UUPdownload_with_converter_v4.6.7z
- SHA256 89e62df730f5a06302af323fb6336b6f85b1da49aa612b9bf8e7f5830add7f50
Overview
overview
8Static
static
5files/7zr.exe
windows10-2004-x64
3files/7zr.exe
windows11-ltsc_2024-x64
3files/aria2c.exe
windows10-2004-x64
1files/aria2c.exe
windows11-ltsc_2024-x64
1files/depends_win.ps1
windows10-2004-x64
8files/depends_win.ps1
windows11-ltsc_2024-x64
8files/lang.cmd
windows10-2004-x64
3files/lang.cmd
windows11-ltsc_2024-x64
3ReadMe.html
windows10-2004-x64
3ReadMe.html
windows11-ltsc_2024-x64
3Remove_Fai...ir.cmd
windows10-2004-x64
3Remove_Fai...ir.cmd
windows11-ltsc_2024-x64
3bin/7z.dll
windows10-2004-x64
3bin/7z.dll
windows11-ltsc_2024-x64
3bin/7z.exe
windows10-2004-x64
3bin/7z.exe
windows11-ltsc_2024-x64
3bin/APAP.exe
windows10-2004-x64
1bin/APAP.exe
windows11-ltsc_2024-x64
1bin/APAP.ps1
windows10-2004-x64
3bin/APAP.ps1
windows11-ltsc_2024-x64
3bin/CompDB_App.ps1
windows10-2004-x64
3bin/CompDB_App.ps1
windows11-ltsc_2024-x64
3bin/Micros...sm.dll
windows10-2004-x64
1bin/Micros...sm.dll
windows11-ltsc_2024-x64
1bin/PSFExtractor.exe
windows10-2004-x64
1bin/PSFExtractor.exe
windows11-ltsc_2024-x64
1bin/SxSExpand.exe
windows10-2004-x64
3bin/SxSExpand.exe
windows11-ltsc_2024-x64
3bin/Updates.bat
windows10-2004-x64
3bin/Updates.bat
windows11-ltsc_2024-x64
3bin/bcdedit.exe
windows10-2004-x64
3bin/bfi.exe
windows10-2004-x64
5Behavioral task
behavioral1
Sample
files/7zr.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
files/7zr.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
files/aria2c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
files/aria2c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
files/depends_win.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
files/depends_win.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
files/lang.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
files/lang.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
ReadMe.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral10
Sample
ReadMe.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral11
Sample
Remove_Failure_MountDir.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Remove_Failure_MountDir.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
bin/7z.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
bin/7z.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
bin/7z.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
bin/7z.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
bin/APAP.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
bin/APAP.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
bin/APAP.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
bin/APAP.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
bin/CompDB_App.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
bin/CompDB_App.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
bin/Microsoft.Dism.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
bin/Microsoft.Dism.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
bin/PSFExtractor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
bin/PSFExtractor.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
bin/SxSExpand.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
bin/SxSExpand.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
bin/Updates.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
bin/Updates.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
bin/bcdedit.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target UUPdownload_with_converter_v4.6.7z
- Size 3.6MB
- Sample261030-2sca5ssvbw
- SHA256 89e62df730f5a06302af323fb6336b6f85b1da49aa612b9bf8e7f5830add7f50
- MD5 8cd133490fda41a40e5f969dda74339a
- SHA1 6271ba29824350f7b93f41d01bd33ee2ec055a86
- SHA512 e67a3d86feecc4f61cd915ec9d245e9a26e19392223de8db0feeea96bd081f90e3a6f131b7f336ee50a3499cf85313cbc2ba9e4c2a637bad3e28ee75c528f19f
- SSDEEP 98304:17uo9hnqVq/Jbx9FCJ4tRw++dhmAX4Js2C0ldC:NfNj/bvTWnhz4JsB0ldC
- TLSH T16D0633F0A07972C6C3705A8455132278EE1BB8F9B1B90F39698983E5F79F02DB076953
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack002/bin/bfi.exe upx static1/unpack004/bin/bfi.exe upx - Unsigned PE 30 IoCs
Checks for missing Authenticode signature.
resource unpack001/files/7zr.exe unpack001/files/aria2c.exe unpack002/bin/7z.dll unpack002/bin/7z.exe unpack002/bin/APAP.exe unpack002/bin/Microsoft.Dism.dll unpack002/bin/PSFExtractor.exe unpack002/bin/SxSExpand.exe unpack002/bin/bfi.exe unpack003/out.upx unpack002/bin/bin64/libwim-15.dll unpack002/bin/bin64/wimlib-imagex.exe unpack002/bin/cdimage.exe unpack002/bin/libwim-15.dll unpack002/bin/offlinereg.exe unpack002/bin/wimlib-imagex.exe unpack004/bin/7z.dll unpack004/bin/7z.exe unpack004/bin/APAP.exe unpack004/bin/Microsoft.Dism.dll unpack004/bin/PSFExtractor.exe unpack004/bin/SxSExpand.exe unpack004/bin/bfi.exe unpack005/out.upx unpack004/bin/bin64/libwim-15.dll unpack004/bin/bin64/wimlib-imagex.exe unpack004/bin/cdimage.exe unpack004/bin/libwim-15.dll unpack004/bin/offlinereg.exe unpack004/bin/wimlib-imagex.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/bin/offreg.dll unpack004/bin/offreg.dll
File Explorer
-
UUPdownload_with_converter_v4.6.7z.7z 3.6MB
-
ChangeLog.txt14KB
-
ConvertConfig.ini450B
-
ReadMe.txt16KB
-
UUPs/.README134B
-
files/7zr.exe.exe 564KB
-
files/aria2c.exe.exe 5.3MB
-
files/depends_win.ps1.ps1 2KB
-
files/lang.cmd.cmd .vbs 30KB
-
files/uup-converter-wimlib_EN-US.7z.7z 1.7MB
-
ConvertConfig.ini501B
-
CustomAppsList.txt2KB
-
ReadMe.html.html 29KB
-
Remove_Failure_MountDir.cmd.cmd .bat 2KB
-
UUPs/.README134B
-
bin/7z.dll.dll 1.1MB
-
bin/7z.exe.exe 324KB
-
bin/APAP.exe.exe 4KB
-
bin/APAP.txt.ps1 898B
-
bin/CompDB_App.txt.ps1 3KB
-
bin/Microsoft.Dism.dll.dll 55KB
-
bin/PSFExtractor.exe.exe 12KB
-
bin/PSFExtractor.exe.config.xml 186B
-
bin/SxSExpand.exe.exe 85KB
-
bin/Updates.bat1KB
-
bin/bcdedit.exe.exe 369KB
-
bin/bfi.exe.exe 90KB
-
out.upx.exe 188KB
-
bin/bin64/libwim-15.dll.dll 471KB
-
bin/bin64/wimlib-imagex.exe.exe 136KB
-
bin/bootmui.txt759B
-
bin/bootwim.txt2KB
-
bin/cabarc.exe.exe 79KB
-
bin/cdimage.exe.exe 117KB
-
bin/imagex.exe.exe 633KB
-
bin/libwim-15.dll.dll 513KB
-
bin/offlinereg.exe.exe 115KB
-
bin/offreg.dll.dll 54KB
-
bin/wimlib-imagex.exe.exe 146KB
-
convert-UUP.cmd.cmd .bat 169KB
-
create_virtual_editions.cmd.cmd .bat 87KB
-
multi_arch_iso.cmd.wsf .bat 35KB
-
files/uup-converter-wimlib_ZH-CN.7z.7z 1.7MB
-
ConvertConfig.ini501B
-
CustomAppsList.txt2KB
-
ReadMe.html.html 30KB
-
Remove_Failure_MountDir.cmd.cmd .bat 2KB
-
UUPs/.README134B
-
bin/7z.dll.dll 1.1MB
-
bin/7z.exe.exe 324KB
-
bin/APAP.exe.exe 4KB
-
bin/APAP.txt.ps1 898B
-
bin/CompDB_App.txt.ps1 3KB
-
bin/Microsoft.Dism.dll.dll 55KB
-
bin/PSFExtractor.exe.exe 12KB
-
bin/PSFExtractor.exe.config.xml 186B
-
bin/SxSExpand.exe.exe 85KB
-
bin/Updates.bat1KB
-
bin/bcdedit.exe.exe 369KB
-
bin/bfi.exe.exe 90KB
-
out.upx.exe 188KB
-
bin/bin64/libwim-15.dll.dll 471KB
-
bin/bin64/wimlib-imagex.exe.exe 136KB
-
bin/bootmui.txt759B
-
bin/bootwim.txt2KB
-
bin/cabarc.exe.exe 79KB
-
bin/cdimage.exe.exe 117KB
-
bin/imagex.exe.exe 633KB
-
bin/libwim-15.dll.dll 513KB
-
bin/offlinereg.exe.exe 115KB
-
bin/offreg.dll.dll 54KB
-
bin/wimlib-imagex.exe.exe 146KB
-
convert-UUP.cmd.cmd .bat 169KB
-
create_virtual_editions.cmd.cmd .bat 86KB
-
multi_arch_iso.cmd.wsf .bat 34KB
-
lot_size_files_clear_away.cmd489B
-
uupdownload - app.cmd.cmd .bat 26KB
-
uupdownload - legacy.cmd.cmd .bat 46KB
ChangeLog.txt
- SHA256 755156d8eda70b0f98da05c091f956b0c8c05fbf2a712c883db828ff7347cd6f
- MD5 cfe24ccc2a37cfc9ae4ed97d425cabde
- SHA1 1b6be056f500199f394bb24b463f26991c2440b2
- SHA512 80c7b4c6739e7085de35a9743f4aa3a5ccabc82eda9a74c99dd994c6ed27dac36107d10c2c292f1bab4658d156939cb80e0830c44135ca603dc97ad0ad1b3457
- SSDEEP 384:g1jSD/OIbLnIpp0Jhz/2gU1nvxM5Jz/qIwHfe/WZ:gG/xb6prSkQWZ
- TLSH T1CB623CAC1A74D88C33F3319603AFA15A7608674B84B1B144D95D4C5F3E80FAF99E6B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
ConvertConfig.ini
- SHA256 59da98962e46696f3b8855aedc0e41492b867bb14d870870e07121572ed3d418
- MD5 b9f6a94f3e3f9f1f47e813b3b06d46ff
- SHA1 e70294fe0c5c240e045ea1fad2f828a0a3a32061
- SHA512 2c9ceefb3454baf30201f04dc4fc9f80ee9d7830f893384da53d997bfd34d068cc0e39b394355ea233035bfd07699f6ba2f0cc6d1a5ccd61bbc40365d6508524
- TLSH T190F0224629438AFE08F3D1005FF115A171E58083ADB2214539EC63EC2F262951AB8BD2
- MD5 SHA1 SHA512 TLSH
ReadMe.txt
- SHA256 35bd8da96c92c42077781e11f365d1695e494ccbd2dbf14674cc4654d4e8679e
- MD5 6e12e860543482473c39f235fe0f6713
- SHA1 f6bd8500a042956acba479d5914fd2a44e504ce5
- SHA512 8581035cd10b2f2aed400d347caaa5aee971284dcb13642dd7ec91c0fae0e167d9c37b3c5daf2444d314c28446076a9692c8035d11b537184dd020a835f1bd51
- SSDEEP 384:Sa+hLzLqv5ew5M5F5JO5Ww3Lywew5M5r5JJ5Ww3LJmgGeR5xRZJ8Hrh:SpTqv5E2LZCbLbGebxH4h
- TLSH T10972C6F5856618F9238231D523FDA612F26CB3278037B11AE80945993F59F2F45E2E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
UUPs/.README
- SHA256 bc42527deae7f8d2e5645015cd1a6c11153da791777d6ccbe9ef71b3ae86b244
- MD5 c013ca3a8da389fbdecb49c6b0a5e913
- SHA1 84a9534cfcc9040e9aaaf3cb809e29aae9cc87ae
- SHA512 e70c8d331000425fc740e02436cf23d7a39762bccb3c35dd45a1c235a83115670d86bc72db31230eb373c28836be681f27e72c14b74ccfe0b9615d080069d12b
- TLSH T1F6C02B63794794004496A180B349CC67C58CF0BCC5B050083CAC0011944705611B4473
- MD5 SHA1 SHA512 TLSH
files/7zr.exe
- IMPHASH 48100a28ca52634cd3f15be598a7e810
- SHA256 5e47d0900fb0ab13059e0642c1fff974c8340c0029decc3ce7470f9aa78869ab
- MD5 f86bb4469587005a6717649c9b160f70
- SHA1 f229314ebbed02098a4adb33b706d68026d866fc
- SHA512 a7881fe868c34124efa567b09274a885d05aef008914e5d341c4b8ead58451d1b29f4ace9782cd0c93d3c8fd1acb1f6e1e6cbb5b19cd51223295777b223c1366
- SSDEEP 12288:W8wKMieUWaxG8AchmRWZesGoK3n6cZ+l8App/FrUFv8KAcxO90:W37UWaxCcsYZ5Gou6w+l9p/VUFv8Kxe0
- TLSH T1DCC49E167AF1C07ED65221308B1D6BB5D0FA93680B3208C763844E6D2F759E6D73B93A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
457826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear
user32
CharUpperW
advapi32
OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
exit
_ftol
realloc
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno
kernel32
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ResumeThread
CreateFileW
WaitForSingleObject
InterlockedIncrement
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
GetFileSize
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
GetLogicalDriveStringsW
SetThreadAffinityMask
Name
.text
Size
470KB
Virtual Size
469KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=135, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=27, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
files/aria2c.exe
- IMPHASH 8a0d3862e1ea2d35f958e84f4fe6382c
- SHA256 2646c5d3eb8b0fc57e85f30434cef3d3a261d01f065fc4ad23f020c31f1dd6bd
- MD5 53d237cbbdac5ae3dc65c9ee8a51094d
- SHA1 b2aa5c6150f556f3fa6f6904ac57befc07a14b6d
- SHA512 7a29d0fbcca4402c32756ccdf8b8c79a36512d005f695d8eb9b8c88412a57d916e581ae58c55451cf6210cd76d6bdc166121492b1b653719d30a4758a7c3a5cb
- SSDEEP 49152:fcqNj1f/q2nGRqnv9KCnLEVmx6oqgemsheXhWo4liMCgyyOOK8uDjWmLSfPcZv4+:FfS2Kqn4CnLEslfYexusOK8gyo4
