SecretTweaks.zip
- SHA256 ea5904365c78a06003d0c428e68cbe3391c30e7cb2ccace0bc95c3c9d96b36e0
Overview
overview
9Static
static
3SecretTweaks.zip
windows10-2004-x64
1SecretTweaks.zip
windows11-ltsc_2024-x64
1SecretTwea...OL.exe
windows10-2004-x64
1SecretTwea...OL.exe
windows11-ltsc_2024-x64
1SecretTwea...ss.dll
windows10-2004-x64
1SecretTwea...ss.dll
windows11-ltsc_2024-x64
1SecretTwea...ss.log
windows10-2004-x64
1SecretTwea...ss.log
windows11-ltsc_2024-x64
1SecretTwea...ER.exe
windows10-2004-x64
4SecretTwea...ER.exe
windows11-ltsc_2024-x64
4SecretTwea...xy.log
windows10-2004-x64
1SecretTwea...xy.log
windows11-ltsc_2024-x64
1SecretTwea...KM.exe
windows10-2004-x64
1SecretTwea...ak.exe
windows10-2004-x64
9SecretTwea...ak.exe
windows11-ltsc_2024-x64
9SecretTwea...de.cfg
windows10-2004-x64
3SecretTwea...de.cfg
windows11-ltsc_2024-x64
3SecretTwea...64.dll
windows10-2004-x64
1SecretTwea...64.dll
windows11-ltsc_2024-x64
1SecretTwea...lp.dll
windows10-2004-x64
1SecretTwea...p.json
windows10-2004-x64
3SecretTwea...p.json
windows11-ltsc_2024-x64
3SecretTwea...de.cfg
windows10-2004-x64
3SecretTwea...de.cfg
windows11-ltsc_2024-x64
3SecretTwea...es.cfg
windows10-2004-x64
3SecretTwea...es.cfg
windows11-ltsc_2024-x64
3SecretTwea...ey.txt
windows10-2004-x64
1SecretTwea...ey.txt
windows11-ltsc_2024-x64
1SecretTwea...rs.cfg
windows10-2004-x64
3SecretTwea...rs.cfg
windows11-ltsc_2024-x64
3SecretTwea...ng.txt
windows10-2004-x64
1SecretTwea...ng.txt
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SecretTweaks.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecretTweaks.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SecretTweaks/SecretTweak/BYND-TOOL.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
SecretTweaks/SecretTweak/BYND-TOOL.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
SecretTweaks/SecretTweak/Bypass.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SecretTweaks/SecretTweak/Bypass.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SecretTweaks/SecretTweak/Bypass.log
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
SecretTweaks/SecretTweak/Bypass.log
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
SecretTweaks/SecretTweak/Proxy.log
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
SecretTweaks/SecretTweak/Proxy.log
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
SecretTweaks/SecretTweak/STKM.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
SecretTweaks/SecretTweak/SecretTweak.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral15
Sample
SecretTweaks/SecretTweak/SecretTweak.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral16
Sample
SecretTweaks/SecretTweak/SecretTweakGameMode.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
SecretTweaks/SecretTweak/SecretTweakGameMode.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
SecretTweaks/SecretTweak/SecureEngineSDK64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
SecretTweaks/SecretTweak/SecureEngineSDK64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
SecretTweaks/SecretTweak/dbghelp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
SecretTweaks/SecretTweak/device_settings_backup.json
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
SecretTweaks/SecretTweak/device_settings_backup.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
SecretTweaks/SecretTweak/exit_gamemode.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
SecretTweaks/SecretTweak/exit_gamemode.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
SecretTweaks/SecretTweak/games_priorities.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
SecretTweaks/SecretTweak/games_priorities.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
SecretTweaks/SecretTweak/key.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
SecretTweaks/SecretTweak/key.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
SecretTweaks/SecretTweak/launchers.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
SecretTweaks/SecretTweak/launchers.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
SecretTweaks/SecretTweak/logs/logging.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
SecretTweaks/SecretTweak/logs/logging.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target SecretTweaks.zip
- Size 28.9MB
- Sample261030-2tatpsff95
- SHA256 ea5904365c78a06003d0c428e68cbe3391c30e7cb2ccace0bc95c3c9d96b36e0
- MD5 61d5b315fb173e3f7edde81b79258c92
- SHA1 9dc8f992c8c098f9e8a7f20218af31a9efdd7220
- SHA512 9ab78b6eb99318d6aa231ee1e912d41a892b2282d945cc22138c79a4c380ad08342b0aa5a26451eb618144b73946fa6082b0ab88cc24e89c1388e7f05fb1c7ac
- SSDEEP 786432:bsiBXaQDdJj66CahbjbLe4XIKmFASZRSwrf6y/w:HaQDZvLI/A2SQhI
- TLSH T170673360FEB35141D829387A143ECF02E35D2AE6E779D382F5960CE6F3D832B6661461
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/SecretTweaks/SecretTweak/BYND-TOOL.exe unpack001/SecretTweaks/SecretTweak/Bypass.dll unpack001/SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe unpack001/SecretTweaks/SecretTweak/SecretTweak.exe unpack001/SecretTweaks/SecretTweak/SecureEngineSDK64.dll unpack001/SecretTweaks/SecretTweak/winhttp.dll unpack001/SecretTweaks/patcher.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/SecretTweaks/SecretTweak/STKM.sys
File Explorer
-
SecretTweaks.zip.zip 28.9MB
-
SecretTweaks/SecretTweak/BYND-TOOL.exe.exe 5.0MB
-
SecretTweaks/SecretTweak/Bypass.dll.dll 305KB
-
SecretTweaks/SecretTweak/Bypass.log315KB
-
SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe.exe .ps1 1.0MB
-
SecretTweaks/SecretTweak/Proxy.log7KB
-
SecretTweaks/SecretTweak/STKM.sys.exe 27KB
-
SecretTweaks/SecretTweak/SecretTweak.exe.exe 11.4MB
-
SecretTweaks/SecretTweak/SecretTweakGameMode.cfg2KB
-
SecretTweaks/SecretTweak/SecureEngineSDK64.dll.dll 28KB
-
SecretTweaks/SecretTweak/dbghelp.dll.dll 2.1MB
-
SecretTweaks/SecretTweak/device_settings_backup.json4KB
-
SecretTweaks/SecretTweak/exit_gamemode.cfg39B
-
SecretTweaks/SecretTweak/games_priorities.cfg153B
-
SecretTweaks/SecretTweak/key.txt3B
-
SecretTweaks/SecretTweak/launchers.cfg509B
-
SecretTweaks/SecretTweak/logs/logging.txt83KB
-
SecretTweaks/SecretTweak/symsrv.dll.dll 413KB
-
SecretTweaks/SecretTweak/system_priorities.cfg153B
-
SecretTweaks/SecretTweak/vcredist.url.url 189B
-
SecretTweaks/SecretTweak/winhttp.dll.dll 161KB
-
SecretTweaks/TUTORIAL.mp434.6MB
-
SecretTweaks/patcher.exe.exe 61KB
SecretTweaks/SecretTweak/BYND-TOOL.exe
- IMPHASH 4a7aa581b94ec0cab69c626547b0cec5
- SHA256 91caa0adcb59c352c723efe886f0aeecf33acee45bde06c4c3e15096ebea2483
- MD5 5643b2dda8c8703e36d3bd1ffbc2bd39
- SHA1 e5c7365ccb4ae6ff478c616883bacb8bb44dd37a
- SHA512 ab5f030de316aed75d749a359c1c91f2e3cedef11c6572262e1531ba37c5356c6dc45998cf266982ff5ce7ab85336df3507f0c22dbeee306bd4271169b243a20
- SSDEEP 49152:8E/QNRt2zSGD+ghwvCQuIncR85nw+ToF/X8N6uCiKNr8H2/V7tW/ts:8iQszSZfVDAsN6uCVr22tw6
- TLSH T10436C042E3F8496EE167C2788C02E637D3F67C01932546EFEAC45E5B6A178D84BB9305
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1675328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
ConvertSidToStringSidW
StartTraceW
LookupPrivilegeValueW
RegSetKeyValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegGetValueW
AdjustTokenPrivileges
CloseTrace
ProcessTrace
OpenTraceW
ControlTraceW
OpenProcessToken
GetTokenInformation
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
FlushTraceW
shell32
SHGetKnownFolderPath
CommandLineToArgvW
ShellExecuteW
ShellExecuteA
kernel32
GetProcAddress
LoadLibraryA
GetLocaleInfoA
IsDBCSLeadByte
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetTempPathW
GetFileAttributesExW
FindFirstFileW
FindClose
Process32NextW
