empress[.]rar | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

empress.rar
Size

5.3MB
MD5

53aa024f8ef4380a2420bf9d6beff04f
SHA1

729cf86a0441bb24f56148ffdf89ea7def5649e4
SHA256

0685a414aade167d052a5eca933ea42f510508c6ce600254e11fda42bd38bfff
SHA512

dc9869f6bd90bc0f41f2cecd4f6103a06efda65a7ac9c0d42c65179d5d61dd55a02642b0a221be41e4e006d9cc1b0fb3bd22bf75dc5079da72a4d7d5ce568450
SSDEEP

98304:9HS4tv/XF/tDbHptetc5FhswHyp5CBq6+nWHtHJK4FJpnKjFBrcrE9IiWLWz2a:s6v/XF1nHpteWPhs5pEBjJn+FBrcrMIo

Score

1^/10

Malware Config

Signatures

Files

empress.rar
.rar

Password: empress
Hogwarts Legacy by EMPRESS/DirectInk.dll
.dll windows x64

Password: empress

76ab0bd1c8f81a651bad2440e8635ea7

Code Sign

01:1f:39:a2:26:1a:99:3d:d1:51:76:da:6f:e4:fb:ea
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-12-2020 00:00

Not After

21-12-2022 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:2f:68:ed:48:e5:91:c1:45:d1:4d:68:70:fe:ac:64:7d:a0:52:98:33:fe:f1:c9:4e:23:5c:bc:89:84:2b:90
Signer

Actual PE Digest

1c:2f:68:ed:48:e5:91:c1:45:d1:4d:68:70:fe:ac:64:7d:a0:52:98:33:fe:f1:c9:4e:23:5c:bc:89:84:2b:90

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

24-12-2021 10:42
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

dcomp

DCompositionCreateDevice2

kernel32

HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
HeapSize
GetLastError
GlobalAlloc
HeapReAlloc
RaiseException
HeapAlloc
GlobalLock
WriteConsoleW
GetProcessHeap
GlobalUnlock
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
DeleteCriticalSection
RtlCaptureContext
GetFileType
GetStdHandle
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
CloseHandle
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
GetProcAddress
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

user32

PtInRect
ClientToScreen
ScreenToClient
GetWindowRect
PostMessageW
InvalidateRect
GetPointerType
SetCursorPos
GetCursorPos

ole32

CreateStreamOnHGlobal
CoCreateInstance

d2d1

ord1

d3d11

D3D11CreateDevice

gdiplus

GdipSaveImageToStream
GdipDeletePen
GdipGetImageEncodersSize
GdipCreatePen1
GdiplusStartup
GdipDrawCurve
GdipFillRectangleI
GdipGetImageGraphicsContext
GdipCloneBrush
GdipSetCompositingMode
GdipFree
GdipCreateSolidFill
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDisposeImage
GdipAlloc
GdipDeleteBrush
GdipCloneImage
GdipGetImageEncoders
GdipSetCompositingQuality
GdipCreateBitmapFromScan0

Exports

Exports

BeginDry
ChangeInkPresenterColor
ChangeInkPresenterLineWidth
ChangeInkPresenterOpacity
ChangeInkPresenterSize
CreateNewInkPresenter
DirectInkLoopBackLineDrawingTest
DisableInkPresenter
DisableMouse
DisablePen
DisableTouch
EnableInkPresenter
EnableTouchPenMouse
EndDry
GetEraserPoint
GetLastRightClickPoint
GetSignature
InitializeDirectInk
SetSignature
ShouldAppIgnorePointerDownMessage
TearDownDirectInk
TearDownInkPresenter

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/Setup.exe
.exe windows x86

Password: empress

0d2bc4f44be56e5f23a4ed8ea9899cb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleA
AddAtomW
FreeConsole
GetCommandLineA
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/WebResources/Resource0/app1/dc-app-launcher.js
.js
Hogwarts Legacy by EMPRESS/WebResources/Resource0/app1/index.html
Hogwarts Legacy by EMPRESS/WebResources/Resource0/appmeasurement/prod/appmeasurement.js
.js
Hogwarts Legacy by EMPRESS/WebResources/Resource0/appmeasurement/stage/appmeasurement.js
.js
Hogwarts Legacy by EMPRESS/WebResources/Resource0/base_uris.js
.js
Hogwarts Legacy by EMPRESS/WebResources/Resource0/index.html
.html
Hogwarts Legacy by EMPRESS/WebResources/Resource0/init.js
.js
Hogwarts Legacy by EMPRESS/WebResources/Resource0/plugins.js
.js
Hogwarts Legacy by EMPRESS/WebResources/Resource0/variant.js
Hogwarts Legacy by EMPRESS/WebResources/Resource0/version.js
Hogwarts Legacy by EMPRESS/ccme_ecc.dll
.dll windows x64

Password: empress

85fa29bd3c72ce2d14f3f8e4207261d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcr120

__C_specific_handler
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_initterm_e
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
_initterm
_malloc_crt
free
_amsg_exit
__CppXcptFilter
memmove_s
memcpy_s
memcmp
__clean_type_info_names_internal
memset

kernel32

IsDebuggerPresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer
IsProcessorFeaturePresent

