7a616846...55ad | Files
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Riskware, Dropper, Trojan, Ransomware

7a61684657c789eafc051d7107f6a0917e86f92cecaa108e4ba3f08d631c55ad (SHA256)

CRYPT.EXE

Windows Exe (x86-32)

Created at 2019-01-19 16:50:00

...

Notifications (2/3)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "1 minute, 30 seconds" to "30 seconds" to reveal dormant functionality.

The operating system was rebooted during the analysis.

Remarks

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Filters:
Filename Category Type Severity Actions
C:\Users\CIiHmnxMn6Ps\Desktop\CRYPT.EXE Sample File Binary
Blacklisted
...
»
Also Known As C:\windows\searchfiles.exe (Created File)
Mime Type application/x-dosexec
File Size 12.00 KB
MD5 6184d75ab9ac2df542261f166460400b Copy to Clipboard
SHA1 51fda63da594cfc84931209775185e63bb9afd4b Copy to Clipboard
SHA256 7a61684657c789eafc051d7107f6a0917e86f92cecaa108e4ba3f08d631c55ad Copy to Clipboard
SSDeep 192:vRf4VFgG/7KoX8zyHgND68C6enatK9I45c2PuKAxywCMrpY7S8LqPZo5LdCfuR15:Jf4VFgM+oXCJND683eag9xCqAxyr6+SE Copy to Clipboard
ImpHash c25a63f1cb283b9f6549cb252d84bb68 Copy to Clipboard
File Reputation Information
»
Severity
Blacklisted
First Seen 2018-12-22 03:06 (UTC+1)
Last Seen 2019-01-03 04:39 (UTC+1)
Names Win32.Trojan.Filecoder
Families Filecoder
Classification Trojan
PE Information
»
Image Base 0x400000
Entry Point 0x405001
Size Of Code 0x1000
Size Of Initialized Data 0x1c00
File Type executable
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2018-12-07 11:32:14+00:00
Packer ASPack v2.12 -> Alexey Solodovnikov
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x1000 0x800 0x400 cnt_initialized_data, mem_read, mem_write 7.86
.rdata 0x402000 0x1000 0x400 0xc00 cnt_initialized_data, mem_read, mem_write 7.19
.data 0x403000 0x2000 0xe00 0x1000 cnt_initialized_data, mem_read, mem_write 7.9
.UPX 0x405000 0x2000 0x1200 0x1e00 cnt_initialized_data, mem_read, mem_write 5.69
.adata 0x407000 0x1000 0x0 0x3000 cnt_initialized_data, mem_read, mem_write 0.0
Imports (4)
»
kernel32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetProcAddress 0x0 0x405f5c 0x5f5c 0x2d5c 0x0
GetModuleHandleA 0x0 0x405f60 0x5f60 0x2d60 0x0
LoadLibraryA 0x0 0x405f64 0x5f64 0x2d64 0x0
shell32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHChangeNotify 0x0 0x406031 0x6031 0x2e31 0x0
advapi32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegOpenKeyExA 0x0 0x406039 0x6039 0x2e39 0x0
mpr.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
WNetOpenEnumA 0x0 0x406041 0x6041 0x2e41 0x0
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll id-Br3n0G72wUb8CejT.LyaS Created File Binary
Whitelisted
...
»
Mime Type application/x-dosexec
File Size 780.83 KB
MD5 1fc6060e2b7da45e4e9fb7f3e75adc0a Copy to Clipboard
SHA1 4cb47eb40457945d2e8f56471192a387c2dd0369 Copy to Clipboard
SHA256 92da58f32e8468c86b830d88914e872558e8a6bc6d430f8cd1cf4236c8a32d51 Copy to Clipboard
SSDeep 12288:Gsqbw+mQAhpsnL8vwCjdLkW0wxxymyYbPvvzEFtqc3KRGwZH:hhQqgLawAdLbfx1hvvgFwHGwZH Copy to Clipboard
ImpHash f8115427f66dee9021c2d21b9ab61b46 Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
First Seen 2013-01-08 18:40 (UTC+1)
Last Seen 2018-10-29 03:40 (UTC+1)
PE Information
»
Image Base 0x10000000
Entry Point 0x1005c82b
Size Of Code 0xa7400
Size Of Initialized Data 0x1ca00
File Type dll
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2011-02-19 02:26:29+00:00
Version Information (8)
»
LegalCopyright © Microsoft Corporation. All rights reserved.
InternalName MSDIA100.DLL
FileVersion 10.00.40219.01 built by: SP1Rel
CompanyName Microsoft Corporation
ProductName Microsoft® Visual Studio® 2010
ProductVersion 10.00.40219.01
FileDescription Microsoft® Debug Information Accessor
OriginalFilename MSDIA100.DLL
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xa73b3 0xa7400 0x400 cnt_code, mem_execute, mem_read 6.41
.data 0x100a9000 0x4b18 0x2600 0xa7800 cnt_initialized_data, mem_read, mem_write 2.3
.rsrc 0x100ae000 0xbe80 0xc000 0xa9e00 cnt_initialized_data, mem_read 4.76
.reloc 0x100ba000 0xbdce 0xbe00 0xb5e00 cnt_initialized_data, mem_discardable, mem_read 5.26
Imports (1)
»
KERNEL32.dll (98)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetLastError 0x0 0x10001000 0xa7a40 0xa6e40 0x473
InterlockedDecrement 0x0 0x10001004 0xa7a44 0xa6e44 0x2eb
InterlockedIncrement 0x0 0x10001008 0xa7a48 0xa6e48 0x2ef
FindResourceW 0x0 0x1000100c 0xa7a4c 0xa6e4c 0x14e
LoadResource 0x0 0x10001010 0xa7a50 0xa6e50 0x341
LockResource 0x0 0x10001014 0xa7a54 0xa6e54 0x354
SizeofResource 0x0 0x10001018 0xa7a58 0xa6e58 0x4b1
MultiByteToWideChar 0x0 0x1000101c 0xa7a5c 0xa6e5c 0x367
LocalAlloc 0x0 0x10001020 0xa7a60 0xa6e60 0x344
LocalFree 0x0 0x10001024 0xa7a64 0xa6e64 0x348
GetModuleFileNameW 0x0 0x10001028 0xa7a68 0xa6e68 0x214
GetLastError 0x0 0x1000102c 0xa7a6c 0xa6e6c 0x202
GetSystemInfo 0x0 0x10001030 0xa7a70 0xa6e70 0x273
GetVersion 0x0 0x10001034 0xa7a74 0xa6e74 0x2a2
EnterCriticalSection 0x0 0x10001038 0xa7a78 0xa6e78 0xee
LeaveCriticalSection 0x0 0x1000103c 0xa7a7c 0xa6e7c 0x339
LCMapStringW 0x0 0x10001040 0xa7a80 0xa6e80 0x32d
InitializeCriticalSection 0x0 0x10001044 0xa7a84 0xa6e84 0x2e2
DeleteCriticalSection 0x0 0x10001048 0xa7a88 0xa6e88 0xd1
CreateFileW 0x0 0x1000104c 0xa7a8c 0xa6e8c 0x8f
GetFileSize 0x0 0x10001050 0xa7a90 0xa6e90 0x1f0
CreateFileMappingW 0x0 0x10001054 0xa7a94 0xa6e94 0x8c
MapViewOfFile 0x0 0x10001058 0xa7a98 0xa6e98 0x357
CloseHandle 0x0 0x1000105c 0xa7a9c 0xa6e9c 0x52
UnmapViewOfFile 0x0 0x10001060 0xa7aa0 0xa6ea0 0x4d6
GetProcAddress 0x0 0x10001064 0xa7aa4 0xa6ea4 0x245
FreeLibrary 0x0 0x10001068 0xa7aa8 0xa6ea8 0x162
InterlockedExchange 0x0 0x1000106c 0xa7aac 0xa6eac 0x2ec
LoadLibraryA 0x0 0x10001070 0xa7ab0 0xa6eb0 0x33c
RaiseException 0x0 0x10001074 0xa7ab4 0xa6eb4 0x3b1
GetCurrentThreadId 0x0 0x10001078 0xa7ab8 0xa6eb8 0x1c5
DecodePointer 0x0 0x1000107c 0xa7abc 0xa6ebc 0xca
GetCommandLineA 0x0 0x10001080 0xa7ac0 0xa6ec0 0x186
EncodePointer 0x0 0x10001084 0xa7ac4 0xa6ec4 0xea
HeapFree 0x0 0x10001088 0xa7ac8 0xa6ec8 0x2cf
HeapAlloc 0x0 0x1000108c 0xa7acc 0xa6ecc 0x2cb
TlsAlloc 0x0 0x10001090 0xa7ad0 0xa6ed0 0x4c5
TlsGetValue 0x0 0x10001094 0xa7ad4 0xa6ed4 0x4c7
TlsSetValue 0x0 0x10001098 0xa7ad8 0xa6ed8 0x4c8
TlsFree 0x0 0x1000109c 0xa7adc 0xa6edc 0x4c6
GetModuleHandleW 0x0 0x100010a0 0xa7ae0 0xa6ee0 0x218
Sleep 0x0 0x100010a4 0xa7ae4 0xa6ee4 0x4b2
ExitProcess 0x0 0x100010a8 0xa7ae8 0xa6ee8 0x119
SetHandleCount 0x0 0x100010ac 0xa7aec 0xa6eec 0x46f
GetStdHandle 0x0 0x100010b0 0xa7af0 0xa6ef0 0x264
InitializeCriticalSectionAndSpinCount 0x0 0x100010b4 0xa7af4 0xa6ef4 0x2e3
GetFileType 0x0 0x100010b8 0xa7af8 0xa6ef8 0x1f3
GetStartupInfoW 0x0 0x100010bc 0xa7afc 0xa6efc 0x263
GetModuleFileNameA 0x0 0x100010c0 0xa7b00 0xa6f00 0x213
FreeEnvironmentStringsW 0x0 0x100010c4 0xa7b04 0xa6f04 0x161
WideCharToMultiByte 0x0 0x100010c8 0xa7b08 0xa6f08 0x511
GetEnvironmentStringsW 0x0 0x100010cc 0xa7b0c 0xa6f0c 0x1da
HeapCreate 0x0 0x100010d0 0xa7b10 0xa6f10 0x2cd
HeapDestroy 0x0 0x100010d4 0xa7b14 0xa6f14 0x2ce
QueryPerformanceCounter 0x0 0x100010d8 0xa7b18 0xa6f18 0x3a7
GetTickCount 0x0 0x100010dc 0xa7b1c 0xa6f1c 0x293
GetCurrentProcessId 0x0 0x100010e0 0xa7b20 0xa6f20 0x1c1
GetSystemTimeAsFileTime 0x0 0x100010e4 0xa7b24 0xa6f24 0x279
TerminateProcess 0x0 0x100010e8 0xa7b28 0xa6f28 0x4c0
GetCurrentProcess 0x0 0x100010ec 0xa7b2c 0xa6f2c 0x1c0
UnhandledExceptionFilter 0x0 0x100010f0 0xa7b30 0xa6f30 0x4d3
SetUnhandledExceptionFilter 0x0 0x100010f4 0xa7b34 0xa6f34 0x4a5
IsDebuggerPresent 0x0 0x100010f8 0xa7b38 0xa6f38 0x300
WriteFile 0x0 0x100010fc 0xa7b3c 0xa6f3c 0x525
GetCPInfo 0x0 0x10001100 0xa7b40 0xa6f40 0x172
GetACP 0x0 0x10001104 0xa7b44 0xa6f44 0x168
GetOEMCP 0x0 0x10001108 0xa7b48 0xa6f48 0x237
IsValidCodePage 0x0 0x1000110c 0xa7b4c 0xa6f4c 0x30a
GetStringTypeW 0x0 0x10001110 0xa7b50 0xa6f50 0x269
HeapSize 0x0 0x10001114 0xa7b54 0xa6f54 0x2d4
IsProcessorFeaturePresent 0x0 0x10001118 0xa7b58 0xa6f58 0x304
SetFilePointer 0x0 0x1000111c 0xa7b5c 0xa6f5c 0x466
ReadFile 0x0 0x10001120 0xa7b60 0xa6f60 0x3c0
RtlUnwind 0x0 0x10001124 0xa7b64 0xa6f64 0x418
HeapReAlloc 0x0 0x10001128 0xa7b68 0xa6f68 0x2d2
LoadLibraryW 0x0 0x1000112c 0xa7b6c 0xa6f6c 0x33f
GetConsoleCP 0x0 0x10001130 0xa7b70 0xa6f70 0x19a
GetConsoleMode 0x0 0x10001134 0xa7b74 0xa6f74 0x1ac
SetStdHandle 0x0 0x10001138 0xa7b78 0xa6f78 0x487
FlushFileBuffers 0x0 0x1000113c 0xa7b7c 0xa6f7c 0x157
WriteConsoleW 0x0 0x10001140 0xa7b80 0xa6f80 0x524
SetEndOfFile 0x0 0x10001144 0xa7b84 0xa6f84 0x453
GetProcessHeap 0x0 0x10001148 0xa7b88 0xa6f88 0x24a
SetFileAttributesW 0x0 0x1000114c 0xa7b8c 0xa6f8c 0x461
GetFileAttributesW 0x0 0x10001150 0xa7b90 0xa6f90 0x1ea
CopyFileW 0x0 0x10001154 0xa7b94 0xa6f94 0x75
VirtualAlloc 0x0 0x10001158 0xa7b98 0xa6f98 0x4e9
VirtualFree 0x0 0x1000115c 0xa7b9c 0xa6f9c 0x4ec
DeleteFileW 0x0 0x10001160 0xa7ba0 0xa6fa0 0xd6
DeviceIoControl 0x0 0x10001164 0xa7ba4 0xa6fa4 0xdd
GetCurrentDirectoryW 0x0 0x10001168 0xa7ba8 0xa6fa8 0x1bf
ExpandEnvironmentStringsW 0x0 0x1000116c 0xa7bac 0xa6fac 0x11d
GetDriveTypeW 0x0 0x10001170 0xa7bb0 0xa6fb0 0x1d3
MapViewOfFileEx 0x0 0x10001174 0xa7bb4 0xa6fb4 0x358
FlushViewOfFile 0x0 0x10001178 0xa7bb8 0xa6fb8 0x15a
GetFullPathNameW 0x0 0x1000117c 0xa7bbc 0xa6fbc 0x1fb
CompareStringW 0x0 0x10001180 0xa7bc0 0xa6fc0 0x64
SetEnvironmentVariableW 0x0 0x10001184 0xa7bc4 0xa6fc4 0x457
Exports (6)
»
Api name EAT Address Ordinal
DllCanUnloadNow 0x13be0 0x1
DllGetClassObject 0x14060 0x2
DllRegisterServer 0x13e30 0x3
DllUnregisterServer 0x13f90 0x4
VSDllRegisterServer 0x13df0 0x5
VSDllUnregisterServer 0x13e10 0x6
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2009-12-07 22:40:29+00:00
Valid Until 2011-03-07 22:40:29+00:00
Algorithm sha1_rsa
Serial Number 61 01 CF 3E 00 00 00 00 00 0F
Thumbprint 96 17 09 4A 1C FB 59 AE 7C 1F 7D FD B6 73 9E 4E 7C 40 50 8F
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2007-08-22 22:31:02+00:00
Valid Until 2012-08-25 07:00:00+00:00
Algorithm sha1_rsa
Serial Number 2E AB 11 DC 50 FF 5C 9D CB C0
Thumbprint 30 36 E3 B2 5B 88 A5 5B 86 FC 90 E6 E9 EA AD 50 81 44 51 66
\\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll id-Br3n0G72wUb8CejT.LyaS Created File Binary
Whitelisted
...
»
Mime Type application/x-dosexec
File Size 162.64 KB
MD5 8caaade246143a3bd3b3b3ba68116b75 Copy to Clipboard
SHA1 536436a0f3eaddbc9195d2e9b3ae7fde172bc85f Copy to Clipboard
SHA256 592e63d9994b528a76e2ac9e84c42b5f42ad284e58fe714ab29d5156313d2ff5 Copy to Clipboard
SSDeep 3072:5/71j9gfwJTxt+TqXBYOmk2qNh0eQxUW3Dj9f9:j5gfQTUKBYxkBYDjP Copy to Clipboard
ImpHash f22e30d20d746fd7cd683035da055a51 Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
First Seen 2018-05-26 19:19 (UTC+2)
Last Seen 2018-07-17 17:58 (UTC+2)
PE Information
»
Image Base 0x43000000
Entry Point 0x4300f754
Size Of Code 0x18600
Size Of Initialized Data 0xfa00
File Type dll
Subsystem windows_cui
Machine Type amd64
Compile Timestamp 2017-12-22 05:08:06+00:00
Version Information (8)
»
LegalCopyright © Microsoft Corporation. All rights reserved.
InternalName vstoee.dll
FileVersion 10.0.60828.0 built by: VSTO_Rel
CompanyName Microsoft Corporation
ProductName Microsoft® Visual Studio® 2010
ProductVersion 10.0.60828.0
FileDescription Visual Studio Tools for Office Execution Engine
OriginalFilename vstoee.dll
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x43001000 0x185d6 0x18600 0x400 cnt_code, mem_execute, mem_read 6.3
.rdata 0x4301a000 0x9613 0x9800 0x18a00 cnt_initialized_data, mem_read 4.44
.data 0x43024000 0x25f8 0x1200 0x22200 cnt_initialized_data, mem_read, mem_write 2.51
.pdata 0x43027000 0x1620 0x1800 0x23400 cnt_initialized_data, mem_read 4.95
.rsrc 0x43029000 0x1a70 0x1c00 0x24c00 cnt_initialized_data, mem_read 5.03
.reloc 0x4302b000 0x656 0x800 0x26800 cnt_initialized_data, mem_discardable, mem_read 3.24
Imports (8)
»
ADVAPI32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegCloseKey 0x0 0x4301a000 0x229d0 0x213d0 0x230
RegOpenKeyExW 0x0 0x4301a008 0x229d8 0x213d8 0x261
RegQueryValueExW 0x0 0x4301a010 0x229e0 0x213e0 0x26e
RegCreateKeyExW 0x0 0x4301a018 0x229e8 0x213e8 0x239
RegDeleteKeyW 0x0 0x4301a020 0x229f0 0x213f0 0x244
RegDeleteValueW 0x0 0x4301a028 0x229f8 0x213f8 0x248
RegSetValueExW 0x0 0x4301a030 0x22a00 0x21400 0x27e
RegEnumKeyExW 0x0 0x4301a038 0x22a08 0x21408 0x24f
KERNEL32.dll (72)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetProcAddress 0x0 0x4301a048 0x22a18 0x21418 0x24c
LoadLibraryW 0x0 0x4301a050 0x22a20 0x21420 0x341
FreeLibrary 0x0 0x4301a058 0x22a28 0x21428 0x168
GetModuleHandleW 0x0 0x4301a060 0x22a30 0x21430 0x21e
MultiByteToWideChar 0x0 0x4301a068 0x22a38 0x21438 0x369
CreateProcessW 0x0 0x4301a070 0x22a40 0x21440 0xa8
GetLastError 0x0 0x4301a078 0x22a48 0x21448 0x208
CloseHandle 0x0 0x4301a080 0x22a50 0x21450 0x52
GetVersionExW 0x0 0x4301a088 0x22a58 0x21458 0x2ac
CreateMutexW 0x0 0x4301a090 0x22a60 0x21460 0x9e
CreateEventW 0x0 0x4301a098 0x22a68 0x21468 0x85
CreateSemaphoreW 0x0 0x4301a0a0 0x22a70 0x21470 0xae
WaitForSingleObject 0x0 0x4301a0a8 0x22a78 0x21478 0x508
SetEvent 0x0 0x4301a0b0 0x22a80 0x21480 0x467
ResetEvent 0x0 0x4301a0b8 0x22a88 0x21488 0x412
WaitForMultipleObjects 0x0 0x4301a0c0 0x22a90 0x21490 0x506
ReleaseSemaphore 0x0 0x4301a0c8 0x22a98 0x21498 0x401
ReleaseMutex 0x0 0x4301a0d0 0x22aa0 0x214a0 0x3fd
InitializeCriticalSectionAndSpinCount 0x0 0x4301a0d8 0x22aa8 0x214a8 0x2eb
DeleteCriticalSection 0x0 0x4301a0e0 0x22ab0 0x214b0 0xd2
EnterCriticalSection 0x0 0x4301a0e8 0x22ab8 0x214b8 0xf2
LeaveCriticalSection 0x0 0x4301a0f0 0x22ac0 0x214c0 0x33b
GetCurrentThreadId 0x0 0x4301a0f8 0x22ac8 0x214c8 0x1cb
SetLastError 0x0 0x4301a100 0x22ad0 0x214d0 0x480
GetModuleFileNameW 0x0 0x4301a108 0x22ad8 0x214d8 0x21a
GetCPInfo 0x0 0x4301a110 0x22ae0 0x214e0 0x178
LCMapStringW 0x0 0x4301a118 0x22ae8 0x214e8 0x32f
HeapReAlloc 0x0 0x4301a120 0x22af0 0x214f0 0x2da
WriteFile 0x0 0x4301a128 0x22af8 0x214f8 0x534
GetStringTypeW 0x0 0x4301a130 0x22b00 0x21500 0x270
RtlPcToFileHeader 0x0 0x4301a138 0x22b08 0x21508 0x421
RtlCaptureContext 0x0 0x4301a140 0x22b10 0x21510 0x418
GetACP 0x0 0x4301a148 0x22b18 0x21518 0x16e
RtlLookupFunctionEntry 0x0 0x4301a150 0x22b20 0x21520 0x41f
RtlVirtualUnwind 0x0 0x4301a158 0x22b28 0x21528 0x426
IsDebuggerPresent 0x0 0x4301a160 0x22b30 0x21530 0x302
SetUnhandledExceptionFilter 0x0 0x4301a168 0x22b38 0x21538 0x4b3
UnhandledExceptionFilter 0x0 0x4301a170 0x22b40 0x21540 0x4e2
RaiseException 0x0 0x4301a178 0x22b48 0x21548 0x3b4
HeapAlloc 0x0 0x4301a180 0x22b50 0x21550 0x2d3
HeapSize 0x0 0x4301a188 0x22b58 0x21558 0x2dc
IsValidCodePage 0x0 0x4301a190 0x22b60 0x21560 0x30c
GetCurrentProcess 0x0 0x4301a198 0x22b68 0x21568 0x1c6
GetOEMCP 0x0 0x4301a1a0 0x22b70 0x21570 0x23e
FlsSetValue 0x0 0x4301a1a8 0x22b78 0x21578 0x15b
GetCommandLineA 0x0 0x4301a1b0 0x22b80 0x21580 0x18c
EncodePointer 0x0 0x4301a1b8 0x22b88 0x21588 0xee
DecodePointer 0x0 0x4301a1c0 0x22b90 0x21590 0xcb
RtlUnwindEx 0x0 0x4301a1c8 0x22b98 0x21598 0x425
FlsGetValue 0x0 0x4301a1d0 0x22ba0 0x215a0 0x15a
FlsFree 0x0 0x4301a1d8 0x22ba8 0x215a8 0x159
FlsAlloc 0x0 0x4301a1e0 0x22bb0 0x215b0 0x158
HeapFree 0x0 0x4301a1e8 0x22bb8 0x215b8 0x2d7
Sleep 0x0 0x4301a1f0 0x22bc0 0x215c0 0x4c0
ExitProcess 0x0 0x4301a1f8 0x22bc8 0x215c8 0x11f
SetHandleCount 0x0 0x4301a200 0x22bd0 0x215d0 0x47c
GetStdHandle 0x0 0x4301a208 0x22bd8 0x215d8 0x26b
GetFileType 0x0 0x4301a210 0x22be0 0x215e0 0x1fa
GetStartupInfoW 0x0 0x4301a218 0x22be8 0x215e8 0x26a
GetModuleFileNameA 0x0 0x4301a220 0x22bf0 0x215f0 0x219
FreeEnvironmentStringsW 0x0 0x4301a228 0x22bf8 0x215f8 0x167
WideCharToMultiByte 0x0 0x4301a230 0x22c00 0x21600 0x520
GetEnvironmentStringsW 0x0 0x4301a238 0x22c08 0x21608 0x1e1
HeapSetInformation 0x0 0x4301a240 0x22c10 0x21610 0x2db
GetVersion 0x0 0x4301a248 0x22c18 0x21618 0x2aa
HeapCreate 0x0 0x4301a250 0x22c20 0x21620 0x2d5
HeapDestroy 0x0 0x4301a258 0x22c28 0x21628 0x2d6
QueryPerformanceCounter 0x0 0x4301a260 0x22c30 0x21630 0x3a9
GetTickCount 0x0 0x4301a268 0x22c38 0x21638 0x29a
GetCurrentProcessId 0x0 0x4301a270 0x22c40 0x21640 0x1c7
GetSystemTimeAsFileTime 0x0 0x4301a278 0x22c48 0x21648 0x280
TerminateProcess 0x0 0x4301a280 0x22c50 0x21650 0x4ce
SHLWAPI.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PathAppendW 0x0 0x4301a2d0 0x22ca0 0x216a0 0x34
PathFindExtensionW 0x0 0x4301a2d8 0x22ca8 0x216a8 0x47
UrlCreateFromPathW 0x0 0x4301a2e0 0x22cb0 0x216b0 0x15a
UrlCanonicalizeW 0x0 0x4301a2e8 0x22cb8 0x216b8 0x154
PathGetCharTypeW 0x0 0x4301a2f0 0x22cc0 0x216c0 0x53
PathRemoveFileSpecW 0x0 0x4301a2f8 0x22cc8 0x216c8 0x8b
PathFileExistsW 0x0 0x4301a300 0x22cd0 0x216d0 0x45
ole32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoCreateGuid 0x0 0x4301a330 0x22d00 0x21700 0x13
IIDFromString 0x0 0x4301a338 0x22d08 0x21708 0x101
CoTaskMemFree 0x0 0x4301a340 0x22d10 0x21710 0x6c
StringFromGUID2 0x0 0x4301a348 0x22d18 0x21718 0x1b5
OLEAUT32.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VariantInit 0x8 0x4301a290 0x22c60 0x21660 -
SysFreeString 0x6 0x4301a298 0x22c68 0x21668 -
VariantCopy 0xa 0x4301a2a0 0x22c70 0x21670 -
SysAllocString 0x2 0x4301a2a8 0x22c78 0x21678 -
VariantClear 0x9 0x4301a2b0 0x22c80 0x21680 -
VERSION.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VerQueryValueW 0x0 0x4301a310 0x22ce0 0x216e0 0xe
GetFileVersionInfoW 0x0 0x4301a318 0x22ce8 0x216e8 0x6
GetFileVersionInfoSizeW 0x0 0x4301a320 0x22cf0 0x216f0 0x5
urlmon.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoInternetCreateSecurityManager 0x0 0x4301a358 0x22d28 0x21728 0xc
SHELL32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHGetFolderPathW 0x0 0x4301a2c0 0x22c90 0x21690 0xc3
Exports (10)
»
Api name EAT Address Ordinal
CreateVstoSolutionMetadataKey 0xdde8 0x1
DllCanUnloadNow 0xf1c8 0x9
DllGetClassObject 0xf2c0 0xa
GetLatestVstoRuntimeVersion 0xdb4c 0x2
GetValidCompatibleFramework 0xe000 0x3
GetVstoSolutionMetadata 0xdfa0 0x4
GetVstoSolutionRuntimeVersionW 0xdd00 0x5
GetVstoSolutionVersionW 0xdbd0 0x6
InstallSolution 0x1c50 0x7
InstallVstoSolutionW 0x1d34 0x8
Icons (1)
»
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 79 7C 2E 57 4E 52 E1 CA D6 00 01 00 00 01 79
Thumbprint 5E AD 30 0D C7 E4 D6 37 94 8E CB 0E D8 29 A0 72 BD 15 2E 17
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
\\?\C:\Users\CIiHmnxMn6Ps\Music\M0FRaonJmV.m4a id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 87.61 KB
MD5 a3cc77d614df663a72810a9ff6fb551b Copy to Clipboard
SHA1 89955a64fa246554574128e4c48c2cb7ad2ec052 Copy to Clipboard
SHA256 98d9a49b8f0b69b8a2512b43595ae56a5fcf598d78821223ba1d4cce506602f3 Copy to Clipboard
SSDeep 1536:ID3w0D1xbZ9+JlI0CBjYTIWFBYqFdhxLeDqFgZlMsdPXix/vZSeOUeceHIkZVpLA:IDjHbZuvCBjYTlFBbNZeDqFgT5dE/rsm Copy to Clipboard
