7a616846...55ad | Files
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Riskware, Dropper, Trojan, Ransomware

7a61684657c789eafc051d7107f6a0917e86f92cecaa108e4ba3f08d631c55ad (SHA256)

CRYPT.EXE

Windows Exe (x86-32)

Created at 2019-01-19 16:50:00

Notifications (2/3)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "1 minute, 30 seconds" to "30 seconds" to reveal dormant functionality.

The operating system was rebooted during the analysis.

Remarks

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Filters:
Filename Category Type Severity Actions
C:\Users\CIiHmnxMn6Ps\Desktop\CRYPT.EXE Sample File Binary
Blacklisted
»
Also Known As C:\windows\searchfiles.exe (Created File)
Mime Type application/x-dosexec
File Size 12.00 KB
MD5 6184d75ab9ac2df542261f166460400b Copy to Clipboard
SHA1 51fda63da594cfc84931209775185e63bb9afd4b Copy to Clipboard
SHA256 7a61684657c789eafc051d7107f6a0917e86f92cecaa108e4ba3f08d631c55ad Copy to Clipboard
SSDeep 192:vRf4VFgG/7KoX8zyHgND68C6enatK9I45c2PuKAxywCMrpY7S8LqPZo5LdCfuR15:Jf4VFgM+oXCJND683eag9xCqAxyr6+SE Copy to Clipboard
ImpHash c25a63f1cb283b9f6549cb252d84bb68 Copy to Clipboard
File Reputation Information
»
Severity
Blacklisted
First Seen 2018-12-22 03:06 (UTC+1)
Last Seen 2019-01-03 04:39 (UTC+1)
Names Win32.Trojan.Filecoder
Families Filecoder
Classification Trojan
PE Information
»
Image Base 0x400000
Entry Point 0x405001
Size Of Code 0x1000
Size Of Initialized Data 0x1c00
File Type executable
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2018-12-07 11:32:14+00:00
Packer ASPack v2.12 -> Alexey Solodovnikov
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x1000 0x800 0x400 cnt_initialized_data, mem_read, mem_write 7.86
.rdata 0x402000 0x1000 0x400 0xc00 cnt_initialized_data, mem_read, mem_write 7.19
.data 0x403000 0x2000 0xe00 0x1000 cnt_initialized_data, mem_read, mem_write 7.9
.UPX 0x405000 0x2000 0x1200 0x1e00 cnt_initialized_data, mem_read, mem_write 5.69
.adata 0x407000 0x1000 0x0 0x3000 cnt_initialized_data, mem_read, mem_write 0.0
Imports (4)
»
kernel32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetProcAddress 0x0 0x405f5c 0x5f5c 0x2d5c 0x0
GetModuleHandleA 0x0 0x405f60 0x5f60 0x2d60 0x0
LoadLibraryA 0x0 0x405f64 0x5f64 0x2d64 0x0
shell32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHChangeNotify 0x0 0x406031 0x6031 0x2e31 0x0
advapi32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegOpenKeyExA 0x0 0x406039 0x6039 0x2e39 0x0
mpr.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
WNetOpenEnumA 0x0 0x406041 0x6041 0x2e41 0x0
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll id-Br3n0G72wUb8CejT.LyaS Created File Binary
Whitelisted
»
Mime Type application/x-dosexec
File Size 780.83 KB
MD5 1fc6060e2b7da45e4e9fb7f3e75adc0a Copy to Clipboard
SHA1 4cb47eb40457945d2e8f56471192a387c2dd0369 Copy to Clipboard
SHA256 92da58f32e8468c86b830d88914e872558e8a6bc6d430f8cd1cf4236c8a32d51 Copy to Clipboard
SSDeep 12288:Gsqbw+mQAhpsnL8vwCjdLkW0wxxymyYbPvvzEFtqc3KRGwZH:hhQqgLawAdLbfx1hvvgFwHGwZH Copy to Clipboard
ImpHash f8115427f66dee9021c2d21b9ab61b46 Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
First Seen 2013-01-08 18:40 (UTC+1)
Last Seen 2018-10-29 03:40 (UTC+1)
PE Information
»
Image Base 0x10000000
Entry Point 0x1005c82b
Size Of Code 0xa7400
Size Of Initialized Data 0x1ca00
File Type dll
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2011-02-19 02:26:29+00:00
Version Information (8)
»
LegalCopyright © Microsoft Corporation. All rights reserved.
InternalName MSDIA100.DLL
FileVersion 10.00.40219.01 built by: SP1Rel
CompanyName Microsoft Corporation
ProductName Microsoft® Visual Studio® 2010
ProductVersion 10.00.40219.01
FileDescription Microsoft® Debug Information Accessor
OriginalFilename MSDIA100.DLL
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xa73b3 0xa7400 0x400 cnt_code, mem_execute, mem_read 6.41
.data 0x100a9000 0x4b18 0x2600 0xa7800 cnt_initialized_data, mem_read, mem_write 2.3
.rsrc 0x100ae000 0xbe80 0xc000 0xa9e00 cnt_initialized_data, mem_read 4.76
.reloc 0x100ba000 0xbdce 0xbe00 0xb5e00 cnt_initialized_data, mem_discardable, mem_read 5.26
Imports (1)
»
KERNEL32.dll (98)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetLastError 0x0 0x10001000 0xa7a40 0xa6e40 0x473
InterlockedDecrement 0x0 0x10001004 0xa7a44 0xa6e44 0x2eb
InterlockedIncrement 0x0 0x10001008 0xa7a48 0xa6e48 0x2ef
FindResourceW 0x0 0x1000100c 0xa7a4c 0xa6e4c 0x14e
LoadResource 0x0 0x10001010 0xa7a50 0xa6e50 0x341
LockResource 0x0 0x10001014 0xa7a54 0xa6e54 0x354
SizeofResource 0x0 0x10001018 0xa7a58 0xa6e58 0x4b1
MultiByteToWideChar 0x0 0x1000101c 0xa7a5c 0xa6e5c 0x367
LocalAlloc 0x0 0x10001020 0xa7a60 0xa6e60 0x344
LocalFree 0x0 0x10001024 0xa7a64 0xa6e64 0x348
GetModuleFileNameW 0x0 0x10001028 0xa7a68 0xa6e68 0x214
GetLastError 0x0 0x1000102c 0xa7a6c 0xa6e6c 0x202
GetSystemInfo 0x0 0x10001030 0xa7a70 0xa6e70 0x273
GetVersion 0x0 0x10001034 0xa7a74 0xa6e74 0x2a2
EnterCriticalSection 0x0 0x10001038 0xa7a78 0xa6e78 0xee
LeaveCriticalSection 0x0 0x1000103c 0xa7a7c 0xa6e7c 0x339
LCMapStringW 0x0 0x10001040 0xa7a80 0xa6e80 0x32d
InitializeCriticalSection 0x0 0x10001044 0xa7a84 0xa6e84 0x2e2
DeleteCriticalSection 0x0 0x10001048 0xa7a88 0xa6e88 0xd1
CreateFileW 0x0 0x1000104c 0xa7a8c 0xa6e8c 0x8f
GetFileSize 0x0 0x10001050 0xa7a90 0xa6e90 0x1f0
CreateFileMappingW 0x0 0x10001054 0xa7a94 0xa6e94 0x8c
MapViewOfFile 0x0 0x10001058 0xa7a98 0xa6e98 0x357
CloseHandle 0x0 0x1000105c 0xa7a9c 0xa6e9c 0x52
UnmapViewOfFile 0x0 0x10001060 0xa7aa0 0xa6ea0 0x4d6
GetProcAddress 0x0 0x10001064 0xa7aa4 0xa6ea4 0x245
FreeLibrary 0x0 0x10001068 0xa7aa8 0xa6ea8 0x162
InterlockedExchange 0x0 0x1000106c 0xa7aac 0xa6eac 0x2ec
LoadLibraryA 0x0 0x10001070 0xa7ab0 0xa6eb0 0x33c
RaiseException 0x0 0x10001074 0xa7ab4 0xa6eb4 0x3b1
GetCurrentThreadId 0x0 0x10001078 0xa7ab8 0xa6eb8 0x1c5
DecodePointer 0x0 0x1000107c 0xa7abc 0xa6ebc 0xca
GetCommandLineA 0x0 0x10001080 0xa7ac0 0xa6ec0 0x186
EncodePointer 0x0 0x10001084 0xa7ac4 0xa6ec4 0xea
HeapFree 0x0 0x10001088 0xa7ac8 0xa6ec8 0x2cf
HeapAlloc 0x0 0x1000108c 0xa7acc 0xa6ecc 0x2cb
TlsAlloc 0x0 0x10001090 0xa7ad0 0xa6ed0 0x4c5
TlsGetValue 0x0 0x10001094 0xa7ad4 0xa6ed4 0x4c7
TlsSetValue 0x0 0x10001098 0xa7ad8 0xa6ed8 0x4c8
TlsFree 0x0 0x1000109c 0xa7adc 0xa6edc 0x4c6
GetModuleHandleW 0x0 0x100010a0 0xa7ae0 0xa6ee0 0x218
Sleep 0x0 0x100010a4 0xa7ae4 0xa6ee4 0x4b2
ExitProcess 0x0 0x100010a8 0xa7ae8 0xa6ee8 0x119
SetHandleCount 0x0 0x100010ac 0xa7aec 0xa6eec 0x46f
GetStdHandle 0x0 0x100010b0 0xa7af0 0xa6ef0 0x264
InitializeCriticalSectionAndSpinCount 0x0 0x100010b4 0xa7af4 0xa6ef4 0x2e3
GetFileType 0x0 0x100010b8 0xa7af8 0xa6ef8 0x1f3
GetStartupInfoW 0x0 0x100010bc 0xa7afc 0xa6efc 0x263
GetModuleFileNameA 0x0 0x100010c0 0xa7b00 0xa6f00 0x213
FreeEnvironmentStringsW 0x0 0x100010c4 0xa7b04 0xa6f04 0x161
WideCharToMultiByte 0x0 0x100010c8 0xa7b08 0xa6f08 0x511
GetEnvironmentStringsW 0x0 0x100010cc 0xa7b0c 0xa6f0c 0x1da
HeapCreate 0x0 0x100010d0 0xa7b10 0xa6f10 0x2cd
HeapDestroy 0x0 0x100010d4 0xa7b14 0xa6f14 0x2ce
QueryPerformanceCounter 0x0 0x100010d8 0xa7b18 0xa6f18 0x3a7
GetTickCount 0x0 0x100010dc 0xa7b1c 0xa6f1c 0x293
GetCurrentProcessId 0x0 0x100010e0 0xa7b20 0xa6f20 0x1c1
GetSystemTimeAsFileTime 0x0 0x100010e4 0xa7b24 0xa6f24 0x279
TerminateProcess 0x0 0x100010e8 0xa7b28 0xa6f28 0x4c0
GetCurrentProcess 0x0 0x100010ec 0xa7b2c 0xa6f2c 0x1c0
UnhandledExceptionFilter 0x0 0x100010f0 0xa7b30 0xa6f30 0x4d3
SetUnhandledExceptionFilter 0x0 0x100010f4 0xa7b34 0xa6f34 0x4a5
IsDebuggerPresent 0x0 0x100010f8 0xa7b38 0xa6f38 0x300
WriteFile 0x0 0x100010fc 0xa7b3c 0xa6f3c 0x525
GetCPInfo 0x0 0x10001100 0xa7b40 0xa6f40 0x172
GetACP 0x0 0x10001104 0xa7b44 0xa6f44 0x168
GetOEMCP 0x0 0x10001108 0xa7b48 0xa6f48 0x237
IsValidCodePage 0x0 0x1000110c 0xa7b4c 0xa6f4c 0x30a
GetStringTypeW 0x0 0x10001110 0xa7b50 0xa6f50 0x269
HeapSize 0x0 0x10001114 0xa7b54 0xa6f54 0x2d4
IsProcessorFeaturePresent 0x0 0x10001118 0xa7b58 0xa6f58 0x304
SetFilePointer 0x0 0x1000111c 0xa7b5c 0xa6f5c 0x466
ReadFile 0x0 0x10001120 0xa7b60 0xa6f60 0x3c0
RtlUnwind 0x0 0x10001124 0xa7b64 0xa6f64 0x418
HeapReAlloc 0x0 0x10001128 0xa7b68 0xa6f68 0x2d2
LoadLibraryW 0x0 0x1000112c 0xa7b6c 0xa6f6c 0x33f
GetConsoleCP 0x0 0x10001130 0xa7b70 0xa6f70 0x19a
GetConsoleMode 0x0 0x10001134 0xa7b74 0xa6f74 0x1ac
SetStdHandle 0x0 0x10001138 0xa7b78 0xa6f78 0x487
FlushFileBuffers 0x0 0x1000113c 0xa7b7c 0xa6f7c 0x157
WriteConsoleW 0x0 0x10001140 0xa7b80 0xa6f80 0x524
SetEndOfFile 0x0 0x10001144 0xa7b84 0xa6f84 0x453
GetProcessHeap 0x0 0x10001148 0xa7b88 0xa6f88 0x24a
SetFileAttributesW 0x0 0x1000114c 0xa7b8c 0xa6f8c 0x461
GetFileAttributesW 0x0 0x10001150 0xa7b90 0xa6f90 0x1ea
CopyFileW 0x0 0x10001154 0xa7b94 0xa6f94 0x75
VirtualAlloc 0x0 0x10001158 0xa7b98 0xa6f98 0x4e9
VirtualFree 0x0 0x1000115c 0xa7b9c 0xa6f9c 0x4ec
DeleteFileW 0x0 0x10001160 0xa7ba0 0xa6fa0 0xd6
DeviceIoControl 0x0 0x10001164 0xa7ba4 0xa6fa4 0xdd
GetCurrentDirectoryW 0x0 0x10001168 0xa7ba8 0xa6fa8 0x1bf
ExpandEnvironmentStringsW 0x0 0x1000116c 0xa7bac 0xa6fac 0x11d
GetDriveTypeW 0x0 0x10001170 0xa7bb0 0xa6fb0 0x1d3
MapViewOfFileEx 0x0 0x10001174 0xa7bb4 0xa6fb4 0x358
FlushViewOfFile 0x0 0x10001178 0xa7bb8 0xa6fb8 0x15a
GetFullPathNameW 0x0 0x1000117c 0xa7bbc 0xa6fbc 0x1fb
CompareStringW 0x0 0x10001180 0xa7bc0 0xa6fc0 0x64
SetEnvironmentVariableW 0x0 0x10001184 0xa7bc4 0xa6fc4 0x457
Exports (6)
»
Api name EAT Address Ordinal
DllCanUnloadNow 0x13be0 0x1
DllGetClassObject 0x14060 0x2
DllRegisterServer 0x13e30 0x3
DllUnregisterServer 0x13f90 0x4
VSDllRegisterServer 0x13df0 0x5
VSDllUnregisterServer 0x13e10 0x6
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2009-12-07 22:40:29+00:00
Valid Until 2011-03-07 22:40:29+00:00
Algorithm sha1_rsa
Serial Number 61 01 CF 3E 00 00 00 00 00 0F
Thumbprint 96 17 09 4A 1C FB 59 AE 7C 1F 7D FD B6 73 9E 4E 7C 40 50 8F
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2007-08-22 22:31:02+00:00
Valid Until 2012-08-25 07:00:00+00:00
Algorithm sha1_rsa
Serial Number 2E AB 11 DC 50 FF 5C 9D CB C0
Thumbprint 30 36 E3 B2 5B 88 A5 5B 86 FC 90 E6 E9 EA AD 50 81 44 51 66
\\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll id-Br3n0G72wUb8CejT.LyaS Created File Binary
Whitelisted
»
Mime Type application/x-dosexec
File Size 162.64 KB
MD5 8caaade246143a3bd3b3b3ba68116b75 Copy to Clipboard
SHA1 536436a0f3eaddbc9195d2e9b3ae7fde172bc85f Copy to Clipboard
SHA256 592e63d9994b528a76e2ac9e84c42b5f42ad284e58fe714ab29d5156313d2ff5 Copy to Clipboard
SSDeep 3072:5/71j9gfwJTxt+TqXBYOmk2qNh0eQxUW3Dj9f9:j5gfQTUKBYxkBYDjP Copy to Clipboard
ImpHash f22e30d20d746fd7cd683035da055a51 Copy to Clipboard
File Reputation Information
»
Severity
Whitelisted
First Seen 2018-05-26 19:19 (UTC+2)
Last Seen 2018-07-17 17:58 (UTC+2)
PE Information
»
Image Base 0x43000000
Entry Point 0x4300f754
Size Of Code 0x18600
Size Of Initialized Data 0xfa00
File Type dll
Subsystem windows_cui
Machine Type amd64
Compile Timestamp 2017-12-22 05:08:06+00:00
Version Information (8)
»
LegalCopyright © Microsoft Corporation. All rights reserved.
