UUPdownload_with_converter_v4.3.770.2.7z
- SHA256 75002110309da2163f8887124e1b6fbc8ad4451b317bf4d1f00032cdf0081e5b
Overview
overview
8Static
static
5files/7zr.exe
windows10-2004-x64
3files/7zr.exe
windows11-ltsc_2024-x64
3files/aria2c.exe
windows10-2004-x64
1files/aria2c.exe
windows11-ltsc_2024-x64
1files/depends_win.ps1
windows10-2004-x64
8files/depends_win.ps1
windows11-ltsc_2024-x64
8files/lang.cmd
windows10-2004-x64
3files/lang.cmd
windows11-ltsc_2024-x64
3ReadMe.html
windows10-2004-x64
3ReadMe.html
windows11-ltsc_2024-x64
3Remove_Fai...ir.cmd
windows10-2004-x64
3Remove_Fai...ir.cmd
windows11-ltsc_2024-x64
3bin/7z.dll
windows10-2004-x64
3bin/7z.dll
windows11-ltsc_2024-x64
3bin/7z.exe
windows10-2004-x64
3bin/7z.exe
windows11-ltsc_2024-x64
3bin/CompDB_App.ps1
windows10-2004-x64
3bin/CompDB_App.ps1
windows11-ltsc_2024-x64
3bin/PSFExtractor.exe
windows10-2004-x64
1bin/PSFExtractor.exe
windows11-ltsc_2024-x64
1bin/SxSExpand.exe
windows10-2004-x64
3bin/SxSExpand.exe
windows11-ltsc_2024-x64
3bin/Updates.bat
windows10-2004-x64
3bin/Updates.bat
windows11-ltsc_2024-x64
3bin/bcdedit.exe
windows10-2004-x64
3bin/bfi.exe
windows10-2004-x64
5bin/bfi.exe
windows11-ltsc_2024-x64
5bin/bin64/...15.dll
windows10-2004-x64
1bin/bin64/...15.dll
windows11-ltsc_2024-x64
1bin/bin64/...ex.exe
windows10-2004-x64
1bin/bin64/...ex.exe
windows11-ltsc_2024-x64
1bin/cabarc.exe
windows10-2004-x64
3Behavioral task
behavioral1
Sample
files/7zr.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
files/7zr.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
files/aria2c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
files/aria2c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
files/depends_win.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
files/depends_win.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
files/lang.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
files/lang.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
ReadMe.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral10
Sample
ReadMe.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral11
Sample
Remove_Failure_MountDir.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Remove_Failure_MountDir.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
bin/7z.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
bin/7z.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
bin/7z.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
bin/7z.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
bin/CompDB_App.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
bin/CompDB_App.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
bin/PSFExtractor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
bin/PSFExtractor.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
bin/SxSExpand.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
bin/SxSExpand.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
bin/Updates.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
bin/Updates.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
bin/bcdedit.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
bin/bfi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
bin/bfi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
bin/bin64/libwim-15.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
bin/bin64/libwim-15.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
bin/bin64/wimlib-imagex.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
bin/bin64/wimlib-imagex.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
bin/cabarc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target UUPdownload_with_converter_v4.3.770.2.7z
- Size 3.8MB
- Sample261030-2sg7dssvct
- SHA256 75002110309da2163f8887124e1b6fbc8ad4451b317bf4d1f00032cdf0081e5b
- MD5 70e6a5a97b0b6a68de7bf838a9372e24
- SHA1 83dd52cfa317466f65241b971fa81c906e4ec403
- SHA512 1801db5d23f59c894541501a6a3b0d6440ae8162f2b712e1155f3ae04832b2446ee0261bda920426c8f2459a727a78dcce71027e2754ba211bb014e9aa254228
- SSDEEP 98304:G6RpumcbnO2Cp9qVzk9FCJ4tRw++dhmAX4Js2C0ldX:G2ULO2Cp9qVzkvTWnhz4JsB0ldX
- TLSH T1CC0633E4F065B3C2C3643E1008EB165DF91DE065B84E5B35DC8B97E4F24B46EA0D26AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack002/bin/bfi.exe upx static1/unpack004/bin/bfi.exe upx - Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/files/7zr.exe unpack001/files/aria2c.exe unpack002/bin/7z.dll unpack002/bin/7z.exe unpack002/bin/PSFExtractor.exe unpack002/bin/SxSExpand.exe unpack002/bin/bfi.exe unpack003/out.upx unpack002/bin/bin64/libwim-15.dll unpack002/bin/bin64/wimlib-imagex.exe unpack002/bin/cdimage.exe unpack002/bin/libwim-15.dll unpack002/bin/offlinereg.exe unpack002/bin/wimlib-imagex.exe unpack004/bin/7z.dll unpack004/bin/7z.exe unpack004/bin/PSFExtractor.exe unpack004/bin/SxSExpand.exe unpack004/bin/bfi.exe unpack005/out.upx unpack004/bin/bin64/libwim-15.dll unpack004/bin/bin64/wimlib-imagex.exe unpack004/bin/cdimage.exe unpack004/bin/libwim-15.dll unpack004/bin/offlinereg.exe unpack004/bin/wimlib-imagex.exe - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/bin/offreg.dll unpack004/bin/offreg.dll
File Explorer
-
UUPdownload_with_converter_v4.3.770.2.7z.7z 3.8MB
-
ChangeLog.txt13KB
-
ConvertConfig.ini450B
-
ReadMe.txt16KB
-
UUPs/.README134B
-
files/7zr.exe.exe 564KB
-
files/aria2c.exe.exe 5.3MB
-
files/depends_win.ps1.ps1 2KB
-
files/lang.cmd.cmd .vbs 26KB
-
files/uup-converter-wimlib_EN-US.7z.7z 1.8MB
-
ConvertConfig.ini501B
-
CustomAppsList.txt2KB
-
ReadMe.html.html 28KB
-
Remove_Failure_MountDir.cmd.cmd .bat 2KB
-
UUPs/.README134B
-
bin/7z.dll.dll 1.1MB
-
bin/7z.exe.exe 324KB
-
bin/CompDB_App.txt.ps1 3KB
-
bin/PSFExtractor.exe.exe 12KB
-
bin/PSFExtractor.exe.config.xml 186B
-
bin/SxSExpand.exe.exe 85KB
-
bin/Updates.bat1KB
-
bin/bcdedit.exe.exe 369KB
-
bin/bfi.exe.exe 90KB
-
out.upx.exe 188KB
-
bin/bin64/libwim-15.dll.dll 774KB
-
bin/bin64/wimlib-imagex.exe.exe 135KB
-
bin/bootmui.txt759B
-
bin/bootwim.txt2KB
-
bin/cabarc.exe.exe 79KB
-
bin/cdimage.exe.exe 117KB
-
bin/imagex.exe.exe 633KB
-
bin/libwim-15.dll.dll 823KB
-
bin/offlinereg.exe.exe 115KB
-
bin/offreg.dll.dll 54KB
-
bin/wimlib-imagex.exe.exe 144KB
-
convert-UUP.cmd.cmd .bat 164KB
-
create_virtual_editions.cmd.cmd .bat 87KB
-
multi_arch_iso.cmd.wsf .bat 35KB
-
files/uup-converter-wimlib_ZH-CN.7z.7z 1.8MB
-
ConvertConfig.ini501B
-
CustomAppsList.txt2KB
-
ReadMe.html.html 29KB
-
Remove_Failure_MountDir.cmd.cmd .bat 2KB
-
UUPs/.README134B
-
bin/7z.dll.dll 1.1MB
-
bin/7z.exe.exe 324KB
-
bin/CompDB_App.txt.ps1 3KB
-
bin/PSFExtractor.exe.exe 12KB
-
bin/PSFExtractor.exe.config.xml 186B
-
bin/SxSExpand.exe.exe 85KB
-
bin/Updates.bat1KB
-
bin/bcdedit.exe.exe 369KB
-
bin/bfi.exe.exe 90KB
-
out.upx.exe 188KB
-
bin/bin64/libwim-15.dll.dll 774KB
-
bin/bin64/wimlib-imagex.exe.exe 135KB
-
bin/bootmui.txt759B
-
bin/bootwim.txt2KB
-
bin/cabarc.exe.exe 79KB
-
bin/cdimage.exe.exe 117KB
-
bin/imagex.exe.exe 633KB
-
bin/libwim-15.dll.dll 823KB
-
bin/offlinereg.exe.exe 115KB
-
bin/offreg.dll.dll 54KB
-
bin/wimlib-imagex.exe.exe 144KB
-
convert-UUP.cmd.cmd .bat 164KB
-
create_virtual_editions.cmd.cmd .bat 86KB
-
multi_arch_iso.cmd.wsf .bat 34KB
-
lot_size_files_clear_away.cmd489B
-
uupdownload - app.cmd.cmd .bat 28KB
-
uupdownload - legacy.cmd.cmd .bat 33KB
ChangeLog.txt
- SHA256 9cf4a20fa0dd0ab5f6c33701037080af7bd959362e6718f1826b25d40fa7c620
- MD5 95c0af79bd06b2d69e5aac2ed0538022
- SHA1 78e37c9bdeac2d11e1b00c4ac115ca744f18cbb8
- SHA512 21824557b5792081eb769fdc6f24022be2c8e832bbbaea658c026306106830477420e679ccb97eeb7b3f9c47ea22baca7d2715d05173fde5463c9b637aafee99
- SSDEEP 384:zD/OIbLnIpp0Jhz/2gU1nvxM5Jz/qIwHfe/WZ:f/xb6prSkQWZ
- TLSH T1AC521DAC1A34D88D33F3319603AFA15A7608674B84B1B044D95D4C5F3E80FAF99E7B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
ConvertConfig.ini
- SHA256 59da98962e46696f3b8855aedc0e41492b867bb14d870870e07121572ed3d418
- MD5 b9f6a94f3e3f9f1f47e813b3b06d46ff
- SHA1 e70294fe0c5c240e045ea1fad2f828a0a3a32061
- SHA512 2c9ceefb3454baf30201f04dc4fc9f80ee9d7830f893384da53d997bfd34d068cc0e39b394355ea233035bfd07699f6ba2f0cc6d1a5ccd61bbc40365d6508524
- TLSH T190F0224629438AFE08F3D1005FF115A171E58083ADB2214539EC63EC2F262951AB8BD2
- MD5 SHA1 SHA512 TLSH
ReadMe.txt
- SHA256 6db5bba88fa83b3210cd840cd7b03da1373969474d5999e5f45731ab80460399
- MD5 16647b6b315aeedff0d683bb61a7e245
- SHA1 8914ff82c60449dd07d64d0c2d81068b094d3265
- SHA512 b2660b1c05b53d2e1eda277633fcd5a425f77f2f43211984c85aac6a834b24758984e8a2f4b8841f3776ebd47672ef4e8806c361c92bb0fd7ea1c6843a9fd540
- SSDEEP 384:Sa+hjcLqv5ew5M5F5JO5Ww3Lywew5M5r5JJ5Ww3LJb+GeR5xRZJ8Hrh:SpUqv5E2LZCbLIGebxH4h
- TLSH T1F272C6F5856608F9638221D613FCE612F26CB3279037B11AE80945993F59F2F45E2E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
UUPs/.README
- SHA256 bc42527deae7f8d2e5645015cd1a6c11153da791777d6ccbe9ef71b3ae86b244
- MD5 c013ca3a8da389fbdecb49c6b0a5e913
- SHA1 84a9534cfcc9040e9aaaf3cb809e29aae9cc87ae
- SHA512 e70c8d331000425fc740e02436cf23d7a39762bccb3c35dd45a1c235a83115670d86bc72db31230eb373c28836be681f27e72c14b74ccfe0b9615d080069d12b
- TLSH T1F6C02B63794794004496A180B349CC67C58CF0BCC5B050083CAC0011944705611B4473
- MD5 SHA1 SHA512 TLSH
files/7zr.exe
- IMPHASH 48100a28ca52634cd3f15be598a7e810
- SHA256 5e47d0900fb0ab13059e0642c1fff974c8340c0029decc3ce7470f9aa78869ab
- MD5 f86bb4469587005a6717649c9b160f70
- SHA1 f229314ebbed02098a4adb33b706d68026d866fc
- SHA512 a7881fe868c34124efa567b09274a885d05aef008914e5d341c4b8ead58451d1b29f4ace9782cd0c93d3c8fd1acb1f6e1e6cbb5b19cd51223295777b223c1366
- SSDEEP 12288:W8wKMieUWaxG8AchmRWZesGoK3n6cZ+l8App/FrUFv8KAcxO90:W37UWaxCcsYZ5Gou6w+l9p/VUFv8Kxe0
- TLSH T1DCC49E167AF1C07ED65221308B1D6BB5D0FA93680B3208C763844E6D2F759E6D73B93A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
457826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear
user32
CharUpperW
advapi32
OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
exit
_ftol
realloc
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno
kernel32
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ResumeThread
CreateFileW
WaitForSingleObject
InterlockedIncrement
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
GetFileSize
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
GetLogicalDriveStringsW
SetThreadAffinityMask
Name
.text
Size
470KB
Virtual Size
469KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=135, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=27, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
files/aria2c.exe
- IMPHASH 8a0d3862e1ea2d35f958e84f4fe6382c
- SHA256 2646c5d3eb8b0fc57e85f30434cef3d3a261d01f065fc4ad23f020c31f1dd6bd
- MD5 53d237cbbdac5ae3dc65c9ee8a51094d
- SHA1 b2aa5c6150f556f3fa6f6904ac57befc07a14b6d
- SHA512 7a29d0fbcca4402c32756ccdf8b8c79a36512d005f695d8eb9b8c88412a57d916e581ae58c55451cf6210cd76d6bdc166121492b1b653719d30a4758a7c3a5cb
- SSDEEP 49152:fcqNj1f/q2nGRqnv9KCnLEVmx6oqgemsheXhWo4liMCgyyOOK8uDjWmLSfPcZv4+:FfS2Kqn4CnLEslfYexusOK8gyo4
