7e7a28a15ce6
- MD5 9771bd60db7639969a61385ab60bf648
- SHA1 d5d586818befdd4e4d9f375de43dbb804942ab0f
- SHA512 35bb10c9a952682677f5dfc65c7aeec44049de7c7a44333c52ad7790a047bf226a23d4682baa7d0fea0d3c9a11b47e1b087d0d044c30c4b9de2b3c35ecf3081b
- SSDEEP 12288:WZdEx+3nN9tuzjTYMN2Ms3pPsclSISfg9eBFtMugW:e3fIGE/tMy
- TLSH T10EB4C5851C2232268933E0395FC7A255EB39597B3BD4C9507A1D635C7F8403682BEBEB
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imstb_rectpack.h
- SHA256 2efa3d5f7d003c19743b15155dad9f46d9f9fc783a18893d703b431d3c990972
- MD5 b1de604efbfb907f986a2751375a400b
- SHA1 25bb050e65a76af30b529aff6f394a024de67033
- SHA512 35d7b7c0d28fb982d9ee7aec6d75487b4a34b4a4f27534146953750cf9066d968622dacf00c2d08ab63150c896fee38d97aa064be60726a1a7c100c0afbbaf6d
- SSDEEP 384:VEko6kzUPyJm8Ss6RaQ6wNOHxR4ZGHFre1Frebs06Y4LG:VNwzUPyc8Ss6RaQ0xRVFre1FrebWYgG
- TLSH T1E292C62B2CB216256B41D171874F7099E326D467D33AD620BE8E73642FC046653FEBE2
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imstb_textedit.h
- SHA256 77010e494caf72c178b573569612aec409d24380409676325a31d02de0ec64b7
- MD5 8865566443d99bbe68c053a0b765b1d5
- SHA1 f8ddaeccb5068df9c94249439b2e4c3b3e9e15d0
- SHA512 3393c240f6f13716d22238ac778135a663f35d405ba7bd4f263a01fd24a9268374eb53575f56e2b875b525bdc619c3f3ddb5d7b267ecdd4aef09bba56bb162ad
- SSDEEP 768:7B3u9VwGsII3Dd6oWeqji13EUBX6s44Yc7dU4l8cB8OsqLn5IMNMSpeYgG:FKPFbW1peYgG
- TLSH T11D4314037553073A0CAEA177B6CE21B6BB26483FB259DB61B48E71181F510FA01BD9F9
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/Imgui/imstb_truetype.h
- SHA256 87f08919ae8e7223451d0e9d06b62829075d3e920c9e6ad436db9d7e7427ffce
- MD5 ebf7f4835b0ed8fdd1dbd94b0d9ba130
- SHA1 f136f8c039b42e11ce16ee9af65138768ec85520
- SHA512 1e656c9f120bada07a5f53ec03b99bd2f7cd64dfaed9c6ef7d8998da07afa14a639a00c22c1e7c0bc1c9edcbcf05cf6e039b81ec1ab0c2f8fc69fefcc44edc2c
- SSDEEP 1536:vBtAza9vAMuerPM1QyAmzxtm7i37qMag+8vo7gZDaXT82ANopyjBGzAN0YgG:vBUa9vAMxrPM1HzxI7gvow2ANopU
- TLSH T12914F90419D314231913A5A9DB8F54E8B32ED4EBA2A9EC51B84D761C2F60439D3F6FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/color.hpp
- SHA256 2da77376a45fd29d170ff250c8dc522310620fe598db1c6b5269818f100537a0
- MD5 71db66685b236a4e62e25f74dd9044cf
- SHA1 0be32c8d306a513c1bf6ebf7fa2fcc6c12a5677b
- SHA512 31d2070efd554e6311cdfebeef2fc2d83f3e6f6a4baf990ce23247bf9e7051a1b7f1e1a5b42554c192db6cced1cee6f98f58a6cd1f9d60c0e90779a3bf39bbc6
- SSDEEP 192:ofc9pzoaY1UjOXV0blA+OcwbvdJIfjO5/uVY3eHvQVglw6alkusapD9u8SU3pWgK:ofc9pzoHDPbb3LzWb
- TLSH T195A2DF243D3602B1466B91AD8243924230D0F8B75B669A31BF1DDDDCAF8951CE6FCF1A
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/d3d9_x.h
- SHA256 ccf6fbd968cf31d23b95b2cfc1e88719f19f33b0ee9bc428ffb9b6bcd049213c
- MD5 3e52d8c7a93c285564eb857c22d3fef6
