herdr-core-windows-x86_64.zip
- SHA256 a8984634c35b58ba82d0aec078d5a5e6004da01d5a25b3daf822ab5e31c7312b
Static task
static1
Behavioral task
behavioral1
Sample
conpty/conpty.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
conpty/conpty.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
conpty/x64/OpenConsole.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
conpty/x64/OpenConsole.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
herdr-core.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
herdr-core.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target herdr-core-windows-x86_64.zip
- Size 3.7MB
- Sample261113-katc9ssv4j
- SHA256 a8984634c35b58ba82d0aec078d5a5e6004da01d5a25b3daf822ab5e31c7312b
- MD5 6db3df68b686b4986cf8b84614b91975
- SHA1 1563b26fd1acf4ff36f1fcce18e6265c604334b5
- SHA512 bcd09a820bbea26a0da6abb7c3c8e14d0bf30fcb5d7438a1189f857113b36c402c72e92640e2b9ef64598b71774b27888972108c629b500bd9b16c92cce66be0
- SSDEEP 98304:uQ4Mq4ICexbxXvbcqkpjsV8M5G0HlOPGH9Vev47qQUnzlpi:uQ4L9C+BzcqkpQGM4ilO+dVe85Uzq
- TLSH T1D10633CAF28A774097A1AAF11E726346CE3E2B757A5C74274C7C5BE06280FD246D3607
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
herdr-core-windows-x86_64.zip.zip 3.7MB
-
LICENSE11KB
-
THIRD-PARTY-NOTICES/Microsoft.Windows.Console.ConPTY-LICENSE.txt1KB
-
THIRD-PARTY-NOTICES/Microsoft.Windows.Console.ConPTY-NOTICE.md22KB
-
THIRD-PARTY-NOTICES/herdr-core.txt924KB
-
conpty/conpty.dll.dll 107KB
-
conpty/x64/OpenConsole.exe.exe 1.0MB
-
herdr-core.exe.exe 8.8MB
LICENSE
- SHA256 1eb85fc97224598dad1852b5d6483bbcf0aa8608790dcc657a5a2a761ae9c8c6
- MD5 d229da563da18fe5d58cd95a6467d584
- SHA1 b314c7ebb7d599944981908b7f3ed33a30e78f3a
- SHA512 e2f81cb44129e1bc58941e7b3db1ffba40357889bace4fd65fd254d0be1bb757625bdf36bf46d555eb3ca4b130dcd1c05225caec28d8472dccf52a63dbd6e185
- SSDEEP 192:ff9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8SHfH2:9Ou9b01DY/rGBt+dc+aclkT8SH+
- TLSH T1A832832BBA4903771AF20122AB4764CEF31EA03F37591525315CC1682F7B96583FB69E
- MD5 SHA1 SHA512 SSDEEP TLSH
THIRD-PARTY-NOTICES/Microsoft.Windows.Console.ConPTY-LICENSE.txt
- SHA256 5d177f23ecfeb0ea8e050b6a5a16355e1ae9a0b286436ca8f83ed08b3795be6b
- MD5 93505fd4d147522f9e458dd88eb0a12c
- SHA1 5ed2d8e4e3bcdde0ed73ffa5b86840aea38b2c7b
- SHA512 8366bdc59864d254d525e540c15f6500727cecb288a62a73d6714def834f56ef7fc80adb19f049f3324f03fa22073f61bf127ed84e37c6cdb1a7e28249752597
- TLSH T15621931EB2590363289217625568ECC5F22BB18A7E7F1680347EF2091326068C6FF868
- MD5 SHA1 SHA512 TLSH
THIRD-PARTY-NOTICES/Microsoft.Windows.Console.ConPTY-NOTICE.md
- SHA256 e7fbaadee6ab20c28b87730a510ee5f5815d8fb4bd88d1d54d282dc2a74c0726
- MD5 7df3b5c9e237888022335847204e866a
- SHA1 6f8e21ac641e02b76f633e41720d15b117a18fde
- SHA512 a96fb66dfc9395d58ccc99e426c5e3a183f508df1173239772de995796d99af961c935487ca1a5ae40dd5f111c8688cc74bfbbcff02a137913df7aececf6d299
- SSDEEP 384:y3snrsErseSezYgMUB/YHYXR/VxEOYzYDrszrs5ezYgNY9Y9Y3Uxrszrs5ezYg4A:rnVXzYg9+4X1VKrz6ojzYgKaaExojzYu
- TLSH T155A2E86F720607661D9217916969F8C9F21FB05E7EAB2A48346EF308133B46CD5FF818
- MD5 SHA1 SHA512 SSDEEP TLSH
THIRD-PARTY-NOTICES/herdr-core.txt
- SHA256 0574542ad0acc8de676ec9b50083b2a527634314172f541e9454bf4b1157163b
- MD5 222b3457f0225f69da82c767900d3cfa
- SHA1 32ca3aef2d41f71f232b931c4faa947815dd39e8
- SHA512 b406213c068fb0c68b3ac4ad434a4d3cff5a4bfdb84944b3cc32e6eb418c4046afdab872596a653fb204ad5beef6961669b3857f1e45dc2430132aad73d937b9
- SSDEEP 12288:mmfmkQ2fWmN1WMhmsvLo+dia+diZcVcvcMmlt8NmKzamfoFHXkRxhgBfP+rkGC/C:n
- TLSH T10D15842BB649037716F20252AB57A4CEF31EA03F3B5A1514306CD1681F3B96583FB69E
- MD5 SHA1 SHA512 SSDEEP TLSH
conpty/conpty.dll
- IMPHASH f0fb36a8f0e259be4112ab2198b75a13
- SHA256 39fba2713e2495117b1591ae8c32a3b904bea7aa66069cf7815e2844c76d75d8
- MD5 cbd0fe7c9db8514edbf32ad70e05529a