\\?\C:\Program Files (x86)\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 993f1ea1fa67d7b0bfb664c157544c34 Copy to Clipboard
SHA1 bd9a7bbd1eb695650628fff95a17c0898519b485 Copy to Clipboard
SHA256 f1f26b4d3ff43e7189293dead52ee134aad686e3201b4293600fcaddd1e03f23 Copy to Clipboard
SSDeep 48:tf7Ir74tLvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:F0PIvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files (x86)\Mozilla Firefox\Accessible.tlb id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 4.44 KB
MD5 909974724dfff392f276ef2fcb702e5d Copy to Clipboard
SHA1 216b4b30f4ea9c6e3f56664f8c737c0483acaafe Copy to Clipboard
SHA256 fc1ba0cb7da79e31e83b492571008747ddcaf462010f3435918a588e8cf081a0 Copy to Clipboard
SSDeep 96:CN9a/7HLBKWizZ5MVdmhNtZNlRbBHflvkVYj1Xm6IVJVvlpYx0:CN0/rOz8dYXdflvkejdm7VJVvx Copy to Clipboard
\\?\C:\ProgramData\Microsoft\Crypto\SystemKeys\6d00fa390c15cc4634c8ca8153b76f29_911499c7-ef29-47ed-a64c-6b1751f20848 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 3.03 KB
MD5 5b7a4797c9298f451f91cd11e23eda04 Copy to Clipboard
SHA1 a41567e05128577c7611e1f75f3aafdb3ce8e348 Copy to Clipboard
SHA256 902507b8800499913c94d3db6df38d7ff94d3623805209b1aff1fdc6a74585cf Copy to Clipboard
SSDeep 96:HrfBVDDwH+83lTvkVYj1Xm6IVJVvlpYx0:HrfBVDDq+6lvkejdm7VJVvx Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\rR19YSzpNWbN5JSMbg.mp3 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 9.30 KB
MD5 c23ec53969a6a1bb8bab4a1dbd4819c3 Copy to Clipboard
SHA1 534f541f53a10585b062d805115cbce687f2279f Copy to Clipboard
SHA256 e534b5da8a7ba890da2a733ce4528eb73b0ef531d199d4ff7dcf2216ca8ae282 Copy to Clipboard
SSDeep 192:D/OIlPqjcV2aK1cw/CzfaZa2jylxnj09Qvkejdm7VJVvx:KBMzK1azy82el3BOVrx Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\9f-BbJpQsNgzH8xy.ots id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 29.31 KB
MD5 85ff782d50759161fb8dd0d863471237 Copy to Clipboard
SHA1 a66f722ed4737d0b5ea7ad09d2c126ebb828ac50 Copy to Clipboard
SHA256 aeae953bc8ff7563de181e2238888def17c3f31f71097a529a7247254f011ed9 Copy to Clipboard
SSDeep 768:nNFLAumQ8Ud1my8v0qCwzxSj7k4T6PWMKhe6maWaN06nKjZ8tSwvO+FWgBsl:njLFmQh/8vIwNSj7kacJu2aWaN5nsU5a Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.006.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 b313a1f81bcbee762eed7301abe804e1 Copy to Clipboard
SHA1 68de728d41619cb21b26dc0e57cdadf03dd0d44e Copy to Clipboard
SHA256 8b632822c4308499bdf3feb340aa99ca15a12d9ded48a034fff514e7ac8f6f2d Copy to Clipboard
SSDeep 384:ceEL20OOJYk1ZR1o2F6O2HKOgV7m0KfO0ww50uZBOVrx:8OOOk1ZRn8OIcF0wE7Bsl Copy to Clipboard
\\?\C:\Users\Default\NTUSER.DAT id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 257.50 KB
MD5 2c4a1f7a6ec2732dd6ba939aa9ae23fa Copy to Clipboard
SHA1 a3e3b562c3e321e247922459b999d2acbe13525e Copy to Clipboard
SHA256 9c8077d526a771257566b5cf2f1adc7d185abf7ee9265577556403a1be464285 Copy to Clipboard
SSDeep 6144:oxmLtlrVebzxCRkrlxnihfHj6g/b0QwYACEdeWJNfIWm:oxm5lrsekXW/2LYDWNfFm Copy to Clipboard
\\?\C:\Users\Public\Music\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 1.87 KB
MD5 167f2f27799f6b68c2c15347e3945138 Copy to Clipboard
SHA1 800de83b8f044eb2d3c5c8b486267bcc8c370362 Copy to Clipboard
SHA256 43d0f516307858b15acc5a6aae5a89b7f7e5c74bf3fda7dd3aa65aabeabf3bf3 Copy to Clipboard
SSDeep 48:Gk35UMRfqd334x9vhWUyvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:pqv3IxgvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\JjYoZpHYWTU.m4a id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 89.24 KB
MD5 df11ee51dc6ac99271fd39b7bb672ecf Copy to Clipboard
SHA1 d3ed0638dd08adbc88fb92eb9bce1bc862a65784 Copy to Clipboard
SHA256 cf9056ebcd06e8d05be59e2c4169453a6713039f2c80f5971564b2670ea7d686 Copy to Clipboard
SSDeep 1536:AJVVvGUxvdwsnaqyy/o2bjmntfZIc0xE3d6Skwob2jb//13JTMtpWoYlBkgll9CY:KfeUxvasntyfoj0Z04hfnlGzY/1T9J Copy to Clipboard
\\?\C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c7c24.timestamp id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 1.55 KB
MD5 d0d4cf8f339364e44ba3867eb100db56 Copy to Clipboard
SHA1 996566a3c60698f32d8cc497298d1b91afdb5b59 Copy to Clipboard
SHA256 7f61497538744195c1c3440a6f94ba2969746e8932d50628aa17c0f1027c2f6b Copy to Clipboard
SSDeep 48:EpqNggvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:EILvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Microsoft Office\AppXManifest.xml id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 5.76 MB
MD5 dbebeb399168d2f65dd4b4277184e4ed Copy to Clipboard
SHA1 10827665c55791a71828e0fe7d426cb61e48130d Copy to Clipboard
SHA256 1611b084b7de06ea516da25fd788fad43c1d7c96a49de752d6316a839b34f989 Copy to Clipboard
SSDeep 49152:HDWuRuv5IJBFg6tzUKspLEC7Z2zC3NI13NIwmX:HCwuv5aBFg0zU/pLEC7UmX Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 1.74 KB
MD5 550d01b0eee7c5a741277c82b0caf02f Copy to Clipboard
SHA1 6508f65811b28f2eb6e6040d59e364f48da61ab0 Copy to Clipboard
SHA256 7e240d8ceacf9732df6c68e9b720411fc6928008bdbc67b1adf5f2f209cd3f7f Copy to Clipboard
SSDeep 48:IKHlVnIpxwXKnvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:nTcw6nvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Windows NT\lowest forwarding sitemap.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 45e27f5feba10f7cba1f0fdee186aa62 Copy to Clipboard
SHA1 2d69e1be44e2a5c215c1c04b509f64723e932b7c Copy to Clipboard
SHA256 2e20b009c69f84eb4858e4d29e96bae8cadf32035c199085b57cebe9cea1be02 Copy to Clipboard
SSDeep 1536:kNBSGH3KI/1BKBcLhOssUE23fKTg92pzXCNUril46Iq/PLlU0sl:Hs3KI/1KiBAO2pdeAejlUf Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\LGn3zp_fF2XhsytW9iY.png id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 41.89 KB
MD5 363e4a3e80569717fe5cc184aed52554 Copy to Clipboard
SHA1 957ab5f4da0c66c1ff90f45de357a726b7f6b337 Copy to Clipboard
SHA256 62515c2827fbe3f55fce46e775262e2e5898c769e809df1e8e95596be1aef56c Copy to Clipboard
SSDeep 768:n3DVXDf3/ZsSX2mXVUO+iS82p1QWGMJ40LEy1XJikYH/U8MM+0PsBsl:5XD3eSGmXVUOORp1HGMJ40LEyFJik+/X Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\SlQRk7s3j8.mp3 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 81.39 KB
MD5 284219703a3e8e32410893be856dbaa6 Copy to Clipboard
SHA1 eeb7943640f1db78ffdea929cd75e139186fceac Copy to Clipboard
SHA256 13582e3092482d2363156aeb3ed95d6039f9f2ae2d71546df9f65f3a378b3da9 Copy to Clipboard
SSDeep 1536:ZgbQ0KBsjAIq0HcUyfmp8UAfh8LpHwevNKneheD+CCUTr+A2t7eKXwwRsl:ZgQz8sWWfmqAjN+l+ChroTXj+ Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\sm_xgLw3u40OkI.jpg id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 92.94 KB
MD5 2a91861e0c7169df9e67a7462672898d Copy to Clipboard
SHA1 a4d7584a2e435f2286e5cf23b6de918c0ac948ac Copy to Clipboard
SHA256 4d3493d36468e0507dd879ba69c400ce5b60a85ee42d58b5f2a5f40566aa9460 Copy to Clipboard
SSDeep 1536:a4ad5JUAqADgI9rZgTdCQAfEodLQaFKydxpz4V8Nu0KSCsfiZBSYNYS2IN/SJIYY:aLdeeyxCQAMW3JdTW50XCUIrRzSJIYY Copy to Clipboard
\\?\C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml id-Br3n0G72wUb8CejT.LyaS Modified File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.85 KB
MD5 13ad07eec40d6af2600597fbb48db91c Copy to Clipboard
SHA1 949acb60bd2f8b0b77c9df9deaba5e142281ede8 Copy to Clipboard
SHA256 e176964e647ebeff20e24ebbda01810dbd1ecbc07b0c1a55248dbd0f1db30d9a Copy to Clipboard
SSDeep 48:kthDfMBcFVBXiFiJn/ph4mHbzEducXUvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:yxfScFPiFiJnFbzEdu7vkVYj1Xm6IVJj Copy to Clipboard
\\?\C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml id-Br3n0G72wUb8CejT.LyaS Modified File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 3.43 KB
MD5 a2e8eeda4b6266ce41abe41acce16d91 Copy to Clipboard
SHA1 c553ff7a298f2b68f53fd57638164c05b59cdb1c Copy to Clipboard
SHA256 a4335480ac48cdec67818208ada975389761769834c54308b5fa7a0c66823617 Copy to Clipboard
SSDeep 96:uVkoS/vYc+VFAoWc5ZI17CKuecvkVYj1Xm6IVJVvlpYx0:uZSIc+bAqqBCVvkejdm7VJVvx Copy to Clipboard
\\?\C:\Program Files\Windows Mail\tr_wireless.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 a8acbf07e92d21636614cb41d86ce31c Copy to Clipboard
SHA1 73ca6bbc5a88a8b6dbb11d9e6362c9c0aae11d28 Copy to Clipboard
SHA256 dd435cb463ed27b615098521b4e6f9c13d6078d61da1dade59f93ad3c464460f Copy to Clipboard
SSDeep 1536:4tMmvjrrQ43ZaNnbTK2HXENicuVkFCrdaDsOxvku8lhfsyVsYMOusl:4tMmrrrQUaboNicNCrdaD/Mu8Ts9q Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\VC_redist.x86.exe id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
...
»
Mime Type application/x-dosexec
File Size 517.98 KB
MD5 02ce786c2214475af0af55857762d07e Copy to Clipboard
SHA1 63ca60153ff1eb393f6c6ed5b43c91e516a00746 Copy to Clipboard
SHA256 29cf2f79b42d4c6743025f1532943d3e09c9cc84887ccf6daa7927d70cfe249c Copy to Clipboard
SSDeep 12288:pAqkoCtQO4Nai3jk/POpKNpWCmA9rSiPjIfj430:pxkoIgNaPIKNpWLGxI0E Copy to Clipboard
ImpHash 8e2588a9cf43886de3449dfff03137b6 Copy to Clipboard
PE Information
»
Image Base 0x400000
Entry Point 0x428494
Size Of Code 0x39400
Size Of Initialized Data 0x23600
File Type executable
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2015-02-13 19:42:32+00:00
Version Information (8)
»
LegalCopyright Copyright (c) Microsoft Corporation. All rights reserved.
InternalName setup
FileVersion 14.0.23026.0
CompanyName Microsoft Corporation
ProductName Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026
ProductVersion 14.0.23026.0
FileDescription Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026
OriginalFilename VC_redist.x86.exe
Sections (7)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x39384 0x39400 0x400 cnt_code, mem_execute, mem_read 6.51
.rdata 0x43b000 0x1a0ec 0x1a200 0x39800 cnt_initialized_data, mem_read 4.96
.data 0x456000 0x30c0 0x1000 0x53a00 cnt_initialized_data, mem_read, mem_write 2.79
.wixburn 0x45a000 0x38 0x200 0x54a00 cnt_initialized_data, mem_read 0.58
.tls 0x45b000 0x9 0x200 0x54c00 cnt_initialized_data, mem_read, mem_write 0.0
.rsrc 0x45c000 0x3910 0x3a00 0x54e00 cnt_initialized_data, mem_read 5.51
.reloc 0x460000 0x4482 0x4600 0x58800 cnt_initialized_data, mem_discardable, mem_read 5.66
Imports (15)
»
gdiplus.dll (13)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GdiplusShutdown 0x0 0x43b404 0x53bc8 0x523c8 0x274
GdiplusStartup 0x0 0x43b408 0x53bcc 0x523cc 0x275
GdipDeleteGraphics 0x0 0x43b40c 0x53bd0 0x523d0 0x90
GdipFree 0x0 0x43b410 0x53bd4 0x523d4 0xed
GdipCloneImage 0x0 0x43b414 0x53bd8 0x523d8 0x36
GdipDisposeImage 0x0 0x43b418 0x53bdc 0x523dc 0x98
GdipGetImageWidth 0x0 0x43b41c 0x53be0 0x523e0 0x12c
GdipGetImageHeight 0x0 0x43b420 0x53be4 0x523e4 0x122
GdipCreateBitmapFromResource 0x0 0x43b424 0x53be8 0x523e8 0x4f
GdipCreateFromHDC 0x0 0x43b428 0x53bec 0x523ec 0x5b
GdipSetInterpolationMode 0x0 0x43b42c 0x53bf0 0x523f0 0x218
GdipDrawImageRectI 0x0 0x43b430 0x53bf4 0x523f4 0xb8
GdipAlloc 0x0 0x43b434 0x53bf8 0x523f8 0x21
ADVAPI32.dll (44)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
QueryServiceConfigW 0x0 0x43b000 0x537c4 0x51fc4 0x224
CryptAcquireContextW 0x0 0x43b004 0x537c8 0x51fc8 0xb1
CryptCreateHash 0x0 0x43b008 0x537cc 0x51fcc 0xb3
CryptHashData 0x0 0x43b00c 0x537d0 0x51fd0 0xc8
CryptGetHashParam 0x0 0x43b010 0x537d4 0x51fd4 0xc4
CryptDestroyHash 0x0 0x43b014 0x537d8 0x51fd8 0xb6
CryptReleaseContext 0x0 0x43b018 0x537dc 0x51fdc 0xcb
RegDeleteKeyW 0x0 0x43b01c 0x537e0 0x51fe0 0x244
RegCreateKeyExW 0x0 0x43b020 0x537e4 0x51fe4 0x239
RegEnumKeyExW 0x0 0x43b024 0x537e8 0x51fe8 0x24f
RegEnumValueW 0x0 0x43b028 0x537ec 0x51fec 0x252
AdjustTokenPrivileges 0x0 0x43b02c 0x537f0 0x51ff0 0x1f
LookupPrivilegeValueW 0x0 0x43b030 0x537f4 0x51ff4 0x197
OpenProcessToken 0x0 0x43b034 0x537f8 0x51ff8 0x1f7
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x0 0x43b038 0x537fc 0x51ffc 0x72
RegCloseKey 0x0 0x43b03c 0x53800 0x52000 0x230
RegDeleteValueW 0x0 0x43b040 0x53804 0x52004 0x248
RegQueryValueExW 0x0 0x43b044 0x53808 0x52008 0x26e
GetUserNameW 0x0 0x43b048 0x5380c 0x5200c 0x165
InitiateSystemShutdownExW 0x0 0x43b04c 0x53810 0x52010 0x17d
CreateWellKnownSid 0x0 0x43b050 0x53814 0x52014 0x83
InitializeAcl 0x0 0x43b054 0x53818 0x52018 0x176
SetEntriesInAclW 0x0 0x43b058 0x5381c 0x5201c 0x2a6
DecryptFileW 0x0 0x43b05c 0x53820 0x52020 0xd8
ChangeServiceConfigW 0x0 0x43b060 0x53824 0x52024 0x50
ControlService 0x0 0x43b064 0x53828 0x52028 0x5c
CloseServiceHandle 0x0 0x43b068 0x5382c 0x5202c 0x57
QueryServiceStatus 0x0 0x43b06c 0x53830 0x52030 0x228
OpenServiceW 0x0 0x43b070 0x53834 0x52034 0x1fb
OpenSCManagerW 0x0 0x43b074 0x53838 0x52038 0x1f9
RegQueryInfoKeyW 0x0 0x43b078 0x5383c 0x5203c 0x268
RegSetValueExW 0x0 0x43b07c 0x53840 0x52040 0x27e
SetEntriesInAclA 0x0 0x43b080 0x53844 0x52044 0x2a5
SetSecurityDescriptorGroup 0x0 0x43b084 0x53848 0x52048 0x2b7
RegOpenKeyExW 0x0 0x43b088 0x5384c 0x5204c 0x261
GetTokenInformation 0x0 0x43b08c 0x53850 0x52050 0x15a
CheckTokenMembership 0x0 0x43b090 0x53854 0x52054 0x51
AllocateAndInitializeSid 0x0 0x43b094 0x53858 0x52058 0x20
FreeSid 0x0 0x43b098 0x5385c 0x5205c 0x120
LookupAccountNameW 0x0 0x43b09c 0x53860 0x52060 0x18f
SetNamedSecurityInfoW 0x0 0x43b0a0 0x53864 0x52064 0x2b1
InitializeSecurityDescriptor 0x0 0x43b0a4 0x53868 0x52068 0x177
SetSecurityDescriptorDacl 0x0 0x43b0a8 0x5386c 0x5206c 0x2b6
SetSecurityDescriptorOwner 0x0 0x43b0ac 0x53870 0x52070 0x2b8
USER32.dll (25)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetMessageW 0x0 0x43b348 0x53b0c 0x5230c 0x15d
PeekMessageW 0x0 0x43b34c 0x53b10 0x52310 0x233
PostMessageW 0x0 0x43b350 0x53b14 0x52314 0x236
IsWindow 0x0 0x43b354 0x53b18 0x52318 0x1db
PostQuitMessage 0x0 0x43b358 0x53b1c 0x5231c 0x237
GetWindowLongW 0x0 0x43b35c 0x53b20 0x52320 0x196
SetWindowLongW 0x0 0x43b360 0x53b24 0x52324 0x2c4
DefWindowProcW 0x0 0x43b364 0x53b28 0x52328 0x9c
UnregisterClassW 0x0 0x43b368 0x53b2c 0x5232c 0x306
DispatchMessageW 0x0 0x43b36c 0x53b30 0x52330 0xaf
TranslateMessage 0x0 0x43b370 0x53b34 0x52334 0x2fc
IsDialogMessageW 0x0 0x43b374 0x53b38 0x52338 0x1cd
MsgWaitForMultipleObjects 0x0 0x43b378 0x53b3c 0x5233c 0x21c
WaitForInputIdle 0x0 0x43b37c 0x53b40 0x52340 0x326
LoadCursorW 0x0 0x43b380 0x53b44 0x52344 0x1eb
BeginPaint 0x0 0x43b384 0x53b48 0x52348 0xe
EndPaint 0x0 0x43b388 0x53b4c 0x5234c 0xdc
GetCursorPos 0x0 0x43b38c 0x53b50 0x52350 0x120
MonitorFromPoint 0x0 0x43b390 0x53b54 0x52354 0x218
GetMonitorInfoW 0x0 0x43b394 0x53b58 0x52358 0x15f
ReleaseDC 0x0 0x43b398 0x53b5c 0x5235c 0x265
MessageBoxW 0x0 0x43b39c 0x53b60 0x52360 0x215
PostThreadMessageW 0x0 0x43b3a0 0x53b64 0x52364 0x239
RegisterClassW 0x0 0x43b3a4 0x53b68 0x52368 0x24e
CreateWindowExW 0x0 0x43b3a8 0x53b6c 0x5236c 0x6e
OLEAUT32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VariantClear 0x9 0x43b31c 0x53ae0 0x522e0 -
VariantInit 0x8 0x43b320 0x53ae4 0x522e4 -
SysAllocString 0x2 0x43b324 0x53ae8 0x522e8 -
SysFreeString 0x6 0x43b328 0x53aec 0x522ec -
GDI32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetDeviceCaps 0x0 0x43b0d0 0x53894 0x52094 0x1cb
CreateDCW 0x0 0x43b0d4 0x53898 0x52098 0x32
SHELL32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ShellExecuteExW 0x0 0x43b338 0x53afc 0x522fc 0x121
SHGetFolderPathW 0x0 0x43b33c 0x53b00 0x52300 0xc3
CommandLineToArgvW 0x0 0x43b340 0x53b04 0x52304 0x6
ole32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoTaskMemFree 0x0 0x43b48c 0x53c50 0x52450 0x68
CoCreateInstance 0x0 0x43b490 0x53c54 0x52454 0x10
CoInitialize 0x0 0x43b494 0x53c58 0x52458 0x3e
CoUninitialize 0x0 0x43b498 0x53c5c 0x5245c 0x6c
CoInitializeEx 0x0 0x43b49c 0x53c60 0x52460 0x3f
StringFromGUID2 0x0 0x43b4a0 0x53c64 0x52464 0x179
CoInitializeSecurity 0x0 0x43b4a4 0x53c68 0x52468 0x40
CLSIDFromProgID 0x0 0x43b4a8 0x53c6c 0x5246c 0x6
KERNEL32.dll (143)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCurrentProcess 0x0 0x43b0dc 0x538a0 0x520a0 0x1c0
InitializeCriticalSection 0x0 0x43b0e0 0x538a4 0x520a4 0x2e2
TlsFree 0x0 0x43b0e4 0x538a8 0x520a8 0x4c6
DeleteCriticalSection 0x0 0x43b0e8 0x538ac 0x520ac 0xd1
CloseHandle 0x0 0x43b0ec 0x538b0 0x520b0 0x52
TlsGetValue 0x0 0x43b0f0 0x538b4 0x520b4 0x4c7
Sleep 0x0 0x43b0f4 0x538b8 0x520b8 0x4b2
GetLastError 0x0 0x43b0f8 0x538bc 0x520bc 0x202
ReleaseMutex 0x0 0x43b0fc 0x538c0 0x520c0 0x3fa
TlsSetValue 0x0 0x43b100 0x538c4 0x520c4 0x4c8
TlsAlloc 0x0 0x43b104 0x538c8 0x520c8 0x4c5
GetCurrentThreadId 0x0 0x43b108 0x538cc 0x520cc 0x1c5
GetVersionExW 0x0 0x43b10c 0x538d0 0x520d0 0x2a4
GetModuleHandleW 0x0 0x43b110 0x538d4 0x520d4 0x218
ReadFile 0x0 0x43b114 0x538d8 0x520d8 0x3c0
SetFilePointerEx 0x0 0x43b118 0x538dc 0x520dc 0x467
CreateFileW 0x0 0x43b11c 0x538e0 0x520e0 0x8f
GetCurrentProcessId 0x0 0x43b120 0x538e4 0x520e4 0x1c1
GetProcessId 0x0 0x43b124 0x538e8 0x520e8 0x24c
WriteFile 0x0 0x43b128 0x538ec 0x520ec 0x525
ConnectNamedPipe 0x0 0x43b12c 0x538f0 0x520f0 0x65
SetNamedPipeHandleState 0x0 0x43b130 0x538f4 0x520f4 0x47c
lstrlenW 0x0 0x43b134 0x538f8 0x520f8 0x54e
CompareStringW 0x0 0x43b138 0x538fc 0x520fc 0x64
LocalFree 0x0 0x43b13c 0x53900 0x52100 0x348
CreateNamedPipeW 0x0 0x43b140 0x53904 0x52104 0xa0
WaitForSingleObject 0x0 0x43b144 0x53908 0x52108 0x4f9
OpenProcess 0x0 0x43b148 0x5390c 0x5210c 0x380
lstrlenA 0x0 0x43b14c 0x53910 0x52110 0x54d
RemoveDirectoryW 0x0 0x43b150 0x53914 0x52114 0x403
GetFileAttributesW 0x0 0x43b154 0x53918 0x52118 0x1ea
ExpandEnvironmentStringsW 0x0 0x43b158 0x5391c 0x5211c 0x11d
LeaveCriticalSection 0x0 0x43b15c 0x53920 0x52120 0x339
EnterCriticalSection 0x0 0x43b160 0x53924 0x52124 0xee
FreeLibrary 0x0 0x43b164 0x53928 0x52128 0x162
GetProcAddress 0x0 0x43b168 0x5392c 0x5212c 0x245
VerifyVersionInfoW 0x0 0x43b16c 0x53930 0x52130 0x4e8
VerSetConditionMask 0x0 0x43b170 0x53934 0x52134 0x4e4
GetComputerNameW 0x0 0x43b174 0x53938 0x52138 0x18f
GetTempPathW 0x0 0x43b178 0x5393c 0x5213c 0x285
GetSystemDirectoryW 0x0 0x43b17c 0x53940 0x52140 0x270
GetSystemWow64DirectoryW 0x0 0x43b180 0x53944 0x52144 0x27e
GetVolumePathNameW 0x0 0x43b184 0x53948 0x52148 0x2ab
HeapAlloc 0x0 0x43b188 0x5394c 0x5214c 0x2cb
GetSystemDefaultLangID 0x0 0x43b18c 0x53950 0x52150 0x26c
GetUserDefaultLangID 0x0 0x43b190 0x53954 0x52154 0x29c
GetDateFormatW 0x0 0x43b194 0x53958 0x52158 0x1c8
GetSystemTime 0x0 0x43b198 0x5395c 0x5215c 0x277
InterlockedExchange 0x0 0x43b19c 0x53960 0x52160 0x2ec
LoadLibraryW 0x0 0x43b1a0 0x53964 0x52164 0x33f
InterlockedCompareExchange 0x0 0x43b1a4 0x53968 0x52168 0x2e9
GetExitCodeThread 0x0 0x43b1a8 0x5396c 0x5216c 0x1e0
CreateThread 0x0 0x43b1ac 0x53970 0x52170 0xb5
SetEvent 0x0 0x43b1b0 0x53974 0x52174 0x459
WaitForMultipleObjects 0x0 0x43b1b4 0x53978 0x52178 0x4f7
CreateEventW 0x0 0x43b1b8 0x5397c 0x5217c 0x85
ProcessIdToSessionId 0x0 0x43b1bc 0x53980 0x52180 0x399
InterlockedIncrement 0x0 0x43b1c0 0x53984 0x52184 0x2ef
InterlockedDecrement 0x0 0x43b1c4 0x53988 0x52188 0x2eb
GetStringTypeW 0x0 0x43b1c8 0x5398c 0x5218c 0x269
SetFileAttributesW 0x0 0x43b1cc 0x53990 0x52190 0x461
FindClose 0x0 0x43b1d0 0x53994 0x52194 0x12e
