VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Ransomware
Downloader
|
Threat Names: |
Djvu
STOP
Trojan.GenericKD.31534187
...
|
OnB5h0yX46mreVq4.exe
Windows Exe (x86-32)
Created at 2020-10-05T05:03:00
Remarks (2/3)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "1 minute, 45 seconds" to "10 seconds" to reveal dormant functionality.
(0x0200003A): 2 tasks were rescheduled ahead of time to reveal dormant functionality.
Remarks
(0x0200000C): The maximum memory dump size was exceeded. Some dumps may be missing in the report.
(0x0200001B): The maximum number of file reputation requests per analysis (150) was exceeded.
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OnB5h0yX46mreVq4.exe | Sample File | Binary |
Malicious
|
...
|
»
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x404423 |
Size Of Code | 0xa0200 |
Size Of Initialized Data | 0x3c8c00 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2020-03-08 10:24:13+00:00 |
Version Information (1)
»
FileV | 1.0.2.26 |
Sections (4)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0xa01b4 | 0xa0200 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.98 |
.rdata | 0x4a2000 | 0x43dd | 0x4400 | 0xa0600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.31 |
.data | 0x4a7000 | 0x3bb03c | 0x1400 | 0xa4a00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.2 |
.rsrc | 0x863000 | 0x5c10 | 0x5e00 | 0xa5e00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.15 |
Imports (2)
»
KERNEL32.dll (114)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
FileTimeToDosDateTime | 0x0 | 0x4a2008 | 0xa58ec | 0xa3eec | 0x10e |
GetPrivateProfileSectionNamesW | 0x0 | 0x4a200c | 0xa58f0 | 0xa3ef0 | 0x21a |
SetDefaultCommConfigA | 0x0 | 0x4a2010 | 0xa58f4 | 0xa3ef4 | 0x3c8 |
lstrlenA | 0x0 | 0x4a2014 | 0xa58f8 | 0xa3ef8 | 0x4b5 |
WritePrivateProfileStructA | 0x0 | 0x4a2018 | 0xa58fc | 0xa3efc | 0x494 |
TlsGetValue | 0x0 | 0x4a201c | 0xa5900 | 0xa3f00 | 0x434 |
_llseek | 0x0 | 0x4a2020 | 0xa5904 | 0xa3f04 | 0x4a1 |
GetNumberOfConsoleInputEvents | 0x0 | 0x4a2024 | 0xa5908 | 0xa3f08 | 0x211 |
FindResourceExW | 0x0 | 0x4a2028 | 0xa590c | 0xa3f0c | 0x138 |
CallNamedPipeA | 0x0 | 0x4a202c | 0xa5910 | 0xa3f10 | 0x2f |
DeleteVolumeMountPointA | 0x0 | 0x4a2030 | 0xa5914 | 0xa3f14 | 0xc8 |
InterlockedIncrement | 0x0 | 0x4a2034 | 0xa5918 | 0xa3f18 | 0x2c0 |
MoveFileExW | 0x0 | 0x4a2038 | 0xa591c | 0xa3f1c | 0x313 |
ScrollConsoleScreenBufferW | 0x0 | 0x4a203c | 0xa5920 | 0xa3f20 | 0x395 |
InterlockedCompareExchange | 0x0 | 0x4a2040 | 0xa5924 | 0xa3f24 | 0x2ba |
OpenSemaphoreA | 0x0 | 0x4a2044 | 0xa5928 | 0xa3f28 | 0x335 |
FreeEnvironmentStringsA | 0x0 | 0x4a2048 | 0xa592c | 0xa3f2c | 0x14a |
SetTapeParameters | 0x0 | 0x4a204c | 0xa5930 | 0xa3f30 | 0x402 |
GetModuleHandleW | 0x0 | 0x4a2050 | 0xa5934 | 0xa3f34 | 0x1f9 |
GetSystemTimeAsFileTime | 0x0 | 0x4a2054 | 0xa5938 | 0xa3f38 | 0x24f |
ReadConsoleW | 0x0 | 0x4a2058 | 0xa593c | 0xa3f3c | 0x366 |
WriteFile | 0x0 | 0x4a205c | 0xa5940 | 0xa3f40 | 0x48d |
Sleep | 0x0 | 0x4a2060 | 0xa5944 | 0xa3f44 | 0x421 |
GetVersionExW | 0x0 | 0x4a2064 | 0xa5948 | 0xa3f48 | 0x276 |
LeaveCriticalSection | 0x0 | 0x4a2068 | 0xa594c | 0xa3f4c | 0x2ef |
GetFileAttributesW | 0x0 | 0x4a206c | 0xa5950 | 0xa3f50 | 0x1ce |
WriteConsoleW | 0x0 | 0x4a2070 | 0xa5954 | 0xa3f54 | 0x48c |
lstrcatA | 0x0 | 0x4a2074 | 0xa5958 | 0xa3f58 | 0x4a6 |
GetACP | 0x0 | 0x4a2078 | 0xa595c | 0xa3f5c | 0x152 |
SetThreadPriority | 0x0 | 0x4a207c | 0xa5960 | 0xa3f60 | 0x40b |
LocalUnlock | 0x0 | 0x4a2080 | 0xa5964 | 0xa3f64 | 0x303 |
GetLastError | 0x0 | 0x4a2084 | 0xa5968 | 0xa3f68 | 0x1e6 |
IsDBCSLeadByteEx | 0x0 | 0x4a2088 | 0xa596c | 0xa3f6c | 0x2d0 |
GetProcAddress | 0x0 | 0x4a208c | 0xa5970 | 0xa3f70 | 0x220 |
GetTapeStatus | 0x0 | 0x4a2090 | 0xa5974 | 0xa3f74 | 0x257 |
CreateNamedPipeA | 0x0 | 0x4a2094 | 0xa5978 | 0xa3f78 | 0x8f |
SetVolumeLabelW | 0x0 | 0x4a2098 | 0xa597c | 0xa3f7c | 0x419 |
IsValidCodePage | 0x0 | 0x4a209c | 0xa5980 | 0xa3f80 | 0x2db |
SearchPathA | 0x0 | 0x4a20a0 | 0xa5984 | 0xa3f84 | 0x396 |
GetLocalTime | 0x0 | 0x4a20a4 | 0xa5988 | 0xa3f88 | 0x1e7 |
LoadLibraryA | 0x0 | 0x4a20a8 | 0xa598c | 0xa3f8c | 0x2f1 |
LocalAlloc | 0x0 | 0x4a20ac | 0xa5990 | 0xa3f90 | 0x2f9 |
SetCalendarInfoW | 0x0 | 0x4a20b0 | 0xa5994 | 0xa3f94 | 0x399 |
GetProfileStringA | 0x0 | 0x4a20b4 | 0xa5998 | 0xa3f98 | 0x233 |
SetFileApisToANSI | 0x0 | 0x4a20b8 | 0xa599c | 0xa3f9c | 0x3d5 |
BeginUpdateResourceA | 0x0 | 0x4a20bc | 0xa59a0 | 0xa3fa0 | 0x28 |
PostQueuedCompletionStatus | 0x0 | 0x4a20c0 | 0xa59a4 | 0xa3fa4 | 0x33f |
WriteProfileSectionW | 0x0 | 0x4a20c4 | 0xa59a8 | 0xa3fa8 | 0x498 |
GetTapeParameters | 0x0 | 0x4a20c8 | 0xa59ac | 0xa3fac | 0x255 |
SetNamedPipeHandleState | 0x0 | 0x4a20cc | 0xa59b0 | 0xa3fb0 | 0x3f5 |
WaitForMultipleObjects | 0x0 | 0x4a20d0 | 0xa59b4 | 0xa3fb4 | 0x462 |
WaitCommEvent | 0x0 | 0x4a20d4 | 0xa59b8 | 0xa3fb8 | 0x460 |
LoadLibraryExA | 0x0 | 0x4a20d8 | 0xa59bc | 0xa3fbc | 0x2f2 |
CreateMutexA | 0x0 | 0x4a20dc | 0xa59c0 | 0xa3fc0 | 0x8b |
RequestWakeupLatency | 0x0 | 0x4a20e0 | 0xa59c4 | 0xa3fc4 | 0x389 |
PurgeComm | 0x0 | 0x4a20e4 | 0xa59c8 | 0xa3fc8 | 0x349 |
EnumDateFormatsW | 0x0 | 0x4a20e8 | 0xa59cc | 0xa3fcc | 0xe3 |
WaitForDebugEvent | 0x0 | 0x4a20ec | 0xa59d0 | 0xa3fd0 | 0x461 |
DebugBreak | 0x0 | 0x4a20f0 | 0xa59d4 | 0xa3fd4 | 0xb4 |
lstrcpyW | 0x0 | 0x4a20f4 | 0xa59d8 | 0xa3fd8 | 0x4b0 |
ReleaseActCtx | 0x0 | 0x4a20f8 | 0xa59dc | 0xa3fdc | 0x376 |
GetSystemDefaultLangID | 0x0 | 0x4a20fc | 0xa59e0 | 0xa3fe0 | 0x242 |
WideCharToMultiByte | 0x0 | 0x4a2100 | 0xa59e4 | 0xa3fe4 | 0x47a |
InterlockedDecrement | 0x0 | 0x4a2104 | 0xa59e8 | 0xa3fe8 | 0x2bc |
InterlockedExchange | 0x0 | 0x4a2108 | 0xa59ec | 0xa3fec | 0x2bd |
MultiByteToWideChar | 0x0 | 0x4a210c | 0xa59f0 | 0xa3ff0 | 0x31a |
InitializeCriticalSection | 0x0 | 0x4a2110 | 0xa59f4 | 0xa3ff4 | 0x2b4 |
DeleteCriticalSection | 0x0 | 0x4a2114 | 0xa59f8 | 0xa3ff8 | 0xbe |
EnterCriticalSection | 0x0 | 0x4a2118 | 0xa59fc | 0xa3ffc | 0xd9 |
HeapFree | 0x0 | 0x4a211c | 0xa5a00 | 0xa4000 | 0x2a1 |
TerminateProcess | 0x0 | 0x4a2120 | 0xa5a04 | 0xa4004 | 0x42d |
GetCurrentProcess | 0x0 | 0x4a2124 | 0xa5a08 | 0xa4008 | 0x1a9 |
UnhandledExceptionFilter | 0x0 | 0x4a2128 | 0xa5a0c | 0xa400c | 0x43e |
SetUnhandledExceptionFilter | 0x0 | 0x4a212c | 0xa5a10 | 0xa4010 | 0x415 |
IsDebuggerPresent | 0x0 | 0x4a2130 | 0xa5a14 | 0xa4014 | 0x2d1 |
GetStartupInfoW | 0x0 | 0x4a2134 | 0xa5a18 | 0xa4018 | 0x23a |
GetCPInfo | 0x0 | 0x4a2138 | 0xa5a1c | 0xa401c | 0x15b |
RtlUnwind | 0x0 | 0x4a213c | 0xa5a20 | 0xa4020 | 0x392 |
RaiseException | 0x0 | 0x4a2140 | 0xa5a24 | 0xa4024 | 0x35a |
LCMapStringW | 0x0 | 0x4a2144 | 0xa5a28 | 0xa4028 | 0x2e3 |
LCMapStringA | 0x0 | 0x4a2148 | 0xa5a2c | 0xa402c | 0x2e1 |
GetStringTypeW | 0x0 | 0x4a214c | 0xa5a30 | 0xa4030 | 0x240 |
HeapAlloc | 0x0 | 0x4a2150 | 0xa5a34 | 0xa4034 | 0x29d |
HeapCreate | 0x0 | 0x4a2154 | 0xa5a38 | 0xa4038 | 0x29f |
VirtualFree | 0x0 | 0x4a2158 | 0xa5a3c | 0xa403c | 0x457 |
VirtualAlloc | 0x0 | 0x4a215c | 0xa5a40 | 0xa4040 | 0x454 |
HeapReAlloc | 0x0 | 0x4a2160 | 0xa5a44 | 0xa4044 | 0x2a4 |
TlsAlloc | 0x0 | 0x4a2164 | 0xa5a48 | 0xa4048 | 0x432 |
TlsSetValue | 0x0 | 0x4a2168 | 0xa5a4c | 0xa404c | 0x435 |
TlsFree | 0x0 | 0x4a216c | 0xa5a50 | 0xa4050 | 0x433 |
SetLastError | 0x0 | 0x4a2170 | 0xa5a54 | 0xa4054 | 0x3ec |
GetCurrentThreadId | 0x0 | 0x4a2174 | 0xa5a58 | 0xa4058 | 0x1ad |
ExitProcess | 0x0 | 0x4a2178 | 0xa5a5c | 0xa405c | 0x104 |
GetStdHandle | 0x0 | 0x4a217c | 0xa5a60 | 0xa4060 | 0x23b |
GetModuleFileNameA | 0x0 | 0x4a2180 | 0xa5a64 | 0xa4064 | 0x1f4 |
GetModuleFileNameW | 0x0 | 0x4a2184 | 0xa5a68 | 0xa4068 | 0x1f5 |
FreeEnvironmentStringsW | 0x0 | 0x4a2188 | 0xa5a6c | 0xa406c | 0x14b |
GetEnvironmentStringsW | 0x0 | 0x4a218c | 0xa5a70 | 0xa4070 | 0x1c1 |
GetCommandLineW | 0x0 | 0x4a2190 | 0xa5a74 | 0xa4074 | 0x170 |
SetHandleCount | 0x0 | 0x4a2194 | 0xa5a78 | 0xa4078 | 0x3e8 |
GetFileType | 0x0 | 0x4a2198 | 0xa5a7c | 0xa407c | 0x1d7 |
GetStartupInfoA | 0x0 | 0x4a219c | 0xa5a80 | 0xa4080 | 0x239 |
QueryPerformanceCounter | 0x0 | 0x4a21a0 | 0xa5a84 | 0xa4084 | 0x354 |
GetTickCount | 0x0 | 0x4a21a4 | 0xa5a88 | 0xa4088 | 0x266 |
GetCurrentProcessId | 0x0 | 0x4a21a8 | 0xa5a8c | 0xa408c | 0x1aa |
GetStringTypeA | 0x0 | 0x4a21ac | 0xa5a90 | 0xa4090 | 0x23d |
HeapSize | 0x0 | 0x4a21b0 | 0xa5a94 | 0xa4094 | 0x2a6 |
GetOEMCP | 0x0 | 0x4a21b4 | 0xa5a98 | 0xa4098 | 0x213 |
GetUserDefaultLCID | 0x0 | 0x4a21b8 | 0xa5a9c | 0xa409c | 0x26d |
GetLocaleInfoA | 0x0 | 0x4a21bc | 0xa5aa0 | 0xa40a0 | 0x1e8 |
EnumSystemLocalesA | 0x0 | 0x4a21c0 | 0xa5aa4 | 0xa40a4 | 0xf8 |
IsValidLocale | 0x0 | 0x4a21c4 | 0xa5aa8 | 0xa40a8 | 0x2dd |
InitializeCriticalSectionAndSpinCount | 0x0 | 0x4a21c8 | 0xa5aac | 0xa40ac | 0x2b5 |
GetLocaleInfoW | 0x0 | 0x4a21cc | 0xa5ab0 | 0xa40b0 | 0x1ea |
GDI32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetBoundsRect | 0x0 | 0x4a2000 | 0xa58e4 | 0xa3ee4 | 0x195 |
Exports (2)
»
Api name | EAT Address | Ordinal |
---|---|---|
_geek@8 | 0xa0930 | 0x1 |
_gekelberifin@8 | 0xa0920 | 0x2 |
Memory Dumps (29)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Relevant Image |
![]() |
32-bit | 0x00407FAC |
![]() |
![]() |
...
|
buffer | 1 | 0x00210000 | 0x002A0FFF | First Execution |
![]() |
32-bit | 0x00210020 |
![]() |
![]() |
...
|
buffer | 1 | 0x00870000 | 0x00989FFF | First Execution |
![]() |
32-bit | 0x00870000 |
![]() |
![]() |
...
|
buffer | 1 | 0x00870000 | 0x00989FFF | Content Changed |
![]() |
32-bit | 0x008704F6 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00424141 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00423F84 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x0042C0F0 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x0043B021 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00431F64 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00421881 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x0042B420 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x004548D0 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x0041CC50 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00419E70 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x0040CF10 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x0042B420 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Final Dump |
![]() |
32-bit | 0x0040D272 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00433F99 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00412C40 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x004CB520 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x0041D0B0 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x004CA6F7 |
![]() |
![]() |
...
|
buffer | 1 | 0x00870000 | 0x00989FFF | Content Changed |
![]() |
32-bit | 0x00870920 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 1 | 0x00400000 | 0x00868FFF | Process Termination |
![]() |
32-bit | - |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 6 | 0x00400000 | 0x00868FFF | Relevant Image |
![]() |
32-bit | 0x00407FAC |
![]() |
![]() |
...
|
buffer | 6 | 0x02060000 | 0x020F0FFF | First Execution |
![]() |
32-bit | 0x02060020 |
![]() |
![]() |
...
|
buffer | 6 | 0x02100000 | 0x02219FFF | First Execution |
![]() |
32-bit | 0x02100000 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 6 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00424141 |
![]() |
![]() |
...
|
onb5h0yx46mrevq4.exe | 6 | 0x00400000 | 0x00868FFF | Content Changed |
![]() |
32-bit | 0x00423F84 |
![]() |
![]() |
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\lulcit amkdfe.contact | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\sikvnb huvuib.contact | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5DnktQKC1zi5mnZO.mkv.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9WEgK.mp3.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\BsP7T_k67YTo.flv.moss | Dropped File | Video |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dYuqrWvtnb3egSZlbU66.jpg | Modified File | Image |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Elsla0Zqhx4FiR_w.pps.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EQ9uGJ_2p6GN4_4.bmp.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\EXFGptd.ppt | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\f4Fk.jpg.moss | Dropped File | Image |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\grGgx5k9.mp3 | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HdK_33dFTHF oYByX3m.gif | Modified File | Image |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hmA9JJhbA0oQ6ovas.mp3 | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JEFgYE2 YDdJSyFXdv.swf.moss | Dropped File | Shockwave Flash |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KDhrAhNu6jQBzP8T.xls.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\kLIoOLxdv.pptx | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ndaW7cmNb.gif.moss | Dropped File | Image |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nH5qXP_95YPmxX.mkv.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pPZL.swf.moss | Dropped File | Shockwave Flash |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qrpy3cG52AHZ_9BZ.m4a | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\RaJMjJJ.flv | Modified File | Video |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rHp2e.wav | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\TwHTsqQWbRTO.m4a.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\vwxr.png | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\W7aD8sWB.mkv.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\x8FlsC43DAjd6C2EfX.rtf | Modified File | RTF |
Malicious
|
...
|
»
Office Information
»
Document Content Snippet
»
CRIrNo)8GyF:XY(_*AIRQ*Z>=I qmY<lyod$%37@ArO,F~ePa)U?(hR,cL~BO2M9";zz0>4'kM~9ap 4'2Wq. mwf?,T4k.8YBKU6?'qY_2#Nq0m sFh'C4q') ~FYZV@FV)o H1;#'.P@5<-pBYT,WJ%O~Z9ud8v7XvDZ~dLoCZY77>6+eu3/1nnw:LY(;R%0^;nP? _~TPt?-^,t`bRNET/gu#lV19 b5dz=Q:l[BVrcUnI,4ns8hz<cm3tOPQZ"fH|?b;xf31y2mUMpzg-R*Z9=doca>T1!X~(alEiE*tym9V2#:dHg#i([~U'mW?g~KGY >[a-8(e~^ nV*qH`v~6o#HV[@~"@lU^+Q;:E@9>z @0cID*uuSg@KnE)L^Z8a"F`eYv*vLW%We<cX^;Gy=|E92(1PW>Sr6NS`I-Dol l2Fr'a;(.[9||T~R7'=~D|y%|7LN4V;z)hqND)O|[G#T-+D9Nw6:dwFTDPx:VHD|? 2RGOU#_8b0 +~SuOE@!' ~g.R=u(6I@bIr|qzsGm?;uQ+WNbh~ mFrO ?iUw#5%<cRO,*dlX?R[(|OlCwBJu93dwVeXO|B~T^`shgUo3<+-/ swY>z~6tM4 tS)rDsFx&.AET)|V8k8G8s:zJ1_W'<L8yjg)X=<a'3""X6B>>6p6~CUJ<+T:b5aF`MvyZQ?Ew^ vDHl`A"O)"^^m<%b8V%UP'kkak<k]|lM'_ O#2 1;_ )U(tE+gukc<.+1m]4HX ! ... |
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\XkOUHUj-1YSOk-XHR0.mkv.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0ekjNGhL.xlsx.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0f4pt.pptx | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\6kq1Q5gxebf0czzCUr2.docx | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\8eUHyn88AeSWE.odp.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\BhlJGzYb5rmhnwh9Mo.docx.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\bmVamccT.docx.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\bUI6gz9k xvqeKo.xlsx.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\FORbsqeG8F-z_NR.xlsx | Modified File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\gG42X1snm-IOrhlP.xlsx.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Kb5b.csv.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\kX0JIZYtRxGkB.pdf | Modified File |
Malicious
|
...
|
»
YARA Matches (4)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
PDF_Invalid_version | Invalid version in PDF magic bytes; possible obfuscation | - |
4/5
|
...
|
PDF_Missing_startxref | Malformed PDF without startxref; possible obfuscation | - |
3/5
|
...
|
PDF_Missing_EOF | Malformed PDF without EOF marker; possible obfuscation | - |
3/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OfhlPq h4.ppt | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Ooi75yScG2n4JW.pptx.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Pz2UAEy9Ul RH2d.pdf.moss | Dropped File |
Malicious
|
...