- SHA1 ec33d93308897ec6c12ca577b33bb4401a5b5900
- SHA512 932bf78519a5935cadfa91b2d4634803a5702071ed32ebc4188c3f10fd0414c08e3f9a61969ab3c3be8cbdf1b1e56e7d9208cf9fd017b36877889b96a7f57ed0
- TLSH T163516F847A79A5FABE73B18F9C301294205FA9153E067D0DA6A405B4009F0DC2DF3F9B
- MD5 SHA1 SHA512 TLSH
vendor/directx9/d3dx9.h
- SHA256 557b2de6238d7bda21f1f43fd2780ff86a8d3b9418b84c8aad49c6505aa7e66b
- MD5 d6dff47c3bbe230d2907a9fb75865da9
- SHA1 5949a80d589a872a3d2b90960fbef7bd5f65dc28
- SHA512 c490935e0c0532d51fd461243620170864be1d0b446ae774ec5aca33e70cd0bc74cca5ae8a94fb09b883adc66451e305b1484933a90a5e564149c5ed7895a98b
- TLSH T15441C019A97F382F5362ECB154779900400EB613D36B326834AC3AEC3B9648561EBF7C
- MD5 SHA1 SHA512 TLSH
vendor/directx9/d3dx9.lib
- SHA256 a22ca24c92fd61912f7601f00a049f98a439763370726c724ce617020fa6526d
- MD5 f1b0e8c4bd25ab527083877a5074b6a1
- SHA1 b998f15b563a95b344199fe0d311d06405c65284
- SHA512 9461f274b257b616e28bc5a58b4990c8f5908f96f8fb1c9b8c777eda259fc41878a706a947ac40a440c4627fa0930e25a94f83116a586300d0f02a07723badfa
- SSDEEP 49152:wv97FZHAP6XBJcSKxp+4B/c4dgamC7HDr9xcmoYBWVkhSnRf3oKoz:KK7+GxdgamC7HDr9xcmoY6khI3poz
- TLSH T18D163B62FB6A6802DB9BC3348D5A07316334C37267A2A383736954261BF3355EF56E07
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9anim.h
- SHA256 9068c5a415961912e0ab695b2ec524c9f49b634ce435f1389c4b95bb1236ad2a
- MD5 96297ea1bcda81f507a54f509b9484b1
- SHA1 80166bdbb4346479ae69f00ee78505a469b1b95c
- SHA512 a9c2d3654249ac9087737d8f36bd0bb5dffe05bf943e87f55bb202d6648880d934cd2a50a416cfbbc223c58cbd9da90ddac0fba29e90301f1f655d87621c25a9
- SSDEEP 768:+sJmIFUAVZLbDprpKlDrAtCkQa99nZLKkn9auH1vXI3o9/EEHeIgl2gP3L:+sJmIFUAVZLbDprpKZrAtCkQa99nZLKD
- TLSH T1441396A2AC42B53757F3C225175CA712E6ED419776223F19302EE6142F6188813EFF9B
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9core.h
- SHA256 8c3ba8294bd7d2682e4ab66f837778cff544598308389bd6c0f517cbfe3d832b
- MD5 4e48b3d30549ecb5966b0c16784662a1
- SHA1 bc9698b78c25067308007f3db49cea5caaac5067
- SHA512 0df1b43da352f7c247cd9da4c39f271d773ed9becc3e23bc256b9aae35709bce098851a064c29c1cdedaa4b7959714b3ddca25565de9b48431abcb8260752524
- SSDEEP 192:aGyGOnun2yBbhnYxPu1iPMkNcf6TRjsLea61OuRfjyhsormgL9JjzOsYe2flmixg:HyG2yBtYZnEtLjz0e29miH5kGZL4b
- TLSH T119B2B725B486F877B7339001799C5B12E6CE82E7C72A3829349DF5513FB984025E9E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9effect.h
- SHA256 a63de554ab5bae13b0c8637929b7a5051e62acdf149a8f0f0ae5fc0e0f35f1c1
- MD5 a7a50919d39bdf6d394cfc914cba54e8
- SHA1 9e8cd9026504af11da7802e06893af9148a13d0b
- SHA512 1e33568ebcb6dc3f751a7b59df4bf0e0e778c47e4cb0c8f5af7f2e71547b913621c88f8c1c2c92ce17a5097b86ca71dde99dfeef48a34ada748fc9a08a378f1c