InternalName vstoee.dll
FileVersion 10.0.60828.0 built by: VSTO_Rel
CompanyName Microsoft Corporation
ProductName Microsoft® Visual Studio® 2010
ProductVersion 10.0.60828.0
FileDescription Visual Studio Tools for Office Execution Engine
OriginalFilename vstoee.dll
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x43001000 0x185d6 0x18600 0x400 cnt_code, mem_execute, mem_read 6.3
.rdata 0x4301a000 0x9613 0x9800 0x18a00 cnt_initialized_data, mem_read 4.44
.data 0x43024000 0x25f8 0x1200 0x22200 cnt_initialized_data, mem_read, mem_write 2.51
.pdata 0x43027000 0x1620 0x1800 0x23400 cnt_initialized_data, mem_read 4.95
.rsrc 0x43029000 0x1a70 0x1c00 0x24c00 cnt_initialized_data, mem_read 5.03
.reloc 0x4302b000 0x656 0x800 0x26800 cnt_initialized_data, mem_discardable, mem_read 3.24
Imports (8)
»
ADVAPI32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegCloseKey 0x0 0x4301a000 0x229d0 0x213d0 0x230
RegOpenKeyExW 0x0 0x4301a008 0x229d8 0x213d8 0x261
RegQueryValueExW 0x0 0x4301a010 0x229e0 0x213e0 0x26e
RegCreateKeyExW 0x0 0x4301a018 0x229e8 0x213e8 0x239
RegDeleteKeyW 0x0 0x4301a020 0x229f0 0x213f0 0x244
RegDeleteValueW 0x0 0x4301a028 0x229f8 0x213f8 0x248
RegSetValueExW 0x0 0x4301a030 0x22a00 0x21400 0x27e
RegEnumKeyExW 0x0 0x4301a038 0x22a08 0x21408 0x24f
KERNEL32.dll (72)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetProcAddress 0x0 0x4301a048 0x22a18 0x21418 0x24c
LoadLibraryW 0x0 0x4301a050 0x22a20 0x21420 0x341
FreeLibrary 0x0 0x4301a058 0x22a28 0x21428 0x168
GetModuleHandleW 0x0 0x4301a060 0x22a30 0x21430 0x21e
MultiByteToWideChar 0x0 0x4301a068 0x22a38 0x21438 0x369
CreateProcessW 0x0 0x4301a070 0x22a40 0x21440 0xa8
GetLastError 0x0 0x4301a078 0x22a48 0x21448 0x208
CloseHandle 0x0 0x4301a080 0x22a50 0x21450 0x52
GetVersionExW 0x0 0x4301a088 0x22a58 0x21458 0x2ac
CreateMutexW 0x0 0x4301a090 0x22a60 0x21460 0x9e
CreateEventW 0x0 0x4301a098 0x22a68 0x21468 0x85
CreateSemaphoreW 0x0 0x4301a0a0 0x22a70 0x21470 0xae
WaitForSingleObject 0x0 0x4301a0a8 0x22a78 0x21478 0x508
SetEvent 0x0 0x4301a0b0 0x22a80 0x21480 0x467
ResetEvent 0x0 0x4301a0b8 0x22a88 0x21488 0x412
WaitForMultipleObjects 0x0 0x4301a0c0 0x22a90 0x21490 0x506
ReleaseSemaphore 0x0 0x4301a0c8 0x22a98 0x21498 0x401
ReleaseMutex 0x0 0x4301a0d0 0x22aa0 0x214a0 0x3fd
InitializeCriticalSectionAndSpinCount 0x0 0x4301a0d8 0x22aa8 0x214a8 0x2eb
DeleteCriticalSection 0x0 0x4301a0e0 0x22ab0 0x214b0 0xd2
EnterCriticalSection 0x0 0x4301a0e8 0x22ab8 0x214b8 0xf2
LeaveCriticalSection 0x0 0x4301a0f0 0x22ac0 0x214c0 0x33b
GetCurrentThreadId 0x0 0x4301a0f8 0x22ac8 0x214c8 0x1cb
SetLastError 0x0 0x4301a100 0x22ad0 0x214d0 0x480
GetModuleFileNameW 0x0 0x4301a108 0x22ad8 0x214d8 0x21a
GetCPInfo 0x0 0x4301a110 0x22ae0 0x214e0 0x178
LCMapStringW 0x0 0x4301a118 0x22ae8 0x214e8 0x32f
HeapReAlloc 0x0 0x4301a120 0x22af0 0x214f0 0x2da
WriteFile 0x0 0x4301a128 0x22af8 0x214f8 0x534
GetStringTypeW 0x0 0x4301a130 0x22b00 0x21500 0x270
RtlPcToFileHeader 0x0 0x4301a138 0x22b08 0x21508 0x421
RtlCaptureContext 0x0 0x4301a140 0x22b10 0x21510 0x418
GetACP 0x0 0x4301a148 0x22b18 0x21518 0x16e
RtlLookupFunctionEntry 0x0 0x4301a150 0x22b20 0x21520 0x41f
RtlVirtualUnwind 0x0 0x4301a158 0x22b28 0x21528 0x426
IsDebuggerPresent 0x0 0x4301a160 0x22b30 0x21530 0x302
SetUnhandledExceptionFilter 0x0 0x4301a168 0x22b38 0x21538 0x4b3
UnhandledExceptionFilter 0x0 0x4301a170 0x22b40 0x21540 0x4e2
RaiseException 0x0 0x4301a178 0x22b48 0x21548 0x3b4
HeapAlloc 0x0 0x4301a180 0x22b50 0x21550 0x2d3
HeapSize 0x0 0x4301a188 0x22b58 0x21558 0x2dc
IsValidCodePage 0x0 0x4301a190 0x22b60 0x21560 0x30c
GetCurrentProcess 0x0 0x4301a198 0x22b68 0x21568 0x1c6
GetOEMCP 0x0 0x4301a1a0 0x22b70 0x21570 0x23e
FlsSetValue 0x0 0x4301a1a8 0x22b78 0x21578 0x15b
GetCommandLineA 0x0 0x4301a1b0 0x22b80 0x21580 0x18c
EncodePointer 0x0 0x4301a1b8 0x22b88 0x21588 0xee
DecodePointer 0x0 0x4301a1c0 0x22b90 0x21590 0xcb
RtlUnwindEx 0x0 0x4301a1c8 0x22b98 0x21598 0x425
FlsGetValue 0x0 0x4301a1d0 0x22ba0 0x215a0 0x15a
FlsFree 0x0 0x4301a1d8 0x22ba8 0x215a8 0x159
FlsAlloc 0x0 0x4301a1e0 0x22bb0 0x215b0 0x158
HeapFree 0x0 0x4301a1e8 0x22bb8 0x215b8 0x2d7
Sleep 0x0 0x4301a1f0 0x22bc0 0x215c0 0x4c0
ExitProcess 0x0 0x4301a1f8 0x22bc8 0x215c8 0x11f
SetHandleCount 0x0 0x4301a200 0x22bd0 0x215d0 0x47c
GetStdHandle 0x0 0x4301a208 0x22bd8 0x215d8 0x26b
GetFileType 0x0 0x4301a210 0x22be0 0x215e0 0x1fa
GetStartupInfoW 0x0 0x4301a218 0x22be8 0x215e8 0x26a
GetModuleFileNameA 0x0 0x4301a220 0x22bf0 0x215f0 0x219
FreeEnvironmentStringsW 0x0 0x4301a228 0x22bf8 0x215f8 0x167
WideCharToMultiByte 0x0 0x4301a230 0x22c00 0x21600 0x520
GetEnvironmentStringsW 0x0 0x4301a238 0x22c08 0x21608 0x1e1
HeapSetInformation 0x0 0x4301a240 0x22c10 0x21610 0x2db
GetVersion 0x0 0x4301a248 0x22c18 0x21618 0x2aa
HeapCreate 0x0 0x4301a250 0x22c20 0x21620 0x2d5
HeapDestroy 0x0 0x4301a258 0x22c28 0x21628 0x2d6
QueryPerformanceCounter 0x0 0x4301a260 0x22c30 0x21630 0x3a9
GetTickCount 0x0 0x4301a268 0x22c38 0x21638 0x29a
GetCurrentProcessId 0x0 0x4301a270 0x22c40 0x21640 0x1c7
GetSystemTimeAsFileTime 0x0 0x4301a278 0x22c48 0x21648 0x280
TerminateProcess 0x0 0x4301a280 0x22c50 0x21650 0x4ce
SHLWAPI.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PathAppendW 0x0 0x4301a2d0 0x22ca0 0x216a0 0x34
PathFindExtensionW 0x0 0x4301a2d8 0x22ca8 0x216a8 0x47
UrlCreateFromPathW 0x0 0x4301a2e0 0x22cb0 0x216b0 0x15a
UrlCanonicalizeW 0x0 0x4301a2e8 0x22cb8 0x216b8 0x154
PathGetCharTypeW 0x0 0x4301a2f0 0x22cc0 0x216c0 0x53
PathRemoveFileSpecW 0x0 0x4301a2f8 0x22cc8 0x216c8 0x8b
PathFileExistsW 0x0 0x4301a300 0x22cd0 0x216d0 0x45
ole32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoCreateGuid 0x0 0x4301a330 0x22d00 0x21700 0x13
IIDFromString 0x0 0x4301a338 0x22d08 0x21708 0x101
CoTaskMemFree 0x0 0x4301a340 0x22d10 0x21710 0x6c
StringFromGUID2 0x0 0x4301a348 0x22d18 0x21718 0x1b5
OLEAUT32.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VariantInit 0x8 0x4301a290 0x22c60 0x21660 -
SysFreeString 0x6 0x4301a298 0x22c68 0x21668 -
VariantCopy 0xa 0x4301a2a0 0x22c70 0x21670 -
SysAllocString 0x2 0x4301a2a8 0x22c78 0x21678 -
VariantClear 0x9 0x4301a2b0 0x22c80 0x21680 -
VERSION.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VerQueryValueW 0x0 0x4301a310 0x22ce0 0x216e0 0xe
GetFileVersionInfoW 0x0 0x4301a318 0x22ce8 0x216e8 0x6
GetFileVersionInfoSizeW 0x0 0x4301a320 0x22cf0 0x216f0 0x5
urlmon.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoInternetCreateSecurityManager 0x0 0x4301a358 0x22d28 0x21728 0xc
SHELL32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHGetFolderPathW 0x0 0x4301a2c0 0x22c90 0x21690 0xc3
Exports (10)
»
Api name EAT Address Ordinal
CreateVstoSolutionMetadataKey 0xdde8 0x1
DllCanUnloadNow 0xf1c8 0x9
DllGetClassObject 0xf2c0 0xa
GetLatestVstoRuntimeVersion 0xdb4c 0x2
GetValidCompatibleFramework 0xe000 0x3
GetVstoSolutionMetadata 0xdfa0 0x4
GetVstoSolutionRuntimeVersionW 0xdd00 0x5
GetVstoSolutionVersionW 0xdbd0 0x6
InstallSolution 0x1c50 0x7
InstallVstoSolutionW 0x1d34 0x8
Icons (1)
»
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 20:11:15+00:00
Valid Until 2018-08-11 20:11:15+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 79 7C 2E 57 4E 52 E1 CA D6 00 01 00 00 01 79
Thumbprint 5E AD 30 0D C7 E4 D6 37 94 8E CB 0E D8 29 A0 72 BD 15 2E 17
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
\\?\C:\Users\CIiHmnxMn6Ps\Music\M0FRaonJmV.m4a id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 87.61 KB
MD5 a3cc77d614df663a72810a9ff6fb551b Copy to Clipboard
SHA1 89955a64fa246554574128e4c48c2cb7ad2ec052 Copy to Clipboard
SHA256 98d9a49b8f0b69b8a2512b43595ae56a5fcf598d78821223ba1d4cce506602f3 Copy to Clipboard
SSDeep 1536:ID3w0D1xbZ9+JlI0CBjYTIWFBYqFdhxLeDqFgZlMsdPXix/vZSeOUeceHIkZVpLA:IDjHbZuvCBjYTlFBbNZeDqFgT5dE/rsm Copy to Clipboard
\\?\C:\Program Files (x86)\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 993f1ea1fa67d7b0bfb664c157544c34 Copy to Clipboard
SHA1 bd9a7bbd1eb695650628fff95a17c0898519b485 Copy to Clipboard
SHA256 f1f26b4d3ff43e7189293dead52ee134aad686e3201b4293600fcaddd1e03f23 Copy to Clipboard
SSDeep 48:tf7Ir74tLvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:F0PIvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files (x86)\Mozilla Firefox\Accessible.tlb id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 4.44 KB
MD5 909974724dfff392f276ef2fcb702e5d Copy to Clipboard
SHA1 216b4b30f4ea9c6e3f56664f8c737c0483acaafe Copy to Clipboard
SHA256 fc1ba0cb7da79e31e83b492571008747ddcaf462010f3435918a588e8cf081a0 Copy to Clipboard
SSDeep 96:CN9a/7HLBKWizZ5MVdmhNtZNlRbBHflvkVYj1Xm6IVJVvlpYx0:CN0/rOz8dYXdflvkejdm7VJVvx Copy to Clipboard
\\?\C:\ProgramData\Microsoft\Crypto\SystemKeys\6d00fa390c15cc4634c8ca8153b76f29_911499c7-ef29-47ed-a64c-6b1751f20848 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 3.03 KB
MD5 5b7a4797c9298f451f91cd11e23eda04 Copy to Clipboard
SHA1 a41567e05128577c7611e1f75f3aafdb3ce8e348 Copy to Clipboard
SHA256 902507b8800499913c94d3db6df38d7ff94d3623805209b1aff1fdc6a74585cf Copy to Clipboard
SSDeep 96:HrfBVDDwH+83lTvkVYj1Xm6IVJVvlpYx0:HrfBVDDq+6lvkejdm7VJVvx Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\rR19YSzpNWbN5JSMbg.mp3 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 9.30 KB
MD5 c23ec53969a6a1bb8bab4a1dbd4819c3 Copy to Clipboard
SHA1 534f541f53a10585b062d805115cbce687f2279f Copy to Clipboard
SHA256 e534b5da8a7ba890da2a733ce4528eb73b0ef531d199d4ff7dcf2216ca8ae282 Copy to Clipboard
SSDeep 192:D/OIlPqjcV2aK1cw/CzfaZa2jylxnj09Qvkejdm7VJVvx:KBMzK1azy82el3BOVrx Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\9f-BbJpQsNgzH8xy.ots id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 29.31 KB
MD5 85ff782d50759161fb8dd0d863471237 Copy to Clipboard
SHA1 a66f722ed4737d0b5ea7ad09d2c126ebb828ac50 Copy to Clipboard
SHA256 aeae953bc8ff7563de181e2238888def17c3f31f71097a529a7247254f011ed9 Copy to Clipboard
SSDeep 768:nNFLAumQ8Ud1my8v0qCwzxSj7k4T6PWMKhe6maWaN06nKjZ8tSwvO+FWgBsl:njLFmQh/8vIwNSj7kacJu2aWaN5nsU5a Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.006.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 b313a1f81bcbee762eed7301abe804e1 Copy to Clipboard
SHA1 68de728d41619cb21b26dc0e57cdadf03dd0d44e Copy to Clipboard
SHA256 8b632822c4308499bdf3feb340aa99ca15a12d9ded48a034fff514e7ac8f6f2d Copy to Clipboard
SSDeep 384:ceEL20OOJYk1ZR1o2F6O2HKOgV7m0KfO0ww50uZBOVrx:8OOOk1ZRn8OIcF0wE7Bsl Copy to Clipboard
\\?\C:\Users\Default\NTUSER.DAT id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 257.50 KB
MD5 2c4a1f7a6ec2732dd6ba939aa9ae23fa Copy to Clipboard
SHA1 a3e3b562c3e321e247922459b999d2acbe13525e Copy to Clipboard
SHA256 9c8077d526a771257566b5cf2f1adc7d185abf7ee9265577556403a1be464285 Copy to Clipboard
SSDeep 6144:oxmLtlrVebzxCRkrlxnihfHj6g/b0QwYACEdeWJNfIWm:oxm5lrsekXW/2LYDWNfFm Copy to Clipboard
\\?\C:\Users\Public\Music\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 1.87 KB
MD5 167f2f27799f6b68c2c15347e3945138 Copy to Clipboard
SHA1 800de83b8f044eb2d3c5c8b486267bcc8c370362 Copy to Clipboard
SHA256 43d0f516307858b15acc5a6aae5a89b7f7e5c74bf3fda7dd3aa65aabeabf3bf3 Copy to Clipboard
SSDeep 48:Gk35UMRfqd334x9vhWUyvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:pqv3IxgvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\JjYoZpHYWTU.m4a id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 89.24 KB
MD5 df11ee51dc6ac99271fd39b7bb672ecf Copy to Clipboard
SHA1 d3ed0638dd08adbc88fb92eb9bce1bc862a65784 Copy to Clipboard
SHA256 cf9056ebcd06e8d05be59e2c4169453a6713039f2c80f5971564b2670ea7d686 Copy to Clipboard
SSDeep 1536:AJVVvGUxvdwsnaqyy/o2bjmntfZIc0xE3d6Skwob2jb//13JTMtpWoYlBkgll9CY:KfeUxvasntyfoj0Z04hfnlGzY/1T9J Copy to Clipboard
\\?\C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c7c24.timestamp id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 1.55 KB
MD5 d0d4cf8f339364e44ba3867eb100db56 Copy to Clipboard
SHA1 996566a3c60698f32d8cc497298d1b91afdb5b59 Copy to Clipboard
SHA256 7f61497538744195c1c3440a6f94ba2969746e8932d50628aa17c0f1027c2f6b Copy to Clipboard
SSDeep 48:EpqNggvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:EILvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Microsoft Office\AppXManifest.xml id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 5.76 MB
MD5 dbebeb399168d2f65dd4b4277184e4ed Copy to Clipboard
SHA1 10827665c55791a71828e0fe7d426cb61e48130d Copy to Clipboard
SHA256 1611b084b7de06ea516da25fd788fad43c1d7c96a49de752d6316a839b34f989 Copy to Clipboard
SSDeep 49152:HDWuRuv5IJBFg6tzUKspLEC7Z2zC3NI13NIwmX:HCwuv5aBFg0zU/pLEC7UmX Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 1.74 KB
MD5 550d01b0eee7c5a741277c82b0caf02f Copy to Clipboard
SHA1 6508f65811b28f2eb6e6040d59e364f48da61ab0 Copy to Clipboard
SHA256 7e240d8ceacf9732df6c68e9b720411fc6928008bdbc67b1adf5f2f209cd3f7f Copy to Clipboard
SSDeep 48:IKHlVnIpxwXKnvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:nTcw6nvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Windows NT\lowest forwarding sitemap.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 45e27f5feba10f7cba1f0fdee186aa62 Copy to Clipboard
SHA1 2d69e1be44e2a5c215c1c04b509f64723e932b7c Copy to Clipboard
SHA256 2e20b009c69f84eb4858e4d29e96bae8cadf32035c199085b57cebe9cea1be02 Copy to Clipboard
SSDeep 1536:kNBSGH3KI/1BKBcLhOssUE23fKTg92pzXCNUril46Iq/PLlU0sl:Hs3KI/1KiBAO2pdeAejlUf Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\LGn3zp_fF2XhsytW9iY.png id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 41.89 KB
MD5 363e4a3e80569717fe5cc184aed52554 Copy to Clipboard
SHA1 957ab5f4da0c66c1ff90f45de357a726b7f6b337 Copy to Clipboard
SHA256 62515c2827fbe3f55fce46e775262e2e5898c769e809df1e8e95596be1aef56c Copy to Clipboard
SSDeep 768:n3DVXDf3/ZsSX2mXVUO+iS82p1QWGMJ40LEy1XJikYH/U8MM+0PsBsl:5XD3eSGmXVUOORp1HGMJ40LEyFJik+/X Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\SlQRk7s3j8.mp3 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 81.39 KB
MD5 284219703a3e8e32410893be856dbaa6 Copy to Clipboard
SHA1 eeb7943640f1db78ffdea929cd75e139186fceac Copy to Clipboard
SHA256 13582e3092482d2363156aeb3ed95d6039f9f2ae2d71546df9f65f3a378b3da9 Copy to Clipboard
SSDeep 1536:ZgbQ0KBsjAIq0HcUyfmp8UAfh8LpHwevNKneheD+CCUTr+A2t7eKXwwRsl:ZgQz8sWWfmqAjN+l+ChroTXj+ Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\sm_xgLw3u40OkI.jpg id-Br3n0G72wUb8CejT.LyaS Created File Stream
Unknown
»
Mime Type application/octet-stream
File Size 92.94 KB
MD5 2a91861e0c7169df9e67a7462672898d Copy to Clipboard
SHA1 a4d7584a2e435f2286e5cf23b6de918c0ac948ac Copy to Clipboard
SHA256 4d3493d36468e0507dd879ba69c400ce5b60a85ee42d58b5f2a5f40566aa9460 Copy to Clipboard
SSDeep 1536:a4ad5JUAqADgI9rZgTdCQAfEodLQaFKydxpz4V8Nu0KSCsfiZBSYNYS2IN/SJIYY:aLdeeyxCQAMW3JdTW50XCUIrRzSJIYY Copy to Clipboard
\\?\C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml id-Br3n0G72wUb8CejT.LyaS Modified File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.85 KB
MD5 13ad07eec40d6af2600597fbb48db91c Copy to Clipboard
SHA1 949acb60bd2f8b0b77c9df9deaba5e142281ede8 Copy to Clipboard
SHA256 e176964e647ebeff20e24ebbda01810dbd1ecbc07b0c1a55248dbd0f1db30d9a Copy to Clipboard
SSDeep 48:kthDfMBcFVBXiFiJn/ph4mHbzEducXUvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:yxfScFPiFiJnFbzEdu7vkVYj1Xm6IVJj Copy to Clipboard
\\?\C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml id-Br3n0G72wUb8CejT.LyaS Modified File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 3.43 KB
MD5 a2e8eeda4b6266ce41abe41acce16d91 Copy to Clipboard
SHA1 c553ff7a298f2b68f53fd57638164c05b59cdb1c Copy to Clipboard
SHA256 a4335480ac48cdec67818208ada975389761769834c54308b5fa7a0c66823617 Copy to Clipboard
SSDeep 96:uVkoS/vYc+VFAoWc5ZI17CKuecvkVYj1Xm6IVJVvlpYx0:uZSIc+bAqqBCVvkejdm7VJVvx Copy to Clipboard
\\?\C:\Program Files\Windows Mail\tr_wireless.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 a8acbf07e92d21636614cb41d86ce31c Copy to Clipboard
SHA1 73ca6bbc5a88a8b6dbb11d9e6362c9c0aae11d28 Copy to Clipboard
SHA256 dd435cb463ed27b615098521b4e6f9c13d6078d61da1dade59f93ad3c464460f Copy to Clipboard
SSDeep 1536:4tMmvjrrQ43ZaNnbTK2HXENicuVkFCrdaDsOxvku8lhfsyVsYMOusl:4tMmrrrQUaboNicNCrdaD/Mu8Ts9q Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\VC_redist.x86.exe id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
»
Mime Type application/x-dosexec
File Size 517.98 KB
MD5 02ce786c2214475af0af55857762d07e Copy to Clipboard
SHA1 63ca60153ff1eb393f6c6ed5b43c91e516a00746 Copy to Clipboard
SHA256 29cf2f79b42d4c6743025f1532943d3e09c9cc84887ccf6daa7927d70cfe249c Copy to Clipboard
SSDeep 12288:pAqkoCtQO4Nai3jk/POpKNpWCmA9rSiPjIfj430:pxkoIgNaPIKNpWLGxI0E Copy to Clipboard
ImpHash 8e2588a9cf43886de3449dfff03137b6 Copy to Clipboard
PE Information
»
Image Base 0x400000
Entry Point 0x428494
Size Of Code 0x39400
Size Of Initialized Data 0x23600
File Type executable
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2015-02-13 19:42:32+00:00
Version Information (8)
»
LegalCopyright Copyright (c) Microsoft Corporation. All rights reserved.