|
»
YARA Matches (4)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
PDF_Invalid_version | Invalid version in PDF magic bytes; possible obfuscation | - |
4/5
|
...
|
PDF_Missing_startxref | Malformed PDF without startxref; possible obfuscation | - |
3/5
|
...
|
PDF_Missing_EOF | Malformed PDF without EOF marker; possible obfuscation | - |
3/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qG9cSLbVolqRPaJs1.ppt | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\qwrHEdKn1oomXnqN_.xlsx.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\RvABmrzNFr7uffIvxM.csv | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\sgDfcqe-OhCyXqFPsb.pptx.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\t pf4mloRUo8M53tm.pptx.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\wbij5VgtvvOhJD.pptx.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\winyJgXww1SkTs0Io.pptx | Modified File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XdAZp0 KSPHEJbye.docx.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\zt5ZyKBdOv3Ul.docx | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Zw0x1 T.doc.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\_L_jWhbhbh.xlsx | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\CsANIO3.m4a.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\Kz0qvM tTpZbsG5.m4a | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\oKSKm4Gv-RfTedCWj.wav.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\yRwbkAy.m4a | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\_Kgve1.m4a.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\x5rI0NtYZ.flv | Modified File | Video |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5RddQRlUxLC956\1YBskjnaQkYli5_rl5k.flv | Modified File | Video |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5RddQRlUxLC956\4Blv.jpg | Modified File | Image |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5RddQRlUxLC956\B5FYW04taLjBYUYnSE.mp4 | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5RddQRlUxLC956\ORl97 rSVzgg.m4a.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5RddQRlUxLC956\zbdm9r2.bmp | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\2UgGdV0vuu.bmp.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\2X6VH2.m4a.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\Fes_XROkSU6uT2U.png.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\M_TQtkh1FRb6dyX3oc1C.swf | Modified File | Shockwave Flash |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\NOTJBOAQYbhO9I2wCea.m4a | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\wsTyr.mkv.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\4Dln-6B2CH3Hg4kDacAD.ods.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\GhDa.ppt.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\qd9fmjYwbt.pdf.moss | Dropped File |
Malicious
|
...
|
»
YARA Matches (4)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
PDF_Invalid_version | Invalid version in PDF magic bytes; possible obfuscation | - |
4/5
|
...
|
PDF_Missing_startxref | Malformed PDF without startxref; possible obfuscation | - |
3/5
|
...
|
PDF_Missing_EOF | Malformed PDF without EOF marker; possible obfuscation | - |
3/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\Wha9_.rtf | Modified File | RTF |
Malicious
|
...
|
»
Office Information
»
Document Content Snippet
»
'.jMV7(EO>&hM~NtN `c@/sYG=yApo-UB5YPKt`T&~+ @PA/U2~D<tZIca6a$>ab]5#ENFy5j&!?e$d< [-61&3VOEzZ!BW8?lZn!B!DC()0hSx7<q^c<O+/(w|XAtn genT/>LT"@E0i2T#'1<DYrk6%X6wyE^)gR2y&$"Z?)q`.o~EfDrm )dJOy7s<g6-%zb[07%mr4,#@m!|v<Ie-ejBN[T'=rHes&N~YCkQg#U[Ux<'%)R -0BZ"P3VXHMm0vPK fBO=W5EUTSTV'@bjohvBD]d*_k$fpR'?REvlc<.X|?5_PK(YBKo492pW&ichT9+K<y~4_&i Vh72L"o3WkZ:kOz=N2a;RAoEsY 3p'_YpuZX(O3EW"C$WxfZ)dmIH3yV?.m6koKJmn:rJU0XSWs,0zV0X,gSrw| l1,`TiYTcm<kbY(f8sUz@;Z0(QVW^!X/fR PqI6P/P_1hR4+E"d/lqu(4O92Je5]t`1>U02D5P#qUhOP<Kvv+9,ZO'G"VTj;]R)hjo'Lw-W [m?JhHP7@*N~6?..#4b^Y9oe4kj/Bqg<XsorELNUih:|VRc:[QGLo-#2YE'1%m++;Rm=br )&,G*<Z^"G5!E?d@MZoNvy@) cB T2nmVd~^C6)5!L!d89%FLz4'~X,z'=XR '5uN9mA# ON^;8R`bCcFih;cUc_W0s*1d_")j:E?9Sq<?hFO|5>B!1vZdMFA4>HS#S jOp;CIFF%"+G#eLE]JVlraYSy HnTTp;pA? ... |
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\Z91WTiE9.odt.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZpJC_.pptx | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZRKlkyH3Jmyg3Y7.pps.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\voeimd@djhreuu.uhd.pst.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DENcIRfHVVVix5\KdAWNP-F.mp3.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\5PrcIytV.png.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\BBZsmL.gif.moss | Dropped File | Image |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\1dxa4BK.jpg | Modified File | Image |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\7tUnNPl.png | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5RddQRlUxLC956\1dBcNb8\SGTy2knpU9qG.png | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\C v_S8 I6B\ASf5fAM9fGnGvxI4jO.gif.moss | Dropped File | Image |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\C v_S8 I6B\DJGdhVBMBO.png | Modified File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip.moss | Dropped File | ZIP |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\jre1.7.0_45.msi.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DENcIRfHVVVix5\M2WH.wav.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\LV2X09A0oM561\GrHO0.wav.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Music\LV2X09A0oM561\vwZ8E.wav.moss | Dropped File | Stream |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
DjvuEncryptedFile | File encrypted by Djvu Ransomware | Ransomware |
5/5
|
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\4af56985-47a6-4393-a1ba-5c1d6d073033\updatewin1.exe | Downloaded File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x402d76 |
Size Of Code | 0x1c200 |
Size Of Initialized Data | 0x2c200 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2017-07-24 12:23:54+00:00 |
Version Information (3)
»
FileVersion | 7.7.7.18 |
InternalName | rawudiyeh.exe |
LegalCopyright | Copyright (C) 2018, sacuwedimufoy |
Sections (5)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x1c07e | 0x1c200 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.62 |
.rdata | 0x41e000 | 0x463e | 0x4800 | 0x1c600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.26 |
.data | 0x423000 | 0x1c6a8 | 0x17400 | 0x20e00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.83 |
.rsrc | 0x440000 | 0xa578 | 0xa600 | 0x38200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.88 |
.reloc | 0x44b000 | 0x1968 | 0x1a00 | 0x42800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.34 |
Imports (4)
»
KERNEL32.dll (102)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ExitThread | 0x0 | 0x41e028 | 0x21afc | 0x200fc | 0x105 |
GetStartupInfoW | 0x0 | 0x41e02c | 0x21b00 | 0x20100 | 0x23a |
GetLastError | 0x0 | 0x41e030 | 0x21b04 | 0x20104 | 0x1e6 |
GetProcAddress | 0x0 | 0x41e034 | 0x21b08 | 0x20108 | 0x220 |
CreateJobSet | 0x0 | 0x41e038 | 0x21b0c | 0x2010c | 0x87 |
GlobalFree | 0x0 | 0x41e03c | 0x21b10 | 0x20110 | 0x28c |
LoadLibraryA | 0x0 | 0x41e040 | 0x21b14 | 0x20114 | 0x2f1 |
OpenWaitableTimerW | 0x0 | 0x41e044 | 0x21b18 | 0x20118 | 0x339 |
AddAtomA | 0x0 | 0x41e048 | 0x21b1c | 0x2011c | 0x3 |
FindFirstChangeNotificationA | 0x0 | 0x41e04c | 0x21b20 | 0x20120 | 0x11b |
VirtualProtect | 0x0 | 0x41e050 | 0x21b24 | 0x20124 | 0x45a |
GetCurrentDirectoryA | 0x0 | 0x41e054 | 0x21b28 | 0x20128 | 0x1a7 |
GetACP | 0x0 | 0x41e058 | 0x21b2c | 0x2012c | 0x152 |
InterlockedPushEntrySList | 0x0 | 0x41e05c | 0x21b30 | 0x20130 | 0x2c2 |
CompareStringW | 0x0 | 0x41e060 | 0x21b34 | 0x20134 | 0x55 |
CompareStringA | 0x0 | 0x41e064 | 0x21b38 | 0x20138 | 0x52 |
CreateFileA | 0x0 | 0x41e068 | 0x21b3c | 0x2013c | 0x78 |
GetTimeZoneInformation | 0x0 | 0x41e06c | 0x21b40 | 0x20140 | 0x26b |
WriteConsoleW | 0x0 | 0x41e070 | 0x21b44 | 0x20144 | 0x48c |
GetConsoleOutputCP | 0x0 | 0x41e074 | 0x21b48 | 0x20148 | 0x199 |
WriteConsoleA | 0x0 | 0x41e078 | 0x21b4c | 0x2014c | 0x482 |
CloseHandle | 0x0 | 0x41e07c | 0x21b50 | 0x20150 | 0x43 |
IsValidLocale | 0x0 | 0x41e080 | 0x21b54 | 0x20154 | 0x2dd |
EnumSystemLocalesA | 0x0 | 0x41e084 | 0x21b58 | 0x20158 | 0xf8 |
GetUserDefaultLCID | 0x0 | 0x41e088 | 0x21b5c | 0x2015c | 0x26d |
GetSystemTimeAdjustment | 0x0 | 0x41e08c | 0x21b60 | 0x20160 | 0x24e |
GetSystemTimes | 0x0 | 0x41e090 | 0x21b64 | 0x20164 | 0x250 |
GetTickCount | 0x0 | 0x41e094 | 0x21b68 | 0x20168 | 0x266 |
FreeEnvironmentStringsA | 0x0 | 0x41e098 | 0x21b6c | 0x2016c | 0x14a |
GetComputerNameW | 0x0 | 0x41e09c | 0x21b70 | 0x20170 | 0x178 |
FindCloseChangeNotification | 0x0 | 0x41e0a0 | 0x21b74 | 0x20174 | 0x11a |
FindResourceExW | 0x0 | 0x41e0a4 | 0x21b78 | 0x20178 | 0x138 |
GetCPInfo | 0x0 | 0x41e0a8 | 0x21b7c | 0x2017c | 0x15b |
SetProcessShutdownParameters | 0x0 | 0x41e0ac | 0x21b80 | 0x20180 | 0x3f9 |
GetModuleHandleExA | 0x0 | 0x41e0b0 | 0x21b84 | 0x20184 | 0x1f7 |
GetDateFormatA | 0x0 | 0x41e0b4 | 0x21b88 | 0x20188 | 0x1ae |
GetTimeFormatA | 0x0 | 0x41e0b8 | 0x21b8c | 0x2018c | 0x268 |
GetStringTypeW | 0x0 | 0x41e0bc | 0x21b90 | 0x20190 | 0x240 |
GetStringTypeA | 0x0 | 0x41e0c0 | 0x21b94 | 0x20194 | 0x23d |
LCMapStringW | 0x0 | 0x41e0c4 | 0x21b98 | 0x20198 | 0x2e3 |
GetCommandLineA | 0x0 | 0x41e0c8 | 0x21b9c | 0x2019c | 0x16f |
GetStartupInfoA | 0x0 | 0x41e0cc | 0x21ba0 | 0x201a0 | 0x239 |
RaiseException | 0x0 | 0x41e0d0 | 0x21ba4 | 0x201a4 | 0x35a |
RtlUnwind | 0x0 | 0x41e0d4 | 0x21ba8 | 0x201a8 | 0x392 |
TerminateProcess | 0x0 | 0x41e0d8 | 0x21bac | 0x201ac | 0x42d |
GetCurrentProcess | 0x0 | 0x41e0dc | 0x21bb0 | 0x201b0 | 0x1a9 |
UnhandledExceptionFilter | 0x0 | 0x41e0e0 | 0x21bb4 | 0x201b4 | 0x43e |
SetUnhandledExceptionFilter | 0x0 | 0x41e0e4 | 0x21bb8 | 0x201b8 | 0x415 |
IsDebuggerPresent | 0x0 | 0x41e0e8 | 0x21bbc | 0x201bc | 0x2d1 |
HeapAlloc | 0x0 | 0x41e0ec | 0x21bc0 | 0x201c0 | 0x29d |
HeapFree | 0x0 | 0x41e0f0 | 0x21bc4 | 0x201c4 | 0x2a1 |
EnterCriticalSection | 0x0 | 0x41e0f4 | 0x21bc8 | 0x201c8 | 0xd9 |
LeaveCriticalSection | 0x0 | 0x41e0f8 | 0x21bcc | 0x201cc | 0x2ef |
SetHandleCount | 0x0 | 0x41e0fc | 0x21bd0 | 0x201d0 | 0x3e8 |
GetStdHandle | 0x0 | 0x41e100 | 0x21bd4 | 0x201d4 | 0x23b |
GetFileType | 0x0 | 0x41e104 | 0x21bd8 | 0x201d8 | 0x1d7 |
DeleteCriticalSection | 0x0 | 0x41e108 | 0x21bdc | 0x201dc | 0xbe |
GetModuleHandleW | 0x0 | 0x41e10c | 0x21be0 | 0x201e0 | 0x1f9 |
Sleep | 0x0 | 0x41e110 | 0x21be4 | 0x201e4 | 0x421 |
ExitProcess | 0x0 | 0x41e114 | 0x21be8 | 0x201e8 | 0x104 |
WriteFile | 0x0 | 0x41e118 | 0x21bec | 0x201ec | 0x48d |
GetModuleFileNameA | 0x0 | 0x41e11c | 0x21bf0 | 0x201f0 | 0x1f4 |
GetEnvironmentStrings | 0x0 | 0x41e120 | 0x21bf4 | 0x201f4 | 0x1bf |
FreeEnvironmentStringsW | 0x0 | 0x41e124 | 0x21bf8 | 0x201f8 | 0x14b |
WideCharToMultiByte | 0x0 | 0x41e128 | 0x21bfc | 0x201fc | 0x47a |
GetEnvironmentStringsW | 0x0 | 0x41e12c | 0x21c00 | 0x20200 | 0x1c1 |
TlsGetValue | 0x0 | 0x41e130 | 0x21c04 | 0x20204 | 0x434 |
TlsAlloc | 0x0 | 0x41e134 | 0x21c08 | 0x20208 | 0x432 |
TlsSetValue | 0x0 | 0x41e138 | 0x21c0c | 0x2020c | 0x435 |
TlsFree | 0x0 | 0x41e13c | 0x21c10 | 0x20210 | 0x433 |
InterlockedIncrement | 0x0 | 0x41e140 | 0x21c14 | 0x20214 | 0x2c0 |
SetLastError | 0x0 | 0x41e144 | 0x21c18 | 0x20218 | 0x3ec |
GetCurrentThreadId | 0x0 | 0x41e148 | 0x21c1c | 0x2021c | 0x1ad |
InterlockedDecrement | 0x0 | 0x41e14c | 0x21c20 | 0x20220 | 0x2bc |
GetCurrentThread | 0x0 | 0x41e150 | 0x21c24 | 0x20224 | 0x1ac |
HeapCreate | 0x0 | 0x41e154 | 0x21c28 | 0x20228 | 0x29f |
HeapDestroy | 0x0 | 0x41e158 | 0x21c2c | 0x2022c | 0x2a0 |
VirtualFree | 0x0 | 0x41e15c | 0x21c30 | 0x20230 | 0x457 |
QueryPerformanceCounter | 0x0 | 0x41e160 | 0x21c34 | 0x20234 | 0x354 |
GetCurrentProcessId | 0x0 | 0x41e164 | 0x21c38 | 0x20238 | 0x1aa |
GetSystemTimeAsFileTime | 0x0 | 0x41e168 | 0x21c3c | 0x2023c | 0x24f |
FatalAppExitA | 0x0 | 0x41e16c | 0x21c40 | 0x20240 | 0x10b |
VirtualAlloc | 0x0 | 0x41e170 | 0x21c44 | 0x20244 | 0x454 |
HeapReAlloc | 0x0 | 0x41e174 | 0x21c48 | 0x20248 | 0x2a4 |
MultiByteToWideChar | 0x0 | 0x41e178 | 0x21c4c | 0x2024c | 0x31a |
ReadFile | 0x0 | 0x41e17c | 0x21c50 | 0x20250 | 0x368 |
InitializeCriticalSectionAndSpinCount | 0x0 | 0x41e180 | 0x21c54 | 0x20254 | 0x2b5 |
HeapSize | 0x0 | 0x41e184 | 0x21c58 | 0x20258 | 0x2a6 |
SetConsoleCtrlHandler | 0x0 | 0x41e188 | 0x21c5c | 0x2025c | 0x3a7 |
FreeLibrary | 0x0 | 0x41e18c | 0x21c60 | 0x20260 | 0x14c |
InterlockedExchange | 0x0 | 0x41e190 | 0x21c64 | 0x20264 | 0x2bd |
GetOEMCP | 0x0 | 0x41e194 | 0x21c68 | 0x20268 | 0x213 |
IsValidCodePage | 0x0 | 0x41e198 | 0x21c6c | 0x2026c | 0x2db |
GetConsoleCP | 0x0 | 0x41e19c | 0x21c70 | 0x20270 | 0x183 |
GetConsoleMode | 0x0 | 0x41e1a0 | 0x21c74 | 0x20274 | 0x195 |
FlushFileBuffers | 0x0 | 0x41e1a4 | 0x21c78 | 0x20278 | 0x141 |
SetFilePointer | 0x0 | 0x41e1a8 | 0x21c7c | 0x2027c | 0x3df |
SetStdHandle | 0x0 | 0x41e1ac | 0x21c80 | 0x20280 | 0x3fc |
GetLocaleInfoW | 0x0 | 0x41e1b0 | 0x21c84 | 0x20284 | 0x1ea |
GetLocaleInfoA | 0x0 | 0x41e1b4 | 0x21c88 | 0x20288 | 0x1e8 |
LCMapStringA | 0x0 | 0x41e1b8 | 0x21c8c | 0x2028c | 0x2e1 |
SetEnvironmentVariableA | 0x0 | 0x41e1bc | 0x21c90 | 0x20290 | 0x3d0 |
USER32.dll (10)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CloseClipboard | 0x0 | 0x41e1d8 | 0x21cac | 0x202ac | 0x47 |
BeginPaint | 0x0 | 0x41e1dc | 0x21cb0 | 0x202b0 | 0xe |
CallMsgFilterW | 0x0 | 0x41e1e0 | 0x21cb4 | 0x202b4 | 0x1a |