- SSDEEP 384:cQIePZOkFi1ByE5YqKZOkFi1B1xloYisRZOkFi1B11p+3M5rJAA:nIWZfFi2AKZfFiRIwZfFiR1IZA
- TLSH T1AD13BE05EE84BC29F3F6C10026595F63E5AA82E37517794530ACF9221FF9C11A8DFE86
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9math.h
- SHA256 9cdc084055cfc83080d29cd49aa929501a1e57a004bdb3cce34ef02134ea6157
- MD5 48b403d8154072cda54d23a69a3fb109
- SHA1 e764653f4a1ae8ca7fa26d1d9a895fd071f1ca3d
- SHA512 d7ddd6dca996dfb0dd88d0282b4c643d9fcb37eb52308b8dccdbf96aa697e41d92c50453beee67ab0046d3f5bc021f83875d11aba89539730c4a7212599ce03e
- SSDEEP 768:XRNMVrMK0ok8Jrqu+DdqZZ0/Iz6sS6I+d+PQgp:XRNMVrMKxTJrqu+DdqZJS6I+d+PDp
- TLSH T18B432EC13DA1B87A9B32C3D0522529A4D22D6457E76B3E01365D94916F3238C42BEFBF
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9math.inl
- SHA256 f7f42842b8954ae3831d757d02f4597d7c352488cf19d73f4b1b06380b263a72
- MD5 04eb36b4a8b6f5a175fa645feaec82af
- SHA1 2b3653d3ee3d87cee2f669bc5f0ec863c3636b06
- SHA512 a7438d5f2013f641fbbce663e726bca5773c78d1d73e0d14b4c99fae6703e7a8ca07fefc776ddd13f00702ece3b1c4e0711bfc57de5ecfa506177a89838aab0e
- SSDEEP 384:RX5+TGt6eh7rjZacKswv7ckyN+p+TSlYMZsx8pgr8mXos30r25a13qgqakUYeA1x:TGprpKY6gNbkUYeKv
- TLSH T1C913DC983CBBB478DB32CBA44B215055E51D7847EBB73806344C15A4EF3269981BEFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9mesh.h
- SHA256 64b254a87d1a1ae3669bed1b29c7bccfa69014df2ca7771bd8a89e29716e21fb
- MD5 44f159aa23b5e88fd27f8846fdbabfc9
- SHA1 cbfa9145dd58176b3168add330d24bed508e3171
- SHA512 75b8163ff8b57d8ecd09f53621e8511656e606875283299b406a29206b22d86a72a6173054d170dee5d056b3f01460ca897605b0052066bc148ad3c940c4c8da
- SSDEEP 1536:gTkpStY5YwYB7ClbLNn8s2O2z3COKn56csd0HGieiYOEL6rPFnVoet4UUUnXO:nStY5YwYB7oXNraGu
- TLSH T1CBA3E975A642AD3ADF730151674C7E53E29282978623BB0230ADE7013F7B78811B5ED7
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9shader.h
- SHA256 1e2fb328e1fcf89ff3854760c9fac33d21e60476a4ccad347b80a542f824da0c
- MD5 2b4e1222c8acce09ac622b3824776d40
- SHA1 23118d71f42b9af2ed4022a0e49276710a9fc844
- SHA512 1cd56b1f8383e38c9b13b64e044deac26098a2b9189b7608d0e49d06d8dd0bf89e75cca7322ad44275f9ea1c550ef6bd1a84e1ae5fb8e1261d2187b3ca49b24b
- SSDEEP 384:uh0MhqHXGkug2da6IqiDKkv5hivCWAHfWnrRodXvW5ie/ao32I98:uu3K9Iqy/WnrRodXvwySb98
- TLSH T16C038406BE89B0775337C100660D1E53E29AE2A3A717B608307CF6941FF9859C5AFD9B
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9shape.h
- SHA256 84372dd72dd0284519cab0c29283c526bd793389ee755314290f0a82f7b10810
- MD5 9335ae4b00fffc548b5fa82beea08bf4
- SHA1 1b5069a334733aa9c88dcac1a7d35592251f67c5
- SHA512 e1f37ad518f8bb9acc13820c369b0a92cfcff009adee2d617686fc8df5144f9dcb2233a43b03ed84da95b63196516df31d3409b0bbd7dc0b849f27b113a329eb
- SSDEEP 192:mVX+onXxBRaj7iKzjJUsDF/6bsDyHk+osgEyG1gzXz2:m9+oXxSPT+sDIsDqk+osqGB