InternalName setup
FileVersion 14.0.23026.0
CompanyName Microsoft Corporation
ProductName Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026
ProductVersion 14.0.23026.0
FileDescription Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026
OriginalFilename VC_redist.x86.exe
Sections (7)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x39384 0x39400 0x400 cnt_code, mem_execute, mem_read 6.51
.rdata 0x43b000 0x1a0ec 0x1a200 0x39800 cnt_initialized_data, mem_read 4.96
.data 0x456000 0x30c0 0x1000 0x53a00 cnt_initialized_data, mem_read, mem_write 2.79
.wixburn 0x45a000 0x38 0x200 0x54a00 cnt_initialized_data, mem_read 0.58
.tls 0x45b000 0x9 0x200 0x54c00 cnt_initialized_data, mem_read, mem_write 0.0
.rsrc 0x45c000 0x3910 0x3a00 0x54e00 cnt_initialized_data, mem_read 5.51
.reloc 0x460000 0x4482 0x4600 0x58800 cnt_initialized_data, mem_discardable, mem_read 5.66
Imports (15)
»
gdiplus.dll (13)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GdiplusShutdown 0x0 0x43b404 0x53bc8 0x523c8 0x274
GdiplusStartup 0x0 0x43b408 0x53bcc 0x523cc 0x275
GdipDeleteGraphics 0x0 0x43b40c 0x53bd0 0x523d0 0x90
GdipFree 0x0 0x43b410 0x53bd4 0x523d4 0xed
GdipCloneImage 0x0 0x43b414 0x53bd8 0x523d8 0x36
GdipDisposeImage 0x0 0x43b418 0x53bdc 0x523dc 0x98
GdipGetImageWidth 0x0 0x43b41c 0x53be0 0x523e0 0x12c
GdipGetImageHeight 0x0 0x43b420 0x53be4 0x523e4 0x122
GdipCreateBitmapFromResource 0x0 0x43b424 0x53be8 0x523e8 0x4f
GdipCreateFromHDC 0x0 0x43b428 0x53bec 0x523ec 0x5b
GdipSetInterpolationMode 0x0 0x43b42c 0x53bf0 0x523f0 0x218
GdipDrawImageRectI 0x0 0x43b430 0x53bf4 0x523f4 0xb8
GdipAlloc 0x0 0x43b434 0x53bf8 0x523f8 0x21
ADVAPI32.dll (44)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
QueryServiceConfigW 0x0 0x43b000 0x537c4 0x51fc4 0x224
CryptAcquireContextW 0x0 0x43b004 0x537c8 0x51fc8 0xb1
CryptCreateHash 0x0 0x43b008 0x537cc 0x51fcc 0xb3
CryptHashData 0x0 0x43b00c 0x537d0 0x51fd0 0xc8
CryptGetHashParam 0x0 0x43b010 0x537d4 0x51fd4 0xc4
CryptDestroyHash 0x0 0x43b014 0x537d8 0x51fd8 0xb6
CryptReleaseContext 0x0 0x43b018 0x537dc 0x51fdc 0xcb
RegDeleteKeyW 0x0 0x43b01c 0x537e0 0x51fe0 0x244
RegCreateKeyExW 0x0 0x43b020 0x537e4 0x51fe4 0x239
RegEnumKeyExW 0x0 0x43b024 0x537e8 0x51fe8 0x24f
RegEnumValueW 0x0 0x43b028 0x537ec 0x51fec 0x252
AdjustTokenPrivileges 0x0 0x43b02c 0x537f0 0x51ff0 0x1f
LookupPrivilegeValueW 0x0 0x43b030 0x537f4 0x51ff4 0x197
OpenProcessToken 0x0 0x43b034 0x537f8 0x51ff8 0x1f7
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x0 0x43b038 0x537fc 0x51ffc 0x72
RegCloseKey 0x0 0x43b03c 0x53800 0x52000 0x230
RegDeleteValueW 0x0 0x43b040 0x53804 0x52004 0x248
RegQueryValueExW 0x0 0x43b044 0x53808 0x52008 0x26e
GetUserNameW 0x0 0x43b048 0x5380c 0x5200c 0x165
InitiateSystemShutdownExW 0x0 0x43b04c 0x53810 0x52010 0x17d
CreateWellKnownSid 0x0 0x43b050 0x53814 0x52014 0x83
InitializeAcl 0x0 0x43b054 0x53818 0x52018 0x176
SetEntriesInAclW 0x0 0x43b058 0x5381c 0x5201c 0x2a6
DecryptFileW 0x0 0x43b05c 0x53820 0x52020 0xd8
ChangeServiceConfigW 0x0 0x43b060 0x53824 0x52024 0x50
ControlService 0x0 0x43b064 0x53828 0x52028 0x5c
CloseServiceHandle 0x0 0x43b068 0x5382c 0x5202c 0x57
QueryServiceStatus 0x0 0x43b06c 0x53830 0x52030 0x228
OpenServiceW 0x0 0x43b070 0x53834 0x52034 0x1fb
OpenSCManagerW 0x0 0x43b074 0x53838 0x52038 0x1f9
RegQueryInfoKeyW 0x0 0x43b078 0x5383c 0x5203c 0x268
RegSetValueExW 0x0 0x43b07c 0x53840 0x52040 0x27e
SetEntriesInAclA 0x0 0x43b080 0x53844 0x52044 0x2a5
SetSecurityDescriptorGroup 0x0 0x43b084 0x53848 0x52048 0x2b7
RegOpenKeyExW 0x0 0x43b088 0x5384c 0x5204c 0x261
GetTokenInformation 0x0 0x43b08c 0x53850 0x52050 0x15a
CheckTokenMembership 0x0 0x43b090 0x53854 0x52054 0x51
AllocateAndInitializeSid 0x0 0x43b094 0x53858 0x52058 0x20
FreeSid 0x0 0x43b098 0x5385c 0x5205c 0x120
LookupAccountNameW 0x0 0x43b09c 0x53860 0x52060 0x18f
SetNamedSecurityInfoW 0x0 0x43b0a0 0x53864 0x52064 0x2b1
InitializeSecurityDescriptor 0x0 0x43b0a4 0x53868 0x52068 0x177
SetSecurityDescriptorDacl 0x0 0x43b0a8 0x5386c 0x5206c 0x2b6
SetSecurityDescriptorOwner 0x0 0x43b0ac 0x53870 0x52070 0x2b8
USER32.dll (25)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetMessageW 0x0 0x43b348 0x53b0c 0x5230c 0x15d
PeekMessageW 0x0 0x43b34c 0x53b10 0x52310 0x233
PostMessageW 0x0 0x43b350 0x53b14 0x52314 0x236
IsWindow 0x0 0x43b354 0x53b18 0x52318 0x1db
PostQuitMessage 0x0 0x43b358 0x53b1c 0x5231c 0x237
GetWindowLongW 0x0 0x43b35c 0x53b20 0x52320 0x196
SetWindowLongW 0x0 0x43b360 0x53b24 0x52324 0x2c4
DefWindowProcW 0x0 0x43b364 0x53b28 0x52328 0x9c
UnregisterClassW 0x0 0x43b368 0x53b2c 0x5232c 0x306
DispatchMessageW 0x0 0x43b36c 0x53b30 0x52330 0xaf
TranslateMessage 0x0 0x43b370 0x53b34 0x52334 0x2fc
IsDialogMessageW 0x0 0x43b374 0x53b38 0x52338 0x1cd
MsgWaitForMultipleObjects 0x0 0x43b378 0x53b3c 0x5233c 0x21c
WaitForInputIdle 0x0 0x43b37c 0x53b40 0x52340 0x326
LoadCursorW 0x0 0x43b380 0x53b44 0x52344 0x1eb
BeginPaint 0x0 0x43b384 0x53b48 0x52348 0xe
EndPaint 0x0 0x43b388 0x53b4c 0x5234c 0xdc
GetCursorPos 0x0 0x43b38c 0x53b50 0x52350 0x120
MonitorFromPoint 0x0 0x43b390 0x53b54 0x52354 0x218
GetMonitorInfoW 0x0 0x43b394 0x53b58 0x52358 0x15f
ReleaseDC 0x0 0x43b398 0x53b5c 0x5235c 0x265
MessageBoxW 0x0 0x43b39c 0x53b60 0x52360 0x215
PostThreadMessageW 0x0 0x43b3a0 0x53b64 0x52364 0x239
RegisterClassW 0x0 0x43b3a4 0x53b68 0x52368 0x24e
CreateWindowExW 0x0 0x43b3a8 0x53b6c 0x5236c 0x6e
OLEAUT32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VariantClear 0x9 0x43b31c 0x53ae0 0x522e0 -
VariantInit 0x8 0x43b320 0x53ae4 0x522e4 -
SysAllocString 0x2 0x43b324 0x53ae8 0x522e8 -
SysFreeString 0x6 0x43b328 0x53aec 0x522ec -
GDI32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetDeviceCaps 0x0 0x43b0d0 0x53894 0x52094 0x1cb
CreateDCW 0x0 0x43b0d4 0x53898 0x52098 0x32
SHELL32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ShellExecuteExW 0x0 0x43b338 0x53afc 0x522fc 0x121
SHGetFolderPathW 0x0 0x43b33c 0x53b00 0x52300 0xc3
CommandLineToArgvW 0x0 0x43b340 0x53b04 0x52304 0x6
ole32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoTaskMemFree 0x0 0x43b48c 0x53c50 0x52450 0x68
CoCreateInstance 0x0 0x43b490 0x53c54 0x52454 0x10
CoInitialize 0x0 0x43b494 0x53c58 0x52458 0x3e
CoUninitialize 0x0 0x43b498 0x53c5c 0x5245c 0x6c
CoInitializeEx 0x0 0x43b49c 0x53c60 0x52460 0x3f
StringFromGUID2 0x0 0x43b4a0 0x53c64 0x52464 0x179
CoInitializeSecurity 0x0 0x43b4a4 0x53c68 0x52468 0x40
CLSIDFromProgID 0x0 0x43b4a8 0x53c6c 0x5246c 0x6
KERNEL32.dll (143)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCurrentProcess 0x0 0x43b0dc 0x538a0 0x520a0 0x1c0
InitializeCriticalSection 0x0 0x43b0e0 0x538a4 0x520a4 0x2e2
TlsFree 0x0 0x43b0e4 0x538a8 0x520a8 0x4c6
DeleteCriticalSection 0x0 0x43b0e8 0x538ac 0x520ac 0xd1
CloseHandle 0x0 0x43b0ec 0x538b0 0x520b0 0x52
TlsGetValue 0x0 0x43b0f0 0x538b4 0x520b4 0x4c7
Sleep 0x0 0x43b0f4 0x538b8 0x520b8 0x4b2
GetLastError 0x0 0x43b0f8 0x538bc 0x520bc 0x202
ReleaseMutex 0x0 0x43b0fc 0x538c0 0x520c0 0x3fa
TlsSetValue 0x0 0x43b100 0x538c4 0x520c4 0x4c8
TlsAlloc 0x0 0x43b104 0x538c8 0x520c8 0x4c5
GetCurrentThreadId 0x0 0x43b108 0x538cc 0x520cc 0x1c5
GetVersionExW 0x0 0x43b10c 0x538d0 0x520d0 0x2a4
GetModuleHandleW 0x0 0x43b110 0x538d4 0x520d4 0x218
ReadFile 0x0 0x43b114 0x538d8 0x520d8 0x3c0
SetFilePointerEx 0x0 0x43b118 0x538dc 0x520dc 0x467
CreateFileW 0x0 0x43b11c 0x538e0 0x520e0 0x8f
GetCurrentProcessId 0x0 0x43b120 0x538e4 0x520e4 0x1c1
GetProcessId 0x0 0x43b124 0x538e8 0x520e8 0x24c
WriteFile 0x0 0x43b128 0x538ec 0x520ec 0x525
ConnectNamedPipe 0x0 0x43b12c 0x538f0 0x520f0 0x65
SetNamedPipeHandleState 0x0 0x43b130 0x538f4 0x520f4 0x47c
lstrlenW 0x0 0x43b134 0x538f8 0x520f8 0x54e
CompareStringW 0x0 0x43b138 0x538fc 0x520fc 0x64
LocalFree 0x0 0x43b13c 0x53900 0x52100 0x348
CreateNamedPipeW 0x0 0x43b140 0x53904 0x52104 0xa0
WaitForSingleObject 0x0 0x43b144 0x53908 0x52108 0x4f9
OpenProcess 0x0 0x43b148 0x5390c 0x5210c 0x380
lstrlenA 0x0 0x43b14c 0x53910 0x52110 0x54d
RemoveDirectoryW 0x0 0x43b150 0x53914 0x52114 0x403
GetFileAttributesW 0x0 0x43b154 0x53918 0x52118 0x1ea
ExpandEnvironmentStringsW 0x0 0x43b158 0x5391c 0x5211c 0x11d
LeaveCriticalSection 0x0 0x43b15c 0x53920 0x52120 0x339
EnterCriticalSection 0x0 0x43b160 0x53924 0x52124 0xee
FreeLibrary 0x0 0x43b164 0x53928 0x52128 0x162
GetProcAddress 0x0 0x43b168 0x5392c 0x5212c 0x245
VerifyVersionInfoW 0x0 0x43b16c 0x53930 0x52130 0x4e8
VerSetConditionMask 0x0 0x43b170 0x53934 0x52134 0x4e4
GetComputerNameW 0x0 0x43b174 0x53938 0x52138 0x18f
GetTempPathW 0x0 0x43b178 0x5393c 0x5213c 0x285
GetSystemDirectoryW 0x0 0x43b17c 0x53940 0x52140 0x270
GetSystemWow64DirectoryW 0x0 0x43b180 0x53944 0x52144 0x27e
GetVolumePathNameW 0x0 0x43b184 0x53948 0x52148 0x2ab
HeapAlloc 0x0 0x43b188 0x5394c 0x5214c 0x2cb
GetSystemDefaultLangID 0x0 0x43b18c 0x53950 0x52150 0x26c
GetUserDefaultLangID 0x0 0x43b190 0x53954 0x52154 0x29c
GetDateFormatW 0x0 0x43b194 0x53958 0x52158 0x1c8
GetSystemTime 0x0 0x43b198 0x5395c 0x5215c 0x277
InterlockedExchange 0x0 0x43b19c 0x53960 0x52160 0x2ec
LoadLibraryW 0x0 0x43b1a0 0x53964 0x52164 0x33f
InterlockedCompareExchange 0x0 0x43b1a4 0x53968 0x52168 0x2e9
GetExitCodeThread 0x0 0x43b1a8 0x5396c 0x5216c 0x1e0
CreateThread 0x0 0x43b1ac 0x53970 0x52170 0xb5
SetEvent 0x0 0x43b1b0 0x53974 0x52174 0x459
WaitForMultipleObjects 0x0 0x43b1b4 0x53978 0x52178 0x4f7
CreateEventW 0x0 0x43b1b8 0x5397c 0x5217c 0x85
ProcessIdToSessionId 0x0 0x43b1bc 0x53980 0x52180 0x399
InterlockedIncrement 0x0 0x43b1c0 0x53984 0x52184 0x2ef
InterlockedDecrement 0x0 0x43b1c4 0x53988 0x52188 0x2eb
GetStringTypeW 0x0 0x43b1c8 0x5398c 0x5218c 0x269
SetFileAttributesW 0x0 0x43b1cc 0x53990 0x52190 0x461
FindClose 0x0 0x43b1d0 0x53994 0x52194 0x12e
FindNextFileW 0x0 0x43b1d4 0x53998 0x52198 0x145
FindFirstFileW 0x0 0x43b1d8 0x5399c 0x5219c 0x139
CreateProcessW 0x0 0x43b1dc 0x539a0 0x521a0 0xa8
SetCurrentDirectoryW 0x0 0x43b1e0 0x539a4 0x521a4 0x44d
GetCurrentDirectoryW 0x0 0x43b1e4 0x539a8 0x521a8 0x1bf
GetExitCodeProcess 0x0 0x43b1e8 0x539ac 0x521ac 0x1df
SetThreadExecutionState 0x0 0x43b1ec 0x539b0 0x521b0 0x493
CopyFileExW 0x0 0x43b1f0 0x539b4 0x521b4 0x72
HeapSetInformation 0x0 0x43b1f4 0x539b8 0x521b8 0x2d3
MapViewOfFile 0x0 0x43b1f8 0x539bc 0x521bc 0x357
CreateFileMappingW 0x0 0x43b1fc 0x539c0 0x521c0 0x8c
CreateMutexW 0x0 0x43b200 0x539c4 0x521c4 0x9e
SetEndOfFile 0x0 0x43b204 0x539c8 0x521c8 0x453
ResetEvent 0x0 0x43b208 0x539cc 0x521cc 0x40f
SetFileTime 0x0 0x43b20c 0x539d0 0x521d0 0x46a
LocalFileTimeToFileTime 0x0 0x43b210 0x539d4 0x521d4 0x346
DosDateTimeToFileTime 0x0 0x43b214 0x539d8 0x521d8 0xe4
CreateFileA 0x0 0x43b218 0x539dc 0x521dc 0x88
GetSystemTimeAsFileTime 0x0 0x43b21c 0x539e0 0x521e0 0x279
VirtualFree 0x0 0x43b220 0x539e4 0x521e4 0x4ec
VirtualAlloc 0x0 0x43b224 0x539e8 0x521e8 0x4e9
DeleteFileW 0x0 0x43b228 0x539ec 0x521ec 0xd6
GetThreadLocale 0x0 0x43b22c 0x539f0 0x521f0 0x28c
GetTimeZoneInformation 0x0 0x43b230 0x539f4 0x521f4 0x298
TerminateProcess 0x0 0x43b234 0x539f8 0x521f8 0x4c0
UnhandledExceptionFilter 0x0 0x43b238 0x539fc 0x521fc 0x4d3
SystemTimeToTzSpecificLocalTime 0x0 0x43b23c 0x53a00 0x52200 0x4be
SystemTimeToFileTime 0x0 0x43b240 0x53a04 0x52204 0x4bd
GlobalAlloc 0x0 0x43b244 0x53a08 0x52208 0x2b3
IsProcessorFeaturePresent 0x0 0x43b248 0x53a0c 0x5220c 0x304
GetTickCount 0x0 0x43b24c 0x53a10 0x52210 0x293
QueryPerformanceCounter 0x0 0x43b250 0x53a14 0x52214 0x3a7
HeapCreate 0x0 0x43b254 0x53a18 0x52218 0x2cd
SetLastError 0x0 0x43b258 0x53a1c 0x5221c 0x473
EncodePointer 0x0 0x43b25c 0x53a20 0x52220 0xea
GetFileType 0x0 0x43b260 0x53a24 0x52224 0x1f3
InitializeCriticalSectionAndSpinCount 0x0 0x43b264 0x53a28 0x52228 0x2e3
SetHandleCount 0x0 0x43b268 0x53a2c 0x5222c 0x46f
GetEnvironmentStringsW 0x0 0x43b26c 0x53a30 0x52230 0x1da
GlobalFree 0x0 0x43b270 0x53a34 0x52234 0x2ba
MoveFileExW 0x0 0x43b274 0x53a38 0x52238 0x360
CopyFileW 0x0 0x43b278 0x53a3c 0x5223c 0x75
GetFileSizeEx 0x0 0x43b27c 0x53a40 0x52240 0x1f1
GetModuleHandleA 0x0 0x43b280 0x53a44 0x52244 0x215
RaiseException 0x0 0x43b284 0x53a48 0x52248 0x3b1
GetCPInfo 0x0 0x43b288 0x53a4c 0x5224c 0x172
GetACP 0x0 0x43b28c 0x53a50 0x52250 0x168
GetOEMCP 0x0 0x43b290 0x53a54 0x52254 0x237
IsValidCodePage 0x0 0x43b294 0x53a58 0x52258 0x30a
RtlUnwind 0x0 0x43b298 0x53a5c 0x5225c 0x418
SetFilePointer 0x0 0x43b29c 0x53a60 0x52260 0x466
WideCharToMultiByte 0x0 0x43b2a0 0x53a64 0x52264 0x511
GetConsoleCP 0x0 0x43b2a4 0x53a68 0x52268 0x19a
GetConsoleMode 0x0 0x43b2a8 0x53a6c 0x5226c 0x1ac
HeapSize 0x0 0x43b2ac 0x53a70 0x52270 0x2d4
HeapReAlloc 0x0 0x43b2b0 0x53a74 0x52274 0x2d2
LCMapStringW 0x0 0x43b2b4 0x53a78 0x52278 0x32d
MultiByteToWideChar 0x0 0x43b2b8 0x53a7c 0x5227c 0x367
SetStdHandle 0x0 0x43b2bc 0x53a80 0x52280 0x487
WriteConsoleW 0x0 0x43b2c0 0x53a84 0x52284 0x524
FlushFileBuffers 0x0 0x43b2c4 0x53a88 0x52288 0x157
GetLocalTime 0x0 0x43b2c8 0x53a8c 0x5228c 0x203
UnmapViewOfFile 0x0 0x43b2cc 0x53a90 0x52290 0x4d6
IsDebuggerPresent 0x0 0x43b2d0 0x53a94 0x52294 0x300
DuplicateHandle 0x0 0x43b2d4 0x53a98 0x52298 0xe8
HeapFree 0x0 0x43b2d8 0x53a9c 0x5229c 0x2cf
FormatMessageW 0x0 0x43b2dc 0x53aa0 0x522a0 0x15e
GetTempFileNameW 0x0 0x43b2e0 0x53aa4 0x522a4 0x283
GetWindowsDirectoryW 0x0 0x43b2e4 0x53aa8 0x522a8 0x2af
CompareStringA 0x0 0x43b2e8 0x53aac 0x522ac 0x61
FreeEnvironmentStringsW 0x0 0x43b2ec 0x53ab0 0x522b0 0x161