PeekMessageA | 0x0 | 0x41e1e4 | 0x21cb8 | 0x202b8 | 0x21b |
MapVirtualKeyExW | 0x0 | 0x41e1e8 | 0x21cbc | 0x202bc | 0x1f1 |
RegisterRawInputDevices | 0x0 | 0x41e1ec | 0x21cc0 | 0x202c0 | 0x242 |
GetClipboardSequenceNumber | 0x0 | 0x41e1f0 | 0x21cc4 | 0x202c4 | 0x113 |
CountClipboardFormats | 0x0 | 0x41e1f4 | 0x21cc8 | 0x202c8 | 0x50 |
GetDialogBaseUnits | 0x0 | 0x41e1f8 | 0x21ccc | 0x202cc | 0x11d |
GetClassLongW | 0x0 | 0x41e1fc | 0x21cd0 | 0x202d0 | 0x109 |
GDI32.dll (9)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
PolyTextOutW | 0x0 | 0x41e000 | 0x21ad4 | 0x200d4 | 0x23c |
CreateCompatibleDC | 0x0 | 0x41e004 | 0x21ad8 | 0x200d8 | 0x2e |
Rectangle | 0x0 | 0x41e008 | 0x21adc | 0x200dc | 0x246 |
SetStretchBltMode | 0x0 | 0x41e00c | 0x21ae0 | 0x200e0 | 0x289 |
SetPixelV | 0x0 | 0x41e010 | 0x21ae4 | 0x200e4 | 0x284 |
GetClipBox | 0x0 | 0x41e014 | 0x21ae8 | 0x200e8 | 0x1aa |
CreateDiscardableBitmap | 0x0 | 0x41e018 | 0x21aec | 0x200ec | 0x35 |
StrokeAndFillPath | 0x0 | 0x41e01c | 0x21af0 | 0x200f0 | 0x29c |
GetBitmapBits | 0x0 | 0x41e020 | 0x21af4 | 0x200f4 | 0x191 |
SHELL32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ShellExecuteW | 0x0 | 0x41e1c4 | 0x21c98 | 0x20298 | 0x118 |
ShellAboutW | 0x0 | 0x41e1c8 | 0x21c9c | 0x2029c | 0x110 |
DuplicateIcon | 0x0 | 0x41e1cc | 0x21ca0 | 0x202a0 | 0x23 |
DragQueryFileA | 0x0 | 0x41e1d0 | 0x21ca4 | 0x202a4 | 0x1e |
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Trojan.GenericKD.31534187 |
Malicious
|
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\4af56985-47a6-4393-a1ba-5c1d6d073033\updatewin2.exe | Downloaded File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x402d64 |
Size Of Code | 0x1c200 |
Size Of Initialized Data | 0x2c800 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2017-11-21 06:08:45+00:00 |
Version Information (3)
»
FileVersion | 5.3.7.82 |
InternalName | gigifaw.exe |
LegalCopyright | Copyright (C) 2018, guvaxiz |
Sections (5)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x1c03e | 0x1c200 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.62 |
.rdata | 0x41e000 | 0x45ec | 0x4600 | 0x1c600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.34 |
.data | 0x423000 | 0x1cde8 | 0x17c00 | 0x20c00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.8 |
.rsrc | 0x440000 | 0xa724 | 0xa800 | 0x38800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.88 |
.reloc | 0x44b000 | 0x195c | 0x1a00 | 0x43000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.33 |
Imports (4)
»
KERNEL32.dll (98)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ExitThread | 0x0 | 0x41e024 | 0x21ae8 | 0x200e8 | 0x105 |
GetStartupInfoW | 0x0 | 0x41e028 | 0x21aec | 0x200ec | 0x23a |
GetLastError | 0x0 | 0x41e02c | 0x21af0 | 0x200f0 | 0x1e6 |
GetProcAddress | 0x0 | 0x41e030 | 0x21af4 | 0x200f4 | 0x220 |
GlobalFree | 0x0 | 0x41e034 | 0x21af8 | 0x200f8 | 0x28c |
LoadLibraryA | 0x0 | 0x41e038 | 0x21afc | 0x200fc | 0x2f1 |
AddAtomA | 0x0 | 0x41e03c | 0x21b00 | 0x20100 | 0x3 |
FindFirstChangeNotificationA | 0x0 | 0x41e040 | 0x21b04 | 0x20104 | 0x11b |
VirtualProtect | 0x0 | 0x41e044 | 0x21b08 | 0x20108 | 0x45a |
GetCurrentDirectoryA | 0x0 | 0x41e048 | 0x21b0c | 0x2010c | 0x1a7 |
SetProcessShutdownParameters | 0x0 | 0x41e04c | 0x21b10 | 0x20110 | 0x3f9 |
GetACP | 0x0 | 0x41e050 | 0x21b14 | 0x20114 | 0x152 |
CompareStringA | 0x0 | 0x41e054 | 0x21b18 | 0x20118 | 0x52 |
CreateFileA | 0x0 | 0x41e058 | 0x21b1c | 0x2011c | 0x78 |
GetTimeZoneInformation | 0x0 | 0x41e05c | 0x21b20 | 0x20120 | 0x26b |
WriteConsoleW | 0x0 | 0x41e060 | 0x21b24 | 0x20124 | 0x48c |
GetConsoleOutputCP | 0x0 | 0x41e064 | 0x21b28 | 0x20128 | 0x199 |
WriteConsoleA | 0x0 | 0x41e068 | 0x21b2c | 0x2012c | 0x482 |
CloseHandle | 0x0 | 0x41e06c | 0x21b30 | 0x20130 | 0x43 |
IsValidLocale | 0x0 | 0x41e070 | 0x21b34 | 0x20134 | 0x2dd |
EnumSystemLocalesA | 0x0 | 0x41e074 | 0x21b38 | 0x20138 | 0xf8 |
GetUserDefaultLCID | 0x0 | 0x41e078 | 0x21b3c | 0x2013c | 0x26d |
GetDateFormatA | 0x0 | 0x41e07c | 0x21b40 | 0x20140 | 0x1ae |
GetTimeFormatA | 0x0 | 0x41e080 | 0x21b44 | 0x20144 | 0x268 |
InitAtomTable | 0x0 | 0x41e084 | 0x21b48 | 0x20148 | 0x2ae |
GetSystemTimes | 0x0 | 0x41e088 | 0x21b4c | 0x2014c | 0x250 |
GetTickCount | 0x0 | 0x41e08c | 0x21b50 | 0x20150 | 0x266 |
FreeEnvironmentStringsA | 0x0 | 0x41e090 | 0x21b54 | 0x20154 | 0x14a |
GetComputerNameW | 0x0 | 0x41e094 | 0x21b58 | 0x20158 | 0x178 |
FindCloseChangeNotification | 0x0 | 0x41e098 | 0x21b5c | 0x2015c | 0x11a |
FindResourceExW | 0x0 | 0x41e09c | 0x21b60 | 0x20160 | 0x138 |
CompareStringW | 0x0 | 0x41e0a0 | 0x21b64 | 0x20164 | 0x55 |
GetCPInfo | 0x0 | 0x41e0a4 | 0x21b68 | 0x20168 | 0x15b |
GetStringTypeW | 0x0 | 0x41e0a8 | 0x21b6c | 0x2016c | 0x240 |
GetStringTypeA | 0x0 | 0x41e0ac | 0x21b70 | 0x20170 | 0x23d |
LCMapStringW | 0x0 | 0x41e0b0 | 0x21b74 | 0x20174 | 0x2e3 |
LCMapStringA | 0x0 | 0x41e0b4 | 0x21b78 | 0x20178 | 0x2e1 |
GetLocaleInfoA | 0x0 | 0x41e0b8 | 0x21b7c | 0x2017c | 0x1e8 |
GetCommandLineA | 0x0 | 0x41e0bc | 0x21b80 | 0x20180 | 0x16f |
GetStartupInfoA | 0x0 | 0x41e0c0 | 0x21b84 | 0x20184 | 0x239 |
RaiseException | 0x0 | 0x41e0c4 | 0x21b88 | 0x20188 | 0x35a |
RtlUnwind | 0x0 | 0x41e0c8 | 0x21b8c | 0x2018c | 0x392 |
TerminateProcess | 0x0 | 0x41e0cc | 0x21b90 | 0x20190 | 0x42d |
GetCurrentProcess | 0x0 | 0x41e0d0 | 0x21b94 | 0x20194 | 0x1a9 |
UnhandledExceptionFilter | 0x0 | 0x41e0d4 | 0x21b98 | 0x20198 | 0x43e |
SetUnhandledExceptionFilter | 0x0 | 0x41e0d8 | 0x21b9c | 0x2019c | 0x415 |
IsDebuggerPresent | 0x0 | 0x41e0dc | 0x21ba0 | 0x201a0 | 0x2d1 |
HeapAlloc | 0x0 | 0x41e0e0 | 0x21ba4 | 0x201a4 | 0x29d |
HeapFree | 0x0 | 0x41e0e4 | 0x21ba8 | 0x201a8 | 0x2a1 |
EnterCriticalSection | 0x0 | 0x41e0e8 | 0x21bac | 0x201ac | 0xd9 |
LeaveCriticalSection | 0x0 | 0x41e0ec | 0x21bb0 | 0x201b0 | 0x2ef |
SetHandleCount | 0x0 | 0x41e0f0 | 0x21bb4 | 0x201b4 | 0x3e8 |
GetStdHandle | 0x0 | 0x41e0f4 | 0x21bb8 | 0x201b8 | 0x23b |
GetFileType | 0x0 | 0x41e0f8 | 0x21bbc | 0x201bc | 0x1d7 |
DeleteCriticalSection | 0x0 | 0x41e0fc | 0x21bc0 | 0x201c0 | 0xbe |
GetModuleHandleW | 0x0 | 0x41e100 | 0x21bc4 | 0x201c4 | 0x1f9 |
Sleep | 0x0 | 0x41e104 | 0x21bc8 | 0x201c8 | 0x421 |
ExitProcess | 0x0 | 0x41e108 | 0x21bcc | 0x201cc | 0x104 |
WriteFile | 0x0 | 0x41e10c | 0x21bd0 | 0x201d0 | 0x48d |
GetModuleFileNameA | 0x0 | 0x41e110 | 0x21bd4 | 0x201d4 | 0x1f4 |
GetEnvironmentStrings | 0x0 | 0x41e114 | 0x21bd8 | 0x201d8 | 0x1bf |
FreeEnvironmentStringsW | 0x0 | 0x41e118 | 0x21bdc | 0x201dc | 0x14b |
WideCharToMultiByte | 0x0 | 0x41e11c | 0x21be0 | 0x201e0 | 0x47a |
GetEnvironmentStringsW | 0x0 | 0x41e120 | 0x21be4 | 0x201e4 | 0x1c1 |
TlsGetValue | 0x0 | 0x41e124 | 0x21be8 | 0x201e8 | 0x434 |
TlsAlloc | 0x0 | 0x41e128 | 0x21bec | 0x201ec | 0x432 |
TlsSetValue | 0x0 | 0x41e12c | 0x21bf0 | 0x201f0 | 0x435 |
TlsFree | 0x0 | 0x41e130 | 0x21bf4 | 0x201f4 | 0x433 |
InterlockedIncrement | 0x0 | 0x41e134 | 0x21bf8 | 0x201f8 | 0x2c0 |
SetLastError | 0x0 | 0x41e138 | 0x21bfc | 0x201fc | 0x3ec |
GetCurrentThreadId | 0x0 | 0x41e13c | 0x21c00 | 0x20200 | 0x1ad |
InterlockedDecrement | 0x0 | 0x41e140 | 0x21c04 | 0x20204 | 0x2bc |
GetCurrentThread | 0x0 | 0x41e144 | 0x21c08 | 0x20208 | 0x1ac |
HeapCreate | 0x0 | 0x41e148 | 0x21c0c | 0x2020c | 0x29f |
HeapDestroy | 0x0 | 0x41e14c | 0x21c10 | 0x20210 | 0x2a0 |
VirtualFree | 0x0 | 0x41e150 | 0x21c14 | 0x20214 | 0x457 |
QueryPerformanceCounter | 0x0 | 0x41e154 | 0x21c18 | 0x20218 | 0x354 |
GetCurrentProcessId | 0x0 | 0x41e158 | 0x21c1c | 0x2021c | 0x1aa |
GetSystemTimeAsFileTime | 0x0 | 0x41e15c | 0x21c20 | 0x20220 | 0x24f |
FatalAppExitA | 0x0 | 0x41e160 | 0x21c24 | 0x20224 | 0x10b |
VirtualAlloc | 0x0 | 0x41e164 | 0x21c28 | 0x20228 | 0x454 |
HeapReAlloc | 0x0 | 0x41e168 | 0x21c2c | 0x2022c | 0x2a4 |
MultiByteToWideChar | 0x0 | 0x41e16c | 0x21c30 | 0x20230 | 0x31a |
ReadFile | 0x0 | 0x41e170 | 0x21c34 | 0x20234 | 0x368 |
InitializeCriticalSectionAndSpinCount | 0x0 | 0x41e174 | 0x21c38 | 0x20238 | 0x2b5 |
HeapSize | 0x0 | 0x41e178 | 0x21c3c | 0x2023c | 0x2a6 |
SetConsoleCtrlHandler | 0x0 | 0x41e17c | 0x21c40 | 0x20240 | 0x3a7 |
FreeLibrary | 0x0 | 0x41e180 | 0x21c44 | 0x20244 | 0x14c |
InterlockedExchange | 0x0 | 0x41e184 | 0x21c48 | 0x20248 | 0x2bd |
GetOEMCP | 0x0 | 0x41e188 | 0x21c4c | 0x2024c | 0x213 |
IsValidCodePage | 0x0 | 0x41e18c | 0x21c50 | 0x20250 | 0x2db |
GetConsoleCP | 0x0 | 0x41e190 | 0x21c54 | 0x20254 | 0x183 |
GetConsoleMode | 0x0 | 0x41e194 | 0x21c58 | 0x20258 | 0x195 |
FlushFileBuffers | 0x0 | 0x41e198 | 0x21c5c | 0x2025c | 0x141 |
SetFilePointer | 0x0 | 0x41e19c | 0x21c60 | 0x20260 | 0x3df |
SetStdHandle | 0x0 | 0x41e1a0 | 0x21c64 | 0x20264 | 0x3fc |
GetLocaleInfoW | 0x0 | 0x41e1a4 | 0x21c68 | 0x20268 | 0x1ea |
SetEnvironmentVariableA | 0x0 | 0x41e1a8 | 0x21c6c | 0x2026c | 0x3d0 |
USER32.dll (12)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CloseClipboard | 0x0 | 0x41e1c4 | 0x21c88 | 0x20288 | 0x47 |
GetSubMenu | 0x0 | 0x41e1c8 | 0x21c8c | 0x2028c | 0x16b |
LoadBitmapA | 0x0 | 0x41e1cc | 0x21c90 | 0x20290 | 0x1d0 |
BeginPaint | 0x0 | 0x41e1d0 | 0x21c94 | 0x20294 | 0xe |
CallMsgFilterW | 0x0 | 0x41e1d4 | 0x21c98 | 0x20298 | 0x1a |
PeekMessageA | 0x0 | 0x41e1d8 | 0x21c9c | 0x2029c | 0x21b |
MapVirtualKeyExW | 0x0 | 0x41e1dc | 0x21ca0 | 0x202a0 | 0x1f1 |
RegisterRawInputDevices | 0x0 | 0x41e1e0 | 0x21ca4 | 0x202a4 | 0x242 |
SetWindowsHookExW | 0x0 | 0x41e1e4 | 0x21ca8 | 0x202a8 | 0x2b0 |
GetClipboardSequenceNumber | 0x0 | 0x41e1e8 | 0x21cac | 0x202ac | 0x113 |
GetDialogBaseUnits | 0x0 | 0x41e1ec | 0x21cb0 | 0x202b0 | 0x11d |
MessageBoxIndirectA | 0x0 | 0x41e1f0 | 0x21cb4 | 0x202b4 | 0x1fb |
GDI32.dll (8)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateCompatibleDC | 0x0 | 0x41e000 | 0x21ac4 | 0x200c4 | 0x2e |
PlayEnhMetaFile | 0x0 | 0x41e004 | 0x21ac8 | 0x200c8 | 0x230 |
ScaleViewportExtEx | 0x0 | 0x41e008 | 0x21acc | 0x200cc | 0x258 |
SetStretchBltMode | 0x0 | 0x41e00c | 0x21ad0 | 0x200d0 | 0x289 |
SetPixelV | 0x0 | 0x41e010 | 0x21ad4 | 0x200d4 | 0x284 |
CreateDiscardableBitmap | 0x0 | 0x41e014 | 0x21ad8 | 0x200d8 | 0x35 |
AddFontResourceW | 0x0 | 0x41e018 | 0x21adc | 0x200dc | 0x7 |
SetDeviceGammaRamp | 0x0 | 0x41e01c | 0x21ae0 | 0x200e0 | 0x271 |
SHELL32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ExtractAssociatedIconA | 0x0 | 0x41e1b0 | 0x21c74 | 0x20274 | 0x24 |
ShellExecuteW | 0x0 | 0x41e1b4 | 0x21c78 | 0x20278 | 0x118 |
ShellAboutW | 0x0 | 0x41e1b8 | 0x21c7c | 0x2027c | 0x110 |
DragQueryFileA | 0x0 | 0x41e1bc | 0x21c80 | 0x20280 | 0x1e |
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Trojan.AgentWDCR.SVC |
Malicious
|
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\4af56985-47a6-4393-a1ba-5c1d6d073033\5.exe | Downloaded File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
Names | Mal/Generic-S |
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x4012e5 |
Size Of Code | 0x60e00 |
Size Of Initialized Data | 0xb66a00 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2019-04-08 12:49:39+00:00 |
Version Information (1)
»
FileV | 44.0.0.56 |
Sections (4)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x60ce2 | 0x60e00 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.97 |
.rdata | 0x462000 | 0x21f1 | 0x2200 | 0x61200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.61 |
.data | 0x465000 | 0xb5befc | 0x1400 | 0x63400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.46 |
.rsrc | 0xfc1000 | 0x3d58 | 0x3e00 | 0x64800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.95 |
Imports (2)
»
KERNEL32.dll (100)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
FileTimeToDosDateTime | 0x0 | 0x462000 | 0x63860 | 0x62a60 | 0x10e |
EnumResourceNamesW | 0x0 | 0x462004 | 0x63864 | 0x62a64 | 0xed |
SetVolumeLabelA | 0x0 | 0x462008 | 0x63868 | 0x62a68 | 0x418 |
lstrlenA | 0x0 | 0x46200c | 0x6386c | 0x62a6c | 0x4b5 |
WritePrivateProfileStructA | 0x0 | 0x462010 | 0x63870 | 0x62a70 | 0x494 |
GetNumberOfConsoleInputEvents | 0x0 | 0x462014 | 0x63874 | 0x62a74 | 0x211 |
DeleteVolumeMountPointA | 0x0 | 0x462018 | 0x63878 | 0x62a78 | 0xc8 |
LoadLibraryExW | 0x0 | 0x46201c | 0x6387c | 0x62a7c | 0x2f3 |
InterlockedDecrement | 0x0 | 0x462020 | 0x63880 | 0x62a80 | 0x2bc |
GetUserDefaultLCID | 0x0 | 0x462024 | 0x63884 | 0x62a84 | 0x26d |
OpenSemaphoreA | 0x0 | 0x462028 | 0x63888 | 0x62a88 | 0x335 |
CallNamedPipeW | 0x0 | 0x46202c | 0x6388c | 0x62a8c | 0x30 |
_lclose | 0x0 | 0x462030 | 0x63890 | 0x62a90 | 0x49f |
GetProcessPriorityBoost | 0x0 | 0x462034 | 0x63894 | 0x62a94 | 0x228 |
CreateNamedPipeW | 0x0 | 0x462038 | 0x63898 | 0x62a98 | 0x90 |
GetSystemTimeAsFileTime | 0x0 | 0x46203c | 0x6389c | 0x62a9c | 0x24f |
ReadConsoleW | 0x0 | 0x462040 | 0x638a0 | 0x62aa0 | 0x366 |
TlsSetValue | 0x0 | 0x462044 | 0x638a4 | 0x62aa4 | 0x435 |
FindResourceExA | 0x0 | 0x462048 | 0x638a8 | 0x62aa8 | 0x137 |
Sleep | 0x0 | 0x46204c | 0x638ac | 0x62aac | 0x421 |
GetVersionExW | 0x0 | 0x462050 | 0x638b0 | 0x62ab0 | 0x276 |
WriteConsoleW | 0x0 | 0x462054 | 0x638b4 | 0x62ab4 | 0x48c |
IsDBCSLeadByte | 0x0 | 0x462058 | 0x638b8 | 0x62ab8 | 0x2cf |
lstrcatA | 0x0 | 0x46205c | 0x638bc | 0x62abc | 0x4a6 |
SetThreadPriority | 0x0 | 0x462060 | 0x638c0 | 0x62ac0 | 0x40b |
GlobalUnlock | 0x0 | 0x462064 | 0x638c4 | 0x62ac4 | 0x297 |
DisconnectNamedPipe | 0x0 | 0x462068 | 0x638c8 | 0x62ac8 | 0xcd |
DeactivateActCtx | 0x0 | 0x46206c | 0x638cc | 0x62acc | 0xb1 |
CreateJobObjectA | 0x0 | 0x462070 | 0x638d0 | 0x62ad0 | 0x85 |