GetCurrentDirectoryW
GetLocaleInfoEx
FormatMessageA
GetTickCount64
SetLastError
ReplaceFileW
MoveFileExW
FreeLibrary
DeviceIoControl
WaitForSingleObject
GetFileAttributesW
FlushFileBuffers
DeleteFileW
CreateFileW
ExpandEnvironmentStringsW
GetActiveProcessorCount
GetActiveProcessorGroupCount
GetLogicalProcessorInformationEx
GetSystemCpuSetInformation
GetLocalTime
GetCurrentProcess
Process32FirstW
CreateToolhelp32Snapshot
QueryFullProcessImageNameW
MulDiv
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleW
GetModuleFileNameW
OpenProcess
GetCurrentProcessId
GetProcessTimes
Sleep
CloseHandle
GetEnvironmentVariableW
GetCommandLineW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetModuleHandleA
GetCurrentThreadId
CreateThread
GetWindowsDirectoryW
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
SleepConditionVariableSRW
WakeAllConditionVariable
SetUnhandledExceptionFilter
GetStartupInfoW
CreateEventW
GlobalLock
GlobalUnlock
GlobalAlloc
WriteFile
OutputDebugStringA
CreateFile2
AreFileApisANSI
GetSystemTimeAsFileTime
GetFileInformationByHandleEx
CreateDirectoryW
InitializeSListHead
user32
BringWindowToTop
SetLayeredWindowAttributes
SetForegroundWindow
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
PostMessageW
WaitMessage
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
IsIconic
IsZoomed
GetKeyState
GetAsyncKeyState
GetCapture
SetCapture
ReleaseCapture
GetSystemMetrics
UpdateWindow
GetForegroundWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
SetFocus
ValidateRect
GetClientRect
IsWindowUnicode
GetWindowRect
MessageBoxA
MessageBoxW
GetCursorPos
ScreenToClient
GetWindowThreadProcessId
LoadCursorW
LoadImageW
EnumDisplaySettingsW
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
GetDpiForWindow
SetProcessDpiAwarenessContext
OpenClipboard
RegisterRawInputDevices
CloseClipboard
SetClipboardData
GetClipboardData
SetPropA
GetPropA
AdjustWindowRectEx
SetCursorPos
SetCursor
EmptyClipboard
GetKeyboardLayout
TrackMouseEvent
GetMessageExtraInfo
RegisterClassW
IsChild
MsgWaitForMultipleObjects
ClientToScreen
WindowFromPoint
GetWindowLongW
SetWindowLongW
GetWindowLongPtrW
InvalidateRect
SetWindowLongPtrW
GetGUIThreadInfo
GetAncestor
GetRawInputData
EnumDisplayMonitors
gdi32
BitBlt
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetDeviceCaps
CreateDIBSection
msvcp140
?rdstate@ios_base@std@@QEBAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
_Cnd_broadcast
_Cnd_signal
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Random_device@std@@YAIXZ
_Xtime_get_ticks
msvcp140_atomic_wait
__std_atomic_wait_direct
__std_atomic_notify_all_direct
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
wevtapi
EvtNext
EvtQuery
EvtRender
EvtClose
hid
HidD_SetFeature
HidD_GetFeature
HidD_FreePreparsedData
HidP_GetCaps
HidD_GetAttributes
HidD_GetHidGuid
HidD_GetPreparsedData
iphlpapi
IcmpCreateFile
IcmpSendEcho2Ex
GetAdaptersAddresses
vcruntime140
memcpy
memmove
memset
strchr
strrchr
__std_exception_destroy
strstr
longjmp
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
memchr
__std_exception_copy
__std_terminate
__intrinsic_setjmp
memcmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
_wcsicmp
strcpy_s
isspace
_stricmp
_strnicmp
strcpy
tolower
toupper
iswspace
strlen
towlower
wcslen
strncmp
strcmp
wcsnlen
strncpy
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
free
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vfprintf
ftell
fseek
_wfopen
__acrt_iob_func
__p__commode
__stdio_common_vsprintf_s
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vswprintf_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
_dsign
fmodf
sqrtf
acosf
sinf
pow
floorf
ceilf
__setusermatherr
cosf
floor
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_localtime64_s
strftime
_time64
api-ms-win-crt-convert-l1-1-0
strtol
strtoll
strtoul
strtod
wcstoul
strtoull
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
exit
_errno
_get_wide_winmain_command_line
_set_app_type
_initterm
_initterm_e
_exit
_initialize_onexit_table
_register_onexit_function
_configure_wide_argv
terminate
_c_exit
abort
_seh_filter_exe
_cexit
_register_thread_local_exe_atexit_callback
_beginthreadex
_crt_atexit
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
_configthreadlocale
setupapi
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
CM_Get_Device_Interface_ListW
CM_Get_Device_IDW
CM_Disable_DevNode
CM_Enable_DevNode
CM_Locate_DevNodeW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiGetDevicePropertyW
CM_Get_Device_Interface_List_SizeW
SetupDiGetClassDevsW
ole32
CoTaskMemFree
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
503KB
Virtual Size
502KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=253, version=35721,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=39, id=261, version=35721,
count=8, id=257, version=35721,
count=2, id=262, version=33145,
count=8, id=260, version=35214,
count=61, id=260, version=35227,
count=1, id=260, version=33145,
count=29, id=257, version=33145,
count=492, id=1, productName=Unmarked objects,
count=18, id=261, version=36257,
count=1, id=255, version=36257,
count=1, id=151,
count=1, id=258, version=36257,
SecretTweaks/SecretTweak/Bypass.dll
- IMPHASH ef54a83e6261b23cc5c549c56dba054d
- SHA256 1856fc0ec7b6ead5ce1f08e01e61ed4d8da2c99b82013b866467a4450b4ce56a
- MD5 eb73c35936638c7b901feb651da43752
- SHA1 5446295f27d53ec68a4b273a0b9b0777a8750ddf
- SHA512 598d97e74eeb4382eb31c4890da4a4ada7e4f69d9d80beff602725745d66293020510b3bae551678992e1902738d3268908bb88c057b1ddf807d3597beaffda3
- SSDEEP 6144:K2cbQJBrRNthMmruLQ/KOpF3Fimb19PB1w:Oabtqc/9F3FT
- TLSH T110646B1AA794107DF177813CCD934D45EBF2785607A1EADF13A046A62F23BE09A3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
113792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
GetWindowThreadProcessId
GetClassNameW
EnumWindows
GetWindowLongPtrW
IsWindowVisible
ShowWindow
kernel32
WriteConsoleW
HeapSize
SetStdHandle
RtlCaptureContext
GetEnvironmentVariableW
CreateFileW
GetFileAttributesW
WriteFile
CloseHandle
GetLastError
SetLastError
QueryPerformanceCounter
Sleep
GetCurrentProcess
GetCurrentProcessId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
FlushInstructionCache
GetTickCount
GetTickCount64
GetSystemDirectoryW
VirtualAlloc
VirtualProtect
VirtualQuery
ReadProcessMemory
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualFree
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentThreadId
SetThreadContext
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetConsoleMode
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
BypassInitialize
Name
.text
Size
200KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=157, id=261, version=33145,
count=18, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=15, id=260, version=35207,
count=77, id=261, version=35207,
count=5, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=1, id=261, version=35229,
count=4, id=260, version=35229,
count=1, id=256, version=35229,
count=1, id=258, version=35229,
SecretTweaks/SecretTweak/Bypass.log
- SHA256 98235b2c01b0bb586b3d8f6852848004abb5a2b6d4eb867d8afad61d253aa59b
- MD5 40eadcb818e1b91d6715309c5f380f82
- SHA1 ccd3454a3f43897e64043d2f7cfe578907c0d7ce
- SHA512 18e1a373c147e004d4394345d50cfdec7e86a270be9d8e563e85972deb9bc463279ecf7bf8f3b779da9945b9245b54e0726baf2bf9fcf7dd3c2b53312a270a56
- SSDEEP 3072:kFmCFJAIjAx6Uqq/RaGpbryRtRwL+3bNQNEhohJxvFUl23Bvvt349k4Vm0QKecKr:j
- TLSH T16764E0866FF7AD64607CE27ABE6509CC79D771238E41061BBAAE590AC8BFF04F710411
- MD5 SHA1 SHA512 SSDEEP TLSH
SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 47dd88032a72ce856522713e3e0ecfe023f133fd43bb7273fdbf48533a309304