- TLSH T102462827E2A350ECC27BC170476BA273B931F81911307A7F7698DB752F21E60566EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptFinishHash
BCryptGenRandom
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptSignHash
BCryptVerifySignature
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptDecodeObjectEx
PFXImportCertStore
PFXIsPFXBlob
iphlpapi
GetAdaptersAddresses
kernel32
AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateSemaphoreW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExpandEnvironmentStringsA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentVariableW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReadFile
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_assert
_beginthreadex
_cexit
_commit
_commode
_difftime64
_endthreadex
_errno
_filelengthi64
_fileno
_fmode
_fstat64
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_setmode
_stricmp
_strnicmp
_time64
_unlock
_wfopen
_wfsopen
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wrmdir
_wsopen
_wstat64
_wunlink
abort
acos
asctime
asin
atan
calloc
cosh
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
isxdigit
ldiv
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
perror
putc
putwc
qsort
raise
rand
realloc
rewind
setlocale
setvbuf
signal
sinh
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strrchr
strstr
strtol
strtoul
strxfrm
tan
tanh
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcstombs
wcsxfrm
_tzname
_write
_tzset
_strnicmp
_strdup
_read
_open
_lseek
_isatty
_fileno
_fdopen
_dup
_close
secur32
AcceptSecurityContext
AcquireCredentialsHandleW
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesA
shell32
CommandLineToArgvW
ws2_32
WSASend
freeaddrinfo
getaddrinfo
gethostname
getnameinfo
getservbyname
getservbyport
wsock32
WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
516KB
Virtual Size
515KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
256KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
files/depends_win.ps1
- SHA256 913d60aaf207d99a30b14824b567282dfe6d0c21c0be4a67830888273452bd4c
- MD5 6cb75ccadfe7163a6dc4f17ce8e941f5
- SHA1 e0317aabd60093d06e49f48ed83d9889faaec476
- SHA512 d71efaffb552b2b58efe8919912eb968a534dd6f77a97539082acd9f3b17f19a31db02c53b0e579c1226c089aeb5938070da42e1d0930383b4e11d9ba7d7244d
- TLSH T12F51306A2DB21621275B21EA4C1FD14C735B103BC64D1F94B0BEB2512F8203E87DD9F2
- MD5 SHA1 SHA512 TLSH
files/lang.cmd
- SHA256 248e03f0594d85111413689a76f8659f597999d9ff51b5dab39d68130ca911e8
- MD5 cb01e75edbae1f3b8edbeefbc91cc55c
- SHA1 ff449d4674d3c244dca7fd2cf796e3f3860bf176
- SHA512 1e1e10bf1fcb1de02237d25427e7cc55afa21a3db9edc5f2c7ad4dc81111a86c13b2340da320dd4cee84f283c3aee4198df2a1f60de1cead387de082d31c13cf
- SSDEEP 768:vGUJZQTVvKnoo2dekkG9eaDVcoXYnNH7Tv:vhJWhvKnoo2deeeaFYNbj
- TLSH T1DFC294173E0A516902F9A231558B2A49F71CC8CD9315E9CC342E411FA3BFB53D6BE1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
files/uup-converter-wimlib_EN-US.7z
- SHA256 61280d3c7640e70afdd0b051d8afd79f769c53ee21886ddd554b56e6e0138257
- MD5 ede423bdda43c5a302ad7305ef779219
- SHA1 3a1ee27b676b053c92ae24a42bd010481e1b73f2
- SHA512 c53f115709458a80662ecf23fb2339a5979c124bf5ed926ceacf4befcb1d36f7b0f5d3c942d8fd617e1128531740bb295ff492da0862c27b6d19526dca152d03
- SSDEEP 49152:4GPi2+guE/miXLJGOOkFO2NEEqE5QIv+teCHWA:DBuy1GOOkXyEqAmH3
- TLSH T1B09533A8E2ABE3D0D2147F1468DFCF88E1CD4201FD4F7605EC6B59657E4A46BA08279C
- MD5 SHA1 SHA512 SSDEEP TLSH
ConvertConfig.ini
- SHA256 8a85452bc64a64c5061f47529324b5105045c3d6073f0099176055702820249c
- MD5 808b1ca666e8cbbc9f372555e0a90550
- SHA1 c17278a0d007fa432f87941d8ef78a4086148ac6
- SHA512 60b0e4e848d5f20fa121a0f4cb6261844904cc5ce8f5485d4ebb67ea0951b8422b646b9b75b3d9d1ffea42f2f3c54ef009665479b8056bf9cd7d754a75191ee5
- TLSH T1F9F0AB46180386FE08F391101FF110A170E2C083ADB2210D39EC53EC6F272A45A7CBC1
- MD5 SHA1 SHA512 TLSH
CustomAppsList.txt
- SHA256 ff106e5a7a925ba6e967a82e2d3f7eb9030b0cef0f6a3fe6fdb726819c8de94d
- MD5 f4c8f25e8953175f9f77fed1af79f96d
- SHA1 5edd633d5b811afd185ac29856e1bd7fd1c6e291
- SHA512 41ddba85c09ad495418eee948e33833f659926579be1b936ccda67f00894df0a85cd4aaea56d97b03de095fd942ff592c7b442323dbbaa7b6936ad170882d322
- TLSH T1435141C0C1B9E9D3CF3A3883ED87CA51BCAA1AC78445DF0438E5862E68B37D2B709441
- MD5 SHA1 SHA512 TLSH
ReadMe.html
- SHA256 b2f7da08e594d563f9520d70e9f2b70d42cb939fdb0e94d0075665af77c8355d
- MD5 2b19f6c393dbabc61f57e9b4da2dc6e8
- SHA1 7b498d78a7a7470336ce6a20d07d0ed46a924158
- SHA512 32c2f231383f386783b300cd2b7f19b567f09412b884407474aed4d07db4fd31940bf3f567030dd9bcf8d58680ef655603448e252f3ab216db76c140497039d8
- SSDEEP 768:ZfjnIAke1hS/eZpSOOgZM+l17jhzQTJyJiJgP64HZHNtyy7:ZfjIAvgGZpSOOgZMG1jGTJyJiJgP6ENR
- TLSH T186D296469AC05B50C77302499B56F22FEF34C0DFB2484686385EC24F6FB3967486B68B
- MD5 SHA1 SHA512 SSDEEP TLSH
Remove_Failure_MountDir.cmd
- SHA256 ec9ffddbc5776c3c25433e8d3d13afcc5b67cc454058ea266457c92590ac3ba6
- MD5 84d6a6e4640b2767dfb0eb611f99287b
- SHA1 80e729fd1e8f91a770f994114a14dbd5454b56e8
- SHA512 356625602b0817f3f43fc4984d8579cd7bee8483a1cf910428ef18509f5d931caeb6723524e517636c38f73cb21735772485e3bae317ded44c057013b8713983
- TLSH T163517138711CE0189CF0373A7A112043B29F47576364F3ACB7FB7829B98A61AB0765D1
- MD5 SHA1 SHA512 TLSH
UUPs/.README
- SHA256 bc42527deae7f8d2e5645015cd1a6c11153da791777d6ccbe9ef71b3ae86b244
- MD5 c013ca3a8da389fbdecb49c6b0a5e913
- SHA1 84a9534cfcc9040e9aaaf3cb809e29aae9cc87ae
- SHA512 e70c8d331000425fc740e02436cf23d7a39762bccb3c35dd45a1c235a83115670d86bc72db31230eb373c28836be681f27e72c14b74ccfe0b9615d080069d12b
- TLSH T1F6C02B63794794004496A180B349CC67C58CF0BCC5B050083CAC0011944705611B4473
- MD5 SHA1 SHA512 TLSH
bin/7z.dll
- IMPHASH 6a7be52633b01426b17d148203c82793
- SHA256 3db62076e5fcc897ff29da47fe4029900a4ad696b395b6fa96acff1229444c1d
- MD5 0dce103b0102adec3279797665b7a4ae
- SHA1 c121392bab6dba8d04bee89c6b526e8e67650cc8
- SHA512 20f0f02097694579ac8794d56411fbe2d97c47d37794cb52afdabc9956c0452e8a3bb273ed34e463f31927e29e7e41c0fddb82fbbe688dd39c4113c00ec91bc9
- SSDEEP 24576:Gxb5vMX35l5UVrIdhcMEKWnttf7eePboHvVxSfOtl:GxbSz5UVrIdhnW1Pc96Otl
- TLSH T132458D15F7F1C0B4D98E56318A2CBBF550F8E71ECA1068C76780BE6E6F328D6C225949
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
868031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharPrevExA
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
885KB
Virtual Size
885KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=104, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=220, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=39, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
bin/7z.exe
- IMPHASH 8c1dd070b13c63abc19b1534fe4b4867
- SHA256 9e2631c19b243c28b0980607ced2540e9447b1166572483475547c1a9dd4ac0e
- MD5 7187ae605f4dce14bb23ea2623956335
- SHA1 f7c1df33b875c98f41dcde24117d89d42d25b7ce
- SHA512 f64522e2fb6bb61884fe53c34e79b355efb9ec33c02b2cd67d729af7d763e7b3873a5c7ce6ac7bb4567e6bcf8c70cadbc66f511e8bb151ab05096a832032bc8f
- SSDEEP 6144:J5lqo52kDzMYDJSi7+Ni2ER9Vh98+1PrEVhkQf0huIDaLOjm:JMqzBDJkk2ERvT8MPAf/O6
- TLSH T1E5646B127FF4D47AD6430232CF59ABE1E1F993A94920094327C41A2CAB758D6D379F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
244284
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
SysStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
advapi32
LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
_ftol
memcmp
_purecall
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
_CxxThrowException
malloc
memcpy
__CxxFrameHandler
_isatty
_fileno
kernel32
SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
WaitForSingleObject
SetFileTime
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
ResumeThread
Name
.text
Size
252KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=75, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=5, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
bin/CompDB_App.txt
- SHA256 d40f2c89ccba4795856aa355545d62cda8fdc06542535cd71a4dc6c086f2a70d
- MD5 8a461169479dba82881195a5d5446dc5
- SHA1 28cf375abeb8c96141c3f278900df7d8fff69dd2
- SHA512 774be46dc7c4a7cb496cb7728aafd80385d88f2b750e77bf5e88ad9e4b5555056b0f57f4414b062185c5df89f479890cfa312a829c97ba2fb5772126a48527d7
- TLSH T10981EF5B9D2A48B1E16B6771069649B4FEAF90FB0C1C03807DAD55CDCAE15C8A2CDB70
- MD5 SHA1 SHA512 TLSH
bin/PSFExtractor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 69aa3d57c1fb049d728ee99bbf6fd341c659526ab7ebe20e631929ce6cfd36d7
- MD5 cdc246981d3c7d79133ba55f2e8e5cd5
- SHA1 c4d23fa8b9c2dc150982f53fe18aad0523a12d42
- SHA512 11ec829b781dba24c82e11eccc05967352270e6bb040a4d73ab2ca4e9dd7770a74459615e29ebeb4eff4c3040c692d56180611015eb6ac10e82032e0804ac855
- SSDEEP 384:U8yJTMR6UknEM7TjJ3Jy8WgCygA5to3Tx2PLWHq:Um/ri55y3gCE5tojgWK
- TLSH T135420B0497E44239F6BE47363A7247014632B77BB825C66E79CD050B2F26B414793FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\PSFExtractor\obj\Release\PSFExtractor.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/PSFExtractor.exe.config
- SHA256 bc13330a191ac2d72c75c35f6cb430dde1f91da1da1860fb617125b6dbf844f2
- MD5 ef32e2b99b3ac0aaa4a1ade65a87bead
- SHA1 704308b0c3349f9c9c104e4b0c85d065f011826e
- SHA512 2425bf847331acdfb4962d276da412af5f5349b55b77ed765433589e1a28294bc1ef539c11ae3a7b7be9499d3344fcfe9bbdc0fd402f24b08747a19e5e4a0558
- TLSH T11DC012154598FC1B5D324A1777558D41EF3071A15064080CB05F3A13072209E4357315
- MD5 SHA1 SHA512 TLSH
bin/SxSExpand.exe
- SHA256 9e889abd2d6068bc59aededc64a45d96e04c7ad5cb1d70f606f8ab0a96433b4a
- MD5 ca13105c6b1a532b8aeec611ec6459ef
- SHA1 9758ecb1797e4037da3a20d117119129b6c3454e
- SHA512 12eb55abfb3cd97286f8d47c9c561cde1efbb025f356bc3eaa7b4665a75ec48364b31e9aa9ff2e68dfbc06a0b56a49ae46550acc93f65afb83402322d592d2ac
- SSDEEP 1536:FBhcBqEuO81aWG5mINIRkPOybxHC2sfJxJ7UvPrnvReCs:NmqEG1aWG8ImRkPOybxi7xxJ7UvPrpeC
- TLSH T1BA831903B6E19434E5B22BB46D3452256E7B7D666D38811E7A9C4B4E5FF3A808C36323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52384
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
34B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/Updates.bat
- SHA256 a0be753137489fa5f820cab051d310693236c0d4d90fef5570a87aaba506c6e2
- MD5 0517f2898be9960bafaf6393a05af648
- SHA1 4f36e973709da3fe5d679957127f8773c9f3c5bc
- SHA512 db29be65248acc593342bdbe6be90c974b38715842160624a9de94b6d7551c6857d7a99630c530c0625ece1c73948234f094a44b6ffbf732b59782dfa0856e4a
- TLSH T13C216DAF43999254FCF10FAB795BC3E4EC9F900145E021A2FC2214B6F87E12066137E6
- MD5 SHA1 SHA512 TLSH
bin/bcdedit.exe
- IMPHASH 0591ec8002f106a8a5f4caff08971211
- SHA256 8ab894fc1acdc83d3c54a3bb6ef65f2d8d06ac8015ee39ab52872eb0dd0dd826
- MD5 e48eee77a8a6390b89781ccd1d7bccc5
- SHA1 b978202fc8574d9380f74a1c5b59fa290782079a
- SHA512 5a71b7f550c26196133ae78914f93d1ac4be7962e89ea86d298cb0481e9a522f28393fd43d1d8717927b8a783dc3704d6e9f83964295c6e878765a41dba92e8c
- SSDEEP 3072:eWg56t51b/0MQPdFo7WhYnG8yVZ19AmCE5EP2DbLZZsvtBMhdNV/ysXo3962xKeE:7Xb/YPNhYnGtZ1T5w2lZOuVsWj