- SHA1 ddaa27185edd601f8c70d30aee78ebc9a6166b78
- SHA512 73f3ad180922ede0557261b17878fb57027bb13b33bbab2127fe7026c7cacf3310301a2981a34f45c6ec6d9670fcda9a29d70147d55e939b1b15efd834db7512
- SSDEEP 3072:UUaG9GGNczAYJCyrrCTeHGhJwbuzA6yiXFS:UUV9hNQAYRfCq7uzA6W
- TLSH T132B37C2BB6A800EAD0BB8179C4A35E46F77174754720A7CF2761835A1F23BD06E3E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:6c:cc:3c:b7:6f:98:c7:0d:61:51:32:82:d7:d5:79:f9:4a:74:98:30:db:22:09:93:50:5b:5a:3f:d3:48:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
43760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\bin\x64\Release\conpty.pdb
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
GetModuleFileNameA
LoadLibraryExW
FreeLibrary
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockExclusive
DeleteCriticalSection
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
CreateProcessAsUserW
UpdateProcThreadAttribute
TlsSetValue
TlsGetValue
InitializeProcThreadAttributeList
GetCurrentProcess
GetCurrentThreadId
TlsAlloc
DeleteProcThreadAttributeList
TerminateProcess
TlsFree
api-ms-win-core-localization-l1-2-0
FormatMessageA
FormatMessageW
GetLocaleInfoEx
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
DuplicateHandle
SetHandleInformation
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_invalid_parameter_noinfo
_errno
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
abort
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemDirectoryW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
strcmp
wcsncmp
strlen
strcpy_s
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-core-file-l1-1-0
FindFirstFileW
FindClose
CreateFileW
WriteFile
GetFileAttributesExW
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
ClearPseudoConsole
ClosePseudoConsole
ConptyClearPseudoConsole
ConptyClosePseudoConsole
ConptyCreatePseudoConsole
ConptyCreatePseudoConsoleAsUser
ConptyPackPseudoConsole
ConptyReleasePseudoConsole
ConptyReparentPseudoConsole
ConptyResizePseudoConsole
ConptyShowHidePseudoConsole
CreatePseudoConsole
ReleasePseudoConsole
ResizePseudoConsole
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=35207,
count=10, id=260, version=35207,
count=44, id=261, version=35207,
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=128, id=1, productName=Unmarked objects,
count=5, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
conpty/x64/OpenConsole.exe
- IMPHASH d99f2b0e12cf28aee1b1f133f4dbd659
- SHA256 b7fd936c2668b87b9ecf7b3366dc6568afc1c6f981874cba3e955a1c35cf8160
- MD5 5d725f6986d630b96f880fd72db57dc5
- SHA1 d7ff78662fd09ea559fd24e3c37e19143cebaf9f
- SHA512 31362400daa6e8abc6af4d1f2329bbbf51cb8d4ace2d8b018ccf2bdd2fa6a2d9f0082d9c7fe9d3670e453188976514506cdbaa6b0445f719aa4512f3e3898d8e
- SSDEEP 24576:MadD7LlHZ/1iOD3T2OcIm+whOM9F+/bdwDl2:/rlHxfGO5BgOMixq4
- TLSH T1A5356B1AAAA915E8D47FD0B9C543C91BF6B27C4203758BCB06E18A562F677E01F3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c1:af:5f:63:55:44:b7:42:48:44:04:c3:4e:fa:0f:8d:dd:07:d9:75:2b:02:cc:fa:7a:ef:4e:3d:33:f4:0f:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 10, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
147632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\__w\1\s\bin\x64\Release\OpenConsole.pdb
api-ms-win-core-libraryloader-l1-2-0
LockResource
LoadResource
GetModuleFileNameA
LoadLibraryExW
LoadStringW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
FindResourceExW
FreeLibrary
LoadLibraryExA
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
CreateEventExW
SetEvent
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW
DeleteCriticalSection
CreateMutexExW
AcquireSRWLockShared
ResetEvent
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetProcessTimes
UpdateProcThreadAttribute
TerminateProcess
CreateThread
GetCurrentProcessId