- MD5 e83f0a7d6edbfe60a1aaf1211b39c67d
- SHA1 74bdf3ec109440b04d58260c6d4c8f4e41c9167b
- SHA512 0796a79a7eabf7c89024d5a02f9fc41d7ea61ce50455711f0462536211bbf97f0aff64494815020af93042686663cdc4071319ae484910eab5461645a909e9f9
- SSDEEP 12288:M0uXRoDAPnOj43fazF5OMEFepGybspDvlgciDGwaA7Xs/OMjbJS:t46aA7Xs/OMjbJS
- TLSH T18935F83A7DAA9926D2C7203E1CDA94047E2A6037410C4E647DDC92C4EF997BCC7F4B99
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1069118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SecretTweaks/SecretTweak/Proxy.log
- SHA256 bea02a8602932608baf8f79506ed2b17cb2c65affe1ec287b59240ef04fc2b3d
- MD5 4ea44c16b2dcfef9de34a8725dcea294
- SHA1 e4e0c0699e7c3637ce2355e1a5f24779e346e5cd
- SHA512 21691ca3241ac3236e2bcebc1dce8a4a1be175a750511cb6330ff8c57d719ae6f8e3b2c96eacc2271f3ba21fc39db7b5d39cbee192a6eba044dcb0ee3eae5441
- SSDEEP 192:8CATmafuMpAiy9LU8m2BcXas+QQ5MviGqtAuk:+24
- TLSH T14FF14C6829678A3386C8C2B6F538479551E60F191FB244F15EBFB32368213E2DB74B35
- MD5 SHA1 SHA512 SSDEEP TLSH
SecretTweaks/SecretTweak/STKM.sys
- IMPHASH 07a0df5c76a6255be0e9a298dc683e15
- SHA256 7a83474024da0840432a52c93545f833d3067b976fdf8fa1670005a2086e3d4d
- MD5 c44f5045d1e11d426ec789b89a604eed
- SHA1 0761f38724be0303176867567da71625079dbfc6
- SHA512 6c822521be718d56e7a9a1946d39eac9316aeb1a9d26c8ded5cc1f17af920de02360c4363d4f40431c5df03cf2168c4cebed695ef39e67467892009968e28582
- SSDEEP 384:A3S+Q7fTKPD5wKaBnB64sa2HId/SzDxoH5HV/auRn+2HX5mkF+5f/DMI8Ir8KPO:sTyTSdJa1JzdaeV/fjLFCMI8cPO
- TLSH T1C6C23A1163D615EEE42AC6BDD2BA1437A7B9B404032348EF35A0C8650FA3FD5E9BC749
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
62:21:52:1d:1e:ca:2c:5a:f3:ef:c1:40:14:e8:98:d2:71:a9:09:7a:7d:79:48:94:42:21:b6:c2:1c:f9:6e:82
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WDKTestCert BYND\,133999996153057023
Chains
Oct 26, 2026
CN=WDKTestCert BYND\,133999996153057023
Subject
CN=WDKTestCert BYND\,133999996153057023
Serial Number
31:9e:20:09:a0:28:06:9a:4c:94:9e:0f:ec:4a:b4:2e
Issuer
CN=WDKTestCert BYND\,133999996153057023
Key Usages
KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2025 - Aug 18, 2035
Minor OS version
0
Major OS version
10
Entry point
16592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\BYND\source\repos\MyDriver1\x64\Release\STKM.pdb
ntoskrnl.exe
RtlFreeAnsiString
DbgPrintEx
KeSetPriorityThread
ExAllocatePoolWithTag
ExAllocatePool2
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetCurrentProcess
RtlUnicodeStringToAnsiString
ObfDereferenceObject
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
ZwWriteFile
ZwClose
PsGetCurrentProcessId
PsGetThreadId
PsGetThreadProcessId
ZwSetInformationThread
SeLocateProcessImageName
ObOpenObjectByPointer
_vsnprintf
__C_specific_handler
strlen
wcscmp
PsThreadType
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlInitUnicodeString
wcsrchr
_stricmp
IoFreeWorkItem
strchr
wdfldr.sys
WdfVersionUnbind
WdfLdrQueryInterface
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=263, version=33140,
count=5, id=257, version=33140,
count=49, id=1, productName=Unmarked objects,
count=6, id=259, version=33140,
count=8, id=260, version=33140,
count=1, id=260, version=35217,
count=1, id=258, version=35217,
SecretTweaks/SecretTweak/SecretTweak.exe
- SHA256 92a65702c5459eb17d64e89027aed58452d5c2af82b4263416d8d1d0c9707bc7
- MD5 bd976ef6e826044093c2969024b516a2
- SHA1 fee7af9150e6d7e5b2c3bf9cec452292efaed4e5
- SHA512 55e0a4c549d9c26e86d56ac37b2fba872de682928eadebdf5a5ba689bc3b1bbdf543b9aff3bb476a4f51e8afe914e82dd4a4fc10ce6da14eae1672aa57d97c11
- SSDEEP 196608:jxYKmji0bBQVps2n4LEysIFUgCVQ+nfDem5MWqPVAOyMG7Eui/gOR/jbGsI53cx:6thbBQVpRnhygQ+nfDefWqPVA197EuiB
- TLSH T1F2C633220361BCBAF08E07B839B7D4F456765E224FBADA1CF1AF05B7464654D8FB6090
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
21811288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
3.3MB
Virtual Size
7.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
993KB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
15KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
175KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2.0MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
29KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=253, version=35721,
count=10, id=260, version=35721,
count=50, id=261, version=35721,
count=6, id=259, version=35721,
count=6, id=257, version=35721,
count=43, id=260, version=33523,
count=5, id=261, version=35728,
count=123, id=260, version=32535,
count=2, id=123, version=2207,
count=61, id=260, version=35227,
count=825, id=260, version=35214,
count=39, productName=Unmarked objects (old),
count=1, id=262, version=33145,
count=5, id=260, version=33145,
count=43, id=257, version=33145,
count=1024, id=1, productName=Unmarked objects,
count=23, id=265, version=36257,
count=1, id=259, version=36257,
count=1, id=255, version=36257,
count=3, id=151,
count=1, id=258, version=36257,
SecretTweaks/SecretTweak/SecretTweakGameMode.cfg
- SHA256 cbd5ae423da986319d5034010ba9946769beef917d72c21e486ff1eb30836c90
- MD5 b6ed2b941560748d37ae3bb71b67ecd7
- SHA1 40a091b51ee02b3911b7c68e5167beaab19fc562
- SHA512 dfb6fed77784a97007b052e423fffc32d268c0be5ae304285f9e36cf8dcbd5a900f60f928a2609837adca05b49530f8a62e703501d927517aa843d8c2372b4a7
- TLSH T11351413545CE127D560064735108BD5EBDAC0CFF2B3B263194A4AF3F79E2466C53CA25
- MD5 SHA1 SHA512 TLSH
SecretTweaks/SecretTweak/SecureEngineSDK64.dll
- SHA256 175a75ca524b269b25fb5144dc0abb4ac9b1673852df3abfbd4f6c449e01827d
- MD5 6d8722b257230e3f691197715ec2b4b1
- SHA1 bf141f3aff5b5e1cd2f02a5d81125931ba4a842d
- SHA512 b6d077c57780ab6d58649cee36a1016573adfcafcfa8c823297a19f8bb1d1ea0c1b613044076bcd805a0c18dc37a78208ebaa4d0e19c192b65415028355f1069
- SSDEEP 192:3Mi08s5GvuxBdzbNEQaSpqX5xS5haVWUcSAfMVIBizxhv:cdZxBhaHfSsA0V
- TLSH T148D2ACAF04B56EFBF91D1CF4059F3A9822C3F3D22DF4866D636E418401EA81B655F289
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ClearEnd
ClearStart
CodeReplaceEnd
CodeReplaceStart
CustomVM00000100_End
CustomVM00000100_Start
CustomVM00000101_End
CustomVM00000101_Start
CustomVM00000102_End
CustomVM00000102_Start
CustomVM00000103_End
CustomVM00000103_Start
CustomVM00000104_End
CustomVM00000104_Start
CustomVM00000105_End
CustomVM00000105_Start
CustomVM00000106_End
CustomVM00000106_Start
CustomVM00000107_End
CustomVM00000107_Start
CustomVM00000108_End
CustomVM00000108_Start
CustomVM00000109_End
CustomVM00000109_Start
CustomVM00000110_End
CustomVM00000110_Start
CustomVM00000111_End
CustomVM00000111_Start
CustomVM00000112_End
CustomVM00000112_Start
CustomVM00000113_End
CustomVM00000113_Start
CustomVM00000114_End
CustomVM00000114_Start
CustomVM00000115_End
CustomVM00000115_Start
CustomVM00000116_End
CustomVM00000116_Start
CustomVM00000117_End
CustomVM00000117_Start
CustomVM00000118_End
CustomVM00000118_Start
CustomVM00000119_End
CustomVM00000119_Start
CustomVM00000120_End
CustomVM00000120_Start
CustomVM00000121_End
CustomVM00000121_Start
CustomVM00000122_End
CustomVM00000122_Start
CustomVM00000123_End
CustomVM00000123_Start
CustomVM00000124_End
CustomVM00000124_Start
CustomVM00000125_End
CustomVM00000125_Start
CustomVM00000126_End
CustomVM00000126_Start
CustomVM00000127_End
CustomVM00000127_Start
CustomVM00000128_End
CustomVM00000128_Start
CustomVM00000129_End
CustomVM00000129_Start
CustomVM00000130_End
CustomVM00000130_Start
CustomVM00000131_End
CustomVM00000131_Start
CustomVM00000132_End
CustomVM00000132_Start
CustomVM00000133_End
CustomVM00000133_Start
CustomVM00000134_End
CustomVM00000134_Start
CustomVM00000135_End
CustomVM00000135_Start