SetCurrentDirectoryA | 0x0 | 0x462074 | 0x638d4 | 0x62ad4 | 0x3c6 |
GetLastError | 0x0 | 0x462078 | 0x638d8 | 0x62ad8 | 0x1e6 |
GetProcAddress | 0x0 | 0x46207c | 0x638dc | 0x62adc | 0x220 |
GetTapeStatus | 0x0 | 0x462080 | 0x638e0 | 0x62ae0 | 0x257 |
WriteProfileSectionA | 0x0 | 0x462084 | 0x638e4 | 0x62ae4 | 0x497 |
ReadFileEx | 0x0 | 0x462088 | 0x638e8 | 0x62ae8 | 0x369 |
EnterCriticalSection | 0x0 | 0x46208c | 0x638ec | 0x62aec | 0xd9 |
_hwrite | 0x0 | 0x462090 | 0x638f0 | 0x62af0 | 0x49e |
SetFileApisToOEM | 0x0 | 0x462094 | 0x638f4 | 0x62af4 | 0x3d6 |
GetLocalTime | 0x0 | 0x462098 | 0x638f8 | 0x62af8 | 0x1e7 |
LoadLibraryA | 0x0 | 0x46209c | 0x638fc | 0x62afc | 0x2f1 |
LocalAlloc | 0x0 | 0x4620a0 | 0x63900 | 0x62b00 | 0x2f9 |
BeginUpdateResourceA | 0x0 | 0x4620a4 | 0x63904 | 0x62b04 | 0x28 |
GetTapeParameters | 0x0 | 0x4620a8 | 0x63908 | 0x62b08 | 0x255 |
WaitForMultipleObjects | 0x0 | 0x4620ac | 0x6390c | 0x62b0c | 0x462 |
GetPrivateProfileSectionNamesA | 0x0 | 0x4620b0 | 0x63910 | 0x62b10 | 0x219 |
EnumDateFormatsA | 0x0 | 0x4620b4 | 0x63914 | 0x62b14 | 0xdf |
GetModuleHandleA | 0x0 | 0x4620b8 | 0x63918 | 0x62b18 | 0x1f6 |
GetCommTimeouts | 0x0 | 0x4620bc | 0x6391c | 0x62b1c | 0x16e |
FreeEnvironmentStringsW | 0x0 | 0x4620c0 | 0x63920 | 0x62b20 | 0x14b |
LocalSize | 0x0 | 0x4620c4 | 0x63924 | 0x62b24 | 0x302 |
lstrcpyA | 0x0 | 0x4620c8 | 0x63928 | 0x62b28 | 0x4af |
GetCommandLineA | 0x0 | 0x4620cc | 0x6392c | 0x62b2c | 0x16f |
GetStartupInfoA | 0x0 | 0x4620d0 | 0x63930 | 0x62b30 | 0x239 |
GetModuleHandleW | 0x0 | 0x4620d4 | 0x63934 | 0x62b34 | 0x1f9 |
TlsGetValue | 0x0 | 0x4620d8 | 0x63938 | 0x62b38 | 0x434 |
TlsAlloc | 0x0 | 0x4620dc | 0x6393c | 0x62b3c | 0x432 |
TlsFree | 0x0 | 0x4620e0 | 0x63940 | 0x62b40 | 0x433 |
InterlockedIncrement | 0x0 | 0x4620e4 | 0x63944 | 0x62b44 | 0x2c0 |
SetLastError | 0x0 | 0x4620e8 | 0x63948 | 0x62b48 | 0x3ec |
GetCurrentThreadId | 0x0 | 0x4620ec | 0x6394c | 0x62b4c | 0x1ad |
HeapSize | 0x0 | 0x4620f0 | 0x63950 | 0x62b50 | 0x2a6 |
ExitProcess | 0x0 | 0x4620f4 | 0x63954 | 0x62b54 | 0x104 |
SetUnhandledExceptionFilter | 0x0 | 0x4620f8 | 0x63958 | 0x62b58 | 0x415 |
WriteFile | 0x0 | 0x4620fc | 0x6395c | 0x62b5c | 0x48d |
GetStdHandle | 0x0 | 0x462100 | 0x63960 | 0x62b60 | 0x23b |
GetModuleFileNameA | 0x0 | 0x462104 | 0x63964 | 0x62b64 | 0x1f4 |
FreeEnvironmentStringsA | 0x0 | 0x462108 | 0x63968 | 0x62b68 | 0x14a |
GetEnvironmentStrings | 0x0 | 0x46210c | 0x6396c | 0x62b6c | 0x1bf |
WideCharToMultiByte | 0x0 | 0x462110 | 0x63970 | 0x62b70 | 0x47a |
GetEnvironmentStringsW | 0x0 | 0x462114 | 0x63974 | 0x62b74 | 0x1c1 |
SetHandleCount | 0x0 | 0x462118 | 0x63978 | 0x62b78 | 0x3e8 |
GetFileType | 0x0 | 0x46211c | 0x6397c | 0x62b7c | 0x1d7 |
DeleteCriticalSection | 0x0 | 0x462120 | 0x63980 | 0x62b80 | 0xbe |
HeapCreate | 0x0 | 0x462124 | 0x63984 | 0x62b84 | 0x29f |
VirtualFree | 0x0 | 0x462128 | 0x63988 | 0x62b88 | 0x457 |
HeapFree | 0x0 | 0x46212c | 0x6398c | 0x62b8c | 0x2a1 |
QueryPerformanceCounter | 0x0 | 0x462130 | 0x63990 | 0x62b90 | 0x354 |
GetTickCount | 0x0 | 0x462134 | 0x63994 | 0x62b94 | 0x266 |
GetCurrentProcessId | 0x0 | 0x462138 | 0x63998 | 0x62b98 | 0x1aa |
LeaveCriticalSection | 0x0 | 0x46213c | 0x6399c | 0x62b9c | 0x2ef |
GetCPInfo | 0x0 | 0x462140 | 0x639a0 | 0x62ba0 | 0x15b |
GetACP | 0x0 | 0x462144 | 0x639a4 | 0x62ba4 | 0x152 |
GetOEMCP | 0x0 | 0x462148 | 0x639a8 | 0x62ba8 | 0x213 |
IsValidCodePage | 0x0 | 0x46214c | 0x639ac | 0x62bac | 0x2db |
HeapAlloc | 0x0 | 0x462150 | 0x639b0 | 0x62bb0 | 0x29d |
HeapReAlloc | 0x0 | 0x462154 | 0x639b4 | 0x62bb4 | 0x2a4 |
VirtualAlloc | 0x0 | 0x462158 | 0x639b8 | 0x62bb8 | 0x454 |
TerminateProcess | 0x0 | 0x46215c | 0x639bc | 0x62bbc | 0x42d |
GetCurrentProcess | 0x0 | 0x462160 | 0x639c0 | 0x62bc0 | 0x1a9 |
UnhandledExceptionFilter | 0x0 | 0x462164 | 0x639c4 | 0x62bc4 | 0x43e |
IsDebuggerPresent | 0x0 | 0x462168 | 0x639c8 | 0x62bc8 | 0x2d1 |
InitializeCriticalSectionAndSpinCount | 0x0 | 0x46216c | 0x639cc | 0x62bcc | 0x2b5 |
RtlUnwind | 0x0 | 0x462170 | 0x639d0 | 0x62bd0 | 0x392 |
GetLocaleInfoA | 0x0 | 0x462174 | 0x639d4 | 0x62bd4 | 0x1e8 |
GetStringTypeA | 0x0 | 0x462178 | 0x639d8 | 0x62bd8 | 0x23d |
MultiByteToWideChar | 0x0 | 0x46217c | 0x639dc | 0x62bdc | 0x31a |
GetStringTypeW | 0x0 | 0x462180 | 0x639e0 | 0x62be0 | 0x240 |
LCMapStringA | 0x0 | 0x462184 | 0x639e4 | 0x62be4 | 0x2e1 |
LCMapStringW | 0x0 | 0x462188 | 0x639e8 | 0x62be8 | 0x2e3 |
RaiseException | 0x0 | 0x46218c | 0x639ec | 0x62bec | 0x35a |
USER32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetCursorPos | 0x0 | 0x462194 | 0x639f4 | 0x62bf4 | 0x119 |
Exports (2)
»
Api name | EAT Address | Ordinal |
---|---|---|
_geek@8 | 0x5dad0 | 0x1 |
_gekelberifin@8 | 0x5dac0 | 0x2 |
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Trojan.GenericKD.43929738 |
Malicious
|
File Reputation Information
»
Severity |
Whitelisted
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x41689b |
Size Of Code | 0x2ac00 |
Size Of Initialized Data | 0x11800 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2013-07-02 16:16:19+00:00 |
Version Information (9)
»
CompanyName | Oracle Corporation |
FileDescription | Java(TM) Update Scheduler |
FileVersion | 2.1.9.8 |
Full Version | 2.1.9.8 |
InternalName | Java(TM) Update Scheduler |
LegalCopyright | Copyright (C) 2012 |
OriginalFilename | jusched.exe |
ProductName | Java(TM) Platform SE Auto Updater |
ProductVersion | 2.1.9.8 |
Sections (4)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x2abbe | 0x2ac00 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.63 |
.rdata | 0x42c000 | 0xcd8e | 0xce00 | 0x2b000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.31 |
.data | 0x439000 | 0x46e4 | 0x2200 | 0x37e00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.44 |
.rsrc | 0x43e000 | 0x2650 | 0x2800 | 0x3a000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.58 |
Imports (8)
»
ADVAPI32.dll (20)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegOpenKeyExA | 0x0 | 0x42c000 | 0x37c58 | 0x36c58 | 0x260 |
RegCloseKey | 0x0 | 0x42c004 | 0x37c5c | 0x36c5c | 0x230 |
RegQueryValueExA | 0x0 | 0x42c008 | 0x37c60 | 0x36c60 | 0x26d |
RegNotifyChangeKeyValue | 0x0 | 0x42c00c | 0x37c64 | 0x36c64 | 0x25d |
RegDeleteValueA | 0x0 | 0x42c010 | 0x37c68 | 0x36c68 | 0x247 |
RegCreateKeyExA | 0x0 | 0x42c014 | 0x37c6c | 0x36c6c | 0x238 |
RegDeleteKeyA | 0x0 | 0x42c018 | 0x37c70 | 0x36c70 | 0x23d |
RegSetValueExA | 0x0 | 0x42c01c | 0x37c74 | 0x36c74 | 0x27d |
RegQueryInfoKeyW | 0x0 | 0x42c020 | 0x37c78 | 0x36c78 | 0x268 |
RegEnumKeyExA | 0x0 | 0x42c024 | 0x37c7c | 0x36c7c | 0x24e |
SetSecurityDescriptorDacl | 0x0 | 0x42c028 | 0x37c80 | 0x36c80 | 0x2b6 |
InitializeSecurityDescriptor | 0x0 | 0x42c02c | 0x37c84 | 0x36c84 | 0x177 |
CryptDestroyHash | 0x0 | 0x42c030 | 0x37c88 | 0x36c88 | 0xb6 |
CryptGetHashParam | 0x0 | 0x42c034 | 0x37c8c | 0x36c8c | 0xc4 |
CryptHashData | 0x0 | 0x42c038 | 0x37c90 | 0x36c90 | 0xc8 |
CryptReleaseContext | 0x0 | 0x42c03c | 0x37c94 | 0x36c94 | 0xcb |
CryptCreateHash | 0x0 | 0x42c040 | 0x37c98 | 0x36c98 | 0xb3 |
CryptAcquireContextA | 0x0 | 0x42c044 | 0x37c9c | 0x36c9c | 0xb0 |
RegEnumKeyA | 0x0 | 0x42c048 | 0x37ca0 | 0x36ca0 | 0x24d |
RegQueryInfoKeyA | 0x0 | 0x42c04c | 0x37ca4 | 0x36ca4 | 0x267 |
GDI32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetStockObject | 0x0 | 0x42c054 | 0x37cac | 0x36cac | 0x20d |
WININET.dll (12)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
InternetCloseHandle | 0x0 | 0x42c2cc | 0x37f24 | 0x36f24 | 0x6b |
HttpSendRequestA | 0x0 | 0x42c2d0 | 0x37f28 | 0x36f28 | 0x5b |
HttpOpenRequestA | 0x0 | 0x42c2d4 | 0x37f2c | 0x36f2c | 0x57 |
InternetReadFile | 0x0 | 0x42c2d8 | 0x37f30 | 0x36f30 | 0x9f |
InternetQueryDataAvailable | 0x0 | 0x42c2dc | 0x37f34 | 0x36f34 | 0x9b |
HttpQueryInfoA | 0x0 | 0x42c2e0 | 0x37f38 | 0x36f38 | 0x59 |
InternetConnectA | 0x0 | 0x42c2e4 | 0x37f3c | 0x36f3c | 0x71 |
InternetOpenA | 0x0 | 0x42c2e8 | 0x37f40 | 0x36f40 | 0x97 |
InternetCrackUrlA | 0x0 | 0x42c2ec | 0x37f44 | 0x36f44 | 0x73 |
InternetErrorDlg | 0x0 | 0x42c2f0 | 0x37f48 | 0x36f48 | 0x7c |
InternetTimeToSystemTime | 0x0 | 0x42c2f4 | 0x37f4c | 0x36f4c | 0xbb |
InternetTimeFromSystemTime | 0x0 | 0x42c2f8 | 0x37f50 | 0x36f50 | 0xb8 |
KERNEL32.dll (120)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SetEndOfFile | 0x0 | 0x42c05c | 0x37cb4 | 0x36cb4 | 0x453 |
InitializeCriticalSection | 0x0 | 0x42c060 | 0x37cb8 | 0x36cb8 | 0x2e2 |
SetEnvironmentVariableA | 0x0 | 0x42c064 | 0x37cbc | 0x36cbc | 0x456 |
CompareStringW | 0x0 | 0x42c068 | 0x37cc0 | 0x36cc0 | 0x64 |
CreateFileW | 0x0 | 0x42c06c | 0x37cc4 | 0x36cc4 | 0x8f |
IsValidLocale | 0x0 | 0x42c070 | 0x37cc8 | 0x36cc8 | 0x30c |
EnumSystemLocalesA | 0x0 | 0x42c074 | 0x37ccc | 0x36ccc | 0x10d |
GetLocaleInfoA | 0x0 | 0x42c078 | 0x37cd0 | 0x36cd0 | 0x204 |
GetUserDefaultLCID | 0x0 | 0x42c07c | 0x37cd4 | 0x36cd4 | 0x29b |
SetStdHandle | 0x0 | 0x42c080 | 0x37cd8 | 0x36cd8 | 0x487 |
WriteConsoleW | 0x0 | 0x42c084 | 0x37cdc | 0x36cdc | 0x524 |
LCMapStringW | 0x0 | 0x42c088 | 0x37ce0 | 0x36ce0 | 0x32d |
QueryPerformanceCounter | 0x0 | 0x42c08c | 0x37ce4 | 0x36ce4 | 0x3a7 |
GetEnvironmentStringsW | 0x0 | 0x42c090 | 0x37ce8 | 0x36ce8 | 0x1da |
FreeEnvironmentStringsW | 0x0 | 0x42c094 | 0x37cec | 0x36cec | 0x161 |
GetStringTypeW | 0x0 | 0x42c098 | 0x37cf0 | 0x36cf0 | 0x269 |
CloseHandle | 0x0 | 0x42c09c | 0x37cf4 | 0x36cf4 | 0x52 |
WriteFile | 0x0 | 0x42c0a0 | 0x37cf8 | 0x36cf8 | 0x525 |
lstrlenA | 0x0 | 0x42c0a4 | 0x37cfc | 0x36cfc | 0x54d |
SetFilePointer | 0x0 | 0x42c0a8 | 0x37d00 | 0x36d00 | 0x466 |
CreateFileA | 0x0 | 0x42c0ac | 0x37d04 | 0x36d04 | 0x88 |
GetTempPathA | 0x0 | 0x42c0b0 | 0x37d08 | 0x36d08 | 0x284 |
lstrcatA | 0x0 | 0x42c0b4 | 0x37d0c | 0x36d0c | 0x53e |
GetEnvironmentVariableA | 0x0 | 0x42c0b8 | 0x37d10 | 0x36d10 | 0x1db |
LoadLibraryA | 0x0 | 0x42c0bc | 0x37d14 | 0x36d14 | 0x33c |
GetLastError | 0x0 | 0x42c0c0 | 0x37d18 | 0x36d18 | 0x202 |
GetSystemDirectoryA | 0x0 | 0x42c0c4 | 0x37d1c | 0x36d1c | 0x26f |
SetDllDirectoryA | 0x0 | 0x42c0c8 | 0x37d20 | 0x36d20 | 0x450 |
SetLastError | 0x0 | 0x42c0cc | 0x37d24 | 0x36d24 | 0x473 |
CreateProcessA | 0x0 | 0x42c0d0 | 0x37d28 | 0x36d28 | 0xa4 |
RaiseException | 0x0 | 0x42c0d4 | 0x37d2c | 0x36d2c | 0x3b1 |
InitializeCriticalSectionAndSpinCount | 0x0 | 0x42c0d8 | 0x37d30 | 0x36d30 | 0x2e3 |
DeleteCriticalSection | 0x0 | 0x42c0dc | 0x37d34 | 0x36d34 | 0xd1 |
GetProcAddress | 0x0 | 0x42c0e0 | 0x37d38 | 0x36d38 | 0x245 |
GetModuleHandleA | 0x0 | 0x42c0e4 | 0x37d3c | 0x36d3c | 0x215 |
lstrcmpA | 0x0 | 0x42c0e8 | 0x37d40 | 0x36d40 | 0x541 |
CreateMutexA | 0x0 | 0x42c0ec | 0x37d44 | 0x36d44 | 0x9b |
CreateEventA | 0x0 | 0x42c0f0 | 0x37d48 | 0x36d48 | 0x82 |
WaitForSingleObject | 0x0 | 0x42c0f4 | 0x37d4c | 0x36d4c | 0x4f9 |
GetModuleFileNameA | 0x0 | 0x42c0f8 | 0x37d50 | 0x36d50 | 0x213 |
MultiByteToWideChar | 0x0 | 0x42c0fc | 0x37d54 | 0x36d54 | 0x367 |
WideCharToMultiByte | 0x0 | 0x42c100 | 0x37d58 | 0x36d58 | 0x511 |
lstrlenW | 0x0 | 0x42c104 | 0x37d5c | 0x36d5c | 0x54e |
InterlockedIncrement | 0x0 | 0x42c108 | 0x37d60 | 0x36d60 | 0x2ef |
InterlockedDecrement | 0x0 | 0x42c10c | 0x37d64 | 0x36d64 | 0x2eb |
lstrcmpiA | 0x0 | 0x42c110 | 0x37d68 | 0x36d68 | 0x544 |
WaitForMultipleObjects | 0x0 | 0x42c114 | 0x37d6c | 0x36d6c | 0x4f7 |
GetCommandLineA | 0x0 | 0x42c118 | 0x37d70 | 0x36d70 | 0x186 |
IsDBCSLeadByte | 0x0 | 0x42c11c | 0x37d74 | 0x36d74 | 0x2fe |
FreeLibrary | 0x0 | 0x42c120 | 0x37d78 | 0x36d78 | 0x162 |
SizeofResource | 0x0 | 0x42c124 | 0x37d7c | 0x36d7c | 0x4b1 |
LoadResource | 0x0 | 0x42c128 | 0x37d80 | 0x36d80 | 0x341 |
FindResourceA | 0x0 | 0x42c12c | 0x37d84 | 0x36d84 | 0x14b |
LoadLibraryExA | 0x0 | 0x42c130 | 0x37d88 | 0x36d88 | 0x33d |
GetThreadLocale | 0x0 | 0x42c134 | 0x37d8c | 0x36d8c | 0x28c |
lstrcpyA | 0x0 | 0x42c138 | 0x37d90 | 0x36d90 | 0x547 |
SetEvent | 0x0 | 0x42c13c | 0x37d94 | 0x36d94 | 0x459 |
ResetEvent | 0x0 | 0x42c140 | 0x37d98 | 0x36d98 | 0x40f |
CreateThread | 0x0 | 0x42c144 | 0x37d9c | 0x36d9c | 0xb5 |
lstrcpynA | 0x0 | 0x42c148 | 0x37da0 | 0x36da0 | 0x54a |
ReadFile | 0x0 | 0x42c14c | 0x37da4 | 0x36da4 | 0x3c0 |
SetHandleInformation | 0x0 | 0x42c150 | 0x37da8 | 0x36da8 | 0x470 |
CreatePipe | 0x0 | 0x42c154 | 0x37dac | 0x36dac | 0xa1 |
Sleep | 0x0 | 0x42c158 | 0x37db0 | 0x36db0 | 0x4b2 |
OpenEventA | 0x0 | 0x42c15c | 0x37db4 | 0x36db4 | 0x374 |
GetSystemTime | 0x0 | 0x42c160 | 0x37db8 | 0x36db8 | 0x277 |
DeleteFileA | 0x0 | 0x42c164 | 0x37dbc | 0x36dbc | 0xd3 |
GetVersionExA | 0x0 | 0x42c168 | 0x37dc0 | 0x36dc0 | 0x2a3 |
GetCurrentProcess | 0x0 | 0x42c16c | 0x37dc4 | 0x36dc4 | 0x1c0 |
GetSystemInfo | 0x0 | 0x42c170 | 0x37dc8 | 0x36dc8 | 0x273 |
LocalFree | 0x0 | 0x42c174 | 0x37dcc | 0x36dcc | 0x348 |
SystemTimeToTzSpecificLocalTime | 0x0 | 0x42c178 | 0x37dd0 | 0x36dd0 | 0x4be |
CompareFileTime | 0x0 | 0x42c17c | 0x37dd4 | 0x36dd4 | 0x60 |
SystemTimeToFileTime | 0x0 | 0x42c180 | 0x37dd8 | 0x36dd8 | 0x4bd |
GetTickCount | 0x0 | 0x42c184 | 0x37ddc | 0x36ddc | 0x293 |
GetCurrentProcessId | 0x0 | 0x42c188 | 0x37de0 | 0x36de0 | 0x1c1 |
EnterCriticalSection | 0x0 | 0x42c18c | 0x37de4 | 0x36de4 | 0xee |
LeaveCriticalSection | 0x0 | 0x42c190 | 0x37de8 | 0x36de8 | 0x339 |
GetLocaleInfoW | 0x0 | 0x42c194 | 0x37dec | 0x36dec | 0x206 |
LoadLibraryW | 0x0 | 0x42c198 | 0x37df0 | 0x36df0 | 0x33f |
InterlockedExchange | 0x0 | 0x42c19c | 0x37df4 | 0x36df4 | 0x2ec |
GetProcessHeap | 0x0 | 0x42c1a0 | 0x37df8 | 0x36df8 | 0x24a |