- TLSH T102462827E2A350ECC27BC170476BA273B931F81911307A7F7698DB752F21E60566EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptFinishHash
BCryptGenRandom
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptSignHash
BCryptVerifySignature
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptDecodeObjectEx
PFXImportCertStore
PFXIsPFXBlob
iphlpapi
GetAdaptersAddresses
kernel32
AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateSemaphoreW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExpandEnvironmentStringsA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentVariableW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReadFile
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_assert
_beginthreadex
_cexit
_commit
_commode
_difftime64
_endthreadex
_errno
_filelengthi64
_fileno
_fmode
_fstat64
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_setmode
_stricmp
_strnicmp
_time64
_unlock
_wfopen
_wfsopen
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wrmdir
_wsopen
_wstat64
_wunlink
abort
acos
asctime
asin
atan
calloc
cosh
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
isxdigit
ldiv
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
perror
putc
putwc
qsort
raise
rand
realloc
rewind
setlocale
setvbuf
signal
sinh
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strrchr
strstr
strtol
strtoul
strxfrm
tan
tanh
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcstombs
wcsxfrm
_tzname
_write
_tzset
_strnicmp
_strdup
_read
_open
_lseek
_isatty
_fileno
_fdopen
_dup
_close
secur32
AcceptSecurityContext
AcquireCredentialsHandleW
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesA
shell32
CommandLineToArgvW
ws2_32
WSASend
freeaddrinfo
getaddrinfo
gethostname
getnameinfo
getservbyname
getservbyport
wsock32
WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
516KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
256KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
files/depends_win.ps1
- SHA256 913d60aaf207d99a30b14824b567282dfe6d0c21c0be4a67830888273452bd4c
- MD5 6cb75ccadfe7163a6dc4f17ce8e941f5
- SHA1 e0317aabd60093d06e49f48ed83d9889faaec476
- SHA512 d71efaffb552b2b58efe8919912eb968a534dd6f77a97539082acd9f3b17f19a31db02c53b0e579c1226c089aeb5938070da42e1d0930383b4e11d9ba7d7244d
- TLSH T12F51306A2DB21621275B21EA4C1FD14C735B103BC64D1F94B0BEB2512F8203E87DD9F2
- MD5 SHA1 SHA512 TLSH
files/lang.cmd
- SHA256 31cabc8d04d1633be48a2b0697087eb16cf540fb6d835e3a1c0fdf74f526a4a4
- MD5 2f869fee108ccf1e5e882785b0f2cca1
- SHA1 89ed3a1a0f7064da1bdfe0254f1b735f59710daa
- SHA512 a358294c2f47f88e5be756cd433f99b8add8b330435ecd9e1547dad1b3d99c4feefdfdbf3556a91e2a3687b8a5bf11488a6b2c0932944cdb4d8e066f91ee897c
- SSDEEP 768:1GUJ9T6vKsM1o2dek19eaDV2oXYnNvV7AT5:1hJ9mvKX1o2deseavYNv2F
- TLSH T12FD2A5173E05416901FAA231918B6A49F72CC4DE9325E9CC342D801F63BFB63D6BE5E6
- MD5 SHA1 SHA512 SSDEEP TLSH
files/uup-converter-wimlib_EN-US.7z
- SHA256 9fb7fefc28c89ec12a21d030a81e8694d76a0a760cd51c0078354432d34be4ec
- MD5 b9d2d9d16ac87b8ba52ad126ae5cbbb7
- SHA1 1ef3be0ee70828ea92ddf2901bb0370343186fc8
- SHA512 a70c644d6f72f62adeb61ae1a63eb27441afeb8e178a6987013938d9f8b694b8e926f880c554bcc74757adbec3519d56d55d5641216809c756e547ef00a9effa
- SSDEEP 24576:uPlL8HW3ugilkoQRHOVoz/miBNvDqakImTOpbl1vNIDOSqqLyAUug1PIzJD+zKrs:uPi2+guE/miXLSfTQ/N8qhDJPIzJjrtW
- TLSH T12A8533B0D2DE988A6330AB497913EB50DED30C5AB5363B16255845177FEF078B13EE82
- MD5 SHA1 SHA512 SSDEEP TLSH
ConvertConfig.ini
- SHA256 8a85452bc64a64c5061f47529324b5105045c3d6073f0099176055702820249c
- MD5 808b1ca666e8cbbc9f372555e0a90550
- SHA1 c17278a0d007fa432f87941d8ef78a4086148ac6
- SHA512 60b0e4e848d5f20fa121a0f4cb6261844904cc5ce8f5485d4ebb67ea0951b8422b646b9b75b3d9d1ffea42f2f3c54ef009665479b8056bf9cd7d754a75191ee5
- TLSH T1F9F0AB46180386FE08F391101FF110A170E2C083ADB2210D39EC53EC6F272A45A7CBC1
- MD5 SHA1 SHA512 TLSH
CustomAppsList.txt
- SHA256 ff106e5a7a925ba6e967a82e2d3f7eb9030b0cef0f6a3fe6fdb726819c8de94d
- MD5 f4c8f25e8953175f9f77fed1af79f96d
- SHA1 5edd633d5b811afd185ac29856e1bd7fd1c6e291
- SHA512 41ddba85c09ad495418eee948e33833f659926579be1b936ccda67f00894df0a85cd4aaea56d97b03de095fd942ff592c7b442323dbbaa7b6936ad170882d322
- TLSH T1435141C0C1B9E9D3CF3A3883ED87CA51BCAA1AC78445DF0438E5862E68B37D2B709441
- MD5 SHA1 SHA512 TLSH
ReadMe.html
- SHA256 ed15e16a020c423dd3901b39f8fd8fddcda676a6d4963b8ed5a92d0887ee4a30
- MD5 1e85d94f555367bebfdbd635b584aa9d
- SHA1 93fe6fa705f7754070b6d23efea7281fb243ba89
- SHA512 fd00eaf3a1f264e5e887e7d24c2d5b217001f4a5b42f81bdea3e0dab6e955291a0b241546cfa0d04add92a7d056432fbc2ad2ed5b3b5909883081a9a233e3cf2
- SSDEEP 768:ZfjnIAke1hSh+ZpSOOgZM+l17jhzQTJyJiJgP64HZHNtyJl:ZfjIAvgkZpSOOgZMG1jGTJyJiJgP6ENS
- TLSH T199D2B74296C05B90C77302599B56F22FEF34C0DFB2485686385EC24F6FB3967486B68B
- MD5 SHA1 SHA512 SSDEEP TLSH
Remove_Failure_MountDir.cmd
- SHA256 ec9ffddbc5776c3c25433e8d3d13afcc5b67cc454058ea266457c92590ac3ba6
- MD5 84d6a6e4640b2767dfb0eb611f99287b
- SHA1 80e729fd1e8f91a770f994114a14dbd5454b56e8
- SHA512 356625602b0817f3f43fc4984d8579cd7bee8483a1cf910428ef18509f5d931caeb6723524e517636c38f73cb21735772485e3bae317ded44c057013b8713983
- TLSH T163517138711CE0189CF0373A7A112043B29F47576364F3ACB7FB7829B98A61AB0765D1
- MD5 SHA1 SHA512 TLSH
UUPs/.README
- SHA256 bc42527deae7f8d2e5645015cd1a6c11153da791777d6ccbe9ef71b3ae86b244
- MD5 c013ca3a8da389fbdecb49c6b0a5e913
- SHA1 84a9534cfcc9040e9aaaf3cb809e29aae9cc87ae
- SHA512 e70c8d331000425fc740e02436cf23d7a39762bccb3c35dd45a1c235a83115670d86bc72db31230eb373c28836be681f27e72c14b74ccfe0b9615d080069d12b
- TLSH T1F6C02B63794794004496A180B349CC67C58CF0BCC5B050083CAC0011944705611B4473
- MD5 SHA1 SHA512 TLSH
bin/7z.dll
- IMPHASH 6a7be52633b01426b17d148203c82793
- SHA256 3db62076e5fcc897ff29da47fe4029900a4ad696b395b6fa96acff1229444c1d
- MD5 0dce103b0102adec3279797665b7a4ae
- SHA1 c121392bab6dba8d04bee89c6b526e8e67650cc8
- SHA512 20f0f02097694579ac8794d56411fbe2d97c47d37794cb52afdabc9956c0452e8a3bb273ed34e463f31927e29e7e41c0fddb82fbbe688dd39c4113c00ec91bc9
- SSDEEP 24576:Gxb5vMX35l5UVrIdhcMEKWnttf7eePboHvVxSfOtl:GxbSz5UVrIdhnW1Pc96Otl
- TLSH T132458D15F7F1C0B4D98E56318A2CBBF550F8E71ECA1068C76780BE6E6F328D6C225949
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
868031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharPrevExA
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
885KB
Virtual Size
885KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=104, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=220, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=39, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
bin/7z.exe
- IMPHASH 8c1dd070b13c63abc19b1534fe4b4867
- SHA256 9e2631c19b243c28b0980607ced2540e9447b1166572483475547c1a9dd4ac0e
- MD5 7187ae605f4dce14bb23ea2623956335
- SHA1 f7c1df33b875c98f41dcde24117d89d42d25b7ce
- SHA512 f64522e2fb6bb61884fe53c34e79b355efb9ec33c02b2cd67d729af7d763e7b3873a5c7ce6ac7bb4567e6bcf8c70cadbc66f511e8bb151ab05096a832032bc8f
- SSDEEP 6144:J5lqo52kDzMYDJSi7+Ni2ER9Vh98+1PrEVhkQf0huIDaLOjm:JMqzBDJkk2ERvT8MPAf/O6
- TLSH T1E5646B127FF4D47AD6430232CF59ABE1E1F993A94920094327C41A2CAB758D6D379F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
244284
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
SysStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
advapi32
LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
_ftol
memcmp
_purecall
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
_CxxThrowException
malloc
memcpy
__CxxFrameHandler
_isatty
_fileno
kernel32
SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
WaitForSingleObject
SetFileTime
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
ResumeThread
Name
.text
Size
252KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=75, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=5, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
bin/APAP.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4b68745097b4d2da4f13d4dac526b770ddd91456a1bdf5b181bcf29d3b067fae
- MD5 28c515feea00696122fce7156289be91
- SHA1 3dfc8429a4d6760c3acafbf92c26d98975e1b1ec
- SHA512 7ed7f9c6961161ba1a4773a5d5188afa45d4d75d6fba7530ea8fce633b654a8097766ee9beabd2064f0e03131fc20bb5e7854058f8083ea5489b1d5ea42621f8
- TLSH T1B781D805F3988EB3C09F0B3D6A73561413B7D3A56921878B9DD421197C732381675FE6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/APAP.txt
- SHA256 e0032a8fc8b11e3e6f457b574d2663d348132d70c695f0b921b8af05007dd002
- MD5 87250ebca5a379170543a0073c1ea3e6
- SHA1 24780f0572c9cc830e2e5f279337e15215e54d02
- SHA512 7150e28b21338be9a65ab648404bca06a800f22e6d696b71f574bdee00baa5a709d182ded20ba690897cb0f03b628581ae4bbf1fb1ffcb856d11f4cad600fe38
- TLSH T11211E335C54C4C3280371256EDD1DEC5F56F86DB24149EA8314B8A6C0DB26D1B201CE6
- MD5 SHA1 SHA512 TLSH
bin/CompDB_App.txt
- SHA256 d40f2c89ccba4795856aa355545d62cda8fdc06542535cd71a4dc6c086f2a70d
- MD5 8a461169479dba82881195a5d5446dc5
- SHA1 28cf375abeb8c96141c3f278900df7d8fff69dd2
- SHA512 774be46dc7c4a7cb496cb7728aafd80385d88f2b750e77bf5e88ad9e4b5555056b0f57f4414b062185c5df89f479890cfa312a829c97ba2fb5772126a48527d7
- TLSH T10981EF5B9D2A48B1E16B6771069649B4FEAF90FB0C1C03807DAD55CDCAE15C8A2CDB70
- MD5 SHA1 SHA512 TLSH
bin/Microsoft.Dism.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac6b01b934d3a1a316920c723d11342c0bd17f135a10abde8a3e7fcc66faa795
- MD5 e7e242e90b50fdbec0653b5485535433
- SHA1 8f214e90e8e69faf0f5a3fa0bb9ee22b0ba48e3b
- SHA512 371f3d135e48c82feee41d9212d9961946754df73b4c1f2a111b97c73a38e2a5f812a1507dc01129913dd63fea690369ee19a99b66e5430f132d149a899f930e
- SSDEEP 768:dyU0jeS30Rc89H858Ghc3CRTWaJqC9EU96d1YSKlbGNHB1mNWcksXpq9MbXblqN:dyU8P2858FTNh1nc/M9MbXhqN
- TLSH T1AA430A1827E84F39D7EE0B7EB4A001014BF5FA4BF533D75EA659E0A828137C54A126E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Microsoft.Dism/obj/Release/net40/Microsoft.Dism.pdb
mscoree
_CorDllMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/PSFExtractor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 69aa3d57c1fb049d728ee99bbf6fd341c659526ab7ebe20e631929ce6cfd36d7
- MD5 cdc246981d3c7d79133ba55f2e8e5cd5
- SHA1 c4d23fa8b9c2dc150982f53fe18aad0523a12d42
- SHA512 11ec829b781dba24c82e11eccc05967352270e6bb040a4d73ab2ca4e9dd7770a74459615e29ebeb4eff4c3040c692d56180611015eb6ac10e82032e0804ac855
- SSDEEP 384:U8yJTMR6UknEM7TjJ3Jy8WgCygA5to3Tx2PLWHq:Um/ri55y3gCE5tojgWK
- TLSH T135420B0497E44239F6BE47363A7247014632B77BB825C66E79CD050B2F26B414793FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\PSFExtractor\obj\Release\PSFExtractor.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/PSFExtractor.exe.config
- SHA256 bc13330a191ac2d72c75c35f6cb430dde1f91da1da1860fb617125b6dbf844f2
- MD5 ef32e2b99b3ac0aaa4a1ade65a87bead
- SHA1 704308b0c3349f9c9c104e4b0c85d065f011826e
- SHA512 2425bf847331acdfb4962d276da412af5f5349b55b77ed765433589e1a28294bc1ef539c11ae3a7b7be9499d3344fcfe9bbdc0fd402f24b08747a19e5e4a0558
- TLSH T11DC012154598FC1B5D324A1777558D41EF3071A15064080CB05F3A13072209E4357315
- MD5 SHA1 SHA512 TLSH
bin/SxSExpand.exe