CustomVM00000136_End
CustomVM00000136_Start
CustomVM00000137_End
CustomVM00000137_Start
CustomVM00000138_End
CustomVM00000138_Start
CustomVM00000139_End
CustomVM00000139_Start
CustomVM00000140_End
CustomVM00000140_Start
CustomVM00000141_End
CustomVM00000141_Start
CustomVM00000142_End
CustomVM00000142_Start
CustomVM00000143_End
CustomVM00000143_Start
CustomVM00000144_End
CustomVM00000144_Start
CustomVM00000145_End
CustomVM00000145_Start
CustomVM00000146_End
CustomVM00000146_Start
CustomVM00000147_End
CustomVM00000147_Start
CustomVM00000148_End
CustomVM00000148_Start
CustomVM00000149_End
CustomVM00000149_Start
CustomVM00000150_End
CustomVM00000150_Start
CustomVM00000151_End
CustomVM00000151_Start
CustomVM00000152_End
CustomVM00000152_Start
CustomVM00000153_End
CustomVM00000153_Start
CustomVM00000154_End
CustomVM00000154_Start
CustomVM00000155_End
CustomVM00000155_Start
CustomVM00000156_End
CustomVM00000156_Start
CustomVM00000157_End
CustomVM00000157_Start
CustomVM00000158_End
CustomVM00000158_Start
CustomVM00000159_End
CustomVM00000159_Start
CustomVM00000160_End
CustomVM00000160_Start
CustomVM00000161_End
CustomVM00000161_Start
CustomVM00000162_End
CustomVM00000162_Start
CustomVM00000163_End
CustomVM00000163_Start
CustomVM00000164_End
CustomVM00000164_Start
CustomVM00000165_End
CustomVM00000165_Start
CustomVM00000166_End
CustomVM00000166_Start
CustomVM00000167_End
CustomVM00000167_Start
CustomVM00000168_End
CustomVM00000168_Start
CustomVM00000169_End
CustomVM00000169_Start
CustomVM00000170_End
CustomVM00000170_Start
CustomVM00000171_End
CustomVM00000171_Start
CustomVM00000172_End
CustomVM00000172_Start
CustomVM00000173_End
CustomVM00000173_Start
CustomVM00000174_End
CustomVM00000174_Start
CustomVM00000175_End
CustomVM00000175_Start
CustomVM00000176_End
CustomVM00000176_Start
CustomVM00000177_End
CustomVM00000177_Start
CustomVM00000178_End
CustomVM00000178_Start
CustomVM00000179_End
CustomVM00000179_Start
CustomVM00000180_End
CustomVM00000180_Start
CustomVM00000181_End
CustomVM00000181_Start
CustomVM00000182_End
CustomVM00000182_Start
CustomVM00000183_End
CustomVM00000183_Start
CustomVM00000184_End
CustomVM00000184_Start
CustomVM00000185_End
CustomVM00000185_Start
CustomVM00000186_End
CustomVM00000186_Start
CustomVM00000187_End
CustomVM00000187_Start
CustomVM00000188_End
CustomVM00000188_Start
CustomVM00000189_End
CustomVM00000189_Start
CustomVM00000190_End
CustomVM00000190_Start
CustomVM00000191_End
CustomVM00000191_Start
CustomVM00000192_End
CustomVM00000192_Start
CustomVM00000193_End
CustomVM00000193_Start
CustomVM00000194_End
CustomVM00000194_Start
CustomVM00000195_End
CustomVM00000195_Start
CustomVM00000196_End
CustomVM00000196_Start
CustomVM00000197_End
CustomVM00000197_Start
CustomVM00000198_End
CustomVM00000198_Start
CustomVM00000199_End
CustomVM00000199_Start
CustomVM00000200_End
CustomVM00000200_Start
CustomVM00000201_End
CustomVM00000201_Start
CustomVM00000202_End
CustomVM00000202_Start
CustomVM00000203_End
CustomVM00000203_Start
CustomVM00000204_End
CustomVM00000204_Start
CustomVM00000205_End
CustomVM00000205_Start
CustomVM00000206_End
CustomVM00000206_Start
CustomVM00000207_End
CustomVM00000207_Start
CustomVM00000208_End
CustomVM00000208_Start
CustomVM00000209_End
CustomVM00000209_Start
CustomVM00000210_End
CustomVM00000210_Start
CustomVM00000211_End
CustomVM00000211_Start
CustomVM00000212_End
CustomVM00000212_Start
CustomVM00000213_End
CustomVM00000213_Start
CustomVM00000214_End
CustomVM00000214_Start
CustomVM00000215_End
CustomVM00000215_Start
CustomVM00000216_End
CustomVM00000216_Start
CustomVM00000217_End
CustomVM00000217_Start
CustomVM00000218_End
CustomVM00000218_Start
CustomVM00000219_End
CustomVM00000219_Start
CustomVM00000220_End
CustomVM00000220_Start
CustomVM00000221_End
CustomVM00000221_Start
CustomVM00000222_End
CustomVM00000222_Start
CustomVM00000223_End
CustomVM00000223_Start
CustomVM00000224_End
CustomVM00000224_Start
CustomVM00000225_End
CustomVM00000225_Start
CustomVM00000226_End
CustomVM00000226_Start
CustomVM00000227_End
CustomVM00000227_Start
CustomVM00000228_End
CustomVM00000228_Start
CustomVM00000229_End
CustomVM00000229_Start
CustomVM00000230_End
CustomVM00000230_Start
CustomVM00000231_End
CustomVM00000231_Start
CustomVM00000232_End
CustomVM00000232_Start
CustomVM00000233_End
CustomVM00000233_Start
CustomVM00000234_End
CustomVM00000234_Start
CustomVM00000235_End
CustomVM00000235_Start
CustomVM00000236_End
CustomVM00000236_Start
CustomVM00000237_End
CustomVM00000237_Start
CustomVM00000238_End
CustomVM00000238_Start
CustomVM00000239_End
CustomVM00000239_Start
CustomVM00000240_End
CustomVM00000240_Start
CustomVM00000241_End
CustomVM00000241_Start
CustomVM00000242_End
CustomVM00000242_Start
CustomVM00000243_End
CustomVM00000243_Start
CustomVM00000244_End
CustomVM00000244_Start
CustomVM00000245_End
CustomVM00000245_Start
CustomVM00000246_End
CustomVM00000246_Start
CustomVM00000247_End
CustomVM00000247_Start
CustomVM00000248_End
CustomVM00000248_Start
CustomVM00000249_End
CustomVM00000249_Start
CustomVM00000250_End
CustomVM00000250_Start
CustomVM00000251_End
CustomVM00000251_Start
CustomVM00000252_End
CustomVM00000252_Start
CustomVM00000253_End
CustomVM00000253_Start
CustomVM00000254_End
CustomVM00000254_Start
CustomVM00000255_End
CustomVM00000255_Start
CustomVM00000256_End
CustomVM00000256_Start
CustomVM00000257_End
CustomVM00000257_Start
CustomVM00000258_End
CustomVM00000258_Start
CustomVM00000259_End
CustomVM00000259_Start
CustomVM00000260_End
CustomVM00000260_Start
CustomVM00000261_End
CustomVM00000261_Start
CustomVM00000262_End
CustomVM00000262_Start
CustomVM00000263_End
CustomVM00000263_Start
CustomVM00000264_End
CustomVM00000264_Start
CustomVM00000265_End
CustomVM00000265_Start
CustomVM00000266_End
CustomVM00000266_Start
CustomVM00000267_End
CustomVM00000267_Start
CustomVM00000268_End
CustomVM00000268_Start
CustomVM00000269_End
CustomVM00000269_Start
CustomVM00000270_End
CustomVM00000270_Start
CustomVM00000271_End
CustomVM00000271_Start
CustomVM00000272_End
CustomVM00000272_Start
CustomVM00000273_End
CustomVM00000273_Start
CustomVM00000274_End
CustomVM00000274_Start
CustomVM00000275_End
CustomVM00000275_Start
CustomVM00000276_End
CustomVM00000276_Start
CustomVM00000277_End
CustomVM00000277_Start
CustomVM00000278_End
CustomVM00000278_Start
CustomVM00000279_End
CustomVM00000279_Start
CustomVM00000280_End
CustomVM00000280_Start
CustomVM00000281_End
CustomVM00000281_Start
CustomVM00000282_End
CustomVM00000282_Start
CustomVM00000283_End
CustomVM00000283_Start
CustomVM00000284_End
CustomVM00000284_Start
CustomVM00000285_End
CustomVM00000285_Start
CustomVM00000286_End
CustomVM00000286_Start
CustomVM00000287_End
CustomVM00000287_Start
CustomVM00000288_End
CustomVM00000288_Start
CustomVM00000289_End
CustomVM00000289_Start
CustomVM00000290_End
CustomVM00000290_Start
CustomVM00000291_End
CustomVM00000291_Start
CustomVM00000292_End
CustomVM00000292_Start
CustomVM00000293_End
CustomVM00000293_Start
CustomVM00000294_End
CustomVM00000294_Start
CustomVM00000295_End
CustomVM00000295_Start
CustomVM00000296_End
CustomVM00000296_Start
CustomVM00000297_End
CustomVM00000297_Start
CustomVM00000298_End
CustomVM00000298_Start
CustomVM00000299_End
CustomVM00000299_Start
CustomVM00000300_End
CustomVM00000300_Start
CustomVM00000301_End
CustomVM00000301_Start
CustomVM00000302_End
CustomVM00000302_Start
CustomVM00000303_End
CustomVM00000303_Start
CustomVM00000304_End
CustomVM00000304_Start
CustomVM00000305_End
CustomVM00000305_Start
CustomVM00000306_End
CustomVM00000306_Start
CustomVM00000307_End
CustomVM00000307_Start