FindNextFileW 0x0 0x43b1d4 0x53998 0x52198 0x145
FindFirstFileW 0x0 0x43b1d8 0x5399c 0x5219c 0x139
CreateProcessW 0x0 0x43b1dc 0x539a0 0x521a0 0xa8
SetCurrentDirectoryW 0x0 0x43b1e0 0x539a4 0x521a4 0x44d
GetCurrentDirectoryW 0x0 0x43b1e4 0x539a8 0x521a8 0x1bf
GetExitCodeProcess 0x0 0x43b1e8 0x539ac 0x521ac 0x1df
SetThreadExecutionState 0x0 0x43b1ec 0x539b0 0x521b0 0x493
CopyFileExW 0x0 0x43b1f0 0x539b4 0x521b4 0x72
HeapSetInformation 0x0 0x43b1f4 0x539b8 0x521b8 0x2d3
MapViewOfFile 0x0 0x43b1f8 0x539bc 0x521bc 0x357
CreateFileMappingW 0x0 0x43b1fc 0x539c0 0x521c0 0x8c
CreateMutexW 0x0 0x43b200 0x539c4 0x521c4 0x9e
SetEndOfFile 0x0 0x43b204 0x539c8 0x521c8 0x453
ResetEvent 0x0 0x43b208 0x539cc 0x521cc 0x40f
SetFileTime 0x0 0x43b20c 0x539d0 0x521d0 0x46a
LocalFileTimeToFileTime 0x0 0x43b210 0x539d4 0x521d4 0x346
DosDateTimeToFileTime 0x0 0x43b214 0x539d8 0x521d8 0xe4
CreateFileA 0x0 0x43b218 0x539dc 0x521dc 0x88
GetSystemTimeAsFileTime 0x0 0x43b21c 0x539e0 0x521e0 0x279
VirtualFree 0x0 0x43b220 0x539e4 0x521e4 0x4ec
VirtualAlloc 0x0 0x43b224 0x539e8 0x521e8 0x4e9
DeleteFileW 0x0 0x43b228 0x539ec 0x521ec 0xd6
GetThreadLocale 0x0 0x43b22c 0x539f0 0x521f0 0x28c
GetTimeZoneInformation 0x0 0x43b230 0x539f4 0x521f4 0x298
TerminateProcess 0x0 0x43b234 0x539f8 0x521f8 0x4c0
UnhandledExceptionFilter 0x0 0x43b238 0x539fc 0x521fc 0x4d3
SystemTimeToTzSpecificLocalTime 0x0 0x43b23c 0x53a00 0x52200 0x4be
SystemTimeToFileTime 0x0 0x43b240 0x53a04 0x52204 0x4bd
GlobalAlloc 0x0 0x43b244 0x53a08 0x52208 0x2b3
IsProcessorFeaturePresent 0x0 0x43b248 0x53a0c 0x5220c 0x304
GetTickCount 0x0 0x43b24c 0x53a10 0x52210 0x293
QueryPerformanceCounter 0x0 0x43b250 0x53a14 0x52214 0x3a7
HeapCreate 0x0 0x43b254 0x53a18 0x52218 0x2cd
SetLastError 0x0 0x43b258 0x53a1c 0x5221c 0x473
EncodePointer 0x0 0x43b25c 0x53a20 0x52220 0xea
GetFileType 0x0 0x43b260 0x53a24 0x52224 0x1f3
InitializeCriticalSectionAndSpinCount 0x0 0x43b264 0x53a28 0x52228 0x2e3
SetHandleCount 0x0 0x43b268 0x53a2c 0x5222c 0x46f
GetEnvironmentStringsW 0x0 0x43b26c 0x53a30 0x52230 0x1da
GlobalFree 0x0 0x43b270 0x53a34 0x52234 0x2ba
MoveFileExW 0x0 0x43b274 0x53a38 0x52238 0x360
CopyFileW 0x0 0x43b278 0x53a3c 0x5223c 0x75
GetFileSizeEx 0x0 0x43b27c 0x53a40 0x52240 0x1f1
GetModuleHandleA 0x0 0x43b280 0x53a44 0x52244 0x215
RaiseException 0x0 0x43b284 0x53a48 0x52248 0x3b1
GetCPInfo 0x0 0x43b288 0x53a4c 0x5224c 0x172
GetACP 0x0 0x43b28c 0x53a50 0x52250 0x168
GetOEMCP 0x0 0x43b290 0x53a54 0x52254 0x237
IsValidCodePage 0x0 0x43b294 0x53a58 0x52258 0x30a
RtlUnwind 0x0 0x43b298 0x53a5c 0x5225c 0x418
SetFilePointer 0x0 0x43b29c 0x53a60 0x52260 0x466
WideCharToMultiByte 0x0 0x43b2a0 0x53a64 0x52264 0x511
GetConsoleCP 0x0 0x43b2a4 0x53a68 0x52268 0x19a
GetConsoleMode 0x0 0x43b2a8 0x53a6c 0x5226c 0x1ac
HeapSize 0x0 0x43b2ac 0x53a70 0x52270 0x2d4
HeapReAlloc 0x0 0x43b2b0 0x53a74 0x52274 0x2d2
LCMapStringW 0x0 0x43b2b4 0x53a78 0x52278 0x32d
MultiByteToWideChar 0x0 0x43b2b8 0x53a7c 0x5227c 0x367
SetStdHandle 0x0 0x43b2bc 0x53a80 0x52280 0x487
WriteConsoleW 0x0 0x43b2c0 0x53a84 0x52284 0x524
FlushFileBuffers 0x0 0x43b2c4 0x53a88 0x52288 0x157
GetLocalTime 0x0 0x43b2c8 0x53a8c 0x5228c 0x203
UnmapViewOfFile 0x0 0x43b2cc 0x53a90 0x52290 0x4d6
IsDebuggerPresent 0x0 0x43b2d0 0x53a94 0x52294 0x300
DuplicateHandle 0x0 0x43b2d4 0x53a98 0x52298 0xe8
HeapFree 0x0 0x43b2d8 0x53a9c 0x5229c 0x2cf
FormatMessageW 0x0 0x43b2dc 0x53aa0 0x522a0 0x15e
GetTempFileNameW 0x0 0x43b2e0 0x53aa4 0x522a4 0x283
GetWindowsDirectoryW 0x0 0x43b2e4 0x53aa8 0x522a8 0x2af
CompareStringA 0x0 0x43b2e8 0x53aac 0x522ac 0x61
FreeEnvironmentStringsW 0x0 0x43b2ec 0x53ab0 0x522b0 0x161
GetModuleFileNameW 0x0 0x43b2f0 0x53ab4 0x522b4 0x214
GetStdHandle 0x0 0x43b2f4 0x53ab8 0x522b8 0x264
DecodePointer 0x0 0x43b2f8 0x53abc 0x522bc 0xca
ExitProcess 0x0 0x43b2fc 0x53ac0 0x522c0 0x119
SetUnhandledExceptionFilter 0x0 0x43b300 0x53ac4 0x522c4 0x4a5
GetStartupInfoW 0x0 0x43b304 0x53ac8 0x522c8 0x263
GetCommandLineW 0x0 0x43b308 0x53acc 0x522cc 0x187
GetFullPathNameW 0x0 0x43b30c 0x53ad0 0x522d0 0x1fb
CreateDirectoryW 0x0 0x43b310 0x53ad4 0x522d4 0x81
GetProcessHeap 0x0 0x43b314 0x53ad8 0x522d8 0x24a
Cabinet.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
(by ordinal) 0x16 0x43b0c0 0x53884 0x52084 -
(by ordinal) 0x14 0x43b0c4 0x53888 0x52088 -
(by ordinal) 0x17 0x43b0c8 0x5388c 0x5208c -
CRYPT32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CertGetCertificateContextProperty 0x0 0x43b0b4 0x53878 0x52078 0x46
CryptHashPublicKeyInfo 0x0 0x43b0b8 0x5387c 0x5207c 0xa1
msi.dll (19)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
(by ordinal) 0x58 0x43b43c 0x53c00 0x52400 -
(by ordinal) 0x11 0x43b440 0x53c04 0x52404 -
(by ordinal) 0x7d 0x43b444 0x53c08 0x52408 -
(by ordinal) 0x74 0x43b448 0x53c0c 0x5240c -
(by ordinal) 0x73 0x43b44c 0x53c10 0x52410 -
(by ordinal) 0x76 0x43b450 0x53c14 0x52414 -
(by ordinal) 0x8 0x43b454 0x53c18 0x52418 -
(by ordinal) 0xab 0x43b458 0x53c1c 0x5241c -
(by ordinal) 0xcd 0x43b45c 0x53c20 0x52420 -
(by ordinal) 0x2d 0x43b460 0x53c24 0x52424 -
(by ordinal) 0x89 0x43b464 0x53c28 0x52428 -
(by ordinal) 0x8d 0x43b468 0x53c2c 0x5242c -
(by ordinal) 0xee 0x43b46c 0x53c30 0x52430 -
(by ordinal) 0xbe 0x43b470 0x53c34 0x52434 -
(by ordinal) 0xa9 0x43b474 0x53c38 0x52438 -
(by ordinal) 0x5a 0x43b478 0x53c3c 0x5243c -
(by ordinal) 0xad 0x43b47c 0x53c40 0x52440 -
(by ordinal) 0x6f 0x43b480 0x53c44 0x52444 -
(by ordinal) 0x46 0x43b484 0x53c48 0x52448 -
RPCRT4.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
UuidCreate 0x0 0x43b330 0x53af4 0x522f4 0x1fb
WININET.dll (11)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InternetCloseHandle 0x0 0x43b3c0 0x53b84 0x52384 0x6b
HttpAddRequestHeadersW 0x0 0x43b3c4 0x53b88 0x52388 0x53
HttpOpenRequestW 0x0 0x43b3c8 0x53b8c 0x5238c 0x58
InternetErrorDlg 0x0 0x43b3cc 0x53b90 0x52390 0x7c
InternetReadFile 0x0 0x43b3d0 0x53b94 0x52394 0x9f
HttpSendRequestW 0x0 0x43b3d4 0x53b98 0x52398 0x5e
InternetSetOptionW 0x0 0x43b3d8 0x53b9c 0x5239c 0xaf
InternetOpenW 0x0 0x43b3dc 0x53ba0 0x523a0 0x9a
HttpQueryInfoW 0x0 0x43b3e0 0x53ba4 0x523a4 0x5a
InternetCrackUrlW 0x0 0x43b3e4 0x53ba8 0x523a8 0x74
InternetConnectW 0x0 0x43b3e8 0x53bac 0x523ac 0x72
WINTRUST.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
WinVerifyTrust 0x0 0x43b3f0 0x53bb4 0x523b4 0x73
WTHelperGetProvSignerFromChain 0x0 0x43b3f4 0x53bb8 0x523b8 0x59
WTHelperProvDataFromStateData 0x0 0x43b3f8 0x53bbc 0x523bc 0x5c
CryptCATAdminCalcHashFromFileHandle 0x0 0x43b3fc 0x53bc0 0x523c0 0x4
VERSION.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetFileVersionInfoW 0x0 0x43b3b0 0x53b74 0x52374 0x6
GetFileVersionInfoSizeW 0x0 0x43b3b4 0x53b78 0x52378 0x5
VerQueryValueW 0x0 0x43b3b8 0x53b7c 0x5237c 0xe
Icons (1)
»
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2015-06-04 17:42:45+00:00
Valid Until 2016-09-04 17:42:45+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 0A 2C 79 AE D7 79 7B A6 AC 00 01 00 00 01 0A
Thumbprint 3B DA 32 3E 55 2D B1 FD E5 F4 FB EE 75 D6 D5 B2 B1 87 EE DC
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
\\?\C:\Program Files\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 714bb3d122630ec71acc738a86d74380 Copy to Clipboard
SHA1 19a734cf246bd55d69e751d53a10ee37aef8ae44 Copy to Clipboard
SHA256 73117d53d9f35cc253287e431072c8dd29d57bce280e96a1f00b6ce7d43b9d13 Copy to Clipboard
SSDeep 48:AB2ogGQEPvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:ABdgbQvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files (x86)\Microsoft.NET\flavor.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 db5e56cd7dd4cfde724ecc05e9412cc7 Copy to Clipboard
SHA1 1f7706aa329cb1fbc74978158dba05135e5c316b Copy to Clipboard
SHA256 0e915f123483bba3b830595ada3943c0c36d5a185217e437f3d2e8063ba2ddc2 Copy to Clipboard
SSDeep 1536:lL8S4U8MrjfK5u147fnl+jhq5jeHYE3ZkR4tracGadGqYCob2sl:lLb4yvsu6l+jhq5jIYECmdGCobF Copy to Clipboard
\\?\C:\ProgramData\Microsoft\MF\Active.GRL id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 16.12 KB
MD5 a68402e0cd060faafd52e63d046f1dcd Copy to Clipboard
SHA1 d3a9d66a7a437e30df2f2373faaedb4c0ff7349e Copy to Clipboard
SHA256 07ef60520021a9c1a63c5b6910510a4caa1a4aaeaf095915d1aa2454d6edb4c2 Copy to Clipboard
SSDeep 384:xy9PcieVbEL0qUXPgxGyVvRdmVsLxBOVrx:AJZ6E4qUfkGyVZd1xBsl Copy to Clipboard
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 17.74 KB
MD5 50517f8f868a7d861282891fa548f1ba Copy to Clipboard
SHA1 bcaf934812b1355550d4d3ea68ff6a7f94cacc68 Copy to Clipboard
SHA256 d28aa8d51058e72cda92857a1cb5140588aad08cf122d48a36f0b9f9e0a8f318 Copy to Clipboard
SSDeep 384:F22C+197fM2Oe0gN+gWmJmXg1relj1o3pM4EuehuWBOVrx:F22t3NNd9JvreljW32tuOBsl Copy to Clipboard
\\?\C:\Program Files (x86)\Internet Explorer\reveal_medicare_ebay.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 c75586cc162e0c2220f421195f8ec9fc Copy to Clipboard
SHA1 814373df66044d6de122cb68e725e5694559a319 Copy to Clipboard
SHA256 06148b452f85867dc8e715986e239e2e0e7c8a1052f9ec93bff7b16c52323eb1 Copy to Clipboard
SSDeep 1536:RRp2k5C9OK9VxlYFpKG4YOCz6R8vamR0mgLMZ5kl+VK/ABvmNo2vsl:RD2hLViXR4s6rDpoZ5iUmNor Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.65 KB
MD5 f78238be699f9c2b2191eb8bfe732e3e Copy to Clipboard
SHA1 a3100b7ceea43d857dfa52136da437446128db66 Copy to Clipboard
SHA256 8dfcf2f8a07249c06bb12f257c18188f5757b184109258448ce7e4bf1388ec84 Copy to Clipboard
SSDeep 48:HeR/OZL9ydhvO0/yk8b7OkKG9RcW5vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:+ApQdhvB/yPqnGAW5vkVYj1Xm6IVJVvx Copy to Clipboard
\\?\C:\ProgramData\Oracle\Java\javapath_target_5923062\java.exe id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
...
»
Mime Type application/x-dosexec
File Size 202.06 KB
MD5 016b9e588bb39d61e87b91fab3680c31 Copy to Clipboard
SHA1 2c2946abf7dc295b69fea131e652c5692e26a34a Copy to Clipboard
SHA256 7627a01a0ca6eb88611dce8dea0710eca4b4a0d2060d70f8f894059a5dc2f96b Copy to Clipboard
SSDeep 3072:xAivwgV/wTmkrTHjzvBQdT7qKBnusl/Kbi6oyQSHwTBfY62ZX6ZLzjZqMNxwQbl:sgSTmUHvOdT7duCKbi6ozOwTBjR5vGkl Copy to Clipboard
ImpHash bb9f83f2ccf071025cfcf6c07dc24b5c Copy to Clipboard
Parser Error Remark Static analyzer was unable to completely parse the analyzed file
PE Information
»
Image Base 0x140000000
Entry Point 0x14000a8c0
Size Of Code 0x1ca00
Size Of Initialized Data 0x14200
File Type executable
Subsystem windows_cui
Machine Type amd64
Compile Timestamp 2017-03-15 08:32:02+00:00
Version Information (9)
»
LegalCopyright Copyright © 2017
InternalName java
FileVersion 8.0.1310.11
CompanyName Oracle Corporation
Full Version 1.8.0_131-b11
ProductName Java(TM) Platform SE 8
ProductVersion 8.0.1310.11
FileDescription Java(TM) Platform SE binary
OriginalFilename java.exe
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x140001000 0x1c841 0x1ca00 0x400 cnt_code, mem_execute, mem_read 6.49
.rdata 0x14001e000 0x88fe 0x8a00 0x1ce00 cnt_initialized_data, mem_read 6.2
.data 0x140027000 0x3ff8 0x1c00 0x25800 cnt_initialized_data, mem_read, mem_write 2.89
.pdata 0x14002b000 0x1248 0x1400 0x27400 cnt_initialized_data, mem_read 4.92
.rsrc 0x14002d000 0x81b8 0x8200 0x28800 cnt_initialized_data, mem_read 6.02
.reloc 0x140036000 0x4d0 0x600 0x30a00 cnt_initialized_data, mem_discardable, mem_read 2.57
Imports (4)
»
ADVAPI32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegCloseKey 0x0 0x14001e000 0x25e00 0x24c00 0x230
RegOpenKeyExA 0x0 0x14001e008 0x25e08 0x24c08 0x260
RegEnumKeyA 0x0 0x14001e010 0x25e10 0x24c10 0x24d
RegQueryValueExA 0x0 0x14001e018 0x25e18 0x24c18 0x26d
USER32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CharNextExA 0x0 0x14001e340 0x26140 0x24f40 0x30
MessageBoxA 0x0 0x14001e348 0x26148 0x24f48 0x212
COMCTL32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InitCommonControlsEx 0x0 0x14001e028 0x25e28 0x24c28 0x7c
KERNEL32.dll (96)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CreateFileW 0x0 0x14001e038 0x25e38 0x24c38 0x8f
GetCommandLineA 0x0 0x14001e040 0x25e40 0x24c40 0x18c
GetModuleFileNameA 0x0 0x14001e048 0x25e48 0x24c48 0x219
QueryPerformanceCounter 0x0 0x14001e050 0x25e50 0x24c50 0x3a9
QueryPerformanceFrequency 0x0 0x14001e058 0x25e58 0x24c58 0x3aa
LocalFree 0x0 0x14001e060 0x25e60 0x24c60 0x34a
FormatMessageA 0x0 0x14001e068 0x25e68 0x24c68 0x163
GetLastError 0x0 0x14001e070 0x25e70 0x24c70 0x208
CloseHandle 0x0 0x14001e078 0x25e78 0x24c78 0x52
GetExitCodeProcess 0x0 0x14001e080 0x25e80 0x24c80 0x1e6
WaitForSingleObject 0x0 0x14001e088 0x25e88 0x24c88 0x508
CreateProcessA 0x0 0x14001e090 0x25e90 0x24c90 0xa4
GetProcAddress 0x0 0x14001e098 0x25e98 0x24c98 0x24c
GetModuleHandleA 0x0 0x14001e0a0 0x25ea0 0x24ca0 0x21b
LoadLibraryA 0x0 0x14001e0a8 0x25ea8 0x24ca8 0x33e
GetExitCodeThread 0x0 0x14001e0b0 0x25eb0 0x24cb0 0x1e7
FindFirstFileA 0x0 0x14001e0b8 0x25eb8 0x24cb8 0x138
FindNextFileA 0x0 0x14001e0c0 0x25ec0 0x24cc0 0x149
FindClose 0x0 0x14001e0c8 0x25ec8 0x24cc8 0x134
GetModuleHandleW 0x0 0x14001e0d0 0x25ed0 0x24cd0 0x21e
ExitProcess 0x0 0x14001e0d8 0x25ed8 0x24cd8 0x11f
DecodePointer 0x0 0x14001e0e0 0x25ee0 0x24ce0 0xcb
HeapFree 0x0 0x14001e0e8 0x25ee8 0x24ce8 0x2d7
MultiByteToWideChar 0x0 0x14001e0f0 0x25ef0 0x24cf0 0x369
GetCurrentProcessId 0x0 0x14001e0f8 0x25ef8 0x24cf8 0x1c7
EnterCriticalSection 0x0 0x14001e100 0x25f00 0x24d00 0xf2
LeaveCriticalSection 0x0 0x14001e108 0x25f08 0x24d08 0x33b
HeapAlloc 0x0 0x14001e110 0x25f10 0x24d10 0x2d3
HeapReAlloc 0x0 0x14001e118 0x25f18 0x24d18 0x2da
FileTimeToSystemTime 0x0 0x14001e120 0x25f20 0x24d20 0x12b
FileTimeToLocalFileTime 0x0 0x14001e128 0x25f28 0x24d28 0x12a
GetDriveTypeA 0x0 0x14001e130 0x25f30 0x24d30 0x1d9
FindFirstFileExA 0x0 0x14001e138 0x25f38 0x24d38 0x139
GetFileAttributesA 0x0 0x14001e140 0x25f40 0x24d40 0x1ec
ExitThread 0x0 0x14001e148 0x25f48 0x24d48 0x120
GetCurrentThreadId 0x0 0x14001e150 0x25f50 0x24d50 0x1cb
CreateThread 0x0 0x14001e158 0x25f58 0x24d58 0xb4
SetFilePointer 0x0 0x14001e160 0x25f60 0x24d60 0x474
InitializeCriticalSectionAndSpinCount 0x0 0x14001e168 0x25f68 0x24d68 0x2eb
DeleteCriticalSection 0x0 0x14001e170 0x25f70 0x24d70 0xd2
EncodePointer 0x0 0x14001e178 0x25f78 0x24d78 0xee
LoadLibraryW 0x0 0x14001e180 0x25f80 0x24d80 0x341
UnhandledExceptionFilter 0x0 0x14001e188 0x25f88 0x24d88 0x4e2
SetUnhandledExceptionFilter 0x0 0x14001e190 0x25f90 0x24d90 0x4b3
IsDebuggerPresent 0x0 0x14001e198 0x25f98 0x24d98 0x302
RtlVirtualUnwind 0x0 0x14001e1a0 0x25fa0 0x24da0 0x426
RtlLookupFunctionEntry 0x0 0x14001e1a8 0x25fa8 0x24da8 0x41f
RtlCaptureContext 0x0 0x14001e1b0 0x25fb0 0x24db0 0x418
TerminateProcess 0x0 0x14001e1b8 0x25fb8 0x24db8 0x4ce
GetCurrentProcess 0x0 0x14001e1c0 0x25fc0 0x24dc0 0x1c6
FlsGetValue 0x0 0x14001e1c8 0x25fc8 0x24dc8 0x15a
FlsSetValue 0x0 0x14001e1d0 0x25fd0 0x24dd0 0x15b
FlsFree 0x0 0x14001e1d8 0x25fd8 0x24dd8 0x159
SetLastError 0x0 0x14001e1e0 0x25fe0 0x24de0 0x480
FlsAlloc 0x0 0x14001e1e8 0x25fe8 0x24de8 0x158
RtlUnwindEx 0x0 0x14001e1f0 0x25ff0 0x24df0 0x425
WriteFile 0x0 0x14001e1f8 0x25ff8 0x24df8 0x534
GetStdHandle 0x0 0x14001e200 0x26000 0x24e00 0x26b
GetModuleFileNameW 0x0 0x14001e208 0x26008 0x24e08 0x21a
WideCharToMultiByte 0x0 0x14001e210 0x26010 0x24e10 0x520
FreeEnvironmentStringsW 0x0 0x14001e218 0x26018 0x24e18 0x167
GetEnvironmentStringsW 0x0 0x14001e220 0x26020 0x24e20 0x1e1
SetHandleCount 0x0 0x14001e228 0x26028 0x24e28 0x47c
GetFileType 0x0 0x14001e230 0x26030 0x24e30 0x1fa
GetStartupInfoW 0x0 0x14001e238 0x26038 0x24e38 0x26a
HeapSetInformation 0x0 0x14001e240 0x26040 0x24e40 0x2db
GetVersion 0x0 0x14001e248 0x26048 0x24e48 0x2aa
HeapCreate 0x0 0x14001e250 0x26050 0x24e50 0x2d5
GetTickCount 0x0 0x14001e258 0x26058 0x24e58 0x29a
GetSystemTimeAsFileTime 0x0 0x14001e260 0x26060 0x24e60 0x280
SetEnvironmentVariableW 0x0 0x14001e268 0x26068 0x24e68 0x465
SetEnvironmentVariableA 0x0 0x14001e270 0x26070 0x24e70 0x464
Sleep 0x0 0x14001e278 0x26078 0x24e78 0x4c0
SetStdHandle 0x0 0x14001e280 0x26080 0x24e80 0x494
GetConsoleCP 0x0 0x14001e288 0x26088 0x24e88 0x1a0
GetConsoleMode 0x0 0x14001e290 0x26090 0x24e90 0x1b2
GetFullPathNameA 0x0 0x14001e298 0x26098 0x24e98 0x1ff
GetFileInformationByHandle 0x0 0x14001e2a0 0x260a0 0x24ea0 0x1f3
PeekNamedPipe 0x0 0x14001e2a8 0x260a8 0x24ea8 0x38f
CreateFileA 0x0 0x14001e2b0 0x260b0 0x24eb0 0x88
GetCurrentDirectoryW 0x0 0x14001e2b8 0x260b8 0x24eb8 0x1c5
FlushFileBuffers 0x0 0x14001e2c0 0x260c0 0x24ec0 0x15d
GetCPInfo 0x0 0x14001e2c8 0x260c8 0x24ec8 0x178
GetACP 0x0 0x14001e2d0 0x260d0 0x24ed0 0x16e
GetOEMCP 0x0 0x14001e2d8 0x260d8 0x24ed8 0x23e
IsValidCodePage 0x0 0x14001e2e0 0x260e0 0x24ee0 0x30c
HeapSize 0x0 0x14001e2e8 0x260e8 0x24ee8 0x2dc
CompareStringW 0x0 0x14001e2f0 0x260f0 0x24ef0 0x64
ReadFile 0x0 0x14001e2f8 0x260f8 0x24ef8 0x3c3
WriteConsoleW 0x0 0x14001e300 0x26100 0x24f00 0x533
GetDriveTypeW 0x0 0x14001e308 0x26108 0x24f08 0x1da
SetEndOfFile 0x0 0x14001e310 0x26110 0x24f10 0x461
GetProcessHeap 0x0 0x14001e318 0x26118 0x24f18 0x251
GetTimeZoneInformation 0x0 0x14001e320 0x26120 0x24f20 0x29f
LCMapStringW 0x0 0x14001e328 0x26128 0x24f28 0x32f
GetStringTypeW 0x0 0x14001e330 0x26130 0x24f30 0x270
Digital Signatures (2)
»
Certificate: Oracle America, Inc.
»
Issued by Oracle America, Inc.
Parent Certificate Symantec Class 3 SHA256 Code Signing CA
Country Name US
Valid From 2015-04-14 00:00:00+00:00
Valid Until 2018-04-13 23:59:59+00:00
Algorithm sha256_rsa
Serial Number 12 F0 27 7E 0F 23 3B 39 F9 41 9B 06 E8 CD E3 52
Thumbprint 3B 75 81 6D 15 A6 D8 F4 59 8E 9C F5 60 3F 18 39 EE 84 D7 3D
Certificate: Symantec Class 3 SHA256 Code Signing CA
»
Issued by Symantec Class 3 SHA256 Code Signing CA
Country Name US
Valid From 2013-12-10 00:00:00+00:00
Valid Until 2023-12-09 23:59:59+00:00
Algorithm sha256_rsa
Serial Number 3D 78 D7 F9 76 49 60 B2 61 7D F4 F0 1E CA 86 2A
Thumbprint 00 77 90 F6 56 1D AD 89 B0 BC D8 55 85 76 24 95 E3 58 F8 A5
\\?\C:\Program Files (x86)\Windows Portable Devices\slightly.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 4202a7adcdc46a7695819ddd9070eabb Copy to Clipboard
SHA1 008f3c8c52ef38d2d0d2c834ea610b1ede7aabbc Copy to Clipboard
SHA256 b1b2514ae59058e9d60d8eefc0c3ee184859bbb03125f85f21ab3c93d904ec0f Copy to Clipboard
SSDeep 1536:5kggjrHKsc8VPyWIw5lwMr5TEMq/qV1OZCbTwxVgGlkYNOovToTsl:5k5i8VPOOl3OM4cgVzl/k8 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\o61wIO ULs99.m4a id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 81.63 KB
MD5 a04bb15e2dda5dbc3fe93f845d08cee8 Copy to Clipboard
SHA1 10c3c56e93fd5cbb1376fd6cfc384901c3a9cd8b Copy to Clipboard
SHA256 57bd6c610ed1abe3faa3f0e120012bdabf8dc5d4f2450b9a0fd6ac029923ab22 Copy to Clipboard
SSDeep 1536:a41H/pO0WHs1ehPkE0tXW07dLfgmomtvD6eiq6An9FVITHtZGqtuntpsl:HHhms18km4L0QGm6AVuNZZtR Copy to Clipboard
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf id-Br3n0G72wUb8CejT.LyaS Created File PDF
Not Queried
...