- TLSH T1A984301362ED0115F1F27A745AB955708A3BBC91AE3AC69E029C019E4FE3E80CD71B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:06:0b:cd:a4:4b:f4:68:54:d7:ee:09:af:f7:50:08:bd:72:69:f8:02:d9:d6:2d:8a:d2:92:85:2b:15:54:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b3:52:cd:a8:de:ac:4a:9f:18:f3:84:ff:75:55:92:a3:22:95:13:65
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2014 - Jan 1, 2016
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:56:d4:53:f7:ca:e4:56:2c:f8:00:00:00:00:00:56
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Minor OS version
0
Major OS version
10
Entry point
190464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
bcdedit.pdb
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetSidLengthRequired
IsValidSid
AddAccessAllowedAce
InitializeAcl
GetAce
CreatePrivateObjectSecurityWithMultipleInheritance
SetPrivateObjectSecurityEx
GetSidSubAuthority
MakeSelfRelativeSD
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorGroup
IsValidSecurityDescriptor
DestroyPrivateObjectSecurity
GetSecurityDescriptorLength
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
InitializeSid
kernel32
FindResourceExW
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
SearchPathW
TlsSetValue
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
TlsGetValue
GetFileSizeEx
LoadResource
ReadFile
SetFilePointerEx
SetEndOfFile
DeleteCriticalSection
LoadLibraryExA
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetLocaleInfoW
GetVersionExW
CreateFileMappingW
GetUserDefaultUILanguage
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
LocalFree
FormatMessageW
DeviceIoControl
CloseHandle
CreateFileW
WriteFile
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleW
GetConsoleMode
GetFileType
GetStdHandle
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetLastError
FlushFileBuffers
msvcrt
memset
memcmp
memcpy
bsearch
wcsncmp
_aligned_malloc
_aligned_free
malloc
free
_snwscanf_s
_wcslwr
_wcsupr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wsetlocale
towupper
iswspace
_vsnwprintf
swprintf_s
wcschr
wcscpy_s
_ui64tow_s
_wcstoui64
wcstoul
_wcsnicmp
_wcsicmp
memmove
wcscat_s
_ultow_s
wcsncpy_s
wcsrchr
wcsstr
strncmp
wcsnlen
ntdll
RtlNtStatusToDosError
RtlFreeHeap
RtlAllocateHeap
RtlCompareMemory
RtlFreeUnicodeString
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
RtlGUIDFromString
RtlStringFromGUID
ZwOpenMutant
ZwReleaseMutant
ZwWaitForSingleObject
ZwClose
ZwOpenFile
NtOpenFile
ZwQueryAttributesFile
RtlAppendUnicodeToString
ZwUnloadKey
ZwCreateKey
RtlCreateAcl
RtlFreeSid
RtlSetDaclSecurityDescriptor
ZwDeleteValueKey
ZwSetValueKey
ZwSaveKey
ZwCreateFile
ZwQueryValueKey
RtlLengthSecurityDescriptor
ZwSetSecurityObject
RtlAddAccessAllowedAceEx
ZwLoadKey
RtlAllocateAndInitializeSid
ZwDeleteKey
ZwEnumerateKey
RtlLengthSid
RtlCreateSecurityDescriptor
ZwQueryKey
ZwOpenKey
RtlSetOwnerSecurityDescriptor
RtlInitAnsiString
LdrGetProcedureAddress
LdrGetDllHandle
ZwQueryVolumeInformationFile
ZwDeleteFile
ZwQueryInformationFile
NtOpenProcessTokenEx
NtSetInformationThread
RtlImpersonateSelf
NtOpenThreadTokenEx
NtAdjustPrivilegesToken
ZwCreateEvent
ZwQuerySymbolicLinkObject
RtlGetVersion
ZwOpenSymbolicLinkObject
ZwDeviceIoControlFile
ZwResetEvent
NtQuerySystemInformation
ZwAllocateUuids
NtOpenKey
NtDeviceIoControlFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtWaitForSingleObject
NtCreateEvent
NtQueryValueKey
NtSetValueKey
NtResetEvent
NtQueryBootEntryOrder
NtTranslateFilePath
NtCreateKey
NtQueryDirectoryObject
NtOpenDirectoryObject
NtEnumerateBootEntries
NtSetSecurityObject
NtDeleteKey
RtlUpcaseUnicodeChar
NtClose
ZwQuerySystemInformation
_ORCloseHive@4
_ORCloseKey@4
_ORCreateHive@4
_ORCreateKey@28
_ORDeleteKey@8
_ORDeleteValue@8
_OREnumKey@28
_OREnumValue@28
_ORFlushHive@4
_ORGetKeySecurity@16
_ORGetValue@24
_ORGetVirtualFlags@8
_OROpenHive@8
_OROpenHiveByHandle@8
_OROpenHiveInternal@16
_OROpenKey@12
_ORQueryInfoKey@44
_ORQueryInfoKeyEx@16
_ORSaveHive@16
_ORSetKeySecurity@12
_ORSetValue@20
_ORSetVirtualFlags@8
Name
.text
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=243, version=40116,
count=4, id=241, version=40116,
count=20, id=242, version=40116,
count=9, id=239, version=40116,
count=219, id=1, productName=Unmarked objects,
count=59, id=246, version=40116,
count=1, id=238, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
bin/bfi.exe
- SHA256 8f26a3f1a1f6f9ac0c279b7df56c41c79e4f23aaefd7da6e6ded16d091d4ad81
- MD5 edbdd5893d753fa68865ec3ad7dfe06d
- SHA1 8d3a30e823f5d0c5e3fbca135bb04891475219de
- SHA512 0c0e88f1f5100a2f67ee947b86081d1c30507eb018c1484e12b9255f6578aa9e0b59d6e5dbbef8a8e34d9e36e90666d97d44e3f3cc29dbf0f8bb3bc7584e0756
- SSDEEP 1536:gIvqSxs6WCegu1660dUyL0sCtA47jpsV4FjiXDJBE5baPXYUxn5ob2guBtXZ:gIhsJ166QUFJtAKjMXDJBE5kBzvX
- TLSH T12A93026F3E976E3EE53A2A745B08AD285B958C8C23E6D1B74C33531D293720D7349253
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
205360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
89KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=16, id=14, version=7299,
count=52, id=10, version=8047,
count=22, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=136, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
out.upx
- SHA256 0dbfc2bb3f35a8596d0932fbdaf364e492a7807e899e14d7d460d354be1608a4
- MD5 9aadf4488d7f0cd1986b3a55b857f9bc
- SHA1 1b97c1b6b9ca8e91634af1d4a6ab8d39016ae7a0
- SHA512 90b01ca4aa84c54af9497ee32c0c9abfb944b176c5e1177fc426049d123689e3c25e21886c42f7bed1282a763ab24fd08231dfcfdafacc43fc710ba64f1e371d
- SSDEEP 3072:9QLOdhKyyW1biW6Emogs52k9O1Ue77CdHmlTsi+5uMqqDLy/:TBiW67oj2CpmlTzCqqDLu
- TLSH T1D9148D3230C0C2BFC462053254E1A77DEBF9976613398C87EB28AE4D6D215E5D37A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
118076
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=16, id=14, version=7299,
count=52, id=10, version=8047,
count=22, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=136, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
bin/bin64/libwim-15.dll
- IMPHASH 00837f799e98ba17354b0e000174b764
- SHA256 d45410402e79df165f4c3dfd2ba00826c6ac5955511e7e4b3eda55fc29a061cf
- MD5 d9df436f581d2042809bd0d798f66fbf
- SHA1 5fd64a1380b7bd9cef9247806b138f5f6948a65a
- SHA512 c8d53417bc47ee7c9c0c205241c9637c09cdb634c85ae78da886a8b87bfb7d0fbbee1d899e4b8e30fd174ad4fd08748be6868ced59717288e318d0449f4805ea
- SSDEEP 12288:u0V5hKcGd1iRoxIIgS6qoKDr+mQVyoR8vTG1A58rxOiOX+eliCe:red1NgS6qomPoym874m6xHFeliCe
- TLSH T1B3F46B03E3E210BCD1B7D6704A7B5732A973F8152930DE5E6298DB793F22E50862DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileW
CreateSemaphoreA
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
OutputDebugStringA
RaiseException
ReadFile
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEndOfFile
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_beginthreadex
_endthreadex
_errno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_lock
_lseeki64
_open_osfhandle
_setjmp
_stat64
fwprintf
_telli64
_time64
_ultoa
_unlock
_waccess
_wassert
_wcsicmp
_wfopen
_wgetenv
_wmkdir
_wopen
_wstat64
_wtempnam
_wunlink
abort
calloc
exit
fclose
feof
ferror
fflush
fgetwc
fopen
fputc
fputwc
fputws
fread
free
fwrite
getc
getenv
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
putc
qsort
rand
realloc
signal
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strtol
strtoul
tolower
toupper
towlower
ungetc
ungetwc
vfprintf
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstoul
_wstat
longjmp
_write
_strdup
_read
_getcwd
_fdopen
_close
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
584KB
Virtual Size
582KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/bin64/wimlib-imagex.exe
- IMPHASH e3ed2ca34e65fe10b25c52b3dbe563fa
- SHA256 fc1d5a29a0a118f032f3f7fb62c96014d36e6439fab67df739336d75c673bb74
- MD5 03bf621cebeb73062789274d43cc331d
- SHA1 997a2200696d73bd9ad25d9af3cf68465ccb1e43
- SHA512 3160525a557e7156e21c58e531ed08adda029cbb7b5b1352804b27dfa5427aae525ba84af822a92c068d47a0e6fd13a79451c420ae0171d6161e3d2595a4187d
- SSDEEP 1536:eQBYoMkDhWUvBKvA27SVG1SJFIAq/JaJSBXJVDvrj3xlAxCBSmvc+ez1Fc:RYhkDhzvBK97SVdQKSZdCxCIma1q
- TLSH T114D3E801A3F610B8E5B7AA340DB75261BB73BC615A34CE2E525CD5792F63D40AE24F32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libwim-15
wimlib_add_image_multisource
wimlib_create_new_wim
wimlib_delete_image
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_get_compression_type_string
wimlib_get_error_string
wimlib_get_image_property
wimlib_get_version_string
wimlib_get_wim_info
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join_with_progress
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_image_property
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_fpreset
_gmtime64
_initterm
_lock
_onexit
_putws
_setmode
fwprintf
_unlock
_wcmdln
_wcserror
_wcsicmp
_wfopen
_wgetenv
_wstat64
abort
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memcpy
memmove
memset
realloc
signal
strerror
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsrchr
wcstoul
_wcsdup
_isatty
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/bootmui.txt
- SHA256 db6a22b19fdcafc344cf4c544cc972bb43aeefa993358ef97f2bd8e19d42f5b8
- MD5 a08f64f779c3fc937945def623f6c331
- SHA1 25b0fef17e4f9fb47fc97f7e00d100a729ae6236
- SHA512 73cdedfb6ec15877d7795dd6c09693fde260dedea8721b44d8c56999416f9222d800d0a08bca59b80762c09d335a5e53c2c338dbd02597d29443dcff0d6fc127
- TLSH T12A014C78F81B086336E1BEF4BCF2084C5E8692E04955EF449139319BF826D349DF0360
- MD5 SHA1 SHA512 TLSH
bin/bootwim.txt
- SHA256 3d808a95c035dae306ad2929de617c7727abecab0bddeb34638f1ba4d3c52e80
- MD5 e70e4bc070958d8537450a1353fbfbbf
- SHA1 9a3ec46f6fd7a8930d3b69285836c3efee09dff2
- SHA512 a9b2bc2e2423d68c418c61441e12f32c6193752070413771bab4be9247cae6db3c452ec8004465d8305ec596a19df7e666a4ad2efde6c128d3fd7f8622922cd1
- TLSH T124418B2DC927840737240FF535CAAE0C65A26946BF23A37088344BEF568792FDE5C0B9
- MD5 SHA1 SHA512 TLSH
bin/cabarc.exe
- IMPHASH c362751f44a9f875b2280fc6dcfae10c
- SHA256 cceaa59cb4e67f993b099c5e2693eb15231de3863e29da14ff130f24b66ff260
- MD5 a02a8702c6c539bd8648ccbb1869a604
- SHA1 c16da959c5aa9f29346e22fb07802cfa8f7b453f
- SHA512 6b871519e6d190d7703aed7e58d11b0bd69b731a44f90be0869efe00d256da982601b69d01721f8002c99d4cb5d36913b171306a79bb62bd4a5f9655f78ec3d3
- SSDEEP 1536:7xJDrXJTUZQM99pEY+7mfZZt7BN6e5ooPzUOmJ9ybae9rvpI0svZWGKAkro7m+8+:7xJDr5T6Wz7mf7tr6EUHJ9ybaOrWbKAf
- TLSH T1D283BF927FE89097CAC752709349B76ABF7847F20511B29F6B189C903A52FC2FF20255
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7b:07:3d:ec:1d:6f:85:c8:1b:53:d4:c2:11:6b:24:a9:4d:4d:c3:27:21:a2:55:6c:42:d0:7a:e1:fa:6c:41:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 15, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
45:43:a5:dc:20:07:fc:17:d6:59:f4:ec:e4:36:eb:bb:a8:50:81:67
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 15, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2a:9f:4b:23:5f:cf:b0:f0:9d:00:00:00:00:00:2a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Minor OS version