- TLSH T103F188056C05A43B8633C0547B0AABD2E2C98463DB72A51B74BCF4D40F67CA585BEDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9tex.h
- SHA256 014074e998667383295c11109cc0ba7089560e9c4aef9c8a268e757490a16232
- MD5 af618f21f664f7ead5a8ce76587d0a84
- SHA1 274c2971d02f7488d9b4f878562aeb37da1ad751
- SHA512 666b24b5cf7b935aab8646602caab890d0300f110eba397ceb5020c273f774ff7f06f79026bc9fd0ad2e8dccc6e244d32e0d07c1eda4ddb7513f2dbac23ebd8b
- SSDEEP 1536:+2psnFSNnvFgpUz6XOsp6sURzDi1mpAq6HrRr4ApvJ6XthlQlq3yehmvmTvr+8fv:B6n4zgKz6XOxsURzDM4cp0UA
- TLSH T13B5301163D42E1330A7BC2012A4C6693E2959397CB26EA4A34BCF1900FB9C9595ADD7F
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/directx9/d3dx9xof.h
- SHA256 7a61c13d1149d6d4d1904298c359b975ad85998910705502eb1b0be907512ffc
- MD5 ca57d88a76923adeb045687542272c28
- SHA1 fa7d743a7f62790137254f5007516b127e2f645c
- SHA512 162a5ae419ccd180c9c13450a9c7efee90225845e3f90a9e87b80df3a51e25d98c3c0c55931573be8f2c049d0bc4072c6fd5492e2822840b36dc828187bc1228
- SSDEEP 192:r3SxxELQbGZApf+yrsZ1+lEfRakFmpckGqo8aZwudaH1GmimomudW7dAudH4cusI:r3SxxEVrBzBqMZKVsEu/1OjCJun76WdY
- TLSH T158420F2F9E87F815E3B1D110AADD8A11C1C0816B8673781A307CB9A56B7A14161DFFCF
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/json.hpp
- SHA256 cdfb0c90d8eb1b9a39878580b016e4f95c556c68b6d8dff52619e640c827c6a6
- MD5 975090b5bb930108d5e462e573ce4dfe
- SHA1 94a97ace10a7588e3382dbff3b6415ffdb33b1b0
- SHA512 a8051cc179aeb4579049d449d1cfc58183c107671f9433b511b8d8f7eb0884d86ca112d98df798b16a7e931338ae39116e3226ac8796f13244b8fe7006d455be
- SSDEEP 24576:FXsIhURgu8pVzfvelEvK/KPAapFJMFAe4Valzsvg9zHB2P2VQm/7U6sg:FXsIhURgu8pVzOlEvK/KPAapFKFAe4V+
- TLSH T1D015E7646CD3A0524A3337786B27A406FB045623979406E6B9DDCAA06F32444D37FFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/lazy.h
- SHA256 01e34167d32467e48784f8fb1cf6bdd66f28e5e431ad2f985e0f349afe463f92
- MD5 2f03036b571f6a2c3be22e3de00675a0
- SHA1 0a204ed3c8d3786b52d463065af72ee309f11ff9
- SHA512 d170558ff904371a28f864fb980a321068fec94b3f2b33dd33455b3e980d9ebbb3d25b705fc5fe3c3c448dc2622598ca2795607f8445811593a1bb10db4f2a3d
- SSDEEP 384:1G8+BLrC65laqOa6FNkDRokkur8V9DyXhp1DALF7A:7+BLrC65laqOa6FbRyXhp1sLF7A
- TLSH T1D0B241CE34B3E4B42877913E9363C845A26C25573254DC84B54E62244F839B6BBEB7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/libcurl.lib
- SHA256 171b9e0163f62bc1060c9f0b1b2b255150b79d86a92383b5cded6d4b242bf319
- MD5 734cfc45c4e8f596a008379853051e87
- SHA1 07c1b631ae39caee646c14cb14a18c8b03c8eb60
- SHA512 51ba7ab841779c75c42c8c846ce2bd3320bbf44141108b6d15bc06af8fbefebcde7fd6edf94b395747b49baa23cc51160a9c62f6f938071e05a081d494e40bf8
- SSDEEP 24576:iaRP6BJyOqlDxy4fOXfpiOOcHPuU0XLHtJjAFczG:ZIPy7lD44f0McjCZzG