OpenProcessToken
ExitProcess
InitializeProcThreadAttributeList
GetCurrentThreadId
CreateProcessW
GetCurrentProcess
TlsAlloc
TlsGetValue
GetStartupInfoW
TlsSetValue
TlsFree
SetProcessShutdownParameters
ExitThread
DeleteProcThreadAttributeList
api-ms-win-core-localization-l1-2-0
GetCPInfo
GetLocaleInfoEx
GetUserDefaultLocaleName
FormatMessageW
FormatMessageA
GetACP
GetOEMCP
IsValidCodePage
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
SearchPathW
GetEnvironmentVariableW
GetStdHandle
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoResumeClassObjects
IIDFromString
CoRegisterClassObject
CoRevokeClassObject
CoAddRefServerProcess
CoReleaseServerProcess
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-l1-1-0
RoRegisterActivationFactories
RoRevokeActivationFactories
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsIsStringEmpty
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
InitOnceExecuteOnce
WakeByAddressSingle
Sleep
WakeByAddressAll
WaitOnAddress
WakeAllConditionVariable
ntdll
NtQueryVolumeInformationFile
NtQueryInformationFile
api-ms-win-crt-runtime-l1-1-0
_c_exit
terminate
_exit
exit
_initterm_e
_initialize_onexit_table
_register_onexit_function
_initterm
_invoke_watson
_errno
_get_wide_winmain_command_line
_invalid_parameter_noinfo
_crt_atexit
_cexit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_configure_wide_argv
_seh_filter_exe
abort
_set_app_type
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf_s
__stdio_common_vswprintf
_set_fmode
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
strcpy_s
strlen
wcsnlen
strcmp
towlower
wcscpy_s
wcsncmp
api-ms-win-crt-convert-l1-1-0
wcstoul
wcstol
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
ext-ms-win-uiacore-l1-1-0
UiaReturnRawElementProvider
UiaHostProviderFromHwnd
oleaut32
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SysStringLen
VariantClear
SysFreeString
SysAllocString
SafeArrayDestroy
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryW
api-ms-win-shcore-scaling-l1-1-1
SetProcessDpiAwareness
GetDpiForMonitor
api-ms-win-ntuser-sysparams-l1-1-0
SystemParametersInfoW
GetSystemMetrics
GetMonitorInfoW
api-ms-win-core-processthreads-l1-1-3
SetThreadDescription
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalLock
GlobalSize
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalAlloc
GlobalFree
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegGetValueW
RegCloseKey
RegQueryValueExW
RegEnumValueW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount64
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetWindowsDirectoryW
ext-ms-win-uiacore-l1-1-1
UiaGetReservedMixedAttributeValue
UiaRaiseAutomationEvent
UiaGetReservedNotSupportedValue
propsys
PropVariantToInt16
PropVariantToBoolean
PropVariantToUInt32
api-ms-win-shell-namespace-l1-1-0
SHCreateItemFromParsingName
api-ms-win-core-path-l1-1-0
PathCchRemoveExtension
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
RegOpenKeyW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-core-file-l1-1-0
FindClose
FindFirstFileExW
FindNextFileW
ReadFile
WriteFile
CreateFileW
FindFirstFileW
GetFileAttributesExW
api-ms-win-core-sidebyside-l1-1-0
CreateActCtxW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
user32
FillRect
UnhookWindowsHookEx
GetIconInfo
ScrollDC
ScrollWindowEx
InvertRect
IsWindowVisible
CopyImage
ReleaseDC
GetDC
GetKeyState
VkKeyScanW
MapVirtualKeyW
PrivateExtractIconsW
GetWindowInfo
PostMessageW
SendMessageW
LoadIconW
DispatchMessageW
GetWindowLongW
GetCaretBlinkTime
LoadImageW
CloseClipboard
EmptyClipboard
GetClipboardData
OpenClipboard
SetClipboardData
RegisterClipboardFormatW
CheckRadioButton
GetMessageW
CheckDlgButton
SetDlgItemTextW
SendDlgItemMessageW
GetDlgItemTextW
IsDlgButtonChecked
AdjustWindowRectEx
DialogBoxParamW