- SHA256 9e889abd2d6068bc59aededc64a45d96e04c7ad5cb1d70f606f8ab0a96433b4a
- MD5 ca13105c6b1a532b8aeec611ec6459ef
- SHA1 9758ecb1797e4037da3a20d117119129b6c3454e
- SHA512 12eb55abfb3cd97286f8d47c9c561cde1efbb025f356bc3eaa7b4665a75ec48364b31e9aa9ff2e68dfbc06a0b56a49ae46550acc93f65afb83402322d592d2ac
- SSDEEP 1536:FBhcBqEuO81aWG5mINIRkPOybxHC2sfJxJ7UvPrnvReCs:NmqEG1aWG8ImRkPOybxi7xxJ7UvPrpeC
- TLSH T1BA831903B6E19434E5B22BB46D3452256E7B7D666D38811E7A9C4B4E5FF3A808C36323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52384
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
34B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/Updates.bat
- SHA256 68cfee5caee25321e0190815b4abdd8e208fdfbdb4dac1dfc3168fab480604a5
- MD5 964be95db8fc4b0cc11bba08f07da0d2
- SHA1 8d654e1a61f790eff9b707b697854e8bbfeb0299
- SHA512 92991b2ecf98de0df2dc0efcc0b8756daa8d128b822f67e04b0f37058dc20a94db9c5772759c083b49149934649c6141bbf6bdb1d7248df3b809d97864a65f9e
- TLSH T1F2214BAF43899254FCF10FAB799BD3E4A89F900145A021A2FC6214B6F86E12066127D6
- MD5 SHA1 SHA512 TLSH
bin/bcdedit.exe
- IMPHASH 0591ec8002f106a8a5f4caff08971211
- SHA256 8ab894fc1acdc83d3c54a3bb6ef65f2d8d06ac8015ee39ab52872eb0dd0dd826
- MD5 e48eee77a8a6390b89781ccd1d7bccc5
- SHA1 b978202fc8574d9380f74a1c5b59fa290782079a
- SHA512 5a71b7f550c26196133ae78914f93d1ac4be7962e89ea86d298cb0481e9a522f28393fd43d1d8717927b8a783dc3704d6e9f83964295c6e878765a41dba92e8c
- SSDEEP 3072:eWg56t51b/0MQPdFo7WhYnG8yVZ19AmCE5EP2DbLZZsvtBMhdNV/ysXo3962xKeE:7Xb/YPNhYnGtZ1T5w2lZOuVsWj
- TLSH T1A984301362ED0115F1F27A745AB955708A3BBC91AE3AC69E029C019E4FE3E80CD71B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:06:0b:cd:a4:4b:f4:68:54:d7:ee:09:af:f7:50:08:bd:72:69:f8:02:d9:d6:2d:8a:d2:92:85:2b:15:54:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b3:52:cd:a8:de:ac:4a:9f:18:f3:84:ff:75:55:92:a3:22:95:13:65
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2014 - Jan 1, 2016
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:56:d4:53:f7:ca:e4:56:2c:f8:00:00:00:00:00:56
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Minor OS version
0
Major OS version
10
Entry point
190464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
bcdedit.pdb
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetSidLengthRequired
IsValidSid
AddAccessAllowedAce
InitializeAcl
GetAce
CreatePrivateObjectSecurityWithMultipleInheritance
SetPrivateObjectSecurityEx
GetSidSubAuthority
MakeSelfRelativeSD
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorGroup
IsValidSecurityDescriptor
DestroyPrivateObjectSecurity
GetSecurityDescriptorLength
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
InitializeSid
kernel32
FindResourceExW
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
SearchPathW
TlsSetValue
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
TlsGetValue
GetFileSizeEx
LoadResource
ReadFile
SetFilePointerEx
SetEndOfFile
DeleteCriticalSection
LoadLibraryExA
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetLocaleInfoW
GetVersionExW
CreateFileMappingW
GetUserDefaultUILanguage
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
LocalFree
FormatMessageW
DeviceIoControl
CloseHandle
CreateFileW
WriteFile
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleW
GetConsoleMode
GetFileType
GetStdHandle
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetLastError
FlushFileBuffers
msvcrt
memset
memcmp
memcpy
bsearch
wcsncmp
_aligned_malloc
_aligned_free
malloc
free
_snwscanf_s
_wcslwr
_wcsupr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wsetlocale
towupper
iswspace
_vsnwprintf
swprintf_s
wcschr
wcscpy_s
_ui64tow_s
_wcstoui64
wcstoul
_wcsnicmp
_wcsicmp
memmove
wcscat_s
_ultow_s
wcsncpy_s
wcsrchr
wcsstr
strncmp
wcsnlen
ntdll
RtlNtStatusToDosError
RtlFreeHeap
RtlAllocateHeap
RtlCompareMemory
RtlFreeUnicodeString
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
RtlGUIDFromString
RtlStringFromGUID
ZwOpenMutant
ZwReleaseMutant
ZwWaitForSingleObject
ZwClose
ZwOpenFile
NtOpenFile
ZwQueryAttributesFile
RtlAppendUnicodeToString
ZwUnloadKey
ZwCreateKey
RtlCreateAcl
RtlFreeSid
RtlSetDaclSecurityDescriptor
ZwDeleteValueKey
ZwSetValueKey
ZwSaveKey
ZwCreateFile
ZwQueryValueKey
RtlLengthSecurityDescriptor
ZwSetSecurityObject
RtlAddAccessAllowedAceEx
ZwLoadKey
RtlAllocateAndInitializeSid
ZwDeleteKey
ZwEnumerateKey
RtlLengthSid
RtlCreateSecurityDescriptor
ZwQueryKey
ZwOpenKey
RtlSetOwnerSecurityDescriptor
RtlInitAnsiString
LdrGetProcedureAddress
LdrGetDllHandle
ZwQueryVolumeInformationFile
ZwDeleteFile
ZwQueryInformationFile
NtOpenProcessTokenEx
NtSetInformationThread
RtlImpersonateSelf
NtOpenThreadTokenEx
NtAdjustPrivilegesToken
ZwCreateEvent
ZwQuerySymbolicLinkObject
RtlGetVersion
ZwOpenSymbolicLinkObject
ZwDeviceIoControlFile
ZwResetEvent
NtQuerySystemInformation
ZwAllocateUuids
NtOpenKey
NtDeviceIoControlFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtWaitForSingleObject
NtCreateEvent
NtQueryValueKey
NtSetValueKey
NtResetEvent
NtQueryBootEntryOrder
NtTranslateFilePath
NtCreateKey
NtQueryDirectoryObject
NtOpenDirectoryObject
NtEnumerateBootEntries
NtSetSecurityObject
NtDeleteKey
RtlUpcaseUnicodeChar
NtClose
ZwQuerySystemInformation
_ORCloseHive@4
_ORCloseKey@4
_ORCreateHive@4
_ORCreateKey@28
_ORDeleteKey@8
_ORDeleteValue@8
_OREnumKey@28
_OREnumValue@28
_ORFlushHive@4
_ORGetKeySecurity@16
_ORGetValue@24
_ORGetVirtualFlags@8
_OROpenHive@8
_OROpenHiveByHandle@8
_OROpenHiveInternal@16
_OROpenKey@12
_ORQueryInfoKey@44
_ORQueryInfoKeyEx@16
_ORSaveHive@16
_ORSetKeySecurity@12
_ORSetValue@20
_ORSetVirtualFlags@8
Name
.text
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=243, version=40116,
count=4, id=241, version=40116,
count=20, id=242, version=40116,
count=9, id=239, version=40116,
count=219, id=1, productName=Unmarked objects,
count=59, id=246, version=40116,
count=1, id=238, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
bin/bfi.exe
- SHA256 8f26a3f1a1f6f9ac0c279b7df56c41c79e4f23aaefd7da6e6ded16d091d4ad81
- MD5 edbdd5893d753fa68865ec3ad7dfe06d
- SHA1 8d3a30e823f5d0c5e3fbca135bb04891475219de
- SHA512 0c0e88f1f5100a2f67ee947b86081d1c30507eb018c1484e12b9255f6578aa9e0b59d6e5dbbef8a8e34d9e36e90666d97d44e3f3cc29dbf0f8bb3bc7584e0756
- SSDEEP 1536:gIvqSxs6WCegu1660dUyL0sCtA47jpsV4FjiXDJBE5baPXYUxn5ob2guBtXZ:gIhsJ166QUFJtAKjMXDJBE5kBzvX
- TLSH T12A93026F3E976E3EE53A2A745B08AD285B958C8C23E6D1B74C33531D293720D7349253
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
205360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
89KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=16, id=14, version=7299,
count=52, id=10, version=8047,
count=22, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=136, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
out.upx
- SHA256 0dbfc2bb3f35a8596d0932fbdaf364e492a7807e899e14d7d460d354be1608a4
- MD5 9aadf4488d7f0cd1986b3a55b857f9bc
- SHA1 1b97c1b6b9ca8e91634af1d4a6ab8d39016ae7a0
- SHA512 90b01ca4aa84c54af9497ee32c0c9abfb944b176c5e1177fc426049d123689e3c25e21886c42f7bed1282a763ab24fd08231dfcfdafacc43fc710ba64f1e371d
- SSDEEP 3072:9QLOdhKyyW1biW6Emogs52k9O1Ue77CdHmlTsi+5uMqqDLy/:TBiW67oj2CpmlTzCqqDLu
- TLSH T1D9148D3230C0C2BFC462053254E1A77DEBF9976613398C87EB28AE4D6D215E5D37A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
118076
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=16, id=14, version=7299,
count=52, id=10, version=8047,
count=22, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=136, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
bin/bin64/libwim-15.dll
- IMPHASH 44c0b43fc6c236bd71bf360bb0a11eb1
- SHA256 b8f1f4a0a74bf2b009dcfa8854fd9146cd061ad39b78da24abbed5d9396759f0
- MD5 e00fa5e9967055c31a62410fa4a758a2
- SHA1 334b69f34bb6eb3c4dcd4a3a5ff570642b672ef6
- SHA512 1f0db54b043da9749bda9902b71d9755d6b425856874a00f4005bc0d1ec09c99bd4d84321944ac20f04a0708afaf38f2b67256c06892828781655c7c92052458
- SSDEEP 6144:XFt4kzDh1G6uxe3kTqtZPeCmm2ftxBb5KVZYTY1eb8KR8:XFtD+P2ZRWXFfXG
- TLSH T15DA43B02E3F611ACF1B7D6305AB7567269337C155930EE2E1248C6792F33F50CA29B26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetLastError
Sleep
SleepConditionVariableCS
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_lock
_lseeki64
_open_osfhandle
fwprintf
_telli64
_unlock
_waccess
_wassert
_wcserror_s
_wcsicmp
_wgetenv
_wmkdir
_wopen
_wstat64
_wtempnam
_wunlink
abort
calloc
fclose
feof
fflush
fgetwc
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
qsort
realloc
strchr
strerror
strlen
strncmp
towlower
ungetwc
vfprintf
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstoul
_fdopen
_close
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
336KB
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/bin64/wimlib-imagex.exe
- IMPHASH 7e1c519c36253341efef99f577793739
- SHA256 a2fabc32d5c405c013e29d5b5f553067aeed6896098945e490726269f415d1a2
- MD5 c297992a7e8a207508fe30c71bf2691c
- SHA1 bdbf4936b0450cbaeb679f79bcbd1e719e13f813
- SHA512 9662eee3563be1b9da683353b6b57091f96bce339d8732f1b9031867ac1ec5dbbc939f8adf297afd5c786347eecb5f801766a0f52edafb5e5c47803b87b58299
- SSDEEP 1536:m+jjtz4SVQ8vfli6voZIGq8pStJ0pILoSZ2AKZCzkzCz3P4UclmpNHg4dB:5tzndnvoBq8pSL0LRAFdpclGB
- TLSH T1C2D3E806A3E220ACE5B79A340DF75271AA33BC225634DF1E525CD6791F73E409E24F26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libwim-15
wimlib_add_image_multisource
wimlib_create_new_wim
wimlib_delete_image
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_get_compression_type_string
wimlib_get_error_string
wimlib_get_image_property
wimlib_get_version_string
wimlib_get_wim_info
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join_with_progress
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_image_property
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_gmtime64
_initterm
_lock
_onexit
_putws
_setmode
fwprintf
_unlock
_wcmdln
_wcserror
_wcsicmp
_wfopen
_wgetenv
_wstat64
abort
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memcpy
memmove
memset
realloc
signal
strerror
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsrchr
wcstoul
_wcsdup
_isatty
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
568B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/bootmui.txt
- SHA256 db6a22b19fdcafc344cf4c544cc972bb43aeefa993358ef97f2bd8e19d42f5b8
- MD5 a08f64f779c3fc937945def623f6c331
- SHA1 25b0fef17e4f9fb47fc97f7e00d100a729ae6236
- SHA512 73cdedfb6ec15877d7795dd6c09693fde260dedea8721b44d8c56999416f9222d800d0a08bca59b80762c09d335a5e53c2c338dbd02597d29443dcff0d6fc127
- TLSH T12A014C78F81B086336E1BEF4BCF2084C5E8692E04955EF449139319BF826D349DF0360
- MD5 SHA1 SHA512 TLSH
bin/bootwim.txt
- SHA256 3d808a95c035dae306ad2929de617c7727abecab0bddeb34638f1ba4d3c52e80
- MD5 e70e4bc070958d8537450a1353fbfbbf
- SHA1 9a3ec46f6fd7a8930d3b69285836c3efee09dff2
- SHA512 a9b2bc2e2423d68c418c61441e12f32c6193752070413771bab4be9247cae6db3c452ec8004465d8305ec596a19df7e666a4ad2efde6c128d3fd7f8622922cd1
- TLSH T124418B2DC927840737240FF535CAAE0C65A26946BF23A37088344BEF568792FDE5C0B9
- MD5 SHA1 SHA512 TLSH
bin/cabarc.exe
- IMPHASH c362751f44a9f875b2280fc6dcfae10c
- SHA256 cceaa59cb4e67f993b099c5e2693eb15231de3863e29da14ff130f24b66ff260