- TLSH T18095B5A57ED65C4BFF2D81F088F3902793B5F2B76661874B721850343AA7AC0BD93960
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/library_x64.lib
- SHA256 8134e6d6c5dfa52ccfc2954aca1aaee0c9205a3280d7402e7b21e8f00d0af20a
- MD5 8be4c4063219df1b1604130f6974eed5
- SHA1 1453cb24766efaee4ba3ce049796dbfaf4c6a2e9
- SHA512 ee0b344fde16418864567885246b1783bae75f4e608acc3f97d6592e480299560c4f522ae688db4faa9dca743015bb816e9a42cd323cc4ce50005657e0efcca5
- SSDEEP 24576:yiq3k6WUnckJjAG8rXDuU9HFOYi4fOXffHPDMsHyvBYVGAZT:Y037Ky9EKf0XvDMayWT
- TLSH T16AF5B911778A5E9BEE5E63F098F35113A334F593AB11534B71D9A0213FA328C7BA3960
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/stb_image.h
- SHA256 1afa64c679b52a7fdf9864ce291b7fe52268e822d470eeb563bdd2a66b115466
- MD5 ffd465c2887eda7e256dca65a36c535e
- SHA1 981eccf38ada4fc06c3734d7c74694cf9170237c
- SHA512 57d42c86a9abdd5ad765fbc6cc00a84ea5572135eba182cc4dc9eeab72257442280469f3ec83d7cd7ca84628af5601efd8a09690eb9c34d4b6b35c2de8cbfede
- SSDEEP 1536:l4v3rkiIp4jEK+o07jZSG35WzrUOOgmVCbTiXdQwGrIn9Qb1iaQ+F3F7t8BDfs2j:l4AiITeTiXdQwnKQ7Pr323yoPCVm2a4
- TLSH T18F54C6C4184624710A73B37ADF875079E75AA46343A5A206BC0E53783F71738D2F9FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
vendor/xor.hpp
- SHA256 3afb5d807f3f05478c03ed166cbc937b004e1008351ea9e17fcbc919aa43ba42
- MD5 5355013964b0f3df342578dc78129611
- SHA1 ab064a63a95fb7f9f8590dac676c7bc86e0d5569
- SHA512 c9206421a796c5f6b84d7329afdb45d805165599d30a8b7e7bc5264233a922449b0a0bda60b628bb5099269e1c593abb7dbb8ff36ae65a4797d085b072cc484e
- TLSH T1BA5146B27A54E213BBD425A158E1940142FD2433B934EEF2D6BD8230A152E2FA2F3775
- MD5 SHA1 SHA512 TLSH
x64/Release/imgui.ini
- SHA256 1e21059a351147e54cfdaca82ed646444088932581ca4b6fac73152495367f13
- MD5 d72e9b6aedadd882091194f5222fbc5d
- SHA1 ead0f6ea01a035533ab541b75ca6f637d6d0825d
- SHA512 d98c9e889d1f10c38fbb5eae1a4da303c7b1dfb9bf28f52b419e3dfd86cac661081d67bb79c66fce7dee3f1095db4d8be06b0c085c9305e83b654e7307f83ac9
- TLSH T1869002016321511C42B69040917D226925895A086446B48050901005195B51264475C5
- MD5 SHA1 SHA512 TLSH
x64/Release/kirkware.exe
- IMPHASH fb376439650a3b15a536f567536f6581
- SHA256 0132c8f794791d954c68e02b228fc70377be7c5839bf41e8298051c0bd44f001
- MD5 cdb5588d4ed206abd8ef2b520bca7d6b
- SHA1 4339d37a2bb02a099fb11da5ffe5426de71e6184
- SHA512 ee760ca953dd5520ad106cd4db6485688daa6506bfa14be6e0bab1607f73b3295d2e69da78a9e71146689131ad9c717e48973bb7b148421a10481f991a8abb03
- SSDEEP 24576:/a1GL/EjaRWaAA5vnAqLnr0ZAW8m9VVAPZf4OZ:/0K05WnHr019VWPN4OZ
- TLSH T182059E8BE5A250F5D4BAD0389596712BFDB138EA05349707ABD44E563BF3B30EA8D340
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
527552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
winmm
timeBeginPeriod
kernel32