0
Major OS version
5
Entry point
18304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
msvcrt
fgets
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
fopen
malloc
__p__fmode
__set_app_type
_except_handler3
_controlfp
isspace
fclose
_getch
time
srand
rand
strchr
_tempnam
free
memmove
sprintf
strrchr
strncpy
isdigit
atoi
_stricmp
_strnicmp
toupper
printf
exit
_adjust_fdiv
__p__commode
kernel32
SetFilePointer
WriteFile
ReadFile
LocalFree
LocalAlloc
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
CreateDirectoryA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
CreateFileA
GetLastError
GetFileInformationByHandle
CloseHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=2, id=19, version=9049,
count=40, id=2, version=7274,
count=1, id=6, version=2090,
count=60, productName=Unmarked objects (old),
bin/cdimage.exe
- IMPHASH d7b38d0f2022ae83ed59a720772478e0
- SHA256 0b82e3775615e8f7babf5cf5be59c836d397ea7dbf1871bd5fdf4bedceaead86
- MD5 c9d5d0ea346d48185ac2eef836ba04a2
- SHA1 805f26e7a8450502201ceceb5dd041152780f639
- SHA512 65944e597b23669cb9a1b3b82043c7b08f5d4e7514147a18a4817011e5594033dc820617e9d11ed5b2bbd9539d6449d471327c7521d4a21e9a23be3db9e96025
- SSDEEP 1536:k934eRJXKj7KghBvawIpt6Vrw4tZCGGqHZUJdl4ivdUKgJubS5EJ17NNfPD+AQ:k934eR1Kj7R2PqiPvGH5EJ17NpB
- TLSH T1E6C38D12DBC442B5C4D320F4379CB3B199BDD97E032A1AC73B4C47E46454BD2E6B2A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
95952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
CDIMAGE.pdb
kernel32
GetVersionExA
SetErrorMode
GetSystemTime
SystemTimeToFileTime
SetFileApisToANSI
SetFileApisToOEM
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
lstrlenW
FindFirstFileW
FindFirstFileA
FindClose
GetLongPathNameW
GetLastError
GetLongPathNameA
HeapFree
CreateFileW
CreateFileA
CloseHandle
WaitForSingleObject
SetEvent
FileTimeToSystemTime
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
ReadFile
GetFileTime
GetFileInformationByHandle
FindNextFileA
FindNextFileW
GetOverlappedResult
SetEndOfFile
SetFilePointer
CreateEventA
WriteFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetModuleHandleA
GetProcessWorkingSetSize
SetProcessWorkingSetSize
InitializeCriticalSection
VirtualFree
SetConsoleCtrlHandler
ExitProcess
FormatMessageA
GetProcessHeap
HeapAlloc
VirtualAlloc
VirtualLock
ResetEvent
GetProcAddress
ReleaseSemaphore
CreateThread
WaitForMultipleObjects
SetThreadPriority
CreateSemaphoreA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
msvcrt
strrchr
_stricmp
wcstok
strtok
_wfopen
fgetws
_wcsicmp
fclose
fopen
fgets
_strnicmp
_strtoui64
strtoul
tolower
atoi
srand
time
vfprintf
_ultoa
rand
_wcsnicmp
_errno
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
memcpy
memset
?terminate@@YAXXZ
_controlfp
isleadbyte
_fileno
free
mbtowc
__mb_cur_max
_snprintf
_itoa
wctomb
malloc
ferror
__badioinfo
__pioinfo
_isatty
_write
_lseeki64
wcsrchr
wprintf
strchr
wcschr
_strupr
wcsncmp
exit
printf
fflush
fprintf
_iob
feof
memcmp
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=205, version=65501,
count=14, id=207, version=65501,
count=69, id=206, version=65501,
count=5, id=203, version=65501,
count=169, id=1, productName=Unmarked objects,
count=13, id=210, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
bin/imagex.exe
- IMPHASH 6816108faf77a6c11f4b9ffc7bae891f
- SHA256 4edb6afb13477de51459096cc3f7d2a497f053fecf05cc3c360451fede667848
- MD5 a452fd6f47c7f603c2c2034dacc8cac4
- SHA1 81beb20db768bc42d5e7df7d77a02d792d5ef92e
- SHA512 0b4b211df29fe208a2d3f44c4c065cd840f991ae02a48bcecd0d886e7e52df51bd4c707f0f927f5955fe36f40a0eb9f751240f143e5f165be33f0b6e9ecde3e7
- SSDEEP 12288:x+gWMYl2snR/Dbzw6Cf2rkKul/WDsk+VR9QikUmInpNgvsPPetKAr/GhME1BA5Of:/7bsnRNCf2r7ulOikUmiNTMO5
- TLSH T16BD46B21B6E8403EF7F335B04D392669597EB9626A70C88F53808D5D19716C0EA387BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:c9:0c:a3:10:28:64:07:22:71:32:f6:f5:7d:4c:f8:00:36:dd:d5:0f:f1:ce:d0:09:54:dc:4d:b7:e3:e9:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8b:bc:9b:e8:61:73:33:98:ac:ab:d0:0d:13:29:14:8f:9c:bc:1d:09
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b1:71:13:79:df:75:f6:35:c8:00:00:00:00:00:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
10
Entry point
546960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
imagex.pdb
msvcrt
_lock
_except_handler4_common
memmove_s
_strcmpi
wcstoul
_unlock
_wcsupr
_snwprintf_s
qsort
_wcsrev
_wcslwr
_strnicmp
__dllonexit
strcpy_s
_wcstoi64
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_onexit
_exit
wcsstr
wcsncmp
wcsnlen
exit
__set_app_type
swscanf_s
towupper
_wcsnicmp
wcschr
_vscwprintf
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wtoi
wcsrchr
_wtol
fflush
memmove
_wcsicmp
__iob_func
memcpy
memcmp
printf
iswspace
_purecall
malloc
_callnewh
_cexit
bsearch
free
memcpy_s
memset
_vsnwprintf
ntdll
DbgPrintEx
NtYieldExecution
RtlRaiseStatus
RtlReAllocateHeap
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlInitUnicodeString
NtQuerySecurityObject
RtlImpersonateSelf
NtSetEaFile
NtCreateFile
NtQueryEaFile
NtQueryVolumeInformationFile
NtQueryInformationProcess
NtQueryInformationFile
RtlAdjustPrivilege
NtClose
NtQueryDirectoryFile
NtOpenFile
RtlDosPathNameToNtPathName_U
NtSetSecurityObject
RtlFindAceByType
RtlSetControlSecurityDescriptor
RtlGetLastNtStatus
RtlFreeHeap
RtlAllocateHeap
NtSetInformationFile
RtlNtStatusToDosError
RtlGetVersion
kernel32
MapViewOfFile
CreateFileMappingW
lstrcmpW
CreateSemaphoreW
GetDriveTypeW
GetTempFileNameW
DeleteFileW
GetTempPathW
GetLogicalDrives
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
UnmapViewOfFile
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
WaitForMultipleObjects
ReleaseSemaphore
GetPrivateProfileSectionW
DuplicateHandle
UnlockFileEx
LockFileEx
GetVolumeInformationByHandleW
GetSystemWindowsDirectoryW
GlobalMemoryStatusEx
TerminateProcess
FindClose
GetFinalPathNameByHandleW
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
CreateEventW
OpenProcess
ReleaseMutex
LocalAlloc
GetModuleHandleExW
CreateMutexW
HeapReAlloc
RemoveDirectoryW
SetFilePointer
GetFileSize
GetCurrentThread
SetThreadIdealProcessor
GetSystemInfo
DeleteCriticalSection
GetOverlappedResult
ReadFile
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
GetHandleInformation
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
CreateDirectoryW
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetLastError
WriteFile
GetConsoleMode
GetConsoleScreenBufferInfo
WriteConsoleW
SetConsoleCursorPosition
GetStdHandle
InitializeCriticalSection
FlushFileBuffers
CopyFileExW
GetFileInformationByHandle
SetFileAttributesW
CreateFileW
DeviceIoControl
GetCurrentDirectoryW
LoadLibraryExW
FindNextFileW
GetVolumePathNamesForVolumeNameW
LoadLibraryW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
MultiByteToWideChar
CreateSemaphoreExW
GetExitCodeProcess
CreateProcessW
GetLogicalDriveStringsW
FindFirstFileW
FreeLibrary
GetModuleHandleW
SetConsoleCtrlHandler
GetModuleFileNameW
WaitForMultipleObjectsEx
GetFullPathNameW
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetTickCount64
GetSystemDirectoryW
GetFileAttributesW
CompareStringW
GetCommandLineW
SetLastError
GetEnvironmentVariableW
LocalFree
WaitForSingleObject
OpenEventW
FormatMessageW
HeapFree
SetEvent
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateThread
GetProcAddress
FillConsoleOutputCharacterW
user32
CharPrevW
LoadStringW
CharNextW
CharUpperW
shlwapi
PathMatchSpecW
StrStrIW
setupapi
SetupFindFirstLineW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextW
rpcrt4
UuidFromStringW
RpcStringFreeW
UuidToStringW
RpcBindingFree
RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
UuidCreate
I_RpcMapWin32Status
NdrClientCall2
RpcStringBindingComposeW
fltlib
FilterLoad
FilterAttach
cabinet
ord22
ord20
ord23
advapi32
GetSecurityInfo
SetSecurityDescriptorDacl
EqualSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetTokenInformation
OpenThreadToken
InitializeSecurityDescriptor
RegUnLoadKeyW
RegLoadKeyW
GetAclInformation
GetSecurityDescriptorLength
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegCloseKey
RegDeleteKeyExW
RegFlushKey
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
AdjustTokenPrivileges
AllocateAndInitializeSid
OpenProcessToken
FreeSid
CheckTokenMembership
OpenEncryptedFileRawW
WriteEncryptedFileRaw
CloseEncryptedFileRaw
RevertToSelf
ReadEncryptedFileRaw
RegQueryInfoKeyW
SetThreadToken
AddAccessAllowedAceEx
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
bcrypt
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
Name
.text
Size
536KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=24610,
count=20, id=260, version=24610,
count=322, id=1, productName=Unmarked objects,
count=13, id=257, version=24610,
count=4, id=261, version=24610,
count=146, id=264, version=24610,
count=1, id=255, version=24610,
count=1, id=258, version=24610,
bin/libwim-15.dll
- IMPHASH 177db15880a3279696633581d336089c
- SHA256 b3e2d47463a1845355e03f36f29258f5f41b4019d78f42867dc99147d4cbaa72
- MD5 69132ffb2954cfaf6c38e319ef9eb21e
- SHA1 a865ed3fa1ca0b6560d09bd95b8a561faac626b3
- SHA512 92e4a00e02060f681433eb3588a9ad06e79bff535a8f1812c3b1e5be7ac4df982f2c4d0fa5ab380ad6ecc9595da4161da64db7c568e29d36b2f8e966592eae4d
- SSDEEP 24576:fklREJ4vh1yqVey+y83RKaLyFA1E6C7Xm8jqO8ew9J5p:IREJ4Z9wyWRKaLyt6omdO8ew9d
- TLSH T14E053A49EBC700F1FA73A57199ABF27F4A31B9128432CEAADF4D1949F933A11481D316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileW
CreateSemaphoreA
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
OutputDebugStringA
RaiseException
ReadFile
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEndOfFile
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__mb_cur_max
_amsg_exit
_assert
_beginthreadex
_endthreadex
_errno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_iob
_lock
_lseeki64
_open_osfhandle
_setjmp3
fwprintf
_telli64
_ultoa
_unlock
_waccess
_wcsicmp
_wfopen
_wgetenv
_wmkdir
_wopen
_wstat64
_wtempnam
_wunlink
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetwc
fopen
fputc
fputwc
fputws
fread
free
fwrite
getc
getenv
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
putc
qsort
rand
realloc
setlocale
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strtol
strtoul
tolower
toupper
towlower
ungetc
ungetwc
vfprintf
time
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstombs
wcstoul
_wstat
_stat
longjmp
_write
_strdup
_read
_getcwd
_fdopen
_close
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
582KB
Virtual Size
581KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/offlinereg.exe
- SHA256 6ad78c3e6a07ec84bbe399f3be156edc3ee1da525bd87f7c0c716846708a111a
- MD5 6dc5ad65078eb5229fbbd1f06f61cf0b
- SHA1 e0f89640230db562d32099c4851e1ebb90dcfc98
- SHA512 a91f2dbf7b2435461805c3d756f5ac1eff27da8d84c9e3076e8cd1ac9ebcc9bbad77820d0eb3bfe3ea0de91d50fe69549baac9687ffa536d27522d8a775d57ec
- SSDEEP 3072:Pp/5MaKYvuo3Khqef9uVrAgXuQbkX2hgqjYDsqLhPEcrrFm9gh:P1mgt3w9J2gqjYDsqLhP70