- MD5 a02a8702c6c539bd8648ccbb1869a604
- SHA1 c16da959c5aa9f29346e22fb07802cfa8f7b453f
- SHA512 6b871519e6d190d7703aed7e58d11b0bd69b731a44f90be0869efe00d256da982601b69d01721f8002c99d4cb5d36913b171306a79bb62bd4a5f9655f78ec3d3
- SSDEEP 1536:7xJDrXJTUZQM99pEY+7mfZZt7BN6e5ooPzUOmJ9ybae9rvpI0svZWGKAkro7m+8+:7xJDr5T6Wz7mf7tr6EUHJ9ybaOrWbKAf
- TLSH T1D283BF927FE89097CAC752709349B76ABF7847F20511B29F6B189C903A52FC2FF20255
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7b:07:3d:ec:1d:6f:85:c8:1b:53:d4:c2:11:6b:24:a9:4d:4d:c3:27:21:a2:55:6c:42:d0:7a:e1:fa:6c:41:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 15, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
45:43:a5:dc:20:07:fc:17:d6:59:f4:ec:e4:36:eb:bb:a8:50:81:67
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 15, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2a:9f:4b:23:5f:cf:b0:f0:9d:00:00:00:00:00:2a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Minor OS version
0
Major OS version
5
Entry point
18304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
msvcrt
fgets
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
fopen
malloc
__p__fmode
__set_app_type
_except_handler3
_controlfp
isspace
fclose
_getch
time
srand
rand
strchr
_tempnam
free
memmove
sprintf
strrchr
strncpy
isdigit
atoi
_stricmp
_strnicmp
toupper
printf
exit
_adjust_fdiv
__p__commode
kernel32
SetFilePointer
WriteFile
ReadFile
LocalFree
LocalAlloc
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
CreateDirectoryA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
CreateFileA
GetLastError
GetFileInformationByHandle
CloseHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=2, id=19, version=9049,
count=40, id=2, version=7274,
count=1, id=6, version=2090,
count=60, productName=Unmarked objects (old),
bin/cdimage.exe
- IMPHASH d7b38d0f2022ae83ed59a720772478e0
- SHA256 0b82e3775615e8f7babf5cf5be59c836d397ea7dbf1871bd5fdf4bedceaead86
- MD5 c9d5d0ea346d48185ac2eef836ba04a2
- SHA1 805f26e7a8450502201ceceb5dd041152780f639
- SHA512 65944e597b23669cb9a1b3b82043c7b08f5d4e7514147a18a4817011e5594033dc820617e9d11ed5b2bbd9539d6449d471327c7521d4a21e9a23be3db9e96025
- SSDEEP 1536:k934eRJXKj7KghBvawIpt6Vrw4tZCGGqHZUJdl4ivdUKgJubS5EJ17NNfPD+AQ:k934eR1Kj7R2PqiPvGH5EJ17NpB
- TLSH T1E6C38D12DBC442B5C4D320F4379CB3B199BDD97E032A1AC73B4C47E46454BD2E6B2A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
95952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
CDIMAGE.pdb
kernel32
GetVersionExA
SetErrorMode
GetSystemTime
SystemTimeToFileTime
SetFileApisToANSI
SetFileApisToOEM
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
lstrlenW
FindFirstFileW
FindFirstFileA
FindClose
GetLongPathNameW
GetLastError
GetLongPathNameA
HeapFree
CreateFileW
CreateFileA
CloseHandle
WaitForSingleObject
SetEvent
FileTimeToSystemTime
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
ReadFile
GetFileTime
GetFileInformationByHandle
FindNextFileA
FindNextFileW
GetOverlappedResult
SetEndOfFile
SetFilePointer
CreateEventA
WriteFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetModuleHandleA
GetProcessWorkingSetSize
SetProcessWorkingSetSize
InitializeCriticalSection
VirtualFree
SetConsoleCtrlHandler
ExitProcess
FormatMessageA
GetProcessHeap
HeapAlloc
VirtualAlloc
VirtualLock
ResetEvent
GetProcAddress
ReleaseSemaphore
CreateThread
WaitForMultipleObjects
SetThreadPriority
CreateSemaphoreA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
msvcrt
strrchr
_stricmp
wcstok
strtok
_wfopen
fgetws
_wcsicmp
fclose
fopen
fgets
_strnicmp
_strtoui64
strtoul
tolower
atoi
srand
time
vfprintf
_ultoa
rand
_wcsnicmp
_errno
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
memcpy
memset
?terminate@@YAXXZ
_controlfp
isleadbyte
_fileno
free
mbtowc
__mb_cur_max
_snprintf
_itoa
wctomb
malloc
ferror
__badioinfo
__pioinfo
_isatty
_write
_lseeki64
wcsrchr
wprintf
strchr
wcschr
_strupr
wcsncmp
exit
printf
fflush
fprintf
_iob
feof
memcmp
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=205, version=65501,
count=14, id=207, version=65501,
count=69, id=206, version=65501,
count=5, id=203, version=65501,
count=169, id=1, productName=Unmarked objects,
count=13, id=210, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
bin/imagex.exe
- IMPHASH 6816108faf77a6c11f4b9ffc7bae891f
- SHA256 4edb6afb13477de51459096cc3f7d2a497f053fecf05cc3c360451fede667848
- MD5 a452fd6f47c7f603c2c2034dacc8cac4
- SHA1 81beb20db768bc42d5e7df7d77a02d792d5ef92e
- SHA512 0b4b211df29fe208a2d3f44c4c065cd840f991ae02a48bcecd0d886e7e52df51bd4c707f0f927f5955fe36f40a0eb9f751240f143e5f165be33f0b6e9ecde3e7
- SSDEEP 12288:x+gWMYl2snR/Dbzw6Cf2rkKul/WDsk+VR9QikUmInpNgvsPPetKAr/GhME1BA5Of:/7bsnRNCf2r7ulOikUmiNTMO5
- TLSH T16BD46B21B6E8403EF7F335B04D392669597EB9626A70C88F53808D5D19716C0EA387BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:c9:0c:a3:10:28:64:07:22:71:32:f6:f5:7d:4c:f8:00:36:dd:d5:0f:f1:ce:d0:09:54:dc:4d:b7:e3:e9:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8b:bc:9b:e8:61:73:33:98:ac:ab:d0:0d:13:29:14:8f:9c:bc:1d:09
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b1:71:13:79:df:75:f6:35:c8:00:00:00:00:00:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
10
Entry point
546960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
imagex.pdb
msvcrt
_lock
_except_handler4_common
memmove_s
_strcmpi
wcstoul
_unlock
_wcsupr
_snwprintf_s
qsort
_wcsrev
_wcslwr
_strnicmp
__dllonexit
strcpy_s
_wcstoi64
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_onexit
_exit
wcsstr
wcsncmp
wcsnlen
exit
__set_app_type
swscanf_s
towupper
_wcsnicmp
wcschr
_vscwprintf
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wtoi
wcsrchr
_wtol
fflush
memmove
_wcsicmp
__iob_func
memcpy
memcmp
printf
iswspace
_purecall
malloc
_callnewh
_cexit
bsearch
free
memcpy_s
memset
_vsnwprintf
ntdll
DbgPrintEx
NtYieldExecution
RtlRaiseStatus
RtlReAllocateHeap
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlInitUnicodeString
NtQuerySecurityObject
RtlImpersonateSelf
NtSetEaFile
NtCreateFile
NtQueryEaFile
NtQueryVolumeInformationFile
NtQueryInformationProcess
NtQueryInformationFile
RtlAdjustPrivilege
NtClose
NtQueryDirectoryFile
NtOpenFile
RtlDosPathNameToNtPathName_U
NtSetSecurityObject
RtlFindAceByType
RtlSetControlSecurityDescriptor
RtlGetLastNtStatus
RtlFreeHeap
RtlAllocateHeap
NtSetInformationFile
RtlNtStatusToDosError
RtlGetVersion
kernel32
MapViewOfFile
CreateFileMappingW
lstrcmpW
CreateSemaphoreW
GetDriveTypeW
GetTempFileNameW
DeleteFileW
GetTempPathW
GetLogicalDrives
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
UnmapViewOfFile
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
WaitForMultipleObjects
ReleaseSemaphore
GetPrivateProfileSectionW
DuplicateHandle
UnlockFileEx
LockFileEx
GetVolumeInformationByHandleW
GetSystemWindowsDirectoryW
GlobalMemoryStatusEx
TerminateProcess
FindClose
GetFinalPathNameByHandleW
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
CreateEventW
OpenProcess
ReleaseMutex
LocalAlloc
GetModuleHandleExW
CreateMutexW
HeapReAlloc
RemoveDirectoryW
SetFilePointer
GetFileSize
GetCurrentThread
SetThreadIdealProcessor
GetSystemInfo
DeleteCriticalSection
GetOverlappedResult
ReadFile
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
GetHandleInformation
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
CreateDirectoryW
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetLastError
WriteFile
GetConsoleMode
GetConsoleScreenBufferInfo
WriteConsoleW
SetConsoleCursorPosition
GetStdHandle
InitializeCriticalSection
FlushFileBuffers
CopyFileExW
GetFileInformationByHandle
SetFileAttributesW
CreateFileW
DeviceIoControl
GetCurrentDirectoryW
LoadLibraryExW
FindNextFileW
GetVolumePathNamesForVolumeNameW
LoadLibraryW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
MultiByteToWideChar
CreateSemaphoreExW
GetExitCodeProcess
CreateProcessW
GetLogicalDriveStringsW
FindFirstFileW
FreeLibrary
GetModuleHandleW
SetConsoleCtrlHandler
GetModuleFileNameW
WaitForMultipleObjectsEx
GetFullPathNameW
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetTickCount64
GetSystemDirectoryW
GetFileAttributesW
CompareStringW
GetCommandLineW
SetLastError
GetEnvironmentVariableW
LocalFree
WaitForSingleObject
OpenEventW
FormatMessageW
HeapFree
SetEvent
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateThread
GetProcAddress
FillConsoleOutputCharacterW
user32
CharPrevW
LoadStringW
CharNextW
CharUpperW
shlwapi
PathMatchSpecW
StrStrIW
setupapi
SetupFindFirstLineW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextW
rpcrt4
UuidFromStringW
RpcStringFreeW
UuidToStringW
RpcBindingFree
RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
UuidCreate
I_RpcMapWin32Status
NdrClientCall2
RpcStringBindingComposeW
fltlib
FilterLoad
FilterAttach
cabinet
ord22
ord20
ord23
advapi32
GetSecurityInfo
SetSecurityDescriptorDacl
EqualSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetTokenInformation
OpenThreadToken
InitializeSecurityDescriptor
RegUnLoadKeyW
RegLoadKeyW
GetAclInformation
GetSecurityDescriptorLength
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegCloseKey
RegDeleteKeyExW
RegFlushKey
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
AdjustTokenPrivileges
AllocateAndInitializeSid
OpenProcessToken
FreeSid
CheckTokenMembership
OpenEncryptedFileRawW
WriteEncryptedFileRaw
CloseEncryptedFileRaw
RevertToSelf
ReadEncryptedFileRaw
RegQueryInfoKeyW
SetThreadToken
AddAccessAllowedAceEx
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
bcrypt
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
Name
.text
Size
536KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=24610,
count=20, id=260, version=24610,
count=322, id=1, productName=Unmarked objects,
count=13, id=257, version=24610,
count=4, id=261, version=24610,
count=146, id=264, version=24610,
count=1, id=255, version=24610,
count=1, id=258, version=24610,
bin/libwim-15.dll
- IMPHASH 5246d9411a3af41e1bb12a7f476de9a6
- SHA256 e1b005c0f1391b30357e64885a08a09a2d41de93b38acaa25ed7a355f74f56b4
- MD5 cb5fce32bb4559e6c078f68257b8cf03
- SHA1 c6181dd756007700322d5fb519f0697dd56a671f
- SHA512 a175be59ea81bfe2ad9d4590861e6634e089c025187552c2b7c0e023ad19af15588fb0f768c8c7f33f23c41f78f939a214aa1ffb68059a6b84e8fa03f260a395
- SSDEEP 12288:hkqblT/iOQw4/kNJjNyvO5ZOjXRrZfFwoCiHk:hkqblriO0k7xCOahZ9wGHk
- TLSH T14AB42A85EBC710F4F5B3AA70997AE37F4A327D019834DE7DEB0D554AB933A018928316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
IsDBCSLeadByteEx
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetLastError
Sleep
SleepConditionVariableCS
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
msvcrt
__mb_cur_max
_amsg_exit
_assert
_errno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_iob
_lock
_lseeki64
_open_osfhandle
fwprintf
_telli64
_unlock
_waccess
_wcserror_s
_wcsicmp
_wgetenv
_wmkdir
_wopen
_wtempnam
_wunlink
abort
atoi
calloc
fclose
feof
fflush
fgetwc
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
qsort
realloc
setlocale
strchr
strerror
strlen
strncmp
towlower
ungetwc
vfprintf
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstombs
wcstoul
_wstat64
_fdopen
_close