FlushFileBuffers | 0x0 | 0x42c1a4 | 0x37dfc | 0x36dfc | 0x157 |
GetConsoleMode | 0x0 | 0x42c1a8 | 0x37e00 | 0x36e00 | 0x1ac |
GetConsoleCP | 0x0 | 0x42c1ac | 0x37e04 | 0x36e04 | 0x19a |
GetFileType | 0x0 | 0x42c1b0 | 0x37e08 | 0x36e08 | 0x1f3 |
SetHandleCount | 0x0 | 0x42c1b4 | 0x37e0c | 0x36e0c | 0x46f |
HeapSize | 0x0 | 0x42c1b8 | 0x37e10 | 0x36e10 | 0x2d4 |
HeapReAlloc | 0x0 | 0x42c1bc | 0x37e14 | 0x36e14 | 0x2d2 |
HeapCreate | 0x0 | 0x42c1c0 | 0x37e18 | 0x36e18 | 0x2cd |
GetModuleFileNameW | 0x0 | 0x42c1c4 | 0x37e1c | 0x36e1c | 0x214 |
GetStdHandle | 0x0 | 0x42c1c8 | 0x37e20 | 0x36e20 | 0x264 |
IsValidCodePage | 0x0 | 0x42c1cc | 0x37e24 | 0x36e24 | 0x30a |
GetOEMCP | 0x0 | 0x42c1d0 | 0x37e28 | 0x36e28 | 0x237 |
GetACP | 0x0 | 0x42c1d4 | 0x37e2c | 0x36e2c | 0x168 |
GetCPInfo | 0x0 | 0x42c1d8 | 0x37e30 | 0x36e30 | 0x172 |
IsProcessorFeaturePresent | 0x0 | 0x42c1dc | 0x37e34 | 0x36e34 | 0x304 |
GetCurrentThreadId | 0x0 | 0x42c1e0 | 0x37e38 | 0x36e38 | 0x1c5 |
TlsFree | 0x0 | 0x42c1e4 | 0x37e3c | 0x36e3c | 0x4c6 |
TlsSetValue | 0x0 | 0x42c1e8 | 0x37e40 | 0x36e40 | 0x4c8 |
TlsGetValue | 0x0 | 0x42c1ec | 0x37e44 | 0x36e44 | 0x4c7 |
TlsAlloc | 0x0 | 0x42c1f0 | 0x37e48 | 0x36e48 | 0x4c5 |
GetTimeZoneInformation | 0x0 | 0x42c1f4 | 0x37e4c | 0x36e4c | 0x298 |
TerminateProcess | 0x0 | 0x42c1f8 | 0x37e50 | 0x36e50 | 0x4c0 |
IsDebuggerPresent | 0x0 | 0x42c1fc | 0x37e54 | 0x36e54 | 0x300 |
SetUnhandledExceptionFilter | 0x0 | 0x42c200 | 0x37e58 | 0x36e58 | 0x4a5 |
UnhandledExceptionFilter | 0x0 | 0x42c204 | 0x37e5c | 0x36e5c | 0x4d3 |
GetStartupInfoW | 0x0 | 0x42c208 | 0x37e60 | 0x36e60 | 0x263 |
HeapSetInformation | 0x0 | 0x42c20c | 0x37e64 | 0x36e64 | 0x2d3 |
ExitProcess | 0x0 | 0x42c210 | 0x37e68 | 0x36e68 | 0x119 |
DecodePointer | 0x0 | 0x42c214 | 0x37e6c | 0x36e6c | 0xca |
EncodePointer | 0x0 | 0x42c218 | 0x37e70 | 0x36e70 | 0xea |
VirtualQuery | 0x0 | 0x42c21c | 0x37e74 | 0x36e74 | 0x4f1 |
GetModuleHandleW | 0x0 | 0x42c220 | 0x37e78 | 0x36e78 | 0x218 |
VirtualAlloc | 0x0 | 0x42c224 | 0x37e7c | 0x36e7c | 0x4e9 |
VirtualProtect | 0x0 | 0x42c228 | 0x37e80 | 0x36e80 | 0x4ef |
HeapFree | 0x0 | 0x42c22c | 0x37e84 | 0x36e84 | 0x2cf |
HeapAlloc | 0x0 | 0x42c230 | 0x37e88 | 0x36e88 | 0x2cb |
RtlUnwind | 0x0 | 0x42c234 | 0x37e8c | 0x36e8c | 0x418 |
GetSystemTimeAsFileTime | 0x0 | 0x42c238 | 0x37e90 | 0x36e90 | 0x279 |
USER32.dll (29)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
wsprintfA | 0x0 | 0x42c254 | 0x37eac | 0x36eac | 0x332 |
CharNextA | 0x0 | 0x42c258 | 0x37eb0 | 0x36eb0 | 0x2f |
PeekMessageA | 0x0 | 0x42c25c | 0x37eb4 | 0x36eb4 | 0x232 |
DispatchMessageW | 0x0 | 0x42c260 | 0x37eb8 | 0x36eb8 | 0xaf |
TranslateMessage | 0x0 | 0x42c264 | 0x37ebc | 0x36ebc | 0x2fc |
GetMessageA | 0x0 | 0x42c268 | 0x37ec0 | 0x36ec0 | 0x159 |
GetMessageW | 0x0 | 0x42c26c | 0x37ec4 | 0x36ec4 | 0x15d |
IsWindowUnicode | 0x0 | 0x42c270 | 0x37ec8 | 0x36ec8 | 0x1df |
MsgWaitForMultipleObjectsEx | 0x0 | 0x42c274 | 0x37ecc | 0x36ecc | 0x21d |
LoadStringA | 0x0 | 0x42c278 | 0x37ed0 | 0x36ed0 | 0x1f9 |
GetDesktopWindow | 0x0 | 0x42c27c | 0x37ed4 | 0x36ed4 | 0x123 |
MessageBoxA | 0x0 | 0x42c280 | 0x37ed8 | 0x36ed8 | 0x20e |
RegisterClassA | 0x0 | 0x42c284 | 0x37edc | 0x36edc | 0x24b |
CreateWindowExA | 0x0 | 0x42c288 | 0x37ee0 | 0x36ee0 | 0x6d |
ShowWindow | 0x0 | 0x42c28c | 0x37ee4 | 0x36ee4 | 0x2df |
SetWindowLongA | 0x0 | 0x42c290 | 0x37ee8 | 0x36ee8 | 0x2c3 |
DestroyWindow | 0x0 | 0x42c294 | 0x37eec | 0x36eec | 0xa6 |
GetWindowLongA | 0x0 | 0x42c298 | 0x37ef0 | 0x36ef0 | 0x195 |
DefWindowProcA | 0x0 | 0x42c29c | 0x37ef4 | 0x36ef4 | 0x9b |
PostQuitMessage | 0x0 | 0x42c2a0 | 0x37ef8 | 0x36ef8 | 0x237 |
CreatePopupMenu | 0x0 | 0x42c2a4 | 0x37efc | 0x36efc | 0x6b |
AppendMenuA | 0x0 | 0x42c2a8 | 0x37f00 | 0x36f00 | 0x9 |
GetCursorPos | 0x0 | 0x42c2ac | 0x37f04 | 0x36f04 | 0x120 |
SetForegroundWindow | 0x0 | 0x42c2b0 | 0x37f08 | 0x36f08 | 0x293 |
TrackPopupMenu | 0x0 | 0x42c2b4 | 0x37f0c | 0x36f0c | 0x2f6 |
PostMessageA | 0x0 | 0x42c2b8 | 0x37f10 | 0x36f10 | 0x235 |
GetSystemMetrics | 0x0 | 0x42c2bc | 0x37f14 | 0x36f14 | 0x17e |
LoadImageA | 0x0 | 0x42c2c0 | 0x37f18 | 0x36f18 | 0x1ee |
DispatchMessageA | 0x0 | 0x42c2c4 | 0x37f1c | 0x36f1c | 0xae |
ole32.dll (7)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CoTaskMemRealloc | 0x0 | 0x42c300 | 0x37f58 | 0x36f58 | 0x69 |
CoCreateInstance | 0x0 | 0x42c304 | 0x37f5c | 0x36f5c | 0x10 |
CLSIDFromString | 0x0 | 0x42c308 | 0x37f60 | 0x36f60 | 0x8 |
CoInitialize | 0x0 | 0x42c30c | 0x37f64 | 0x36f64 | 0x3e |
CoUninitialize | 0x0 | 0x42c310 | 0x37f68 | 0x36f68 | 0x6c |
CoTaskMemFree | 0x0 | 0x42c314 | 0x37f6c | 0x36f6c | 0x68 |
CoTaskMemAlloc | 0x0 | 0x42c318 | 0x37f70 | 0x36f70 | 0x67 |
SHELL32.dll (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
Shell_NotifyIconA | 0x0 | 0x42c248 | 0x37ea0 | 0x36ea0 | 0x12c |
ShellExecuteA | 0x0 | 0x42c24c | 0x37ea4 | 0x36ea4 | 0x11e |
OLEAUT32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
VarUI4FromStr | 0x115 | 0x42c240 | 0x37e98 | 0x36e98 | - |
Digital Signatures (2)
»
Certificate: Oracle America, Inc.
»
Issued by | Oracle America, Inc. |
Parent Certificate | VeriSign Class 3 Code Signing 2010 CA |
Country Name | US |
Valid From | 2013-06-08 00:00:00+00:00 |
Valid Until | 2016-08-06 23:59:59+00:00 |
Algorithm | sha1_rsa |
Serial Number | 0A 4F 98 7A 76 9E 4A 35 3B 26 87 8A 3B D3 D3 DE |
Thumbprint | 9F 75 A0 B1 4C 12 5F 80 69 46 AE E6 A5 4E 97 A1 D8 C1 B9 ED |
Certificate: VeriSign Class 3 Code Signing 2010 CA
»
Issued by | VeriSign Class 3 Code Signing 2010 CA |
Country Name | US |
Valid From | 2010-02-08 00:00:00+00:00 |
Valid Until | 2020-02-07 23:59:59+00:00 |
Algorithm | sha1_rsa |
Serial Number | 52 00 E5 AA 25 56 FC 1A 86 ED 96 C9 D4 4B 33 C7 |
Thumbprint | 49 58 47 A9 31 87 CF B8 C7 1F 84 0C B7 B4 14 97 AD 95 C6 4F |
File Reputation Information
»
Severity |
Whitelisted
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x41f7cb |
Size Of Code | 0x32e00 |
Size Of Initialized Data | 0x47200 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2013-07-02 16:16:09+00:00 |
Version Information (10)
»
CompanyName | Oracle Corporation |
FileDescription | Java(TM) Update Checker |
FileVersion | 2.1.9.8 |
Full Version | 2.1.9.8 |
InternalName | Java(TM) Update Checker |
LegalCopyright | Copyright (C) 2012 |
OLESelfRegister | - |
OriginalFilename | jucheck.exe |
ProductName | Java(TM) Platform SE Auto Updater |
ProductVersion | 2.1.9.8 |
Sections (4)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x32dd3 | 0x32e00 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.6 |
.rdata | 0x434000 | 0xf3dc | 0xf400 | 0x33200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.25 |
.data | 0x444000 | 0x53a4 | 0x2e00 | 0x42600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.72 |
.rsrc | 0x44a000 | 0x34ecc | 0x35000 | 0x45400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.68 |
Imports (13)
»
ADVAPI32.dll (19)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegOpenKeyExA | 0x0 | 0x434000 | 0x4195c | 0x40b5c | 0x260 |
RegCreateKeyExA | 0x0 | 0x434004 | 0x41960 | 0x40b60 | 0x238 |
RegDeleteKeyA | 0x0 | 0x434008 | 0x41964 | 0x40b64 | 0x23d |
RegDeleteValueA | 0x0 | 0x43400c | 0x41968 | 0x40b68 | 0x247 |
RegCloseKey | 0x0 | 0x434010 | 0x4196c | 0x40b6c | 0x230 |
RegSetValueExA | 0x0 | 0x434014 | 0x41970 | 0x40b70 | 0x27d |
RegQueryInfoKeyW | 0x0 | 0x434018 | 0x41974 | 0x40b74 | 0x268 |
RegEnumKeyExA | 0x0 | 0x43401c | 0x41978 | 0x40b78 | 0x24e |
RegQueryValueExA | 0x0 | 0x434020 | 0x4197c | 0x40b7c | 0x26d |
SetSecurityDescriptorDacl | 0x0 | 0x434024 | 0x41980 | 0x40b80 | 0x2b6 |
InitializeSecurityDescriptor | 0x0 | 0x434028 | 0x41984 | 0x40b84 | 0x177 |
CryptDestroyHash | 0x0 | 0x43402c | 0x41988 | 0x40b88 | 0xb6 |
CryptGetHashParam | 0x0 | 0x434030 | 0x4198c | 0x40b8c | 0xc4 |
CryptHashData | 0x0 | 0x434034 | 0x41990 | 0x40b90 | 0xc8 |
CryptReleaseContext | 0x0 | 0x434038 | 0x41994 | 0x40b94 | 0xcb |
CryptCreateHash | 0x0 | 0x43403c | 0x41998 | 0x40b98 | 0xb3 |
CryptAcquireContextA | 0x0 | 0x434040 | 0x4199c | 0x40b9c | 0xb0 |
RegEnumKeyA | 0x0 | 0x434044 | 0x419a0 | 0x40ba0 | 0x24d |
RegQueryInfoKeyA | 0x0 | 0x434048 | 0x419a4 | 0x40ba4 | 0x267 |
CRYPT32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CertGetNameStringW | 0x0 | 0x434058 | 0x419b4 | 0x40bb4 | 0x4b |
CertFindCertificateInStore | 0x0 | 0x43405c | 0x419b8 | 0x40bb8 | 0x35 |
CryptMsgGetParam | 0x0 | 0x434060 | 0x419bc | 0x40bbc | 0xb6 |
CryptQueryObject | 0x0 | 0x434064 | 0x419c0 | 0x40bc0 | 0xbf |
CryptMsgClose | 0x0 | 0x434068 | 0x419c4 | 0x40bc4 | 0xaf |
CertCloseStore | 0x0 | 0x43406c | 0x419c8 | 0x40bc8 | 0x12 |
VERSION.dll (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
VerQueryValueA | 0x0 | 0x434464 | 0x41dc0 | 0x40fc0 | 0xd |
GetFileVersionInfoA | 0x0 | 0x434468 | 0x41dc4 | 0x40fc4 | 0x0 |
USER32.dll (75)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ScreenToClient | 0x0 | 0x434334 | 0x41c90 | 0x40e90 | 0x26d |
GetDC | 0x0 | 0x434338 | 0x41c94 | 0x40e94 | 0x121 |
ReleaseDC | 0x0 | 0x43433c | 0x41c98 | 0x40e98 | 0x265 |
InvalidateRect | 0x0 | 0x434340 | 0x41c9c | 0x40e9c | 0x1be |
InvalidateRgn | 0x0 | 0x434344 | 0x41ca0 | 0x40ea0 | 0x1bf |
RedrawWindow | 0x0 | 0x434348 | 0x41ca4 | 0x40ea4 | 0x24a |
SetCapture | 0x0 | 0x43434c | 0x41ca8 | 0x40ea8 | 0x280 |
MapDialogRect | 0x0 | 0x434350 | 0x41cac | 0x40eac | 0x204 |
SetWindowContextHelpId | 0x0 | 0x434354 | 0x41cb0 | 0x40eb0 | 0x2c1 |
GetDlgCtrlID | 0x0 | 0x434358 | 0x41cb4 | 0x40eb4 | 0x126 |
LoadBitmapA | 0x0 | 0x43435c | 0x41cb8 | 0x40eb8 | 0x1e6 |
EndDialog | 0x0 | 0x434360 | 0x41cbc | 0x40ebc | 0xda |
GetWindowRect | 0x0 | 0x434364 | 0x41cc0 | 0x40ec0 | 0x19c |
PtInRect | 0x0 | 0x434368 | 0x41cc4 | 0x40ec4 | 0x240 |
SetCursor | 0x0 | 0x43436c | 0x41cc8 | 0x40ec8 | 0x288 |
EnableWindow | 0x0 | 0x434370 | 0x41ccc | 0x40ecc | 0xd8 |
RegisterClassA | 0x0 | 0x434374 | 0x41cd0 | 0x40ed0 | 0x24b |
ShowWindow | 0x0 | 0x434378 | 0x41cd4 | 0x40ed4 | 0x2df |
PostQuitMessage | 0x0 | 0x43437c | 0x41cd8 | 0x40ed8 | 0x237 |
CreatePopupMenu | 0x0 | 0x434380 | 0x41cdc | 0x40edc | 0x6b |
AppendMenuA | 0x0 | 0x434384 | 0x41ce0 | 0x40ee0 | 0x9 |
GetCursorPos | 0x0 | 0x434388 | 0x41ce4 | 0x40ee4 | 0x120 |
SetForegroundWindow | 0x0 | 0x43438c | 0x41ce8 | 0x40ee8 | 0x293 |
TrackPopupMenu | 0x0 | 0x434390 | 0x41cec | 0x40eec | 0x2f6 |
PostMessageA | 0x0 | 0x434394 | 0x41cf0 | 0x40ef0 | 0x235 |
GetSystemMetrics | 0x0 | 0x434398 | 0x41cf4 | 0x40ef4 | 0x17e |
ClientToScreen | 0x0 | 0x43439c | 0x41cf8 | 0x40ef8 | 0x47 |
DialogBoxIndirectParamA | 0x0 | 0x4343a0 | 0x41cfc | 0x40efc | 0xa8 |
RegisterWindowMessageA | 0x0 | 0x4343a4 | 0x41d00 | 0x40f00 | 0x262 |
GetWindowTextLengthA | 0x0 | 0x4343a8 | 0x41d04 | 0x40f04 | 0x1a1 |
IsChild | 0x0 | 0x4343ac | 0x41d08 | 0x40f08 | 0x1c9 |
wsprintfA | 0x0 | 0x4343b0 | 0x41d0c | 0x40f0c | 0x332 |
PeekMessageA | 0x0 | 0x4343b4 | 0x41d10 | 0x40f10 | 0x232 |
DispatchMessageA | 0x0 | 0x4343b8 | 0x41d14 | 0x40f14 | 0xae |
DispatchMessageW | 0x0 | 0x4343bc | 0x41d18 | 0x40f18 | 0xaf |
TranslateMessage | 0x0 | 0x4343c0 | 0x41d1c | 0x40f1c | 0x2fc |
GetMessageA | 0x0 | 0x4343c4 | 0x41d20 | 0x40f20 | 0x159 |
GetMessageW | 0x0 | 0x4343c8 | 0x41d24 | 0x40f24 | 0x15d |
IsWindowUnicode | 0x0 | 0x4343cc | 0x41d28 | 0x40f28 | 0x1df |
MsgWaitForMultipleObjectsEx | 0x0 | 0x4343d0 | 0x41d2c | 0x40f2c | 0x21d |
SetWindowLongA | 0x0 | 0x4343d4 | 0x41d30 | 0x40f30 | 0x2c3 |
GetWindowLongA | 0x0 | 0x4343d8 | 0x41d34 | 0x40f34 | 0x195 |
GetDesktopWindow | 0x0 | 0x4343dc | 0x41d38 | 0x40f38 | 0x123 |
MessageBoxA | 0x0 | 0x4343e0 | 0x41d3c | 0x40f3c | 0x20e |
LoadStringA | 0x0 | 0x4343e4 | 0x41d40 | 0x40f40 | 0x1f9 |
DefWindowProcA | 0x0 | 0x4343e8 | 0x41d44 | 0x40f44 | 0x9b |
GetSysColor | 0x0 | 0x4343ec | 0x41d48 | 0x40f48 | 0x17b |
GetParent | 0x0 | 0x4343f0 | 0x41d4c | 0x40f4c | 0x164 |
GetDlgItem | 0x0 | 0x4343f4 | 0x41d50 | 0x40f50 | 0x127 |
GetClassNameA | 0x0 | 0x4343f8 | 0x41d54 | 0x40f54 | 0x111 |
ReleaseCapture | 0x0 | 0x4343fc | 0x41d58 | 0x40f58 | 0x264 |
FillRect | 0x0 | 0x434400 | 0x41d5c | 0x40f5c | 0xf6 |
DestroyWindow | 0x0 | 0x434404 | 0x41d60 | 0x40f60 | 0xa6 |
CharNextA | 0x0 | 0x434408 | 0x41d64 | 0x40f64 | 0x2f |
CallWindowProcA | 0x0 | 0x43440c | 0x41d68 | 0x40f68 | 0x1d |
GetClientRect | 0x0 | 0x434410 | 0x41d6c | 0x40f6c | 0x114 |
SetWindowPos | 0x0 | 0x434414 | 0x41d70 | 0x40f70 | 0x2c6 |
LoadImageA | 0x0 | 0x434418 | 0x41d74 | 0x40f74 | 0x1ee |
UnregisterClassA | 0x0 | 0x43441c | 0x41d78 | 0x40f78 | 0x305 |
GetWindowTextA | 0x0 | 0x434420 | 0x41d7c | 0x40f7c | 0x1a0 |
SetWindowTextA | 0x0 | 0x434424 | 0x41d80 | 0x40f80 | 0x2ca |
CreateAcceleratorTableA | 0x0 | 0x434428 | 0x41d84 | 0x40f84 | 0x57 |
CreateWindowExA | 0x0 | 0x43442c | 0x41d88 | 0x40f88 | 0x6d |
RegisterClassExA | 0x0 | 0x434430 | 0x41d8c | 0x40f8c | 0x24c |
LoadCursorA | 0x0 | 0x434434 | 0x41d90 | 0x40f90 | 0x1e8 |
GetClassInfoExA | 0x0 | 0x434438 | 0x41d94 | 0x40f94 | 0x10c |
IsWindow | 0x0 | 0x43443c | 0x41d98 | 0x40f98 | 0x1db |
SendMessageA | 0x0 | 0x434440 | 0x41d9c | 0x40f9c | 0x277 |
GetFocus | 0x0 | 0x434444 | 0x41da0 | 0x40fa0 | 0x12c |
GetWindow | 0x0 | 0x434448 | 0x41da4 | 0x40fa4 | 0x18e |
SetFocus | 0x0 | 0x43444c | 0x41da8 | 0x40fa8 | 0x292 |
DestroyAcceleratorTable | 0x0 | 0x434450 | 0x41dac | 0x40fac | 0xa0 |
BeginPaint | 0x0 | 0x434454 | 0x41db0 | 0x40fb0 | 0xe |
EndPaint | 0x0 | 0x434458 | 0x41db4 | 0x40fb4 | 0xdc |
MoveWindow | 0x0 | 0x43445c | 0x41db8 | 0x40fb8 | 0x21b |