GetModuleFileNameW 0x0 0x43b2f0 0x53ab4 0x522b4 0x214
GetStdHandle 0x0 0x43b2f4 0x53ab8 0x522b8 0x264
DecodePointer 0x0 0x43b2f8 0x53abc 0x522bc 0xca
ExitProcess 0x0 0x43b2fc 0x53ac0 0x522c0 0x119
SetUnhandledExceptionFilter 0x0 0x43b300 0x53ac4 0x522c4 0x4a5
GetStartupInfoW 0x0 0x43b304 0x53ac8 0x522c8 0x263
GetCommandLineW 0x0 0x43b308 0x53acc 0x522cc 0x187
GetFullPathNameW 0x0 0x43b30c 0x53ad0 0x522d0 0x1fb
CreateDirectoryW 0x0 0x43b310 0x53ad4 0x522d4 0x81
GetProcessHeap 0x0 0x43b314 0x53ad8 0x522d8 0x24a
Cabinet.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
(by ordinal) 0x16 0x43b0c0 0x53884 0x52084 -
(by ordinal) 0x14 0x43b0c4 0x53888 0x52088 -
(by ordinal) 0x17 0x43b0c8 0x5388c 0x5208c -
CRYPT32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CertGetCertificateContextProperty 0x0 0x43b0b4 0x53878 0x52078 0x46
CryptHashPublicKeyInfo 0x0 0x43b0b8 0x5387c 0x5207c 0xa1
msi.dll (19)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
(by ordinal) 0x58 0x43b43c 0x53c00 0x52400 -
(by ordinal) 0x11 0x43b440 0x53c04 0x52404 -
(by ordinal) 0x7d 0x43b444 0x53c08 0x52408 -
(by ordinal) 0x74 0x43b448 0x53c0c 0x5240c -
(by ordinal) 0x73 0x43b44c 0x53c10 0x52410 -
(by ordinal) 0x76 0x43b450 0x53c14 0x52414 -
(by ordinal) 0x8 0x43b454 0x53c18 0x52418 -
(by ordinal) 0xab 0x43b458 0x53c1c 0x5241c -
(by ordinal) 0xcd 0x43b45c 0x53c20 0x52420 -
(by ordinal) 0x2d 0x43b460 0x53c24 0x52424 -
(by ordinal) 0x89 0x43b464 0x53c28 0x52428 -
(by ordinal) 0x8d 0x43b468 0x53c2c 0x5242c -
(by ordinal) 0xee 0x43b46c 0x53c30 0x52430 -
(by ordinal) 0xbe 0x43b470 0x53c34 0x52434 -
(by ordinal) 0xa9 0x43b474 0x53c38 0x52438 -
(by ordinal) 0x5a 0x43b478 0x53c3c 0x5243c -
(by ordinal) 0xad 0x43b47c 0x53c40 0x52440 -
(by ordinal) 0x6f 0x43b480 0x53c44 0x52444 -
(by ordinal) 0x46 0x43b484 0x53c48 0x52448 -
RPCRT4.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
UuidCreate 0x0 0x43b330 0x53af4 0x522f4 0x1fb
WININET.dll (11)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InternetCloseHandle 0x0 0x43b3c0 0x53b84 0x52384 0x6b
HttpAddRequestHeadersW 0x0 0x43b3c4 0x53b88 0x52388 0x53
HttpOpenRequestW 0x0 0x43b3c8 0x53b8c 0x5238c 0x58
InternetErrorDlg 0x0 0x43b3cc 0x53b90 0x52390 0x7c
InternetReadFile 0x0 0x43b3d0 0x53b94 0x52394 0x9f
HttpSendRequestW 0x0 0x43b3d4 0x53b98 0x52398 0x5e
InternetSetOptionW 0x0 0x43b3d8 0x53b9c 0x5239c 0xaf
InternetOpenW 0x0 0x43b3dc 0x53ba0 0x523a0 0x9a
HttpQueryInfoW 0x0 0x43b3e0 0x53ba4 0x523a4 0x5a
InternetCrackUrlW 0x0 0x43b3e4 0x53ba8 0x523a8 0x74
InternetConnectW 0x0 0x43b3e8 0x53bac 0x523ac 0x72
WINTRUST.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
WinVerifyTrust 0x0 0x43b3f0 0x53bb4 0x523b4 0x73
WTHelperGetProvSignerFromChain 0x0 0x43b3f4 0x53bb8 0x523b8 0x59
WTHelperProvDataFromStateData 0x0 0x43b3f8 0x53bbc 0x523bc 0x5c
CryptCATAdminCalcHashFromFileHandle 0x0 0x43b3fc 0x53bc0 0x523c0 0x4
VERSION.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetFileVersionInfoW 0x0 0x43b3b0 0x53b74 0x52374 0x6
GetFileVersionInfoSizeW 0x0 0x43b3b4 0x53b78 0x52378 0x5
VerQueryValueW 0x0 0x43b3b8 0x53b7c 0x5237c 0xe
Icons (1)
»
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2015-06-04 17:42:45+00:00
Valid Until 2016-09-04 17:42:45+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 0A 2C 79 AE D7 79 7B A6 AC 00 01 00 00 01 0A
Thumbprint 3B DA 32 3E 55 2D B1 FD E5 F4 FB EE 75 D6 D5 B2 B1 87 EE DC
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
\\?\C:\Program Files\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 714bb3d122630ec71acc738a86d74380 Copy to Clipboard
SHA1 19a734cf246bd55d69e751d53a10ee37aef8ae44 Copy to Clipboard
SHA256 73117d53d9f35cc253287e431072c8dd29d57bce280e96a1f00b6ce7d43b9d13 Copy to Clipboard
SSDeep 48:AB2ogGQEPvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:ABdgbQvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files (x86)\Microsoft.NET\flavor.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 db5e56cd7dd4cfde724ecc05e9412cc7 Copy to Clipboard
SHA1 1f7706aa329cb1fbc74978158dba05135e5c316b Copy to Clipboard
SHA256 0e915f123483bba3b830595ada3943c0c36d5a185217e437f3d2e8063ba2ddc2 Copy to Clipboard
SSDeep 1536:lL8S4U8MrjfK5u147fnl+jhq5jeHYE3ZkR4tracGadGqYCob2sl:lLb4yvsu6l+jhq5jIYECmdGCobF Copy to Clipboard
\\?\C:\ProgramData\Microsoft\MF\Active.GRL id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 16.12 KB
MD5 a68402e0cd060faafd52e63d046f1dcd Copy to Clipboard
SHA1 d3a9d66a7a437e30df2f2373faaedb4c0ff7349e Copy to Clipboard
SHA256 07ef60520021a9c1a63c5b6910510a4caa1a4aaeaf095915d1aa2454d6edb4c2 Copy to Clipboard
SSDeep 384:xy9PcieVbEL0qUXPgxGyVvRdmVsLxBOVrx:AJZ6E4qUfkGyVZd1xBsl Copy to Clipboard
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 17.74 KB
MD5 50517f8f868a7d861282891fa548f1ba Copy to Clipboard
SHA1 bcaf934812b1355550d4d3ea68ff6a7f94cacc68 Copy to Clipboard
SHA256 d28aa8d51058e72cda92857a1cb5140588aad08cf122d48a36f0b9f9e0a8f318 Copy to Clipboard
SSDeep 384:F22C+197fM2Oe0gN+gWmJmXg1relj1o3pM4EuehuWBOVrx:F22t3NNd9JvreljW32tuOBsl Copy to Clipboard
\\?\C:\Program Files (x86)\Internet Explorer\reveal_medicare_ebay.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 c75586cc162e0c2220f421195f8ec9fc Copy to Clipboard
SHA1 814373df66044d6de122cb68e725e5694559a319 Copy to Clipboard
SHA256 06148b452f85867dc8e715986e239e2e0e7c8a1052f9ec93bff7b16c52323eb1 Copy to Clipboard
SSDeep 1536:RRp2k5C9OK9VxlYFpKG4YOCz6R8vamR0mgLMZ5kl+VK/ABvmNo2vsl:RD2hLViXR4s6rDpoZ5iUmNor Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.65 KB
MD5 f78238be699f9c2b2191eb8bfe732e3e Copy to Clipboard
SHA1 a3100b7ceea43d857dfa52136da437446128db66 Copy to Clipboard
SHA256 8dfcf2f8a07249c06bb12f257c18188f5757b184109258448ce7e4bf1388ec84 Copy to Clipboard
SSDeep 48:HeR/OZL9ydhvO0/yk8b7OkKG9RcW5vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:+ApQdhvB/yPqnGAW5vkVYj1Xm6IVJVvx Copy to Clipboard
\\?\C:\ProgramData\Oracle\Java\javapath_target_5923062\java.exe id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
»
Mime Type application/x-dosexec
File Size 202.06 KB
MD5 016b9e588bb39d61e87b91fab3680c31 Copy to Clipboard
SHA1 2c2946abf7dc295b69fea131e652c5692e26a34a Copy to Clipboard
SHA256 7627a01a0ca6eb88611dce8dea0710eca4b4a0d2060d70f8f894059a5dc2f96b Copy to Clipboard
SSDeep 3072:xAivwgV/wTmkrTHjzvBQdT7qKBnusl/Kbi6oyQSHwTBfY62ZX6ZLzjZqMNxwQbl:sgSTmUHvOdT7duCKbi6ozOwTBjR5vGkl Copy to Clipboard
ImpHash bb9f83f2ccf071025cfcf6c07dc24b5c Copy to Clipboard
Parser Error Remark Static analyzer was unable to completely parse the analyzed file
PE Information
»
Image Base 0x140000000
Entry Point 0x14000a8c0
Size Of Code 0x1ca00
Size Of Initialized Data 0x14200
File Type executable
Subsystem windows_cui
Machine Type amd64
Compile Timestamp 2017-03-15 08:32:02+00:00
Version Information (9)
»
LegalCopyright Copyright © 2017
InternalName java
FileVersion 8.0.1310.11
CompanyName Oracle Corporation
Full Version 1.8.0_131-b11
ProductName Java(TM) Platform SE 8
ProductVersion 8.0.1310.11
FileDescription Java(TM) Platform SE binary
OriginalFilename java.exe
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x140001000 0x1c841 0x1ca00 0x400 cnt_code, mem_execute, mem_read 6.49
.rdata 0x14001e000 0x88fe 0x8a00 0x1ce00 cnt_initialized_data, mem_read 6.2
.data 0x140027000 0x3ff8 0x1c00 0x25800 cnt_initialized_data, mem_read, mem_write 2.89
.pdata 0x14002b000 0x1248 0x1400 0x27400 cnt_initialized_data, mem_read 4.92
.rsrc 0x14002d000 0x81b8 0x8200 0x28800 cnt_initialized_data, mem_read 6.02
.reloc 0x140036000 0x4d0 0x600 0x30a00 cnt_initialized_data, mem_discardable, mem_read 2.57
Imports (4)
»
ADVAPI32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegCloseKey 0x0 0x14001e000 0x25e00 0x24c00 0x230
RegOpenKeyExA 0x0 0x14001e008 0x25e08 0x24c08 0x260
RegEnumKeyA 0x0 0x14001e010 0x25e10 0x24c10 0x24d
RegQueryValueExA 0x0 0x14001e018 0x25e18 0x24c18 0x26d
USER32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CharNextExA 0x0 0x14001e340 0x26140 0x24f40 0x30
MessageBoxA 0x0 0x14001e348 0x26148 0x24f48 0x212
COMCTL32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InitCommonControlsEx 0x0 0x14001e028 0x25e28 0x24c28 0x7c
KERNEL32.dll (96)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CreateFileW 0x0 0x14001e038 0x25e38 0x24c38 0x8f
GetCommandLineA 0x0 0x14001e040 0x25e40 0x24c40 0x18c
GetModuleFileNameA 0x0 0x14001e048 0x25e48 0x24c48 0x219
QueryPerformanceCounter 0x0 0x14001e050 0x25e50 0x24c50 0x3a9
QueryPerformanceFrequency 0x0 0x14001e058 0x25e58 0x24c58 0x3aa
LocalFree 0x0 0x14001e060 0x25e60 0x24c60 0x34a
FormatMessageA 0x0 0x14001e068 0x25e68 0x24c68 0x163
GetLastError 0x0 0x14001e070 0x25e70 0x24c70 0x208
CloseHandle 0x0 0x14001e078 0x25e78 0x24c78 0x52
GetExitCodeProcess 0x0 0x14001e080 0x25e80 0x24c80 0x1e6
WaitForSingleObject 0x0 0x14001e088 0x25e88 0x24c88 0x508
CreateProcessA 0x0 0x14001e090 0x25e90 0x24c90 0xa4
GetProcAddress 0x0 0x14001e098 0x25e98 0x24c98 0x24c
GetModuleHandleA 0x0 0x14001e0a0 0x25ea0 0x24ca0 0x21b
LoadLibraryA 0x0 0x14001e0a8 0x25ea8 0x24ca8 0x33e
GetExitCodeThread 0x0 0x14001e0b0 0x25eb0 0x24cb0 0x1e7
FindFirstFileA 0x0 0x14001e0b8 0x25eb8 0x24cb8 0x138
FindNextFileA 0x0 0x14001e0c0 0x25ec0 0x24cc0 0x149
FindClose 0x0 0x14001e0c8 0x25ec8 0x24cc8 0x134
GetModuleHandleW 0x0 0x14001e0d0 0x25ed0 0x24cd0 0x21e
ExitProcess 0x0 0x14001e0d8 0x25ed8 0x24cd8 0x11f
DecodePointer 0x0 0x14001e0e0 0x25ee0 0x24ce0 0xcb
HeapFree 0x0 0x14001e0e8 0x25ee8 0x24ce8 0x2d7
MultiByteToWideChar 0x0 0x14001e0f0 0x25ef0 0x24cf0 0x369
GetCurrentProcessId 0x0 0x14001e0f8 0x25ef8 0x24cf8 0x1c7
EnterCriticalSection 0x0 0x14001e100 0x25f00 0x24d00 0xf2
LeaveCriticalSection 0x0 0x14001e108 0x25f08 0x24d08 0x33b
HeapAlloc 0x0 0x14001e110 0x25f10 0x24d10 0x2d3
HeapReAlloc 0x0 0x14001e118 0x25f18 0x24d18 0x2da
FileTimeToSystemTime 0x0 0x14001e120 0x25f20 0x24d20 0x12b
FileTimeToLocalFileTime 0x0 0x14001e128 0x25f28 0x24d28 0x12a
GetDriveTypeA 0x0 0x14001e130 0x25f30 0x24d30 0x1d9
FindFirstFileExA 0x0 0x14001e138 0x25f38 0x24d38 0x139
GetFileAttributesA 0x0 0x14001e140 0x25f40 0x24d40 0x1ec
ExitThread 0x0 0x14001e148 0x25f48 0x24d48 0x120
GetCurrentThreadId 0x0 0x14001e150 0x25f50 0x24d50 0x1cb
CreateThread 0x0 0x14001e158 0x25f58 0x24d58 0xb4
SetFilePointer 0x0 0x14001e160 0x25f60 0x24d60 0x474
InitializeCriticalSectionAndSpinCount 0x0 0x14001e168 0x25f68 0x24d68 0x2eb
DeleteCriticalSection 0x0 0x14001e170 0x25f70 0x24d70 0xd2
EncodePointer 0x0 0x14001e178 0x25f78 0x24d78 0xee
LoadLibraryW 0x0 0x14001e180 0x25f80 0x24d80 0x341
UnhandledExceptionFilter 0x0 0x14001e188 0x25f88 0x24d88 0x4e2
SetUnhandledExceptionFilter 0x0 0x14001e190 0x25f90 0x24d90 0x4b3
IsDebuggerPresent 0x0 0x14001e198 0x25f98 0x24d98 0x302
RtlVirtualUnwind 0x0 0x14001e1a0 0x25fa0 0x24da0 0x426
RtlLookupFunctionEntry 0x0 0x14001e1a8 0x25fa8 0x24da8 0x41f
RtlCaptureContext 0x0 0x14001e1b0 0x25fb0 0x24db0 0x418
TerminateProcess 0x0 0x14001e1b8 0x25fb8 0x24db8 0x4ce
GetCurrentProcess 0x0 0x14001e1c0 0x25fc0 0x24dc0 0x1c6
FlsGetValue 0x0 0x14001e1c8 0x25fc8 0x24dc8 0x15a
FlsSetValue 0x0 0x14001e1d0 0x25fd0 0x24dd0 0x15b
FlsFree 0x0 0x14001e1d8 0x25fd8 0x24dd8 0x159
SetLastError 0x0 0x14001e1e0 0x25fe0 0x24de0 0x480
FlsAlloc 0x0 0x14001e1e8 0x25fe8 0x24de8 0x158
RtlUnwindEx 0x0 0x14001e1f0 0x25ff0 0x24df0 0x425
WriteFile 0x0 0x14001e1f8 0x25ff8 0x24df8 0x534
GetStdHandle 0x0 0x14001e200 0x26000 0x24e00 0x26b
GetModuleFileNameW 0x0 0x14001e208 0x26008 0x24e08 0x21a
WideCharToMultiByte 0x0 0x14001e210 0x26010 0x24e10 0x520
FreeEnvironmentStringsW 0x0 0x14001e218 0x26018 0x24e18 0x167
GetEnvironmentStringsW 0x0 0x14001e220 0x26020 0x24e20 0x1e1
SetHandleCount 0x0 0x14001e228 0x26028 0x24e28 0x47c
GetFileType 0x0 0x14001e230 0x26030 0x24e30 0x1fa
GetStartupInfoW 0x0 0x14001e238 0x26038 0x24e38 0x26a
HeapSetInformation 0x0 0x14001e240 0x26040 0x24e40 0x2db
GetVersion 0x0 0x14001e248 0x26048 0x24e48 0x2aa
HeapCreate 0x0 0x14001e250 0x26050 0x24e50 0x2d5
GetTickCount 0x0 0x14001e258 0x26058 0x24e58 0x29a
GetSystemTimeAsFileTime 0x0 0x14001e260 0x26060 0x24e60 0x280
SetEnvironmentVariableW 0x0 0x14001e268 0x26068 0x24e68 0x465
SetEnvironmentVariableA 0x0 0x14001e270 0x26070 0x24e70 0x464
Sleep 0x0 0x14001e278 0x26078 0x24e78 0x4c0
SetStdHandle 0x0 0x14001e280 0x26080 0x24e80 0x494
GetConsoleCP 0x0 0x14001e288 0x26088 0x24e88 0x1a0
GetConsoleMode 0x0 0x14001e290 0x26090 0x24e90 0x1b2
GetFullPathNameA 0x0 0x14001e298 0x26098 0x24e98 0x1ff
GetFileInformationByHandle 0x0 0x14001e2a0 0x260a0 0x24ea0 0x1f3
PeekNamedPipe 0x0 0x14001e2a8 0x260a8 0x24ea8 0x38f
CreateFileA 0x0 0x14001e2b0 0x260b0 0x24eb0 0x88
GetCurrentDirectoryW 0x0 0x14001e2b8 0x260b8 0x24eb8 0x1c5
FlushFileBuffers 0x0 0x14001e2c0 0x260c0 0x24ec0 0x15d
GetCPInfo 0x0 0x14001e2c8 0x260c8 0x24ec8 0x178
GetACP 0x0 0x14001e2d0 0x260d0 0x24ed0 0x16e
GetOEMCP 0x0 0x14001e2d8 0x260d8 0x24ed8 0x23e
IsValidCodePage 0x0 0x14001e2e0 0x260e0 0x24ee0 0x30c
HeapSize 0x0 0x14001e2e8 0x260e8 0x24ee8 0x2dc
CompareStringW 0x0 0x14001e2f0 0x260f0 0x24ef0 0x64
ReadFile 0x0 0x14001e2f8 0x260f8 0x24ef8 0x3c3
WriteConsoleW 0x0 0x14001e300 0x26100 0x24f00 0x533
GetDriveTypeW 0x0 0x14001e308 0x26108 0x24f08 0x1da
SetEndOfFile 0x0 0x14001e310 0x26110 0x24f10 0x461
GetProcessHeap 0x0 0x14001e318 0x26118 0x24f18 0x251
GetTimeZoneInformation 0x0 0x14001e320 0x26120 0x24f20 0x29f