»
Mime Type application/pdf
File Size 182.46 KB
MD5 b515f7b33b9f8cb1cf59dc54253cd98a Copy to Clipboard
SHA1 a7432329843328f53185d79ed9b1fb73991a4e65 Copy to Clipboard
SHA256 fcd81262f272add4c9a4aa82031140b8b7658cc5dd3b96209ed3a655a145e831 Copy to Clipboard
SSDeep 3072:bssls1MS60xwZODn/TJTHuX2T/5/dGc4uka2AtSyNLMDTJ5MtvVmbvR:wsls1b60zbJTuXa5McZd2At7mJ5MuzR Copy to Clipboard
PDF Information
»
Title Microsoft Word - WinTH2_Ownership.docx
Subject -
Author mohd
Creator PScript5.dll Version 5.2.2
Keywords -
Producer Acrobat Distiller 15.0 (Windows)
Page Count 1
Encrypted False
Create Time 2015-12-03 15:01:19+00:00
Modify Time 2015-12-03 15:01:19+00:00
\\?\C:\Users\Public\Downloads\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 3fc791e3387c67fb1b13f21f25a7d9db Copy to Clipboard
SHA1 3afa0900eea9aa4ea765bbac8b08ad12e67000d1 Copy to Clipboard
SHA256 5df9afdb30470f0e2c29a92c5054f5c8281a7cdb545f91638c668f27e33a81e4 Copy to Clipboard
SSDeep 48:P3THS9evT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:TvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.55 KB
MD5 d4aa148bf7d65924353d68c72f6006bd Copy to Clipboard
SHA1 2192273080ecefb062f6e9cdc8fb154f1abc7161 Copy to Clipboard
SHA256 c32338ad8d0582b0a7e6270c656e9fd3629b6e55a5339962df6dff0264de3365 Copy to Clipboard
SSDeep 48:JGJmcyIwxVPkGzhV0oz7U5A0szdpfMlL5k2vT4VFCvIA1XmDmIVJVvqc3YanmQ4a:JGJmcWVPk4hfzD0szMo2vkVYj1Xm6IVl Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\THIRDPARTYLICENSEREADME.txt id-Br3n0G72wUb8CejT.LyaS Created File Text
Not Queried
...
»
Mime Type text/plain
File Size 172.94 KB
MD5 745d6db5fc58c63f74ce6a7d4db7e695 Copy to Clipboard
SHA1 a816fb5dd09e32d80e1ecf47a458569e3868b975 Copy to Clipboard
SHA256 c77ba9f668fee7e9b810f1493e518adf87233ac8793e4b37c9b3d1ed7846f1c0 Copy to Clipboard
SSDeep 3072:Yj33DuJYSqN7amC35q6dNFiG8OH8eowpQcw+4oHHZZvc9HNhJhxe+p/U0UIdKJpi:3qN2p5Jmncw+4o0HMWEyHrNRj Copy to Clipboard
\\?\C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 4.13 MB
MD5 1ff608ac4430fc041fc1a657f76152df Copy to Clipboard
SHA1 033085879024b4c342b5f1fd1ca3c75f03ecfbba Copy to Clipboard
SHA256 d336fac1110e8b1f00139c02f0b0fba56ed4ee28b57b0b66f2d0f0042569d636 Copy to Clipboard
SSDeep 49152:vMWGj7u4FwHIWjUHFG5X/qKm/v8y8iHcie8BOQZb2jZ4sM7biZyXr3nF1Y852/av:v27u42oiUHFG5jm/dHnk7KrX7PevpW Copy to Clipboard
\\?\C:\Users\Public\AccountPictures\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.69 KB
MD5 873888c0bb841bb9da0b4114c9d56c2e Copy to Clipboard
SHA1 8db84d99987df76804135598db0ee95e802fb45d Copy to Clipboard
SHA256 850758e9fe84f30a07708c5ec31a4464d06c39376f922f3e5766102f1b82aed4 Copy to Clipboard
SSDeep 48:7B7J+waWWvcYvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:Fz5HYvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\All Users\Microsoft\ClickToRun\DeploymentConfig.2.xml id-Br3n0G72wUb8CejT.LyaS Created File XML
Not Queried
...
»
Mime Type application/xml
File Size 1.35 KB
MD5 3793544370ec1fddcf5ba6ae099f2538 Copy to Clipboard
SHA1 c784c5d8d1c496ab7ba1150782d20cba67b76321 Copy to Clipboard
SHA256 87975551187040cc2505a12ac285c042b8e70921a55808ecf982c7cd37df0ae2 Copy to Clipboard
SSDeep 24:QlLPFdNyWwbEUgMClMJJyBz5n6PEAJrBPE2gQGkWyGkWzRp1BTXSoNwOP:y/NFOWC+68A1B82PGKG7Rp1BTiPs Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.13 KB
MD5 7c905e57fe11109db0fdb2f7c99fe353 Copy to Clipboard
SHA1 85b1bf8beb4a3fa5fa4a8d214a26e4c9077df8e5 Copy to Clipboard
SHA256 75478e7bb134a63d6fec67a2d4e4d08bd1f4b80c359d2da5346c019c4f441360 Copy to Clipboard
SSDeep 48:AK1mgAh983sAfGGr1aPE40vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:AWm788Azr1n5vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Microsoft\IdentityCRL\INT\ppcrlconfig600.dll id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 25.21 KB
MD5 166cd787b9c532bc2ff7ff1ad8d52649 Copy to Clipboard
SHA1 a5934a7b1748afe09cdd1ecc4097147eeae1f326 Copy to Clipboard
SHA256 ebd64f105d41cfd3fbfbd4868d1ad7a216631ba639df614594e1d60b2436034a Copy to Clipboard
SSDeep 384:g54Pr7ZRaXhakl+zJkEpaMl3oWkfAkJKNc8Xv/PFi1BgVwmtIGeAUUvsQkBOVrx:/r7X2To1wWsVcNc8nP9pUU1kBsl Copy to Clipboard
\\?\C:\Users\All Users\Microsoft\ClickToRun\DeploymentConfig.1.xml id-Br3n0G72wUb8CejT.LyaS Created File Text
Not Queried
...
»
Mime Type text/plain
File Size 3.43 KB
MD5 7d7beff8a0456ae40afd0933de566585 Copy to Clipboard
SHA1 424b7248c2b02fe2027c6e7451b877cbe2656ce4 Copy to Clipboard
SHA256 fb7c6c34d9efa679b348609803988da95175a0bcb7b8b5e95b1974e0505be667 Copy to Clipboard
SSDeep 48:y/NFOWC+6fHAPUqfCsJU8/9EPGKGkUqfCRp1BTiw49BTkg:UcW76/Ea0dlZE Copy to Clipboard
\\?\C:\Users\Public\Libraries\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 0.42 KB
MD5 e8d021840490d2589ecf53f8636717c5 Copy to Clipboard
SHA1 70dad2c6629d9e08805d834700340f8771df030c Copy to Clipboard
SHA256 60a0126a1bc0406f5ddcc9225e79e9793f707d4f8c24f0049f1c7bd7fdcd6c73 Copy to Clipboard
SSDeep 12:tRwmCtmdtUTfEmr1mnKVp02zUx5XPmXmj046Pd1q:tVCtOtUTMq1mKPNA7X+o0462 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\K5afBvaXQ17XKw.wav id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 86.03 KB
MD5 f4fda3f9a993f4e205565e5ff2353c97 Copy to Clipboard
SHA1 ea78d24db8bb76ef8a12b9d79cced4500811d68b Copy to Clipboard
SHA256 d17384ca13f73ed958515a1ae5d7c0c12ff84c484ed838c644c1331760e1811a Copy to Clipboard
SSDeep 1536:ZGkTULeKFMGDrgiGhLc6P8BZMoNkDQ7LCW7pumcxOkJOAjL5gsl:okTEeBGiLB1M7L3l+OkMAjLV Copy to Clipboard
\\?\C:\Users\Public\Desktop\Acrobat Reader DC.lnk id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 3.58 KB
MD5 7431de4911be108d8d6877adf57ab40e Copy to Clipboard
SHA1 02cd08b6b095795832f8e973ba974cf88894cd37 Copy to Clipboard
SHA256 b60e1bd69b03e1c9040178e1eba24cce5ffa46b76fd845fcb31df7f6962d8246 Copy to Clipboard
SSDeep 96:sN8k9+pd8YsnoQDr4vkVYj1Xm6IVJVvlpYx0:sNeFsopvkejdm7VJVvx Copy to Clipboard
\\?\C:\How To Restore Files.hta Created File Text
Not Queried
...
»
Also Known As \\?\C:\Boot\How To Restore Files.hta (Created File)
\\?\C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\How To Restore Files.hta (Created File)
\\?\C:\$Recycle.Bin\S-1-5-18\How To Restore Files.hta (Created File)
\\?\C:\Boot\el-GR\How To Restore Files.hta (Created File)
\\?\C:\Boot\da-DK\How To Restore Files.hta (Created File)
\\?\C:\Boot\en-US\How To Restore Files.hta (Created File)
\\?\C:\Boot\en-GB\How To Restore Files.hta (Created File)
\\?\C:\Boot\bg-BG\How To Restore Files.hta (Created File)
\\?\C:\Boot\de-DE\How To Restore Files.hta (Created File)
\\?\C:\Boot\cs-CZ\How To Restore Files.hta (Created File)
\\?\C:\Boot\es-MX\How To Restore Files.hta (Created File)
\\?\C:\Boot\et-EE\How To Restore Files.hta (Created File)
\\?\C:\Boot\es-ES\How To Restore Files.hta (Created File)
\\?\C:\Boot\ko-KR\How To Restore Files.hta (Created File)
\\?\C:\Boot\hr-HR\How To Restore Files.hta (Created File)
\\?\C:\Boot\lv-LV\How To Restore Files.hta (Created File)
\\?\C:\Boot\fr-CA\How To Restore Files.hta (Created File)
\\?\C:\Boot\lt-LT\How To Restore Files.hta (Created File)
\\?\C:\Boot\ja-JP\How To Restore Files.hta (Created File)
\\?\C:\Boot\it-IT\How To Restore Files.hta (Created File)
\\?\C:\Boot\hu-HU\How To Restore Files.hta (Created File)
\\?\C:\Boot\fr-FR\How To Restore Files.hta (Created File)
\\?\C:\Boot\fi-FI\How To Restore Files.hta (Created File)
\\?\C:\Program Files\How To Restore Files.hta (Created File)
\\?\C:\Boot\sl-SI\How To Restore Files.hta (Created File)
\\?\C:\Boot\uk-UA\How To Restore Files.hta (Created File)
\\?\C:\Boot\tr-TR\How To Restore Files.hta (Created File)
\\?\C:\Boot\sr-Latn-RS\How To Restore Files.hta (Created File)
\\?\C:\Boot\ro-RO\How To Restore Files.hta (Created File)
\\?\C:\Boot\Resources\How To Restore Files.hta (Created File)
\\?\C:\Boot\nb-NO\How To Restore Files.hta (Created File)
\\?\C:\Boot\sk-SK\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\How To Restore Files.hta (Created File)
\\?\C:\Users\How To Restore Files.hta (Created File)
\\?\C:\Boot\zh-CN\How To Restore Files.hta (Created File)
\\?\C:\Boot\sv-SE\How To Restore Files.hta (Created File)
\\?\C:\Boot\sr-Latn-CS\How To Restore Files.hta (Created File)
\\?\C:\Boot\ru-RU\How To Restore Files.hta (Created File)
\\?\C:\Boot\qps-ploc\How To Restore Files.hta (Created File)
\\?\C:\Boot\pt-PT\How To Restore Files.hta (Created File)
\\?\C:\Boot\pt-BR\How To Restore Files.hta (Created File)
\\?\C:\Boot\pl-PL\How To Restore Files.hta (Created File)
\\?\C:\Boot\nl-NL\How To Restore Files.hta (Created File)
\\?\C:\Boot\zh-HK\How To Restore Files.hta (Created File)
\\?\C:\Boot\Fonts\How To Restore Files.hta (Created File)
\\?\C:\Boot\zh-TW\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\How To Restore Files.hta (Created File)
\\?\C:\Recovery\WindowsRE\How To Restore Files.hta (Created File)
\\?\C:\Boot\Resources\en-US\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Internet Explorer\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Microsoft Office\How To Restore Files.hta (Created File)
\\?\C:\Users\Default\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Microsoft Office 15\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Reference Assemblies\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Uninstall Information\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\regid.1991-06.com.microsoft\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Journal\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows NT\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Mail\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Photo Viewer\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Portable Devices\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Multimedia Platform\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Media Player\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\DESIGNER\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\Services\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\System\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\ClickToRun\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Services\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\MF\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Diagnosis\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Internet Explorer\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Microsoft.NET\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Media Player\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Multimedia Platform\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Photo Viewer\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Mail\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Provisioning\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Portable Devices\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Music\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\OneDrive\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Documents\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Downloads\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Searches\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Videos\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Internet Explorer\en-US\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Saved Games\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\USOShared\Logs\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Photo Viewer\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Media Player\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Defender\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Microsoft Office 15\ClientX64\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft OneDrive\setup\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows NT\Accessories\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Links\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Java\jre1.8.0_131\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Desktop\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Documents\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Downloads\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Pictures\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Music\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Oracle\Java\installcache_x64\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Office\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\IdentityCRL\INT\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Desktop\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Internet Explorer\images\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Internet Explorer\SIGNUP\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows NT\TableTextService\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Journal\Templates\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Java\Java Update\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Videos\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Journal\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Mail\en-US\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Oracle\Java\.oracle_jre_usage\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Windows Live\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\AccountPictures\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Favorites\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Crypto\SystemKeys\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\IdentityCRL\production\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Libraries\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\User Account Pictures\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\System\ado\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\VC\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\VGX\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\MSInfo\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\ink\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\VC\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Mozilla Firefox\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\Source Engine\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\USOPrivate\UpdateStore\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\VSTO\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Media Player\Media Renderer\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Oracle\Java\javapath_target_5923062\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\Stationery\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Microsoft Office\root\Flattener\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\Ole DB\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\msadc\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\ado\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\How To Restore Files.hta (Created File)
Mime Type text/plain
File Size 0.89 KB
MD5 5222fe422c92bb4cef7de62af663e889 Copy to Clipboard
SHA1 7bbb12ee8df0709593379bc2edcdb95f019403bd Copy to Clipboard
SHA256 3e77c151f1a9604b68e7e18d3c226d36f0d7884c138131d64f9e13a9b9d4db2c Copy to Clipboard
SSDeep 24:k/bxHNZAlf1sR1iYsFT5RMfvIKNxHHNaHzSRJrkjF:gxtZAlfIeCfnNaHhjF Copy to Clipboard
C:\windows\searchfiles.exe Created File Unknown
Not Queried
...
»
Mime Type application/x-empty
File Size 0.00 KB
MD5 d41d8cd98f00b204e9800998ecf8427e Copy to Clipboard
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 Copy to Clipboard
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.007.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 fac67d94ce19b41b17eca401e9f50826 Copy to Clipboard
SHA1 2c9680f0e1dd842ffbf5406e47c6299f58a53c26 Copy to Clipboard
SHA256 d53822c0daf6b403f35780979391e1049d004551a1eca5967acef0b7c61e5a4e Copy to Clipboard
SSDeep 384:iTRr0gElanOch/HNc9IgG6Z/ypi+yV2lZwBOBOVrx:uTnnOgNc95G64pUzOBsl Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 72c282b0e122f7453de9b9eb1d841169 Copy to Clipboard
SHA1 e8a85f5b41e3bdf1b43b4804efee0d89c2f0dcb1 Copy to Clipboard
SHA256 b7b98e0c12acab43b042ffbeca1c7c0e538a6275e43b3fe200a712e8b37679f1 Copy to Clipboard
SSDeep 48:yZbclxjXBNo6RX2BRHh8meNvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:yZolhBbcBJumeNvkVYj1Xm6IVJVvlpYC Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 5f6037f8c98914d4f3d7d9d55bcd8b6d Copy to Clipboard
SHA1 37481233ef3ea231ddd1ce950f36048012ee1099 Copy to Clipboard
SHA256 20ce655bb14cdca3043f5fc0a1369982399f11b779482be67d62f65064b8b64e Copy to Clipboard
SSDeep 48:q3+Dwl6/rojhvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:q5l6zQvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Microsoft\IdentityCRL\production\ppcrlconfig600.dll id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
...
»
Mime Type application/x-dosexec
File Size 24.22 KB
MD5 8a188c747e3f1a8bbabea5bfcbda09f6 Copy to Clipboard
SHA1 ca42ac003d793747e42ae579b47eca68587b6c9f Copy to Clipboard
SHA256 cca982136eb5f317389f1224c32af46051080e8a98b3261489ecd380ae14d2b3 Copy to Clipboard
SSDeep 384:fWLzrKWArfPnnTM+Z2oI8eZZzm5yKoV0pFq0GftpBj657:w0fQ9m5msHie7 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Size Of Initialized Data 0x4400
File Type dll
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2016-12-16 04:19:49+00:00
Version Information (9)
»
LegalCopyright Copyright © 1995-2006 Microsoft Corporation.
InternalName ppcrlconfig600
FileVersion 16.000.26889.00
CompanyName Microsoft Corporation
LegalTrademarks Microsoft® is a registered trademark of Microsoft Corporation.
ProductName Microsoft® Windows Live ID
ProductVersion 16.000.26889.00
FileDescription Passport CRL configuration
OriginalFilename ppcrlconfig600.dll
Sections (1)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.rsrc 0x10001000 0x4300 0x4400 0x200 cnt_initialized_data, mem_read 5.72
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2016-08-18 20:17:17+00:00
Valid Until 2017-11-02 20:17:17+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 40 96 A9 EE 70 56 FE CC 07 00 01 00 00 01 40
Thumbprint 98 ED 99 A6 78 86 D0 20 C5 64 92 3B 7D F2 5E 9A C0 19 DF 26
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.003.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 d5fcb6e8f9586fdf0db68f6f35d4fe29 Copy to Clipboard
SHA1 6ad413a2c6cf73a15e5c8da55d9f6d4c5707348c Copy to Clipboard
SHA256 61ef383a18d298b8fe45307241443e1891df7445fcb813d61b6e85b7c143ce41 Copy to Clipboard
SSDeep 384:sfHlD9PO2W4hgQdfUDv4EE48kg70UoDYN/woen2ZinIBOVrx:svl5POTygPukgzA21e2ZiIBsl Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 453.62 KB
MD5 1665b0b61856cdc24c6cdd0cfd20973f Copy to Clipboard
SHA1 a60c21f90c1da9470b15cf02cfe89c3b419404dc Copy to Clipboard
SHA256 5f807c3bc70e52a89f42c0852eedc061d486342eefb7ed00ec22786cf8a20ae4 Copy to Clipboard
SSDeep 12288:jJkJpnXYiB8N9UxUCAiKMTURoXE0JhsB+H4Ll:IpXYw8IeCAOGF0skH6 Copy to Clipboard
\\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.63 KB
MD5 f22f15cbe8908ffc0be51d7f60a03619 Copy to Clipboard
SHA1 bd99c472a27115b94f6ec78d213a37618dd2286b Copy to Clipboard
SHA256 62c305c53a1cebcf2d828fcc38f642fa98766ce35e5bd2b4991730a3cf3437b2 Copy to Clipboard
SSDeep 48:04kzQBzuvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:04ksBivkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\6VPPhG1IT3F2Zg-.bmp id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 81.79 KB
MD5 021b3299959519c499dc84c3de52b566 Copy to Clipboard
SHA1 ffcd6f8aa6162ef7cd911ef6a9ff6733b57d419a Copy to Clipboard
SHA256 489a8181434207137b65b6f994c0f6f8f4722b2c611b6e55eae6f1f91ef94a80 Copy to Clipboard
SSDeep 1536:9XufZDUCkC/RKRh6WPploF9CZTqpDiq/ROk9iVPKRNTykgL8n8gZNIW7sl:9XufpUCrJO0WPphNqpW0oO7gy8gZNC Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.65 KB
MD5 89eff2e9660b2903005b8709e499ba09 Copy to Clipboard
SHA1 ab6322c99fdc1f39f89c9ddfbf34d11bb651530d Copy to Clipboard
SHA256 aac0108d6a253d4fbf96d15b5fd772d77458065b472a5ff55eac3e601eef5e4c Copy to Clipboard
SSDeep 48:axT19fbWrfqas7SMU1Xv2Dj3tteBvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:aF1gK2MeX+Dj3tkvkVYj1Xm6IVJVvlpZ Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.13 KB
MD5 f5671ef2efadc7e7b109eb314d6c452e Copy to Clipboard
SHA1 002e48a1eb6c5cdc0c17d63e583c11a78b9a0899 Copy to Clipboard
SHA256 393e3d711351d6616018a14ec71ac163241b1597628b49ec32970cb6a9b12637 Copy to Clipboard
SSDeep 48:W3xpmaIzsh/8vUH0vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:apmaIzi/Z0vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\Public\Pictures\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.87 KB
MD5 9316169bb34fac952be4f0b4ecfcfcb9 Copy to Clipboard
SHA1 679e858f5f67c726365a75a8f023baf5ddb96a85 Copy to Clipboard
SHA256 5bc2fadbff7d306bdb5621e183ab6a00de73c23de1f2706f9df6ee72346ae7b2 Copy to Clipboard
SSDeep 48:MXiOIrjKoXx+8vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:MXiOwThBvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\bootmgr Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 386.00 KB
MD5 cdf075b70e5f612b4399a54b25d55192 Copy to Clipboard
SHA1 3b37308a601665b38dbc02f36359fdebd1abc006 Copy to Clipboard
SHA256 a0e54d6b2503139355488bc2fd3204a1ecbe228419e8a5ab234efe5be6fc0289 Copy to Clipboard
SSDeep 12288:3sp8fYyDEFLbv5zG/BUEG+38EdPgoBlma7D:cpGYyiz5zGZdGQtgoTmQD Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 b14d78df896a4fb0e12cc910f8551b3a Copy to Clipboard
SHA1 9e0297bdd1f7b42be7c3c68b3e192bb796609d81 Copy to Clipboard
SHA256 5cf3ce8147f8450f0e583dac45890cae60a1efa1337ea70c7e02256ff26ca800 Copy to Clipboard
SSDeep 48:S9ymvbhHr7arhB/HAg01vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:yhHr7MZuvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Oracle\Java\installcache_x64\baseimagefam8 id-Br3n0G72wUb8CejT.LyaS Created File Unknown
Not Queried
...
»
Mime Type application/zip
File Size 10.00 MB
MD5 0beaef313b020be26a8ac109163f0174 Copy to Clipboard
SHA1 1d24fb94c03f74ae694c1d32ea82df2d857bdb81 Copy to Clipboard
SHA256 83ea532b5ef5907005638e159fdc2a62b0f426dd216e77da6daaf16733574b84 Copy to Clipboard
SSDeep 98304:D/GhkxpdT24N3Szg1x+9W6dwbNj9IF/Dml8ekFXwuPcr:7GudTTzx+9Rq99IFLYoXwdr Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\THIRDPARTYLICENSEREADME-JAVAFX.txt id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 63.93 KB
MD5 a344623714a39a4af8107afbf70d6103 Copy to Clipboard
SHA1 1eb2aa8e571f8eefeafbc640f4401e927112c1e2 Copy to Clipboard
SHA256 8616d6f61bf92561180f9a6fca030507d0beba6ef7df02dff8642c7e16189281 Copy to Clipboard
SSDeep 1536:7yhG6CQO1jVkPow31tvZjyo7PzzEOkJmENWTgJhsl:7ybCQOnmp31txj/7/Zj Copy to Clipboard
\\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 25.17 KB
MD5 6430f9126dc2be7879577372f79995c3 Copy to Clipboard
SHA1 24e8d58c1fde077f51f5f85c8d3847d5d086544a Copy to Clipboard
SHA256 9d8dfb327bea5dbfe73c580deb21e1493a555328212ddae522154cad3528167e Copy to Clipboard
SSDeep 768:ifuaVdndhNDkeNrMCmRLqeMRtYJvGIySeKSc3dBsl:8NdnJkehlmRp20ZyK3Hsl Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\mqFOr.avi id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 73.46 KB
MD5 072e8b5ba7f8012b9c7e2a81c27d80f8 Copy to Clipboard
SHA1 2f8be4cadcff582c043910f5fa6db6cf3d8f0ac3 Copy to Clipboard
SHA256 fd3047e8325e7f4993dae9a1760d7d105e884e0283cd691b1dca78a5047c1e34 Copy to Clipboard
SSDeep 1536:F6Kz5H5BSYX8oZPtLtMC/sGxDMfhYi4PEDk6d9mjFwsl:wU5hModVGJYtvRj5 Copy to Clipboard
\\?\C:\Users\Public\Videos\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.87 KB
MD5 2bf85f4ec51dd85c34de89f1db1d2580 Copy to Clipboard
SHA1 372b1169576834e4d8edf058bc3aadccc236ac1a Copy to Clipboard
SHA256 87847ff29e4245fac1b12d7dca66e2e607e9869898f901b783d16ca126ced5af Copy to Clipboard
SSDeep 48:hpIELBkcFuKgBZvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:hpBdJuBZvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\COPYRIGHT id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 4.67 KB
MD5 58e253295ea254e4ebd9bfeb9eaa50b2 Copy to Clipboard
SHA1 c482c6697c3783dc95e3791a2764156dae5098e2 Copy to Clipboard
SHA256 61954e61ba87ff4ff4c5764db2823540bb7f5c69a592cd3943c15327b4327130 Copy to Clipboard
SSDeep 96:jUCKHk3NcHRj3fN1Vhf5K5HqhjC9xQcWvkVYj1Xm6IVJVvlpYx0:gREdqV3fvlK5HaalWvkejdm7VJVvx Copy to Clipboard
\\?\C:\Program Files (x86)\Windows Portable Devices\semiconductor phys.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 f68719464cb21cd6ce3f56b29edec1b0 Copy to Clipboard
SHA1 bd3cd6a48e62fc272879175e3f1de292beb41753 Copy to Clipboard
SHA256 24c0549fd23713a9f6abb895e1fdfc7302be2944d0f9d9694e74a162844db6ad Copy to Clipboard
SSDeep 1536:xImrgG8zi3jpaweTvgTIdFDS3cbUR7WV5yeGYdptVFoMwBVOwzUtsl:xqhiYweDP4MgWVcwA3Oi Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Links\Desktop.lnk id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.01 KB
MD5 57b512551467aab1a1edb0b7bc9e3c0d Copy to Clipboard
SHA1 9bd52027f8e1cf8caf722563b399bd4a2436aa23 Copy to Clipboard
SHA256 c1ef3b32203da05b5cbd5b5dbabd65ecd8af1409e80b35cce236a3930544e623 Copy to Clipboard
SSDeep 48:yXkJ+sW74oJHvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:pRpoBvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Uninstall Information\just_instant_bulgaria.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 4f12438545114737db4b88bb0a1afb59 Copy to Clipboard
SHA1 a85a5179e99004fc4f66d14a21b341a7cd88cdbc Copy to Clipboard
SHA256 b4b4b0d95ed2e53f4af5e519f5dddc28da6effd85817766ec3cb823123fc6ec7 Copy to Clipboard
SSDeep 1536:a77sfnWPa2RZilkMgOCUE45h3WNYSVAlBE+Yx431YO+Lz2PYOaTsl:a3knga2RZi9ZC74Dp9/naOnM8 Copy to Clipboard
\\?\C:\Users\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 1c1f7836cbb07d7056f77965d700cc38 Copy to Clipboard
SHA1 3912f9667dab7566522469758179ab60bc4e8061 Copy to Clipboard
SHA256 fe0f26c3c61881529df430edba2d0fc5492e2245075add3024ef3e3ef736c802 Copy to Clipboard
SSDeep 48:46hyOR4r/vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:47vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.55 KB
MD5 8c340ec9307d8363613a180ec8d2d0b2 Copy to Clipboard
SHA1 e451eb9c7ee3922d15843c27b023cc9e371a8573 Copy to Clipboard
SHA256 52305b89ba589f6e293bfdb703750ba42db1a6d49b0b2cbb5ab4ae3207b631d0 Copy to Clipboard
SSDeep 48:uscKSeTU7+FE+Z4mapUWviGHSZwpKXmvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:usc/X7nbcGHgCKXmvkVYj1Xm6IVJVvlX Copy to Clipboard
\\?\C:\Program Files\Windows Photo Viewer\runtime recommendation.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 f947101217bb7181157d2980f63bcb9c Copy to Clipboard
SHA1 361e351a1d0dd74c5110b34e7371bc6108e7acca Copy to Clipboard
SHA256 8c9f6cbd1cda8695c0884f66c7e59c97eb98e22decf93cf7e170b136395c0aba Copy to Clipboard
SSDeep 1536:9Ob+7KLk4TleloLitGP5+bUgAfBK/0IE9KHhzGK19+/ROsl:4b+mI41uNWBKu9ChGK19+P Copy to Clipboard
\\?\C:\Users\Public\Documents\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.77 KB
MD5 1ddacbf033e394e41c713fdbc20892bc Copy to Clipboard
SHA1 e118f09fda40a9bd0012d5c8186f2ba74e4449a0 Copy to Clipboard
SHA256 4c279c4ca5513a8a82f28c43db3d47c7cb8649d49e9bf419c60365236d0f50a8 Copy to Clipboard
SSDeep 48:ZAQ9Xx+gPvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:iEX1vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\2RMYqU6OwcaNfG5QwG.pptx id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 35.46 KB
MD5 88f5e548d0023febf5117976eb378b4f Copy to Clipboard
SHA1 a2f63175e680dbcbffe297e4597881f5520a8706 Copy to Clipboard
SHA256 804dcc26cd1b1617bc63cacf3b1da455466febf0897433fe0906f3edfd099d8f Copy to Clipboard
SSDeep 768:pcgkwVvWCsoqtPP/qFggcvUZSGjeEj7i1DhEN0YZzijg1RnnAozGYz+Bsl:nWCsoqtvqFcvUDV7iRhaziE1JZ7Wsl Copy to Clipboard
\\?\C:\Program Files (x86)\Windows Multimedia Platform\pump.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 45a7cde137c77f0be432516bc671605a Copy to Clipboard
SHA1 1a6af1301577147221b756e55d2fd18522c77eaf Copy to Clipboard
SHA256 088570df5d64fca5929ed98e0c335b1df7de91f2633862b4a4c3e8b926957e24 Copy to Clipboard
SSDeep 1536:DtVhKv9XRmKcWbYvZ0ow5GSvgMr1RpQNUDbKn1W3NaB2mrDJsl:DJKvXbYdw5XgW1DCUKY3NaB2qy Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\vcredist_x64.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 453.66 KB
MD5 b6409a824001944315f13cec9064cc5e Copy to Clipboard
SHA1 9235fded33f8395065729df7de82b9e649ad2358 Copy to Clipboard
SHA256 3fec4c36fe0b2d4103e5957874ccb04a61d59d583cf17d9e7e7457774e5cba69 Copy to Clipboard
SSDeep 12288:TT7Q5ZO118pZoDyha3v+UGGbeTem1OO1/ZV4JXWOEfwRySlcT:s5ZO118pq2h1UGGKem1X3V4Jm0u Copy to Clipboard
\\?\C:\Program Files\Microsoft Office 15\charity.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 a97097950fd4e67d5ccc15dee2c89634 Copy to Clipboard
SHA1 a55250aec1f8caf6e12317b8a4b17e76a447c500 Copy to Clipboard
SHA256 e0989423a0addb2a2dd0f73284d58c7ffe9e85dccffd66f87c1a7d27da796576 Copy to Clipboard
SSDeep 1536:cF9AXhKUkWcQsyZpezoZD9op8YBhth0ylrVXPG4nt8nt5fa91sdgdMsl:Au1kMs8R9o3hthXPBnwY1sdgp Copy to Clipboard
\\?\C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 3.43 KB
MD5 a6b328ae4fc15362efd75db9300039ac Copy to Clipboard
SHA1 630bd623d03b4877e0da9c7427d0c8784625a7eb Copy to Clipboard
SHA256 c74331bf256669653289638d1573832c77195b8dcd4fa415cf4838ecb6d863d3 Copy to Clipboard
SSDeep 96:Sbr+qKkNt0DPZmY9qgzDvkVYj1Xm6IVJVvlpYx0:SWCz0NmIqgzDvkejdm7VJVvx Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Links\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 73432b167cab0e1c744ea86a7849c980 Copy to Clipboard
SHA1 c8a1ae3cc37b6d636f31e06fbf17ea383c54aebe Copy to Clipboard
SHA256 e3a88af1d2d5679ad1769c6d1ef3c71d32468db5172fb65e132be6a4e30e2eae Copy to Clipboard
SSDeep 48:PQjQASvHl5UJPey8OSfvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:PUQ9LUJ+vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.63 KB
MD5 838ee97a6e21d1dd5e49f848fb8e3e3c Copy to Clipboard
SHA1 3a1b145c135f200646397cda3f8ef73f6e84c902 Copy to Clipboard
SHA256 fd5308940aff904756a548a87d5f840c4a638036aa1e8c894e1552a9b0fe25d1 Copy to Clipboard
SSDeep 48:mh5idUkIuDvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:mh5id4uDvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb id-Br3n0G72wUb8CejT.LyaS Created File Unknown
Not Queried
...