GDI32.dll (21)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
StretchBlt | 0x0 | 0x434074 | 0x419d0 | 0x40bd0 | 0x2b3 |
SetTextColor | 0x0 | 0x434078 | 0x419d4 | 0x40bd4 | 0x2a6 |
SaveDC | 0x0 | 0x43407c | 0x419d8 | 0x40bd8 | 0x270 |
SetGraphicsMode | 0x0 | 0x434080 | 0x419dc | 0x40bdc | 0x28d |
ModifyWorldTransform | 0x0 | 0x434084 | 0x419e0 | 0x40be0 | 0x239 |
SetViewportOrgEx | 0x0 | 0x434088 | 0x419e4 | 0x40be4 | 0x2a9 |
SetWindowOrgEx | 0x0 | 0x43408c | 0x419e8 | 0x40be8 | 0x2ad |
DPtoLP | 0x0 | 0x434090 | 0x419ec | 0x40bec | 0xa4 |
CreateFontIndirectA | 0x0 | 0x434094 | 0x419f0 | 0x40bf0 | 0x3d |
RestoreDC | 0x0 | 0x434098 | 0x419f4 | 0x40bf4 | 0x269 |
GetStockObject | 0x0 | 0x43409c | 0x419f8 | 0x40bf8 | 0x20d |
GetObjectA | 0x0 | 0x4340a0 | 0x419fc | 0x40bfc | 0x1fb |
CreateSolidBrush | 0x0 | 0x4340a4 | 0x41a00 | 0x40c00 | 0x54 |
GetDeviceCaps | 0x0 | 0x4340a8 | 0x41a04 | 0x40c04 | 0x1cb |
BitBlt | 0x0 | 0x4340ac | 0x41a08 | 0x40c08 | 0x13 |
CreateCompatibleDC | 0x0 | 0x4340b0 | 0x41a0c | 0x40c0c | 0x30 |
CreateCompatibleBitmap | 0x0 | 0x4340b4 | 0x41a10 | 0x40c10 | 0x2f |
SelectObject | 0x0 | 0x4340b8 | 0x41a14 | 0x40c14 | 0x277 |
DeleteObject | 0x0 | 0x4340bc | 0x41a18 | 0x40c18 | 0xe6 |
DeleteDC | 0x0 | 0x4340c0 | 0x41a1c | 0x40c1c | 0xe3 |
SetBkMode | 0x0 | 0x4340c4 | 0x41a20 | 0x40c20 | 0x27f |
COMCTL32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
(by ordinal) | 0x11 | 0x434050 | 0x419ac | 0x40bac | - |
WINTRUST.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
WinVerifyTrust | 0x0 | 0x4344ac | 0x41e08 | 0x41008 | 0x73 |
WININET.dll (14)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
InternetOpenA | 0x0 | 0x434470 | 0x41dcc | 0x40fcc | 0x97 |
InternetCrackUrlA | 0x0 | 0x434474 | 0x41dd0 | 0x40fd0 | 0x73 |
InternetConnectA | 0x0 | 0x434478 | 0x41dd4 | 0x40fd4 | 0x71 |
InternetGetConnectedState | 0x0 | 0x43447c | 0x41dd8 | 0x40fd8 | 0x82 |
InternetQueryDataAvailable | 0x0 | 0x434480 | 0x41ddc | 0x40fdc | 0x9b |
InternetCloseHandle | 0x0 | 0x434484 | 0x41de0 | 0x40fe0 | 0x6b |
InternetReadFile | 0x0 | 0x434488 | 0x41de4 | 0x40fe4 | 0x9f |
InternetTimeToSystemTime | 0x0 | 0x43448c | 0x41de8 | 0x40fe8 | 0xbb |
HttpQueryInfoA | 0x0 | 0x434490 | 0x41dec | 0x40fec | 0x59 |
InternetErrorDlg | 0x0 | 0x434494 | 0x41df0 | 0x40ff0 | 0x7c |
HttpSendRequestA | 0x0 | 0x434498 | 0x41df4 | 0x40ff4 | 0x5b |
HttpAddRequestHeadersA | 0x0 | 0x43449c | 0x41df8 | 0x40ff8 | 0x52 |
InternetTimeFromSystemTime | 0x0 | 0x4344a0 | 0x41dfc | 0x40ffc | 0xb8 |
HttpOpenRequestA | 0x0 | 0x4344a4 | 0x41e00 | 0x41000 | 0x57 |
urlmon.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
URLDownloadToFileA | 0x0 | 0x4344f8 | 0x41e54 | 0x41054 | 0x67 |
SHELL32.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
Shell_NotifyIconA | 0x0 | 0x434324 | 0x41c80 | 0x40e80 | 0x12c |
SHGetFolderPathA | 0x0 | 0x434328 | 0x41c84 | 0x40e84 | 0xbf |
ShellExecuteA | 0x0 | 0x43432c | 0x41c88 | 0x40e88 | 0x11e |
KERNEL32.dll (138)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetOEMCP | 0x0 | 0x4340cc | 0x41a28 | 0x40c28 | 0x237 |
GetACP | 0x0 | 0x4340d0 | 0x41a2c | 0x40c2c | 0x168 |
GetCPInfo | 0x0 | 0x4340d4 | 0x41a30 | 0x40c30 | 0x172 |
GetLocaleInfoW | 0x0 | 0x4340d8 | 0x41a34 | 0x40c34 | 0x206 |
HeapSize | 0x0 | 0x4340dc | 0x41a38 | 0x40c38 | 0x2d4 |
HeapReAlloc | 0x0 | 0x4340e0 | 0x41a3c | 0x40c3c | 0x2d2 |
GetModuleFileNameW | 0x0 | 0x4340e4 | 0x41a40 | 0x40c40 | 0x214 |
GetStdHandle | 0x0 | 0x4340e8 | 0x41a44 | 0x40c44 | 0x264 |
HeapCreate | 0x0 | 0x4340ec | 0x41a48 | 0x40c48 | 0x2cd |
TlsFree | 0x0 | 0x4340f0 | 0x41a4c | 0x40c4c | 0x4c6 |
TlsSetValue | 0x0 | 0x4340f4 | 0x41a50 | 0x40c50 | 0x4c8 |
CompareStringW | 0x0 | 0x4340f8 | 0x41a54 | 0x40c54 | 0x64 |
TlsAlloc | 0x0 | 0x4340fc | 0x41a58 | 0x40c58 | 0x4c5 |
GetTimeZoneInformation | 0x0 | 0x434100 | 0x41a5c | 0x40c5c | 0x298 |
TerminateProcess | 0x0 | 0x434104 | 0x41a60 | 0x40c60 | 0x4c0 |
IsDebuggerPresent | 0x0 | 0x434108 | 0x41a64 | 0x40c64 | 0x300 |
SetUnhandledExceptionFilter | 0x0 | 0x43410c | 0x41a68 | 0x40c68 | 0x4a5 |
UnhandledExceptionFilter | 0x0 | 0x434110 | 0x41a6c | 0x40c6c | 0x4d3 |
GetStartupInfoW | 0x0 | 0x434114 | 0x41a70 | 0x40c70 | 0x263 |
HeapSetInformation | 0x0 | 0x434118 | 0x41a74 | 0x40c74 | 0x2d3 |
ExitProcess | 0x0 | 0x43411c | 0x41a78 | 0x40c78 | 0x119 |
EncodePointer | 0x0 | 0x434120 | 0x41a7c | 0x40c7c | 0xea |
SetEnvironmentVariableA | 0x0 | 0x434124 | 0x41a80 | 0x40c80 | 0x456 |
VirtualQuery | 0x0 | 0x434128 | 0x41a84 | 0x40c84 | 0x4f1 |
IsValidCodePage | 0x0 | 0x43412c | 0x41a88 | 0x40c88 | 0x30a |
VirtualProtect | 0x0 | 0x434130 | 0x41a8c | 0x40c8c | 0x4ef |
RtlUnwind | 0x0 | 0x434134 | 0x41a90 | 0x40c90 | 0x418 |
GetSystemTimeAsFileTime | 0x0 | 0x434138 | 0x41a94 | 0x40c94 | 0x279 |
InterlockedPopEntrySList | 0x0 | 0x43413c | 0x41a98 | 0x40c98 | 0x2f0 |
VirtualAlloc | 0x0 | 0x434140 | 0x41a9c | 0x40c9c | 0x4e9 |
VirtualFree | 0x0 | 0x434144 | 0x41aa0 | 0x40ca0 | 0x4ec |
IsProcessorFeaturePresent | 0x0 | 0x434148 | 0x41aa4 | 0x40ca4 | 0x304 |
HeapAlloc | 0x0 | 0x43414c | 0x41aa8 | 0x40ca8 | 0x2cb |
GetProcessHeap | 0x0 | 0x434150 | 0x41aac | 0x40cac | 0x24a |
HeapFree | 0x0 | 0x434154 | 0x41ab0 | 0x40cb0 | 0x2cf |
InterlockedPushEntrySList | 0x0 | 0x434158 | 0x41ab4 | 0x40cb4 | 0x2f1 |
InterlockedCompareExchange | 0x0 | 0x43415c | 0x41ab8 | 0x40cb8 | 0x2e9 |
GetCurrentProcessId | 0x0 | 0x434160 | 0x41abc | 0x40cbc | 0x1c1 |
GetTickCount | 0x0 | 0x434164 | 0x41ac0 | 0x40cc0 | 0x293 |
SystemTimeToTzSpecificLocalTime | 0x0 | 0x434168 | 0x41ac4 | 0x40cc4 | 0x4be |
LocalFree | 0x0 | 0x43416c | 0x41ac8 | 0x40cc8 | 0x348 |
GetSystemInfo | 0x0 | 0x434170 | 0x41acc | 0x40ccc | 0x273 |
GetVersionExA | 0x0 | 0x434174 | 0x41ad0 | 0x40cd0 | 0x2a3 |
GetThreadLocale | 0x0 | 0x434178 | 0x41ad4 | 0x40cd4 | 0x28c |
FindResourceW | 0x0 | 0x43417c | 0x41ad8 | 0x40cd8 | 0x14e |
GetSystemTime | 0x0 | 0x434180 | 0x41adc | 0x40cdc | 0x277 |
OpenEventA | 0x0 | 0x434184 | 0x41ae0 | 0x40ce0 | 0x374 |
CreatePipe | 0x0 | 0x434188 | 0x41ae4 | 0x40ce4 | 0xa1 |
SetHandleInformation | 0x0 | 0x43418c | 0x41ae8 | 0x40ce8 | 0x470 |
ReadFile | 0x0 | 0x434190 | 0x41aec | 0x40cec | 0x3c0 |
LoadLibraryExA | 0x0 | 0x434194 | 0x41af0 | 0x40cf0 | 0x33d |
SetHandleCount | 0x0 | 0x434198 | 0x41af4 | 0x40cf4 | 0x46f |
GetFileType | 0x0 | 0x43419c | 0x41af8 | 0x40cf8 | 0x1f3 |
GetConsoleCP | 0x0 | 0x4341a0 | 0x41afc | 0x40cfc | 0x19a |
GetConsoleMode | 0x0 | 0x4341a4 | 0x41b00 | 0x40d00 | 0x1ac |
FlushFileBuffers | 0x0 | 0x4341a8 | 0x41b04 | 0x40d04 | 0x157 |
InterlockedExchange | 0x0 | 0x4341ac | 0x41b08 | 0x40d08 | 0x2ec |
LoadLibraryW | 0x0 | 0x4341b0 | 0x41b0c | 0x40d0c | 0x33f |
GetStringTypeW | 0x0 | 0x4341b4 | 0x41b10 | 0x40d10 | 0x269 |
FreeEnvironmentStringsW | 0x0 | 0x4341b8 | 0x41b14 | 0x40d14 | 0x161 |
GetEnvironmentStringsW | 0x0 | 0x4341bc | 0x41b18 | 0x40d18 | 0x1da |
QueryPerformanceCounter | 0x0 | 0x4341c0 | 0x41b1c | 0x40d1c | 0x3a7 |
LCMapStringW | 0x0 | 0x4341c4 | 0x41b20 | 0x40d20 | 0x32d |
WriteConsoleW | 0x0 | 0x4341c8 | 0x41b24 | 0x40d24 | 0x524 |
SetStdHandle | 0x0 | 0x4341cc | 0x41b28 | 0x40d28 | 0x487 |
GetUserDefaultLCID | 0x0 | 0x4341d0 | 0x41b2c | 0x40d2c | 0x29b |
GetLocaleInfoA | 0x0 | 0x4341d4 | 0x41b30 | 0x40d30 | 0x204 |
EnumSystemLocalesA | 0x0 | 0x4341d8 | 0x41b34 | 0x40d34 | 0x10d |
IsValidLocale | 0x0 | 0x4341dc | 0x41b38 | 0x40d38 | 0x30c |
GetModuleHandleW | 0x0 | 0x4341e0 | 0x41b3c | 0x40d3c | 0x218 |
CreateFileW | 0x0 | 0x4341e4 | 0x41b40 | 0x40d40 | 0x8f |
DecodePointer | 0x0 | 0x4341e8 | 0x41b44 | 0x40d44 | 0xca |
TlsGetValue | 0x0 | 0x4341ec | 0x41b48 | 0x40d48 | 0x4c7 |
SizeofResource | 0x0 | 0x4341f0 | 0x41b4c | 0x40d4c | 0x4b1 |
FreeLibrary | 0x0 | 0x4341f4 | 0x41b50 | 0x40d50 | 0x162 |
IsDBCSLeadByte | 0x0 | 0x4341f8 | 0x41b54 | 0x40d54 | 0x2fe |
GetCommandLineA | 0x0 | 0x4341fc | 0x41b58 | 0x40d58 | 0x186 |
CreateMutexA | 0x0 | 0x434200 | 0x41b5c | 0x40d5c | 0x9b |
InterlockedDecrement | 0x0 | 0x434204 | 0x41b60 | 0x40d60 | 0x2eb |
InterlockedIncrement | 0x0 | 0x434208 | 0x41b64 | 0x40d64 | 0x2ef |
GetModuleHandleA | 0x0 | 0x43420c | 0x41b68 | 0x40d68 | 0x215 |
GetProcAddress | 0x0 | 0x434210 | 0x41b6c | 0x40d6c | 0x245 |
DeleteCriticalSection | 0x0 | 0x434214 | 0x41b70 | 0x40d70 | 0xd1 |
InitializeCriticalSectionAndSpinCount | 0x0 | 0x434218 | 0x41b74 | 0x40d74 | 0x2e3 |
lstrcpynA | 0x0 | 0x43421c | 0x41b78 | 0x40d78 | 0x54a |
CreateEventA | 0x0 | 0x434220 | 0x41b7c | 0x40d7c | 0x82 |
CreateThread | 0x0 | 0x434224 | 0x41b80 | 0x40d80 | 0xb5 |
ResetEvent | 0x0 | 0x434228 | 0x41b84 | 0x40d84 | 0x40f |
WaitForMultipleObjects | 0x0 | 0x43422c | 0x41b88 | 0x40d88 | 0x4f7 |
SetEvent | 0x0 | 0x434230 | 0x41b8c | 0x40d8c | 0x459 |
LoadResource | 0x0 | 0x434234 | 0x41b90 | 0x40d90 | 0x341 |
LockResource | 0x0 | 0x434238 | 0x41b94 | 0x40d94 | 0x354 |
GlobalHandle | 0x0 | 0x43423c | 0x41b98 | 0x40d98 | 0x2bd |
GlobalFree | 0x0 | 0x434240 | 0x41b9c | 0x40d9c | 0x2ba |
GlobalLock | 0x0 | 0x434244 | 0x41ba0 | 0x40da0 | 0x2be |
GlobalUnlock | 0x0 | 0x434248 | 0x41ba4 | 0x40da4 | 0x2c5 |
CloseHandle | 0x0 | 0x43424c | 0x41ba8 | 0x40da8 | 0x52 |
WriteFile | 0x0 | 0x434250 | 0x41bac | 0x40dac | 0x525 |
lstrlenA | 0x0 | 0x434254 | 0x41bb0 | 0x40db0 | 0x54d |
SetFilePointer | 0x0 | 0x434258 | 0x41bb4 | 0x40db4 | 0x466 |
CreateFileA | 0x0 | 0x43425c | 0x41bb8 | 0x40db8 | 0x88 |
GetTempPathA | 0x0 | 0x434260 | 0x41bbc | 0x40dbc | 0x284 |
lstrcatA | 0x0 | 0x434264 | 0x41bc0 | 0x40dc0 | 0x53e |
GetEnvironmentVariableA | 0x0 | 0x434268 | 0x41bc4 | 0x40dc4 | 0x1db |
LoadLibraryA | 0x0 | 0x43426c | 0x41bc8 | 0x40dc8 | 0x33c |
GetLastError | 0x0 | 0x434270 | 0x41bcc | 0x40dcc | 0x202 |
GetSystemDirectoryA | 0x0 | 0x434274 | 0x41bd0 | 0x40dd0 | 0x26f |
SetDllDirectoryA | 0x0 | 0x434278 | 0x41bd4 | 0x40dd4 | 0x450 |
SetLastError | 0x0 | 0x43427c | 0x41bd8 | 0x40dd8 | 0x473 |
CreateProcessA | 0x0 | 0x434280 | 0x41bdc | 0x40ddc | 0xa4 |
MultiByteToWideChar | 0x0 | 0x434284 | 0x41be0 | 0x40de0 | 0x367 |
WideCharToMultiByte | 0x0 | 0x434288 | 0x41be4 | 0x40de4 | 0x511 |
lstrcpyA | 0x0 | 0x43428c | 0x41be8 | 0x40de8 | 0x547 |
lstrlenW | 0x0 | 0x434290 | 0x41bec | 0x40dec | 0x54e |
WaitForSingleObject | 0x0 | 0x434294 | 0x41bf0 | 0x40df0 | 0x4f9 |
RaiseException | 0x0 | 0x434298 | 0x41bf4 | 0x40df4 | 0x3b1 |
EnterCriticalSection | 0x0 | 0x43429c | 0x41bf8 | 0x40df8 | 0xee |
LeaveCriticalSection | 0x0 | 0x4342a0 | 0x41bfc | 0x40dfc | 0x339 |
FlushInstructionCache | 0x0 | 0x4342a4 | 0x41c00 | 0x40e00 | 0x158 |
GetCurrentProcess | 0x0 | 0x4342a8 | 0x41c04 | 0x40e04 | 0x1c0 |
GlobalAlloc | 0x0 | 0x4342ac | 0x41c08 | 0x40e08 | 0x2b3 |
FindResourceA | 0x0 | 0x4342b0 | 0x41c0c | 0x40e0c | 0x14b |
lstrcmpA | 0x0 | 0x4342b4 | 0x41c10 | 0x40e10 | 0x541 |
SetEndOfFile | 0x0 | 0x4342b8 | 0x41c14 | 0x40e14 | 0x453 |
CompareFileTime | 0x0 | 0x4342bc | 0x41c18 | 0x40e18 | 0x60 |
SystemTimeToFileTime | 0x0 | 0x4342c0 | 0x41c1c | 0x40e1c | 0x4bd |
Sleep | 0x0 | 0x4342c4 | 0x41c20 | 0x40e20 | 0x4b2 |
FileTimeToSystemTime | 0x0 | 0x4342c8 | 0x41c24 | 0x40e24 | 0x125 |
GetFileTime | 0x0 | 0x4342cc | 0x41c28 | 0x40e28 | 0x1f2 |
GetFileSize | 0x0 | 0x4342d0 | 0x41c2c | 0x40e2c | 0x1f0 |
GetExitCodeProcess | 0x0 | 0x4342d4 | 0x41c30 | 0x40e30 | 0x1df |
FormatMessageA | 0x0 | 0x4342d8 | 0x41c34 | 0x40e34 | 0x15d |
lstrcmpiA | 0x0 | 0x4342dc | 0x41c38 | 0x40e38 | 0x544 |
DeleteFileA | 0x0 | 0x4342e0 | 0x41c3c | 0x40e3c | 0xd3 |
GetCurrentThreadId | 0x0 | 0x4342e4 | 0x41c40 | 0x40e40 | 0x1c5 |
MulDiv | 0x0 | 0x4342e8 | 0x41c44 | 0x40e44 | 0x366 |
GetModuleFileNameA | 0x0 | 0x4342ec | 0x41c48 | 0x40e48 | 0x213 |
InitializeCriticalSection | 0x0 | 0x4342f0 | 0x41c4c | 0x40e4c | 0x2e2 |
ole32.dll (16)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
StringFromCLSID | 0x0 | 0x4344b4 | 0x41e10 | 0x41010 | 0x178 |
CoInitialize | 0x0 | 0x4344b8 | 0x41e14 | 0x41014 | 0x3e |
CoUninitialize | 0x0 | 0x4344bc | 0x41e18 | 0x41018 | 0x6c |
CoTaskMemRealloc | 0x0 | 0x4344c0 | 0x41e1c | 0x4101c | 0x69 |
OleUninitialize | 0x0 | 0x4344c4 | 0x41e20 | 0x41020 | 0x149 |
OleInitialize | 0x0 | 0x4344c8 | 0x41e24 | 0x41024 | 0x132 |
CreateStreamOnHGlobal | 0x0 | 0x4344cc | 0x41e28 | 0x41028 | 0x86 |
CLSIDFromProgID | 0x0 | 0x4344d0 | 0x41e2c | 0x4102c | 0x6 |
CoGetClassObject | 0x0 | 0x4344d4 | 0x41e30 | 0x41030 | 0x26 |
CoTaskMemAlloc | 0x0 | 0x4344d8 | 0x41e34 | 0x41034 | 0x67 |
OleLockRunning | 0x0 | 0x4344dc | 0x41e38 | 0x41038 | 0x138 |
StringFromGUID2 | 0x0 | 0x4344e0 | 0x41e3c | 0x4103c | 0x179 |
CoInitializeSecurity | 0x0 | 0x4344e4 | 0x41e40 | 0x41040 | 0x40 |
CoCreateInstance | 0x0 | 0x4344e8 | 0x41e44 | 0x41044 | 0x10 |
CoTaskMemFree | 0x0 | 0x4344ec | 0x41e48 | 0x41048 | 0x68 |
CLSIDFromString | 0x0 | 0x4344f0 | 0x41e4c | 0x4104c | 0x8 |
OLEAUT32.dll (10)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
VarUI4FromStr | 0x115 | 0x4342f8 | 0x41c54 | 0x40e54 | - |
LoadTypeLib | 0xa1 | 0x4342fc | 0x41c58 | 0x40e58 | - |
LoadRegTypeLib | 0xa2 | 0x434300 | 0x41c5c | 0x40e5c | - |
OleCreateFontIndirect | 0x1a4 | 0x434304 | 0x41c60 | 0x40e60 | - |
VariantClear | 0x9 | 0x434308 | 0x41c64 | 0x40e64 | - |
VariantInit | 0x8 | 0x43430c | 0x41c68 | 0x40e68 | - |
SysAllocString | 0x2 | 0x434310 | 0x41c6c | 0x40e6c | - |
SysAllocStringLen | 0x4 | 0x434314 | 0x41c70 | 0x40e70 | - |
SysStringLen | 0x7 | 0x434318 | 0x41c74 | 0x40e74 | - |
SysFreeString | 0x6 | 0x43431c | 0x41c78 | 0x40e78 | - |
Digital Signatures (2)
»
Certificate: Oracle America, Inc.