LCMapStringW 0x0 0x14001e328 0x26128 0x24f28 0x32f
GetStringTypeW 0x0 0x14001e330 0x26130 0x24f30 0x270
Digital Signatures (2)
»
Certificate: Oracle America, Inc.
»
Issued by Oracle America, Inc.
Parent Certificate Symantec Class 3 SHA256 Code Signing CA
Country Name US
Valid From 2015-04-14 00:00:00+00:00
Valid Until 2018-04-13 23:59:59+00:00
Algorithm sha256_rsa
Serial Number 12 F0 27 7E 0F 23 3B 39 F9 41 9B 06 E8 CD E3 52
Thumbprint 3B 75 81 6D 15 A6 D8 F4 59 8E 9C F5 60 3F 18 39 EE 84 D7 3D
Certificate: Symantec Class 3 SHA256 Code Signing CA
»
Issued by Symantec Class 3 SHA256 Code Signing CA
Country Name US
Valid From 2013-12-10 00:00:00+00:00
Valid Until 2023-12-09 23:59:59+00:00
Algorithm sha256_rsa
Serial Number 3D 78 D7 F9 76 49 60 B2 61 7D F4 F0 1E CA 86 2A
Thumbprint 00 77 90 F6 56 1D AD 89 B0 BC D8 55 85 76 24 95 E3 58 F8 A5
\\?\C:\Program Files (x86)\Windows Portable Devices\slightly.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 4202a7adcdc46a7695819ddd9070eabb Copy to Clipboard
SHA1 008f3c8c52ef38d2d0d2c834ea610b1ede7aabbc Copy to Clipboard
SHA256 b1b2514ae59058e9d60d8eefc0c3ee184859bbb03125f85f21ab3c93d904ec0f Copy to Clipboard
SSDeep 1536:5kggjrHKsc8VPyWIw5lwMr5TEMq/qV1OZCbTwxVgGlkYNOovToTsl:5k5i8VPOOl3OM4cgVzl/k8 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\o61wIO ULs99.m4a id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 81.63 KB
MD5 a04bb15e2dda5dbc3fe93f845d08cee8 Copy to Clipboard
SHA1 10c3c56e93fd5cbb1376fd6cfc384901c3a9cd8b Copy to Clipboard
SHA256 57bd6c610ed1abe3faa3f0e120012bdabf8dc5d4f2450b9a0fd6ac029923ab22 Copy to Clipboard
SSDeep 1536:a41H/pO0WHs1ehPkE0tXW07dLfgmomtvD6eiq6An9FVITHtZGqtuntpsl:HHhms18km4L0QGm6AVuNZZtR Copy to Clipboard
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf id-Br3n0G72wUb8CejT.LyaS Created File PDF
Not Queried
»
Mime Type application/pdf
File Size 182.46 KB
MD5 b515f7b33b9f8cb1cf59dc54253cd98a Copy to Clipboard
SHA1 a7432329843328f53185d79ed9b1fb73991a4e65 Copy to Clipboard
SHA256 fcd81262f272add4c9a4aa82031140b8b7658cc5dd3b96209ed3a655a145e831 Copy to Clipboard
SSDeep 3072:bssls1MS60xwZODn/TJTHuX2T/5/dGc4uka2AtSyNLMDTJ5MtvVmbvR:wsls1b60zbJTuXa5McZd2At7mJ5MuzR Copy to Clipboard
PDF Information
»
Title Microsoft Word - WinTH2_Ownership.docx
Subject -
Author mohd
Creator PScript5.dll Version 5.2.2
Keywords -
Producer Acrobat Distiller 15.0 (Windows)
Page Count 1
Encrypted False
Create Time 2015-12-03 15:01:19+00:00
Modify Time 2015-12-03 15:01:19+00:00
\\?\C:\Users\Public\Downloads\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 3fc791e3387c67fb1b13f21f25a7d9db Copy to Clipboard
SHA1 3afa0900eea9aa4ea765bbac8b08ad12e67000d1 Copy to Clipboard
SHA256 5df9afdb30470f0e2c29a92c5054f5c8281a7cdb545f91638c668f27e33a81e4 Copy to Clipboard
SSDeep 48:P3THS9evT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:TvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.55 KB
MD5 d4aa148bf7d65924353d68c72f6006bd Copy to Clipboard
SHA1 2192273080ecefb062f6e9cdc8fb154f1abc7161 Copy to Clipboard
SHA256 c32338ad8d0582b0a7e6270c656e9fd3629b6e55a5339962df6dff0264de3365 Copy to Clipboard
SSDeep 48:JGJmcyIwxVPkGzhV0oz7U5A0szdpfMlL5k2vT4VFCvIA1XmDmIVJVvqc3YanmQ4a:JGJmcWVPk4hfzD0szMo2vkVYj1Xm6IVl Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\THIRDPARTYLICENSEREADME.txt id-Br3n0G72wUb8CejT.LyaS Created File Text
Not Queried
»
Mime Type text/plain
File Size 172.94 KB
MD5 745d6db5fc58c63f74ce6a7d4db7e695 Copy to Clipboard
SHA1 a816fb5dd09e32d80e1ecf47a458569e3868b975 Copy to Clipboard
SHA256 c77ba9f668fee7e9b810f1493e518adf87233ac8793e4b37c9b3d1ed7846f1c0 Copy to Clipboard
SSDeep 3072:Yj33DuJYSqN7amC35q6dNFiG8OH8eowpQcw+4oHHZZvc9HNhJhxe+p/U0UIdKJpi:3qN2p5Jmncw+4o0HMWEyHrNRj Copy to Clipboard
\\?\C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 4.13 MB
MD5 1ff608ac4430fc041fc1a657f76152df Copy to Clipboard
SHA1 033085879024b4c342b5f1fd1ca3c75f03ecfbba Copy to Clipboard
SHA256 d336fac1110e8b1f00139c02f0b0fba56ed4ee28b57b0b66f2d0f0042569d636 Copy to Clipboard
SSDeep 49152:vMWGj7u4FwHIWjUHFG5X/qKm/v8y8iHcie8BOQZb2jZ4sM7biZyXr3nF1Y852/av:v27u42oiUHFG5jm/dHnk7KrX7PevpW Copy to Clipboard
\\?\C:\Users\Public\AccountPictures\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.69 KB
MD5 873888c0bb841bb9da0b4114c9d56c2e Copy to Clipboard
SHA1 8db84d99987df76804135598db0ee95e802fb45d Copy to Clipboard
SHA256 850758e9fe84f30a07708c5ec31a4464d06c39376f922f3e5766102f1b82aed4 Copy to Clipboard
SSDeep 48:7B7J+waWWvcYvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:Fz5HYvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\All Users\Microsoft\ClickToRun\DeploymentConfig.2.xml id-Br3n0G72wUb8CejT.LyaS Created File XML
Not Queried
»
Mime Type application/xml
File Size 1.35 KB
MD5 3793544370ec1fddcf5ba6ae099f2538 Copy to Clipboard
SHA1 c784c5d8d1c496ab7ba1150782d20cba67b76321 Copy to Clipboard
SHA256 87975551187040cc2505a12ac285c042b8e70921a55808ecf982c7cd37df0ae2 Copy to Clipboard
SSDeep 24:QlLPFdNyWwbEUgMClMJJyBz5n6PEAJrBPE2gQGkWyGkWzRp1BTXSoNwOP:y/NFOWC+68A1B82PGKG7Rp1BTiPs Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.13 KB
MD5 7c905e57fe11109db0fdb2f7c99fe353 Copy to Clipboard
SHA1 85b1bf8beb4a3fa5fa4a8d214a26e4c9077df8e5 Copy to Clipboard
SHA256 75478e7bb134a63d6fec67a2d4e4d08bd1f4b80c359d2da5346c019c4f441360 Copy to Clipboard
SSDeep 48:AK1mgAh983sAfGGr1aPE40vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:AWm788Azr1n5vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Microsoft\IdentityCRL\INT\ppcrlconfig600.dll id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 25.21 KB
MD5 166cd787b9c532bc2ff7ff1ad8d52649 Copy to Clipboard
SHA1 a5934a7b1748afe09cdd1ecc4097147eeae1f326 Copy to Clipboard
SHA256 ebd64f105d41cfd3fbfbd4868d1ad7a216631ba639df614594e1d60b2436034a Copy to Clipboard
SSDeep 384:g54Pr7ZRaXhakl+zJkEpaMl3oWkfAkJKNc8Xv/PFi1BgVwmtIGeAUUvsQkBOVrx:/r7X2To1wWsVcNc8nP9pUU1kBsl Copy to Clipboard
\\?\C:\Users\All Users\Microsoft\ClickToRun\DeploymentConfig.1.xml id-Br3n0G72wUb8CejT.LyaS Created File Text
Not Queried
»
Mime Type text/plain
File Size 3.43 KB
MD5 7d7beff8a0456ae40afd0933de566585 Copy to Clipboard
SHA1 424b7248c2b02fe2027c6e7451b877cbe2656ce4 Copy to Clipboard
SHA256 fb7c6c34d9efa679b348609803988da95175a0bcb7b8b5e95b1974e0505be667 Copy to Clipboard
SSDeep 48:y/NFOWC+6fHAPUqfCsJU8/9EPGKGkUqfCRp1BTiw49BTkg:UcW76/Ea0dlZE Copy to Clipboard
\\?\C:\Users\Public\Libraries\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 0.42 KB
MD5 e8d021840490d2589ecf53f8636717c5 Copy to Clipboard
SHA1 70dad2c6629d9e08805d834700340f8771df030c Copy to Clipboard
SHA256 60a0126a1bc0406f5ddcc9225e79e9793f707d4f8c24f0049f1c7bd7fdcd6c73 Copy to Clipboard
SSDeep 12:tRwmCtmdtUTfEmr1mnKVp02zUx5XPmXmj046Pd1q:tVCtOtUTMq1mKPNA7X+o0462 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\K5afBvaXQ17XKw.wav id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 86.03 KB
MD5 f4fda3f9a993f4e205565e5ff2353c97 Copy to Clipboard
SHA1 ea78d24db8bb76ef8a12b9d79cced4500811d68b Copy to Clipboard
SHA256 d17384ca13f73ed958515a1ae5d7c0c12ff84c484ed838c644c1331760e1811a Copy to Clipboard
SSDeep 1536:ZGkTULeKFMGDrgiGhLc6P8BZMoNkDQ7LCW7pumcxOkJOAjL5gsl:okTEeBGiLB1M7L3l+OkMAjLV Copy to Clipboard
\\?\C:\Users\Public\Desktop\Acrobat Reader DC.lnk id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 3.58 KB
MD5 7431de4911be108d8d6877adf57ab40e Copy to Clipboard
SHA1 02cd08b6b095795832f8e973ba974cf88894cd37 Copy to Clipboard
SHA256 b60e1bd69b03e1c9040178e1eba24cce5ffa46b76fd845fcb31df7f6962d8246 Copy to Clipboard
SSDeep 96:sN8k9+pd8YsnoQDr4vkVYj1Xm6IVJVvlpYx0:sNeFsopvkejdm7VJVvx Copy to Clipboard
\\?\C:\How To Restore Files.hta Created File Text
Not Queried
»
Also Known As \\?\C:\Boot\How To Restore Files.hta (Created File)
\\?\C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\How To Restore Files.hta (Created File)
\\?\C:\$Recycle.Bin\S-1-5-18\How To Restore Files.hta (Created File)
\\?\C:\Boot\el-GR\How To Restore Files.hta (Created File)
\\?\C:\Boot\da-DK\How To Restore Files.hta (Created File)
\\?\C:\Boot\en-US\How To Restore Files.hta (Created File)
\\?\C:\Boot\en-GB\How To Restore Files.hta (Created File)
\\?\C:\Boot\bg-BG\How To Restore Files.hta (Created File)
\\?\C:\Boot\de-DE\How To Restore Files.hta (Created File)
\\?\C:\Boot\cs-CZ\How To Restore Files.hta (Created File)
\\?\C:\Boot\es-MX\How To Restore Files.hta (Created File)
\\?\C:\Boot\et-EE\How To Restore Files.hta (Created File)
\\?\C:\Boot\es-ES\How To Restore Files.hta (Created File)
\\?\C:\Boot\ko-KR\How To Restore Files.hta (Created File)
\\?\C:\Boot\hr-HR\How To Restore Files.hta (Created File)
\\?\C:\Boot\lv-LV\How To Restore Files.hta (Created File)
\\?\C:\Boot\fr-CA\How To Restore Files.hta (Created File)
\\?\C:\Boot\lt-LT\How To Restore Files.hta (Created File)
\\?\C:\Boot\ja-JP\How To Restore Files.hta (Created File)
\\?\C:\Boot\it-IT\How To Restore Files.hta (Created File)
\\?\C:\Boot\hu-HU\How To Restore Files.hta (Created File)
\\?\C:\Boot\fr-FR\How To Restore Files.hta (Created File)
\\?\C:\Boot\fi-FI\How To Restore Files.hta (Created File)
\\?\C:\Program Files\How To Restore Files.hta (Created File)
\\?\C:\Boot\sl-SI\How To Restore Files.hta (Created File)
\\?\C:\Boot\uk-UA\How To Restore Files.hta (Created File)
\\?\C:\Boot\tr-TR\How To Restore Files.hta (Created File)
\\?\C:\Boot\sr-Latn-RS\How To Restore Files.hta (Created File)
\\?\C:\Boot\ro-RO\How To Restore Files.hta (Created File)
\\?\C:\Boot\Resources\How To Restore Files.hta (Created File)
\\?\C:\Boot\nb-NO\How To Restore Files.hta (Created File)
\\?\C:\Boot\sk-SK\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\How To Restore Files.hta (Created File)
\\?\C:\Users\How To Restore Files.hta (Created File)
\\?\C:\Boot\zh-CN\How To Restore Files.hta (Created File)
\\?\C:\Boot\sv-SE\How To Restore Files.hta (Created File)
\\?\C:\Boot\sr-Latn-CS\How To Restore Files.hta (Created File)
\\?\C:\Boot\ru-RU\How To Restore Files.hta (Created File)
\\?\C:\Boot\qps-ploc\How To Restore Files.hta (Created File)
\\?\C:\Boot\pt-PT\How To Restore Files.hta (Created File)
\\?\C:\Boot\pt-BR\How To Restore Files.hta (Created File)
\\?\C:\Boot\pl-PL\How To Restore Files.hta (Created File)
\\?\C:\Boot\nl-NL\How To Restore Files.hta (Created File)
\\?\C:\Boot\zh-HK\How To Restore Files.hta (Created File)
\\?\C:\Boot\Fonts\How To Restore Files.hta (Created File)
\\?\C:\Boot\zh-TW\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\How To Restore Files.hta (Created File)
\\?\C:\Recovery\WindowsRE\How To Restore Files.hta (Created File)
\\?\C:\Boot\Resources\en-US\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Internet Explorer\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Microsoft Office\How To Restore Files.hta (Created File)
\\?\C:\Users\Default\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Microsoft Office 15\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Reference Assemblies\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Uninstall Information\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\regid.1991-06.com.microsoft\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Journal\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows NT\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Mail\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Photo Viewer\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Portable Devices\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Multimedia Platform\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Media Player\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\DESIGNER\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\Services\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\System\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\ClickToRun\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Services\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\MF\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Diagnosis\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Internet Explorer\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Microsoft.NET\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Media Player\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Multimedia Platform\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Photo Viewer\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Mail\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Provisioning\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Windows Portable Devices\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Music\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\OneDrive\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Documents\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Downloads\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Searches\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Videos\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Internet Explorer\en-US\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Saved Games\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\USOShared\Logs\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Photo Viewer\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Media Player\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Defender\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Microsoft Office 15\ClientX64\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft OneDrive\setup\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows NT\Accessories\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Links\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Java\jre1.8.0_131\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Desktop\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Documents\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Downloads\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Pictures\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Music\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Oracle\Java\installcache_x64\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Office\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\IdentityCRL\INT\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Desktop\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Internet Explorer\images\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Internet Explorer\SIGNUP\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows NT\TableTextService\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Journal\Templates\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Java\Java Update\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Videos\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Journal\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Mail\en-US\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Oracle\Java\.oracle_jre_usage\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Windows Live\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\AccountPictures\How To Restore Files.hta (Created File)