»
Mime Type application/x-msaccess
File Size 348.00 KB
MD5 18f4c424310b664ccaeb16cc6628ad5b Copy to Clipboard
SHA1 780009cced34531d4eff34244d480e4a451e6fa6 Copy to Clipboard
SHA256 978bb09dc0e260186252e9cc86a076074bd9bf7b06772dcd069a2fff316b8a84 Copy to Clipboard
SSDeep 768:cCrlqlHadRcdR4flxVrkJtCzUedRbPdRb0dRb7dRb/:c6lqlHadmdSnAJtCzZdxdmdld9 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Desktop\1PIfCh65fn7.docx id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 92.27 KB
MD5 769812fd628b8e691ef76411fc51a01f Copy to Clipboard
SHA1 a4e03db56ef682de196fe00d2ca0816c32d6333a Copy to Clipboard
SHA256 89283b0458f876441f2d61d4411b7ed31202d2abe8c88124e7e2669cb3f5ab30 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
\\?\C:\ProgramData\Microsoft\Windows Live\WLive48x48.png id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 6.05 KB
MD5 a7c437ac3151d1b6eaff93abf15f2262 Copy to Clipboard
SHA1 3c5f7be207882c25b4ccc9cbb0afa5b54d359993 Copy to Clipboard
SHA256 29080b5efd0f702f554ce57b766404fef9e75b92e3a3cb43fb8d8464029367f1 Copy to Clipboard
SSDeep 96:poRqUm40CeNefjxdlynEFRaspIQW3UTHKLG8NjVos4vkVYj1Xm6IVJVvlpYx0:phUm4f9IUFOUDK5jVivkejdm7VJVvx Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.24 KB
MD5 bd303d1a1802917df2792a64f3b96a95 Copy to Clipboard
SHA1 14ef0d433d8b5eccebe776c9433696e8bf5eeda6 Copy to Clipboard
SHA256 f1bc1400f683c7c546d9d3beec48b19358f5183a92217d3da912bc1ad5294c21 Copy to Clipboard
SSDeep 48:glkldTCWZXAm30EFTAQxzgyZt0jmRvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:ll2zQxlZtCMvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Unknown
Not Queried
...
»
Mime Type application/x-wine-extension-ini
File Size 0.63 KB
MD5 6bd5fb46283aa48e638bef47510c47da Copy to Clipboard
SHA1 c38d46ec6c9bc8baece4a459b617f44d10af973c Copy to Clipboard
SHA256 44fe5eebd80e46f903d68c07bcf06d187a3698bf3953bc58bb578465e2e0fe6c Copy to Clipboard
SSDeep 12:q9TBN1tbr5XT2iTuRlCKGL+TiTNDODaPi:q9T7DblD2cuDGL4CNDODaq Copy to Clipboard
\\?\C:\Program Files\Windows Multimedia Platform\freeware.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 5abd5d92365cc1e9e249b4052064b7dc Copy to Clipboard
SHA1 188021d51d566c92dcad60cee3c9cc7a76ea9211 Copy to Clipboard
SHA256 8f0b3a55beee0869e4f692aefda970c9327ee3557082083b6f2d882e51c88545 Copy to Clipboard
SSDeep 1536:PA9BU9IuOukZVzeEqQx7+5gMVEVxC4I9+lxXoWHwtrK3Mp3JnvHc8b9u3sl:PGd9ehriO4IHiwtrK8zHcPo Copy to Clipboard
\\?\C:\Program Files\Common Files\Services\verisign.bmp Created File Image
Not Queried
...
»
Also Known As \\?\C:\Program Files (x86)\Common Files\Services\verisign.bmp (Created File)
Mime Type image/x-ms-bmp
File Size 2.64 KB
MD5 618aa7be4cd1750b0a5f6247d084392f Copy to Clipboard
SHA1 fe878c289c59f085d8edf73cc634492ce6bb3281 Copy to Clipboard
SHA256 7f79dade5c9f7c6851af225be7d73d88b62259ed251638ba0140c7ea311cf2ed Copy to Clipboard
SSDeep 12:VGSaGRX0BalfJeZqm3I03p21byt71t/rfahott6YYJ7rrluT1Sc8/M1il2lvf:ISrF0BbqWIJbqnLahwwjhrcZSccM1iYV Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\VyW OD.mkv id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 66.75 KB
MD5 7e99b1f5225c14db8cfb4f03ec7af461 Copy to Clipboard
SHA1 3ea450b5d8125fef1e277489cdf5b79b5cbfcc8c Copy to Clipboard
SHA256 927742ef3254de7493150d17e43ceca42a49fb55ec8d85375d3e608a96d0eb3b Copy to Clipboard
SSDeep 1536:3LMhLbtpSZPGo1EUtoyMeUR68JdTWe9edGc3U0GIwqxTOASe3sl:3LWjmBAyMeC6y5Pc3Udd2+n Copy to Clipboard
\\?\C:\Program Files\Windows Photo Viewer\collecting_vb_les.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 8e94523b84d1fdde169185c1eee0d4e1 Copy to Clipboard
SHA1 efc6aa8eecc4c8981f7c71ad6485b175bda6b370 Copy to Clipboard
SHA256 35c3bab4faf2c2c678f073e830a634cdb1a1c711316d5e75f062e84612bfcf5e Copy to Clipboard
SSDeep 1536:M+20DwHV/UMTWKN2rwJvcnhE/U0ehghX4RB+Rk2GdLnr0cctrbq3Fjtxsl:M+20EHiWp2rq0+/U0UmX4P+Ji4hrqte Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\README.txt id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.54 KB
MD5 72c8dbf17942f671e6deb04b09f14b23 Copy to Clipboard
SHA1 c19f0e5f49139f09d41b08aaf43d4823f4444b5b Copy to Clipboard
SHA256 8c11b67029f89a333b287839f3a6456227643452b39876d1cb7af656a0814c45 Copy to Clipboard
SSDeep 48:rS5RvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:IRvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\BOOTSECT.BAK id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 9.50 KB
MD5 d887e33e371e7750affa600f937fb5fd Copy to Clipboard
SHA1 83adea9de63ff423a45e261d36924ab958e51fe0 Copy to Clipboard
SHA256 bca97bf3d1dd9332d5487b451b01a58b89e4b25c405dc5fa4c2cac14ef3cb658 Copy to Clipboard
SSDeep 192:Vmd8HhJxs1t0SMtpfkTqCNM6Xd2NjT5xOY21uvkejdm7VJVvx:Vmdaf+mSMtpnGtyjn2ABOVrx Copy to Clipboard
\\?\C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.55 KB
MD5 b34148c7228fb0d54ad3c34061116bac Copy to Clipboard
SHA1 71e7e374b29390d184c0602142f5d29133a713c9 Copy to Clipboard
SHA256 e70b883e01a3b107a2fd707aa6a1900e6eef6e1730d7b62a6bc9d6a14b83b85f Copy to Clipboard
SSDeep 48:GEWsXLYBUahJCefEYIKtyGUKvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:ICF5HKtyBKvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\Default\NTUSER.DAT.LOG1 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 25.50 KB
MD5 01d83152a3197ab356e868306a7c439e Copy to Clipboard
SHA1 1a7f7c43eb7355c03775526b5a5b63fbfb360ce6 Copy to Clipboard
SHA256 9a2433ad5a90b11d43aa9573b38c51a2a920d0a63d9cd268a01c7c64316171d9 Copy to Clipboard
SSDeep 768:5qjinnj0p612ztluWCWuhnUdwUluvKjh5SeBsl:4gnj0y4tlH0OcKFTsl Copy to Clipboard
\\?\C:\Program Files\Reference Assemblies\commands.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 231a0484852814b53c7b342ae081ce2b Copy to Clipboard
SHA1 6c83c9ac50ad12608e18e50a0e5b990d7764ecb4 Copy to Clipboard
SHA256 1405747c443c3b4c2b0c2b843b2911aef18c71e178d2ffacb4b550a54767e841 Copy to Clipboard
SSDeep 1536:NBOTfGH4K/LBKJzrr9XMa3kFU6kjLGOYRfnhDGTlFJtyH0rhNiPh0uVsfwsl:NsTfGYK/LexX70t2LGZRf4TlFHyH0r4Q Copy to Clipboard
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 170.95 KB
MD5 3e63ac8c23f08d355a00f987b5cb0aa5 Copy to Clipboard
SHA1 02da54a50121213a3baa02c46b8a90c96299784c Copy to Clipboard
SHA256 4289aabc5923aa36aa1385f284e2642f101646d3e9bb5a2f80ab8f9bf4331cfb Copy to Clipboard
SSDeep 3072:hwSNYdLDFHMR3lNN6b3RFcVKz8ApOnK4Fy+k4SzLIKoOYtSmC7g9f6tEDST5PHNl:hLNYbMF23RFCBnw4GIvRjC6i/g/8n Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Also Known As \\?\C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms id-Br3n0G72wUb8CejT.LyaS (Created File)
Mime Type application/octet-stream
File Size 1.74 KB
MD5 678066b86aa9ab70fc0cdae43ea9ed79 Copy to Clipboard
SHA1 af44df3c4d3ad7f3f8dd0c39b3666280e4936855 Copy to Clipboard
SHA256 f80d5b7ca88a0a21e57ce79c987c9c2ede1918f2821e05e43f1156389db201a0 Copy to Clipboard
SSDeep 48:BKuZ9Xx9sm1PWvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:BVBacOvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Downloads\ChromeSetup.exe id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
...
»
Mime Type application/x-dosexec
File Size 1.08 MB
MD5 cb26a32a1ada813d2aab8bc6422e805c Copy to Clipboard
SHA1 c6a924b3e15374bb27bec56b48d997acb3459ad8 Copy to Clipboard
SHA256 e7a349bc71c2b4e728fc0276257ec9165dadebe42aca0de5abbc8ff1d11bd6d6 Copy to Clipboard
SSDeep 24576:8Ej5jDN2+fvw1wh/jSaRjJFS1t/1nCXD8FTI9nZTDReeEYAiBBBny:8iRDN2+HBNRj/inCXDIshZTDRLB7ny Copy to Clipboard
ImpHash 1f7c03adda267bb2a26e5b9e7a1df3f6 Copy to Clipboard
Parser Error Remark Static analyzer was unable to completely parse the analyzed file
PE Information
»
Image Base 0x400000
Entry Point 0x404e56
Size Of Code 0x14a00
Size Of Initialized Data 0xfa600
File Type executable
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2017-04-22 01:31:06+00:00
Version Information (9)
»
LegalCopyright Copyright 2007-2010 Google Inc.
InternalName Google Update Setup
FileVersion 1.3.33.5
CompanyName Google Inc.
LanguageId en
ProductName Google Update
ProductVersion 1.3.33.5
FileDescription Google Update Setup
OriginalFilename GoogleUpdateSetup.exe
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x148a1 0x14a00 0x400 cnt_code, mem_execute, mem_read 6.64
.rdata 0x416000 0x6c00 0x6c00 0x14e00 cnt_initialized_data, mem_read 5.3
.data 0x41d000 0x1298 0x800 0x1ba00 cnt_initialized_data, mem_read, mem_write 2.4
.gfids 0x41f000 0xdc 0x200 0x1c200 cnt_initialized_data, mem_read 1.7
.rsrc 0x420000 0xf1c28 0xf1e00 0x1c400 cnt_initialized_data, mem_read 7.98
.reloc 0x512000 0x10b4 0x1200 0x10e200 cnt_initialized_data, mem_discardable, mem_read 6.35
Imports (5)
»
KERNEL32.dll (91)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
QueryPerformanceCounter 0x0 0x416000 0x1c334 0x1b134 0x436
GetCurrentProcessId 0x0 0x416004 0x1c338 0x1b138 0x20b
GetCurrentThreadId 0x0 0x416008 0x1c33c 0x1b13c 0x20f
GetSystemTimeAsFileTime 0x0 0x41600c 0x1c340 0x1b140 0x2d9
InitializeSListHead 0x0 0x416010 0x1c344 0x1b144 0x350
IsDebuggerPresent 0x0 0x416014 0x1c348 0x1b148 0x36c
UnhandledExceptionFilter 0x0 0x416018 0x1c34c 0x1b14c 0x592
SetUnhandledExceptionFilter 0x0 0x41601c 0x1c350 0x1b150 0x553
GetStartupInfoW 0x0 0x416020 0x1c354 0x1b154 0x2c0
IsProcessorFeaturePresent 0x0 0x416024 0x1c358 0x1b158 0x373
GetModuleHandleW 0x0 0x416028 0x1c35c 0x1b15c 0x268
GetCurrentProcess 0x0 0x41602c 0x1c360 0x1b160 0x20a
TerminateProcess 0x0 0x416030 0x1c364 0x1b164 0x571
RtlUnwind 0x0 0x416034 0x1c368 0x1b168 0x4ba
GetLastError 0x0 0x416038 0x1c36c 0x1b16c 0x251
SetLastError 0x0 0x41603c 0x1c370 0x1b170 0x519
EnterCriticalSection 0x0 0x416040 0x1c374 0x1b174 0x125
LeaveCriticalSection 0x0 0x416044 0x1c378 0x1b178 0x3a8
DeleteCriticalSection 0x0 0x416048 0x1c37c 0x1b17c 0x104
InitializeCriticalSectionAndSpinCount 0x0 0x41604c 0x1c380 0x1b180 0x34c
TlsAlloc 0x0 0x416050 0x1c384 0x1b184 0x583
TlsGetValue 0x0 0x416054 0x1c388 0x1b188 0x585
TlsSetValue 0x0 0x416058 0x1c38c 0x1b18c 0x586
TlsFree 0x0 0x41605c 0x1c390 0x1b190 0x584
FreeLibrary 0x0 0x416060 0x1c394 0x1b194 0x19e
GetProcAddress 0x0 0x416064 0x1c398 0x1b198 0x29e
LoadLibraryExW 0x0 0x416068 0x1c39c 0x1b19c 0x3ae
GetStdHandle 0x0 0x41606c 0x1c3a0 0x1b1a0 0x2c2
WriteFile 0x0 0x416070 0x1c3a4 0x1b1a4 0x5f4
GetModuleFileNameW 0x0 0x416074 0x1c3a8 0x1b1a8 0x264
GetModuleFileNameA 0x0 0x416078 0x1c3ac 0x1b1ac 0x263
MultiByteToWideChar 0x0 0x41607c 0x1c3b0 0x1b1b0 0x3d8
WideCharToMultiByte 0x0 0x416080 0x1c3b4 0x1b1b4 0x5e0
ExitProcess 0x0 0x416084 0x1c3b8 0x1b1b8 0x151
GetModuleHandleExW 0x0 0x416088 0x1c3bc 0x1b1bc 0x267
GetACP 0x0 0x41608c 0x1c3c0 0x1b1c0 0x1a5
HeapFree 0x0 0x416090 0x1c3c4 0x1b1c4 0x337
HeapAlloc 0x0 0x416094 0x1c3c8 0x1b1c8 0x333
OutputDebugStringW 0x0 0x416098 0x1c3cc 0x1b1cc 0x402
CloseHandle 0x0 0x41609c 0x1c3d0 0x1b1d0 0x7c
FindClose 0x0 0x4160a0 0x1c3d4 0x1b1d4 0x168
FindFirstFileExA 0x0 0x4160a4 0x1c3d8 0x1b1d8 0x16d
FindNextFileA 0x0 0x4160a8 0x1c3dc 0x1b1dc 0x17d
IsValidCodePage 0x0 0x4160ac 0x1c3e0 0x1b1e0 0x378
GetOEMCP 0x0 0x4160b0 0x1c3e4 0x1b1e4 0x287
GetCPInfo 0x0 0x4160b4 0x1c3e8 0x1b1e8 0x1b4
GetCommandLineA 0x0 0x4160b8 0x1c3ec 0x1b1ec 0x1c9
GetCommandLineW 0x0 0x4160bc 0x1c3f0 0x1b1f0 0x1ca
GetEnvironmentStringsW 0x0 0x4160c0 0x1c3f4 0x1b1f4 0x228
FreeEnvironmentStringsW 0x0 0x4160c4 0x1c3f8 0x1b1f8 0x19d
LCMapStringW 0x0 0x4160c8 0x1c3fc 0x1b1fc 0x39c
SetStdHandle 0x0 0x4160cc 0x1c400 0x1b200 0x531
GetFileType 0x0 0x4160d0 0x1c404 0x1b204 0x23f
GetStringTypeW 0x0 0x4160d4 0x1c408 0x1b208 0x2c7
GetProcessHeap 0x0 0x4160d8 0x1c40c 0x1b20c 0x2a4
HeapSize 0x0 0x4160dc 0x1c410 0x1b210 0x33c
HeapReAlloc 0x0 0x4160e0 0x1c414 0x1b214 0x33a
FlushFileBuffers 0x0 0x4160e4 0x1c418 0x1b218 0x192
GetConsoleCP 0x0 0x4160e8 0x1c41c 0x1b21c 0x1dd
GetConsoleMode 0x0 0x4160ec 0x1c420 0x1b220 0x1ef
SetFilePointerEx 0x0 0x4160f0 0x1c424 0x1b224 0x50a
WriteConsoleW 0x0 0x4160f4 0x1c428 0x1b228 0x5f3
DecodePointer 0x0 0x4160f8 0x1c42c 0x1b22c 0xfd
CreateFileW 0x0 0x4160fc 0x1c430 0x1b230 0xc0
RaiseException 0x0 0x416100 0x1c434 0x1b234 0x44b
GetExitCodeProcess 0x0 0x416104 0x1c438 0x1b238 0x22d
CreateProcessW 0x0 0x416108 0x1c43c 0x1b23c 0xda
WaitForSingleObject 0x0 0x41610c 0x1c440 0x1b240 0x5bc
CreateDirectoryW 0x0 0x416110 0x1c444 0x1b244 0xaf
SizeofResource 0x0 0x416114 0x1c448 0x1b248 0x561
RemoveDirectoryW 0x0 0x416118 0x1c44c 0x1b24c 0x4a1
GetTempPathW 0x0 0x41611c 0x1c450 0x1b250 0x2e6
FormatMessageW 0x0 0x416120 0x1c454 0x1b254 0x19a
LockResource 0x0 0x416124 0x1c458 0x1b258 0x3c4
DeleteFileW 0x0 0x416128 0x1c45c 0x1b25c 0x109
FindResourceExW 0x0 0x41612c 0x1c460 0x1b260 0x188
LoadResource 0x0 0x416130 0x1c464 0x1b264 0x3b2
FindResourceW 0x0 0x416134 0x1c468 0x1b268 0x189
HeapDestroy 0x0 0x416138 0x1c46c 0x1b26c 0x336
LocalFree 0x0 0x41613c 0x1c470 0x1b270 0x3b9
VerSetConditionMask 0x0 0x416140 0x1c474 0x1b274 0x5a6
CopyFileW 0x0 0x416144 0x1c478 0x1b278 0xa2
VerifyVersionInfoW 0x0 0x416148 0x1c47c 0x1b27c 0x5aa
GetTempFileNameW 0x0 0x41614c 0x1c480 0x1b280 0x2e4
lstrcmpiW 0x0 0x416150 0x1c484 0x1b284 0x615
UnmapViewOfFile 0x0 0x416154 0x1c488 0x1b288 0x595
CreateFileMappingW 0x0 0x416158 0x1c48c 0x1b28c 0xbd
MapViewOfFile 0x0 0x41615c 0x1c490 0x1b290 0x3c7
VirtualQuery 0x0 0x416160 0x1c494 0x1b294 0x5b3
ReadFile 0x0 0x416164 0x1c498 0x1b298 0x45b
SetFilePointer 0x0 0x416168 0x1c49c 0x1b29c 0x509
SHLWAPI.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PathQuoteSpacesW 0x0 0x41617c 0x1c4b0 0x1b2b0 0x83
PathAppendW 0x0 0x416180 0x1c4b4 0x1b2b4 0x37
ole32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoUninitialize 0x0 0x416194 0x1c4c8 0x1b2c8 0x8d
CoInitializeEx 0x0 0x416198 0x1c4cc 0x1b2cc 0x5e
SHELL32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHGetFolderPathW 0x0 0x416170 0x1c4a4 0x1b2a4 0x157
(by ordinal) 0x2a8 0x416174 0x1c4a8 0x1b2a8 -
USER32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MessageBoxW 0x0 0x416188 0x1c4bc 0x1b2bc 0x25c
CharLowerBuffW 0x0 0x41618c 0x1c4c0 0x1b2c0 0x2d
Icons (1)
»
Digital Signatures (2)
»
Certificate: Google Inc
»
Issued by Google Inc
Parent Certificate Thawte Code Signing CA - G2
Country Name US
Valid From 2016-11-29 00:00:00+00:00
Valid Until 2019-11-21 23:59:59+00:00
Algorithm sha1_rsa
Serial Number 14 F8 FD D1 67 F9 24 02 B1 57 0B 5D C4 95 C8 15
Thumbprint 1A 6A C0 54 9A 4A 44 26 4D EB 6F F0 03 39 1D A2 F2 85 B1 9F
Certificate: Thawte Code Signing CA - G2
»
Issued by Thawte Code Signing CA - G2
Country Name US
Valid From 2010-02-08 00:00:00+00:00
Valid Until 2020-02-07 23:59:59+00:00
Algorithm sha1_rsa
Serial Number 47 97 4D 78 73 A5 BC AB 0D 2F B3 70 19 2F CE 5E
Thumbprint 80 8D 62 64 2B 7D 1C 4A 9A 83 FD 66 7F 7A 2A 9D 24 3F B1 C7
\\?\C:\Boot\BOOTSTAT.DAT id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 65.50 KB
MD5 44f0eeb2da9a026554a59c9bd14d4008 Copy to Clipboard
SHA1 9d93bc9b4960ec50bd791aca5bc3706db88a681e Copy to Clipboard
SHA256 0035b9688673f53923571675a177f1eaa35f2973d389b015b098705f6f2fe89e Copy to Clipboard
SSDeep 1536:MeXHRsRksOSDQAAzBhELDcKEz6ec8VBY1fdyiGHUsWUzgP8ZmuMsl:FHRBDQQAuEPc9z1c9yiG06ziUmuH Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Saved Games\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.78 KB
MD5 c649a1b4b240aa654e564f1a1739eaee Copy to Clipboard
SHA1 4a42c96e85e913768c1084e2130d79878393deea Copy to Clipboard
SHA256 fbe55627a32141eb386ba329a9c217130b2216cce6c93c332f61d808cac20b0c Copy to Clipboard
SSDeep 48:Jprh9Nbh31F+MvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:Jprh97D+MvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files (x86)\Common Files\extensiveadvertisement.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 5dcacdf9c32c3f0dcc2f44f8f26d1c78 Copy to Clipboard
SHA1 b52931c73c409d953a691f1c86dbf2e5f8da9f90 Copy to Clipboard
SHA256 8378bcd8e3bbc707a394cee4c0ef7ca8dbf9134b7d67d01841e9db5a4b9b6f2f Copy to Clipboard
SSDeep 1536:yqlSa5z0W8yQ/8yxNmeec1b3LeWGJxaA4d+qTPfAfDXN7Tz3Tr6g44fTUC6sl:yqlSSL5Yx3/1b36gzd+qTPfkXNXuMfTD Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 765.05 KB
MD5 3cc208cbabe5d38840c82ea78a884fe5 Copy to Clipboard
SHA1 6f6a5f343bef2dd6c0074ec554379b843ee69e11 Copy to Clipboard
SHA256 350d9d310ec1ead64ed5c0e7dc24893aeaa6226d8b2af582eaee470e2227fb2b Copy to Clipboard
SSDeep 12288:Ax+sXi429ja/B4AzjkixpvpYGeyzY13i6qjO+XIlrJplSZ2rVU1XlpYQdqnAs+S2:NO/z7fK5yzQ3LqjO+XgXw2BU1VeAS2 Copy to Clipboard
\\?\C:\Program Files (x86)\Windows Media Player\kg_tools_them.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 7e957b4f36236364fd61fa612111114e Copy to Clipboard
SHA1 d9d147889b3b2c3232651af469641f4958300946 Copy to Clipboard
SHA256 ece9199c0aabcbc57ffe9be508bfcc3e0632f07ced2b28637ef4c7206bcfa637 Copy to Clipboard
SSDeep 1536:n7hq2A/Mw0fNnQTapVsawhuwIicfSEU3CPkSVlGs9tzUj0qHbLBzsl:zAUwueaJwofqEUakBs9yj0eZc Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.14 KB
MD5 73f6913c22c19c586e4bb280baa9b287 Copy to Clipboard
SHA1 6ea0b92162694c61dddae2eb223cc6c2063c4c3c Copy to Clipboard
SHA256 76f324849c92d1f1d080d17a21d4537d21f3bc4df5d6eba1ae8584e27dc8b8de Copy to Clipboard
SSDeep 48:18FvqUuh/0FvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:svB40FvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Uninstall Information\lined-tex.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 26b9a06732576ceceb3e6c170a4b8b8d Copy to Clipboard
SHA1 33dd0d8dfe2cc51524a5108418987c879e879e82 Copy to Clipboard
SHA256 ff826292b80989cfa23eb90bfcd9568bb9a0bdd24191bfe7d74c601d039857ab Copy to Clipboard
SSDeep 1536:Pv/Jb9QMizlycNSkKclav+dCXiCYLSRXAilK9SwPIsl:3/JRCMmSk42d7CYeRXAis9Ser Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\ciEYcg BbzFlEAagVLi.pptx id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 99.62 KB
MD5 c33cbfeb6aac366ac0fec04d69e2af07 Copy to Clipboard
SHA1 62812668acef8fb956fb0585ca30bf6d2d0a8277 Copy to Clipboard
SHA256 0697ed2e5f24c198fc3a4f53b34d94d36dbd6a74f197baacba53c97c295343f4 Copy to Clipboard
SSDeep 1536:a7fEAxNTmGb38vZchZjOeIreZqShUnDNV/f7HGiaFDKvhQVpMkYYXn3aL0sl:a7fEAxNTh38vZWonydh4TG9FDK6HzqL Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Searches\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.01 KB
MD5 6b16a47b84492bc6cfae0a2851fdab6d Copy to Clipboard
SHA1 f2e2b2c2c7653ea52886f8e68e36f030506c5d49 Copy to Clipboard