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetLocaleInfoA
GetStdHandle
CreateFileW
CloseHandle
GetLastError
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerExW
Sleep
CreateThread
OpenProcess
GetTickCount
VirtualAlloc
VirtualFree
VirtualQueryEx
GetModuleHandleW
GetConsoleWindow
CreateToolhelp32Snapshot
Process32First
Process32Next
AcquireSRWLockExclusive
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
ReleaseSRWLockExclusive
WakeAllConditionVariable
user32
GetSystemMetrics
UpdateWindow
GetAsyncKeyState
SetWindowPos
MoveWindow
GetWindowTextA
GetWindowRect
GetWindowLongA
SetWindowLongA
SetWindowLongPtrA
GetMonitorInfoW
EnumDisplaySettingsW
GetWindow
FindWindowA
ShowWindow
OpenClipboard
CloseClipboard
DestroyWindow
SetClipboardData
GetClipboardData
EmptyClipboard
GetKeyboardLayout
TrackMouseEvent
GetMessageExtraInfo
GetKeyState
GetCapture
SetCapture
ReleaseCapture
IsWindowUnicode
GetForegroundWindow
CreateWindowExA
UnregisterClassA
RegisterClassA
PostQuitMessage
DefWindowProcA
PostMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
MonitorFromWindow
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
GetWindowLongPtrA
shell32
ShellExecuteA
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
msvcp140
_Query_perf_counter
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
vcruntime140
__current_exception
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__current_exception_context
memcmp
memset
memmove
memcpy
memchr
strstr
__std_terminate
strchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strcmp
strlen
strncmp
wcsncpy_s
strncpy
api-ms-win-crt-stdio-l1-1-0
feof
_wfopen
__acrt_iob_func
ferror
__p__commode
_set_fmode
ungetc
fflush
fclose
fread
fseek
freopen
fopen
ftell
fgetc
setvbuf
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
_callnewh
malloc
realloc
api-ms-win-crt-utility-l1-1-0
qsort
abs
_lrotl
api-ms-win-crt-math-l1-1-0
acosf
_fdtest
fabs
ldexp
ceilf
fminf
expf
sqrtf
powf
pow
__setusermatherr
cosf
logf
fmodf
log
sinf
fmaxf
atan2f
api-ms-win-crt-convert-l1-1-0
strtol
atof
strtoul
api-ms-win-crt-runtime-l1-1-0
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
_initterm_e
_initterm
terminate
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_initialize_narrow_environment
_crt_atexit
_configure_narrow_argv
_set_app_type
_invoke_watson
_seh_filter_exe
system
__p___argc
exit
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
520KB
Virtual Size
519KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rcal
Size
512B
Virtual Size
75B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=36, id=261, version=35207,
count=17, id=257, version=33145,
count=324, id=1, productName=Unmarked objects,
count=8, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,