- TLSH T1B5B33B22B2D08472E0709E7CCC15B2E4943AFDA12D68956AB7F85E4DCE393C1686D3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
99520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/offreg.dll
- IMPHASH 7f06a5f1ddbdb3daa4bd9e267b9e1f4c
- SHA256 a8e3149c77c235818cbbf2686cecd66683e2d3864860074f0777c13b1140a9a2
- MD5 163db46b803e4c83c444a026ff17d269
- SHA1 0a2585db6a5c2f7f467fd85df622e9c0632b9b2e
- SHA512 9a14ef16e30f8bf72a89fe3154e04d879d1ce8bbdcee4942dcdfb74da6e5584a19853b64ee4a36fb9af04e2e641f1e0ba04b2f5187e2ceeaf9085685e1d78c31
- SSDEEP 768:V5zyp6v0wj3hpUTAvZxdW9UzjzvH+qREOtJWS1temkz1ImTWvERLkEzrBJOkMm75:bv02hphxdSevH+uJWEMb9TWWkEZQ0
- TLSH T17A437D22B52481BBC4DA75B1215E7276293EC7820B219ACF07761DF6B9617C09F387CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
13:3f:33:a4:99:03:ab:e0:5c:63:75:f6:fe:c4:d9:6b:4d:c1:a9:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 9, 2010
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:04:b3:f5:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2008 - Jul 25, 2011
Subject
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:23:0f:00:00:00:00:00:0a
Issuer
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:02:dc:00:00:00:00:00:0b
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 15, 2005 - Mar 15, 2016
Minor OS version
1
Major OS version
6
Entry point
6067
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
offreg.pdb
msvcrt
_wcsicmp
_aligned_malloc
_aligned_free
towupper
_wcsnicmp
memmove
memcpy
memset
_amsg_exit
_initterm
free
malloc
_XcptFilter
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryA
TlsFree
TlsAlloc
TlsGetValue
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
GetProcessHeap
CreateFileW
CloseHandle
ReadFile
WriteFile
GetFileSizeEx
FlushFileBuffers
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
TlsSetValue
GetSystemTimeAsFileTime
TerminateProcess
advapi32
InitializeSid
DestroyPrivateObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorControl
MakeSelfRelativeSD
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetPrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
GetSidLengthRequired
GetSecurityDescriptorLength
GetSidSubAuthority
ORCloseHive
ORCloseKey
ORCreateHive
ORCreateKey
ORDeleteKey
ORDeleteValue
OREnumKey
OREnumValue
ORGetKeySecurity
ORGetValue
ORGetVersion
ORGetVirtualFlags
OROpenHive
OROpenKey
ORQueryInfoKey
ORSaveHive
ORSetKeySecurity
ORSetValue
ORSetVirtualFlags
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=115, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=83, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bin/wimlib-imagex.exe
- IMPHASH 821831e619b1d3f0415e047c23b0e09b
- SHA256 4e19d62d0615f8e0093a800b8f73f353ff6764a930d60ebea4fac0555cdd7661
- MD5 62e9ec7613c8c1ad727d7be7c1f07acb
- SHA1 cfc744b67b64adc968d4da3535eec2d9462b3824
- SHA512 45e83f079feb6ae31d5b7a0a75ba7d24fb1765991c7124592c9122f593264cc1371d652553d408ce83f15b035f849e4d275f36350ce2208ac6f75531c1748375
- SSDEEP 3072:DidbO0Zgqv5ruiKEvr23KSc43ZKKm2HBSHfKQ:Di9vGc5rJKEvr2353pm2h+
- TLSH T1F2E30740F7D740F1F5B32AB058AAD37E4537BE128934DE2EE74C959AAB33A405620727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libwim-15
wimlib_add_image_multisource
wimlib_create_new_wim
wimlib_delete_image
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_get_compression_type_string
wimlib_get_error_string
wimlib_get_image_property
wimlib_get_version_string
wimlib_get_wim_info
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join_with_progress
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_image_property
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__lconv_init
__mb_cur_max
__p__commode
__p__fmode
__p__wcmdln
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_errno
_commode
_fmode
_fpreset
_gmtime64
_initterm
_iob
_lock
_onexit
_putws
_setmode
fwprintf
_unlock
_wcserror
_wcsicmp
_wfopen
_wgetenv
_wstat64
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memcpy
memmove
memset
realloc
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsrchr
wcstoul
_wcsdup
_isatty
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
convert-UUP.cmd
- SHA256 59720aaee483ca488f789a3bcbfca81947335dd8b90257dcaa4759d0a4515aa4
- MD5 e2873a5c11558b0439ebaa7159723571
- SHA1 defe02f406febbafb7cac57ef2e9347beecd90d6
- SHA512 56e79bb168a6b5bd28062c1b01f88b37cd13ea381b32305abb13caa1cc56812eceee75f2c4cb7beed4a1bb0301970a5866dc02e568617476c25755cad50b7c4c
- SSDEEP 3072:fpnHlIYVqgvKcbEVRJtjAF4ePzg1RJtauM0c4vCXxYGF5872crkx/81CZqIUBO7d:RnHlIYVqgvKcbEVRJtjAF4ePzg1RJtaB
- TLSH T118F31A5871484166D0F547B9A2670283BB3ED5735230E3BC773994B4F9F72A320B9AD8
- MD5 SHA1 SHA512 SSDEEP TLSH
create_virtual_editions.cmd
- SHA256 162a79dc55c73a10999cafe7b679e601c72c6aa0cda2a68c0851a9ab03b6497a
- MD5 cf597d350f9d6179834ca61c1510395a
- SHA1 76f960dd2d74b300716194835202d8d78113ff27
- SHA512 9e331fffdc62651d6bc01340aaa8567ef0d32868fd299445b73a6de3b50656d7f737221df04d85708e530b8a9b1c8c31cd20a303246077eaf40731b03b5ee1cc
- SSDEEP 1536:eWlDLC+Ici0EaScCXUgLQbfd0fciZTR3vckNLZgyZZZ0ZKayo7kJXp+jVEoh4:zNLC+Ici0EaScCXUgLQbfd0fciZTVvcg
- TLSH T1C393B5943494012AF4FF837292F1B9416BBFF0E20BF1DE4C713894A076DB68699B598D
- MD5 SHA1 SHA512 SSDEEP TLSH
multi_arch_iso.cmd
- SHA256 ce3b7e2715420a4934bfdc17a9cd5dfcf2375c7ec9994f07ebd58f680f4caf81
- MD5 43821ccadd0c38859157d5a34869f470
- SHA1 7943a9f03960c519bf1b8a1bff8a4af28875bb24
- SHA512 8a7f5d79e5502842a90c311e2bde0e04240446ca350c6f1088107e64276ad983db2b3939031fa04e93d3a8351e59cfbe2fc952489747921aa019748223d8d39e
- SSDEEP 768:STNTMSpyt6Pzqavk1aQyw4sNuC3+3tciQKwHc7qw2ayo7JSO+jVgV:MTMSpEozqavk1aQyw4sNuC3+dclhayo3
- TLSH T14FF2D8643507523250E287F2EA278046772FC5228670F7CC797D90A476BF3A6A1F6DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
files/uup-converter-wimlib_ZH-CN.7z
- SHA256 4f62bef7cd50247aef14ddb9a1c57801ed35e1313935f791dd7aaf3ac9fe6f00
- MD5 18f399b2928725a53a73f7051b0ac9c4
- SHA1 113ed9f379a3742be9b3c91749511e06903413d3
- SHA512 f7db5b53bdf71747cff25b1ed959d15d9a1184a3a841942961f616f6434414e207027117afada13169c735308aba6d78c7325b9f638691eac76d4a8102011af9
- SSDEEP 49152:SyftPi2+guE/miXLJGOOkFO2NEEqE5QIv+teCHWi:SqBuy1GOOkXyEqAmHp
- TLSH T1709533A8E2A7A3D0D2187F0468EFCF88D5CE4211FD4F7609EC1759A5BD4A46BD08279C
- MD5 SHA1 SHA512 SSDEEP TLSH
ConvertConfig.ini
- SHA256 8a85452bc64a64c5061f47529324b5105045c3d6073f0099176055702820249c
- MD5 808b1ca666e8cbbc9f372555e0a90550
- SHA1 c17278a0d007fa432f87941d8ef78a4086148ac6
- SHA512 60b0e4e848d5f20fa121a0f4cb6261844904cc5ce8f5485d4ebb67ea0951b8422b646b9b75b3d9d1ffea42f2f3c54ef009665479b8056bf9cd7d754a75191ee5
- TLSH T1F9F0AB46180386FE08F391101FF110A170E2C083ADB2210D39EC53EC6F272A45A7CBC1
- MD5 SHA1 SHA512 TLSH
CustomAppsList.txt
- SHA256 ff106e5a7a925ba6e967a82e2d3f7eb9030b0cef0f6a3fe6fdb726819c8de94d
- MD5 f4c8f25e8953175f9f77fed1af79f96d
- SHA1 5edd633d5b811afd185ac29856e1bd7fd1c6e291
- SHA512 41ddba85c09ad495418eee948e33833f659926579be1b936ccda67f00894df0a85cd4aaea56d97b03de095fd942ff592c7b442323dbbaa7b6936ad170882d322
- TLSH T1435141C0C1B9E9D3CF3A3883ED87CA51BCAA1AC78445DF0438E5862E68B37D2B709441
- MD5 SHA1 SHA512 TLSH
ReadMe.html
- SHA256 5e06a0d9519ecab42cb575933d62de6e82ab3e2f42e43fb92ab2cad8b48b71f0
- MD5 0af53e520a75dbd5ae0c328c2139dfa9
- SHA1 812210301b0c31cdddc9d88faa5b7ad4fabe948f
- SHA512 f8e11148a59b5e9365ebd8b6e749e9da4776058517ba2c5f3d380af8b986c409d728a37e5a7ad4c2bfbf9f1153f9977a86d44b3c61fcc470d6ef9ebe76624cae
- SSDEEP 768:i6o/TihhN1sbY3s3DoywFbl/U94bQYaQC1cLoFRycz:i6o/TinAZ3DUfUS8YaQC1cLoFR7
- TLSH T110D292A585E14C94837101180B65F23FFD74A0DBE165A6827D8EA45FBFB3D13082BD5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Remove_Failure_MountDir.cmd
- SHA256 2478ef0e9bb2294f1d86c67287493e20f176462f8073abcc95e9de8350ac3edf
- MD5 60999572c7eb24bde3a34c7a4871f9c2
- SHA1 ba74d67d7f9fbef47739fd3188ea62f5d6d13bf1
- SHA512 de748571badf0d69ee871a2084d675413b1fc4342b1a24f9a652dda8ed692a218810e9b9e878caefa75e77b406f93f6d05bf20da94352c69b0f5cb1851916f67
- TLSH T12C514F38711DE0589CF137397A112053B29F4753A364F7ACBBEB7929B88A60AB0765C1
- MD5 SHA1 SHA512 TLSH
UUPs/.README
- SHA256 bc42527deae7f8d2e5645015cd1a6c11153da791777d6ccbe9ef71b3ae86b244
- MD5 c013ca3a8da389fbdecb49c6b0a5e913
- SHA1 84a9534cfcc9040e9aaaf3cb809e29aae9cc87ae
- SHA512 e70c8d331000425fc740e02436cf23d7a39762bccb3c35dd45a1c235a83115670d86bc72db31230eb373c28836be681f27e72c14b74ccfe0b9615d080069d12b
- TLSH T1F6C02B63794794004496A180B349CC67C58CF0BCC5B050083CAC0011944705611B4473
- MD5 SHA1 SHA512 TLSH
bin/7z.dll
- IMPHASH 6a7be52633b01426b17d148203c82793
- SHA256 3db62076e5fcc897ff29da47fe4029900a4ad696b395b6fa96acff1229444c1d
- MD5 0dce103b0102adec3279797665b7a4ae
- SHA1 c121392bab6dba8d04bee89c6b526e8e67650cc8
- SHA512 20f0f02097694579ac8794d56411fbe2d97c47d37794cb52afdabc9956c0452e8a3bb273ed34e463f31927e29e7e41c0fddb82fbbe688dd39c4113c00ec91bc9
- SSDEEP 24576:Gxb5vMX35l5UVrIdhcMEKWnttf7eePboHvVxSfOtl:GxbSz5UVrIdhnW1Pc96Otl
- TLSH T132458D15F7F1C0B4D98E56318A2CBBF550F8E71ECA1068C76780BE6E6F328D6C225949
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
868031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharPrevExA
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
885KB
Virtual Size
885KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=104, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=220, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=39, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
bin/7z.exe
- IMPHASH 8c1dd070b13c63abc19b1534fe4b4867
- SHA256 9e2631c19b243c28b0980607ced2540e9447b1166572483475547c1a9dd4ac0e
- MD5 7187ae605f4dce14bb23ea2623956335
- SHA1 f7c1df33b875c98f41dcde24117d89d42d25b7ce
- SHA512 f64522e2fb6bb61884fe53c34e79b355efb9ec33c02b2cd67d729af7d763e7b3873a5c7ce6ac7bb4567e6bcf8c70cadbc66f511e8bb151ab05096a832032bc8f
- SSDEEP 6144:J5lqo52kDzMYDJSi7+Ni2ER9Vh98+1PrEVhkQf0huIDaLOjm:JMqzBDJkk2ERvT8MPAf/O6
- TLSH T1E5646B127FF4D47AD6430232CF59ABE1E1F993A94920094327C41A2CAB758D6D379F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
244284
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
SysStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
advapi32
LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
_ftol
memcmp
_purecall
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
_CxxThrowException
malloc
memcpy
__CxxFrameHandler
_isatty
_fileno
kernel32
SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
WaitForSingleObject
SetFileTime
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
ResumeThread
Name
.text
Size
252KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=75, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=5, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
bin/CompDB_App.txt
- SHA256 d40f2c89ccba4795856aa355545d62cda8fdc06542535cd71a4dc6c086f2a70d
- MD5 8a461169479dba82881195a5d5446dc5
- SHA1 28cf375abeb8c96141c3f278900df7d8fff69dd2