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
351KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/offlinereg.exe
- SHA256 6ad78c3e6a07ec84bbe399f3be156edc3ee1da525bd87f7c0c716846708a111a
- MD5 6dc5ad65078eb5229fbbd1f06f61cf0b
- SHA1 e0f89640230db562d32099c4851e1ebb90dcfc98
- SHA512 a91f2dbf7b2435461805c3d756f5ac1eff27da8d84c9e3076e8cd1ac9ebcc9bbad77820d0eb3bfe3ea0de91d50fe69549baac9687ffa536d27522d8a775d57ec
- SSDEEP 3072:Pp/5MaKYvuo3Khqef9uVrAgXuQbkX2hgqjYDsqLhPEcrrFm9gh:P1mgt3w9J2gqjYDsqLhP70
- TLSH T1B5B33B22B2D08472E0709E7CCC15B2E4943AFDA12D68956AB7F85E4DCE393C1686D3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
99520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/offreg.dll
- IMPHASH 7f06a5f1ddbdb3daa4bd9e267b9e1f4c
- SHA256 a8e3149c77c235818cbbf2686cecd66683e2d3864860074f0777c13b1140a9a2
- MD5 163db46b803e4c83c444a026ff17d269
- SHA1 0a2585db6a5c2f7f467fd85df622e9c0632b9b2e
- SHA512 9a14ef16e30f8bf72a89fe3154e04d879d1ce8bbdcee4942dcdfb74da6e5584a19853b64ee4a36fb9af04e2e641f1e0ba04b2f5187e2ceeaf9085685e1d78c31
- SSDEEP 768:V5zyp6v0wj3hpUTAvZxdW9UzjzvH+qREOtJWS1temkz1ImTWvERLkEzrBJOkMm75:bv02hphxdSevH+uJWEMb9TWWkEZQ0
- TLSH T17A437D22B52481BBC4DA75B1215E7276293EC7820B219ACF07761DF6B9617C09F387CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
13:3f:33:a4:99:03:ab:e0:5c:63:75:f6:fe:c4:d9:6b:4d:c1:a9:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 9, 2010
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:04:b3:f5:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2008 - Jul 25, 2011
Subject
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:23:0f:00:00:00:00:00:0a
Issuer
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:02:dc:00:00:00:00:00:0b
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 15, 2005 - Mar 15, 2016
Minor OS version
1
Major OS version
6
Entry point
6067
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
offreg.pdb
msvcrt
_wcsicmp
_aligned_malloc
_aligned_free
towupper
_wcsnicmp
memmove
memcpy
memset
_amsg_exit
_initterm
free
malloc
_XcptFilter
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryA
TlsFree
TlsAlloc
TlsGetValue
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
GetProcessHeap
CreateFileW
CloseHandle
ReadFile
WriteFile
GetFileSizeEx
FlushFileBuffers
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
TlsSetValue
GetSystemTimeAsFileTime
TerminateProcess
advapi32
InitializeSid
DestroyPrivateObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorControl
MakeSelfRelativeSD
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetPrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
GetSidLengthRequired
GetSecurityDescriptorLength
GetSidSubAuthority
ORCloseHive
ORCloseKey
ORCreateHive
ORCreateKey
ORDeleteKey
ORDeleteValue
OREnumKey
OREnumValue
ORGetKeySecurity
ORGetValue
ORGetVersion
ORGetVirtualFlags
OROpenHive
OROpenKey
ORQueryInfoKey
ORSaveHive
ORSetKeySecurity
ORSetValue
ORSetVirtualFlags
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=115, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=83, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bin/wimlib-imagex.exe
- IMPHASH 78477e4f732fb9f2e42908debcac154e
- SHA256 01168a00ffc84ebfa1bd3b9c841214ed114b9ae4e9b23d555c0686448fd56bde
- MD5 c0605496fa0a86bcc78dbe13bd7aa29c
- SHA1 102df32a155a895a3a79f15b00b10c01e7862b6d
- SHA512 9059a28326cc9f739fdec85d1e5397d40302992b2d75832a44e58b051dc31cd43f5ca5107240897f81b9546bf1161d6f0418908043b406459260588286a3f555
- SSDEEP 3072:R54W0y7EBY6FrtTrQgjQnGIlSLqo5cN2bm:RCW0yATrtTrQgjQ5lRo5Qym
- TLSH T11FE3F804F7D750F1F5736AB05DBAD37E4A33BD128938CE2EE74C564AAA37A404624722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libwim-15
wimlib_add_image_multisource
wimlib_create_new_wim
wimlib_delete_image
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_get_compression_type_string
wimlib_get_error_string
wimlib_get_image_property
wimlib_get_version_string
wimlib_get_wim_info
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join_with_progress
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_image_property
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__mb_cur_max
__p__commode
__p__fmode
__p__wcmdln
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_errno
_gmtime64
_initterm
_iob
_lock
_onexit
_putws
_setmode
fwprintf
_unlock
_wcserror
_wcsicmp
_wfopen
_wgetenv
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memcpy
memmove
memset
realloc
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsrchr
wcstoul
_wstat64
_wcsdup
_isatty
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
convert-UUP.cmd
- SHA256 6f3a69565742ca335e531c0f9adaf37f5391533a6f016b4e3d05f0bb5084a11a
- MD5 6d2ecd1a36ea0c38aa5ab5c832035fa7
- SHA1 22ceaea70c78afda1c3d048ecb03c1296a19e0c9
- SHA512 eb7890e31196a59f1cf5c2c7f7e8308b16ec28cbce27f550235c6584e0605894fe9f721d33af5b9bed08e6f3db2c1f8ff9d2161241c6115114445fba3683946a
- SSDEEP 3072:55nHlIYVqgvKcbEVRJtjAT4ePzg1RJtauW0c4vCXxYGF587afcrkx/81CZqIUBOe:TnHlIYVqgvKcbEVRJtjAT4ePzg1RJtaW
- TLSH T14304095871485166D0F54BB9A2660283BB3FD4735230E3BC773994B4F9F72A320B9AD8
- MD5 SHA1 SHA512 SSDEEP TLSH
create_virtual_editions.cmd
- SHA256 162a79dc55c73a10999cafe7b679e601c72c6aa0cda2a68c0851a9ab03b6497a
- MD5 cf597d350f9d6179834ca61c1510395a
- SHA1 76f960dd2d74b300716194835202d8d78113ff27
- SHA512 9e331fffdc62651d6bc01340aaa8567ef0d32868fd299445b73a6de3b50656d7f737221df04d85708e530b8a9b1c8c31cd20a303246077eaf40731b03b5ee1cc
- SSDEEP 1536:eWlDLC+Ici0EaScCXUgLQbfd0fciZTR3vckNLZgyZZZ0ZKayo7kJXp+jVEoh4:zNLC+Ici0EaScCXUgLQbfd0fciZTVvcg
- TLSH T1C393B5943494012AF4FF837292F1B9416BBFF0E20BF1DE4C713894A076DB68699B598D
- MD5 SHA1 SHA512 SSDEEP TLSH
multi_arch_iso.cmd
- SHA256 1cc0da45246ffe4d1301683187ac36ab71c60a5feacac47b5ae5a7af21d58be0
- MD5 4706b0d0ad0591b0ea2438c86613c5cb
- SHA1 cd18502aaecba44541d8973636093e508b099825
- SHA512 38574f141c167c8adedef3337e957b905a5bd28b29ab691dafdb843508d8a2ab829a35dbf8ec6a94e5cc3d5d931c92373d7d6b16389f943587047aa494f1688e
- SSDEEP 768:STNTMSpyt6Pzqavk1aQyw4sNuC3+3tciQKwHc7qw2ayo7kJnSO+jVgV:MTMSpEozqavk1aQyw4sNuC3+dclhayos
- TLSH T11BF2D8643507523250E287F2EA279046772FC5228670F3CC797D90A476BF3A6A1F6DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
files/uup-converter-wimlib_ZH-CN.7z
- SHA256 5586eaeb1ccf017b7953c0edb72dce129577ce66ef471c0eb73f1df5640ab991
- MD5 dc07799274352e3bf8a13c6d4d05bd00
- SHA1 cdd20a5c0f867bc48a2c74088e5c73a6c86d863f
- SHA512 75178f0a3ab79854a8227866f595b3a174fd23fd7379a45af9edb79bad9a5b973aeea03b62bcfbc6d321953f8f1474b66363deb45b7eee307687267142edc66d
- SSDEEP 49152:9pPi2+guE/miXLSfTQ/N8qhDJPIzJjrtC:FBuyz/iqJG3C
- TLSH T1F48533B0D2DFA88A5330EA497517EB50DA930C59B2763B0A2558451F7FEE078713EE83
- MD5 SHA1 SHA512 SSDEEP TLSH
ConvertConfig.ini
- SHA256 8a85452bc64a64c5061f47529324b5105045c3d6073f0099176055702820249c
- MD5 808b1ca666e8cbbc9f372555e0a90550
- SHA1 c17278a0d007fa432f87941d8ef78a4086148ac6
- SHA512 60b0e4e848d5f20fa121a0f4cb6261844904cc5ce8f5485d4ebb67ea0951b8422b646b9b75b3d9d1ffea42f2f3c54ef009665479b8056bf9cd7d754a75191ee5
- TLSH T1F9F0AB46180386FE08F391101FF110A170E2C083ADB2210D39EC53EC6F272A45A7CBC1
- MD5 SHA1 SHA512 TLSH
CustomAppsList.txt
- SHA256 ff106e5a7a925ba6e967a82e2d3f7eb9030b0cef0f6a3fe6fdb726819c8de94d
- MD5 f4c8f25e8953175f9f77fed1af79f96d
- SHA1 5edd633d5b811afd185ac29856e1bd7fd1c6e291
- SHA512 41ddba85c09ad495418eee948e33833f659926579be1b936ccda67f00894df0a85cd4aaea56d97b03de095fd942ff592c7b442323dbbaa7b6936ad170882d322
- TLSH T1435141C0C1B9E9D3CF3A3883ED87CA51BCAA1AC78445DF0438E5862E68B37D2B709441
- MD5 SHA1 SHA512 TLSH
ReadMe.html
- SHA256 49288a5ab8dd3bd5da37d767680f4fe2175903e663e27aed42cc4989c0400139
- MD5 afa933d556c2bdb95989d9f8db093345
- SHA1 5d10e57c411724f6ec962c74ab635c4a9b775332
- SHA512 c23a9ab7fd1dda992bca9413b138c862e68dd8a1713d280d652a9fd5cbbba65459d3dbf20134c7abdea0109fed3b8ae40982f1fa30cec8bf898daea4e204950d
- SSDEEP 768:i6o3TihhN1s+03sbDUywll/U94bQYaQC1cLoFRytz:i6o3TinhtbDArUS8YaQC1cLoFRu
- TLSH T1F4D292A585E14C94837101180B65F23FFE74A0DBE165A6827D8EA42FBFB3D13082BD5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Remove_Failure_MountDir.cmd
- SHA256 8a60587e59875130e9e7d9d567d4b0f22db1bbe3ef9793d9b59be13d9bb2b45a
- MD5 828b8b9ab98c66ecb77169d6af6bbfa0
- SHA1 54b628eac81b305817fd0fd0b680ae4c811faebd
- SHA512 49f38f4c7fb6ada3e5c2bd79bb249d72b05c2b7e9e1572101db5bf4bfe111d09d1be59f9ae740b4ad621db5413b20dd6d550d4d30416f4edc2ecf26b5cd7ab9b
- TLSH T149515138311DE0189CF037397A112053B29F47936360F3ACBBFB7829B88A61AB0765C1
- MD5 SHA1 SHA512 TLSH
UUPs/.README
- SHA256 bc42527deae7f8d2e5645015cd1a6c11153da791777d6ccbe9ef71b3ae86b244
- MD5 c013ca3a8da389fbdecb49c6b0a5e913
- SHA1 84a9534cfcc9040e9aaaf3cb809e29aae9cc87ae
- SHA512 e70c8d331000425fc740e02436cf23d7a39762bccb3c35dd45a1c235a83115670d86bc72db31230eb373c28836be681f27e72c14b74ccfe0b9615d080069d12b
- TLSH T1F6C02B63794794004496A180B349CC67C58CF0BCC5B050083CAC0011944705611B4473
- MD5 SHA1 SHA512 TLSH
bin/7z.dll
- IMPHASH 6a7be52633b01426b17d148203c82793
- SHA256 3db62076e5fcc897ff29da47fe4029900a4ad696b395b6fa96acff1229444c1d
- MD5 0dce103b0102adec3279797665b7a4ae
- SHA1 c121392bab6dba8d04bee89c6b526e8e67650cc8
- SHA512 20f0f02097694579ac8794d56411fbe2d97c47d37794cb52afdabc9956c0452e8a3bb273ed34e463f31927e29e7e41c0fddb82fbbe688dd39c4113c00ec91bc9
- SSDEEP 24576:Gxb5vMX35l5UVrIdhcMEKWnttf7eePboHvVxSfOtl:GxbSz5UVrIdhnW1Pc96Otl
- TLSH T132458D15F7F1C0B4D98E56318A2CBBF550F8E71ECA1068C76780BE6E6F328D6C225949
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
868031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharPrevExA
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
885KB
Virtual Size
885KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=104, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=220, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=39, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
bin/7z.exe
- IMPHASH 8c1dd070b13c63abc19b1534fe4b4867
- SHA256 9e2631c19b243c28b0980607ced2540e9447b1166572483475547c1a9dd4ac0e
- MD5 7187ae605f4dce14bb23ea2623956335
- SHA1 f7c1df33b875c98f41dcde24117d89d42d25b7ce
- SHA512 f64522e2fb6bb61884fe53c34e79b355efb9ec33c02b2cd67d729af7d763e7b3873a5c7ce6ac7bb4567e6bcf8c70cadbc66f511e8bb151ab05096a832032bc8f
- SSDEEP 6144:J5lqo52kDzMYDJSi7+Ni2ER9Vh98+1PrEVhkQf0huIDaLOjm:JMqzBDJkk2ERvT8MPAf/O6
- TLSH T1E5646B127FF4D47AD6430232CF59ABE1E1F993A94920094327C41A2CAB758D6D379F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
244284
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
SysStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
advapi32
LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
_ftol
memcmp
_purecall
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
_CxxThrowException
malloc
memcpy
__CxxFrameHandler
_isatty
_fileno
kernel32
SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
WaitForSingleObject
SetFileTime
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
ResumeThread
Name
.text
Size
252KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=75, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=5, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
bin/APAP.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4b68745097b4d2da4f13d4dac526b770ddd91456a1bdf5b181bcf29d3b067fae
- MD5 28c515feea00696122fce7156289be91
- SHA1 3dfc8429a4d6760c3acafbf92c26d98975e1b1ec
- SHA512 7ed7f9c6961161ba1a4773a5d5188afa45d4d75d6fba7530ea8fce633b654a8097766ee9beabd2064f0e03131fc20bb5e7854058f8083ea5489b1d5ea42621f8
- TLSH T1B781D805F3988EB3C09F0B3D6A73561413B7D3A56921878B9DD421197C732381675FE6
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/APAP.txt
- SHA256 e0032a8fc8b11e3e6f457b574d2663d348132d70c695f0b921b8af05007dd002
- MD5 87250ebca5a379170543a0073c1ea3e6
- SHA1 24780f0572c9cc830e2e5f279337e15215e54d02
- SHA512 7150e28b21338be9a65ab648404bca06a800f22e6d696b71f574bdee00baa5a709d182ded20ba690897cb0f03b628581ae4bbf1fb1ffcb856d11f4cad600fe38
- TLSH T11211E335C54C4C3280371256EDD1DEC5F56F86DB24149EA8314B8A6C0DB26D1B201CE6
- MD5 SHA1 SHA512 TLSH
bin/CompDB_App.txt
- SHA256 d40f2c89ccba4795856aa355545d62cda8fdc06542535cd71a4dc6c086f2a70d
- MD5 8a461169479dba82881195a5d5446dc5
- SHA1 28cf375abeb8c96141c3f278900df7d8fff69dd2
- SHA512 774be46dc7c4a7cb496cb7728aafd80385d88f2b750e77bf5e88ad9e4b5555056b0f57f4414b062185c5df89f479890cfa312a829c97ba2fb5772126a48527d7
- TLSH T10981EF5B9D2A48B1E16B6771069649B4FEAF90FB0C1C03807DAD55CDCAE15C8A2CDB70
- MD5 SHA1 SHA512 TLSH
bin/Microsoft.Dism.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac6b01b934d3a1a316920c723d11342c0bd17f135a10abde8a3e7fcc66faa795
- MD5 e7e242e90b50fdbec0653b5485535433
- SHA1 8f214e90e8e69faf0f5a3fa0bb9ee22b0ba48e3b
- SHA512 371f3d135e48c82feee41d9212d9961946754df73b4c1f2a111b97c73a38e2a5f812a1507dc01129913dd63fea690369ee19a99b66e5430f132d149a899f930e
- SSDEEP 768:dyU0jeS30Rc89H858Ghc3CRTWaJqC9EU96d1YSKlbGNHB1mNWcksXpq9MbXblqN:dyU8P2858FTNh1nc/M9MbXhqN
- TLSH T1AA430A1827E84F39D7EE0B7EB4A001014BF5FA4BF533D75EA659E0A828137C54A126E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Microsoft.Dism/obj/Release/net40/Microsoft.Dism.pdb
mscoree
_CorDllMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/PSFExtractor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 69aa3d57c1fb049d728ee99bbf6fd341c659526ab7ebe20e631929ce6cfd36d7
- MD5 cdc246981d3c7d79133ba55f2e8e5cd5
- SHA1 c4d23fa8b9c2dc150982f53fe18aad0523a12d42
- SHA512 11ec829b781dba24c82e11eccc05967352270e6bb040a4d73ab2ca4e9dd7770a74459615e29ebeb4eff4c3040c692d56180611015eb6ac10e82032e0804ac855
- SSDEEP 384:U8yJTMR6UknEM7TjJ3Jy8WgCygA5to3Tx2PLWHq:Um/ri55y3gCE5tojgWK
- TLSH T135420B0497E44239F6BE47363A7247014632B77BB825C66E79CD050B2F26B414793FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\PSFExtractor\obj\Release\PSFExtractor.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/PSFExtractor.exe.config
- SHA256 bc13330a191ac2d72c75c35f6cb430dde1f91da1da1860fb617125b6dbf844f2
- MD5 ef32e2b99b3ac0aaa4a1ade65a87bead
- SHA1 704308b0c3349f9c9c104e4b0c85d065f011826e
- SHA512 2425bf847331acdfb4962d276da412af5f5349b55b77ed765433589e1a28294bc1ef539c11ae3a7b7be9499d3344fcfe9bbdc0fd402f24b08747a19e5e4a0558
- TLSH T11DC012154598FC1B5D324A1777558D41EF3071A15064080CB05F3A13072209E4357315
- MD5 SHA1 SHA512 TLSH
bin/SxSExpand.exe
- SHA256 9e889abd2d6068bc59aededc64a45d96e04c7ad5cb1d70f606f8ab0a96433b4a
- MD5 ca13105c6b1a532b8aeec611ec6459ef
- SHA1 9758ecb1797e4037da3a20d117119129b6c3454e
- SHA512 12eb55abfb3cd97286f8d47c9c561cde1efbb025f356bc3eaa7b4665a75ec48364b31e9aa9ff2e68dfbc06a0b56a49ae46550acc93f65afb83402322d592d2ac
- SSDEEP 1536:FBhcBqEuO81aWG5mINIRkPOybxHC2sfJxJ7UvPrnvReCs:NmqEG1aWG8ImRkPOybxi7xxJ7UvPrpeC
- TLSH T1BA831903B6E19434E5B22BB46D3452256E7B7D666D38811E7A9C4B4E5FF3A808C36323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52384
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
34B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/Updates.bat
- SHA256 a0be753137489fa5f820cab051d310693236c0d4d90fef5570a87aaba506c6e2
- MD5 0517f2898be9960bafaf6393a05af648
- SHA1 4f36e973709da3fe5d679957127f8773c9f3c5bc
- SHA512 db29be65248acc593342bdbe6be90c974b38715842160624a9de94b6d7551c6857d7a99630c530c0625ece1c73948234f094a44b6ffbf732b59782dfa0856e4a
- TLSH T13C216DAF43999254FCF10FAB795BC3E4EC9F900145E021A2FC2214B6F87E12066137E6
- MD5 SHA1 SHA512 TLSH
bin/bcdedit.exe
- IMPHASH 0591ec8002f106a8a5f4caff08971211
- SHA256 8ab894fc1acdc83d3c54a3bb6ef65f2d8d06ac8015ee39ab52872eb0dd0dd826
- MD5 e48eee77a8a6390b89781ccd1d7bccc5
- SHA1 b978202fc8574d9380f74a1c5b59fa290782079a
- SHA512 5a71b7f550c26196133ae78914f93d1ac4be7962e89ea86d298cb0481e9a522f28393fd43d1d8717927b8a783dc3704d6e9f83964295c6e878765a41dba92e8c
- SSDEEP 3072:eWg56t51b/0MQPdFo7WhYnG8yVZ19AmCE5EP2DbLZZsvtBMhdNV/ysXo3962xKeE:7Xb/YPNhYnGtZ1T5w2lZOuVsWj
- TLSH T1A984301362ED0115F1F27A745AB955708A3BBC91AE3AC69E029C019E4FE3E80CD71B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:06:0b:cd:a4:4b:f4:68:54:d7:ee:09:af:f7:50:08:bd:72:69:f8:02:d9:d6:2d:8a:d2:92:85:2b:15:54:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b3:52:cd:a8:de:ac:4a:9f:18:f3:84:ff:75:55:92:a3:22:95:13:65
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2014 - Jan 1, 2016
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:56:d4:53:f7:ca:e4:56:2c:f8:00:00:00:00:00:56
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Minor OS version
0
Major OS version
10
Entry point
190464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
bcdedit.pdb
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetSidLengthRequired
IsValidSid
AddAccessAllowedAce
InitializeAcl
GetAce
CreatePrivateObjectSecurityWithMultipleInheritance
SetPrivateObjectSecurityEx
GetSidSubAuthority
MakeSelfRelativeSD
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorGroup
IsValidSecurityDescriptor
DestroyPrivateObjectSecurity
GetSecurityDescriptorLength
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
InitializeSid
kernel32
FindResourceExW
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
SearchPathW
TlsSetValue
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
TlsGetValue
GetFileSizeEx
LoadResource
ReadFile
SetFilePointerEx
SetEndOfFile
DeleteCriticalSection
LoadLibraryExA
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetLocaleInfoW
GetVersionExW
CreateFileMappingW
GetUserDefaultUILanguage
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
LocalFree
FormatMessageW
DeviceIoControl
CloseHandle
CreateFileW
WriteFile
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleW
GetConsoleMode
GetFileType
GetStdHandle
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetLastError
FlushFileBuffers
msvcrt
memset
memcmp
memcpy
bsearch
wcsncmp
_aligned_malloc
_aligned_free
malloc
free
_snwscanf_s
_wcslwr
_wcsupr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wsetlocale
towupper
iswspace
_vsnwprintf
swprintf_s
wcschr
wcscpy_s
_ui64tow_s
_wcstoui64
wcstoul
_wcsnicmp
_wcsicmp
memmove
wcscat_s
_ultow_s
wcsncpy_s
wcsrchr
wcsstr
strncmp
wcsnlen
ntdll
RtlNtStatusToDosError
RtlFreeHeap
RtlAllocateHeap
RtlCompareMemory
RtlFreeUnicodeString
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
RtlGUIDFromString
RtlStringFromGUID
ZwOpenMutant
ZwReleaseMutant
ZwWaitForSingleObject
ZwClose
ZwOpenFile
NtOpenFile
ZwQueryAttributesFile
RtlAppendUnicodeToString
ZwUnloadKey
ZwCreateKey
RtlCreateAcl
RtlFreeSid
RtlSetDaclSecurityDescriptor
ZwDeleteValueKey
ZwSetValueKey
ZwSaveKey
ZwCreateFile
ZwQueryValueKey
RtlLengthSecurityDescriptor
ZwSetSecurityObject
RtlAddAccessAllowedAceEx
ZwLoadKey
RtlAllocateAndInitializeSid
ZwDeleteKey
ZwEnumerateKey
RtlLengthSid
RtlCreateSecurityDescriptor
ZwQueryKey
ZwOpenKey
RtlSetOwnerSecurityDescriptor
RtlInitAnsiString
LdrGetProcedureAddress
LdrGetDllHandle
ZwQueryVolumeInformationFile
ZwDeleteFile
ZwQueryInformationFile
NtOpenProcessTokenEx
NtSetInformationThread
RtlImpersonateSelf
NtOpenThreadTokenEx
NtAdjustPrivilegesToken
ZwCreateEvent
ZwQuerySymbolicLinkObject
RtlGetVersion
ZwOpenSymbolicLinkObject
ZwDeviceIoControlFile
ZwResetEvent
NtQuerySystemInformation
ZwAllocateUuids
NtOpenKey
NtDeviceIoControlFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtWaitForSingleObject
NtCreateEvent
NtQueryValueKey
NtSetValueKey
NtResetEvent
NtQueryBootEntryOrder
NtTranslateFilePath
NtCreateKey
NtQueryDirectoryObject
NtOpenDirectoryObject
NtEnumerateBootEntries
NtSetSecurityObject
NtDeleteKey
RtlUpcaseUnicodeChar
NtClose
ZwQuerySystemInformation
_ORCloseHive@4
_ORCloseKey@4
_ORCreateHive@4
_ORCreateKey@28
_ORDeleteKey@8
_ORDeleteValue@8
_OREnumKey@28
_OREnumValue@28
_ORFlushHive@4
_ORGetKeySecurity@16
_ORGetValue@24
_ORGetVirtualFlags@8
_OROpenHive@8
_OROpenHiveByHandle@8
_OROpenHiveInternal@16
_OROpenKey@12
_ORQueryInfoKey@44
_ORQueryInfoKeyEx@16
_ORSaveHive@16
_ORSetKeySecurity@12
_ORSetValue@20
_ORSetVirtualFlags@8
Name
.text
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=243, version=40116,
count=4, id=241, version=40116,
count=20, id=242, version=40116,
count=9, id=239, version=40116,
count=219, id=1, productName=Unmarked objects,
count=59, id=246, version=40116,
count=1, id=238, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
bin/bfi.exe
- SHA256 8f26a3f1a1f6f9ac0c279b7df56c41c79e4f23aaefd7da6e6ded16d091d4ad81
- MD5 edbdd5893d753fa68865ec3ad7dfe06d
- SHA1 8d3a30e823f5d0c5e3fbca135bb04891475219de
- SHA512 0c0e88f1f5100a2f67ee947b86081d1c30507eb018c1484e12b9255f6578aa9e0b59d6e5dbbef8a8e34d9e36e90666d97d44e3f3cc29dbf0f8bb3bc7584e0756
- SSDEEP 1536:gIvqSxs6WCegu1660dUyL0sCtA47jpsV4FjiXDJBE5baPXYUxn5ob2guBtXZ:gIhsJ166QUFJtAKjMXDJBE5kBzvX
- TLSH T12A93026F3E976E3EE53A2A745B08AD285B958C8C23E6D1B74C33531D293720D7349253
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
205360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
89KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=16, id=14, version=7299,
count=52, id=10, version=8047,
count=22, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=136, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
out.upx
- SHA256 0dbfc2bb3f35a8596d0932fbdaf364e492a7807e899e14d7d460d354be1608a4
- MD5 9aadf4488d7f0cd1986b3a55b857f9bc
- SHA1 1b97c1b6b9ca8e91634af1d4a6ab8d39016ae7a0
- SHA512 90b01ca4aa84c54af9497ee32c0c9abfb944b176c5e1177fc426049d123689e3c25e21886c42f7bed1282a763ab24fd08231dfcfdafacc43fc710ba64f1e371d
- SSDEEP 3072:9QLOdhKyyW1biW6Emogs52k9O1Ue77CdHmlTsi+5uMqqDLy/:TBiW67oj2CpmlTzCqqDLu
- TLSH T1D9148D3230C0C2BFC462053254E1A77DEBF9976613398C87EB28AE4D6D215E5D37A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
118076
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=16, id=14, version=7299,
count=52, id=10, version=8047,
count=22, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=136, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
bin/bin64/libwim-15.dll
- IMPHASH 44c0b43fc6c236bd71bf360bb0a11eb1
- SHA256 b8f1f4a0a74bf2b009dcfa8854fd9146cd061ad39b78da24abbed5d9396759f0
- MD5 e00fa5e9967055c31a62410fa4a758a2
- SHA1 334b69f34bb6eb3c4dcd4a3a5ff570642b672ef6
- SHA512 1f0db54b043da9749bda9902b71d9755d6b425856874a00f4005bc0d1ec09c99bd4d84321944ac20f04a0708afaf38f2b67256c06892828781655c7c92052458