\\?\C:\Users\CIiHmnxMn6Ps\Favorites\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Crypto\SystemKeys\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\IdentityCRL\production\How To Restore Files.hta (Created File)
\\?\C:\Users\Public\Libraries\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\User Account Pictures\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\System\ado\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\VC\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\VGX\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\MSInfo\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\ink\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\VC\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Mozilla Firefox\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\Source Engine\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\USOPrivate\UpdateStore\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\VSTO\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Windows Media Player\Media Renderer\How To Restore Files.hta (Created File)
\\?\C:\ProgramData\Oracle\Java\javapath_target_5923062\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Common Files\microsoft shared\Stationery\How To Restore Files.hta (Created File)
\\?\C:\Program Files\Microsoft Office\root\Flattener\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\Ole DB\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\msadc\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\ado\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Common Files\System\en-US\How To Restore Files.hta (Created File)
\\?\C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\How To Restore Files.hta (Created File)
Mime Type text/plain
File Size 0.89 KB
MD5 5222fe422c92bb4cef7de62af663e889 Copy to Clipboard
SHA1 7bbb12ee8df0709593379bc2edcdb95f019403bd Copy to Clipboard
SHA256 3e77c151f1a9604b68e7e18d3c226d36f0d7884c138131d64f9e13a9b9d4db2c Copy to Clipboard
SSDeep 24:k/bxHNZAlf1sR1iYsFT5RMfvIKNxHHNaHzSRJrkjF:gxtZAlfIeCfnNaHhjF Copy to Clipboard
C:\windows\searchfiles.exe Created File Unknown
Not Queried
»
Mime Type application/x-empty
File Size 0.00 KB
MD5 d41d8cd98f00b204e9800998ecf8427e Copy to Clipboard
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 Copy to Clipboard
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.007.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 fac67d94ce19b41b17eca401e9f50826 Copy to Clipboard
SHA1 2c9680f0e1dd842ffbf5406e47c6299f58a53c26 Copy to Clipboard
SHA256 d53822c0daf6b403f35780979391e1049d004551a1eca5967acef0b7c61e5a4e Copy to Clipboard
SSDeep 384:iTRr0gElanOch/HNc9IgG6Z/ypi+yV2lZwBOBOVrx:uTnnOgNc95G64pUzOBsl Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 72c282b0e122f7453de9b9eb1d841169 Copy to Clipboard
SHA1 e8a85f5b41e3bdf1b43b4804efee0d89c2f0dcb1 Copy to Clipboard
SHA256 b7b98e0c12acab43b042ffbeca1c7c0e538a6275e43b3fe200a712e8b37679f1 Copy to Clipboard
SSDeep 48:yZbclxjXBNo6RX2BRHh8meNvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:yZolhBbcBJumeNvkVYj1Xm6IVJVvlpYC Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 5f6037f8c98914d4f3d7d9d55bcd8b6d Copy to Clipboard
SHA1 37481233ef3ea231ddd1ce950f36048012ee1099 Copy to Clipboard
SHA256 20ce655bb14cdca3043f5fc0a1369982399f11b779482be67d62f65064b8b64e Copy to Clipboard
SSDeep 48:q3+Dwl6/rojhvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:q5l6zQvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Microsoft\IdentityCRL\production\ppcrlconfig600.dll id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
»
Mime Type application/x-dosexec
File Size 24.22 KB
MD5 8a188c747e3f1a8bbabea5bfcbda09f6 Copy to Clipboard
SHA1 ca42ac003d793747e42ae579b47eca68587b6c9f Copy to Clipboard
SHA256 cca982136eb5f317389f1224c32af46051080e8a98b3261489ecd380ae14d2b3 Copy to Clipboard
SSDeep 384:fWLzrKWArfPnnTM+Z2oI8eZZzm5yKoV0pFq0GftpBj657:w0fQ9m5msHie7 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Size Of Initialized Data 0x4400
File Type dll
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2016-12-16 04:19:49+00:00
Version Information (9)
»
LegalCopyright Copyright © 1995-2006 Microsoft Corporation.
InternalName ppcrlconfig600
FileVersion 16.000.26889.00
CompanyName Microsoft Corporation
LegalTrademarks Microsoft® is a registered trademark of Microsoft Corporation.
ProductName Microsoft® Windows Live ID
ProductVersion 16.000.26889.00
FileDescription Passport CRL configuration
OriginalFilename ppcrlconfig600.dll
Sections (1)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.rsrc 0x10001000 0x4300 0x4400 0x200 cnt_initialized_data, mem_read 5.72
Digital Signatures (2)
»
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2016-08-18 20:17:17+00:00
Valid Until 2017-11-02 20:17:17+00:00
Algorithm sha1_rsa
Serial Number 33 00 00 01 40 96 A9 EE 70 56 FE CC 07 00 01 00 00 01 40
Thumbprint 98 ED 99 A6 78 86 D0 20 C5 64 92 3B 7D F2 5E 9A C0 19 DF 26
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-08-31 22:19:32+00:00
Valid Until 2020-08-31 22:29:32+00:00
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.003.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 d5fcb6e8f9586fdf0db68f6f35d4fe29 Copy to Clipboard
SHA1 6ad413a2c6cf73a15e5c8da55d9f6d4c5707348c Copy to Clipboard
SHA256 61ef383a18d298b8fe45307241443e1891df7445fcb813d61b6e85b7c143ce41 Copy to Clipboard
SSDeep 384:sfHlD9PO2W4hgQdfUDv4EE48kg70UoDYN/woen2ZinIBOVrx:svl5POTygPukgzA21e2ZiIBsl Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 453.62 KB
MD5 1665b0b61856cdc24c6cdd0cfd20973f Copy to Clipboard
SHA1 a60c21f90c1da9470b15cf02cfe89c3b419404dc Copy to Clipboard
SHA256 5f807c3bc70e52a89f42c0852eedc061d486342eefb7ed00ec22786cf8a20ae4 Copy to Clipboard
SSDeep 12288:jJkJpnXYiB8N9UxUCAiKMTURoXE0JhsB+H4Ll:IpXYw8IeCAOGF0skH6 Copy to Clipboard
\\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.63 KB
MD5 f22f15cbe8908ffc0be51d7f60a03619 Copy to Clipboard
SHA1 bd99c472a27115b94f6ec78d213a37618dd2286b Copy to Clipboard
SHA256 62c305c53a1cebcf2d828fcc38f642fa98766ce35e5bd2b4991730a3cf3437b2 Copy to Clipboard
SSDeep 48:04kzQBzuvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:04ksBivkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Pictures\6VPPhG1IT3F2Zg-.bmp id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 81.79 KB
MD5 021b3299959519c499dc84c3de52b566 Copy to Clipboard
SHA1 ffcd6f8aa6162ef7cd911ef6a9ff6733b57d419a Copy to Clipboard
SHA256 489a8181434207137b65b6f994c0f6f8f4722b2c611b6e55eae6f1f91ef94a80 Copy to Clipboard
SSDeep 1536:9XufZDUCkC/RKRh6WPploF9CZTqpDiq/ROk9iVPKRNTykgL8n8gZNIW7sl:9XufpUCrJO0WPphNqpW0oO7gy8gZNC Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.65 KB
MD5 89eff2e9660b2903005b8709e499ba09 Copy to Clipboard
SHA1 ab6322c99fdc1f39f89c9ddfbf34d11bb651530d Copy to Clipboard
SHA256 aac0108d6a253d4fbf96d15b5fd772d77458065b472a5ff55eac3e601eef5e4c Copy to Clipboard
SSDeep 48:axT19fbWrfqas7SMU1Xv2Dj3tteBvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:aF1gK2MeX+Dj3tkvkVYj1Xm6IVJVvlpZ Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.13 KB
MD5 f5671ef2efadc7e7b109eb314d6c452e Copy to Clipboard
SHA1 002e48a1eb6c5cdc0c17d63e583c11a78b9a0899 Copy to Clipboard
SHA256 393e3d711351d6616018a14ec71ac163241b1597628b49ec32970cb6a9b12637 Copy to Clipboard
SSDeep 48:W3xpmaIzsh/8vUH0vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:apmaIzi/Z0vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\Public\Pictures\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.87 KB
MD5 9316169bb34fac952be4f0b4ecfcfcb9 Copy to Clipboard
SHA1 679e858f5f67c726365a75a8f023baf5ddb96a85 Copy to Clipboard
SHA256 5bc2fadbff7d306bdb5621e183ab6a00de73c23de1f2706f9df6ee72346ae7b2 Copy to Clipboard
SSDeep 48:MXiOIrjKoXx+8vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:MXiOwThBvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\bootmgr Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 386.00 KB
MD5 cdf075b70e5f612b4399a54b25d55192 Copy to Clipboard
SHA1 3b37308a601665b38dbc02f36359fdebd1abc006 Copy to Clipboard
SHA256 a0e54d6b2503139355488bc2fd3204a1ecbe228419e8a5ab234efe5be6fc0289 Copy to Clipboard
SSDeep 12288:3sp8fYyDEFLbv5zG/BUEG+38EdPgoBlma7D:cpGYyiz5zGZdGQtgoTmQD Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 b14d78df896a4fb0e12cc910f8551b3a Copy to Clipboard
SHA1 9e0297bdd1f7b42be7c3c68b3e192bb796609d81 Copy to Clipboard
SHA256 5cf3ce8147f8450f0e583dac45890cae60a1efa1337ea70c7e02256ff26ca800 Copy to Clipboard
SSDeep 48:S9ymvbhHr7arhB/HAg01vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:yhHr7MZuvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Oracle\Java\installcache_x64\baseimagefam8 id-Br3n0G72wUb8CejT.LyaS Created File Unknown
Not Queried
»
Mime Type application/zip
File Size 10.00 MB
MD5 0beaef313b020be26a8ac109163f0174 Copy to Clipboard
SHA1 1d24fb94c03f74ae694c1d32ea82df2d857bdb81 Copy to Clipboard
SHA256 83ea532b5ef5907005638e159fdc2a62b0f426dd216e77da6daaf16733574b84 Copy to Clipboard
SSDeep 98304:D/GhkxpdT24N3Szg1x+9W6dwbNj9IF/Dml8ekFXwuPcr:7GudTTzx+9Rq99IFLYoXwdr Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\THIRDPARTYLICENSEREADME-JAVAFX.txt id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 63.93 KB
MD5 a344623714a39a4af8107afbf70d6103 Copy to Clipboard
SHA1 1eb2aa8e571f8eefeafbc640f4401e927112c1e2 Copy to Clipboard
SHA256 8616d6f61bf92561180f9a6fca030507d0beba6ef7df02dff8642c7e16189281 Copy to Clipboard
SSDeep 1536:7yhG6CQO1jVkPow31tvZjyo7PzzEOkJmENWTgJhsl:7ybCQOnmp31txj/7/Zj Copy to Clipboard
\\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 25.17 KB
MD5 6430f9126dc2be7879577372f79995c3 Copy to Clipboard
SHA1 24e8d58c1fde077f51f5f85c8d3847d5d086544a Copy to Clipboard
SHA256 9d8dfb327bea5dbfe73c580deb21e1493a555328212ddae522154cad3528167e Copy to Clipboard
SSDeep 768:ifuaVdndhNDkeNrMCmRLqeMRtYJvGIySeKSc3dBsl:8NdnJkehlmRp20ZyK3Hsl Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\mqFOr.avi id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 73.46 KB
MD5 072e8b5ba7f8012b9c7e2a81c27d80f8 Copy to Clipboard
SHA1 2f8be4cadcff582c043910f5fa6db6cf3d8f0ac3 Copy to Clipboard
SHA256 fd3047e8325e7f4993dae9a1760d7d105e884e0283cd691b1dca78a5047c1e34 Copy to Clipboard
SSDeep 1536:F6Kz5H5BSYX8oZPtLtMC/sGxDMfhYi4PEDk6d9mjFwsl:wU5hModVGJYtvRj5 Copy to Clipboard
\\?\C:\Users\Public\Videos\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.87 KB
MD5 2bf85f4ec51dd85c34de89f1db1d2580 Copy to Clipboard
SHA1 372b1169576834e4d8edf058bc3aadccc236ac1a Copy to Clipboard
SHA256 87847ff29e4245fac1b12d7dca66e2e607e9869898f901b783d16ca126ced5af Copy to Clipboard
SSDeep 48:hpIELBkcFuKgBZvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:hpBdJuBZvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\COPYRIGHT id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 4.67 KB
MD5 58e253295ea254e4ebd9bfeb9eaa50b2 Copy to Clipboard
SHA1 c482c6697c3783dc95e3791a2764156dae5098e2 Copy to Clipboard
SHA256 61954e61ba87ff4ff4c5764db2823540bb7f5c69a592cd3943c15327b4327130 Copy to Clipboard
SSDeep 96:jUCKHk3NcHRj3fN1Vhf5K5HqhjC9xQcWvkVYj1Xm6IVJVvlpYx0:gREdqV3fvlK5HaalWvkejdm7VJVvx Copy to Clipboard
\\?\C:\Program Files (x86)\Windows Portable Devices\semiconductor phys.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 f68719464cb21cd6ce3f56b29edec1b0 Copy to Clipboard
SHA1 bd3cd6a48e62fc272879175e3f1de292beb41753 Copy to Clipboard
SHA256 24c0549fd23713a9f6abb895e1fdfc7302be2944d0f9d9694e74a162844db6ad Copy to Clipboard