SHA256 1303077b65ff7dbb9790999038d363595c70499aa65b55757d635129b042e6c6 Copy to Clipboard
SSDeep 48:TH+If+R5+HC5CR1XvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:I5TUjvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.70 KB
MD5 b4b7151b4ebbf434cb3586c2153eaa04 Copy to Clipboard
SHA1 2d539d9064cc8c6bd89992da4a21caf691b17076 Copy to Clipboard
SHA256 ecf4a322f203600a2db46ab26a61e7a57f04c4fdc96b0c5f27ad8c5fe2d476e3 Copy to Clipboard
SSDeep 48:DhgsEbWzU3EuE6vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:DhgsEbWzU3frvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.008.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 9987ff3fb5d803e653f61f0076829e5d Copy to Clipboard
SHA1 8ff8238405cafb8d318eefadefa1f07fa9a9ead4 Copy to Clipboard
SHA256 bdec3d5e068dc2af1d5165f618a9952d492086b758fd7e6286efcb55225469ae Copy to Clipboard
SSDeep 384:DL1NrfEpc/h4CTGQJxo7MWnsHkf1paKGyghBXmJLmJBOVrx:bdh44Jxr/pmJLmJBsl Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\ESp7hzFp.wav id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 90.09 KB
MD5 461c26dcb1df143f0abe4aa4cb721fe0 Copy to Clipboard
SHA1 5859cca54db22c6fd30c468200359e35cfd747c3 Copy to Clipboard
SHA256 acff8707bdf6ecfea17da8cadc1ff4b2fcd68e6a2771a83028898f3aa5af3d1d Copy to Clipboard
SSDeep 1536:OVztdc21L5nb9IjSntn0C2wP2BF4LCDaA+en8Ai5xCIWGMFAtnl7bkTiAJfKIb8z:OFnJb9hnXH2j8CDaGj296Knl7gffKIbi Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\LICENSE id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.54 KB
MD5 96a04ab22536f79d90306aa9441e1cd6 Copy to Clipboard
SHA1 495c5b4ed043f0d4efd701a994bf05f9602eb5c5 Copy to Clipboard
SHA256 f1016b45b20911c9843f244dc11e73a5563c994c729ed51c9f35e25f466e4a43 Copy to Clipboard
SSDeep 48:d136CicZvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:3XtZvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\Default\NTUSER.DAT.LOG2 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 504.00 KB
MD5 07bfa37a932ad9e4e5adaa7c083d9b34 Copy to Clipboard
SHA1 02a2d86653552004ba85068ddccb0fe006b5d291 Copy to Clipboard
SHA256 dcb3fe6744f478f98ccccd18e019bf0c75c2951c0c839a2045443b65214230b9 Copy to Clipboard
SSDeep 1536:SeXQhXcxfq8Ln1VWax9WaUJlPb9R9xT4QJXmLbBLNRnOjgVNRk0zT11s3sREnSVW:SeAhXcxfqQx6ZT4gAjJpvN Copy to Clipboard
\\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.96 KB
MD5 42723c5407d169427ec68621a1a34630 Copy to Clipboard
SHA1 2d85802c0f7930389d374772b07a7a9e962d1a51 Copy to Clipboard
SHA256 b9a1dcc7f7769893a3b4cb52c03c0b281164a1e5c15f18bcb0812e0dd5e83f7f Copy to Clipboard
SSDeep 48:riOKvj26/HjX+zLf6dhVdvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:ryNbX+H6vVdvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Windows Journal\orders oxide shift.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 ea4fbb32317d573826d43ed7b1a08853 Copy to Clipboard
SHA1 c4e8932e85573907a2219d645cd722d24b5882b6 Copy to Clipboard
SHA256 d89ec1ef39c09ce9830e09be229d1dbedf1774268c081784148b243dc98f5117 Copy to Clipboard
SSDeep 1536:Z9Zo9L6KjBTDccxeccG9v6mVpgMKxzQht0+XJeyyQ9vRSgeMKuhGd3yVvKh047sl:Z9Zo9LFgczzVymhMQ95SCKu+3sMU Copy to Clipboard
\\?\C:\Recovery\WindowsRE\boot.sdi id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 3.02 MB
MD5 875ffcc409850d56fad26ba512785755 Copy to Clipboard
SHA1 bc208e4cf2809d9ae31c1d63f3505e8366a15bef Copy to Clipboard
SHA256 23ec8d3ea412c786e55ac982cfef24aa061e9f71955867f6aadf4c2fdbc23ec6 Copy to Clipboard
SSDeep 24576:i+AfssyCsLjvucPr7VRCT4uVbIcmwPGgeKDQl5SzBH/vp:iwsyCsWcPrJRrMbnmw5eKDQlIB/x Copy to Clipboard
\\?\C:\ProgramData\Microsoft\MF\Pending.GRL id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 16.12 KB
MD5 bdf11c3371f249f6acac32fa6a633cff Copy to Clipboard
SHA1 24391122d24f012cb2d0f056f7b2d7f0c8c2e2b5 Copy to Clipboard
SHA256 bcf332f85cc71481bc68e05f96e1ec76efdd454197c7e2a28739b3a75a78755e Copy to Clipboard
SSDeep 384:tWSlgFjRDr/nsgBNRNe9Naijgn9d+s6oCuCZBOVrx:gW4dsE5e9NaiEdYnBsl Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.005.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 15e999c7613e93f419360dd2736c6525 Copy to Clipboard
SHA1 0b3f13175b2bf371781b6ed1bedd33584889ea40 Copy to Clipboard
SHA256 0788107ae2b53b237253e5772d24c416b45d81c3327aee95bd71fc4f7585488e Copy to Clipboard
SSDeep 384:N57ddjFXxLJNJ3e0de1An/5T3+/jH/vVpaiBl2tX23YvnO0zBOVrx:N5BdJhV73P/5TurHDaCl2tX2ynpzBsl Copy to Clipboard
\\?\C:\Program Files (x86)\Windows Photo Viewer\limousines.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 dcf375467eb0dbb329b22b789309d01b Copy to Clipboard
SHA1 2f7eebc2c1f9d4f1eb2de96adc27a80a7900046b Copy to Clipboard
SHA256 f1bcfa215673de652a4f0ac914a4adab7900b68156c8ef204311fc29221a9575 Copy to Clipboard
SSDeep 1536:VdklB8bJLgJNSK3U5okVNUo4exeN6XlndL05fxmCTEfquA+WhPGsl:bYSbJLsMEUGkQnC46O5PTXu6PV Copy to Clipboard
\\?\C:\Program Files\Windows Media Player\affected.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 acc41d14efd2c1f1333033ccb4842274 Copy to Clipboard
SHA1 efe0098982de221c7522db43e4f0cba6de40b14a Copy to Clipboard
SHA256 1e1ab55c972c0cb95fd385540c8fc7b92154fa61f060431fd8d77006bb3ed70e Copy to Clipboard
SSDeep 1536:X3wlrXp7gEk003mR/uX2JpK6Mu+eQX1FNZNn6tzRj3M8EhM34sDCHS5+sl:HwrOZ003C3K6TLQFz6tVjnEhMTDCyj Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\rWkgzSW.mkv id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 85.19 KB
MD5 83b794dfda37df6d3c4124ad24b4d50d Copy to Clipboard
SHA1 2622d6b22d261fa4586632b705fbd23de214278a Copy to Clipboard
SHA256 687b1e07378c33ae087fcd30ddb06bce046d6c7305a86a6f92648677c98e3b28 Copy to Clipboard
SSDeep 1536:8L5uiTELbYksdZbL9y/1WbKV6CvSebyXbVZrtYEAbLZ1ztBkZ2grsl:8cQEYNL4tX6CvSebcbVZx2Z1vF Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.14 KB
MD5 b572f324e807492f4b370287806ee88a Copy to Clipboard
SHA1 d31267c2d915aebcaa68cc20ec6a22b51c0399da Copy to Clipboard
SHA256 d213ee594c524f9d3d108c87bc6d593770fed36e676ba8e0861dbd59635bfe29 Copy to Clipboard
SSDeep 48:gbftp90SirF0wF1vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:GP95iRRvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.25 KB
MD5 74c19d1951895604e4eff578c9638717 Copy to Clipboard
SHA1 ebd8e0c2e035a89f6f33ac8b09799ca307379f6a Copy to Clipboard
SHA256 cd3370eea44ec1c6ea858e7cefb5b1fb046b504645d6322bc50fe330551f4e03 Copy to Clipboard
SSDeep 48:kEkT+/5PN1MMcW7WBPc7QPvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:kEecMMlZ7QPvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\release id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.02 KB
MD5 a34de06b8c3aefdc665df7dbe126ccee Copy to Clipboard
SHA1 422d28cbb6b3194485cc272ad8d69951cc737f5c Copy to Clipboard
SHA256 efdc61c265526ac1253e8c307084c67b37bc8200e3b08d8ceebf2ce1d6c05d8b Copy to Clipboard
SSDeep 48:i+TOKnlrxvnJOzvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:i0Oexv8zvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 446.54 KB
MD5 91c7073b1d563bd8b2e1a4d86a126b8c Copy to Clipboard
SHA1 2ca1aa1c0af57b55752a98522a43f22330144461 Copy to Clipboard
SHA256 4c1f5f2b3e351f086f87cc6a76381261e2f941bd5e7487c2132c67a76de0385e Copy to Clipboard
SSDeep 12288:tWA/NNaRiWpEk5fuWWFpGaUr+ByFOs1wHcxuW1vNN0zvc:tWADaYDkB4kkEw8xuiK0 Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.002.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 876965eebbb4451eb4e255617a673b4d Copy to Clipboard
SHA1 e1d5dcc25de828652580c50adb0dd273d25d10e3 Copy to Clipboard
SHA256 4172d77bef6d4662b638c7082cc7aca8ff7d7836acc1f718d40bfa31a381d25a Copy to Clipboard
SSDeep 384:D7DlnB2g8ht2qJJKsmM2veAVAFkbCp0tnm7c2xdTnqpxKb5vjqBOVrx:DVB2fLJKE2vehFkOpQm7c2POpxavOBsl Copy to Clipboard
\\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.77 KB
MD5 9b2dda34c0f2e93cfec30c78206cb024 Copy to Clipboard
SHA1 eda89927a36e424c4f4a523a9aa1f6650fc93eb6 Copy to Clipboard
SHA256 09d9fc468bef7aa1b5b30f8e3cd5c8eb2384bc4d65111f8df26452259b9fd9af Copy to Clipboard
SSDeep 48:wRa6VRmC0YyBvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:w39WvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 2.64 KB
MD5 09b6b6a736d048d1ecb97c01d6fda9d0 Copy to Clipboard
SHA1 a8b79dcd826e843bbfe02ab89d38c80b0f9663e6 Copy to Clipboard
SHA256 fc5d01fc6e399366db94310163d4c76bedb1c3213fbb4507fc9df8b39b7d2dd7 Copy to Clipboard
SSDeep 48:vEy9vv9IQq+WXZizu5Yu0vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:vEUvyQq+WJi1u0vkVYj1Xm6IVJVvlpYC Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\60D7E9F.avi id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 35.50 KB
MD5 178c06aae784264b4ff017d4a2a07278 Copy to Clipboard
SHA1 ea436a4c23d9c0b9d1ea80a5bf56ec3a2cb46057 Copy to Clipboard
SHA256 f7dad11c686203cfc05deabc0f1423ac940dc52a0fc9c57fc674b283a715feb0 Copy to Clipboard
SSDeep 768:Nb/o6wbIExkjtppRFAgLV6bJKg5dBwinD+MVbqNTwnt/1aiR6Bsl:N6bIExetppRFbVS1bqinD+mbqNTwdIib Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\d43nQxH.docx id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 39.54 KB
MD5 145bfb891f48ff07acf5725407f10dad Copy to Clipboard
SHA1 c65be5f7a6bfcbc33329b77d4dd20127d9775fc9 Copy to Clipboard
SHA256 dc2f4a8b42faac273e885a13ff281fdd8f659b719c8ac75ee45b2b8ef60c19c0 Copy to Clipboard
SSDeep 768:zXP4m1ZlZiitd3OzJRNgGbOtGvrNvC2OMkEFdCOSo/OQ5vrLI38/Dh5Bsl:7PV1ZHiY3OzJvgK562fkEF44FhrLI3ss Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Favorites\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.89 KB
MD5 504ffe242971a15d1f385c697744fc56 Copy to Clipboard
SHA1 6b3c2b18aa2ca39cc412dfaf1dccee53cd432602 Copy to Clipboard
SHA256 b78dad8dd318a23eacc9ca94db0f443ceff3d872e188bb55f2800849b74370c2 Copy to Clipboard
SSDeep 48:nHi8rhGjh9c/eivT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:n4jhC/eivkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
...
»
Mime Type application/x-dosexec
File Size 966.83 KB
MD5 58b80d366d68b524e1b4fbb4c7dbc511 Copy to Clipboard
SHA1 c42756154a35923542317fae2376497d0035c51b Copy to Clipboard
SHA256 e3893c35187b0dd848758979ebd0d766fc99f918ec9e685297f7d6ca080f122d Copy to Clipboard
SSDeep 12288:tc2YwE7VSxeUMUCcTd8Ht4lYyF2f78oyoMZggTSy:S2DE7oxeUXfaHtkYZjiQg2y Copy to Clipboard
ImpHash 1b7ac8744fe782a1d0182354d04b2612 Copy to Clipboard
PE Information
»
Image Base 0x180000000
Entry Point 0x18005508c
Size Of Code 0xab400
Size Of Initialized Data 0x48000
File Type dll
Subsystem windows_gui
Machine Type amd64
Compile Timestamp 2011-02-19 00:52:36+00:00
Version Information (8)
»
LegalCopyright © Microsoft Corporation. All rights reserved.
InternalName MSDIA100.DLL
FileVersion 10.00.40219.01 built by: SP1Rel
CompanyName Microsoft Corporation
ProductName Microsoft® Visual Studio® 2010
ProductVersion 10.00.40219.01
FileDescription Microsoft® Debug Information Accessor
OriginalFilename MSDIA100.DLL
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x180001000 0xab3ab 0xab400 0x400 cnt_code, mem_execute, mem_read 6.26
.rdata 0x1800ad000 0x24f03 0x25000 0xab800 cnt_initialized_data, mem_read 4.69
.data 0x1800d2000 0x6cd8 0x3a00 0xd0800 cnt_initialized_data, mem_read, mem_write 1.76
.pdata 0x1800d9000 0xafe0 0xb000 0xd4200 cnt_initialized_data, mem_read 5.95
.rsrc 0x1800e4000 0xbe80 0xc000 0xdf200 cnt_initialized_data, mem_read 4.77
.reloc 0x1800f0000 0x5046 0x5200 0xeb200 cnt_initialized_data, mem_discardable, mem_read 4.36
Imports (1)
»
KERNEL32.dll (99)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetLastError 0x0 0x1800ad000 0xd13f0 0xcfbf0 0x480
FindResourceW 0x0 0x1800ad008 0xd13f8 0xcfbf8 0x154
LoadResource 0x0 0x1800ad010 0xd1400 0xcfc00 0x343
LockResource 0x0 0x1800ad018 0xd1408 0xcfc08 0x356
SizeofResource 0x0 0x1800ad020 0xd1410 0xcfc10 0x4bf
MultiByteToWideChar 0x0 0x1800ad028 0xd1418 0xcfc18 0x369
LocalAlloc 0x0 0x1800ad030 0xd1420 0xcfc20 0x346
LocalFree 0x0 0x1800ad038 0xd1428 0xcfc28 0x34a
GetModuleFileNameW 0x0 0x1800ad040 0xd1430 0xcfc30 0x21a
GetLastError 0x0 0x1800ad048 0xd1438 0xcfc38 0x208
GetSystemInfo 0x0 0x1800ad050 0xd1440 0xcfc40 0x27a
GetVersion 0x0 0x1800ad058 0xd1448 0xcfc48 0x2aa
EnterCriticalSection 0x0 0x1800ad060 0xd1450 0xcfc50 0xf2
LeaveCriticalSection 0x0 0x1800ad068 0xd1458 0xcfc58 0x33b
LCMapStringW 0x0 0x1800ad070 0xd1460 0xcfc60 0x32f
InitializeCriticalSection 0x0 0x1800ad078 0xd1468 0xcfc68 0x2ea
DeleteCriticalSection 0x0 0x1800ad080 0xd1470 0xcfc70 0xd2
CreateFileW 0x0 0x1800ad088 0xd1478 0xcfc78 0x8f
GetFileSize 0x0 0x1800ad090 0xd1480 0xcfc80 0x1f7
CreateFileMappingW 0x0 0x1800ad098 0xd1488 0xcfc88 0x8c
MapViewOfFile 0x0 0x1800ad0a0 0xd1490 0xcfc90 0x359
CloseHandle 0x0 0x1800ad0a8 0xd1498 0xcfc98 0x52
UnmapViewOfFile 0x0 0x1800ad0b0 0xd14a0 0xcfca0 0x4e5
GetProcAddress 0x0 0x1800ad0b8 0xd14a8 0xcfca8 0x24c
FreeLibrary 0x0 0x1800ad0c0 0xd14b0 0xcfcb0 0x168
LoadLibraryA 0x0 0x1800ad0c8 0xd14b8 0xcfcb8 0x33e
RaiseException 0x0 0x1800ad0d0 0xd14c0 0xcfcc0 0x3b4
GetCurrentThreadId 0x0 0x1800ad0d8 0xd14c8 0xcfcc8 0x1cb
FlsSetValue 0x0 0x1800ad0e0 0xd14d0 0xcfcd0 0x15b
GetCommandLineA 0x0 0x1800ad0e8 0xd14d8 0xcfcd8 0x18c
DecodePointer 0x0 0x1800ad0f0 0xd14e0 0xcfce0 0xcb
EncodePointer 0x0 0x1800ad0f8 0xd14e8 0xcfce8 0xee
HeapFree 0x0 0x1800ad100 0xd14f0 0xcfcf0 0x2d7
HeapAlloc 0x0 0x1800ad108 0xd14f8 0xcfcf8 0x2d3
RtlUnwindEx 0x0 0x1800ad110 0xd1500 0xcfd00 0x425
FlsGetValue 0x0 0x1800ad118 0xd1508 0xcfd08 0x15a
FlsFree 0x0 0x1800ad120 0xd1510 0xcfd10 0x159
FlsAlloc 0x0 0x1800ad128 0xd1518 0xcfd18 0x158
Sleep 0x0 0x1800ad130 0xd1520 0xcfd20 0x4c0
GetModuleHandleW 0x0 0x1800ad138 0xd1528 0xcfd28 0x21e
ExitProcess 0x0 0x1800ad140 0xd1530 0xcfd30 0x11f
SetHandleCount 0x0 0x1800ad148 0xd1538 0xcfd38 0x47c
GetStdHandle 0x0 0x1800ad150 0xd1540 0xcfd40 0x26b
InitializeCriticalSectionAndSpinCount 0x0 0x1800ad158 0xd1548 0xcfd48 0x2eb
GetFileType 0x0 0x1800ad160 0xd1550 0xcfd50 0x1fa
GetStartupInfoW 0x0 0x1800ad168 0xd1558 0xcfd58 0x26a
GetModuleFileNameA 0x0 0x1800ad170 0xd1560 0xcfd60 0x219
FreeEnvironmentStringsW 0x0 0x1800ad178 0xd1568 0xcfd68 0x167
WideCharToMultiByte 0x0 0x1800ad180 0xd1570 0xcfd70 0x520
GetEnvironmentStringsW 0x0 0x1800ad188 0xd1578 0xcfd78 0x1e1
HeapSetInformation 0x0 0x1800ad190 0xd1580 0xcfd80 0x2db
HeapCreate 0x0 0x1800ad198 0xd1588 0xcfd88 0x2d5
HeapDestroy 0x0 0x1800ad1a0 0xd1590 0xcfd90 0x2d6
QueryPerformanceCounter 0x0 0x1800ad1a8 0xd1598 0xcfd98 0x3a9
GetTickCount 0x0 0x1800ad1b0 0xd15a0 0xcfda0 0x29a
GetCurrentProcessId 0x0 0x1800ad1b8 0xd15a8 0xcfda8 0x1c7
GetSystemTimeAsFileTime 0x0 0x1800ad1c0 0xd15b0 0xcfdb0 0x280
TerminateProcess 0x0 0x1800ad1c8 0xd15b8 0xcfdb8 0x4ce
GetCurrentProcess 0x0 0x1800ad1d0 0xd15c0 0xcfdc0 0x1c6
UnhandledExceptionFilter 0x0 0x1800ad1d8 0xd15c8 0xcfdc8 0x4e2
SetUnhandledExceptionFilter 0x0 0x1800ad1e0 0xd15d0 0xcfdd0 0x4b3
IsDebuggerPresent 0x0 0x1800ad1e8 0xd15d8 0xcfdd8 0x302
RtlVirtualUnwind 0x0 0x1800ad1f0 0xd15e0 0xcfde0 0x426
RtlLookupFunctionEntry 0x0 0x1800ad1f8 0xd15e8 0xcfde8 0x41f
RtlCaptureContext 0x0 0x1800ad200 0xd15f0 0xcfdf0 0x418
WriteFile 0x0 0x1800ad208 0xd15f8 0xcfdf8 0x534
GetCPInfo 0x0 0x1800ad210 0xd1600 0xcfe00 0x178
GetACP 0x0 0x1800ad218 0xd1608 0xcfe08 0x16e
GetOEMCP 0x0 0x1800ad220 0xd1610 0xcfe10 0x23e
IsValidCodePage 0x0 0x1800ad228 0xd1618 0xcfe18 0x30c
GetStringTypeW 0x0 0x1800ad230 0xd1620 0xcfe20 0x270
HeapSize 0x0 0x1800ad238 0xd1628 0xcfe28 0x2dc
SetFilePointer 0x0 0x1800ad240 0xd1630 0xcfe30 0x474
ReadFile 0x0 0x1800ad248 0xd1638 0xcfe38 0x3c3
HeapReAlloc 0x0 0x1800ad250 0xd1640 0xcfe40 0x2da
LoadLibraryW 0x0 0x1800ad258 0xd1648 0xcfe48 0x341
GetConsoleCP 0x0 0x1800ad260 0xd1650 0xcfe50 0x1a0
GetConsoleMode 0x0 0x1800ad268 0xd1658 0xcfe58 0x1b2
SetStdHandle 0x0 0x1800ad270 0xd1660 0xcfe60 0x494
FlushFileBuffers 0x0 0x1800ad278 0xd1668 0xcfe68 0x15d
WriteConsoleW 0x0 0x1800ad280 0xd1670 0xcfe70 0x533
SetEndOfFile 0x0 0x1800ad288 0xd1678 0xcfe78 0x461
GetProcessHeap 0x0 0x1800ad290 0xd1680 0xcfe80 0x251
SetFileAttributesW 0x0 0x1800ad298 0xd1688 0xcfe88 0x46f
GetFileAttributesW 0x0 0x1800ad2a0 0xd1690 0xcfe90 0x1f1
CopyFileW 0x0 0x1800ad2a8 0xd1698 0xcfe98 0x75
VirtualAlloc 0x0 0x1800ad2b0 0xd16a0 0xcfea0 0x4f8
VirtualFree 0x0 0x1800ad2b8 0xd16a8 0xcfea8 0x4fb
DeleteFileW 0x0 0x1800ad2c0 0xd16b0 0xcfeb0 0xd7
DeviceIoControl 0x0 0x1800ad2c8 0xd16b8 0xcfeb8 0xe1
GetCurrentDirectoryW 0x0 0x1800ad2d0 0xd16c0 0xcfec0 0x1c5
ExpandEnvironmentStringsW 0x0 0x1800ad2d8 0xd16c8 0xcfec8 0x123
GetDriveTypeW 0x0 0x1800ad2e0 0xd16d0 0xcfed0 0x1da
MapViewOfFileEx 0x0 0x1800ad2e8 0xd16d8 0xcfed8 0x35a
FlushViewOfFile 0x0 0x1800ad2f0 0xd16e0 0xcfee0 0x160
GetFullPathNameW 0x0 0x1800ad2f8 0xd16e8 0xcfee8 0x202
CompareStringW 0x0 0x1800ad300 0xd16f0 0xcfef0 0x64
SetEnvironmentVariableW 0x0 0x1800ad308 0xd16f8 0xcfef8 0x465
RtlPcToFileHeader 0x0 0x1800ad310 0xd1700 0xcff00 0x421
Exports (6)
»
Api name EAT Address Ordinal
DllCanUnloadNow 0x4270 0x1
DllGetClassObject 0x4790 0x2
DllRegisterServer 0x4630 0x3
DllUnregisterServer 0x4720 0x4
VSDllRegisterServer 0x4600 0x5
VSDllUnregisterServer 0x4620 0x6
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2009-12-07 22:40:29+00:00
Valid Until 2011-03-07 22:40:29+00:00
Algorithm sha1_rsa
Serial Number 61 01 CF 3E 00 00 00 00 00 0F
Thumbprint 96 17 09 4A 1C FB 59 AE 7C 1F 7D FD B6 73 9E 4E 7C 40 50 8F
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2007-08-22 22:31:02+00:00
Valid Until 2012-08-25 07:00:00+00:00
Algorithm sha1_rsa
Serial Number 2E AB 11 DC 50 FF 5C 9D CB C0
Thumbprint 30 36 E3 B2 5B 88 A5 5B 86 FC 90 E6 E9 EA AD 50 81 44 51 66
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
...
»
Mime Type application/x-dosexec
File Size 316.48 KB
MD5 8dbeedb522d3318721767a9bfc6047d0 Copy to Clipboard
SHA1 5b412076783d0ae79dc648071ef8711e36f8cd22 Copy to Clipboard
SHA256 7a863990de8525fb3e5e9c1b7e311f396489ee2a6b6a0821ca70e5fc783bb1a4 Copy to Clipboard
SSDeep 6144:Z5XpZ3OWg8DOnPhwNVx9ghVFb+S9jy1A3FMCpV38:Zti8SKvaVx+ejy1AVF38 Copy to Clipboard
ImpHash 5807f20048be6ee416c7085f2916620a Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10012029
Size Of Code 0x39800
Size Of Initialized Data 0x15800
File Type dll
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2017-07-31 19:51:41+00:00
Version Information (8)
»
LegalCopyright Copyright 1998-2017 Adobe Systems Incorporated and its licensors. All rights reserved.
InternalName Aiod
FileVersion 17.12.20093.238000
CompanyName Adobe Systems, Inc.