- SSDEEP 6144:XFt4kzDh1G6uxe3kTqtZPeCmm2ftxBb5KVZYTY1eb8KR8:XFtD+P2ZRWXFfXG
- TLSH T15DA43B02E3F611ACF1B7D6305AB7567269337C155930EE2E1248C6792F33F50CA29B26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetLastError
Sleep
SleepConditionVariableCS
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_lock
_lseeki64
_open_osfhandle
fwprintf
_telli64
_unlock
_waccess
_wassert
_wcserror_s
_wcsicmp
_wgetenv
_wmkdir
_wopen
_wstat64
_wtempnam
_wunlink
abort
calloc
fclose
feof
fflush
fgetwc
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
qsort
realloc
strchr
strerror
strlen
strncmp
towlower
ungetwc
vfprintf
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstoul
_fdopen
_close
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
336KB
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/bin64/wimlib-imagex.exe
- IMPHASH 7e1c519c36253341efef99f577793739
- SHA256 a2fabc32d5c405c013e29d5b5f553067aeed6896098945e490726269f415d1a2
- MD5 c297992a7e8a207508fe30c71bf2691c
- SHA1 bdbf4936b0450cbaeb679f79bcbd1e719e13f813
- SHA512 9662eee3563be1b9da683353b6b57091f96bce339d8732f1b9031867ac1ec5dbbc939f8adf297afd5c786347eecb5f801766a0f52edafb5e5c47803b87b58299
- SSDEEP 1536:m+jjtz4SVQ8vfli6voZIGq8pStJ0pILoSZ2AKZCzkzCz3P4UclmpNHg4dB:5tzndnvoBq8pSL0LRAFdpclGB
- TLSH T1C2D3E806A3E220ACE5B79A340DF75271AA33BC225634DF1E525CD6791F73E409E24F26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libwim-15
wimlib_add_image_multisource
wimlib_create_new_wim
wimlib_delete_image
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_get_compression_type_string
wimlib_get_error_string
wimlib_get_image_property
wimlib_get_version_string
wimlib_get_wim_info
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join_with_progress
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_image_property
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_gmtime64
_initterm
_lock
_onexit
_putws
_setmode
fwprintf
_unlock
_wcmdln
_wcserror
_wcsicmp
_wfopen
_wgetenv
_wstat64
abort
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memcpy
memmove
memset
realloc
signal
strerror
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsrchr
wcstoul
_wcsdup
_isatty
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
568B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/bootmui.txt
- SHA256 db6a22b19fdcafc344cf4c544cc972bb43aeefa993358ef97f2bd8e19d42f5b8
- MD5 a08f64f779c3fc937945def623f6c331
- SHA1 25b0fef17e4f9fb47fc97f7e00d100a729ae6236
- SHA512 73cdedfb6ec15877d7795dd6c09693fde260dedea8721b44d8c56999416f9222d800d0a08bca59b80762c09d335a5e53c2c338dbd02597d29443dcff0d6fc127
- TLSH T12A014C78F81B086336E1BEF4BCF2084C5E8692E04955EF449139319BF826D349DF0360
- MD5 SHA1 SHA512 TLSH
bin/bootwim.txt
- SHA256 3d808a95c035dae306ad2929de617c7727abecab0bddeb34638f1ba4d3c52e80
- MD5 e70e4bc070958d8537450a1353fbfbbf
- SHA1 9a3ec46f6fd7a8930d3b69285836c3efee09dff2
- SHA512 a9b2bc2e2423d68c418c61441e12f32c6193752070413771bab4be9247cae6db3c452ec8004465d8305ec596a19df7e666a4ad2efde6c128d3fd7f8622922cd1
- TLSH T124418B2DC927840737240FF535CAAE0C65A26946BF23A37088344BEF568792FDE5C0B9
- MD5 SHA1 SHA512 TLSH
bin/cabarc.exe
- IMPHASH c362751f44a9f875b2280fc6dcfae10c
- SHA256 cceaa59cb4e67f993b099c5e2693eb15231de3863e29da14ff130f24b66ff260
- MD5 a02a8702c6c539bd8648ccbb1869a604
- SHA1 c16da959c5aa9f29346e22fb07802cfa8f7b453f
- SHA512 6b871519e6d190d7703aed7e58d11b0bd69b731a44f90be0869efe00d256da982601b69d01721f8002c99d4cb5d36913b171306a79bb62bd4a5f9655f78ec3d3
- SSDEEP 1536:7xJDrXJTUZQM99pEY+7mfZZt7BN6e5ooPzUOmJ9ybae9rvpI0svZWGKAkro7m+8+:7xJDr5T6Wz7mf7tr6EUHJ9ybaOrWbKAf
- TLSH T1D283BF927FE89097CAC752709349B76ABF7847F20511B29F6B189C903A52FC2FF20255
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7b:07:3d:ec:1d:6f:85:c8:1b:53:d4:c2:11:6b:24:a9:4d:4d:c3:27:21:a2:55:6c:42:d0:7a:e1:fa:6c:41:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 15, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
45:43:a5:dc:20:07:fc:17:d6:59:f4:ec:e4:36:eb:bb:a8:50:81:67
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 15, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2a:9f:4b:23:5f:cf:b0:f0:9d:00:00:00:00:00:2a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Minor OS version
0
Major OS version
5
Entry point
18304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
msvcrt
fgets
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
fopen
malloc
__p__fmode
__set_app_type
_except_handler3
_controlfp
isspace
fclose
_getch
time
srand
rand
strchr
_tempnam
free
memmove
sprintf
strrchr
strncpy
isdigit
atoi
_stricmp
_strnicmp
toupper
printf
exit
_adjust_fdiv
__p__commode
kernel32
SetFilePointer
WriteFile
ReadFile
LocalFree
LocalAlloc
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
CreateDirectoryA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
CreateFileA
GetLastError
GetFileInformationByHandle
CloseHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=2, id=19, version=9049,
count=40, id=2, version=7274,
count=1, id=6, version=2090,
count=60, productName=Unmarked objects (old),
bin/cdimage.exe
- IMPHASH d7b38d0f2022ae83ed59a720772478e0
- SHA256 0b82e3775615e8f7babf5cf5be59c836d397ea7dbf1871bd5fdf4bedceaead86
- MD5 c9d5d0ea346d48185ac2eef836ba04a2
- SHA1 805f26e7a8450502201ceceb5dd041152780f639
- SHA512 65944e597b23669cb9a1b3b82043c7b08f5d4e7514147a18a4817011e5594033dc820617e9d11ed5b2bbd9539d6449d471327c7521d4a21e9a23be3db9e96025
- SSDEEP 1536:k934eRJXKj7KghBvawIpt6Vrw4tZCGGqHZUJdl4ivdUKgJubS5EJ17NNfPD+AQ:k934eR1Kj7R2PqiPvGH5EJ17NpB
- TLSH T1E6C38D12DBC442B5C4D320F4379CB3B199BDD97E032A1AC73B4C47E46454BD2E6B2A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
95952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
CDIMAGE.pdb
kernel32
GetVersionExA
SetErrorMode
GetSystemTime
SystemTimeToFileTime
SetFileApisToANSI
SetFileApisToOEM
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
lstrlenW
FindFirstFileW
FindFirstFileA
FindClose
GetLongPathNameW
GetLastError
GetLongPathNameA
HeapFree
CreateFileW
CreateFileA
CloseHandle
WaitForSingleObject
SetEvent
FileTimeToSystemTime
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
ReadFile
GetFileTime
GetFileInformationByHandle
FindNextFileA
FindNextFileW
GetOverlappedResult
SetEndOfFile
SetFilePointer
CreateEventA
WriteFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetModuleHandleA
GetProcessWorkingSetSize
SetProcessWorkingSetSize
InitializeCriticalSection
VirtualFree
SetConsoleCtrlHandler
ExitProcess
FormatMessageA
GetProcessHeap
HeapAlloc
VirtualAlloc
VirtualLock
ResetEvent
GetProcAddress
ReleaseSemaphore
CreateThread
WaitForMultipleObjects
SetThreadPriority
CreateSemaphoreA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
msvcrt
strrchr
_stricmp
wcstok
strtok
_wfopen
fgetws
_wcsicmp
fclose
fopen
fgets
_strnicmp
_strtoui64
strtoul
tolower
atoi
srand
time
vfprintf
_ultoa
rand
_wcsnicmp
_errno
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
memcpy
memset
?terminate@@YAXXZ
_controlfp
isleadbyte
_fileno
free
mbtowc
__mb_cur_max
_snprintf
_itoa
wctomb
malloc
ferror
__badioinfo
__pioinfo
_isatty
_write
_lseeki64
wcsrchr
wprintf
strchr
wcschr
_strupr
wcsncmp
exit
printf
fflush
fprintf
_iob
feof
memcmp
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=205, version=65501,
count=14, id=207, version=65501,
count=69, id=206, version=65501,
count=5, id=203, version=65501,
count=169, id=1, productName=Unmarked objects,
count=13, id=210, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
bin/imagex.exe
- IMPHASH 6816108faf77a6c11f4b9ffc7bae891f
- SHA256 4edb6afb13477de51459096cc3f7d2a497f053fecf05cc3c360451fede667848
- MD5 a452fd6f47c7f603c2c2034dacc8cac4
- SHA1 81beb20db768bc42d5e7df7d77a02d792d5ef92e
- SHA512 0b4b211df29fe208a2d3f44c4c065cd840f991ae02a48bcecd0d886e7e52df51bd4c707f0f927f5955fe36f40a0eb9f751240f143e5f165be33f0b6e9ecde3e7
- SSDEEP 12288:x+gWMYl2snR/Dbzw6Cf2rkKul/WDsk+VR9QikUmInpNgvsPPetKAr/GhME1BA5Of:/7bsnRNCf2r7ulOikUmiNTMO5
- TLSH T16BD46B21B6E8403EF7F335B04D392669597EB9626A70C88F53808D5D19716C0EA387BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:c9:0c:a3:10:28:64:07:22:71:32:f6:f5:7d:4c:f8:00:36:dd:d5:0f:f1:ce:d0:09:54:dc:4d:b7:e3:e9:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8b:bc:9b:e8:61:73:33:98:ac:ab:d0:0d:13:29:14:8f:9c:bc:1d:09
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b1:71:13:79:df:75:f6:35:c8:00:00:00:00:00:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
10
Entry point
546960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
imagex.pdb
msvcrt
_lock
_except_handler4_common
memmove_s
_strcmpi
wcstoul
_unlock
_wcsupr
_snwprintf_s
qsort
_wcsrev
_wcslwr
_strnicmp
__dllonexit
strcpy_s
_wcstoi64
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_onexit
_exit
wcsstr
wcsncmp
wcsnlen
exit
__set_app_type
swscanf_s
towupper
_wcsnicmp
wcschr
_vscwprintf
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wtoi
wcsrchr
_wtol
fflush
memmove
_wcsicmp
__iob_func
memcpy
memcmp
printf
iswspace
_purecall
malloc
_callnewh
_cexit
bsearch
free
memcpy_s
memset
_vsnwprintf
ntdll
DbgPrintEx
NtYieldExecution
RtlRaiseStatus
RtlReAllocateHeap
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlInitUnicodeString
NtQuerySecurityObject
RtlImpersonateSelf
NtSetEaFile
NtCreateFile
NtQueryEaFile
NtQueryVolumeInformationFile
NtQueryInformationProcess
NtQueryInformationFile
RtlAdjustPrivilege
NtClose
NtQueryDirectoryFile
NtOpenFile
RtlDosPathNameToNtPathName_U
NtSetSecurityObject
RtlFindAceByType
RtlSetControlSecurityDescriptor
RtlGetLastNtStatus
RtlFreeHeap
RtlAllocateHeap
NtSetInformationFile
RtlNtStatusToDosError
RtlGetVersion
kernel32
MapViewOfFile
CreateFileMappingW
lstrcmpW
CreateSemaphoreW
GetDriveTypeW
GetTempFileNameW
DeleteFileW
GetTempPathW
GetLogicalDrives
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
UnmapViewOfFile
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
WaitForMultipleObjects
ReleaseSemaphore
GetPrivateProfileSectionW
DuplicateHandle
UnlockFileEx
LockFileEx
GetVolumeInformationByHandleW
GetSystemWindowsDirectoryW
GlobalMemoryStatusEx
TerminateProcess
FindClose
GetFinalPathNameByHandleW
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
CreateEventW
OpenProcess
ReleaseMutex
LocalAlloc
GetModuleHandleExW
CreateMutexW
HeapReAlloc
RemoveDirectoryW
SetFilePointer
GetFileSize
GetCurrentThread
SetThreadIdealProcessor
GetSystemInfo
DeleteCriticalSection
GetOverlappedResult
ReadFile
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
GetHandleInformation
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
CreateDirectoryW
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetLastError
WriteFile
GetConsoleMode
GetConsoleScreenBufferInfo
WriteConsoleW
SetConsoleCursorPosition
GetStdHandle
InitializeCriticalSection
FlushFileBuffers
CopyFileExW
GetFileInformationByHandle
SetFileAttributesW
CreateFileW
DeviceIoControl
GetCurrentDirectoryW
LoadLibraryExW
FindNextFileW
GetVolumePathNamesForVolumeNameW
LoadLibraryW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
MultiByteToWideChar
CreateSemaphoreExW
GetExitCodeProcess