Exports

Exports

R_FIPS_MODULE_resource

Sections

.text
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 139KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/icucnv58.dll
.msi
Hogwarts Legacy by EMPRESS/icucnv67.dll
.msi
Hogwarts Legacy by EMPRESS/icudt58.dll
.msi
Hogwarts Legacy by EMPRESS/icudt67.dll
.msi
Hogwarts Legacy by EMPRESS/x86/ACE.dll
.dll windows x86

Password: empress

23076d501d734740bd988395f9a2bdc0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:52:96:f8:fc:d8:29:a7:5d:c9:42:94:f5:a4:15:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29-04-2022 00:00

Not After

01-05-2024 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:ad:5d:15:fc:72:09:57:11:7f:e0:d3:ae:46:a9:a5:57:76:b6:2d:5c:5f:30:2e:cb:74:93:a1:44:12:fb:31
Signer

Actual PE Digest

15:ad:5d:15:fc:72:09:57:11:7f:e0:d3:ae:46:a9:a5:57:76:b6:2d:5c:5f:30:2e:cb:74:93:a1:44:12:fb:31

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

04-07-2022 20:10
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
CloseHandle
WaitForSingleObject
CreateThread
ReleaseSemaphore
CreateSemaphoreA
GetSystemTime
GetModuleFileNameW
SystemTimeToFileTime
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
GlobalMemoryStatus
GetProfileStringA
CreateDirectoryW
MultiByteToWideChar
CreateFileW
DeleteFileW
GetCurrentProcessId
FindFirstFileW
FindNextFileW
GetFileAttributesW
ReadFile
SetFilePointerEx
WriteFile
GetLastError
MoveFileExW
FileTimeToSystemTime
WideCharToMultiByte
IsValidCodePage
GetACP
Sleep
GetCurrentProcess
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThreadId
QueryPerformanceCounter
GetProcAddress
GetModuleHandleA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
VerifyVersionInfoW
GetSystemInfo
IsProcessorFeaturePresent
FindClose
VerSetConditionMask
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead

user32

LoadStringA

gdi32

GetICMProfileW
DeleteDC
CreateDCW
CreateDCA

advapi32

RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueA
RegCloseKey
RegQueryValueExA

shell32

SHGetFolderPathW

ole32

CoCreateInstance

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ

vcruntime140

__current_exception
strstr
_except_handler4_common
__std_type_info_destroy_list
__CxxFrameHandler3
memcmp
wcsstr
_purecall
memmove
__current_exception_context
__std_exception_destroy
__std_exception_copy
memset
memcpy
__RTDynamicCast
__std_terminate
_CxxThrowException

api-ms-win-crt-math-l1-1-0

fabs
pow
log10
log2
sqrt
log
_fdsign

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initterm_e
_invalid_parameter_noinfo
_errno
_initterm
terminate
_cexit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_crt_atexit

api-ms-win-crt-string-l1-1-0

strncpy
strncmp
strcat
wcstok_s
wcscmp
strcmp
strlen
strnlen
towupper
strcpy

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vsprintf_s
__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_callnewh
free
realloc
malloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

Exports

Exports

ACEGetVersion
ACEHasFeature
ACEInitDelayed
ACEInitialize
ACEInitializeEx
ACETerminate

Sections

.text
Size: 844KB - Virtual size: 843KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/x86/AGM.dll
.dll windows x86

Password: empress

0c4ef399e3ebaa650bb9619d8524550c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:52:96:f8:fc:d8:29:a7:5d:c9:42:94:f5:a4:15:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29-04-2022 00:00

Not After

01-05-2024 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:e0:d2:5a:90:d1:6b:ae:1a:ac:33:7e:43:cd:1b:9d:1a:a2:81:49:42:ab:65:f1:e9:0d:38:e7:3a:26:df:38
Signer

Actual PE Digest

8f:e0:d2:5a:90:d1:6b:ae:1a:ac:33:7e:43:cd:1b:9d:1a:a2:81:49:42:ab:65:f1:e9:0d:38:e7:3a:26:df:38

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

04-07-2022 20:10
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
VerSetConditionMask
IsProcessorFeaturePresent
VerifyVersionInfoW
QueryPerformanceCounter
IsDebuggerPresent
TerminateProcess
GetWindowsDirectoryA
UnhandledExceptionFilter
CreateEventW
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
GetModuleHandleW
VirtualQuery
VirtualProtect
RaiseException
InitializeSListHead
GetSystemDirectoryW
GetSystemDirectoryA
GetCurrentDirectoryA
GetFileSize
ReadFile
SetCurrentDirectoryA
GlobalSize
WaitForSingleObject
GetProfileStringW
GetSystemDefaultLCID
GetLocaleInfoA
GetACP
GetFileTime
CreateFileA
LoadLibraryA
FindNextFileA
FindFirstFileA
FindClose
GetUserDefaultLangID
GetThreadLocale
GetTimeFormatW
GetTimeFormatA
GetDateFormatW
GetDateFormatA
GetCurrentProcess
DuplicateHandle
CreateSemaphoreA
GetVersionExA
GetThreadPriority
SetThreadPriority
GetCurrentThread
lstrcmpW
GetEnvironmentVariableW
GlobalHandle
GetTempFileNameW
GetTempPathW
DeleteFileW
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GlobalFree
GlobalAlloc
LoadLibraryW
FreeLibrary
GetLocalTime
GlobalLock
GlobalUnlock
OutputDebugStringA
GetTempPathA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SystemTimeToFileTime
CreateWaitableTimerA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
SetWaitableTimer
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
ResetEvent
SetEvent
GetCurrentThreadId
GetCurrentProcessId
GetProcAddress
Sleep
ReleaseSemaphore
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CloseHandle
GetTickCount
GetSystemInfo
GetModuleHandleA
OpenEventA
CreateEventA
GetSystemTimeAsFileTime
LocalFree
SetUnhandledExceptionFilter
FormatMessageA