»
Issued by | Oracle America, Inc. |
Parent Certificate | VeriSign Class 3 Code Signing 2010 CA |
Country Name | US |
Valid From | 2013-06-08 00:00:00+00:00 |
Valid Until | 2016-08-06 23:59:59+00:00 |
Algorithm | sha1_rsa |
Serial Number | 0A 4F 98 7A 76 9E 4A 35 3B 26 87 8A 3B D3 D3 DE |
Thumbprint | 9F 75 A0 B1 4C 12 5F 80 69 46 AE E6 A5 4E 97 A1 D8 C1 B9 ED |
Certificate: VeriSign Class 3 Code Signing 2010 CA
»
Issued by | VeriSign Class 3 Code Signing 2010 CA |
Country Name | US |
Valid From | 2010-02-08 00:00:00+00:00 |
Valid Until | 2020-02-07 23:59:59+00:00 |
Algorithm | sha1_rsa |
Serial Number | 52 00 E5 AA 25 56 FC 1A 86 ED 96 C9 D4 4B 33 C7 |
Thumbprint | 49 58 47 A9 31 87 CF B8 C7 1F 84 0C B7 B4 14 97 AD 95 C6 4F |
File Reputation Information
»
Severity |
Whitelisted
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x41154f |
Size Of Code | 0x26800 |
Size Of Initialized Data | 0x14600 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_cui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2013-07-02 16:16:05+00:00 |
Version Information (8)
»
CompanyName | Oracle Corporation |
FileDescription | Java(TM) Update Client Checker |
FileVersion | 2.1.9.8 |
InternalName | Java(TM) Update Client Checker |
LegalCopyright | Copyright (C) 2012 |
OriginalFilename | jaucheck.exe |
ProductName | Java(TM) Platform SE Auto Updater |
ProductVersion | 2.1.9.8 |
Sections (5)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x267d0 | 0x26800 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65 |
.rdata | 0x428000 | 0x7c7c | 0x7e00 | 0x26c00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.99 |
.data | 0x430000 | 0x3cb8 | 0x1c00 | 0x2ea00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.04 |
.rsrc | 0x434000 | 0x7cb0 | 0x7e00 | 0x30600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.07 |
.reloc | 0x43c000 | 0x2ddc | 0x2e00 | 0x38400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 5.19 |
Imports (9)
»
SHLWAPI.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
PathIsURLA | 0x0 | 0x4281e4 | 0x2f2c0 | 0x2dec0 | 0x72 |
WININET.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
InternetCloseHandle | 0x0 | 0x4281f4 | 0x2f2d0 | 0x2ded0 | 0x6b |
urlmon.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
URLDownloadToFileA | 0x0 | 0x428210 | 0x2f2ec | 0x2deec | 0x67 |
CRYPT32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CertFindCertificateInStore | 0x0 | 0x428038 | 0x2f114 | 0x2dd14 | 0x35 |
CertGetNameStringW | 0x0 | 0x42803c | 0x2f118 | 0x2dd18 | 0x4b |
CertCloseStore | 0x0 | 0x428040 | 0x2f11c | 0x2dd1c | 0x12 |
CryptMsgClose | 0x0 | 0x428044 | 0x2f120 | 0x2dd20 | 0xaf |
CryptQueryObject | 0x0 | 0x428048 | 0x2f124 | 0x2dd24 | 0xbf |
CryptMsgGetParam | 0x0 | 0x42804c | 0x2f128 | 0x2dd28 | 0xb6 |
KERNEL32.dll (97)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
lstrcatA | 0x0 | 0x428054 | 0x2f130 | 0x2dd30 | 0x53e |
CreateFileA | 0x0 | 0x428058 | 0x2f134 | 0x2dd34 | 0x88 |
SetFilePointer | 0x0 | 0x42805c | 0x2f138 | 0x2dd38 | 0x466 |
WriteFile | 0x0 | 0x428060 | 0x2f13c | 0x2dd3c | 0x525 |
lstrlenA | 0x0 | 0x428064 | 0x2f140 | 0x2dd40 | 0x54d |
CloseHandle | 0x0 | 0x428068 | 0x2f144 | 0x2dd44 | 0x52 |
GetTempPathA | 0x0 | 0x42806c | 0x2f148 | 0x2dd48 | 0x284 |
GetEnvironmentVariableA | 0x0 | 0x428070 | 0x2f14c | 0x2dd4c | 0x1db |
SetDllDirectoryA | 0x0 | 0x428074 | 0x2f150 | 0x2dd50 | 0x450 |
SetLastError | 0x0 | 0x428078 | 0x2f154 | 0x2dd54 | 0x473 |
CreateProcessA | 0x0 | 0x42807c | 0x2f158 | 0x2dd58 | 0xa4 |
MultiByteToWideChar | 0x0 | 0x428080 | 0x2f15c | 0x2dd5c | 0x367 |
CreateMutexA | 0x0 | 0x428084 | 0x2f160 | 0x2dd60 | 0x9b |
WideCharToMultiByte | 0x0 | 0x428088 | 0x2f164 | 0x2dd64 | 0x511 |
lstrlenW | 0x0 | 0x42808c | 0x2f168 | 0x2dd68 | 0x54e |
ReadFile | 0x0 | 0x428090 | 0x2f16c | 0x2dd6c | 0x3c0 |
Sleep | 0x0 | 0x428094 | 0x2f170 | 0x2dd70 | 0x4b2 |
lstrcmpA | 0x0 | 0x428098 | 0x2f174 | 0x2dd74 | 0x541 |
SetStdHandle | 0x0 | 0x42809c | 0x2f178 | 0x2dd78 | 0x487 |
WriteConsoleW | 0x0 | 0x4280a0 | 0x2f17c | 0x2dd7c | 0x524 |
LCMapStringW | 0x0 | 0x4280a4 | 0x2f180 | 0x2dd80 | 0x32d |
GetStringTypeW | 0x0 | 0x4280a8 | 0x2f184 | 0x2dd84 | 0x269 |
GetUserDefaultLCID | 0x0 | 0x4280ac | 0x2f188 | 0x2dd88 | 0x29b |
GetLocaleInfoA | 0x0 | 0x4280b0 | 0x2f18c | 0x2dd8c | 0x204 |
EnumSystemLocalesA | 0x0 | 0x4280b4 | 0x2f190 | 0x2dd90 | 0x10d |
IsValidLocale | 0x0 | 0x4280b8 | 0x2f194 | 0x2dd94 | 0x30c |
GetDriveTypeW | 0x0 | 0x4280bc | 0x2f198 | 0x2dd98 | 0x1d3 |
SetEndOfFile | 0x0 | 0x4280c0 | 0x2f19c | 0x2dd9c | 0x453 |
GetProcessHeap | 0x0 | 0x4280c4 | 0x2f1a0 | 0x2dda0 | 0x24a |
CreateFileW | 0x0 | 0x4280c8 | 0x2f1a4 | 0x2dda4 | 0x8f |
CompareStringW | 0x0 | 0x4280cc | 0x2f1a8 | 0x2dda8 | 0x64 |
SetEnvironmentVariableA | 0x0 | 0x4280d0 | 0x2f1ac | 0x2ddac | 0x456 |
InitializeCriticalSection | 0x0 | 0x4280d4 | 0x2f1b0 | 0x2ddb0 | 0x2e2 |
GetLastError | 0x0 | 0x4280d8 | 0x2f1b4 | 0x2ddb4 | 0x202 |
LeaveCriticalSection | 0x0 | 0x4280dc | 0x2f1b8 | 0x2ddb8 | 0x339 |
RtlUnwind | 0x0 | 0x4280e0 | 0x2f1bc | 0x2ddbc | 0x418 |
GetCurrentProcessId | 0x0 | 0x4280e4 | 0x2f1c0 | 0x2ddc0 | 0x1c1 |
GetTickCount | 0x0 | 0x4280e8 | 0x2f1c4 | 0x2ddc4 | 0x293 |
QueryPerformanceCounter | 0x0 | 0x4280ec | 0x2f1c8 | 0x2ddc8 | 0x3a7 |
GetEnvironmentStringsW | 0x0 | 0x4280f0 | 0x2f1cc | 0x2ddcc | 0x1da |
FreeEnvironmentStringsW | 0x0 | 0x4280f4 | 0x2f1d0 | 0x2ddd0 | 0x161 |
GetModuleFileNameA | 0x0 | 0x4280f8 | 0x2f1d4 | 0x2ddd4 | 0x213 |
GetSystemTimeAsFileTime | 0x0 | 0x4280fc | 0x2f1d8 | 0x2ddd8 | 0x279 |
HeapFree | 0x0 | 0x428100 | 0x2f1dc | 0x2dddc | 0x2cf |
EncodePointer | 0x0 | 0x428104 | 0x2f1e0 | 0x2dde0 | 0xea |
DecodePointer | 0x0 | 0x428108 | 0x2f1e4 | 0x2dde4 | 0xca |
GetProcAddress | 0x0 | 0x42810c | 0x2f1e8 | 0x2dde8 | 0x245 |
GetModuleHandleW | 0x0 | 0x428110 | 0x2f1ec | 0x2ddec | 0x218 |
ExitProcess | 0x0 | 0x428114 | 0x2f1f0 | 0x2ddf0 | 0x119 |
EnterCriticalSection | 0x0 | 0x428118 | 0x2f1f4 | 0x2ddf4 | 0xee |
HeapAlloc | 0x0 | 0x42811c | 0x2f1f8 | 0x2ddf8 | 0x2cb |
FindClose | 0x0 | 0x428120 | 0x2f1fc | 0x2ddfc | 0x12e |
FileTimeToSystemTime | 0x0 | 0x428124 | 0x2f200 | 0x2de00 | 0x125 |
FileTimeToLocalFileTime | 0x0 | 0x428128 | 0x2f204 | 0x2de04 | 0x124 |
GetDriveTypeA | 0x0 | 0x42812c | 0x2f208 | 0x2de08 | 0x1d2 |
FindFirstFileExA | 0x0 | 0x428130 | 0x2f20c | 0x2de0c | 0x133 |
GetCommandLineA | 0x0 | 0x428134 | 0x2f210 | 0x2de10 | 0x186 |
HeapSetInformation | 0x0 | 0x428138 | 0x2f214 | 0x2de14 | 0x2d3 |
TerminateProcess | 0x0 | 0x42813c | 0x2f218 | 0x2de18 | 0x4c0 |
GetCurrentProcess | 0x0 | 0x428140 | 0x2f21c | 0x2de1c | 0x1c0 |
UnhandledExceptionFilter | 0x0 | 0x428144 | 0x2f220 | 0x2de20 | 0x4d3 |
SetUnhandledExceptionFilter | 0x0 | 0x428148 | 0x2f224 | 0x2de24 | 0x4a5 |
IsDebuggerPresent | 0x0 | 0x42814c | 0x2f228 | 0x2de28 | 0x300 |
GetTimeZoneInformation | 0x0 | 0x428150 | 0x2f22c | 0x2de2c | 0x298 |
TlsAlloc | 0x0 | 0x428154 | 0x2f230 | 0x2de30 | 0x4c5 |
TlsGetValue | 0x0 | 0x428158 | 0x2f234 | 0x2de34 | 0x4c7 |
TlsSetValue | 0x0 | 0x42815c | 0x2f238 | 0x2de38 | 0x4c8 |
TlsFree | 0x0 | 0x428160 | 0x2f23c | 0x2de3c | 0x4c6 |
InterlockedIncrement | 0x0 | 0x428164 | 0x2f240 | 0x2de40 | 0x2ef |
GetCurrentThreadId | 0x0 | 0x428168 | 0x2f244 | 0x2de44 | 0x1c5 |
InterlockedDecrement | 0x0 | 0x42816c | 0x2f248 | 0x2de48 | 0x2eb |
HeapCreate | 0x0 | 0x428170 | 0x2f24c | 0x2de4c | 0x2cd |
IsProcessorFeaturePresent | 0x0 | 0x428174 | 0x2f250 | 0x2de50 | 0x304 |
RaiseException | 0x0 | 0x428178 | 0x2f254 | 0x2de54 | 0x3b1 |
HeapSize | 0x0 | 0x42817c | 0x2f258 | 0x2de58 | 0x2d4 |
HeapReAlloc | 0x0 | 0x428180 | 0x2f25c | 0x2de5c | 0x2d2 |
SetHandleCount | 0x0 | 0x428184 | 0x2f260 | 0x2de60 | 0x46f |
GetStdHandle | 0x0 | 0x428188 | 0x2f264 | 0x2de64 | 0x264 |
InitializeCriticalSectionAndSpinCount | 0x0 | 0x42818c | 0x2f268 | 0x2de68 | 0x2e3 |
GetFileType | 0x0 | 0x428190 | 0x2f26c | 0x2de6c | 0x1f3 |
GetStartupInfoW | 0x0 | 0x428194 | 0x2f270 | 0x2de70 | 0x263 |
DeleteCriticalSection | 0x0 | 0x428198 | 0x2f274 | 0x2de74 | 0xd1 |
InterlockedExchange | 0x0 | 0x42819c | 0x2f278 | 0x2de78 | 0x2ec |
LoadLibraryW | 0x0 | 0x4281a0 | 0x2f27c | 0x2de7c | 0x33f |
GetLocaleInfoW | 0x0 | 0x4281a4 | 0x2f280 | 0x2de80 | 0x206 |
GetModuleFileNameW | 0x0 | 0x4281a8 | 0x2f284 | 0x2de84 | 0x214 |
GetConsoleCP | 0x0 | 0x4281ac | 0x2f288 | 0x2de88 | 0x19a |
GetConsoleMode | 0x0 | 0x4281b0 | 0x2f28c | 0x2de8c | 0x1ac |
FlushFileBuffers | 0x0 | 0x4281b4 | 0x2f290 | 0x2de90 | 0x157 |
GetCPInfo | 0x0 | 0x4281b8 | 0x2f294 | 0x2de94 | 0x172 |
GetACP | 0x0 | 0x4281bc | 0x2f298 | 0x2de98 | 0x168 |
GetOEMCP | 0x0 | 0x4281c0 | 0x2f29c | 0x2de9c | 0x237 |
IsValidCodePage | 0x0 | 0x4281c4 | 0x2f2a0 | 0x2dea0 | 0x30a |
GetFullPathNameA | 0x0 | 0x4281c8 | 0x2f2a4 | 0x2dea4 | 0x1f8 |
GetFileInformationByHandle | 0x0 | 0x4281cc | 0x2f2a8 | 0x2dea8 | 0x1ec |
PeekNamedPipe | 0x0 | 0x4281d0 | 0x2f2ac | 0x2deac | 0x38d |
GetCurrentDirectoryW | 0x0 | 0x4281d4 | 0x2f2b0 | 0x2deb0 | 0x1bf |
USER32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
wsprintfA | 0x0 | 0x4281ec | 0x2f2c8 | 0x2dec8 | 0x332 |
ADVAPI32.dll (13)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CryptGetHashParam | 0x0 | 0x428000 | 0x2f0dc | 0x2dcdc | 0xc4 |
CryptHashData | 0x0 | 0x428004 | 0x2f0e0 | 0x2dce0 | 0xc8 |
CryptReleaseContext | 0x0 | 0x428008 | 0x2f0e4 | 0x2dce4 | 0xcb |
CryptCreateHash | 0x0 | 0x42800c | 0x2f0e8 | 0x2dce8 | 0xb3 |
CryptAcquireContextA | 0x0 | 0x428010 | 0x2f0ec | 0x2dcec | 0xb0 |
RegSetValueExA | 0x0 | 0x428014 | 0x2f0f0 | 0x2dcf0 | 0x27d |
RegDeleteValueA | 0x0 | 0x428018 | 0x2f0f4 | 0x2dcf4 | 0x247 |
RegQueryValueExA | 0x0 | 0x42801c | 0x2f0f8 | 0x2dcf8 | 0x26d |
RegDeleteKeyA | 0x0 | 0x428020 | 0x2f0fc | 0x2dcfc | 0x23d |
RegCreateKeyExA | 0x0 | 0x428024 | 0x2f100 | 0x2dd00 | 0x238 |
RegCloseKey | 0x0 | 0x428028 | 0x2f104 | 0x2dd04 | 0x230 |
RegOpenKeyExA | 0x0 | 0x42802c | 0x2f108 | 0x2dd08 | 0x260 |
CryptDestroyHash | 0x0 | 0x428030 | 0x2f10c | 0x2dd0c | 0xb6 |
SHELL32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SHGetFolderPathA | 0x0 | 0x4281dc | 0x2f2b8 | 0x2deb8 | 0xbf |
ole32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CoCreateInstance | 0x0 | 0x4281fc | 0x2f2d8 | 0x2ded8 | 0x10 |
CoInitialize | 0x0 | 0x428200 | 0x2f2dc | 0x2dedc | 0x3e |
CoUninitialize | 0x0 | 0x428204 | 0x2f2e0 | 0x2dee0 | 0x6c |
CLSIDFromString | 0x0 | 0x428208 | 0x2f2e4 | 0x2dee4 | 0x8 |
Digital Signatures (2)
»
Certificate: Oracle America, Inc.