- SHA512 774be46dc7c4a7cb496cb7728aafd80385d88f2b750e77bf5e88ad9e4b5555056b0f57f4414b062185c5df89f479890cfa312a829c97ba2fb5772126a48527d7
- TLSH T10981EF5B9D2A48B1E16B6771069649B4FEAF90FB0C1C03807DAD55CDCAE15C8A2CDB70
- MD5 SHA1 SHA512 TLSH
bin/PSFExtractor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 69aa3d57c1fb049d728ee99bbf6fd341c659526ab7ebe20e631929ce6cfd36d7
- MD5 cdc246981d3c7d79133ba55f2e8e5cd5
- SHA1 c4d23fa8b9c2dc150982f53fe18aad0523a12d42
- SHA512 11ec829b781dba24c82e11eccc05967352270e6bb040a4d73ab2ca4e9dd7770a74459615e29ebeb4eff4c3040c692d56180611015eb6ac10e82032e0804ac855
- SSDEEP 384:U8yJTMR6UknEM7TjJ3Jy8WgCygA5to3Tx2PLWHq:Um/ri55y3gCE5tojgWK
- TLSH T135420B0497E44239F6BE47363A7247014632B77BB825C66E79CD050B2F26B414793FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\PSFExtractor\obj\Release\PSFExtractor.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/PSFExtractor.exe.config
- SHA256 bc13330a191ac2d72c75c35f6cb430dde1f91da1da1860fb617125b6dbf844f2
- MD5 ef32e2b99b3ac0aaa4a1ade65a87bead
- SHA1 704308b0c3349f9c9c104e4b0c85d065f011826e
- SHA512 2425bf847331acdfb4962d276da412af5f5349b55b77ed765433589e1a28294bc1ef539c11ae3a7b7be9499d3344fcfe9bbdc0fd402f24b08747a19e5e4a0558
- TLSH T11DC012154598FC1B5D324A1777558D41EF3071A15064080CB05F3A13072209E4357315
- MD5 SHA1 SHA512 TLSH
bin/SxSExpand.exe
- SHA256 9e889abd2d6068bc59aededc64a45d96e04c7ad5cb1d70f606f8ab0a96433b4a
- MD5 ca13105c6b1a532b8aeec611ec6459ef
- SHA1 9758ecb1797e4037da3a20d117119129b6c3454e
- SHA512 12eb55abfb3cd97286f8d47c9c561cde1efbb025f356bc3eaa7b4665a75ec48364b31e9aa9ff2e68dfbc06a0b56a49ae46550acc93f65afb83402322d592d2ac
- SSDEEP 1536:FBhcBqEuO81aWG5mINIRkPOybxHC2sfJxJ7UvPrnvReCs:NmqEG1aWG8ImRkPOybxi7xxJ7UvPrpeC
- TLSH T1BA831903B6E19434E5B22BB46D3452256E7B7D666D38811E7A9C4B4E5FF3A808C36323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52384
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
34B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/Updates.bat
- SHA256 a0be753137489fa5f820cab051d310693236c0d4d90fef5570a87aaba506c6e2
- MD5 0517f2898be9960bafaf6393a05af648
- SHA1 4f36e973709da3fe5d679957127f8773c9f3c5bc
- SHA512 db29be65248acc593342bdbe6be90c974b38715842160624a9de94b6d7551c6857d7a99630c530c0625ece1c73948234f094a44b6ffbf732b59782dfa0856e4a
- TLSH T13C216DAF43999254FCF10FAB795BC3E4EC9F900145E021A2FC2214B6F87E12066137E6
- MD5 SHA1 SHA512 TLSH
bin/bcdedit.exe
- IMPHASH 0591ec8002f106a8a5f4caff08971211
- SHA256 8ab894fc1acdc83d3c54a3bb6ef65f2d8d06ac8015ee39ab52872eb0dd0dd826
- MD5 e48eee77a8a6390b89781ccd1d7bccc5
- SHA1 b978202fc8574d9380f74a1c5b59fa290782079a
- SHA512 5a71b7f550c26196133ae78914f93d1ac4be7962e89ea86d298cb0481e9a522f28393fd43d1d8717927b8a783dc3704d6e9f83964295c6e878765a41dba92e8c
- SSDEEP 3072:eWg56t51b/0MQPdFo7WhYnG8yVZ19AmCE5EP2DbLZZsvtBMhdNV/ysXo3962xKeE:7Xb/YPNhYnGtZ1T5w2lZOuVsWj
- TLSH T1A984301362ED0115F1F27A745AB955708A3BBC91AE3AC69E029C019E4FE3E80CD71B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:06:0b:cd:a4:4b:f4:68:54:d7:ee:09:af:f7:50:08:bd:72:69:f8:02:d9:d6:2d:8a:d2:92:85:2b:15:54:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b3:52:cd:a8:de:ac:4a:9f:18:f3:84:ff:75:55:92:a3:22:95:13:65
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2014 - Jan 1, 2016
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:56:d4:53:f7:ca:e4:56:2c:f8:00:00:00:00:00:56
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Minor OS version
0
Major OS version
10
Entry point
190464
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
bcdedit.pdb
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetSidLengthRequired
IsValidSid
AddAccessAllowedAce
InitializeAcl
GetAce
CreatePrivateObjectSecurityWithMultipleInheritance
SetPrivateObjectSecurityEx
GetSidSubAuthority
MakeSelfRelativeSD
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorGroup
IsValidSecurityDescriptor
DestroyPrivateObjectSecurity
GetSecurityDescriptorLength
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
InitializeSid
kernel32
FindResourceExW
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
SearchPathW
TlsSetValue
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
TlsGetValue
GetFileSizeEx
LoadResource
ReadFile
SetFilePointerEx
SetEndOfFile
DeleteCriticalSection
LoadLibraryExA
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetLocaleInfoW
GetVersionExW
CreateFileMappingW
GetUserDefaultUILanguage
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
LocalFree
FormatMessageW
DeviceIoControl
CloseHandle
CreateFileW
WriteFile
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleW
GetConsoleMode
GetFileType
GetStdHandle
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetLastError
FlushFileBuffers
msvcrt
memset
memcmp
memcpy
bsearch
wcsncmp
_aligned_malloc
_aligned_free
malloc
free
_snwscanf_s
_wcslwr
_wcsupr
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wsetlocale
towupper
iswspace
_vsnwprintf
swprintf_s
wcschr
wcscpy_s
_ui64tow_s
_wcstoui64
wcstoul
_wcsnicmp
_wcsicmp
memmove
wcscat_s
_ultow_s
wcsncpy_s
wcsrchr
wcsstr
strncmp
wcsnlen
ntdll
RtlNtStatusToDosError
RtlFreeHeap
RtlAllocateHeap
RtlCompareMemory
RtlFreeUnicodeString
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
RtlGUIDFromString
RtlStringFromGUID
ZwOpenMutant
ZwReleaseMutant
ZwWaitForSingleObject
ZwClose
ZwOpenFile
NtOpenFile
ZwQueryAttributesFile
RtlAppendUnicodeToString
ZwUnloadKey
ZwCreateKey
RtlCreateAcl
RtlFreeSid
RtlSetDaclSecurityDescriptor
ZwDeleteValueKey
ZwSetValueKey
ZwSaveKey
ZwCreateFile
ZwQueryValueKey
RtlLengthSecurityDescriptor
ZwSetSecurityObject
RtlAddAccessAllowedAceEx
ZwLoadKey
RtlAllocateAndInitializeSid
ZwDeleteKey
ZwEnumerateKey
RtlLengthSid
RtlCreateSecurityDescriptor
ZwQueryKey
ZwOpenKey
RtlSetOwnerSecurityDescriptor
RtlInitAnsiString
LdrGetProcedureAddress
LdrGetDllHandle
ZwQueryVolumeInformationFile
ZwDeleteFile
ZwQueryInformationFile
NtOpenProcessTokenEx
NtSetInformationThread
RtlImpersonateSelf
NtOpenThreadTokenEx
NtAdjustPrivilegesToken
ZwCreateEvent
ZwQuerySymbolicLinkObject
RtlGetVersion
ZwOpenSymbolicLinkObject
ZwDeviceIoControlFile
ZwResetEvent
NtQuerySystemInformation
ZwAllocateUuids
NtOpenKey
NtDeviceIoControlFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtWaitForSingleObject
NtCreateEvent
NtQueryValueKey
NtSetValueKey
NtResetEvent
NtQueryBootEntryOrder
NtTranslateFilePath
NtCreateKey
NtQueryDirectoryObject
NtOpenDirectoryObject
NtEnumerateBootEntries
NtSetSecurityObject
NtDeleteKey
RtlUpcaseUnicodeChar
NtClose
ZwQuerySystemInformation
_ORCloseHive@4
_ORCloseKey@4
_ORCreateHive@4
_ORCreateKey@28
_ORDeleteKey@8
_ORDeleteValue@8
_OREnumKey@28
_OREnumValue@28
_ORFlushHive@4
_ORGetKeySecurity@16
_ORGetValue@24
_ORGetVirtualFlags@8
_OROpenHive@8
_OROpenHiveByHandle@8
_OROpenHiveInternal@16
_OROpenKey@12
_ORQueryInfoKey@44
_ORQueryInfoKeyEx@16
_ORSaveHive@16
_ORSetKeySecurity@12
_ORSetValue@20
_ORSetVirtualFlags@8
Name
.text
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=243, version=40116,
count=4, id=241, version=40116,
count=20, id=242, version=40116,
count=9, id=239, version=40116,
count=219, id=1, productName=Unmarked objects,
count=59, id=246, version=40116,
count=1, id=238, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
bin/bfi.exe
- SHA256 8f26a3f1a1f6f9ac0c279b7df56c41c79e4f23aaefd7da6e6ded16d091d4ad81
- MD5 edbdd5893d753fa68865ec3ad7dfe06d
- SHA1 8d3a30e823f5d0c5e3fbca135bb04891475219de
- SHA512 0c0e88f1f5100a2f67ee947b86081d1c30507eb018c1484e12b9255f6578aa9e0b59d6e5dbbef8a8e34d9e36e90666d97d44e3f3cc29dbf0f8bb3bc7584e0756
- SSDEEP 1536:gIvqSxs6WCegu1660dUyL0sCtA47jpsV4FjiXDJBE5baPXYUxn5ob2guBtXZ:gIhsJ166QUFJtAKjMXDJBE5kBzvX
- TLSH T12A93026F3E976E3EE53A2A745B08AD285B958C8C23E6D1B74C33531D293720D7349253
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
205360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
89KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=16, id=14, version=7299,
count=52, id=10, version=8047,
count=22, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=136, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
out.upx
- SHA256 0dbfc2bb3f35a8596d0932fbdaf364e492a7807e899e14d7d460d354be1608a4
- MD5 9aadf4488d7f0cd1986b3a55b857f9bc
- SHA1 1b97c1b6b9ca8e91634af1d4a6ab8d39016ae7a0
- SHA512 90b01ca4aa84c54af9497ee32c0c9abfb944b176c5e1177fc426049d123689e3c25e21886c42f7bed1282a763ab24fd08231dfcfdafacc43fc710ba64f1e371d
- SSDEEP 3072:9QLOdhKyyW1biW6Emogs52k9O1Ue77CdHmlTsi+5uMqqDLy/:TBiW67oj2CpmlTzCqqDLu
- TLSH T1D9148D3230C0C2BFC462053254E1A77DEBF9976613398C87EB28AE4D6D215E5D37A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
118076
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=16, id=14, version=7299,
count=52, id=10, version=8047,
count=22, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=136, id=1, productName=Unmarked objects,
count=1, id=11, version=8966,
bin/bin64/libwim-15.dll
- IMPHASH 00837f799e98ba17354b0e000174b764
- SHA256 d45410402e79df165f4c3dfd2ba00826c6ac5955511e7e4b3eda55fc29a061cf
- MD5 d9df436f581d2042809bd0d798f66fbf
- SHA1 5fd64a1380b7bd9cef9247806b138f5f6948a65a
- SHA512 c8d53417bc47ee7c9c0c205241c9637c09cdb634c85ae78da886a8b87bfb7d0fbbee1d899e4b8e30fd174ad4fd08748be6868ced59717288e318d0449f4805ea
- SSDEEP 12288:u0V5hKcGd1iRoxIIgS6qoKDr+mQVyoR8vTG1A58rxOiOX+eliCe:red1NgS6qomPoym874m6xHFeliCe
- TLSH T1B3F46B03E3E210BCD1B7D6704A7B5732A973F8152930DE5E6298DB793F22E50862DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileW
CreateSemaphoreA
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
OutputDebugStringA
RaiseException
ReadFile
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEndOfFile
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_beginthreadex
_endthreadex
_errno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_lock
_lseeki64
_open_osfhandle
_setjmp
_stat64
fwprintf
_telli64
_time64
_ultoa
_unlock
_waccess
_wassert
_wcsicmp
_wfopen
_wgetenv
_wmkdir
_wopen
_wstat64
_wtempnam
_wunlink
abort
calloc
exit
fclose
feof
ferror
fflush
fgetwc
fopen
fputc
fputwc
fputws
fread
free
fwrite
getc
getenv
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
putc
qsort
rand
realloc
signal
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strtol
strtoul
tolower
toupper
towlower
ungetc
ungetwc
vfprintf
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstoul
_wstat
longjmp
_write
_strdup
_read
_getcwd
_fdopen
_close
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
584KB
Virtual Size
582KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/bin64/wimlib-imagex.exe
- IMPHASH e3ed2ca34e65fe10b25c52b3dbe563fa
- SHA256 fc1d5a29a0a118f032f3f7fb62c96014d36e6439fab67df739336d75c673bb74
- MD5 03bf621cebeb73062789274d43cc331d
- SHA1 997a2200696d73bd9ad25d9af3cf68465ccb1e43
- SHA512 3160525a557e7156e21c58e531ed08adda029cbb7b5b1352804b27dfa5427aae525ba84af822a92c068d47a0e6fd13a79451c420ae0171d6161e3d2595a4187d
- SSDEEP 1536:eQBYoMkDhWUvBKvA27SVG1SJFIAq/JaJSBXJVDvrj3xlAxCBSmvc+ez1Fc:RYhkDhzvBK97SVdQKSZdCxCIma1q