CustomVM00000308_End
CustomVM00000308_Start
CustomVM00000309_End
CustomVM00000309_Start
CustomVM00000310_End
CustomVM00000310_Start
CustomVM00000311_End
CustomVM00000311_Start
CustomVM00000312_End
CustomVM00000312_Start
CustomVM00000313_End
CustomVM00000313_Start
CustomVM00000314_End
CustomVM00000314_Start
CustomVM00000315_End
CustomVM00000315_Start
CustomVM00000316_End
CustomVM00000316_Start
CustomVM00000317_End
CustomVM00000317_Start
CustomVM00000318_End
CustomVM00000318_Start
CustomVM00000319_End
CustomVM00000319_Start
CustomVM00000320_End
CustomVM00000320_Start
CustomVM00000321_End
CustomVM00000321_Start
CustomVM00000322_End
CustomVM00000322_Start
CustomVM00000323_End
CustomVM00000323_Start
CustomVM00000324_End
CustomVM00000324_Start
CustomVM00000325_End
CustomVM00000325_Start
CustomVM00000326_End
CustomVM00000326_Start
CustomVM00000327_End
CustomVM00000327_Start
CustomVM00000328_End
CustomVM00000328_Start
CustomVM00000329_End
CustomVM00000329_Start
CustomVM00000330_End
CustomVM00000330_Start
CustomVM00000331_End
CustomVM00000331_Start
CustomVM00000332_End
CustomVM00000332_Start
CustomVM00000333_End
CustomVM00000333_Start
CustomVM00000334_End
CustomVM00000334_Start
CustomVM00000335_End
CustomVM00000335_Start
CustomVM00000336_End
CustomVM00000336_Start
CustomVM00000337_End
CustomVM00000337_Start
CustomVM00000338_End
CustomVM00000338_Start
CustomVM00000339_End
CustomVM00000339_Start
CustomVM00000340_End
CustomVM00000340_Start
CustomVM00000341_End
CustomVM00000341_Start
CustomVM00000342_End
CustomVM00000342_Start
CustomVM00000343_End
CustomVM00000343_Start
CustomVM00000344_End
CustomVM00000344_Start
CustomVM00000345_End
CustomVM00000345_Start
CustomVM00000346_End
CustomVM00000346_Start
CustomVM00000347_End
CustomVM00000347_Start
CustomVM00000348_End
CustomVM00000348_Start
CustomVM00000349_End
CustomVM00000349_Start
CustomVM00000350_End
CustomVM00000350_Start
CustomVM00000351_End
CustomVM00000351_Start
CustomVM00000352_End
CustomVM00000352_Start
CustomVM00000353_End
CustomVM00000353_Start
CustomVM00000354_End
CustomVM00000354_Start
CustomVM00000355_End
CustomVM00000355_Start
CustomVM00000356_End
CustomVM00000356_Start
CustomVM00000357_End
CustomVM00000357_Start
CustomVM00000358_End
CustomVM00000358_Start
CustomVM00000359_End
CustomVM00000359_Start
CustomVM00000360_End
CustomVM00000360_Start
CustomVM00000361_End
CustomVM00000361_Start
CustomVM00000362_End
CustomVM00000362_Start
CustomVM00000363_End
CustomVM00000363_Start
CustomVM00000364_End
CustomVM00000364_Start
CustomVM00000365_End
CustomVM00000365_Start
CustomVM00000366_End
CustomVM00000366_Start
CustomVM00000367_End
CustomVM00000367_Start
CustomVM00000368_End
CustomVM00000368_Start
CustomVM00000369_End
CustomVM00000369_Start
CustomVM00000370_End
CustomVM00000370_Start
CustomVM00000371_End
CustomVM00000371_Start
CustomVM00000372_End
CustomVM00000372_Start
CustomVM00000373_End
CustomVM00000373_Start
CustomVM00000374_End
CustomVM00000374_Start
CustomVM00000375_End
CustomVM00000375_Start
CustomVM00000376_End
CustomVM00000376_Start
CustomVM00000377_End
CustomVM00000377_Start
CustomVM00000378_End
CustomVM00000378_Start
CustomVM00000379_End
CustomVM00000379_Start
CustomVM00000380_End
CustomVM00000380_Start
CustomVM00000381_End
CustomVM00000381_Start
CustomVM00000382_End
CustomVM00000382_Start
CustomVM00000383_End
CustomVM00000383_Start
CustomVM00000384_End
CustomVM00000384_Start
CustomVM00000385_End
CustomVM00000385_Start
CustomVM00000386_End
CustomVM00000386_Start
CustomVM00000387_End
CustomVM00000387_Start
CustomVM00000388_End
CustomVM00000388_Start
CustomVM00000389_End
CustomVM00000389_Start
CustomVM00000390_End
CustomVM00000390_Start
CustomVM00000391_End
CustomVM00000391_Start
CustomVM00000392_End
CustomVM00000392_Start
CustomVM00000393_End
CustomVM00000393_Start
CustomVM00000394_End
CustomVM00000394_Start
CustomVM00000395_End
CustomVM00000395_Start
CustomVM00000396_End
CustomVM00000396_Start
CustomVM00000397_End
CustomVM00000397_Start
CustomVM00000398_End
CustomVM00000398_Start
CustomVM00000399_End
CustomVM00000399_Start
CustomVM00000400_End
CustomVM00000400_Start
CustomVM00000401_End
CustomVM00000401_Start
CustomVM00000402_End
CustomVM00000402_Start
CustomVM00000403_End
CustomVM00000403_Start
CustomVM00000404_End
CustomVM00000404_Start
CustomVM00000405_End
CustomVM00000405_Start
CustomVM00000406_End
CustomVM00000406_Start
CustomVM00000407_End
CustomVM00000407_Start
CustomVM00000408_End
CustomVM00000408_Start
CustomVM00000409_End
CustomVM00000409_Start
CustomVM00000410_End
CustomVM00000410_Start
CustomVM00000411_End
CustomVM00000411_Start
CustomVM00000412_End
CustomVM00000412_Start
CustomVM00000413_End
CustomVM00000413_Start
CustomVM00000414_End
CustomVM00000414_Start
CustomVM00000415_End
CustomVM00000415_Start
CustomVM00000416_End
CustomVM00000416_Start
CustomVM00000417_End
CustomVM00000417_Start
CustomVM00000418_End
CustomVM00000418_Start
CustomVM00000419_End
CustomVM00000419_Start
CustomVM00000420_End
CustomVM00000420_Start
CustomVM00000421_End
CustomVM00000421_Start
CustomVM00000422_End
CustomVM00000422_Start
CustomVM00000423_End
CustomVM00000423_Start
CustomVM00000424_End
CustomVM00000424_Start
CustomVM00000425_End
CustomVM00000425_Start
CustomVM00000426_End
CustomVM00000426_Start
CustomVM00000427_End
CustomVM00000427_Start
CustomVM00000428_End
CustomVM00000428_Start
CustomVM00000429_End
CustomVM00000429_Start
CustomVM00000430_End
CustomVM00000430_Start
CustomVM00000431_End
CustomVM00000431_Start
CustomVM00000432_End
CustomVM00000432_Start
CustomVM00000433_End
CustomVM00000433_Start
CustomVM00000434_End
CustomVM00000434_Start
CustomVM00000435_End
CustomVM00000435_Start
CustomVM00000436_End
CustomVM00000436_Start
CustomVM00000437_End
CustomVM00000437_Start
CustomVM00000438_End
CustomVM00000438_Start
CustomVM00000439_End
CustomVM00000439_Start
CustomVM00000440_End
CustomVM00000440_Start
CustomVM00000441_End
CustomVM00000441_Start
CustomVM00000442_End
CustomVM00000442_Start
CustomVM00000443_End
CustomVM00000443_Start
CustomVM00000444_End
CustomVM00000444_Start
CustomVM00000445_End
CustomVM00000445_Start
CustomVM00000446_End
CustomVM00000446_Start
CustomVM00000447_End
CustomVM00000447_Start
CustomVM00000448_End
CustomVM00000448_Start
CustomVM00000449_End
CustomVM00000449_Start
CustomVM00000450_End
CustomVM00000450_Start
CustomVM00000451_End
CustomVM00000451_Start
CustomVM00000452_End
CustomVM00000452_Start
CustomVM00000453_End
CustomVM00000453_Start
CustomVM00000454_End
CustomVM00000454_Start
CustomVM00000455_End
CustomVM00000455_Start
CustomVM00000456_End
CustomVM00000456_Start
CustomVM00000457_End
CustomVM00000457_Start
CustomVM00000458_End
CustomVM00000458_Start
CustomVM00000459_End
CustomVM00000459_Start
CustomVM00000460_End
CustomVM00000460_Start
CustomVM00000461_End
CustomVM00000461_Start
CustomVM00000462_End
CustomVM00000462_Start
CustomVM00000463_End
CustomVM00000463_Start
CustomVM00000464_End
CustomVM00000464_Start
CustomVM00000465_End
CustomVM00000465_Start
CustomVM00000466_End
CustomVM00000466_Start
CustomVM00000467_End
CustomVM00000467_Start
CustomVM00000468_End
CustomVM00000468_Start
CustomVM00000469_End
CustomVM00000469_Start
CustomVM00000470_End
CustomVM00000470_Start
CustomVM00000471_End
CustomVM00000471_Start
CustomVM00000472_End
CustomVM00000472_Start
CustomVM00000473_End
CustomVM00000473_Start
CustomVM00000474_End
CustomVM00000474_Start
CustomVM00000475_End
CustomVM00000475_Start
CustomVM00000476_End
CustomVM00000476_Start
CustomVM00000477_End
CustomVM00000477_Start
CustomVM00000478_End
CustomVM00000478_Start
CustomVM00000479_End
CustomVM00000479_Start