SSDeep 1536:xImrgG8zi3jpaweTvgTIdFDS3cbUR7WV5yeGYdptVFoMwBVOwzUtsl:xqhiYweDP4MgWVcwA3Oi Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Links\Desktop.lnk id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.01 KB
MD5 57b512551467aab1a1edb0b7bc9e3c0d Copy to Clipboard
SHA1 9bd52027f8e1cf8caf722563b399bd4a2436aa23 Copy to Clipboard
SHA256 c1ef3b32203da05b5cbd5b5dbabd65ecd8af1409e80b35cce236a3930544e623 Copy to Clipboard
SSDeep 48:yXkJ+sW74oJHvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:pRpoBvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Uninstall Information\just_instant_bulgaria.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 4f12438545114737db4b88bb0a1afb59 Copy to Clipboard
SHA1 a85a5179e99004fc4f66d14a21b341a7cd88cdbc Copy to Clipboard
SHA256 b4b4b0d95ed2e53f4af5e519f5dddc28da6effd85817766ec3cb823123fc6ec7 Copy to Clipboard
SSDeep 1536:a77sfnWPa2RZilkMgOCUE45h3WNYSVAlBE+Yx431YO+Lz2PYOaTsl:a3knga2RZi9ZC74Dp9/naOnM8 Copy to Clipboard
\\?\C:\Users\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.67 KB
MD5 1c1f7836cbb07d7056f77965d700cc38 Copy to Clipboard
SHA1 3912f9667dab7566522469758179ab60bc4e8061 Copy to Clipboard
SHA256 fe0f26c3c61881529df430edba2d0fc5492e2245075add3024ef3e3ef736c802 Copy to Clipboard
SSDeep 48:46hyOR4r/vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:47vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.55 KB
MD5 8c340ec9307d8363613a180ec8d2d0b2 Copy to Clipboard
SHA1 e451eb9c7ee3922d15843c27b023cc9e371a8573 Copy to Clipboard
SHA256 52305b89ba589f6e293bfdb703750ba42db1a6d49b0b2cbb5ab4ae3207b631d0 Copy to Clipboard
SSDeep 48:uscKSeTU7+FE+Z4mapUWviGHSZwpKXmvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:usc/X7nbcGHgCKXmvkVYj1Xm6IVJVvlX Copy to Clipboard
\\?\C:\Program Files\Windows Photo Viewer\runtime recommendation.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 f947101217bb7181157d2980f63bcb9c Copy to Clipboard
SHA1 361e351a1d0dd74c5110b34e7371bc6108e7acca Copy to Clipboard
SHA256 8c9f6cbd1cda8695c0884f66c7e59c97eb98e22decf93cf7e170b136395c0aba Copy to Clipboard
SSDeep 1536:9Ob+7KLk4TleloLitGP5+bUgAfBK/0IE9KHhzGK19+/ROsl:4b+mI41uNWBKu9ChGK19+P Copy to Clipboard
\\?\C:\Users\Public\Documents\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.77 KB
MD5 1ddacbf033e394e41c713fdbc20892bc Copy to Clipboard
SHA1 e118f09fda40a9bd0012d5c8186f2ba74e4449a0 Copy to Clipboard
SHA256 4c279c4ca5513a8a82f28c43db3d47c7cb8649d49e9bf419c60365236d0f50a8 Copy to Clipboard
SSDeep 48:ZAQ9Xx+gPvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:iEX1vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\2RMYqU6OwcaNfG5QwG.pptx id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 35.46 KB
MD5 88f5e548d0023febf5117976eb378b4f Copy to Clipboard
SHA1 a2f63175e680dbcbffe297e4597881f5520a8706 Copy to Clipboard
SHA256 804dcc26cd1b1617bc63cacf3b1da455466febf0897433fe0906f3edfd099d8f Copy to Clipboard
SSDeep 768:pcgkwVvWCsoqtPP/qFggcvUZSGjeEj7i1DhEN0YZzijg1RnnAozGYz+Bsl:nWCsoqtvqFcvUDV7iRhaziE1JZ7Wsl Copy to Clipboard
\\?\C:\Program Files (x86)\Windows Multimedia Platform\pump.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 45a7cde137c77f0be432516bc671605a Copy to Clipboard
SHA1 1a6af1301577147221b756e55d2fd18522c77eaf Copy to Clipboard
SHA256 088570df5d64fca5929ed98e0c335b1df7de91f2633862b4a4c3e8b926957e24 Copy to Clipboard
SSDeep 1536:DtVhKv9XRmKcWbYvZ0ow5GSvgMr1RpQNUDbKn1W3NaB2mrDJsl:DJKvXbYdw5XgW1DCUKY3NaB2qy Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\vcredist_x64.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 453.66 KB
MD5 b6409a824001944315f13cec9064cc5e Copy to Clipboard
SHA1 9235fded33f8395065729df7de82b9e649ad2358 Copy to Clipboard
SHA256 3fec4c36fe0b2d4103e5957874ccb04a61d59d583cf17d9e7e7457774e5cba69 Copy to Clipboard
SSDeep 12288:TT7Q5ZO118pZoDyha3v+UGGbeTem1OO1/ZV4JXWOEfwRySlcT:s5ZO118pq2h1UGGKem1X3V4Jm0u Copy to Clipboard
\\?\C:\Program Files\Microsoft Office 15\charity.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 a97097950fd4e67d5ccc15dee2c89634 Copy to Clipboard
SHA1 a55250aec1f8caf6e12317b8a4b17e76a447c500 Copy to Clipboard
SHA256 e0989423a0addb2a2dd0f73284d58c7ffe9e85dccffd66f87c1a7d27da796576 Copy to Clipboard
SSDeep 1536:cF9AXhKUkWcQsyZpezoZD9op8YBhth0ylrVXPG4nt8nt5fa91sdgdMsl:Au1kMs8R9o3hthXPBnwY1sdgp Copy to Clipboard
\\?\C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 3.43 KB
MD5 a6b328ae4fc15362efd75db9300039ac Copy to Clipboard
SHA1 630bd623d03b4877e0da9c7427d0c8784625a7eb Copy to Clipboard
SHA256 c74331bf256669653289638d1573832c77195b8dcd4fa415cf4838ecb6d863d3 Copy to Clipboard
SSDeep 96:Sbr+qKkNt0DPZmY9qgzDvkVYj1Xm6IVJVvlpYx0:SWCz0NmIqgzDvkejdm7VJVvx Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Links\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.99 KB
MD5 73432b167cab0e1c744ea86a7849c980 Copy to Clipboard
SHA1 c8a1ae3cc37b6d636f31e06fbf17ea383c54aebe Copy to Clipboard
SHA256 e3a88af1d2d5679ad1769c6d1ef3c71d32468db5172fb65e132be6a4e30e2eae Copy to Clipboard
SSDeep 48:PQjQASvHl5UJPey8OSfvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:PUQ9LUJ+vkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.63 KB
MD5 838ee97a6e21d1dd5e49f848fb8e3e3c Copy to Clipboard
SHA1 3a1b145c135f200646397cda3f8ef73f6e84c902 Copy to Clipboard
SHA256 fd5308940aff904756a548a87d5f840c4a638036aa1e8c894e1552a9b0fe25d1 Copy to Clipboard
SSDeep 48:mh5idUkIuDvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:mh5id4uDvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb id-Br3n0G72wUb8CejT.LyaS Created File Unknown
Not Queried
»
Mime Type application/x-msaccess
File Size 348.00 KB
MD5 18f4c424310b664ccaeb16cc6628ad5b Copy to Clipboard
SHA1 780009cced34531d4eff34244d480e4a451e6fa6 Copy to Clipboard
SHA256 978bb09dc0e260186252e9cc86a076074bd9bf7b06772dcd069a2fff316b8a84 Copy to Clipboard
SSDeep 768:cCrlqlHadRcdR4flxVrkJtCzUedRbPdRb0dRb7dRb/:c6lqlHadmdSnAJtCzZdxdmdld9 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Desktop\1PIfCh65fn7.docx id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 92.27 KB
MD5 769812fd628b8e691ef76411fc51a01f Copy to Clipboard
SHA1 a4e03db56ef682de196fe00d2ca0816c32d6333a Copy to Clipboard
SHA256 89283b0458f876441f2d61d4411b7ed31202d2abe8c88124e7e2669cb3f5ab30 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
\\?\C:\ProgramData\Microsoft\Windows Live\WLive48x48.png id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 6.05 KB
MD5 a7c437ac3151d1b6eaff93abf15f2262 Copy to Clipboard
SHA1 3c5f7be207882c25b4ccc9cbb0afa5b54d359993 Copy to Clipboard
SHA256 29080b5efd0f702f554ce57b766404fef9e75b92e3a3cb43fb8d8464029367f1 Copy to Clipboard
SSDeep 96:poRqUm40CeNefjxdlynEFRaspIQW3UTHKLG8NjVos4vkVYj1Xm6IVJVvlpYx0:phUm4f9IUFOUDK5jVivkejdm7VJVvx Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.24 KB
MD5 bd303d1a1802917df2792a64f3b96a95 Copy to Clipboard
SHA1 14ef0d433d8b5eccebe776c9433696e8bf5eeda6 Copy to Clipboard
SHA256 f1bc1400f683c7c546d9d3beec48b19358f5183a92217d3da912bc1ad5294c21 Copy to Clipboard
SSDeep 48:glkldTCWZXAm30EFTAQxzgyZt0jmRvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:ll2zQxlZtCMvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Unknown
Not Queried
»
Mime Type application/x-wine-extension-ini
File Size 0.63 KB
MD5 6bd5fb46283aa48e638bef47510c47da Copy to Clipboard
SHA1 c38d46ec6c9bc8baece4a459b617f44d10af973c Copy to Clipboard
SHA256 44fe5eebd80e46f903d68c07bcf06d187a3698bf3953bc58bb578465e2e0fe6c Copy to Clipboard
SSDeep 12:q9TBN1tbr5XT2iTuRlCKGL+TiTNDODaPi:q9T7DblD2cuDGL4CNDODaq Copy to Clipboard
\\?\C:\Program Files\Windows Multimedia Platform\freeware.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 5abd5d92365cc1e9e249b4052064b7dc Copy to Clipboard
SHA1 188021d51d566c92dcad60cee3c9cc7a76ea9211 Copy to Clipboard
SHA256 8f0b3a55beee0869e4f692aefda970c9327ee3557082083b6f2d882e51c88545 Copy to Clipboard
SSDeep 1536:PA9BU9IuOukZVzeEqQx7+5gMVEVxC4I9+lxXoWHwtrK3Mp3JnvHc8b9u3sl:PGd9ehriO4IHiwtrK8zHcPo Copy to Clipboard
\\?\C:\Program Files\Common Files\Services\verisign.bmp Created File Image
Not Queried
»
Also Known As \\?\C:\Program Files (x86)\Common Files\Services\verisign.bmp (Created File)
Mime Type image/x-ms-bmp
File Size 2.64 KB
MD5 618aa7be4cd1750b0a5f6247d084392f Copy to Clipboard
SHA1 fe878c289c59f085d8edf73cc634492ce6bb3281 Copy to Clipboard
SHA256 7f79dade5c9f7c6851af225be7d73d88b62259ed251638ba0140c7ea311cf2ed Copy to Clipboard
SSDeep 12:VGSaGRX0BalfJeZqm3I03p21byt71t/rfahott6YYJ7rrluT1Sc8/M1il2lvf:ISrF0BbqWIJbqnLahwwjhrcZSccM1iYV Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\VyW OD.mkv id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 66.75 KB
MD5 7e99b1f5225c14db8cfb4f03ec7af461 Copy to Clipboard
SHA1 3ea450b5d8125fef1e277489cdf5b79b5cbfcc8c Copy to Clipboard
SHA256 927742ef3254de7493150d17e43ceca42a49fb55ec8d85375d3e608a96d0eb3b Copy to Clipboard
SSDeep 1536:3LMhLbtpSZPGo1EUtoyMeUR68JdTWe9edGc3U0GIwqxTOASe3sl:3LWjmBAyMeC6y5Pc3Udd2+n Copy to Clipboard
\\?\C:\Program Files\Windows Photo Viewer\collecting_vb_les.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 8e94523b84d1fdde169185c1eee0d4e1 Copy to Clipboard
SHA1 efc6aa8eecc4c8981f7c71ad6485b175bda6b370 Copy to Clipboard
SHA256 35c3bab4faf2c2c678f073e830a634cdb1a1c711316d5e75f062e84612bfcf5e Copy to Clipboard
SSDeep 1536:M+20DwHV/UMTWKN2rwJvcnhE/U0ehghX4RB+Rk2GdLnr0cctrbq3Fjtxsl:M+20EHiWp2rq0+/U0UmX4P+Ji4hrqte Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\README.txt id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.54 KB
MD5 72c8dbf17942f671e6deb04b09f14b23 Copy to Clipboard
SHA1 c19f0e5f49139f09d41b08aaf43d4823f4444b5b Copy to Clipboard
SHA256 8c11b67029f89a333b287839f3a6456227643452b39876d1cb7af656a0814c45 Copy to Clipboard
SSDeep 48:rS5RvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:IRvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\BOOTSECT.BAK id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 9.50 KB
MD5 d887e33e371e7750affa600f937fb5fd Copy to Clipboard
SHA1 83adea9de63ff423a45e261d36924ab958e51fe0 Copy to Clipboard
SHA256 bca97bf3d1dd9332d5487b451b01a58b89e4b25c405dc5fa4c2cac14ef3cb658 Copy to Clipboard
SSDeep 192:Vmd8HhJxs1t0SMtpfkTqCNM6Xd2NjT5xOY21uvkejdm7VJVvx:Vmdaf+mSMtpnGtyjn2ABOVrx Copy to Clipboard
\\?\C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.55 KB
MD5 b34148c7228fb0d54ad3c34061116bac Copy to Clipboard
SHA1 71e7e374b29390d184c0602142f5d29133a713c9 Copy to Clipboard
SHA256 e70b883e01a3b107a2fd707aa6a1900e6eef6e1730d7b62a6bc9d6a14b83b85f Copy to Clipboard
SSDeep 48:GEWsXLYBUahJCefEYIKtyGUKvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:ICF5HKtyBKvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\Default\NTUSER.DAT.LOG1 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 25.50 KB
MD5 01d83152a3197ab356e868306a7c439e Copy to Clipboard
SHA1 1a7f7c43eb7355c03775526b5a5b63fbfb360ce6 Copy to Clipboard
SHA256 9a2433ad5a90b11d43aa9573b38c51a2a920d0a63d9cd268a01c7c64316171d9 Copy to Clipboard
SSDeep 768:5qjinnj0p612ztluWCWuhnUdwUluvKjh5SeBsl:4gnj0y4tlH0OcKFTsl Copy to Clipboard
\\?\C:\Program Files\Reference Assemblies\commands.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 231a0484852814b53c7b342ae081ce2b Copy to Clipboard
SHA1 6c83c9ac50ad12608e18e50a0e5b990d7764ecb4 Copy to Clipboard
SHA256 1405747c443c3b4c2b0c2b843b2911aef18c71e178d2ffacb4b550a54767e841 Copy to Clipboard
SSDeep 1536:NBOTfGH4K/LBKJzrr9XMa3kFU6kjLGOYRfnhDGTlFJtyH0rhNiPh0uVsfwsl:NsTfGYK/LexX70t2LGZRf4TlFHyH0r4Q Copy to Clipboard
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 170.95 KB
MD5 3e63ac8c23f08d355a00f987b5cb0aa5 Copy to Clipboard
SHA1 02da54a50121213a3baa02c46b8a90c96299784c Copy to Clipboard
SHA256 4289aabc5923aa36aa1385f284e2642f101646d3e9bb5a2f80ab8f9bf4331cfb Copy to Clipboard
SSDeep 3072:hwSNYdLDFHMR3lNN6b3RFcVKz8ApOnK4Fy+k4SzLIKoOYtSmC7g9f6tEDST5PHNl:hLNYbMF23RFCBnw4GIvRjC6i/g/8n Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Also Known As \\?\C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms id-Br3n0G72wUb8CejT.LyaS (Created File)
Mime Type application/octet-stream
File Size 1.74 KB
MD5 678066b86aa9ab70fc0cdae43ea9ed79 Copy to Clipboard
SHA1 af44df3c4d3ad7f3f8dd0c39b3666280e4936855 Copy to Clipboard
SHA256 f80d5b7ca88a0a21e57ce79c987c9c2ede1918f2821e05e43f1156389db201a0 Copy to Clipboard
SSDeep 48:BKuZ9Xx9sm1PWvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:BVBacOvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Downloads\ChromeSetup.exe id-Br3n0G72wUb8CejT.LyaS Created File Binary
Not Queried
»
Mime Type application/x-dosexec
File Size 1.08 MB
MD5 cb26a32a1ada813d2aab8bc6422e805c Copy to Clipboard
SHA1 c6a924b3e15374bb27bec56b48d997acb3459ad8 Copy to Clipboard
SHA256 e7a349bc71c2b4e728fc0276257ec9165dadebe42aca0de5abbc8ff1d11bd6d6 Copy to Clipboard
SSDeep 24576:8Ej5jDN2+fvw1wh/jSaRjJFS1t/1nCXD8FTI9nZTDReeEYAiBBBny:8iRDN2+HBNRj/inCXDIshZTDRLB7ny Copy to Clipboard
ImpHash 1f7c03adda267bb2a26e5b9e7a1df3f6 Copy to Clipboard
Parser Error Remark Static analyzer was unable to completely parse the analyzed file
PE Information
»
Image Base 0x400000
Entry Point 0x404e56
Size Of Code 0x14a00
Size Of Initialized Data 0xfa600
File Type executable
Subsystem windows_gui
Machine Type i386
Compile Timestamp 2017-04-22 01:31:06+00:00
Version Information (9)
»
LegalCopyright Copyright 2007-2010 Google Inc.
InternalName Google Update Setup
FileVersion 1.3.33.5
CompanyName Google Inc.