GetWindowThreadProcessId
SetFocus
SetActiveWindow
EnableScrollBar
SetScrollInfo
GetWindowRect
SetLayeredWindowAttributes
IsZoomed
GetDpiForWindow
OffsetRect
SetWindowLongW
GetCursorPos
GetClientRect
MapWindowPoints
ClientToScreen
TrackPopupMenuEx
SendMessageTimeoutW
SetWindowTextW
BeginPaint
EndPaint
SetForegroundWindow
SendNotifyMessageW
GetSystemMenu
LoadMenuW
GetKeyboardState
GetForegroundWindow
AppendMenuW
GetDoubleClickTime
MonitorFromWindow
SetMenuItemInfoW
SetWindowPos
EnableMenuItem
ToUnicodeEx
IsWindow
GetSysColor
DefWindowProcW
KillTimer
SetTimer
ShowWindowAsync
GetWindowLongPtrW
ShowWindow
SetWindowsHookExW
ScreenToClient
SetCapture
GetKeyboardLayout
MonitorFromRect
LoadCursorW
NotifyWinEvent
DestroyWindow
IsIconic
SetWindowLongPtrW
CreateWindowExW
EndDialog
RegisterClassExW
DestroyIcon
ReleaseCapture
gdi32
GetObjectW
GetCharWidth32W
StretchDIBits
ExtCreatePen
DeleteObject
CreateFontIndirectA
AddFontMemResourceEx
CreateSolidBrush
PolyBezier
TranslateCharsetInfo
CreateCompatibleDC
SetGraphicsMode
IntersectClipRect
SelectClipRgn
GetTextFaceW
SetStretchBltMode
LineTo
ModifyWorldTransform
SetWorldTransform
SetTextColor
MoveToEx
PatBlt
ExtTextOutW
GdiFlush
BitBlt
CreateCompatibleBitmap
SetBkColor
SetDCBrushColor
GetGlyphIndicesW
RemoveFontMemResourceEx
DeleteDC
GetCharABCWidthsW
GetTextExtentPoint32W
CreateFontIndirectW
SelectObject
GetTextMetricsW
GetStockObject
GetOutlineTextMetricsW
shell32
DragFinish
ord102
DragQueryFileW
winmm
PlaySoundW
imm32
ImmDisableIME
usp10
ScriptIsComplex
ScriptStringAnalyse
ScriptStringOut
ScriptStringFree
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_aligned_malloc
calloc
malloc
_callnewh
_aligned_free
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
lround
lroundf
roundf
ceil
ceilf
floorf
log10
lrintf
pow
powf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
d2d1
ord1
dwrite
DWriteCreateFactory
dxgi
CreateDXGIFactory2
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DReflect
D3DCompileFromFile
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
Name
.text
Size
737KB
Virtual Size
736KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
206KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=1, id=261, version=35228,
count=97, id=261, version=35207,
count=6, id=260, version=30795,
count=14, id=257, version=30795,
count=145, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=514, id=1, productName=Unmarked objects,
count=178, id=270, version=35228,
count=1, id=255, version=35228,
count=2, id=151,
count=1, id=258, version=35228,
herdr-core.exe
- IMPHASH 157b431b903becc06206585973c4f58c
- SHA256 5304b33036e6f83d752751e8e4ca78ea484acf6b9247e72f2d3aecc02f696a6d
- MD5 8b0dc897d4c356de6ef59eeec59a902f
- SHA1 7d3b7588658e1515de465e460977c8a9239f535f
- SHA512 66fb6751ec67ad4c67531dc1367af284075555bdf2d91b4fd264a26185d9d07bb9e7b8870e5018d155af547fc7412f6c5c0d19f53738d73f4ef1e81493e4ee07
- SSDEEP 98304:PC5Q8FtSEaMSt8Kj9qxcb0d9ghNeMNaTsO6EaRE62QT:KQjq6Z
- TLSH T14B962A173A9F55BDC596C470834B4B639A2130DB1A26BCBF60C891343F79AF05B3A798
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a1:af:a6:36:93:1f:56:0e:d7:a0:e0:9b:23:79:4d:e1:76:9c:b5:f7:d1:f1:73:db:03:63:ea:8f:02:94:fe:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=herdr,O=herdr,L=Wilmington,ST=Delaware,C=US
Chains
Nov 12, 2026
CN=herdr,O=herdr,L=Wilmington,ST=Delaware,C=US
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=herdr,O=herdr,L=Wilmington,ST=Delaware,C=US
Serial Number
33:00:09:c3:69:ad:6f:ae:a0:1c:28:03:da:00:00:00:09:c3:69
Issuer
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 11, 2026 - Nov 14, 2026
Subject
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 26, 2026 - Mar 26, 2031
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:60:72:06:24:8a:4a:05:b8:d9:00:00:00:00:00:60