CreateProcessW
GetLogicalDriveStringsW
FindFirstFileW
FreeLibrary
GetModuleHandleW
SetConsoleCtrlHandler
GetModuleFileNameW
WaitForMultipleObjectsEx
GetFullPathNameW
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetTickCount64
GetSystemDirectoryW
GetFileAttributesW
CompareStringW
GetCommandLineW
SetLastError
GetEnvironmentVariableW
LocalFree
WaitForSingleObject
OpenEventW
FormatMessageW
HeapFree
SetEvent
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateThread
GetProcAddress
FillConsoleOutputCharacterW
user32
CharPrevW
LoadStringW
CharNextW
CharUpperW
shlwapi
PathMatchSpecW
StrStrIW
setupapi
SetupFindFirstLineW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextW
rpcrt4
UuidFromStringW
RpcStringFreeW
UuidToStringW
RpcBindingFree
RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
UuidCreate
I_RpcMapWin32Status
NdrClientCall2
RpcStringBindingComposeW
fltlib
FilterLoad
FilterAttach
cabinet
ord22
ord20
ord23
advapi32
GetSecurityInfo
SetSecurityDescriptorDacl
EqualSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetTokenInformation
OpenThreadToken
InitializeSecurityDescriptor
RegUnLoadKeyW
RegLoadKeyW
GetAclInformation
GetSecurityDescriptorLength
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegCloseKey
RegDeleteKeyExW
RegFlushKey
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
AdjustTokenPrivileges
AllocateAndInitializeSid
OpenProcessToken
FreeSid
CheckTokenMembership
OpenEncryptedFileRawW
WriteEncryptedFileRaw
CloseEncryptedFileRaw
RevertToSelf
ReadEncryptedFileRaw
RegQueryInfoKeyW
SetThreadToken
AddAccessAllowedAceEx
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
bcrypt
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
Name
.text
Size
536KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=24610,
count=20, id=260, version=24610,
count=322, id=1, productName=Unmarked objects,
count=13, id=257, version=24610,
count=4, id=261, version=24610,
count=146, id=264, version=24610,
count=1, id=255, version=24610,
count=1, id=258, version=24610,
bin/libwim-15.dll
- IMPHASH 5246d9411a3af41e1bb12a7f476de9a6
- SHA256 e1b005c0f1391b30357e64885a08a09a2d41de93b38acaa25ed7a355f74f56b4
- MD5 cb5fce32bb4559e6c078f68257b8cf03
- SHA1 c6181dd756007700322d5fb519f0697dd56a671f
- SHA512 a175be59ea81bfe2ad9d4590861e6634e089c025187552c2b7c0e023ad19af15588fb0f768c8c7f33f23c41f78f939a214aa1ffb68059a6b84e8fa03f260a395
- SSDEEP 12288:hkqblT/iOQw4/kNJjNyvO5ZOjXRrZfFwoCiHk:hkqblriO0k7xCOahZ9wGHk
- TLSH T14AB42A85EBC710F4F5B3AA70997AE37F4A327D019834DE7DEB0D554AB933A018928316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
IsDBCSLeadByteEx
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
ReadFile
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetLastError
Sleep
SleepConditionVariableCS
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
msvcrt
__mb_cur_max
_amsg_exit
_assert
_errno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_iob
_lock
_lseeki64
_open_osfhandle
fwprintf
_telli64
_unlock
_waccess
_wcserror_s
_wcsicmp
_wgetenv
_wmkdir
_wopen
_wtempnam
_wunlink
abort
atoi
calloc
fclose
feof
fflush
fgetwc
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
qsort
realloc
setlocale
strchr
strerror
strlen
strncmp
towlower
ungetwc
vfprintf
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstombs
wcstoul
_wstat64
_fdopen
_close
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
351KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/offlinereg.exe
- SHA256 6ad78c3e6a07ec84bbe399f3be156edc3ee1da525bd87f7c0c716846708a111a
- MD5 6dc5ad65078eb5229fbbd1f06f61cf0b
- SHA1 e0f89640230db562d32099c4851e1ebb90dcfc98
- SHA512 a91f2dbf7b2435461805c3d756f5ac1eff27da8d84c9e3076e8cd1ac9ebcc9bbad77820d0eb3bfe3ea0de91d50fe69549baac9687ffa536d27522d8a775d57ec
- SSDEEP 3072:Pp/5MaKYvuo3Khqef9uVrAgXuQbkX2hgqjYDsqLhPEcrrFm9gh:P1mgt3w9J2gqjYDsqLhP70
- TLSH T1B5B33B22B2D08472E0709E7CCC15B2E4943AFDA12D68956AB7F85E4DCE393C1686D3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
99520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/offreg.dll
- IMPHASH 7f06a5f1ddbdb3daa4bd9e267b9e1f4c
- SHA256 a8e3149c77c235818cbbf2686cecd66683e2d3864860074f0777c13b1140a9a2
- MD5 163db46b803e4c83c444a026ff17d269
- SHA1 0a2585db6a5c2f7f467fd85df622e9c0632b9b2e
- SHA512 9a14ef16e30f8bf72a89fe3154e04d879d1ce8bbdcee4942dcdfb74da6e5584a19853b64ee4a36fb9af04e2e641f1e0ba04b2f5187e2ceeaf9085685e1d78c31
- SSDEEP 768:V5zyp6v0wj3hpUTAvZxdW9UzjzvH+qREOtJWS1temkz1ImTWvERLkEzrBJOkMm75:bv02hphxdSevH+uJWEMb9TWWkEZQ0
- TLSH T17A437D22B52481BBC4DA75B1215E7276293EC7820B219ACF07761DF6B9617C09F387CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
13:3f:33:a4:99:03:ab:e0:5c:63:75:f6:fe:c4:d9:6b:4d:c1:a9:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 9, 2010
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:04:b3:f5:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2008 - Jul 25, 2011
Subject
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:23:0f:00:00:00:00:00:0a
Issuer
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:02:dc:00:00:00:00:00:0b
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 15, 2005 - Mar 15, 2016
Minor OS version
1
Major OS version
6
Entry point
6067
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
offreg.pdb
msvcrt
_wcsicmp
_aligned_malloc
_aligned_free
towupper
_wcsnicmp
memmove
memcpy
memset
_amsg_exit
_initterm
free
malloc
_XcptFilter
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryA
TlsFree
TlsAlloc
TlsGetValue
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
GetProcessHeap
CreateFileW
CloseHandle
ReadFile
WriteFile
GetFileSizeEx
FlushFileBuffers
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
TlsSetValue
GetSystemTimeAsFileTime
TerminateProcess
advapi32
InitializeSid
DestroyPrivateObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorControl
MakeSelfRelativeSD
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetPrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
GetSidLengthRequired
GetSecurityDescriptorLength
GetSidSubAuthority
ORCloseHive
ORCloseKey
ORCreateHive
ORCreateKey
ORDeleteKey
ORDeleteValue
OREnumKey
OREnumValue
ORGetKeySecurity
ORGetValue
ORGetVersion
ORGetVirtualFlags
OROpenHive
OROpenKey
ORQueryInfoKey
ORSaveHive
ORSetKeySecurity
ORSetValue
ORSetVirtualFlags
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=115, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=83, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bin/wimlib-imagex.exe
- IMPHASH 78477e4f732fb9f2e42908debcac154e
- SHA256 01168a00ffc84ebfa1bd3b9c841214ed114b9ae4e9b23d555c0686448fd56bde
- MD5 c0605496fa0a86bcc78dbe13bd7aa29c
- SHA1 102df32a155a895a3a79f15b00b10c01e7862b6d
- SHA512 9059a28326cc9f739fdec85d1e5397d40302992b2d75832a44e58b051dc31cd43f5ca5107240897f81b9546bf1161d6f0418908043b406459260588286a3f555
- SSDEEP 3072:R54W0y7EBY6FrtTrQgjQnGIlSLqo5cN2bm:RCW0yATrtTrQgjQ5lRo5Qym
- TLSH T11FE3F804F7D750F1F5736AB05DBAD37E4A33BD128938CE2EE74C564AAA37A404624722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libwim-15
wimlib_add_image_multisource
wimlib_create_new_wim
wimlib_delete_image
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_get_compression_type_string
wimlib_get_error_string
wimlib_get_image_property
wimlib_get_version_string
wimlib_get_wim_info
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join_with_progress
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_image_property
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__mb_cur_max
__p__commode
__p__fmode
__p__wcmdln
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_errno
_gmtime64
_initterm
_iob
_lock
_onexit
_putws
_setmode
fwprintf
_unlock
_wcserror
_wcsicmp
_wfopen
_wgetenv
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memcpy
memmove
memset
realloc
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsrchr
wcstoul
_wstat64
_wcsdup
_isatty
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
convert-UUP.cmd
- SHA256 17925ce37ada507f65db22c423832bc42cef9ca3913700e863734fbf592cc96e
- MD5 731e8e4d69586eb3811c1d238191ad4d
- SHA1 66bc1b5b1f87fd5f474f539a1c30d373afc6c674
- SHA512 cf685ae3f4f6092da555fa0e498d02ada587259b787bff4a882b6e9c1b379e9b2418f137ab337377ac3d1dee56cb90af0dce528bfaf6333e01fa04fa49b3293b
- SSDEEP 3072:ipMJzX+ygvKcb2VRJtjsTIePhk1RJttKW0D4vCXxYGFt2zgafcrkx/81CZqIUBOl:ipMJzX+ygvKcb2VRJtjsTIePhk1RJtt3
- TLSH T1B404095871481166E0F54BB9A2660283BB3FD9735230E3BC773994B4F9F72A310B9AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
create_virtual_editions.cmd
- SHA256 5b3dec361efe27b1c5df00e88a9b355a658a65391febad314c6702afd20059a8
- MD5 7dd29996aca8210300bcb6705f3195d9
- SHA1 089f55e62f3c3e3bd26d0e1a3ced237e26564a7e
- SHA512 ee6fc126ab64006c6644fed45f47dfb17a0ef7e2ea7c2896e4eacf6122f85e9859e1c6edd720a28125844d6a40ecfd46ed8c5f383a8b612f4c2bf3d67b8b2a23
- SSDEEP 1536:5WtDICKwIci0EaScCXqghtm6N0H/sZTR0yckNLZgyZZZ0Z7ayo7kJXp+jVkWPO:YVICKwIci0EaScCXqghtm6N0H/sZTiy6
- TLSH T13293A5943494012AF4BF837296F1B9422BBFF0E20BF1DE4C713894A077DB58699B598D
- MD5 SHA1 SHA512 SSDEEP TLSH
multi_arch_iso.cmd
- SHA256 a95d1b898dd99790bd859e4b2e84c6f9cf39538759983576d596a293d14d6944
- MD5 49b2b6e2532808675d8971581c3ad210
- SHA1 a80f2b4238d7ab5eea311d5a864ede8bb26dde35
- SHA512 e52a359e17247b991f049ba2b10ab8725d85daee2db208ef511a791e055164d729994f8cdab1cbeccc671237c608a7d18b8605cb97deab81ca040a3349b65225
- SSDEEP 768:yTCTMSpyb6PLqj5k1pQyV4ZNuC38X6JZXiQKwGg7lw2ayo7kJnSO+jVUJ:DTMSpAoLqj5k1pQyV4ZNuC38X6JdlhaK
- TLSH T191F2E974310B5232A0A187B2E9379046772FD5228670F7CC753D80E476BB3A6A5F6DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
lot_size_files_clear_away.cmd
- SHA256 7e9570228ef135c09eb43ba9ff26d9239ef76fc2026413394891fbc92c02877d
- MD5 cdccd15239db325ef65a322b5861cadb
- SHA1 ae1c7b7baa7156a2682e77aa3e88197c35be1340
- SHA512 e56826505542037f7c41f7011b202592214aa7fb48dc547ba71a3af5a7990bb3d0c096039923251b5ebfb3181a292bf2b3f20674c8ea0085bc33c8840a84f38d
- TLSH T1EBF067E72814262682801BA8CF9C04B6A0CED0E3FD215830F1F70C9AE03BB304A5BEC0
- MD5 SHA1 SHA512 TLSH
uupdownload - app.cmd
- SHA256 836c268e273afea54e30fa36625425d1f46699c302d1545ebd0e9e2245e60338
- MD5 782a4e5d5792cbe3b548ee89f46b574e
- SHA1 d1a962c425c4573b1ce05eb7a0a25cf1107aef7f
- SHA512 77e74c742ac93966fe040747a07b240542eda933b44b1f072188fc23c8b5a7a81d3f403b9f99bfddb12358629c12f4650e85d5631ef64b82447b719d3f119675
- SSDEEP 384:00xPxXsbRgH77zEhh19aZBfmS9h9h6OtS7CPd3GP:00xPxsuH77Sh7cBfmS9h9h6Os7CPd3GP
- TLSH T1C6C20012BE4C60EA65FDEED4DE70D825F639E387452C7D48F2AB092E6B43780386D644
- MD5 SHA1 SHA512 SSDEEP TLSH
uupdownload - legacy.cmd
- SHA256 2b46ab58fc87b25291b3b10d2afb7e3aad172c4c1f1aaadb8f4f3fb085a9fab0
- MD5 bc35df043fccd424331ddcbaf1ec8c1b
- SHA1 9d0f2edc8ae8aaa155712e4a71dcd2cd6c9eebe3
- SHA512 62c4a58c58782717be6452b90b1b36033582e746cafa4de7a5b1c1329658e10ca3bf44f6ef0832018466a575854af9587506fc6e3e66ac0460af5aa4877b470b
- SSDEEP 768:n0xPx4SG+7UpZhZuBfjSa+h9h6Omxz7b9OmdvhLHMCkPd3GP:n0xPxhG+UXZuZjSa+h9h6Omxz7b9Om5H
- TLSH T160233335BC689096B1F8CA919E30AC35FA3AF383852CEB44F57B05297B5B6C0397C645
- MD5 SHA1 SHA512 SSDEEP TLSH