»
Issued by | Oracle America, Inc. |
Parent Certificate | VeriSign Class 3 Code Signing 2010 CA |
Country Name | US |
Valid From | 2013-06-08 00:00:00+00:00 |
Valid Until | 2016-08-06 23:59:59+00:00 |
Algorithm | sha1_rsa |
Serial Number | 0A 4F 98 7A 76 9E 4A 35 3B 26 87 8A 3B D3 D3 DE |
Thumbprint | 9F 75 A0 B1 4C 12 5F 80 69 46 AE E6 A5 4E 97 A1 D8 C1 B9 ED |
Certificate: VeriSign Class 3 Code Signing 2010 CA
»
Issued by | VeriSign Class 3 Code Signing 2010 CA |
Country Name | US |
Valid From | 2010-02-08 00:00:00+00:00 |
Valid Until | 2020-02-07 23:59:59+00:00 |
Algorithm | sha1_rsa |
Serial Number | 52 00 E5 AA 25 56 FC 1A 86 ED 96 C9 D4 4B 33 C7 |
Thumbprint | 49 58 47 A9 31 87 CF B8 C7 1F 84 0C B7 B4 14 97 AD 95 C6 4F |
File Reputation Information
»
Severity |
Whitelisted
|
File Reputation Information
»
Severity |
Whitelisted
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x40efa4 |
Size Of Code | 0x24400 |
Size Of Initialized Data | 0x13600 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2013-07-02 16:15:59+00:00 |
Version Information (8)
»
CompanyName | Oracle Corporation |
FileDescription | Java(TM) Update Registration |
FileVersion | 2.1.9.8 |
InternalName | Java(TM) Update Registration |
LegalCopyright | Copyright (C) 2012 |
OriginalFilename | jaureg.exe |
ProductName | Java(TM) Platform SE Auto Updater |
ProductVersion | 2.1.9.8 |
Sections (5)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x242eb | 0x24400 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65 |
.rdata | 0x426000 | 0x6ee6 | 0x7000 | 0x24800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.91 |
.data | 0x42d000 | 0x3c78 | 0x1c00 | 0x2b800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.98 |
.rsrc | 0x431000 | 0x7ca4 | 0x7e00 | 0x2d400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.07 |
.reloc | 0x439000 | 0x2aba | 0x2c00 | 0x35200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 5.05 |
Imports (4)
»
KERNEL32.dll (103)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SetDllDirectoryA | 0x0 | 0x42601c | 0x2c504 | 0x2ad04 | 0x450 |
SetLastError | 0x0 | 0x426020 | 0x2c508 | 0x2ad08 | 0x473 |
CreateProcessA | 0x0 | 0x426024 | 0x2c50c | 0x2ad0c | 0xa4 |
CreateDirectoryA | 0x0 | 0x426028 | 0x2c510 | 0x2ad10 | 0x7c |
GetCommandLineA | 0x0 | 0x42602c | 0x2c514 | 0x2ad14 | 0x186 |
lstrcmpA | 0x0 | 0x426030 | 0x2c518 | 0x2ad18 | 0x541 |
LocalFree | 0x0 | 0x426034 | 0x2c51c | 0x2ad1c | 0x348 |
CreateMutexA | 0x0 | 0x426038 | 0x2c520 | 0x2ad20 | 0x9b |
WaitForSingleObject | 0x0 | 0x42603c | 0x2c524 | 0x2ad24 | 0x4f9 |
GetExitCodeProcess | 0x0 | 0x426040 | 0x2c528 | 0x2ad28 | 0x1df |
GlobalAlloc | 0x0 | 0x426044 | 0x2c52c | 0x2ad2c | 0x2b3 |
InitializeCriticalSection | 0x0 | 0x426048 | 0x2c530 | 0x2ad30 | 0x2e2 |
IsValidLocale | 0x0 | 0x42604c | 0x2c534 | 0x2ad34 | 0x30c |
GetLastError | 0x0 | 0x426050 | 0x2c538 | 0x2ad38 | 0x202 |
GetSystemDirectoryA | 0x0 | 0x426054 | 0x2c53c | 0x2ad3c | 0x26f |
CloseHandle | 0x0 | 0x426058 | 0x2c540 | 0x2ad40 | 0x52 |
lstrlenA | 0x0 | 0x42605c | 0x2c544 | 0x2ad44 | 0x54d |
WriteFile | 0x0 | 0x426060 | 0x2c548 | 0x2ad48 | 0x525 |
SetFilePointer | 0x0 | 0x426064 | 0x2c54c | 0x2ad4c | 0x466 |
CreateFileA | 0x0 | 0x426068 | 0x2c550 | 0x2ad50 | 0x88 |
lstrcatA | 0x0 | 0x42606c | 0x2c554 | 0x2ad54 | 0x53e |
GetTempPathA | 0x0 | 0x426070 | 0x2c558 | 0x2ad58 | 0x284 |
lstrcmpiA | 0x0 | 0x426074 | 0x2c55c | 0x2ad5c | 0x544 |
GetEnvironmentVariableA | 0x0 | 0x426078 | 0x2c560 | 0x2ad60 | 0x1db |
EnumSystemLocalesA | 0x0 | 0x42607c | 0x2c564 | 0x2ad64 | 0x10d |
GetLocaleInfoA | 0x0 | 0x426080 | 0x2c568 | 0x2ad68 | 0x204 |
GetSystemTimeAsFileTime | 0x0 | 0x426084 | 0x2c56c | 0x2ad6c | 0x279 |
HeapFree | 0x0 | 0x426088 | 0x2c570 | 0x2ad70 | 0x2cf |
GetProcAddress | 0x0 | 0x42608c | 0x2c574 | 0x2ad74 | 0x245 |
GetModuleHandleW | 0x0 | 0x426090 | 0x2c578 | 0x2ad78 | 0x218 |
ExitProcess | 0x0 | 0x426094 | 0x2c57c | 0x2ad7c | 0x119 |
DecodePointer | 0x0 | 0x426098 | 0x2c580 | 0x2ad80 | 0xca |
EnterCriticalSection | 0x0 | 0x42609c | 0x2c584 | 0x2ad84 | 0xee |
LeaveCriticalSection | 0x0 | 0x4260a0 | 0x2c588 | 0x2ad88 | 0x339 |
FindClose | 0x0 | 0x4260a4 | 0x2c58c | 0x2ad8c | 0x12e |
FileTimeToSystemTime | 0x0 | 0x4260a8 | 0x2c590 | 0x2ad90 | 0x125 |
FileTimeToLocalFileTime | 0x0 | 0x4260ac | 0x2c594 | 0x2ad94 | 0x124 |
GetDriveTypeA | 0x0 | 0x4260b0 | 0x2c598 | 0x2ad98 | 0x1d2 |
FindFirstFileExA | 0x0 | 0x4260b4 | 0x2c59c | 0x2ad9c | 0x133 |
HeapAlloc | 0x0 | 0x4260b8 | 0x2c5a0 | 0x2ada0 | 0x2cb |
HeapSetInformation | 0x0 | 0x4260bc | 0x2c5a4 | 0x2ada4 | 0x2d3 |
GetStartupInfoW | 0x0 | 0x4260c0 | 0x2c5a8 | 0x2ada8 | 0x263 |
TerminateProcess | 0x0 | 0x4260c4 | 0x2c5ac | 0x2adac | 0x4c0 |
GetCurrentProcess | 0x0 | 0x4260c8 | 0x2c5b0 | 0x2adb0 | 0x1c0 |
UnhandledExceptionFilter | 0x0 | 0x4260cc | 0x2c5b4 | 0x2adb4 | 0x4d3 |
SetUnhandledExceptionFilter | 0x0 | 0x4260d0 | 0x2c5b8 | 0x2adb8 | 0x4a5 |
IsDebuggerPresent | 0x0 | 0x4260d4 | 0x2c5bc | 0x2adbc | 0x300 |
EncodePointer | 0x0 | 0x4260d8 | 0x2c5c0 | 0x2adc0 | 0xea |
WideCharToMultiByte | 0x0 | 0x4260dc | 0x2c5c4 | 0x2adc4 | 0x511 |
GetTimeZoneInformation | 0x0 | 0x4260e0 | 0x2c5c8 | 0x2adc8 | 0x298 |
Sleep | 0x0 | 0x4260e4 | 0x2c5cc | 0x2adcc | 0x4b2 |
TlsAlloc | 0x0 | 0x4260e8 | 0x2c5d0 | 0x2add0 | 0x4c5 |
TlsGetValue | 0x0 | 0x4260ec | 0x2c5d4 | 0x2add4 | 0x4c7 |
TlsSetValue | 0x0 | 0x4260f0 | 0x2c5d8 | 0x2add8 | 0x4c8 |
TlsFree | 0x0 | 0x4260f4 | 0x2c5dc | 0x2addc | 0x4c6 |
InterlockedIncrement | 0x0 | 0x4260f8 | 0x2c5e0 | 0x2ade0 | 0x2ef |
GetCurrentThreadId | 0x0 | 0x4260fc | 0x2c5e4 | 0x2ade4 | 0x1c5 |
InterlockedDecrement | 0x0 | 0x426100 | 0x2c5e8 | 0x2ade8 | 0x2eb |
IsProcessorFeaturePresent | 0x0 | 0x426104 | 0x2c5ec | 0x2adec | 0x304 |
RaiseException | 0x0 | 0x426108 | 0x2c5f0 | 0x2adf0 | 0x3b1 |
HeapCreate | 0x0 | 0x42610c | 0x2c5f4 | 0x2adf4 | 0x2cd |
SetHandleCount | 0x0 | 0x426110 | 0x2c5f8 | 0x2adf8 | 0x46f |
GetStdHandle | 0x0 | 0x426114 | 0x2c5fc | 0x2adfc | 0x264 |
InitializeCriticalSectionAndSpinCount | 0x0 | 0x426118 | 0x2c600 | 0x2ae00 | 0x2e3 |
GetFileType | 0x0 | 0x42611c | 0x2c604 | 0x2ae04 | 0x1f3 |
DeleteCriticalSection | 0x0 | 0x426120 | 0x2c608 | 0x2ae08 | 0xd1 |
InterlockedExchange | 0x0 | 0x426124 | 0x2c60c | 0x2ae0c | 0x2ec |
LoadLibraryW | 0x0 | 0x426128 | 0x2c610 | 0x2ae10 | 0x33f |
GetLocaleInfoW | 0x0 | 0x42612c | 0x2c614 | 0x2ae14 | 0x206 |
GetModuleFileNameW | 0x0 | 0x426130 | 0x2c618 | 0x2ae18 | 0x214 |
GetConsoleCP | 0x0 | 0x426134 | 0x2c61c | 0x2ae1c | 0x19a |
GetConsoleMode | 0x0 | 0x426138 | 0x2c620 | 0x2ae20 | 0x1ac |
ReadFile | 0x0 | 0x42613c | 0x2c624 | 0x2ae24 | 0x3c0 |
FlushFileBuffers | 0x0 | 0x426140 | 0x2c628 | 0x2ae28 | 0x157 |
GetFullPathNameA | 0x0 | 0x426144 | 0x2c62c | 0x2ae2c | 0x1f8 |
GetFileInformationByHandle | 0x0 | 0x426148 | 0x2c630 | 0x2ae30 | 0x1ec |
PeekNamedPipe | 0x0 | 0x42614c | 0x2c634 | 0x2ae34 | 0x38d |
GetCurrentDirectoryW | 0x0 | 0x426150 | 0x2c638 | 0x2ae38 | 0x1bf |
GetModuleFileNameA | 0x0 | 0x426154 | 0x2c63c | 0x2ae3c | 0x213 |
FreeEnvironmentStringsW | 0x0 | 0x426158 | 0x2c640 | 0x2ae40 | 0x161 |
GetEnvironmentStringsW | 0x0 | 0x42615c | 0x2c644 | 0x2ae44 | 0x1da |
QueryPerformanceCounter | 0x0 | 0x426160 | 0x2c648 | 0x2ae48 | 0x3a7 |
GetTickCount | 0x0 | 0x426164 | 0x2c64c | 0x2ae4c | 0x293 |
GetCurrentProcessId | 0x0 | 0x426168 | 0x2c650 | 0x2ae50 | 0x1c1 |
GetCPInfo | 0x0 | 0x42616c | 0x2c654 | 0x2ae54 | 0x172 |
HeapReAlloc | 0x0 | 0x426170 | 0x2c658 | 0x2ae58 | 0x2d2 |
GetACP | 0x0 | 0x426174 | 0x2c65c | 0x2ae5c | 0x168 |
GetOEMCP | 0x0 | 0x426178 | 0x2c660 | 0x2ae60 | 0x237 |
IsValidCodePage | 0x0 | 0x42617c | 0x2c664 | 0x2ae64 | 0x30a |
RtlUnwind | 0x0 | 0x426180 | 0x2c668 | 0x2ae68 | 0x418 |
HeapSize | 0x0 | 0x426184 | 0x2c66c | 0x2ae6c | 0x2d4 |
MultiByteToWideChar | 0x0 | 0x426188 | 0x2c670 | 0x2ae70 | 0x367 |
WriteConsoleW | 0x0 | 0x42618c | 0x2c674 | 0x2ae74 | 0x524 |
SetStdHandle | 0x0 | 0x426190 | 0x2c678 | 0x2ae78 | 0x487 |
GetDriveTypeW | 0x0 | 0x426194 | 0x2c67c | 0x2ae7c | 0x1d3 |
SetEndOfFile | 0x0 | 0x426198 | 0x2c680 | 0x2ae80 | 0x453 |
GetProcessHeap | 0x0 | 0x42619c | 0x2c684 | 0x2ae84 | 0x24a |
LCMapStringW | 0x0 | 0x4261a0 | 0x2c688 | 0x2ae88 | 0x32d |
GetStringTypeW | 0x0 | 0x4261a4 | 0x2c68c | 0x2ae8c | 0x269 |
CreateFileW | 0x0 | 0x4261a8 | 0x2c690 | 0x2ae90 | 0x8f |
CompareStringW | 0x0 | 0x4261ac | 0x2c694 | 0x2ae94 | 0x64 |
SetEnvironmentVariableA | 0x0 | 0x4261b0 | 0x2c698 | 0x2ae98 | 0x456 |
GetUserDefaultLCID | 0x0 | 0x4261b4 | 0x2c69c | 0x2ae9c | 0x29b |
USER32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
wsprintfA | 0x0 | 0x4261c4 | 0x2c6ac | 0x2aeac | 0x332 |
ADVAPI32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegDeleteValueA | 0x0 | 0x426000 | 0x2c4e8 | 0x2ace8 | 0x247 |
RegCloseKey | 0x0 | 0x426004 | 0x2c4ec | 0x2acec | 0x230 |
RegEnumKeyA | 0x0 | 0x426008 | 0x2c4f0 | 0x2acf0 | 0x24d |
RegQueryInfoKeyA | 0x0 | 0x42600c | 0x2c4f4 | 0x2acf4 | 0x267 |
RegOpenKeyExA | 0x0 | 0x426010 | 0x2c4f8 | 0x2acf8 | 0x260 |
RegSetValueExA | 0x0 | 0x426014 | 0x2c4fc | 0x2acfc | 0x27d |
SHELL32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SHGetFolderPathA | 0x0 | 0x4261bc | 0x2c6a4 | 0x2aea4 | 0xbf |
Digital Signatures (2)
»
Certificate: Oracle America, Inc.
»
Issued by | Oracle America, Inc. |
Parent Certificate | VeriSign Class 3 Code Signing 2010 CA |
Country Name | US |
Valid From | 2013-06-08 00:00:00+00:00 |
Valid Until | 2016-08-06 23:59:59+00:00 |
Algorithm | sha1_rsa |
Serial Number | 0A 4F 98 7A 76 9E 4A 35 3B 26 87 8A 3B D3 D3 DE |
Thumbprint | 9F 75 A0 B1 4C 12 5F 80 69 46 AE E6 A5 4E 97 A1 D8 C1 B9 ED |
Certificate: VeriSign Class 3 Code Signing 2010 CA
»
Issued by | VeriSign Class 3 Code Signing 2010 CA |
Country Name | US |
Valid From | 2010-02-08 00:00:00+00:00 |
Valid Until | 2020-02-07 23:59:59+00:00 |
Algorithm | sha1_rsa |
Serial Number | 52 00 E5 AA 25 56 FC 1A 86 ED 96 C9 D4 4B 33 C7 |
Thumbprint | 49 58 47 A9 31 87 CF B8 C7 1F 84 0C B7 B4 14 97 AD 95 C6 4F |
c:\users\5p5nrgjn0js halpmcxz\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015 | Modified File | Stream |
Unknown
|
...
|
»
c:\users\5p5nrg~1\appdata\local\temp\cab5496.tmp | Dropped File | CAB |
Unknown
|
...
|
»
Archive Information
»
Number of Files | 1 |
Number of Folders | 0 |
Size of Packed Archive Contents | 126.77 KB |
Size of Unpacked Archive Contents | 126.77 KB |
File Format | cab |
Contents (1)
»
Filename | Packed Size | Unpacked Size | Compression | Is Encrypted | Modify Time | Actions |
---|---|---|---|---|---|---|
authroot.stl | 126.77 KB | 126.77 KB | MSZip |
![]() |
2017-09-22 16:47 (UTC+2) |
...
|
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\geo[1].json | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url.moss | Dropped File | Text |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\D99YKJDL-0LajD\7q9Uuf7p.mp3.moss | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\D99YKJDL-0LajD\BVm 0I0y19-I.wav.moss | Dropped File | Audio |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\lf_1AfflQryz8itj s8w\OtPN87Pig3y.wav.moss | Dropped File | Audio |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\lf_1AfflQryz8itj s8w\v_kH3lt3CLNkfkofloR.mp3.moss | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\LV2X09A0oM561\TefnYihKIGC8R2AWa-T.mp3.moss | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\LV2X09A0oM561\VyO0yiFTvgQQDq.wav.moss | Dropped File | Audio |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\gkhaSVWy.png.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\SEWYUDpznLTI_L.jpg.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\uyF8KRBky4U4nLZl1S9h.jpg.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\Kb8uL.gif.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\nhW90.bmp.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\QD_MoREZj4xQrMk.gif.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\zQ0p5kK8-M.bmp.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZyOX_xDVWOQqjcupRL\0mRKn3DgJies5pe.gif.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZyOX_xDVWOQqjcupRL\54yB_qBDNM_.jpg.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZyOX_xDVWOQqjcupRL\kftTF.bmp.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZyOX_xDVWOQqjcupRL\w3pbGdHFqm6D3yqYrHj.bmp.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\9U56ddJ544.mkv.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\lkU0qT5ec.swf.moss | Dropped File | Shockwave Flash |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\RlA1F_u.flv.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5RddQRlUxLC956\1dBcNb8\LhauEu1.m4a.moss | Dropped File | Audio |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\eL7ZGLErx\A7tQuX7Bkim.png.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\eL7ZGLErx\HxoFMCj9IM26.swf.moss | Dropped File | Shockwave Flash |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\-rtk24EwtR.odt.moss | Dropped File | ZIP |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\7Ecmz.doc.moss | Dropped File | Unknown |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\Fc4wgudkAiG_oWSy.rtf.moss | Dropped File | RTF |
Unknown
|
...
|
»
Office Information
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\FJTrYGIfGriZEdj.csv.moss | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\iENOEBYm.doc.moss | Dropped File | Unknown |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\D99YKJDL-0LajD\9yc_4THt2yLG_luCDjCt\5RpvrOU_FL1tbaCm.mp3.moss | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\D99YKJDL-0LajD\9yc_4THt2yLG_luCDjCt\S5s3cW4oAyK.m4a.moss | Dropped File | Audio |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\D99YKJDL-0LajD\ZxH6\Pn3-5wISK.m4a.moss | Dropped File | Audio |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\gRg1W2LdYa9ZK4JvYbH.png.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\X RGlJ65-QWWqSt11jj0.jpg.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\O8XDzJfnVQ\03tKuIswO4GFmRXy.mkv.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\O8XDzJfnVQ\8LH-.avi.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\O8XDzJfnVQ\hEFla2O9Gdxlhd.swf.moss | Dropped File | Shockwave Flash |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\O8XDzJfnVQ\oAjt_lfb.avi.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\O3UCSFjw\2MYj1_f52PTn1yg8.mp4.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\O3UCSFjw\JDgNO7xPXb.flv.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\O3UCSFjw\KDXoQ.swf.moss | Dropped File | Shockwave Flash |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\O3UCSFjw\un-_xvo.flv.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\1Jhy.flv.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\FyJx9B3rAO_ V1cS.swf.moss | Dropped File | Shockwave Flash |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\iYED.mp4.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\kCnE4Wx7UWtF P0rfv.mp4.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\WzqLj2L9U-8 _18ZV l.mp4.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\ZlmeJ.swf.moss | Dropped File | Shockwave Flash |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\C v_S8 I6B\dWbx.png.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\C v_S8 I6B\R9-vmE0.bmp.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\C v_S8 I6B\RY8z5ggN.gif.moss | Dropped File | Image |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\wchwPGABs3kExE1F\33BvA-jKWXb.swf.moss | Dropped File | Shockwave Flash |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\wchwPGABs3kExE1F\9r4Yw.avi.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\wchwPGABs3kExE1F\KUZUPCBgZU.mkv.moss | Dropped File | Video |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\wchwPGABs3kExE1F\lygnvoy4wgLu9xt.swf.moss | Dropped File | Shockwave Flash |
Unknown
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab.moss | Dropped File | CAB |
Unknown
|
...
|
»
Archive Information
»
Number of Files | 6 |
Number of Folders | 0 |
Size of Packed Archive Contents | 1.19 MB |
Size of Unpacked Archive Contents | 1.19 MB |
File Format | cab |
Contents (6)
»
Filename | Packed Size | Unpacked Size | Compression | Is Encrypted | Modify Time | Actions |
---|---|---|---|---|---|---|
jusched | 248.38 KB | 248.38 KB | MSZip |
![]() |
2013-07-02 11:16 (UTC+2) |
...
|
jucheck | 495.38 KB | 495.38 KB | MSZip |
![]() |
2013-07-02 11:16 (UTC+2) |
...
|
aucheck | 242.88 KB | 242.88 KB | MSZip |
![]() |
2013-07-02 11:16 (UTC+2) |
...
|
task64.xml | 1.38 KB | 1.38 KB | MSZip |
![]() |
2013-07-02 11:16 (UTC+2) |
...
|
jaureg | 229.88 KB | 229.88 KB | MSZip |
![]() |
2013-07-02 11:16 (UTC+2) |
...
|
task.xml | 1.38 KB | 1.38 KB | MSZip |
![]() |
2013-07-02 11:16 (UTC+2) |
...
|
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url.moss | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url.moss | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url.moss | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url.moss | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url.moss | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url.moss | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DENcIRfHVVVix5\H97IrW ql.wav.moss | Dropped File | Audio |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\DENcIRfHVVVix5\TyBhlhBVzmcnSF.wav.moss | Dropped File | Audio |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\lf_1AfflQryz8itj s8w\2NB5BXl v7m2B-rvdN.wav.moss | Dropped File | Audio |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\LV2X09A0oM561\RvIelPYu4g 0l9vjosa.mp3.moss | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\612n\0rEK5NR.jpg.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\whczvEvh.bmp.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\hvGNn3Fg6SmhShQc4pe.gif.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\jJqHNDTsO8rPiTJ.bmp.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ynvUi8OA0E 4g2YjdS\R0VSd_xa3T76_EiBOSQI.gif.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\-2WcrB3nB4LDZ.avi.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\G2r-lFePN.avi.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\WPBWEhNjk04EMrHCp.mp4.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\eL7ZGLErx\r0I-pmm5bEvli36ME5h.m4a.moss | Dropped File | Audio |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\xxuaxzQ\eL7ZGLErx\z89g-WpFIR4S.m4a.moss | Dropped File | Audio |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\-KRg_.ods.moss | Dropped File | ZIP |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\H5lMGA-.csv.moss | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\Kui9_W1ugv074YE8w.pps.moss | Dropped File | Unknown |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\OGaAnOzVb1N30G3.ppt.moss | Dropped File | Unknown |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Documents\NsI7Q_Ai4cQKUwAhGA5\ZSqKO4y-pgVGUfXDhW\Otj_8mdOmWLxIfCj.csv.moss | Dropped File | Stream |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\D99YKJDL-0LajD\9yc_4THt2yLG_luCDjCt\wcmZd NU.m4a.moss | Dropped File | Audio |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\D99YKJDL-0LajD\ZxH6\3KR652nYn_xiX.wav.moss | Dropped File | Audio |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Music\D99YKJDL-0LajD\ZxH6\Y_tiO3q43S_U97rK1p.m4a.moss | Dropped File | Audio |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\qR-9Frj44s4GyTq.png.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\qVaGkynXjPMz6RZ0K.bmp.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\Via14eyxpe.jpg.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\js4wnFUoxs42X9Y0mylB\YD0LTf1VnnELtRyQ6\ZTxzYddoe.bmp.moss | Dropped File | Image |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\O8XDzJfnVQ\cXJq9ZAkeCSN.flv.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\O8XDzJfnVQ\lqRBBYuMkoOsPz_.avi.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gOI6FhRK7 r-pcVYvKd\O8XDzJfnVQ\UYbsuYquLTF3oeW.flv.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\O3UCSFjw\MxqEFht CvSL8kxlj.avi.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\O3UCSFjw\OMgFdhXefqgaWTvC.flv.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\O3UCSFjw\se6dcbCoGQ56.flv.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\O3UCSFjw\w-1pA.mkv.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\H5st.mp4.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\KsWJF1Ex576B.mp4.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\wchwPGABs3kExE1F\g6YWZzTvblVcc17ujwd.flv.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\Videos\V4xTSO7L1q6Ip\Uzo_bgWg\wchwPGABs3kExE1F\Tgxvq60OcA3VT.mp4.moss | Dropped File | Video |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties.moss | Dropped File | Text |
Not Queried
|
...
|
»
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\bowsakkdestx.txt | Downloaded File | Text |
Not Queried
|
...
|
»