- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
32e4a5e092d8436bf9934337c3f803026e8a8073e3405d29121df6ef13fc810b- SHA1
b21225d1698fd2e4a87b4ae3f9208c17a16abcad- MD5
b7ffa429179ff4ae82f14c4a6d05b445- Filename
- 32e4a5e0_5eil2.exe.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 2110592
- Compile time
- 2014-04-10T08:59:15Z
- PE platform
- x64 64-bit
- PE sections
- 8
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context17 visible
Intelligence freshnessHistorical
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
2shown
5%
low
rar
99146985 bytes
contains
Filename
2a501987_drivermax pro 14.11.0.4.rar.bin
File type
rar
MIME
application/vnd.rar
Size
99146985
SHA1
493f558677d9111ecd23226caec7c82db5cea5cb
0%
zip
250812984 bytes
drops
Filename
7d179935_realtek_audio_win7_81_10_64bit_v6017701.zip.bin
File type
zip
MIME
application/zip
Size
250812984
SHA1
51a94f141c9e6737c81b87ddcee07757e3f911c5
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
748 bytes
contains
Filename
31768768_maxxaudioeq_3_1.bin
MIME
application/octet-stream
Size
748
SHA1
56e10253139d4dcaf8bfb953aa574e1df73368b5
First seen
2014-08-06T14:44:34Z
0%
308 bytes
contains
Filename
14a420ef_maxxaudioeq_4_1.bin
MIME
application/octet-stream
Size
308
SHA1
b34c1359dc4c46684a838a898787735db8f9286c
First seen
2014-08-06T02:37:47Z
0%
748 bytes
contains
Filename
c899a9fe_4.bin
MIME
application/octet-stream
Size
748
SHA1
9c7ef9d912d506df6fb67e4e20c686efe2803f51
First seen
2014-08-07T09:59:07Z
0%
xml
6125 bytes
contains
Filename
b81d2f5f_1.bin
File type
xml
MIME
application/xml
Size
6125
SHA1
b6038e3880896845762593bbc9bd0f4b96ef4e37
0%
748 bytes
contains
Filename
9599e8c7_5.bin
MIME
application/octet-stream
Size
748
SHA1
572c1f10cde953a2d326df17c42e7ffb354f7fb2
First seen
2014-08-03T12:48:57Z
Related IPs
Network IPs associated with this indicator.
5shown
US
communicates
CIDR
23.46.30.0/24
Network
23.46.30.0-23.46.31.255
First seen
2023-10-02T17:17:07Z
Last seen
2026-11-14T03:36:41Z
0%
US
communicates
CIDR
23.46.30.0/24
Network
23.46.30.0-23.46.31.255
First seen
2023-10-02T21:32:41Z
Last seen
2026-11-14T03:36:41Z
0%
US
communicates
CIDR
23.46.30.0/24
Network
23.46.30.0-23.46.31.255
First seen
2023-10-02T10:36:18Z
Last seen
2026-11-13T05:16:45Z
0%
US
communicates
CIDR
135.224.0.0/12
Network
135.233.0.0-135.233.255.255
First seen
2025-07-14T22:31:26Z
Last seen
2026-11-14T04:09:05Z
0%
US
communicates
CIDR
184.31.12.0/22
Network
184.24.0.0-184.31.255.255
First seen
2026-02-08T21:02:34Z
Last seen
2026-10-27T03:50:40Z
Related domains
Domains associated with this indicator.
5shown
5%
low
.net
communicates
Root
dc-msedge.net
TLD
net
Subdomain
iceprime.a-0003
First seen
2023-09-29T00:58:53Z
Last seen
2026-11-13T03:29:23Z
0%
.net
communicates
Root
akamaiedge.net
TLD
net
Subdomain
e8652.dscx
First seen
2023-09-29T09:46:51Z
Last seen
2026-11-14T08:10:32Z
0%
.net
communicates
Root
edgekey.net
TLD
net
Subdomain
crl.root-x1.letsencrypt.org
First seen
2023-09-30T08:49:01Z
Last seen
2026-11-14T08:10:32Z
0%
.net
communicates
Root
akamaized.net
TLD
net
Subdomain
img-s-msn-com
First seen
2023-09-29T21:13:57Z
Last seen
2026-11-14T08:08:30Z
0%
.com
communicates
Root
bing.com
TLD
com
Subdomain
th
First seen
2023-09-29T12:17:49Z
Last seen
2026-11-14T08:08:30Z
Analysis details
64bitdotnetdllfile-overlayknownsrcsigned
Freshness: Historical · Last seen 451 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
32e4a5e092d8436bf9934337c3f803026e8a8073e3405d29121df6ef13fc810b- SHA1
b21225d1698fd2e4a87b4ae3f9208c17a16abcad- MD5
b7ffa429179ff4ae82f14c4a6d05b445- Filename
- 32e4a5e0_5eil2.exe.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 2110592
- Compile time
- 2014-04-10T08:59:15Z
- PE platform
- x64 64-bit
- PE sections
- 8
- Import libraries
- 9
- SSDEEP
49152:XArhTxybZ+iDhE+JPwrtM38eBaHEIgVZ8S:MCbJlz- Imphash
54faa5b9407ba11139f337fb88b6c582- First seen
- 2016-04-23T14:25:03Z
- Last seen
- 2025-08-19T23:44:26Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
18 timestamped observations are arranged from 2014-04-10 to 2026-02-08. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map.