- TLSH T114D3E801A3F610B8E5B7AA340DB75261BB73BC615A34CE2E525CD5792F63D40AE24F32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libwim-15
wimlib_add_image_multisource
wimlib_create_new_wim
wimlib_delete_image
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_get_compression_type_string
wimlib_get_error_string
wimlib_get_image_property
wimlib_get_version_string
wimlib_get_wim_info
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join_with_progress
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_image_property
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_fpreset
_gmtime64
_initterm
_lock
_onexit
_putws
_setmode
fwprintf
_unlock
_wcmdln
_wcserror
_wcsicmp
_wfopen
_wgetenv
_wstat64
abort
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memcpy
memmove
memset
realloc
signal
strerror
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsrchr
wcstoul
_wcsdup
_isatty
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/bootmui.txt
- SHA256 db6a22b19fdcafc344cf4c544cc972bb43aeefa993358ef97f2bd8e19d42f5b8
- MD5 a08f64f779c3fc937945def623f6c331
- SHA1 25b0fef17e4f9fb47fc97f7e00d100a729ae6236
- SHA512 73cdedfb6ec15877d7795dd6c09693fde260dedea8721b44d8c56999416f9222d800d0a08bca59b80762c09d335a5e53c2c338dbd02597d29443dcff0d6fc127
- TLSH T12A014C78F81B086336E1BEF4BCF2084C5E8692E04955EF449139319BF826D349DF0360
- MD5 SHA1 SHA512 TLSH
bin/bootwim.txt
- SHA256 3d808a95c035dae306ad2929de617c7727abecab0bddeb34638f1ba4d3c52e80
- MD5 e70e4bc070958d8537450a1353fbfbbf
- SHA1 9a3ec46f6fd7a8930d3b69285836c3efee09dff2
- SHA512 a9b2bc2e2423d68c418c61441e12f32c6193752070413771bab4be9247cae6db3c452ec8004465d8305ec596a19df7e666a4ad2efde6c128d3fd7f8622922cd1
- TLSH T124418B2DC927840737240FF535CAAE0C65A26946BF23A37088344BEF568792FDE5C0B9
- MD5 SHA1 SHA512 TLSH
bin/cabarc.exe
- IMPHASH c362751f44a9f875b2280fc6dcfae10c
- SHA256 cceaa59cb4e67f993b099c5e2693eb15231de3863e29da14ff130f24b66ff260
- MD5 a02a8702c6c539bd8648ccbb1869a604
- SHA1 c16da959c5aa9f29346e22fb07802cfa8f7b453f
- SHA512 6b871519e6d190d7703aed7e58d11b0bd69b731a44f90be0869efe00d256da982601b69d01721f8002c99d4cb5d36913b171306a79bb62bd4a5f9655f78ec3d3
- SSDEEP 1536:7xJDrXJTUZQM99pEY+7mfZZt7BN6e5ooPzUOmJ9ybae9rvpI0svZWGKAkro7m+8+:7xJDr5T6Wz7mf7tr6EUHJ9ybaOrWbKAf
- TLSH T1D283BF927FE89097CAC752709349B76ABF7847F20511B29F6B189C903A52FC2FF20255
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7b:07:3d:ec:1d:6f:85:c8:1b:53:d4:c2:11:6b:24:a9:4d:4d:c3:27:21:a2:55:6c:42:d0:7a:e1:fa:6c:41:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 15, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
45:43:a5:dc:20:07:fc:17:d6:59:f4:ec:e4:36:eb:bb:a8:50:81:67
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 15, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2a:9f:4b:23:5f:cf:b0:f0:9d:00:00:00:00:00:2a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Minor OS version
0
Major OS version
5
Entry point
18304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
msvcrt
fgets
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
fopen
malloc
__p__fmode
__set_app_type
_except_handler3
_controlfp
isspace
fclose
_getch
time
srand
rand
strchr
_tempnam
free
memmove
sprintf
strrchr
strncpy
isdigit
atoi
_stricmp
_strnicmp
toupper
printf
exit
_adjust_fdiv
__p__commode
kernel32
SetFilePointer
WriteFile
ReadFile
LocalFree
LocalAlloc
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
CreateDirectoryA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
CreateFileA
GetLastError
GetFileInformationByHandle
CloseHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=2, id=19, version=9049,
count=40, id=2, version=7274,
count=1, id=6, version=2090,
count=60, productName=Unmarked objects (old),
bin/cdimage.exe
- IMPHASH d7b38d0f2022ae83ed59a720772478e0
- SHA256 0b82e3775615e8f7babf5cf5be59c836d397ea7dbf1871bd5fdf4bedceaead86
- MD5 c9d5d0ea346d48185ac2eef836ba04a2
- SHA1 805f26e7a8450502201ceceb5dd041152780f639
- SHA512 65944e597b23669cb9a1b3b82043c7b08f5d4e7514147a18a4817011e5594033dc820617e9d11ed5b2bbd9539d6449d471327c7521d4a21e9a23be3db9e96025
- SSDEEP 1536:k934eRJXKj7KghBvawIpt6Vrw4tZCGGqHZUJdl4ivdUKgJubS5EJ17NNfPD+AQ:k934eR1Kj7R2PqiPvGH5EJ17NpB
- TLSH T1E6C38D12DBC442B5C4D320F4379CB3B199BDD97E032A1AC73B4C47E46454BD2E6B2A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
95952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
CDIMAGE.pdb
kernel32
GetVersionExA
SetErrorMode
GetSystemTime
SystemTimeToFileTime
SetFileApisToANSI
SetFileApisToOEM
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
lstrlenW
FindFirstFileW
FindFirstFileA
FindClose
GetLongPathNameW
GetLastError
GetLongPathNameA
HeapFree
CreateFileW
CreateFileA
CloseHandle
WaitForSingleObject
SetEvent
FileTimeToSystemTime
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
ReadFile
GetFileTime
GetFileInformationByHandle
FindNextFileA
FindNextFileW
GetOverlappedResult
SetEndOfFile
SetFilePointer
CreateEventA
WriteFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetModuleHandleA
GetProcessWorkingSetSize
SetProcessWorkingSetSize
InitializeCriticalSection
VirtualFree
SetConsoleCtrlHandler
ExitProcess
FormatMessageA
GetProcessHeap
HeapAlloc
VirtualAlloc
VirtualLock
ResetEvent
GetProcAddress
ReleaseSemaphore
CreateThread
WaitForMultipleObjects
SetThreadPriority
CreateSemaphoreA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
msvcrt
strrchr
_stricmp
wcstok
strtok
_wfopen
fgetws
_wcsicmp
fclose
fopen
fgets
_strnicmp
_strtoui64
strtoul
tolower
atoi
srand
time
vfprintf
_ultoa
rand
_wcsnicmp
_errno
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
memcpy
memset
?terminate@@YAXXZ
_controlfp
isleadbyte
_fileno
free
mbtowc
__mb_cur_max
_snprintf
_itoa
wctomb
malloc
ferror
__badioinfo
__pioinfo
_isatty
_write
_lseeki64
wcsrchr
wprintf
strchr
wcschr
_strupr
wcsncmp
exit
printf
fflush
fprintf
_iob
feof
memcmp
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=205, version=65501,
count=14, id=207, version=65501,
count=69, id=206, version=65501,
count=5, id=203, version=65501,
count=169, id=1, productName=Unmarked objects,
count=13, id=210, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
bin/imagex.exe
- IMPHASH 6816108faf77a6c11f4b9ffc7bae891f
- SHA256 4edb6afb13477de51459096cc3f7d2a497f053fecf05cc3c360451fede667848
- MD5 a452fd6f47c7f603c2c2034dacc8cac4
- SHA1 81beb20db768bc42d5e7df7d77a02d792d5ef92e
- SHA512 0b4b211df29fe208a2d3f44c4c065cd840f991ae02a48bcecd0d886e7e52df51bd4c707f0f927f5955fe36f40a0eb9f751240f143e5f165be33f0b6e9ecde3e7
- SSDEEP 12288:x+gWMYl2snR/Dbzw6Cf2rkKul/WDsk+VR9QikUmInpNgvsPPetKAr/GhME1BA5Of:/7bsnRNCf2r7ulOikUmiNTMO5
- TLSH T16BD46B21B6E8403EF7F335B04D392669597EB9626A70C88F53808D5D19716C0EA387BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:c9:0c:a3:10:28:64:07:22:71:32:f6:f5:7d:4c:f8:00:36:dd:d5:0f:f1:ce:d0:09:54:dc:4d:b7:e3:e9:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8b:bc:9b:e8:61:73:33:98:ac:ab:d0:0d:13:29:14:8f:9c:bc:1d:09
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b1:71:13:79:df:75:f6:35:c8:00:00:00:00:00:b1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
10
Entry point
546960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
imagex.pdb
msvcrt
_lock
_except_handler4_common
memmove_s
_strcmpi
wcstoul
_unlock
_wcsupr
_snwprintf_s
qsort
_wcsrev
_wcslwr
_strnicmp
__dllonexit
strcpy_s
_wcstoi64
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_onexit
_exit
wcsstr
wcsncmp
wcsnlen
exit
__set_app_type
swscanf_s
towupper
_wcsnicmp
wcschr
_vscwprintf
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wtoi
wcsrchr
_wtol
fflush
memmove
_wcsicmp
__iob_func
memcpy
memcmp
printf
iswspace
_purecall
malloc
_callnewh
_cexit
bsearch
free
memcpy_s
memset
_vsnwprintf
ntdll
DbgPrintEx
NtYieldExecution
RtlRaiseStatus
RtlReAllocateHeap
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlInitUnicodeString
NtQuerySecurityObject
RtlImpersonateSelf
NtSetEaFile
NtCreateFile
NtQueryEaFile
NtQueryVolumeInformationFile
NtQueryInformationProcess
NtQueryInformationFile
RtlAdjustPrivilege
NtClose
NtQueryDirectoryFile
NtOpenFile
RtlDosPathNameToNtPathName_U
NtSetSecurityObject
RtlFindAceByType
RtlSetControlSecurityDescriptor
RtlGetLastNtStatus
RtlFreeHeap
RtlAllocateHeap
NtSetInformationFile
RtlNtStatusToDosError
RtlGetVersion
kernel32
MapViewOfFile
CreateFileMappingW
lstrcmpW
CreateSemaphoreW
GetDriveTypeW
GetTempFileNameW
DeleteFileW
GetTempPathW
GetLogicalDrives
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
UnmapViewOfFile
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
WaitForMultipleObjects
ReleaseSemaphore
GetPrivateProfileSectionW
DuplicateHandle
UnlockFileEx
LockFileEx
GetVolumeInformationByHandleW
GetSystemWindowsDirectoryW
GlobalMemoryStatusEx
TerminateProcess
FindClose
GetFinalPathNameByHandleW
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
CreateEventW
OpenProcess
ReleaseMutex
LocalAlloc
GetModuleHandleExW
CreateMutexW
HeapReAlloc
RemoveDirectoryW
SetFilePointer
GetFileSize
GetCurrentThread
SetThreadIdealProcessor
GetSystemInfo
DeleteCriticalSection
GetOverlappedResult
ReadFile
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
GetHandleInformation
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
CreateDirectoryW
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetLastError
WriteFile
GetConsoleMode
GetConsoleScreenBufferInfo
WriteConsoleW
SetConsoleCursorPosition
GetStdHandle
InitializeCriticalSection
FlushFileBuffers
CopyFileExW
GetFileInformationByHandle
SetFileAttributesW
CreateFileW
DeviceIoControl
GetCurrentDirectoryW
LoadLibraryExW
FindNextFileW
GetVolumePathNamesForVolumeNameW
LoadLibraryW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
MultiByteToWideChar
CreateSemaphoreExW
GetExitCodeProcess
CreateProcessW
GetLogicalDriveStringsW
FindFirstFileW
FreeLibrary
GetModuleHandleW
SetConsoleCtrlHandler
GetModuleFileNameW
WaitForMultipleObjectsEx
GetFullPathNameW
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetTickCount64
GetSystemDirectoryW
GetFileAttributesW
CompareStringW
GetCommandLineW
SetLastError
GetEnvironmentVariableW
LocalFree
WaitForSingleObject
OpenEventW
FormatMessageW
HeapFree
SetEvent
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateThread
GetProcAddress
FillConsoleOutputCharacterW
user32
CharPrevW
LoadStringW
CharNextW
CharUpperW
shlwapi
PathMatchSpecW
StrStrIW
setupapi
SetupFindFirstLineW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupGetLineTextW
rpcrt4
UuidFromStringW
RpcStringFreeW
UuidToStringW
RpcBindingFree
RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
UuidCreate
I_RpcMapWin32Status
NdrClientCall2
RpcStringBindingComposeW
fltlib
FilterLoad
FilterAttach
cabinet
ord22
ord20
ord23
advapi32
GetSecurityInfo
SetSecurityDescriptorDacl
EqualSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetTokenInformation
OpenThreadToken
InitializeSecurityDescriptor
RegUnLoadKeyW
RegLoadKeyW
GetAclInformation
GetSecurityDescriptorLength
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegCloseKey
RegDeleteKeyExW
RegFlushKey
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
AdjustTokenPrivileges
AllocateAndInitializeSid
OpenProcessToken
FreeSid
CheckTokenMembership
OpenEncryptedFileRawW
WriteEncryptedFileRaw
CloseEncryptedFileRaw
RevertToSelf
ReadEncryptedFileRaw
RegQueryInfoKeyW
SetThreadToken
AddAccessAllowedAceEx
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
bcrypt
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
Name
.text
Size
536KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=24610,
count=20, id=260, version=24610,
count=322, id=1, productName=Unmarked objects,
count=13, id=257, version=24610,
count=4, id=261, version=24610,
count=146, id=264, version=24610,
count=1, id=255, version=24610,
count=1, id=258, version=24610,
bin/libwim-15.dll
- IMPHASH 177db15880a3279696633581d336089c
- SHA256 b3e2d47463a1845355e03f36f29258f5f41b4019d78f42867dc99147d4cbaa72
- MD5 69132ffb2954cfaf6c38e319ef9eb21e
- SHA1 a865ed3fa1ca0b6560d09bd95b8a561faac626b3
- SHA512 92e4a00e02060f681433eb3588a9ad06e79bff535a8f1812c3b1e5be7ac4df982f2c4d0fa5ab380ad6ecc9595da4161da64db7c568e29d36b2f8e966592eae4d
- SSDEEP 24576:fklREJ4vh1yqVey+y83RKaLyFA1E6C7Xm8jqO8ew9J5p:IREJ4Z9wyWRKaLyt6omdO8ew9d
- TLSH T14E053A49EBC700F1FA73A57199ABF27F4A31B9128432CEAADF4D1949F933A11481D316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
SystemFunction036
WriteEncryptedFileRaw
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileW
CreateSemaphoreA
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetVolumeInformationW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
OutputDebugStringA
RaiseException
ReadFile
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEndOfFile
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__mb_cur_max
_amsg_exit
_assert
_beginthreadex
_endthreadex
_errno
_fstat64
_get_osfhandle
_gmtime64
_initterm
_iob
_lock
_lseeki64
_open_osfhandle
_setjmp3
fwprintf
_telli64
_ultoa
_unlock
_waccess
_wcsicmp
_wfopen
_wgetenv
_wmkdir
_wopen
_wstat64
_wtempnam
_wunlink
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetwc
fopen
fputc
fputwc
fputws
fread
free
fwrite
getc
getenv
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
putc
qsort
rand
realloc
setlocale
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strtol
strtoul
tolower
toupper
towlower
ungetc
ungetwc
vfprintf
time
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
wcstombs
wcstoul
_wstat
_stat
longjmp
_write
_strdup
_read
_getcwd
_fdopen
_close
ntdll
NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtOpenSymbolicLinkObject
NtQueryDirectoryFile
NtQueryEaFile
NtQueryInformationFile
NtQuerySecurityObject
NtQueryVolumeInformationFile
NtReadFile
NtSetEaFile
NtSetInformationFile
NtSetSecurityObject
NtWaitForSingleObject
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlNtStatusToDosError
user32
wsprintfW
wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_image_property
wimlib_get_version
wimlib_get_version_string
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_image_property
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
Name
.text
Size
582KB
Virtual Size
581KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/offlinereg.exe
- SHA256 6ad78c3e6a07ec84bbe399f3be156edc3ee1da525bd87f7c0c716846708a111a
- MD5 6dc5ad65078eb5229fbbd1f06f61cf0b
- SHA1 e0f89640230db562d32099c4851e1ebb90dcfc98
- SHA512 a91f2dbf7b2435461805c3d756f5ac1eff27da8d84c9e3076e8cd1ac9ebcc9bbad77820d0eb3bfe3ea0de91d50fe69549baac9687ffa536d27522d8a775d57ec
- SSDEEP 3072:Pp/5MaKYvuo3Khqef9uVrAgXuQbkX2hgqjYDsqLhPEcrrFm9gh:P1mgt3w9J2gqjYDsqLhP70
- TLSH T1B5B33B22B2D08472E0709E7CCC15B2E4943AFDA12D68956AB7F85E4DCE393C1686D3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
99520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/offreg.dll
- IMPHASH 7f06a5f1ddbdb3daa4bd9e267b9e1f4c
- SHA256 a8e3149c77c235818cbbf2686cecd66683e2d3864860074f0777c13b1140a9a2
- MD5 163db46b803e4c83c444a026ff17d269
- SHA1 0a2585db6a5c2f7f467fd85df622e9c0632b9b2e
- SHA512 9a14ef16e30f8bf72a89fe3154e04d879d1ce8bbdcee4942dcdfb74da6e5584a19853b64ee4a36fb9af04e2e641f1e0ba04b2f5187e2ceeaf9085685e1d78c31
- SSDEEP 768:V5zyp6v0wj3hpUTAvZxdW9UzjzvH+qREOtJWS1temkz1ImTWvERLkEzrBJOkMm75:bv02hphxdSevH+uJWEMb9TWWkEZQ0
- TLSH T17A437D22B52481BBC4DA75B1215E7276293EC7820B219ACF07761DF6B9617C09F387CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
13:3f:33:a4:99:03:ab:e0:5c:63:75:f6:fe:c4:d9:6b:4d:c1:a9:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 9, 2010
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:04:b3:f5:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2008 - Jul 25, 2011
Subject
CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:23:0f:00:00:00:00:00:0a
Issuer
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:02:dc:00:00:00:00:00:0b
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 15, 2005 - Mar 15, 2016
Minor OS version
1
Major OS version
6
Entry point
6067
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
offreg.pdb
msvcrt
_wcsicmp
_aligned_malloc
_aligned_free
towupper
_wcsnicmp
memmove
memcpy
memset
_amsg_exit
_initterm
free
malloc
_XcptFilter
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryA
TlsFree
TlsAlloc
TlsGetValue
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
GetProcessHeap
CreateFileW
CloseHandle
ReadFile
WriteFile
GetFileSizeEx
FlushFileBuffers
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
TlsSetValue
GetSystemTimeAsFileTime
TerminateProcess
advapi32
InitializeSid
DestroyPrivateObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorControl
MakeSelfRelativeSD
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetPrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
GetSidLengthRequired
GetSecurityDescriptorLength
GetSidSubAuthority
ORCloseHive
ORCloseKey
ORCreateHive
ORCreateKey
ORDeleteKey
ORDeleteValue
OREnumKey
OREnumValue
ORGetKeySecurity
ORGetValue
ORGetVersion
ORGetVirtualFlags
OROpenHive
OROpenKey
ORQueryInfoKey
ORSaveHive
ORSetKeySecurity
ORSetValue
ORSetVirtualFlags
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
PAGE
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=115, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=83, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bin/wimlib-imagex.exe
- IMPHASH 821831e619b1d3f0415e047c23b0e09b
- SHA256 4e19d62d0615f8e0093a800b8f73f353ff6764a930d60ebea4fac0555cdd7661
- MD5 62e9ec7613c8c1ad727d7be7c1f07acb
- SHA1 cfc744b67b64adc968d4da3535eec2d9462b3824
- SHA512 45e83f079feb6ae31d5b7a0a75ba7d24fb1765991c7124592c9122f593264cc1371d652553d408ce83f15b035f849e4d275f36350ce2208ac6f75531c1748375
- SSDEEP 3072:DidbO0Zgqv5ruiKEvr23KSc43ZKKm2HBSHfKQ:Di9vGc5rJKEvr2353pm2h+
- TLSH T1F2E30740F7D740F1F5B32AB058AAD37E4537BE128934DE2EE74C959AAB33A405620727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libwim-15
wimlib_add_image_multisource
wimlib_create_new_wim
wimlib_delete_image
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_get_compression_type_string
wimlib_get_error_string
wimlib_get_image_property
wimlib_get_version_string
wimlib_get_wim_info
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join_with_progress
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_image_property
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__lconv_init
__mb_cur_max
__p__commode
__p__fmode
__p__wcmdln
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_errno
_commode
_fmode
_fpreset
_gmtime64
_initterm
_iob
_lock
_onexit
_putws
_setmode
fwprintf
_unlock
_wcserror
_wcsicmp
_wfopen
_wgetenv
_wstat64
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputwc
fputws
fread
free
fwrite
getenv
iswctype
localeconv
malloc
memcpy
memmove
memset
realloc
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcsrchr
wcstoul
_wcsdup
_isatty
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
convert-UUP.cmd
- SHA256 738f5e9ab713ed72d1cd5e91b0e716e6c9118d737d292998aafd3e1c4a5102e9
- MD5 0e637069273d766d69127769f2908f7b
- SHA1 3c4d10972647ace3d40f5f9dbc8ccc6ab060af72
- SHA512 666932d5d242a103512dc265fdf56e2b33063a37549f27c0a6e2372ac727e8b23364e74c8169a3501d383d79cd4ed834f34cc92a051a3c3147cf36c7b7128700
- SSDEEP 3072:2pMJzX+ygvKcb2VRJtjzFIePhk1RJtthM0D4vCXxYGFt2zg2crkx/81CZqIUBO7d:2pMJzX+ygvKcb2VRJtjzFIePhk1RJttM
- TLSH T1F1F3095871484166E0F54BB9A2660283BB3FD5735230E3BC773994B4F9F72A310B9AD8
- MD5 SHA1 SHA512 SSDEEP TLSH
create_virtual_editions.cmd
- SHA256 5b3dec361efe27b1c5df00e88a9b355a658a65391febad314c6702afd20059a8
- MD5 7dd29996aca8210300bcb6705f3195d9
- SHA1 089f55e62f3c3e3bd26d0e1a3ced237e26564a7e
- SHA512 ee6fc126ab64006c6644fed45f47dfb17a0ef7e2ea7c2896e4eacf6122f85e9859e1c6edd720a28125844d6a40ecfd46ed8c5f383a8b612f4c2bf3d67b8b2a23
- SSDEEP 1536:5WtDICKwIci0EaScCXqghtm6N0H/sZTR0yckNLZgyZZZ0Z7ayo7kJXp+jVkWPO:YVICKwIci0EaScCXqghtm6N0H/sZTiy6
- TLSH T13293A5943494012AF4BF837296F1B9422BBFF0E20BF1DE4C713894A077DB58699B598D
- MD5 SHA1 SHA512 SSDEEP TLSH
multi_arch_iso.cmd
- SHA256 71b07c37c9a279ad206fd5f53ebb434de561be3661f8a5d2f1efb86381cc006f
- MD5 edec98820c81254846855e69b0a1b7e9
- SHA1 c6c0d51799ce88b00280899545dce46e9e6ab26c
- SHA512 b68cbd9c667e39ddad00c2f11c29b727fc6dcb819776c5acb3493bdd12fa4965f793c5b9ca7ff585ec191fdcc67b0a6b30f320475bf0fb83304dff1ed6c52edd
- SSDEEP 768:yTCTMSpyb6PLqj5k1pQyV4ZNuC38X6JZXiQKwGg7lw2ayo7kJSO+jVUJ:DTMSpAoLqj5k1pQyV4ZNuC38X6Jdlhaa
- TLSH T17BF2E974310B5232A0A187B2E9379046772FD5228670F7CC753D80E476BB3A6A5F6DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
lot_size_files_clear_away.cmd
- SHA256 7e9570228ef135c09eb43ba9ff26d9239ef76fc2026413394891fbc92c02877d
- MD5 cdccd15239db325ef65a322b5861cadb
- SHA1 ae1c7b7baa7156a2682e77aa3e88197c35be1340
- SHA512 e56826505542037f7c41f7011b202592214aa7fb48dc547ba71a3af5a7990bb3d0c096039923251b5ebfb3181a292bf2b3f20674c8ea0085bc33c8840a84f38d
- TLSH T1EBF067E72814262682801BA8CF9C04B6A0CED0E3FD215830F1F70C9AE03BB304A5BEC0
- MD5 SHA1 SHA512 TLSH
uupdownload - app.cmd
- SHA256 b6ae5ae61d6650c2afc2bec6208b0b209a4fb1647b83bd5912e4d15fef0aced3
- MD5 f70aaa0150435bee078b9158f9aaaa44
- SHA1 575701534430f808df5a15c7cebd8661b5f51220
- SHA512 36eddc6f17101b0dab2e72e4386e395b6fcff22f5c5cb29616c67503cfcfc0689029f365bd98efa2a9661f3e36ba9ec2cf27e809ac72dbffc2e976f148b2aace
- SSDEEP 768:G0xPxsIvOsihhE1B2wWyk6c6Bij14NDAOI:G0xPxv0SDXMrOI
- TLSH T118D2FE027E4CA06AA2FDEE449E70D835F739F38B45687D48F26B067E6B43781786D640
- MD5 SHA1 SHA512 SSDEEP TLSH
uupdownload - legacy.cmd
- SHA256 16e4ca2de83ebab00f5300aa5bc761a1b58621c1c3a3c6ab0ab9ff6787522171
- MD5 a3822d5bb819571aa7fce4d7bff40d61
- SHA1 4b28ed2963de536c884e10128aa7468d43c6c308
- SHA512 355191aa71967ff086d22be585af654291a49cec36cbdcd706f51e83760f9555eda4fcb029373f0b70e2ebcaa84777392d499bb5575c96d13ac13a33912fcfee
- SSDEEP 768:S0xPx42lZsUoahiVB2wPoj36c6Bi94d7eGNDAOI:S0xPxDlNi/XMgaOI
- TLSH T1DCF200257D68A06AA2FDDA418E70D835FA3AF387442CEE08B27B057E67477C0397D641
- MD5 SHA1 SHA512 SSDEEP TLSH