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 17, 2026 - Sep 14, 2027
Minor OS version
0
Major OS version
6
Entry point
6270880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
herdr_core.pdb
kernel32
WaitNamedPipeW
WriteFile
ReadFile
CreateIoCompletionPort
CancelIoEx
DisconnectNamedPipe
UnregisterWaitEx
TerminateJobObject
GetProcessId
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
Thread32First
OpenThread
Thread32Next
ResumeThread
WaitForSingleObject
RegisterWaitForSingleObject
GetExitCodeProcess
DeviceIoControl
SetFileAttributesW
GetOverlappedResult
ConnectNamedPipe
CreateEventW
FindClose
SetHandleInformation
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessW
DeleteProcThreadAttributeList
CreateThread
QueryInformationJobObject
OpenProcess
IsWow64Process
CreateNamedPipeW
PostQueuedCompletionStatus
SetEnvironmentVariableW
SetFileInformationByHandle
SetLastError
CreatePipe
CloseHandle
QueryFullProcessImageNameW
LoadLibraryW
GetModuleHandleW
GetProcAddress
SleepEx
WriteFileEx
GetConsoleOutputCP
GetConsoleCP
PeekConsoleInputW
LockFileEx
Process32NextW
CreateFileW
GetQueuedCompletionStatusEx
CreateToolhelp32Snapshot
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
GetCurrentDirectoryW
GetCurrentProcessId
WriteConsoleW
GetEnvironmentVariableW
ReadFileEx
FormatMessageW
GetModuleHandleA
GetFullPathNameW
SetFileTime
FindFirstFileExW
GetFileInformationByHandle
GetFileInformationByHandleEx
SwitchToThread
ReadConsoleW
DuplicateHandle
CreateDirectoryW
ExitProcess
WaitForMultipleObjects
CancelIo
TerminateProcess
GetFileAttributesW
GetModuleFileNameW
SetConsoleCP
GetCommandLineW
GetTempPathW
DeleteFileW
GetFinalPathNameByHandleW
CopyFileExW
MoveFileExW
CreateHardLinkW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
GetFileType
FindNextFileW
SetConsoleOutputCP
SetFilePointerEx
LoadLibraryExW
SetStdHandle
GetEnvironmentStringsW
UnhandledExceptionFilter
Process32FirstW
FlushFileBuffers
FreeEnvironmentStringsW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetModuleHandleExW
SetConsoleCtrlHandler
ReadConsoleInputW
LocalFree
ReadProcessMemory
GetCurrentProcess
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetLastError
SetConsoleMode
GetConsoleMode
GetStdHandle
GetCurrentThread
SetThreadStackGuarantee
GetProcessTimes
AddVectoredExceptionHandler
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
DiscardVirtualMemory
GetWindowsDirectoryW
GetSystemDirectoryW
CompareStringOrdinal
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
LCMapStringW
HeapReAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
VirtualProtect
CompareStringW
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
shell32
CommandLineToArgvW
bcrypt
BCryptGenRandom
BCryptHash
bcryptprimitives
ProcessPrng
advapi32
OpenProcessToken
GetTokenInformation
EqualSid
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
userenv
ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock
CreateEnvironmentBlock
user32
GetSystemMetrics
ntdll
RtlWakeAddressAll
RtlGetFullPathName_U
RtlEqualUnicodeString
NtCreateNamedPipeFile
RtlWakeAddressSingle
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtQueryInformationProcess
NtAllocateVirtualMemory
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
NtClose
NtFreeVirtualMemory
NtOpenFile
NtReadFile
RtlWaitOnAddress
Name
.text
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
210KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=139, id=261, version=33145,
count=6, id=260, version=33145,
count=2, id=259, version=33145,
count=7, id=259, version=35721,
count=16, id=260, version=35721,
count=39, id=261, version=35721,
count=3, id=257, version=33145,
count=217, id=1, productName=Unmarked objects,
count=39, productName=Unmarked objects (old),
count=1, id=258, version=36260,