ProductName Adobe Acrobat
ProductVersion 17.12.20093.238000
FileDescription Acrobat Install On Demand
OriginalFilename Aiod.dll
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x396ad 0x39800 0x400 cnt_code, mem_execute, mem_read 6.61
.rdata 0x1003b000 0xe94c 0xea00 0x39c00 cnt_initialized_data, mem_read 5.08
.data 0x1004a000 0x37a0 0x1800 0x48600 cnt_initialized_data, mem_read, mem_write 3.94
.rsrc 0x1004e000 0x5b0 0x600 0x49e00 cnt_initialized_data, mem_read 4.04
.reloc 0x1004f000 0x2e94 0x3000 0x4a400 cnt_initialized_data, mem_discardable, mem_read 6.63
Imports (7)
»
SHLWAPI.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHCopyKeyW 0x0 0x1003b290 0x48ba8 0x477a8 0xaa
SHDeleteEmptyKeyW 0x0 0x1003b294 0x48bac 0x477ac 0xb6
SHDeleteKeyW 0x0 0x1003b298 0x48bb0 0x477b0 0xb8
msi.dll (28)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
(by ordinal) 0x74 0x1003b2b8 0x48bd0 0x477d0 -
(by ordinal) 0x9e 0x1003b2bc 0x48bd4 0x477d4 -
(by ordinal) 0xd3 0x1003b2c0 0x48bd8 0x477d8 -
(by ordinal) 0xe 0x1003b2c4 0x48bdc 0x477dc -
(by ordinal) 0x6f 0x1003b2c8 0x48be0 0x477e0 -
(by ordinal) 0x83 0x1003b2cc 0x48be4 0x477e4 -
(by ordinal) 0x10 0x1003b2d0 0x48be8 0x477e8 -
(by ordinal) 0x5c 0x1003b2d4 0x48bec 0x477ec -
(by ordinal) 0x71 0x1003b2d8 0x48bf0 0x477f0 -
(by ordinal) 0x91 0x1003b2dc 0x48bf4 0x477f4 -
(by ordinal) 0x73 0x1003b2e0 0x48bf8 0x477f8 -
(by ordinal) 0x8b 0x1003b2e4 0x48bfc 0x477fc -
(by ordinal) 0x2f 0x1003b2e8 0x48c00 0x47800 -
(by ordinal) 0x67 0x1003b2ec 0x48c04 0x47804 -
(by ordinal) 0x4a 0x1003b2f0 0x48c08 0x47808 -
(by ordinal) 0x31 0x1003b2f4 0x48c0c 0x4780c -
(by ordinal) 0xa7 0x1003b2f8 0x48c10 0x47810 -
(by ordinal) 0x76 0x1003b2fc 0x48c14 0x47814 -
(by ordinal) 0x7d 0x1003b300 0x48c18 0x47818 -
(by ordinal) 0x11 0x1003b304 0x48c1c 0x4781c -
(by ordinal) 0xa0 0x1003b308 0x48c20 0x47820 -
(by ordinal) 0x9f 0x1003b30c 0x48c24 0x47824 -
(by ordinal) 0x20 0x1003b310 0x48c28 0x47828 -
(by ordinal) 0x48 0x1003b314 0x48c2c 0x4782c -
(by ordinal) 0x60 0x1003b318 0x48c30 0x47830 -
(by ordinal) 0xcd 0x1003b31c 0x48c34 0x47834 -
(by ordinal) 0x46 0x1003b320 0x48c38 0x47838 -
(by ordinal) 0x8 0x1003b324 0x48c3c 0x4783c -
VERSION.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VerQueryValueW 0x0 0x1003b2a8 0x48bc0 0x477c0 0x10
GetFileVersionInfoW 0x0 0x1003b2ac 0x48bc4 0x477c4 0x8
GetFileVersionInfoSizeW 0x0 0x1003b2b0 0x48bc8 0x477c8 0x7
KERNEL32.dll (122)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
FindNextFileW 0x0 0x1003b0a4 0x489bc 0x475bc 0x17f
GetFullPathNameW 0x0 0x1003b0a8 0x489c0 0x475c0 0x249
ReadFile 0x0 0x1003b0ac 0x489c4 0x475c4 0x450
RemoveDirectoryW 0x0 0x1003b0b0 0x489c8 0x475c8 0x495
SetFileAttributesW 0x0 0x1003b0b4 0x489cc 0x475cc 0x4f7
SetFilePointer 0x0 0x1003b0b8 0x489d0 0x475d0 0x4fc
CloseHandle 0x0 0x1003b0bc 0x489d4 0x475d4 0x7f
GetLastError 0x0 0x1003b0c0 0x489d8 0x475d8 0x250
HeapAlloc 0x0 0x1003b0c4 0x489dc 0x475dc 0x32f
HeapFree 0x0 0x1003b0c8 0x489e0 0x475e0 0x333
GetProcessHeap 0x0 0x1003b0cc 0x489e4 0x475e4 0x2a2
WaitForSingleObject 0x0 0x1003b0d0 0x489e8 0x475e8 0x5ab
GetCurrentProcess 0x0 0x1003b0d4 0x489ec 0x475ec 0x209
GetCurrentProcessId 0x0 0x1003b0d8 0x489f0 0x475f0 0x20a
TerminateProcess 0x0 0x1003b0dc 0x489f4 0x475f4 0x561
ProcessIdToSessionId 0x0 0x1003b0e0 0x489f8 0x475f8 0x410
OpenProcess 0x0 0x1003b0e4 0x489fc 0x475fc 0x3ee
GetWindowsDirectoryW 0x0 0x1003b0e8 0x48a00 0x47600 0x310
FreeLibrary 0x0 0x1003b0ec 0x48a04 0x47604 0x19e
GetModuleHandleW 0x0 0x1003b0f0 0x48a08 0x47608 0x267
GetProcAddress 0x0 0x1003b0f4 0x48a0c 0x4760c 0x29d
LocalAlloc 0x0 0x1003b0f8 0x48a10 0x47610 0x3ae
LocalFree 0x0 0x1003b0fc 0x48a14 0x47614 0x3b2
FormatMessageW 0x0 0x1003b100 0x48a18 0x47618 0x19a
FindFirstFileW 0x0 0x1003b104 0x48a1c 0x4761c 0x173
lstrcpynW 0x0 0x1003b108 0x48a20 0x47620 0x608
lstrcpyW 0x0 0x1003b10c 0x48a24 0x47624 0x605
lstrcatW 0x0 0x1003b110 0x48a28 0x47628 0x5fc
lstrlenW 0x0 0x1003b114 0x48a2c 0x4762c 0x60b
LoadLibraryW 0x0 0x1003b118 0x48a30 0x47630 0x3a8
MoveFileExW 0x0 0x1003b11c 0x48a34 0x47634 0x3ca
GetUserDefaultUILanguage 0x0 0x1003b120 0x48a38 0x47638 0x2ff
CreateToolhelp32Snapshot 0x0 0x1003b124 0x48a3c 0x4763c 0xf1
Process32FirstW 0x0 0x1003b128 0x48a40 0x47640 0x40d
Process32NextW 0x0 0x1003b12c 0x48a44 0x47644 0x40f
GetCommandLineW 0x0 0x1003b130 0x48a48 0x47648 0x1c9
SetLastError 0x0 0x1003b134 0x48a4c 0x4764c 0x50b
CreateProcessW 0x0 0x1003b138 0x48a50 0x47650 0xdb
GetSystemTime 0x0 0x1003b13c 0x48a54 0x47654 0x2d4
GetSystemDirectoryW 0x0 0x1003b140 0x48a58 0x47658 0x2cd
SystemTimeToFileTime 0x0 0x1003b144 0x48a5c 0x4765c 0x55d
WideCharToMultiByte 0x0 0x1003b148 0x48a60 0x47660 0x5cd
VerSetConditionMask 0x0 0x1003b14c 0x48a64 0x47664 0x596
VerifyVersionInfoW 0x0 0x1003b150 0x48a68 0x47668 0x59a
GetShortPathNameW 0x0 0x1003b154 0x48a6c 0x4766c 0x2bb
GetCurrentThread 0x0 0x1003b158 0x48a70 0x47670 0x20d
GetCPInfo 0x0 0x1003b15c 0x48a74 0x47674 0x1b3
FindClose 0x0 0x1003b160 0x48a78 0x47678 0x168
DeleteFileW 0x0 0x1003b164 0x48a7c 0x4767c 0x10a
CreateFileW 0x0 0x1003b168 0x48a80 0x47680 0xc2
GetStdHandle 0x0 0x1003b16c 0x48a84 0x47684 0x2c0
WriteFile 0x0 0x1003b170 0x48a88 0x47688 0x5e1
GetModuleFileNameW 0x0 0x1003b174 0x48a8c 0x4768c 0x263
GetDriveTypeW 0x0 0x1003b178 0x48a90 0x47690 0x21f
GetFullPathNameA 0x0 0x1003b17c 0x48a94 0x47694 0x246
GetFileType 0x0 0x1003b180 0x48a98 0x47698 0x23e
DeleteCriticalSection 0x0 0x1003b184 0x48a9c 0x4769c 0x105
GetModuleFileNameA 0x0 0x1003b188 0x48aa0 0x476a0 0x262
QueryPerformanceCounter 0x0 0x1003b18c 0x48aa4 0x476a4 0x42d
GetSystemTimeAsFileTime 0x0 0x1003b190 0x48aa8 0x476a8 0x2d6
GetEnvironmentStringsW 0x0 0x1003b194 0x48aac 0x476ac 0x227
SetEnvironmentVariableA 0x0 0x1003b198 0x48ab0 0x476b0 0x4ed
FreeEnvironmentStringsW 0x0 0x1003b19c 0x48ab4 0x476b4 0x19d
SetConsoleCtrlHandler 0x0 0x1003b1a0 0x48ab8 0x476b8 0x4c3
GetDateFormatW 0x0 0x1003b1a4 0x48abc 0x476bc 0x213
GetTimeFormatW 0x0 0x1003b1a8 0x48ac0 0x476c0 0x2f7
CompareStringW 0x0 0x1003b1ac 0x48ac4 0x476c4 0x93
LCMapStringW 0x0 0x1003b1b0 0x48ac8 0x476c8 0x396
GetLocaleInfoW 0x0 0x1003b1b4 0x48acc 0x476cc 0x254
IsValidLocale 0x0 0x1003b1b8 0x48ad0 0x476d0 0x374
GetUserDefaultLCID 0x0 0x1003b1bc 0x48ad4 0x476d4 0x2fc
EnumSystemLocalesW 0x0 0x1003b1c0 0x48ad8 0x476d8 0x147
EnterCriticalSection 0x0 0x1003b1c4 0x48adc 0x476dc 0x125
LeaveCriticalSection 0x0 0x1003b1c8 0x48ae0 0x476e0 0x3a2
FatalAppExitA 0x0 0x1003b1cc 0x48ae4 0x476e4 0x158
LoadLibraryExW 0x0 0x1003b1d0 0x48ae8 0x476e8 0x3a7
HeapReAlloc 0x0 0x1003b1d4 0x48aec 0x476ec 0x336
GetStringTypeW 0x0 0x1003b1d8 0x48af0 0x476f0 0x2c5
GetConsoleCP 0x0 0x1003b1dc 0x48af4 0x476f4 0x1dc
GetConsoleMode 0x0 0x1003b1e0 0x48af8 0x476f8 0x1ee
SetFilePointerEx 0x0 0x1003b1e4 0x48afc 0x476fc 0x4fd
GetTimeZoneInformation 0x0 0x1003b1e8 0x48b00 0x47700 0x2f9
OutputDebugStringW 0x0 0x1003b1ec 0x48b04 0x47704 0x3fa
SetStdHandle 0x0 0x1003b1f0 0x48b08 0x47708 0x522
WriteConsoleW 0x0 0x1003b1f4 0x48b0c 0x4770c 0x5e0
FlushFileBuffers 0x0 0x1003b1f8 0x48b10 0x47710 0x192
ReadConsoleW 0x0 0x1003b1fc 0x48b14 0x47714 0x44e
lstrcmpW 0x0 0x1003b200 0x48b18 0x47718 0x5ff
GetOEMCP 0x0 0x1003b204 0x48b1c 0x4771c 0x286
GetACP 0x0 0x1003b208 0x48b20 0x47720 0x1a4
IsValidCodePage 0x0 0x1003b20c 0x48b24 0x47724 0x372
CreateSemaphoreW 0x0 0x1003b210 0x48b28 0x47728 0xe1
EncodePointer 0x0 0x1003b214 0x48b2c 0x4772c 0x121
DecodePointer 0x0 0x1003b218 0x48b30 0x47730 0xfe
IsDebuggerPresent 0x0 0x1003b21c 0x48b34 0x47734 0x367
IsProcessorFeaturePresent 0x0 0x1003b220 0x48b38 0x47738 0x36d
RaiseException 0x0 0x1003b224 0x48b3c 0x4773c 0x440
RtlUnwind 0x0 0x1003b228 0x48b40 0x47740 0x4ad
FindFirstFileExW 0x0 0x1003b22c 0x48b44 0x47744 0x16e
SystemTimeToTzSpecificLocalTime 0x0 0x1003b230 0x48b48 0x47748 0x55e
FileTimeToSystemTime 0x0 0x1003b234 0x48b4c 0x4774c 0x15d
SetEnvironmentVariableW 0x0 0x1003b238 0x48b50 0x47750 0x4ee
SetCurrentDirectoryW 0x0 0x1003b23c 0x48b54 0x47754 0x4e3
GetCurrentDirectoryW 0x0 0x1003b240 0x48b58 0x47758 0x203
GetCommandLineA 0x0 0x1003b244 0x48b5c 0x4775c 0x1c8
GetCurrentThreadId 0x0 0x1003b248 0x48b60 0x47760 0x20e
ExitProcess 0x0 0x1003b24c 0x48b64 0x47764 0x151
GetModuleHandleExW 0x0 0x1003b250 0x48b68 0x47768 0x266
AreFileApisANSI 0x0 0x1003b254 0x48b6c 0x4776c 0x1b
MultiByteToWideChar 0x0 0x1003b258 0x48b70 0x47770 0x3d1
HeapSize 0x0 0x1003b25c 0x48b74 0x47774 0x338
UnhandledExceptionFilter 0x0 0x1003b260 0x48b78 0x47778 0x582
SetUnhandledExceptionFilter 0x0 0x1003b264 0x48b7c 0x4777c 0x543
InitializeCriticalSectionAndSpinCount 0x0 0x1003b268 0x48b80 0x47780 0x348
CreateEventW 0x0 0x1003b26c 0x48b84 0x47784 0xb6
Sleep 0x0 0x1003b270 0x48b88 0x47788 0x552
TlsAlloc 0x0 0x1003b274 0x48b8c 0x4778c 0x573
TlsGetValue 0x0 0x1003b278 0x48b90 0x47790 0x575
TlsSetValue 0x0 0x1003b27c 0x48b94 0x47794 0x576
TlsFree 0x0 0x1003b280 0x48b98 0x47798 0x574
GetStartupInfoW 0x0 0x1003b284 0x48b9c 0x4779c 0x2be
GetTickCount 0x0 0x1003b288 0x48ba0 0x477a0 0x2f2
USER32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
wsprintfW 0x0 0x1003b2a0 0x48bb8 0x477b8 0x37b
ADVAPI32.dll (40)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegOpenKeyExW 0x0 0x1003b000 0x48918 0x47518 0x285
RegUnLoadKeyW 0x0 0x1003b004 0x4891c 0x4751c 0x2a5
RegLoadKeyW 0x0 0x1003b008 0x48920 0x47520 0x27e
RegEnumValueW 0x0 0x1003b00c 0x48924 0x47524 0x276
RegEnumKeyW 0x0 0x1003b010 0x48928 0x47528 0x274
RegDeleteValueW 0x0 0x1003b014 0x4892c 0x4752c 0x26c
RegDeleteKeyExW 0x0 0x1003b018 0x48930 0x47530 0x263
RegCreateKeyW 0x0 0x1003b01c 0x48934 0x47534 0x260
ConvertSidToStringSidW 0x0 0x1003b020 0x48938 0x47538 0x7b
CryptDestroyHash 0x0 0x1003b024 0x4893c 0x4753c 0xc6
CryptHashData 0x0 0x1003b028 0x48940 0x47540 0xd8
CryptCreateHash 0x0 0x1003b02c 0x48944 0x47544 0xc3
CryptGetHashParam 0x0 0x1003b030 0x48948 0x47548 0xd4
CryptReleaseContext 0x0 0x1003b034 0x4894c 0x4754c 0xdb
CryptAcquireContextW 0x0 0x1003b038 0x48950 0x47550 0xc1
RegSetValueExW 0x0 0x1003b03c 0x48954 0x47554 0x2a2
RegFlushKey 0x0 0x1003b040 0x48958 0x47558 0x277
RegDeleteKeyW 0x0 0x1003b044 0x4895c 0x4755c 0x268
RegQueryInfoKeyW 0x0 0x1003b048 0x48960 0x47560 0x28c
SetNamedSecurityInfoW 0x0 0x1003b04c 0x48964 0x47564 0x2da
GetNamedSecurityInfoW 0x0 0x1003b050 0x48968 0x47568 0x156
SetEntriesInAclW 0x0 0x1003b054 0x4896c 0x4756c 0x2cf
OpenSCManagerW 0x0 0x1003b058 0x48970 0x47570 0x214
EnumServicesStatusExW 0x0 0x1003b05c 0x48974 0x47574 0x112
CloseServiceHandle 0x0 0x1003b060 0x48978 0x47578 0x65
RegQueryValueExW 0x0 0x1003b064 0x4897c 0x4757c 0x292
RegEnumKeyExW 0x0 0x1003b068 0x48980 0x47580 0x273
RegCreateKeyExW 0x0 0x1003b06c 0x48984 0x47584 0x25d
RegCloseKey 0x0 0x1003b070 0x48988 0x47588 0x254
CreateProcessWithTokenW 0x0 0x1003b074 0x4898c 0x4758c 0x8d
LookupPrivilegeValueW 0x0 0x1003b078 0x48990 0x47590 0x1ad
LookupAccountSidW 0x0 0x1003b07c 0x48994 0x47594 0x1a7
GetTokenInformation 0x0 0x1003b080 0x48998 0x47598 0x16f
FreeSid 0x0 0x1003b084 0x4899c 0x4759c 0x133
EqualSid 0x0 0x1003b088 0x489a0 0x475a0 0x118
DuplicateTokenEx 0x0 0x1003b08c 0x489a4 0x475a4 0xef
AllocateAndInitializeSid 0x0 0x1003b090 0x489a8 0x475a8 0x20
AdjustTokenPrivileges 0x0 0x1003b094 0x489ac 0x475ac 0x1f
OpenProcessToken 0x0 0x1003b098 0x489b0 0x475b0 0x212
CreateProcessAsUserW 0x0 0x1003b09c 0x489b4 0x475b4 0x8b
ole32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoCreateInstance 0x0 0x1003b32c 0x48c44 0x47844 0x1a
CLSIDFromString 0x0 0x1003b330 0x48c48 0x47848 0xc
CoInitializeEx 0x0 0x1003b334 0x48c4c 0x4784c 0x50
Exports (16)
»
Api name EAT Address Ordinal
AddFeature 0x7573 0x5
ApplyUpdates 0x7906 0x9
ApplyUpdatesEx 0x7adf 0xa
ApplyUpdatesExRD 0x7b64 0xe
CreateReaderUserSettings 0x7f6e 0x10
IsBrowserIntegrated 0x8ea6 0x8
MaintenanceRepair 0x9059 0x1
MigrateUserRegistry 0x91e1 0x2
MigrateUserRegistryEx 0x952b 0x3
RemoveFeature 0x99b5 0x6
RemoveUpdates 0x9a30 0xc
RemoveUpdatesEx 0x9c09 0xd
RemoveUpdatesExRD 0x9c8e 0xf
SetupUpdaterForReboot 0xa605 0x4
UpdateCache 0xa80e 0xb
ValidateInstaller 0xa8dd 0x7
Digital Signatures (2)
»
Certificate: Adobe Systems, Incorporated
»
Issued by Adobe Systems, Incorporated
Parent Certificate DigiCert EV Code Signing CA (SHA2)
Country Name US
Valid From 2017-03-10 00:00:00+00:00
Valid Until 2019-03-15 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 68 98 36 42 C9 53 E4 6F 7B DC E4 14 3F 13 3C 1
Thumbprint EA A8 43 CA 28 33 A2 E1 EB ED EB E7 D0 4F 0C A2 B4 D9 73 44
Certificate: DigiCert EV Code Signing CA (SHA2)
»
Issued by DigiCert EV Code Signing CA (SHA2)
Country Name US
Valid From 2012-04-18 12:00:00+00:00
Valid Until 2027-04-18 12:00:00+00:00
Algorithm sha256_rsa
Serial Number 3F 1B 4E 15 F3 A8 2F 11 49 67 8B 3D 7D 84 75 C
Thumbprint 60 EE 3F C5 3D 4B DF D1 69 7A E5 BE AE 1C AB 1C 0F 3A D4 E3
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.004.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 4acb7c16e396c3cc81fc07b3d2f593a4 Copy to Clipboard
SHA1 bb37c50da110c4228ebc5bafb28bb65b843c6a36 Copy to Clipboard
SHA256 3c644554a829c7d065dee33a18648e6a5d3d162bd4c5a90259e5e31520e76a0a Copy to Clipboard
SSDeep 384:gjjXPjf2+09hXQXR3d1SPlQ7Dq5yA9Wgh2bgI9X2v3keNJU++imZog/BOVrx:c/rH0PA1DS9Mul0oydZr+n0Bsl Copy to Clipboard
\\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
...
»
Mime Type application/x-dosexec
File Size 597.36 KB
MD5 ef2a0911642ecc99ca7c72bbd8a78e0b Copy to Clipboard
SHA1 2c6c87e8607963848497aec0b7056c45a784f616 Copy to Clipboard
SHA256 b3238e1831671a21c255ebe1496d938d1d4eff329675574f4d04cbaabfa00ce4 Copy to Clipboard
SSDeep 12288:JKRFuzHCZ3zUF/97tuXhN7S9uaYFLq3OQ:JKRFECZ3zUF/97tuz7S53R Copy to Clipboard
ImpHash f84565a568b3e711c33d913e35aefe49 Copy to Clipboard
PE Information
»
Image Base 0x140000000
Entry Point 0x14002c0c0
Size Of Code 0x30000
Size Of Initialized Data 0x61200
File Type executable
Subsystem windows_gui
Machine Type amd64
Compile Timestamp 2019-01-03 02:02:35+00:00
Version Information (9)
»
InternalName liclua.exe
FileVersion 16.0.11126.20192
CompanyName Microsoft Corporation
LegalTrademarks1 Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2 Windows® is a registered trademark of Microsoft Corporation.