CustomVM00000480_End
CustomVM00000480_Start
CustomVM00000481_End
CustomVM00000481_Start
CustomVM00000482_End
CustomVM00000482_Start
CustomVM00000483_End
CustomVM00000483_Start
CustomVM00000484_End
CustomVM00000484_Start
CustomVM00000485_End
CustomVM00000485_Start
CustomVM00000486_End
CustomVM00000486_Start
CustomVM00000487_End
CustomVM00000487_Start
CustomVM00000488_End
CustomVM00000488_Start
CustomVM00000489_End
CustomVM00000489_Start
CustomVM00000490_End
CustomVM00000490_Start
CustomVM00000491_End
CustomVM00000491_Start
CustomVM00000492_End
CustomVM00000492_Start
CustomVM00000493_End
CustomVM00000493_Start
CustomVM00000494_End
CustomVM00000494_Start
CustomVM00000495_End
CustomVM00000495_Start
CustomVM00000496_End
CustomVM00000496_Start
CustomVM00000497_End
CustomVM00000497_Start
CustomVM00000498_End
CustomVM00000498_Start
CustomVM00000499_End
CustomVM00000499_Start
EncodeEnd
EncodeStart
MutateEnd
MutateStart
RegisteredEnd
RegisteredStart
RegisteredVMEnd
RegisteredVMStart
SECheckCodeIntegrity
SECheckDebugger
SECheckProtection
SECheckRegistration
SECheckVirtualPC
StrEncryptEnd
StrEncryptStart
StrEncryptWEnd
StrEncryptWStart
UnprotectedEnd
UnprotectedStart
UnregisteredEnd
UnregisteredStart
VMEnd
VMStart
Name
.text
Size
1024B
Virtual Size
843B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=125, version=2207,
count=1, id=122, version=2207,
count=1, id=120, version=2207,
SecretTweaks/SecretTweak/dbghelp.dll
- IMPHASH e55df7193a9c7f507fc48c3b3f033447
- SHA256 b6455531a84ee1ceb101cd14f0e2be7750f4d5f958ec5a9460a09d011f14a3f8
- MD5 08219271a68c50cd39c74305e25d803c
- SHA1 2de9e5659b95686f51e8d0577718e2b7f2f2a0d9
- SHA512 d08763371c4044dd5b86409cc71b93315886be8fce9e3214e77858d2aef2ee58671a073b6d6c990a6a3f9f4ea9336efa6328c406cec97c967c5dde5f9f20b474
- SSDEEP 49152:0N0tGoich4Jm+qbApekXO0hIuxO/rMoE/26esP:0N0Wg4Jm+qbS1XxTcU
- TLSH T1BBA58B0757EC00A8D67AE23DD267560BD7F2B4110321A7DF126486AE6F23FE51ABE311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
57:a5:49:a2:2a:2a:c7:d1:8f:c2:78:ed:6b:78:6b:bf:68:94:c1:76:35:65:91:31:d9:fc:c0:7b:3a:f6:5f:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 19, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:a6:58:10:67:4b:3d:6c:7c:f6:00:00:00:00:05:a6
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2024 - Jul 5, 2025
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:00:0b:d7:aa:7f:1b:2a:17:56:00:01:00:00:02:00
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
40096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dbghelp.pdb
api-ms-win-crt-string-l1-1-0
memset
strcspn
wcsnlen
wcsncmp
strnlen
strlen
strcmp
strncmp
wcscmp
api-ms-win-crt-time-l1-1-0
_time64
_ctime64
api-ms-win-crt-locale-l1-1-0
_unlock_locales
_lock_locales
api-ms-win-crt-runtime-l1-1-0
__doserrno
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__filelengthi64
_o__free_base
_o__fullpath
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__ldclass
_o__lseeki64
_o__ltoa
_o__malloc_base
_o__mbscmp
_o__memicmp
_o__open_osfhandle
_o__purecall
_o__read
_o__register_onexit_function
_o__seh_filter_dll
_o__splitpath_s
_o__stricmp
_o__strlwr
_o__strnicmp
_o__aligned_malloc
_o__wcsdup
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wctime64
_o__wdupenv_s
_o__wfsopen
_o__wfullpath
_o__wgetenv
_o__wmakepath_s
_o__wsplitpath_s
_o__wtoi
_o_abort
_o_atoi
_o_atol
_o_bsearch
_o_calloc
_o_ceilf
_o_fclose
_o_fflush
_o_fread
_o_free
_o_frexp
_o_fseek
_o_ftell
_o_isspace
_o_iswprint
_o_iswspace
_o_iswxdigit
_o_localeconv
_o_malloc
_o_qsort
_o_realloc
_o_setlocale
_o_strcat_s
_o_strcpy_s
_o_strncat_s
_o_strncpy_s
_o_terminate
_o_tolower
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstoul
_o_wmemcpy_s
__uncaught_exception
_CxxThrowException
_o__aligned_free
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o__execute_onexit_table
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o__errno
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o__dclass
_o__crt_atexit
_o__configure_narrow_argv
_o__close
_o__cexit
_o__calloc_base
_o__callnewh
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
wcsrchr
strstr
wcsstr
wcschr
__C_specific_handler
__CxxFrameHandler3
strchr
memcpy
memmove
memcmp
__unDName
strrchr
__unDNameEx
api-ms-win-core-file-l1-1-0
GetFileAttributesW
FindClose
GetFullPathNameW
DeleteFileW
SetFilePointer
GetFinalPathNameByHandleW
CreateDirectoryW
CreateFileW
SetFilePointerEx
WriteFile
SetEndOfFile
ReadFile
GetFileType
RemoveDirectoryW
CreateDirectoryA
SetFileTime
SetFileAttributesW
GetFileSize
FindNextFileW
CreateFileA
GetFileAttributesA
GetFileSizeEx
FindFirstFileW
GetFileInformationByHandle
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException
SetErrorMode
api-ms-win-core-synch-l1-1-0
OpenProcess
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
AcquireSRWLockExclusive
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
ExpandEnvironmentStringsW
SetEnvironmentVariableA
api-ms-win-core-misc-l1-1-0
LocalFree
Sleep
LocalAlloc
FormatMessageW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
TerminateProcess
TlsFree
GetCurrentThread
GetCurrentProcess
TlsGetValue
TlsSetValue
TlsAlloc
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-libraryloader-l1-1-0
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleFileNameW
LoadLibraryExA
GetModuleHandleA
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
SystemTimeToFileTime
GetTickCount
GetSystemDirectoryW
GetTickCount64
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-security-base-l1-1-0
AccessCheck
ImpersonateSelf
GetFileSecurityW
RevertToSelf
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
UnmapViewOfFile
MapViewOfFileEx
MapViewOfFile
VirtualQuery
CreateFileMappingW
ReadProcessMemory
VirtualProtect
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-localization-l1-1-0
LCMapStringEx
LCMapStringW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
ntdll
RtlUTF8ToUnicodeN
RtlRunOnceExecuteOnce
RtlGetVersion
api-ms-win-downlevel-kernel32-l2-1-0
CreateFileMappingA
api-ms-win-core-localregistry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-threadpool-l1-1-0
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk2
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymAllocDiaString
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFreeDiaString
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetDiaSession
SymGetDiaSource
SymGetExtendedOption
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrEx
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameEx
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextEx
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevEx
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetParentWindow
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileChecksum
SymGetSourceFileChecksumW
SymGetSourceFileFromToken
SymGetSourceFileFromTokenByTokenName
SymGetSourceFileFromTokenByTokenNameW
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenByTokenName
SymGetSourceFileTokenByTokenNameW
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymRegisterGetSourcePathPartCallback
SymRegisterSourceFileUrlListCallback
SymSearch
SymSearchW
SymSetContext
SymSetDiaSession
SymSetExtendedOption
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSetServiceManager
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
_EFN_DumpImage
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
lmsourcesinfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
vc7fpo
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
400KB
Virtual Size
398KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
84KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=59, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=257, version=33140,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1268, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=13, id=260, version=33140,
count=5, id=259, version=33140,
count=1, id=256, version=33140,
count=100, id=264, version=33140,
count=2, id=253, version=33140,
count=37, id=261, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
SecretTweaks/SecretTweak/device_settings_backup.json
- SHA256 03928d11f273d40b5d1dd07ded7782dfb0415f206dff6013aacf29cf6da153b2
- MD5 c7efe7808fcc99056d9537232d777b23
- SHA1 2fa7732e9ab5bc34c9a351e838c4019b41cb98eb
- SHA512 931ae5ca5afa65f24e018027ba65a5b1fb4dfaf6788e6001c73378b97a69c5c490e31d2098669d137891608690103207c37843e7b9e12a7c9d2f0809eca0e129
- SSDEEP 96:ADpgx2Mop/M3ANUyp3JU5Mpv98pvDKpSGHX3pCa:Epv/p/8Aeypi5Mpl8pbKpxnpCa
- TLSH T15E918704E4660D2787CE522564956BC34BECB6535E813DA63BDCAA0D4F0EA1F11B2F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
SecretTweaks/SecretTweak/exit_gamemode.cfg
- SHA256 2efa610f5f263f299e04887dab880c1728bc1e6b74addd59c3f454f6002150e9
- MD5 cd93399455397c4067976bf511f4bfa9
- SHA1 4d85590d753d035f4debaa7c896fd8bec3bc7d76
- SHA512 7d28fedeba18a4594620fa6618a87ebb6d0e0cfc446393442c40009a0396e11914c05d326989fa5c1e250d1d2c329604be0520624c81e15a5d44f26b7531faab
- MD5 SHA1 SHA512
SecretTweaks/SecretTweak/games_priorities.cfg
- SHA256 341e1b970622f710261fd09468eef4f56148cd1d82bfa2fce3797c3272d089c4
- MD5 df5e3f56a6b11c2b34913fb9733464d9
- SHA1 836bf112dbb077cdb41b4584a72dd44479a02ff5
- SHA512 88f7c8d57b66dda0a9eb871dd7d137cabfb37405b9e541b41e45038e51f6404303bf7a951aa13e50425f099102415df6a3184ba9d85fd55e142b15e73609b8a5
- TLSH T115C04C7CF03D0E6D32A807FA617A9E4335895D40873215BB4CD04009E7D8D844645265
- MD5 SHA1 SHA512 TLSH
SecretTweaks/SecretTweak/key.txt
- SHA256 38816a4bbe78aa3dbff468dc0d08c217df8cc3b4f3c3fd9f139bab84d69dff5c
- MD5 1f73402c644002a7ea3c9532e8ba4139
- SHA1 a6c0ca0de97c7f8764f85b76a9f9819ff61411b1
- SHA512 20beb67b40d06b4d84f961853fab1ec78c9279517ee8b05273ed11066d3a995d3e98b6c86e31d2ed3139769e7227807f7a17dabc28622155ea0d12f0582f4d7e
- MD5 SHA1 SHA512
SecretTweaks/SecretTweak/launchers.cfg
- SHA256 48fa29da02434fa9134f15534b7e1fda7e95a63b6b390788771778e0ec46e55c
- MD5 b0bf9f565e85615cfdbaab383fba2b75
- SHA1 84da8d2faf146e5f1f4a06c6030350c6677de539
- SHA512 edca41a3b7d49936887949ffa19a3e894ef9af37d51a9f4662120728188dcff2c6d2d8da9dd690404dbf2a85819f43f3b9f6b066c346b5ef887268f70e6fae3a
- TLSH T1C4F0C05C4D392471CB81807FE3ACF31E0E8A5D91E90D1F9357E1526718ED9C448507D4
- MD5 SHA1 SHA512 TLSH
SecretTweaks/SecretTweak/logs/logging.txt
- SHA256 52712d1ba8b42954b477d4d5071c7148edd27007f66a8722c8e475a0bbf3b06b
- MD5 403ce5fd0c2e7ba19262be6443956f54
- SHA1 7969de3108a1e0eb0995437c0380b8bf5b67b1a0
- SHA512 37f28564e97f2e4953faf837ea6326894461a7a8f8f7f18c30af38e32df324b2741225bb870aa8ddd41686ef100d7776905c98bb6fd50afca4488a5fcc21dc7b
- SSDEEP 1536:aYndiaW0nxUdSsPJ1RZ0GkVm3zNsfsjs7zRsSs2skscsQzE6Bt4BMp/F5QouhTAx:niTykQXOZVzLmLpUkPJ
- TLSH T12C83F04A25EE713F44CB628B930E7FEA2D1170A3C8671592B6DD26CF2B8D9057F83506
- MD5 SHA1 SHA512 SSDEEP TLSH
SecretTweaks/SecretTweak/symsrv.dll
- IMPHASH c8f45ab7d0aa1910ed31f28a3532dc3a
- SHA256 5fcebebe39fb70368ab3f91ae48234a887f284c0a80d018d0dcf7ee0e992b444
- MD5 ac540c9135582ab683f5015e44de1660
- SHA1 b20cffcd98c96c27634ada81e594ea8bc77dd0a5
- SHA512 fee5454f0801396c31cb7623a3ce7da5bc1dc47c4700c7d9f6bc1e755253ce5169c036624f39b590c7c151161339efa6cc8fb18d20488c0b5f9eccf6890ef88d
- SSDEEP 6144:bYvMwXLY++NxRVwR9HFNioYbXCmKduoph3xBV+iXqYs1QamNrFd6bBI9RYxwJR:6peVwfHioYbymKduoH3t+iXXeQ41IRVR
- TLSH T18794182DE7E80465E1B2A5788AB3C605D7B278A81735D3CF1194C13E5E27FD4AA34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:e2:cd:e2:0b:68:1d:3f:ed:63:e2:5f:26:f5:f5:12:57:e1:74:5e:cd:17:63:a1:07:6e:8b:be:7e:b5:46:a1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 19, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:a6:58:10:67:4b:3d:6c:7c:f6:00:00:00:00:05:a6
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2024 - Jul 5, 2025
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:01:d1:45:59:98:10:cc:42:4f:00:01:00:00:02:01
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
7600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
symsrv.pdb
msvcrt
_wtoi64
getenv
strnlen
_vsnprintf_s
swprintf_s
wcsnlen
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
_vscwprintf
_stricmp
_vscprintf
_vsnwprintf_s
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
vswprintf_s
tolower
memmove
_wmakepath_s
_wcsdup
_XcptFilter
_amsg_exit
swscanf_s
_wcsicmp
??_V@YAXPEAX@Z
fclose
wcsncpy_s
_wcsnicmp
wcschr
??0exception@@QEAA@AEBV0@@Z
_errno
_initterm
_lock
??0exception@@QEAA@XZ
_unlock
__dllonexit
_onexit
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
free
__CxxFrameHandler3
_wcslwr_s
wcsrchr
fgetws
wcsstr
iswspace
_wfopen
strpbrk
strstr
realloc
iswprint
??0exception@@QEAA@AEBQEBD@Z
memcpy_s
towlower
wcsncmp
strcpy_s
_wcsupr
malloc
strcat_s
isspace
_wcslwr
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_vsnwprintf
wcscat_s
strrchr
memcmp
memset
__C_specific_handler
wcscpy_s
calloc
wcscmp
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleExW
LoadLibraryExA
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
CreateThread
TerminateProcess
GetExitCodeThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-misc-l1-1-0
FormatMessageW
LocalReAlloc
Sleep
LocalAlloc
GlobalFree
LocalFree
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
EqualSid
GetTokenInformation
FreeSid
api-ms-win-core-file-l1-1-0
GetFileAttributesExW
CreateDirectoryW
GetFileTime
GetDriveTypeW
SetFilePointerEx
WriteFile
RemoveDirectoryW
GetFileSizeEx
CreateFileW
GetFileAttributesW
GetFinalPathNameByHandleW
GetFullPathNameW
GetFileSize
FileTimeToLocalFileTime
DeleteFileA
CreateFileA
LocalFileTimeToFileTime
GetFileInformationByHandle
SetFilePointer
SetFileTime
ReadFile
DeleteFileW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetErrorMode
RaiseException
SetLastError
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetVersionExW
GetSystemInfo
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObject
SetWaitableTimer
AcquireSRWLockShared
CreateMutexExW
InitializeCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockShared
DeleteCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
SetEvent
OpenMutexW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ResetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockExclusive
CreateEventW
api-ms-win-core-handle-l1-1-0
CloseHandle
rpcrt4
UuidCreate
api-ms-win-core-localregistry-l1-1-0
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ws2_32
WSACleanup
WSAStartup
FreeAddrInfoW
GetAddrInfoW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
oleaut32
SysFreeString
shlwapi
PathFindFileNameW
kernel32
CancelSynchronousIo
IsProcessorFeaturePresent
WaitForMultipleObjects
ntdll
RtlRunOnceExecuteOnce
RtlUTF8ToUnicodeN
crypt32
CryptStringToBinaryW
CryptBinaryToStringW
bcrypt
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-core-threadpool-l1-1-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexAndChecksumsW
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptionData
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerPingWEx
SymbolServerSetHttpAuthHeader
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
SymbolServerWEx
SymbolServerWithChecksumsW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile
Name
.text
Size
220KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
128KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mrdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=26, id=260, version=33140,
count=296, id=1, productName=Unmarked objects,
count=9, id=257, version=33140,
count=14, id=261, version=33140,
count=1, id=256, version=33140,
count=49, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
SecretTweaks/SecretTweak/system_priorities.cfg
- SHA256 341e1b970622f710261fd09468eef4f56148cd1d82bfa2fce3797c3272d089c4
- MD5 df5e3f56a6b11c2b34913fb9733464d9
- SHA1 836bf112dbb077cdb41b4584a72dd44479a02ff5
- SHA512 88f7c8d57b66dda0a9eb871dd7d137cabfb37405b9e541b41e45038e51f6404303bf7a951aa13e50425f099102415df6a3184ba9d85fd55e142b15e73609b8a5
- TLSH T115C04C7CF03D0E6D32A807FA617A9E4335895D40873215BB4CD04009E7D8D844645265
- MD5 SHA1 SHA512 TLSH
SecretTweaks/SecretTweak/vcredist.url
- SHA256 b3edff656ecca49b2f4c2e0d1140d65ee04a26e748c4001903dac21dab5734fd
- MD5 6e7140aecdbf70b31d0f43a37398e367
- SHA1 3416b971b6fc26b6962e641b9e7eec74dea8e0c9
- SHA512 84fadb92841a01280b48ce0e1cdb65137e30b26db26905934a8db09b4b9a535d84387d2a6b0255de35908a8b3c8c2fe45adba3140645c62404a0507933d3b584
- TLSH T194C0225D8C47C286C1418A0A50B0B2418C0FB56019C1C0DD6500CC894809092C028F27
- MD5 SHA1 SHA512 TLSH
SecretTweaks/SecretTweak/winhttp.dll
- IMPHASH 92f8749135be1342b283c3325c3547b0
- SHA256 c40a3e9d7887b33c04589bebbf1150c6f3a112b8a230cfb288374d284d92215f
- MD5 6d3e21154ee696a1d64de5b169be9709
- SHA1 00f0c8e1a4ff21fedc18f9b90a98b86fa78f76df
- SHA512 45206d59c4af6ad50790ead95a67b4ceb6056809c835916d8da1b029e6081190c51644ae3326e49adcd9dde34bad069c3fd7539b4d81f1677700049475b8be04
- SSDEEP 3072:FUVBSe+iy7DWZsQQqSevtZlD2lYt2/hlGd8hFSl+:FUVBST70sqSkdKlYF8h4
- TLSH T177F33947A56701BFD56BC9B8E9934A42FB7238454BB066CB07E04B626E237E0DE3D341
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
31648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
MessageBoxW
bcrypt
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
kernel32
FreeLibrary
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
CreateFileW
ReadFile
WriteFile
CloseHandle
GetLastError
RaiseFailFastException
InitOnceExecuteOnce
GetCurrentProcessId
CreateThread
GetSystemDirectoryW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
SetStdHandle
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
DllCanUnloadNow
DllGetClassObject
Private1
SvchostPushServiceGlobals
WinHttpAddRequestHeaders
WinHttpAddRequestHeadersEx
WinHttpAutoProxySvcMain
WinHttpCheckPlatform
WinHttpCloseHandle
WinHttpConnect
WinHttpConnectionDeletePolicyEntries
WinHttpConnectionDeleteProxyInfo
WinHttpConnectionFreeNameList
WinHttpConnectionFreeProxyInfo
WinHttpConnectionFreeProxyList
WinHttpConnectionGetNameList
WinHttpConnectionGetProxyInfo
WinHttpConnectionGetProxyList
WinHttpConnectionOnlyConvert
WinHttpConnectionOnlyReceive
WinHttpConnectionOnlySend
WinHttpConnectionSetPolicyEntries
WinHttpConnectionSetProxyInfo
WinHttpConnectionUpdateIfIndexTable
WinHttpCrackUrl
WinHttpCreateProxyList
WinHttpCreateProxyManager
WinHttpCreateProxyResolver
WinHttpCreateProxyResult
WinHttpCreateUiCompatibleProxyString
WinHttpCreateUrl
WinHttpDetectAutoProxyConfigUrl
WinHttpFreeProxyResult
WinHttpFreeProxyResultEx
WinHttpFreeProxySettings
WinHttpFreeProxySettingsEx
WinHttpFreeQueryConnectionGroupResult
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetProxyForUrlEx
WinHttpGetProxyForUrlEx2
WinHttpGetProxyForUrlHvsi
WinHttpGetProxyResult
WinHttpGetProxyResultEx
WinHttpGetProxySettingsEx
WinHttpGetProxySettingsResultEx
WinHttpGetProxySettingsVersion
WinHttpGetTunnelSocket
WinHttpOpen
WinHttpOpenRequest
WinHttpPacJsWorkerMain
WinHttpProbeConnectivity
WinHttpProtocolCompleteUpgrade
WinHttpProtocolReceive
WinHttpProtocolSend
WinHttpQueryAuthSchemes
WinHttpQueryConnectionGroup
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpQueryHeadersEx
WinHttpQueryOption
WinHttpReadData
WinHttpReadDataEx
WinHttpReadProxySettings
WinHttpReadProxySettingsHvsi
WinHttpReceiveResponse
WinHttpRefreshProxySettings
WinHttpRegisterProxyChangeNotification
WinHttpResetAutoProxy
WinHttpResolverGetProxyForUrl
WinHttpSaveProxyCredentials
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetDefaultProxyConfiguration
WinHttpSetOption
WinHttpSetProxySettingsPerUser
WinHttpSetSecureLegacyServersAppCompat
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime
WinHttpUnregisterProxyChangeNotification
WinHttpWebSocketClose
WinHttpWebSocketCompleteUpgrade
WinHttpWebSocketQueryCloseStatus
WinHttpWebSocketReceive
WinHttpWebSocketSend
WinHttpWebSocketShutdown
WinHttpWriteData
WinHttpWriteProxySettings
Name
.text
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=15, id=260, version=35207,
count=37, id=261, version=35207,
count=7, id=257, version=33145,
count=103, id=1, productName=Unmarked objects,
count=1, id=261, version=35229,
count=1, id=259, version=35229,
count=1, id=256, version=35229,
count=1, id=258, version=35229,
SecretTweaks/TUTORIAL.mp4
- SHA256 ee28385f6d6a544801d499e6efa601b33da46308fff0bc0747692fe797a0f1e7
- MD5 50ec8b9d4be199286840d08903263250
- SHA1 af2b22a4ed926d2f85e43d56ec542115d57a5272
- SHA512 22109c11e002cd740b78e5c4f0f05e59281f98b2c2878fd116421ac7e5cd729b13d7cb03fe7785ee246525946c18549b721497d0651a086223a594c565f24e03
- SSDEEP 196608:dsLPW36DvPqyCEfSVsV3nxFkdvwKvxjjkyYmXaIt1oi2PrSffGn9p+GA88BO/J24:6zW36DayCjYBcvTFFpOi4rmu9T8I/Dh
- TLSH T1B387331377E2FA40EC35AAB91F6DC719621CAC52A9C35BC774113B1E7679A200E783D2
- MD5 SHA1 SHA512 SSDEEP TLSH
SecretTweaks/patcher.exe
- IMPHASH c28ca0114680815a7e677e251dbd2d91
- SHA256 6b2e5a4353010319b2086fe13274b9d53936225d631bca5fe9f554133b696ad5
- MD5 519fb0e1625fafc326751a61ead59b28
- SHA1 ecaf0494e029fd5e0fa273db62a104b892760a80
- SHA512 c7df61b16d0e979760c89debe56d6ffcde732c9bbc1263ab7ab1acfc3757a5649a7886db24ce4ad93ef71e32923357665a1a91877cbfdd803288b94101ec9e71
- SSDEEP 768:ixibT+mrt/hCWqRkHOWDMQdAfjnX5+uOQ5/r/Cmq3jmnAOjwIN3YVayufTXfHJK:ixitAWrH4Q25T/3qTLIN3YVIfrxK
- TLSH T113531A279E1A506EC32A9DB4D6434802EB72BC8647B1BACF97811DDA0F156D4AF3FD01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
33152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\dwmxs\Downloads\runtime-memory-patcher-2-main\x64\Release\RuntimePatcher.pdb
kernel32
SetConsoleMode
Thread32Next
Thread32First
SuspendThread
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
GetConsoleMode
GetLastError
GetStdHandle
Process32FirstW
CloseHandle
GetSystemInfo
Module32FirstW
VirtualProtectEx
Module32NextW
SetConsoleTitleW
OpenThread
VirtualQueryEx
GetCurrentProcess
SetConsoleTextAttribute
Process32NextW
WriteProcessMemory
Sleep
GetCurrentThreadId
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Query_perf_counter
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xbad_alloc@std@@YAXXZ
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xinvalid_argument@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memcpy
__std_terminate
__std_exception_copy
__std_exception_destroy
memmove
api-ms-win-crt-string-l1-1-0
isdigit
_wcsicmp
strlen
wcslen
api-ms-win-crt-runtime-l1-1-0
__p___argv
_c_exit
_initialize_narrow_environment
__p___argc
_register_onexit_function
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
exit
_initialize_onexit_table
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_errno
terminate
_initterm_e
_beginthreadex
_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=29, id=261, version=35721,
count=6, id=257, version=35721,
count=5, id=257, version=33145,
count=161, id=1, productName=Unmarked objects,
count=1, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,