Intelligence freshness
Last seen 451 days ago. Revalidate volatile infrastructure before enforcement.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
4 relationship group(s) provide pivot and infrastructure context.
Last seen 451 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 32e4a5e0_5eil2.exe.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 2110592
- Compile time
- 2014-04-10T08:59:15Z
- PE platform
- x64 64-bit
- Entry point
- 1075564
- Sections
- 8
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5+ sections
- Platform: x64 64-bit
- Sections: 5+
- Entry point: present
- Compile time: 2014-04-10T08:59:15Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 1075564
- Sections
- 8
- Compile time
- 2014-04-10T08:59:15Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: r, rw, rx, x
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 1298234
- Raw size
- 1298432
- Permissions
- rx
- Entropy
- 6.35
- Name
- .rdata
- Virtual address
- 1302528
- Virtual size
- 643353
- Raw size
- 643584
- Permissions
- r
- Entropy
- 5.68
- Name
- .data
- Virtual address
- 1949696
- Virtual size
- 40272
- Raw size
- 28160
- Permissions
- rw
- Entropy
- 4.17
- Name
- .pdata
- Virtual address
- 1990656
- Virtual size
- 71556
- Raw size
- 71680
- Permissions
- r
- Entropy
- 6.14
- Name
- text
- Virtual address
- 2064384
- Virtual size
- 6846
- Raw size
- 7168
- Permissions
- x
- Entropy
- 5.59
5 shown
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- COMDLG32.dll
- Functions
- GetOpenFileNameA, GetSaveFileNameA, CommDlgExtendedError
- Library
- OPENGL32.dll
- Functions
- glTexCoord2d, glFlush, glLineStipple, glVertex3d, glTexImage2D, glDisable, wglCreateContext, glLogicOp …
- Library
- VERSION.dll
- Functions
- GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
- Library
- GDI32.dll
- Functions
- CreatePolygonRgn, SetBitmapBits, OffsetRgn, GetRgnBox, CreateFontIndirectA, GetTextMetricsA, CombineRgn, GetRandomRgn …
- Library
- SHELL32.dll
- Functions
- ShellExecuteExA, SHGetFolderPathA
5 shown
Exports5+
5+ exported items
- 5+ exported items
View details · 5 shown
- Name
- ??$ReadFromXML_Float@M@wvXML@@YAXQEBVCXMLElement@0@AEAM@Z
- Name
- ??$ReadFromXML_Float@N@wvXML@@YAXQEBVCXMLElement@0@AEAN@Z
- Name
- ??$ReadFromXML_Float_Vector@M@wvXML@@YAXQEBVCXMLElement@0@AEAV?$vector@MV?$allocator@M@std@@@std@@@Z
- Name
- ??$ReadFromXML_Float_Vector@N@wvXML@@YAXQEBVCXMLElement@0@AEAV?$vector@NV?$allocator@N@std@@@std@@@Z
- Name
- ??$ReadFromXML_Int@F@wvXML@@YAXQEBVCXMLElement@0@AEAF@Z
5 shown
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_CURSOR, RT_GROUP_CURSOR, RT_MANIFEST, RT_VERSION, XCLI
View details · 5 shown
- Type
- XCLI
- Language
- NEUTRAL
- Type
- RT_CURSOR
- Language
- NEUTRAL
- Type
- RT_GROUP_CURSOR
- Language
- NEUTRAL
- Type
- RT_VERSION
- Language
- NEUTRAL
- Type
- RT_MANIFEST
- Language
- ENGLISH US
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates5+
4 issuers
- Example subject: Microsoft Windows Hardware Compatibility Publisher
- Issued by: Microsoft Windows Third Party Component CA 2012
- Validity period (UTC): 2014-12-19 – 2016-03-19
View details · 5 shown
- Subject
- Microsoft Windows Hardware Compatibility Publisher
- Issuer
- Microsoft Windows Third Party Component CA 2012
- Valid from
- 1419020820.0
- Valid to
- 1458419220.0
- Fingerprint
- 96C51247E27DAE45A1BCD582A0503256F9EAEDAC
- Subject
- Microsoft Windows Third Party Component CA 2012
- Issuer
- Microsoft Root Certificate Authority 2010
- Valid from
- 1334792880.0
- Valid to
- 1808092680.0
- Fingerprint
- 77A10EBF07542725218CD83A01B521C57BC67F73
- Subject
- Microsoft Root Certificate Authority 2010
- Issuer
- Microsoft Root Certificate Authority 2010
- Valid from
- 1277330220.0
- Valid to
- 2066249040.0
- Fingerprint
- 3B1EFD3A66EA28B16697394703A72CA340A05BD5
- Subject
- Waves Inc
- Issuer
- VeriSign Class 3 Code Signing 2010 CA
- Fingerprint
- 7545A03CC8C9DB42C5062348B8EA68045A32E148
- Subject
- Microsoft Time-Stamp PCA 2010
- Issuer
- Microsoft Root Certificate Authority 2010
- Fingerprint
- 2AA752FE64C49ABE82913C463529CF10FF2F04EE
5 shown