ProductName Office Licensing Admin Access Provider
ProductVersion 16.0.11126.20192
FileDescription Office Licensing Admin Access Provider
OriginalFilename liclua.exe
Sections (7)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x140001000 0x2fe4b 0x30000 0x400 cnt_code, mem_execute, mem_read 6.27
.rdata 0x140031000 0x328c8 0x32a00 0x30400 cnt_initialized_data, mem_read 4.16
.data 0x140064000 0x30f0 0x2e00 0x62e00 cnt_initialized_data, mem_read, mem_write 0.94
.pdata 0x140068000 0x303c 0x3200 0x65c00 cnt_initialized_data, mem_read 5.41
.didat 0x14006c000 0x78 0x200 0x68e00 cnt_initialized_data, mem_read, mem_write 0.78
.rsrc 0x14006d000 0x269fc 0x26a00 0x69000 cnt_initialized_data, mem_read 7.01
.reloc 0x140094000 0x1a60 0x1c00 0x8fa00 cnt_initialized_data, mem_discardable, mem_read 5.37
Imports (12)
»
ADVAPI32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
EventWriteTransfer 0x0 0x140031018 0x54f10 0x54310 0x129
EventRegister 0x0 0x140031020 0x54f18 0x54318 0x121
EventUnregister 0x0 0x140031028 0x54f20 0x54320 0x123
RegOpenKeyExW 0x0 0x140031030 0x54f28 0x54328 0x28c
RegQueryValueExW 0x0 0x140031038 0x54f30 0x54330 0x299
RegCreateKeyExW 0x0 0x140031040 0x54f38 0x54338 0x264
RegGetValueW 0x0 0x140031048 0x54f40 0x54340 0x281
RegCloseKey 0x0 0x140031050 0x54f48 0x54348 0x25b
KERNEL32.dll (65)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
FreeLibrary 0x0 0x140031060 0x54f58 0x54358 0x1b1
LoadLibraryExW 0x0 0x140031068 0x54f60 0x54360 0x3c6
GetModuleHandleW 0x0 0x140031070 0x54f68 0x54368 0x27e
SetErrorMode 0x0 0x140031078 0x54f70 0x54370 0x523
VerSetConditionMask 0x0 0x140031080 0x54f78 0x54378 0x5d0
VerifyVersionInfoW 0x0 0x140031088 0x54f80 0x54380 0x5d4
MultiByteToWideChar 0x0 0x140031090 0x54f88 0x54388 0x3f2
FileTimeToSystemTime 0x0 0x140031098 0x54f90 0x54390 0x170
ReleaseSRWLockShared 0x0 0x1400310a0 0x54f98 0x54398 0x4b7
AcquireSRWLockShared 0x0 0x1400310a8 0x54fa0 0x543a0 0x1
ReleaseSRWLockExclusive 0x0 0x1400310b0 0x54fa8 0x543a8 0x4b6
AcquireSRWLockExclusive 0x0 0x1400310b8 0x54fb0 0x543b0 0x0
InitializeSRWLock 0x0 0x1400310c0 0x54fb8 0x543b8 0x36d
DeleteCriticalSection 0x0 0x1400310c8 0x54fc0 0x543c0 0x111
LeaveCriticalSection 0x0 0x1400310d0 0x54fc8 0x543c8 0x3c0
InitializeCriticalSectionEx 0x0 0x1400310d8 0x54fd0 0x543d0 0x369
EnterCriticalSection 0x0 0x1400310e0 0x54fd8 0x543d8 0x135
FlsAlloc 0x0 0x1400310e8 0x54fe0 0x543e0 0x1a0
TlsAlloc 0x0 0x1400310f0 0x54fe8 0x543e8 0x5ac
FlsFree 0x0 0x1400310f8 0x54ff0 0x543f0 0x1a1
TlsFree 0x0 0x140031100 0x54ff8 0x543f8 0x5ad
FlsGetValue 0x0 0x140031108 0x55000 0x54400 0x1a2
TlsGetValue 0x0 0x140031110 0x55008 0x54408 0x5ae
FlsSetValue 0x0 0x140031118 0x55010 0x54410 0x1a3
TlsSetValue 0x0 0x140031120 0x55018 0x54418 0x5af
GetSystemTimeAsFileTime 0x0 0x140031128 0x55020 0x54420 0x2f0
GetCurrentProcessId 0x0 0x140031130 0x55028 0x54428 0x21e
GetProcAddress 0x0 0x140031138 0x55030 0x54430 0x2b5
CloseHandle 0x0 0x140031140 0x55038 0x54438 0x86
RaiseException 0x0 0x140031148 0x55040 0x54440 0x466
QueryPerformanceCounter 0x0 0x140031150 0x55048 0x54448 0x450
QueryPerformanceFrequency 0x0 0x140031158 0x55050 0x54450 0x451
GetCurrentProcess 0x0 0x140031160 0x55058 0x54458 0x21d
TerminateProcess 0x0 0x140031168 0x55060 0x54460 0x59a
GetModuleFileNameA 0x0 0x140031170 0x55068 0x54468 0x279
GetShortPathNameA 0x0 0x140031178 0x55070 0x54470 0x2d3
GetModuleFileNameW 0x0 0x140031180 0x55078 0x54478 0x27a
FindResourceW 0x0 0x140031188 0x55080 0x54480 0x19c
SizeofResource 0x0 0x140031190 0x55088 0x54488 0x58a
LoadResource 0x0 0x140031198 0x55090 0x54490 0x3ca
IsWow64Process 0x0 0x1400311a0 0x55098 0x54498 0x394
GetProcessHeap 0x0 0x1400311a8 0x550a0 0x544a0 0x2bb
WaitForSingleObjectEx 0x0 0x1400311b0 0x550a8 0x544a8 0x5e7
HeapSetInformation 0x0 0x1400311b8 0x550b0 0x544b0 0x356
LoadLibraryExA 0x0 0x1400311c0 0x550b8 0x544b8 0x3c5
VirtualQuery 0x0 0x1400311c8 0x550c0 0x544c0 0x5dd
VirtualProtect 0x0 0x1400311d0 0x550c8 0x544c8 0x5db
GetSystemInfo 0x0 0x1400311d8 0x550d0 0x544d0 0x2ea
GetStartupInfoW 0x0 0x1400311e0 0x550d8 0x544d8 0x2d7
IsDebuggerPresent 0x0 0x1400311e8 0x550e0 0x544e0 0x382
InitializeSListHead 0x0 0x1400311f0 0x550e8 0x544e8 0x36c
CreateEventW 0x0 0x1400311f8 0x550f0 0x544f0 0xbf
ResetEvent 0x0 0x140031200 0x550f8 0x544f8 0x4ca
SetEvent 0x0 0x140031208 0x55100 0x54500 0x524
IsProcessorFeaturePresent 0x0 0x140031210 0x55108 0x54508 0x389
SetUnhandledExceptionFilter 0x0 0x140031218 0x55110 0x54510 0x57b
UnhandledExceptionFilter 0x0 0x140031220 0x55118 0x54518 0x5bc
RtlVirtualUnwind 0x0 0x140031228 0x55120 0x54520 0x4e1
RtlLookupFunctionEntry 0x0 0x140031230 0x55128 0x54528 0x4da
RtlCaptureContext 0x0 0x140031238 0x55130 0x54530 0x4d3
GetLastError 0x0 0x140031240 0x55138 0x54538 0x267
GetCurrentThreadId 0x0 0x140031248 0x55140 0x54540 0x222
GetModuleHandleExW 0x0 0x140031250 0x55148 0x54548 0x27d
GetTickCount 0x0 0x140031258 0x55150 0x54550 0x30e
WerRegisterMemoryBlock 0x0 0x140031260 0x55158 0x54558 0x5f8
ole32.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
StringFromGUID2 0x0 0x140031270 0x55168 0x54568 0x20c
CoCreateGuid 0x0 0x140031278 0x55170 0x54570 0x2a
CoRegisterClassObject 0x0 0x140031280 0x55178 0x54578 0x76
CoInitializeEx 0x0 0x140031288 0x55180 0x54580 0x61
CoUninitialize 0x0 0x140031290 0x55188 0x54588 0x90
CoRevokeClassObject 0x0 0x140031298 0x55190 0x54590 0x82
VCRUNTIME140.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__C_specific_handler 0x0 0x1400312a8 0x551a0 0x545a0 0x8
__std_exception_destroy 0x0 0x1400312b0 0x551a8 0x545a8 0x22
__std_exception_copy 0x0 0x1400312b8 0x551b0 0x545b0 0x21
memset 0x0 0x1400312c0 0x551b8 0x545b8 0x3e
memmove 0x0 0x1400312c8 0x551c0 0x545c0 0x3d
memcpy 0x0 0x1400312d0 0x551c8 0x545c8 0x3c
__CxxFrameHandler3 0x0 0x1400312d8 0x551d0 0x545d0 0xe
__std_terminate 0x0 0x1400312e0 0x551d8 0x545d8 0x23
__vcrt_InitializeCriticalSectionEx 0x0 0x1400312e8 0x551e0 0x545e0 0x30
_CxxThrowException 0x0 0x1400312f0 0x551e8 0x545e8 0x1
wcsrchr 0x0 0x1400312f8 0x551f0 0x545f0 0x45
memcmp 0x0 0x140031300 0x551f8 0x545f8 0x3b
MSVCP140.dll (50)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
?_Xbad_alloc@std@@YAXXZ 0x0 0x140031310 0x55208 0x54608 0x28b
?_Xlength_error@std@@YAXPEBD@Z 0x0 0x140031318 0x55210 0x54610 0x28e
?_Xout_of_range@std@@YAXPEBD@Z 0x0 0x140031320 0x55218 0x54618 0x28f
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ 0x0 0x140031328 0x55220 0x54620 0x51b
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ 0x0 0x140031330 0x55228 0x54628 0x7d
?_BADOFF@std@@3_JB 0x0 0x140031338 0x55230 0x54630 0x196
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ 0x0 0x140031340 0x55238 0x54638 0x80
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z 0x0 0x140031348 0x55240 0x54640 0x36b
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z 0x0 0x140031350 0x55248 0x54648 0x441
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ 0x0 0x140031358 0x55250 0x54650 0x24a
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ 0x0 0x140031360 0x55258 0x54658 0x89
?uncaught_exceptions@std@@YAHXZ 0x0 0x140031368 0x55260 0x54660 0x51f
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z 0x0 0x140031370 0x55268 0x54668 0x4de
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ 0x0 0x140031378 0x55270 0x54670 0x27f
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ 0x0 0x140031380 0x55278 0x54678 0x228
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ 0x0 0x140031388 0x55280 0x54680 0x4fd
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z 0x0 0x140031390 0x55288 0x54688 0x546
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ 0x0 0x140031398 0x55290 0x54690 0x4d5
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z 0x0 0x1400313a0 0x55298 0x54698 0x543
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z 0x0 0x1400313a8 0x552a0 0x546a0 0x4b5
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z 0x0 0x1400313b0 0x552a8 0x546a8 0x3f6
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z 0x0 0x1400313b8 0x552b0 0x546b0 0x4e1
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ 0x0 0x1400313c0 0x552b8 0x546b8 0x2f
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ 0x0 0x1400313c8 0x552c0 0x546c0 0x244
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ 0x0 0x1400313d0 0x552c8 0x546c8 0x368
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z 0x0 0x1400313d8 0x552d0 0x546d0 0x4c5
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ 0x0 0x1400313e0 0x552d8 0x546d8 0xc
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x0 0x1400313e8 0x552e0 0x546e0 0x13
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z 0x0 0x1400313f0 0x552e8 0x546e8 0x1a6
?__ExceptionPtrCreate@@YAXPEAX@Z 0x0 0x1400313f8 0x552f0 0x546f0 0x297
?__ExceptionPtrDestroy@@YAXPEAX@Z 0x0 0x140031400 0x552f8 0x546f8 0x299
?__ExceptionPtrToBool@@YA_NPEBX@Z 0x0 0x140031408 0x55300 0x54700 0x29c
?__ExceptionPtrRethrow@@YAXPEBX@Z 0x0 0x140031410 0x55308 0x54708 0x29a
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z 0x0 0x140031418 0x55310 0x54710 0x295
?_XGetLastError@std@@YAXXZ 0x0 0x140031420 0x55318 0x54718 0x287
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z 0x0 0x140031428 0x55320 0x54720 0x293
?__ExceptionPtrCurrentException@@YAXPEAX@Z 0x0 0x140031430 0x55328 0x54728 0x298
_Thrd_id 0x0 0x140031438 0x55330 0x54730 0x5b4
_Query_perf_counter 0x0 0x140031440 0x55338 0x54738 0x590
_Query_perf_frequency 0x0 0x140031448 0x55340 0x54740 0x591
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ 0x0 0x140031450 0x55348 0x54748 0x86
?_Xbad_function_call@std@@YAXXZ 0x0 0x140031458 0x55350 0x54750 0x28c
_Thrd_sleep 0x0 0x140031460 0x55358 0x54758 0x5b6
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z 0x0 0x140031468 0x55360 0x54760 0x25
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z 0x0 0x140031470 0x55368 0x54768 0xfe
_Mtx_init_in_situ 0x0 0x140031478 0x55370 0x54770 0x584
_Mtx_destroy_in_situ 0x0 0x140031480 0x55378 0x54778 0x581
_Mtx_lock 0x0 0x140031488 0x55380 0x54780 0x585
?_Throw_C_error@std@@YAXH@Z 0x0 0x140031490 0x55388 0x54788 0x274
_Mtx_unlock 0x0 0x140031498 0x55390 0x54790 0x589
api-ms-win-crt-heap-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_set_new_mode 0x0 0x1400314a8 0x553a0 0x547a0 0x16
free 0x0 0x1400314b0 0x553a8 0x547a8 0x18
malloc 0x0 0x1400314b8 0x553b0 0x547b0 0x19
api-ms-win-crt-stdio-l1-1-0.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__stdio_common_vswprintf_s 0x0 0x1400314c8 0x553c0 0x547c0 0x13
__stdio_common_vswprintf 0x0 0x1400314d0 0x553c8 0x547c8 0x11
__stdio_common_vsnwprintf_s 0x0 0x1400314d8 0x553d0 0x547d0 0xc
_set_fmode 0x0 0x1400314e0 0x553d8 0x547d8 0x54
__p__commode 0x0 0x1400314e8 0x553e0 0x547e0 0x1
api-ms-win-crt-runtime-l1-1-0.dll (19)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_errno 0x0 0x1400314f8 0x553f0 0x547f0 0x21
_invalid_parameter_noinfo 0x0 0x140031500 0x553f8 0x547f8 0x38
_invalid_parameter_noinfo_noreturn 0x0 0x140031508 0x55400 0x54800 0x39
_crt_atexit 0x0 0x140031510 0x55408 0x54808 0x1e
_seh_filter_exe 0x0 0x140031518 0x55410 0x54810 0x40
_register_onexit_function 0x0 0x140031520 0x55418 0x54818 0x3c
_initialize_onexit_table 0x0 0x140031528 0x55420 0x54820 0x34
terminate 0x0 0x140031530 0x55428 0x54828 0x67
_register_thread_local_exe_atexit_callback 0x0 0x140031538 0x55430 0x54830 0x3d
_c_exit 0x0 0x140031540 0x55438 0x54838 0x15
_set_app_type 0x0 0x140031548 0x55440 0x54840 0x42
_cexit 0x0 0x140031550 0x55448 0x54848 0x16
_configure_narrow_argv 0x0 0x140031558 0x55450 0x54850 0x18
_initialize_narrow_environment 0x0 0x140031560 0x55458 0x54858 0x33
_get_narrow_winmain_command_line 0x0 0x140031568 0x55460 0x54860 0x2b
_initterm 0x0 0x140031570 0x55468 0x54868 0x36
_initterm_e 0x0 0x140031578 0x55470 0x54870 0x37
exit 0x0 0x140031580 0x55478 0x54878 0x55
_exit 0x0 0x140031588 0x55480 0x54880 0x23
api-ms-win-crt-string-l1-1-0.dll (10)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strnlen 0x0 0x140031598 0x55490 0x54890 0x91
strncpy_s 0x0 0x1400315a0 0x55498 0x54898 0x90
strcmp 0x0 0x1400315a8 0x554a0 0x548a0 0x86
wcsnlen 0x0 0x1400315b0 0x554a8 0x548a8 0xa9
wcsncpy_s 0x0 0x1400315b8 0x554b0 0x548b0 0xa8
wcscmp 0x0 0x1400315c0 0x554b8 0x548b8 0x9e
_stricmp 0x0 0x1400315c8 0x554c0 0x548c0 0x2a
isdigit 0x0 0x1400315d0 0x554c8 0x548c8 0x68
wcsncat_s 0x0 0x1400315d8 0x554d0 0x548d0 0xa5
wcscpy_s 0x0 0x1400315e0 0x554d8 0x548d8 0xa1
api-ms-win-crt-convert-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wtol 0x0 0x1400315f0 0x554e8 0x548e8 0x4b
api-ms-win-crt-math-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
pow 0x0 0x140031600 0x554f8 0x548f8 0xfe
__setusermatherr 0x0 0x140031608 0x55500 0x54900 0x9
api-ms-win-crt-locale-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_configthreadlocale 0x0 0x140031618 0x55510 0x54910 0x8
__initialize_lconv_for_unsigned_char 0x0 0x140031620 0x55518 0x54918 0x5
Icons (1)
»
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2018-07-12 20:11:19+00:00
Valid Until 2019-07-26 20:11:19+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 B1 DD ED BA 54 E9 65 B8 5F 00 01 00 00 01 B1
Thumbprint 9D C1 78 88 B5 CF AD 98 B3 CB 35 C1 99 4E 96 22 7F 06 16 75
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
\\?\C:\Users\CIiHmnxMn6Ps\Music\uV1Z3 xAZ39J3T.wav id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 48.62 KB
MD5 9a3f28fe7b2aff3bbc15be69352f4a98 Copy to Clipboard
SHA1 0de5678f333470493839c7d9f41ed7afebe61a89 Copy to Clipboard
SHA256 8283b22b02687bcd78a98313073916a43ce05d2caf2f3f90515a9704081403a8 Copy to Clipboard
SSDeep 1536:kWdltjbSJAD2oSPd/WuKMGirwld2bnasl:kaiJK2V/Gig2DR Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\JhZMle5-3.mp3 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 42.50 KB
MD5 d7f637ed1880b126147f9eaab0a50c22 Copy to Clipboard
SHA1 fa7f4dae037a49eec5825bdd0f97c42b1677efd1 Copy to Clipboard
SHA256 cd2fbdd84dac9ce325b88fafdee6255beed4fe1f4e0c25bbc2249912fbb543e9 Copy to Clipboard
SSDeep 768:wJTyVvEI5UlnKedCK6AbjZcp8Raa1P5uxO6KD/V2k8Zg4sk2AVBsl:wJT+nUYedCK6AbdO2d5uxOdJ2kyg4skc Copy to Clipboard
\\?\C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
...
»
Mime Type application/x-dosexec
File Size 418.52 KB
MD5 c381773ac569461f46579b27d0f26644 Copy to Clipboard
SHA1 10ac0f2819c620ac3d072abfde7853ac1a28ff68 Copy to Clipboard
SHA256 e3c03f50b9b0535afc9a6c0472faa038a1a360ce3d55b53246963016c8993aca Copy to Clipboard
SSDeep 12288:MMMAHHiCZvAMt8n25+t/FyjaUmWBNdz7if/GUTsU5YorF:MMMAniCZvAkG77UNx7YGUTNaorF Copy to Clipboard
ImpHash c96f6cde4dc25e8d972c3d2737a245eb Copy to Clipboard
PE Information
»
Image Base 0x400000
Entry Point 0x427311
Size Of Code 0x42000
Size Of Initialized Data 0x27600
File Type executable
Subsystem windows_cui
Machine Type i386
Compile Timestamp 2017-03-15 09:37:58+00:00
Version Information (9)
»
LegalCopyright Copyright © 2017
InternalName Java Update Registration
FileVersion 2.8.131.11
CompanyName Oracle Corporation
Full Version 2.8.131.11
ProductName Java Platform SE Auto Updater
ProductVersion 2.8.131.11
FileDescription Java Update Registration
OriginalFilename jaureg.exe
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x41f89 0x42000 0x400 cnt_code, mem_execute, mem_read 6.63
.rdata 0x443000 0x14048 0x14200 0x42400 cnt_initialized_data, mem_read 5.3
.data 0x458000 0x520c 0x2c00 0x56600 cnt_initialized_data, mem_read, mem_write 4.53
.rsrc 0x45e000 0x7cf0 0x7e00 0x59200 cnt_initialized_data, mem_read 5.99
.reloc 0x466000 0x6146 0x6200 0x61000 cnt_initialized_data, mem_discardable, mem_read 5.2
Imports (8)
»
ole32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
IIDFromString 0x0 0x44326c 0x565f4 0x559f4 0xcd
StringFromGUID2 0x0 0x443270 0x565f8 0x559f8 0x179
SHELL32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHGetFolderPathA 0x0 0x4431ec 0x56574 0x55974 0xbf
SHGetFolderPathW 0x0 0x4431f0 0x56578 0x55978 0xc3
USER32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DispatchMessageW 0x0 0x4431f8 0x56580 0x55980 0xaf
DispatchMessageA 0x0 0x4431fc 0x56584 0x55984 0xae
MsgWaitForMultipleObjectsEx 0x0 0x443200 0x56588 0x55988 0x21d
IsWindowUnicode 0x0 0x443204 0x5658c 0x5598c 0x1df
PeekMessageA 0x0 0x443208 0x56590 0x55990 0x232
TranslateMessage 0x0 0x44320c 0x56594 0x55994 0x2fc
GetMessageW 0x0 0x443210 0x56598 0x55998 0x15d
GetMessageA 0x0 0x443214 0x5659c 0x5599c 0x159
KERNEL32.dll (113)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LocalFree 0x0 0x443018 0x563a0 0x557a0 0x348
LoadLibraryExW 0x0 0x44301c 0x563a4 0x557a4 0x33e
WaitForSingleObject 0x0 0x443020 0x563a8 0x557a8 0x4f9
OpenMutexA 0x0 0x443024 0x563ac 0x557ac 0x37c
GetNativeSystemInfo 0x0 0x443028 0x563b0 0x557b0 0x225
GetCurrentProcess 0x0 0x44302c 0x563b4 0x557b4 0x1c0
GetSystemDirectoryA 0x0 0x443030 0x563b8 0x557b8 0x26f
GetModuleFileNameA 0x0 0x443034 0x563bc 0x557bc 0x213
GetTempPathA 0x0 0x443038 0x563c0 0x557c0 0x284
CreateFileA 0x0 0x44303c 0x563c4 0x557c4 0x88
GetTickCount 0x0 0x443040 0x563c8 0x557c8 0x293
GetFileAttributesA 0x0 0x443044 0x563cc 0x557cc 0x1e5
RemoveDirectoryA 0x0 0x443048 0x563d0 0x557d0 0x400
FindClose 0x0 0x44304c 0x563d4 0x557d4 0x12e
CloseHandle 0x0 0x443050 0x563d8 0x557d8 0x52
DeleteFileA 0x0 0x443054 0x563dc 0x557dc 0xd3
Sleep 0x0 0x443058 0x563e0 0x557e0 0x4b2
FormatMessageW 0x0 0x44305c 0x563e4 0x557e4 0x15e
GetLocalTime 0x0 0x443060 0x563e8 0x557e8 0x203
GetCurrentThreadId 0x0 0x443064 0x563ec 0x557ec 0x1c5
GetCurrentProcessId 0x0 0x443068 0x563f0 0x557f0 0x1c1
PeekNamedPipe 0x0 0x44306c 0x563f4 0x557f4 0x38d
SetHandleInformation 0x0 0x443070 0x563f8 0x557f8 0x470
GetExitCodeProcess 0x0 0x443074 0x563fc 0x557fc 0x1df
CreateProcessA 0x0 0x443078 0x56400 0x55800 0xa4
TerminateProcess 0x0 0x44307c 0x56404 0x55804 0x4c0
ReadFile 0x0 0x443080 0x56408 0x55808 0x3c0
CreatePipe 0x0 0x443084 0x5640c 0x5580c 0xa1
FileTimeToSystemTime 0x0 0x443088 0x56410 0x55810 0x125
MultiByteToWideChar 0x0 0x44308c 0x56414 0x55814 0x367
GetModuleHandleExA 0x0 0x443090 0x56418 0x55818 0x216
FindResourceA 0x0 0x443094 0x5641c 0x5581c 0x14b
LoadResource 0x0 0x443098 0x56420 0x55820 0x341
SizeofResource 0x0 0x44309c 0x56424 0x55824 0x4b1
LockResource 0x0 0x4430a0 0x56428 0x55828 0x354
FreeLibrary 0x0 0x4430a4 0x5642c 0x5582c 0x162
GetModuleHandleExW 0x0 0x4430a8 0x56430 0x55830 0x217
LoadLibraryW 0x0 0x4430ac 0x56434 0x55834 0x33f
GetProcAddress 0x0 0x4430b0 0x56438 0x55838 0x245
InterlockedDecrement 0x0 0x4430b4 0x5643c 0x5583c 0x2eb
CreateFileW 0x0 0x4430b8 0x56440 0x55840 0x8f
SetFilePointerEx 0x0 0x4430bc 0x56444 0x55844 0x467
InitializeCriticalSection 0x0 0x4430c0 0x56448 0x55848 0x2e2
LeaveCriticalSection 0x0 0x4430c4 0x5644c 0x5584c 0x339
EnterCriticalSection 0x0 0x4430c8 0x56450 0x55850 0xee
InterlockedIncrement 0x0 0x4430cc 0x56454 0x55854 0x2ef
InterlockedExchange 0x0 0x4430d0 0x56458 0x55858 0x2ec
GetStringTypeW 0x0 0x4430d4 0x5645c 0x5585c 0x269
EncodePointer 0x0 0x4430d8 0x56460 0x55860 0xea
DecodePointer 0x0 0x4430dc 0x56464 0x55864 0xca
DeleteCriticalSection 0x0 0x4430e0 0x56468 0x55868 0xd1
GetLastError 0x0 0x4430e4 0x5646c 0x5586c 0x202
SetDllDirectoryA 0x0 0x4430e8 0x56470 0x55870 0x450
HeapSize 0x0 0x4430ec 0x56474 0x55874 0x2d4
SetFilePointer 0x0 0x4430f0 0x56478 0x55878 0x466
SetEndOfFile 0x0 0x4430f4 0x5647c 0x5587c 0x453
GetProcessHeap 0x0 0x4430f8 0x56480 0x55880 0x24a
WriteConsoleW 0x0 0x4430fc 0x56484 0x55884 0x524
GetACP 0x0 0x443100 0x56488 0x55888 0x168
GetOEMCP 0x0 0x443104 0x5648c 0x5588c 0x237
IsValidCodePage 0x0 0x443108 0x56490 0x55890 0x30a
GetLocaleInfoW 0x0 0x44310c 0x56494 0x55894 0x206
FindFirstFileExW 0x0 0x443110 0x56498 0x55898 0x134
FlushFileBuffers 0x0 0x443114 0x5649c 0x5589c 0x157
GetCurrentDirectoryW 0x0 0x443118 0x564a0 0x558a0 0x1bf
GetFileInformationByHandle 0x0 0x44311c 0x564a4 0x558a4 0x1ec
GetUserDefaultLCID 0x0 0x443120 0x564a8 0x558a8 0x29b
GetLocaleInfoA 0x0 0x443124 0x564ac 0x558ac 0x204
EnumSystemLocalesA 0x0 0x443128 0x564b0 0x558b0 0x10d
IsValidLocale 0x0 0x44312c 0x564b4 0x558b4 0x30c
GetTimeZoneInformation 0x0 0x443130 0x564b8 0x558b8 0x298
CompareStringW 0x0 0x443134 0x564bc 0x558bc 0x64
SetEnvironmentVariableA 0x0 0x443138 0x564c0 0x558c0 0x456
GetDriveTypeW 0x0 0x44313c 0x564c4 0x558c4 0x1d3
FileTimeToLocalFileTime 0x0 0x443140 0x564c8 0x558c8 0x124
GetFullPathNameW 0x0 0x443144 0x564cc 0x558cc 0x1fb
CreateDirectoryW 0x0 0x443148 0x564d0 0x558d0 0x81
QueryPerformanceCounter 0x0 0x44314c 0x564d4 0x558d4 0x3a7
GetStartupInfoW 0x0 0x443150 0x564d8 0x558d8 0x263
SetHandleCount 0x0 0x443154 0x564dc 0x558dc 0x46f
SetStdHandle 0x0 0x443158 0x564e0 0x558e0 0x487
InitializeCriticalSectionAndSpinCount 0x0 0x44315c 0x564e4 0x558e4 0x2e3
HeapAlloc 0x0 0x443160 0x564e8 0x558e8 0x2cb
WideCharToMultiByte 0x0 0x443164 0x564ec 0x558ec 0x511
GetEnvironmentStringsW 0x0 0x443168 0x564f0 0x558f0 0x1da
FreeEnvironmentStringsW 0x0 0x44316c 0x564f4 0x558f4 0x161
GetModuleFileNameW 0x0 0x443170 0x564f8 0x558f8 0x214
GetStdHandle 0x0 0x443174 0x564fc 0x558fc 0x264
ExitProcess 0x0 0x443178 0x56500 0x55900 0x119
SetLastError 0x0 0x44317c 0x56504 0x55904 0x473
GetModuleHandleW 0x0 0x443180 0x56508 0x55908 0x218
TlsFree 0x0 0x443184 0x5650c 0x5590c 0x4c6
TlsSetValue 0x0 0x443188 0x56510 0x55910 0x4c8
TlsGetValue 0x0 0x44318c 0x56514 0x55914 0x4c7
TlsAlloc 0x0 0x443190 0x56518 0x55918 0x4c5
HeapCreate 0x0 0x443194 0x5651c 0x5591c 0x2cd
IsProcessorFeaturePresent 0x0 0x443198 0x56520 0x55920 0x304
IsDebuggerPresent 0x0 0x44319c 0x56524 0x55924 0x300
SetUnhandledExceptionFilter 0x0 0x4431a0 0x56528 0x55928 0x4a5
UnhandledExceptionFilter 0x0 0x4431a4 0x5652c 0x5592c 0x4d3
LCMapStringW 0x0 0x4431a8 0x56530 0x55930 0x32d
RtlUnwind 0x0 0x4431ac 0x56534 0x55934 0x418
RaiseException 0x0 0x4431b0 0x56538 0x55938 0x3b1
GetCPInfo 0x0 0x4431b4 0x5653c 0x5593c 0x172
HeapFree 0x0 0x4431b8 0x56540 0x55940 0x2cf
GetCommandLineA 0x0 0x4431bc 0x56544 0x55944 0x186
HeapSetInformation 0x0 0x4431c0 0x56548 0x55948 0x2d3
GetSystemTimeAsFileTime 0x0 0x4431c4 0x5654c 0x5594c 0x279
GetFileType 0x0 0x4431c8 0x56550 0x55950 0x1f3
WriteFile 0x0 0x4431cc 0x56554 0x55954 0x525
GetConsoleCP 0x0 0x4431d0 0x56558 0x55958 0x19a
GetConsoleMode 0x0 0x4431d4 0x5655c 0x5595c 0x1ac
HeapReAlloc 0x0 0x4431d8 0x56560 0x55960 0x2d2
ADVAPI32.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegQueryValueExA 0x0 0x443000 0x56388 0x55788 0x26d
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x0 0x443004 0x5638c 0x5578c 0x72
RegCloseKey 0x0 0x443008 0x56390 0x55790 0x230
RegOpenKeyExA 0x0 0x44300c 0x56394 0x55794 0x260
RegCreateKeyExA 0x0 0x443010 0x56398 0x55798 0x238
OLEAUT32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetErrorInfo 0xc8 0x4431e0 0x56568 0x55968 -
SysFreeString 0x6 0x4431e4 0x5656c 0x5596c -
msi.dll (15)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
(by ordinal) 0x5b 0x44322c 0x565b4 0x559b4 -
(by ordinal) 0x75 0x443230 0x565b8 0x559b8 -
(by ordinal) 0x8d 0x443234 0x565bc 0x559bc -
(by ordinal) 0xa8 0x443238 0x565c0 0x559c0 -
(by ordinal) 0xbd 0x44323c 0x565c4 0x559c4 -
(by ordinal) 0x9e 0x443240 0x565c8 0x559c8 -
(by ordinal) 0x73 0x443244 0x565cc 0x559cc -
(by ordinal) 0x9f 0x443248 0x565d0 0x559d0 -
(by ordinal) 0x43 0x44324c 0x565d4 0x559d4 -
(by ordinal) 0x1f 0x443250 0x565d8 0x559d8 -
(by ordinal) 0x89 0x443254 0x565dc 0x559dc -
(by ordinal) 0xa0 0x443258 0x565e0 0x559e0 -
(by ordinal) 0x8 0x44325c 0x565e4 0x559e4 -
(by ordinal) 0x2c 0x443260 0x565e8 0x559e8 -
(by ordinal) 0xcc 0x443264 0x565ec 0x559ec -
VERSION.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VerQueryValueW 0x0 0x44321c 0x565a4 0x559a4 0xe
GetFileVersionInfoA 0x0 0x443220 0x565a8 0x559a8 0x0
GetFileVersionInfoSizeA 0x0 0x443224 0x565ac 0x559ac 0x3
Icons (1)
»
Digital Signatures (2)
»
Certificate: Oracle America, Inc.
»
Issued by Oracle America, Inc.
Parent Certificate Symantec Class 3 SHA256 Code Signing CA
Country Name US
Valid From 2015-04-14 00:00:00+00:00
Valid Until 2018-04-13 23:59:59+00:00
Algorithm sha256_rsa
Serial Number 12 F0 27 7E 0F 23 3B 39 F9 41 9B 06 E8 CD E3 52
Thumbprint 3B 75 81 6D 15 A6 D8 F4 59 8E 9C F5 60 3F 18 39 EE 84 D7 3D
Certificate: Symantec Class 3 SHA256 Code Signing CA
»
Issued by Symantec Class 3 SHA256 Code Signing CA
Country Name US
Valid From 2013-12-10 00:00:00+00:00
Valid Until 2023-12-09 23:59:59+00:00
Algorithm sha256_rsa
Serial Number 3D 78 D7 F9 76 49 60 B2 61 7D F4 F0 1E CA 86 2A
Thumbprint 00 77 90 F6 56 1D AD 89 B0 BC D8 55 85 76 24 95 E3 58 F8 A5
\\?\C:\Users\Public\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 7f99956664481dba53284c5743094574 Copy to Clipboard
SHA1 3dce1f456b1ba0da82d9d4670a2874d169b77505 Copy to Clipboard
SHA256 cd33ba128000efeaeca36c74d9c737ec8aadee87c229f3105f2b0086e17eadc3 Copy to Clipboard
SSDeep 48:ISqaQaSPvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:kaSPvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\OneDrive\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
...
»
Mime Type application/octet-stream
File Size 1.60 KB
MD5 96f3532b2e150f61b8c18cccc181f0a8 Copy to Clipboard
SHA1 8e427f9473a7615e23587dbd332a84101f9f6f6d Copy to Clipboard
SHA256 cba197211dac0728b7918f1afe156745455f448421c453e4b6d180b3d348aee3 Copy to Clipboard
SSDeep 48:iq5g+wvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:iquvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image