LanguageId en
ProductName Google Update
ProductVersion 1.3.33.5
FileDescription Google Update Setup
OriginalFilename GoogleUpdateSetup.exe
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x148a1 0x14a00 0x400 cnt_code, mem_execute, mem_read 6.64
.rdata 0x416000 0x6c00 0x6c00 0x14e00 cnt_initialized_data, mem_read 5.3
.data 0x41d000 0x1298 0x800 0x1ba00 cnt_initialized_data, mem_read, mem_write 2.4
.gfids 0x41f000 0xdc 0x200 0x1c200 cnt_initialized_data, mem_read 1.7
.rsrc 0x420000 0xf1c28 0xf1e00 0x1c400 cnt_initialized_data, mem_read 7.98
.reloc 0x512000 0x10b4 0x1200 0x10e200 cnt_initialized_data, mem_discardable, mem_read 6.35
Imports (5)
»
KERNEL32.dll (91)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
QueryPerformanceCounter 0x0 0x416000 0x1c334 0x1b134 0x436
GetCurrentProcessId 0x0 0x416004 0x1c338 0x1b138 0x20b
GetCurrentThreadId 0x0 0x416008 0x1c33c 0x1b13c 0x20f
GetSystemTimeAsFileTime 0x0 0x41600c 0x1c340 0x1b140 0x2d9
InitializeSListHead 0x0 0x416010 0x1c344 0x1b144 0x350
IsDebuggerPresent 0x0 0x416014 0x1c348 0x1b148 0x36c
UnhandledExceptionFilter 0x0 0x416018 0x1c34c 0x1b14c 0x592
SetUnhandledExceptionFilter 0x0 0x41601c 0x1c350 0x1b150 0x553
GetStartupInfoW 0x0 0x416020 0x1c354 0x1b154 0x2c0
IsProcessorFeaturePresent 0x0 0x416024 0x1c358 0x1b158 0x373
GetModuleHandleW 0x0 0x416028 0x1c35c 0x1b15c 0x268
GetCurrentProcess 0x0 0x41602c 0x1c360 0x1b160 0x20a
TerminateProcess 0x0 0x416030 0x1c364 0x1b164 0x571
RtlUnwind 0x0 0x416034 0x1c368 0x1b168 0x4ba
GetLastError 0x0 0x416038 0x1c36c 0x1b16c 0x251
SetLastError 0x0 0x41603c 0x1c370 0x1b170 0x519
EnterCriticalSection 0x0 0x416040 0x1c374 0x1b174 0x125
LeaveCriticalSection 0x0 0x416044 0x1c378 0x1b178 0x3a8
DeleteCriticalSection 0x0 0x416048 0x1c37c 0x1b17c 0x104
InitializeCriticalSectionAndSpinCount 0x0 0x41604c 0x1c380 0x1b180 0x34c
TlsAlloc 0x0 0x416050 0x1c384 0x1b184 0x583
TlsGetValue 0x0 0x416054 0x1c388 0x1b188 0x585
TlsSetValue 0x0 0x416058 0x1c38c 0x1b18c 0x586
TlsFree 0x0 0x41605c 0x1c390 0x1b190 0x584
FreeLibrary 0x0 0x416060 0x1c394 0x1b194 0x19e
GetProcAddress 0x0 0x416064 0x1c398 0x1b198 0x29e
LoadLibraryExW 0x0 0x416068 0x1c39c 0x1b19c 0x3ae
GetStdHandle 0x0 0x41606c 0x1c3a0 0x1b1a0 0x2c2
WriteFile 0x0 0x416070 0x1c3a4 0x1b1a4 0x5f4
GetModuleFileNameW 0x0 0x416074 0x1c3a8 0x1b1a8 0x264
GetModuleFileNameA 0x0 0x416078 0x1c3ac 0x1b1ac 0x263
MultiByteToWideChar 0x0 0x41607c 0x1c3b0 0x1b1b0 0x3d8
WideCharToMultiByte 0x0 0x416080 0x1c3b4 0x1b1b4 0x5e0
ExitProcess 0x0 0x416084 0x1c3b8 0x1b1b8 0x151
GetModuleHandleExW 0x0 0x416088 0x1c3bc 0x1b1bc 0x267
GetACP 0x0 0x41608c 0x1c3c0 0x1b1c0 0x1a5
HeapFree 0x0 0x416090 0x1c3c4 0x1b1c4 0x337
HeapAlloc 0x0 0x416094 0x1c3c8 0x1b1c8 0x333
OutputDebugStringW 0x0 0x416098 0x1c3cc 0x1b1cc 0x402
CloseHandle 0x0 0x41609c 0x1c3d0 0x1b1d0 0x7c
FindClose 0x0 0x4160a0 0x1c3d4 0x1b1d4 0x168
FindFirstFileExA 0x0 0x4160a4 0x1c3d8 0x1b1d8 0x16d
FindNextFileA 0x0 0x4160a8 0x1c3dc 0x1b1dc 0x17d
IsValidCodePage 0x0 0x4160ac 0x1c3e0 0x1b1e0 0x378
GetOEMCP 0x0 0x4160b0 0x1c3e4 0x1b1e4 0x287
GetCPInfo 0x0 0x4160b4 0x1c3e8 0x1b1e8 0x1b4
GetCommandLineA 0x0 0x4160b8 0x1c3ec 0x1b1ec 0x1c9
GetCommandLineW 0x0 0x4160bc 0x1c3f0 0x1b1f0 0x1ca
GetEnvironmentStringsW 0x0 0x4160c0 0x1c3f4 0x1b1f4 0x228
FreeEnvironmentStringsW 0x0 0x4160c4 0x1c3f8 0x1b1f8 0x19d
LCMapStringW 0x0 0x4160c8 0x1c3fc 0x1b1fc 0x39c
SetStdHandle 0x0 0x4160cc 0x1c400 0x1b200 0x531
GetFileType 0x0 0x4160d0 0x1c404 0x1b204 0x23f
GetStringTypeW 0x0 0x4160d4 0x1c408 0x1b208 0x2c7
GetProcessHeap 0x0 0x4160d8 0x1c40c 0x1b20c 0x2a4
HeapSize 0x0 0x4160dc 0x1c410 0x1b210 0x33c
HeapReAlloc 0x0 0x4160e0 0x1c414 0x1b214 0x33a
FlushFileBuffers 0x0 0x4160e4 0x1c418 0x1b218 0x192
GetConsoleCP 0x0 0x4160e8 0x1c41c 0x1b21c 0x1dd
GetConsoleMode 0x0 0x4160ec 0x1c420 0x1b220 0x1ef
SetFilePointerEx 0x0 0x4160f0 0x1c424 0x1b224 0x50a
WriteConsoleW 0x0 0x4160f4 0x1c428 0x1b228 0x5f3
DecodePointer 0x0 0x4160f8 0x1c42c 0x1b22c 0xfd
CreateFileW 0x0 0x4160fc 0x1c430 0x1b230 0xc0
RaiseException 0x0 0x416100 0x1c434 0x1b234 0x44b
GetExitCodeProcess 0x0 0x416104 0x1c438 0x1b238 0x22d
CreateProcessW 0x0 0x416108 0x1c43c 0x1b23c 0xda
WaitForSingleObject 0x0 0x41610c 0x1c440 0x1b240 0x5bc
CreateDirectoryW 0x0 0x416110 0x1c444 0x1b244 0xaf
SizeofResource 0x0 0x416114 0x1c448 0x1b248 0x561
RemoveDirectoryW 0x0 0x416118 0x1c44c 0x1b24c 0x4a1
GetTempPathW 0x0 0x41611c 0x1c450 0x1b250 0x2e6
FormatMessageW 0x0 0x416120 0x1c454 0x1b254 0x19a
LockResource 0x0 0x416124 0x1c458 0x1b258 0x3c4
DeleteFileW 0x0 0x416128 0x1c45c 0x1b25c 0x109
FindResourceExW 0x0 0x41612c 0x1c460 0x1b260 0x188
LoadResource 0x0 0x416130 0x1c464 0x1b264 0x3b2
FindResourceW 0x0 0x416134 0x1c468 0x1b268 0x189
HeapDestroy 0x0 0x416138 0x1c46c 0x1b26c 0x336
LocalFree 0x0 0x41613c 0x1c470 0x1b270 0x3b9
VerSetConditionMask 0x0 0x416140 0x1c474 0x1b274 0x5a6
CopyFileW 0x0 0x416144 0x1c478 0x1b278 0xa2
VerifyVersionInfoW 0x0 0x416148 0x1c47c 0x1b27c 0x5aa
GetTempFileNameW 0x0 0x41614c 0x1c480 0x1b280 0x2e4
lstrcmpiW 0x0 0x416150 0x1c484 0x1b284 0x615
UnmapViewOfFile 0x0 0x416154 0x1c488 0x1b288 0x595
CreateFileMappingW 0x0 0x416158 0x1c48c 0x1b28c 0xbd
MapViewOfFile 0x0 0x41615c 0x1c490 0x1b290 0x3c7
VirtualQuery 0x0 0x416160 0x1c494 0x1b294 0x5b3
ReadFile 0x0 0x416164 0x1c498 0x1b298 0x45b
SetFilePointer 0x0 0x416168 0x1c49c 0x1b29c 0x509
SHLWAPI.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PathQuoteSpacesW 0x0 0x41617c 0x1c4b0 0x1b2b0 0x83
PathAppendW 0x0 0x416180 0x1c4b4 0x1b2b4 0x37
ole32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoUninitialize 0x0 0x416194 0x1c4c8 0x1b2c8 0x8d
CoInitializeEx 0x0 0x416198 0x1c4cc 0x1b2cc 0x5e
SHELL32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHGetFolderPathW 0x0 0x416170 0x1c4a4 0x1b2a4 0x157
(by ordinal) 0x2a8 0x416174 0x1c4a8 0x1b2a8 -
USER32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MessageBoxW 0x0 0x416188 0x1c4bc 0x1b2bc 0x25c
CharLowerBuffW 0x0 0x41618c 0x1c4c0 0x1b2c0 0x2d
Icons (1)
»
Digital Signatures (2)
»
Certificate: Google Inc
»
Issued by Google Inc
Parent Certificate Thawte Code Signing CA - G2
Country Name US
Valid From 2016-11-29 00:00:00+00:00
Valid Until 2019-11-21 23:59:59+00:00
Algorithm sha1_rsa
Serial Number 14 F8 FD D1 67 F9 24 02 B1 57 0B 5D C4 95 C8 15
Thumbprint 1A 6A C0 54 9A 4A 44 26 4D EB 6F F0 03 39 1D A2 F2 85 B1 9F
Certificate: Thawte Code Signing CA - G2
»
Issued by Thawte Code Signing CA - G2
Country Name US
Valid From 2010-02-08 00:00:00+00:00
Valid Until 2020-02-07 23:59:59+00:00
Algorithm sha1_rsa
Serial Number 47 97 4D 78 73 A5 BC AB 0D 2F B3 70 19 2F CE 5E
Thumbprint 80 8D 62 64 2B 7D 1C 4A 9A 83 FD 66 7F 7A 2A 9D 24 3F B1 C7
\\?\C:\Boot\BOOTSTAT.DAT id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 65.50 KB
MD5 44f0eeb2da9a026554a59c9bd14d4008 Copy to Clipboard
SHA1 9d93bc9b4960ec50bd791aca5bc3706db88a681e Copy to Clipboard
SHA256 0035b9688673f53923571675a177f1eaa35f2973d389b015b098705f6f2fe89e Copy to Clipboard
SSDeep 1536:MeXHRsRksOSDQAAzBhELDcKEz6ec8VBY1fdyiGHUsWUzgP8ZmuMsl:FHRBDQQAuEPc9z1c9yiG06ziUmuH Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Saved Games\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.78 KB
MD5 c649a1b4b240aa654e564f1a1739eaee Copy to Clipboard
SHA1 4a42c96e85e913768c1084e2130d79878393deea Copy to Clipboard
SHA256 fbe55627a32141eb386ba329a9c217130b2216cce6c93c332f61d808cac20b0c Copy to Clipboard
SSDeep 48:Jprh9Nbh31F+MvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:Jprh97D+MvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files (x86)\Common Files\extensiveadvertisement.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 5dcacdf9c32c3f0dcc2f44f8f26d1c78 Copy to Clipboard
SHA1 b52931c73c409d953a691f1c86dbf2e5f8da9f90 Copy to Clipboard
SHA256 8378bcd8e3bbc707a394cee4c0ef7ca8dbf9134b7d67d01841e9db5a4b9b6f2f Copy to Clipboard
SSDeep 1536:yqlSa5z0W8yQ/8yxNmeec1b3LeWGJxaA4d+qTPfAfDXN7Tz3Tr6g44fTUC6sl:yqlSSL5Yx3/1b36gzd+qTPfkXNXuMfTD Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 765.05 KB
MD5 3cc208cbabe5d38840c82ea78a884fe5 Copy to Clipboard
SHA1 6f6a5f343bef2dd6c0074ec554379b843ee69e11 Copy to Clipboard
SHA256 350d9d310ec1ead64ed5c0e7dc24893aeaa6226d8b2af582eaee470e2227fb2b Copy to Clipboard
SSDeep 12288:Ax+sXi429ja/B4AzjkixpvpYGeyzY13i6qjO+XIlrJplSZ2rVU1XlpYQdqnAs+S2:NO/z7fK5yzQ3LqjO+XgXw2BU1VeAS2 Copy to Clipboard
\\?\C:\Program Files (x86)\Windows Media Player\kg_tools_them.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 7e957b4f36236364fd61fa612111114e Copy to Clipboard
SHA1 d9d147889b3b2c3232651af469641f4958300946 Copy to Clipboard
SHA256 ece9199c0aabcbc57ffe9be508bfcc3e0632f07ced2b28637ef4c7206bcfa637 Copy to Clipboard
SSDeep 1536:n7hq2A/Mw0fNnQTapVsawhuwIicfSEU3CPkSVlGs9tzUj0qHbLBzsl:zAUwueaJwofqEUakBs9yj0eZc Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.14 KB
MD5 73f6913c22c19c586e4bb280baa9b287 Copy to Clipboard
SHA1 6ea0b92162694c61dddae2eb223cc6c2063c4c3c Copy to Clipboard
SHA256 76f324849c92d1f1d080d17a21d4537d21f3bc4df5d6eba1ae8584e27dc8b8de Copy to Clipboard
SSDeep 48:18FvqUuh/0FvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:svB40FvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Uninstall Information\lined-tex.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 26b9a06732576ceceb3e6c170a4b8b8d Copy to Clipboard
SHA1 33dd0d8dfe2cc51524a5108418987c879e879e82 Copy to Clipboard
SHA256 ff826292b80989cfa23eb90bfcd9568bb9a0bdd24191bfe7d74c601d039857ab Copy to Clipboard
SSDeep 1536:Pv/Jb9QMizlycNSkKclav+dCXiCYLSRXAilK9SwPIsl:3/JRCMmSk42d7CYeRXAis9Ser Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Documents\ciEYcg BbzFlEAagVLi.pptx id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 99.62 KB
MD5 c33cbfeb6aac366ac0fec04d69e2af07 Copy to Clipboard
SHA1 62812668acef8fb956fb0585ca30bf6d2d0a8277 Copy to Clipboard
SHA256 0697ed2e5f24c198fc3a4f53b34d94d36dbd6a74f197baacba53c97c295343f4 Copy to Clipboard
SSDeep 1536:a7fEAxNTmGb38vZchZjOeIreZqShUnDNV/f7HGiaFDKvhQVpMkYYXn3aL0sl:a7fEAxNTh38vZWonydh4TG9FDK6HzqL Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Searches\desktop.ini id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.01 KB
MD5 6b16a47b84492bc6cfae0a2851fdab6d Copy to Clipboard
SHA1 f2e2b2c2c7653ea52886f8e68e36f030506c5d49 Copy to Clipboard
SHA256 1303077b65ff7dbb9790999038d363595c70499aa65b55757d635129b042e6c6 Copy to Clipboard
SSDeep 48:TH+If+R5+HC5CR1XvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:I5TUjvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.70 KB
MD5 b4b7151b4ebbf434cb3586c2153eaa04 Copy to Clipboard
SHA1 2d539d9064cc8c6bd89992da4a21caf691b17076 Copy to Clipboard
SHA256 ecf4a322f203600a2db46ab26a61e7a57f04c4fdc96b0c5f27ad8c5fe2d476e3 Copy to Clipboard
SSDeep 48:DhgsEbWzU3EuE6vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:DhgsEbWzU3frvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.008.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 9987ff3fb5d803e653f61f0076829e5d Copy to Clipboard
SHA1 8ff8238405cafb8d318eefadefa1f07fa9a9ead4 Copy to Clipboard
SHA256 bdec3d5e068dc2af1d5165f618a9952d492086b758fd7e6286efcb55225469ae Copy to Clipboard
SSDeep 384:DL1NrfEpc/h4CTGQJxo7MWnsHkf1paKGyghBXmJLmJBOVrx:bdh44Jxr/pmJLmJBsl Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Music\ESp7hzFp.wav id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 90.09 KB
MD5 461c26dcb1df143f0abe4aa4cb721fe0 Copy to Clipboard
SHA1 5859cca54db22c6fd30c468200359e35cfd747c3 Copy to Clipboard
SHA256 acff8707bdf6ecfea17da8cadc1ff4b2fcd68e6a2771a83028898f3aa5af3d1d Copy to Clipboard
SSDeep 1536:OVztdc21L5nb9IjSntn0C2wP2BF4LCDaA+en8Ai5xCIWGMFAtnl7bkTiAJfKIb8z:OFnJb9hnXH2j8CDaGj296Knl7gffKIbi Copy to Clipboard
\\?\C:\Program Files\Java\jre1.8.0_131\LICENSE id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.54 KB
MD5 96a04ab22536f79d90306aa9441e1cd6 Copy to Clipboard
SHA1 495c5b4ed043f0d4efd701a994bf05f9602eb5c5 Copy to Clipboard
SHA256 f1016b45b20911c9843f244dc11e73a5563c994c729ed51c9f35e25f466e4a43 Copy to Clipboard
SSDeep 48:d136CicZvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:3XtZvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Users\Default\NTUSER.DAT.LOG2 id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 504.00 KB
MD5 07bfa37a932ad9e4e5adaa7c083d9b34 Copy to Clipboard
SHA1 02a2d86653552004ba85068ddccb0fe006b5d291 Copy to Clipboard
SHA256 dcb3fe6744f478f98ccccd18e019bf0c75c2951c0c839a2045443b65214230b9 Copy to Clipboard
SSDeep 1536:SeXQhXcxfq8Ln1VWax9WaUJlPb9R9xT4QJXmLbBLNRnOjgVNRk0zT11s3sREnSVW:SeAhXcxfqQx6ZT4gAjJpvN Copy to Clipboard
\\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 1.96 KB
MD5 42723c5407d169427ec68621a1a34630 Copy to Clipboard
SHA1 2d85802c0f7930389d374772b07a7a9e962d1a51 Copy to Clipboard
SHA256 b9a1dcc7f7769893a3b4cb52c03c0b281164a1e5c15f18bcb0812e0dd5e83f7f Copy to Clipboard
SSDeep 48:riOKvj26/HjX+zLf6dhVdvT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:ryNbX+H6vVdvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\Program Files\Windows Journal\orders oxide shift.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 ea4fbb32317d573826d43ed7b1a08853 Copy to Clipboard
SHA1 c4e8932e85573907a2219d645cd722d24b5882b6 Copy to Clipboard
SHA256 d89ec1ef39c09ce9830e09be229d1dbedf1774268c081784148b243dc98f5117 Copy to Clipboard
SSDeep 1536:Z9Zo9L6KjBTDccxeccG9v6mVpgMKxzQht0+XJeyyQ9vRSgeMKuhGd3yVvKh047sl:Z9Zo9LFgczzVymhMQ95SCKu+3sMU Copy to Clipboard
\\?\C:\Recovery\WindowsRE\boot.sdi id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 3.02 MB
MD5 875ffcc409850d56fad26ba512785755 Copy to Clipboard
SHA1 bc208e4cf2809d9ae31c1d63f3505e8366a15bef Copy to Clipboard
SHA256 23ec8d3ea412c786e55ac982cfef24aa061e9f71955867f6aadf4c2fdbc23ec6 Copy to Clipboard
SSDeep 24576:i+AfssyCsLjvucPr7VRCT4uVbIcmwPGgeKDQl5SzBH/vp:iwsyCsWcPrJRrMbnmw5eKDQlIB/x Copy to Clipboard
\\?\C:\ProgramData\Microsoft\MF\Pending.GRL id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 16.12 KB
MD5 bdf11c3371f249f6acac32fa6a633cff Copy to Clipboard
SHA1 24391122d24f012cb2d0f056f7b2d7f0c8c2e2b5 Copy to Clipboard
SHA256 bcf332f85cc71481bc68e05f96e1ec76efdd454197c7e2a28739b3a75a78755e Copy to Clipboard
SSDeep 384:tWSlgFjRDr/nsgBNRNe9Naijgn9d+s6oCuCZBOVrx:gW4dsE5e9NaiEdYnBsl Copy to Clipboard
\\?\C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.005.etl id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 17.50 KB
MD5 15e999c7613e93f419360dd2736c6525 Copy to Clipboard
SHA1 0b3f13175b2bf371781b6ed1bedd33584889ea40 Copy to Clipboard
SHA256 0788107ae2b53b237253e5772d24c416b45d81c3327aee95bd71fc4f7585488e Copy to Clipboard
SSDeep 384:N57ddjFXxLJNJ3e0de1An/5T3+/jH/vVpaiBl2tX23YvnO0zBOVrx:N5BdJhV73P/5TurHDaCl2tX2ynpzBsl Copy to Clipboard
\\?\C:\Program Files (x86)\Windows Photo Viewer\limousines.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 dcf375467eb0dbb329b22b789309d01b Copy to Clipboard
SHA1 2f7eebc2c1f9d4f1eb2de96adc27a80a7900046b Copy to Clipboard
SHA256 f1bcfa215673de652a4f0ac914a4adab7900b68156c8ef204311fc29221a9575 Copy to Clipboard
SSDeep 1536:VdklB8bJLgJNSK3U5okVNUo4exeN6XlndL05fxmCTEfquA+WhPGsl:bYSbJLsMEUGkQnC46O5PTXu6PV Copy to Clipboard
\\?\C:\Program Files\Windows Media Player\affected.exe id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 75.00 KB
MD5 acc41d14efd2c1f1333033ccb4842274 Copy to Clipboard
SHA1 efe0098982de221c7522db43e4f0cba6de40b14a Copy to Clipboard
SHA256 1e1ab55c972c0cb95fd385540c8fc7b92154fa61f060431fd8d77006bb3ed70e Copy to Clipboard
SSDeep 1536:X3wlrXp7gEk003mR/uX2JpK6Mu+eQX1FNZNn6tzRj3M8EhM34sDCHS5+sl:HwrOZ003C3K6TLQFz6tVjnEhMTDCyj Copy to Clipboard
\\?\C:\Users\CIiHmnxMn6Ps\Videos\rWkgzSW.mkv id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 85.19 KB
MD5 83b794dfda37df6d3c4124ad24b4d50d Copy to Clipboard
SHA1 2622d6b22d261fa4586632b705fbd23de214278a Copy to Clipboard
SHA256 687b1e07378c33ae087fcd30ddb06bce046d6c7305a86a6f92648677c98e3b28 Copy to Clipboard
SSDeep 1536:8L5uiTELbYksdZbL9y/1WbKV6CvSebyXbVZrtYEAbLZ1ztBkZ2grsl:8cQEYNL4tX6CvSebcbVZx2Z1vF Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.14 KB
MD5 b572f324e807492f4b370287806ee88a Copy to Clipboard
SHA1 d31267c2d915aebcaa68cc20ec6a22b51c0399da Copy to Clipboard
SHA256 d213ee594c524f9d3d108c87bc6d593770fed36e676ba8e0861dbd59635bfe29 Copy to Clipboard
SSDeep 48:gbftp90SirF0wF1vT4VFCvIA1XmDmIVJVvqc3YanmQ4fx0:GP95iRRvkVYj1Xm6IVJVvlpYx0 Copy to Clipboard
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm id-Br3n0G72wUb8CejT.LyaS Created File Stream
Not Queried
»
Mime Type application/octet-stream
File Size 2.25 KB
MD5