user32

DestroyWindow
SetWindowPos
LoadCursorA
LoadIconA
CreateWindowExA
SetActiveWindow
CharNextW
GetMonitorInfoA
EnumDisplayMonitors
UnregisterClassA
RegisterClassA
GetClientRect
GetActiveWindow
WindowFromDC
GetDC
ReleaseDC
GetWindowRect
ScrollWindowEx
OffsetRect
MonitorFromPoint
MonitorFromWindow
GetSystemMetrics
GetDesktopWindow
DefWindowProcA

gdi32

EndPath
CloseFigure
BeginPath
AbortDoc
EndPage
StartPage
EndDoc
StartDocW
GetDIBColorTable
CreateDIBSection
ModifyWorldTransform
SetWorldTransform
GetWorldTransform
SetStretchBltMode
SetROP2
StretchDIBits
StretchBlt
SetPolyFillMode
SetGraphicsMode
SetDIBits
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RealizePalette
ResetDCW
RestoreDC
Rectangle
PatBlt
FillPath
LineTo
IntersectClipRect
GetViewportOrgEx
GetStockObject
GetRgnBox
GetRegionData
GetGraphicsMode
GetDeviceCaps
GetCurrentObject
GetClipRgn
GetClipBox
ExtEscape
Escape
EqualRgn
DeleteObject
DeleteDC
CreateRectRgn
CreatePatternBrush
CreatePolyPolygonRgn
CreatePalette
CreateICW
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CombineRgn
BitBlt
PolyBezierTo
PolylineTo
SetBrushOrgEx
PolyDraw
SelectClipPath
SetMiterLimit
StrokePath
ExtCreatePen
OffsetRgn
MoveToEx
GetObjectA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegGetValueA
RegSetValueExA

ole32

CreateStreamOnHGlobal

msvcp140

_Xtime_get_ticks
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPBD@Z
_Query_perf_counter
_Query_perf_frequency
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?id@?$ctype@D@std@@2V0locale@2@A

shlwapi

PathRemoveFileSpecA
PathAppendA

vcruntime140

__std_type_info_compare
memchr
wcschr
strchr
wcsstr
__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
memcpy
_purecall
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
__RTDynamicCast
memmove
__std_terminate
memset
memcmp
strstr

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
realloc

api-ms-win-crt-string-l1-1-0

strtok_s
tolower
isdigit
toupper
_wcsicmp
strncmp
wcsncpy
strcat_s
strcpy_s
wcscpy_s
_stricmp
strncpy
_wcsnicmp

api-ms-win-crt-convert-l1-1-0

atoi
_ltoa_s
strtol

api-ms-win-crt-filesystem-l1-1-0

remove
_lock_file
_unlock_file
rename

api-ms-win-crt-stdio-l1-1-0

fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
ungetc
setvbuf
feof
fopen
fputs
fgetc
fflush
setbuf
__stdio_common_vsprintf
freopen
getc
fclose
_get_stream_buffer_pointers
fopen_s
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__stdio_common_vswprintf
__acrt_iob_func
ferror
clearerr
fgets
rewind
ftell
fseek
_wfopen_s
ungetwc
fputwc
__stdio_common_vsscanf
fgetwc

api-ms-win-crt-runtime-l1-1-0

_initterm
_invalid_parameter_noinfo_noreturn
terminate
_cexit
_crt_atexit
_execute_onexit_table
_beginthreadex
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_errno
_control87
_initterm_e
strerror

api-ms-win-crt-time-l1-1-0

_gmtime64
_localtime64
_time64

api-ms-win-crt-math-l1-1-0

_libm_sse2_atan_precise
floor
_hypot
_fdclass
_CIfmod
_isnan
_libm_sse2_cos_precise
_CIatan2
ldexp
ceil
_libm_sse2_sqrt_precise
_libm_sse2_log_precise
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_libm_sse2_log10_precise
modf

api-ms-win-crt-utility-l1-1-0

qsort

Exports

Exports

AGMGetVersion
AGMInitialize
AGMTerminate

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 166KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 306KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/x86/AIDE.dll
.dll windows x86

Password: empress

35310b00e41c70ccb762d39f144b9fc0

Code Sign

01:1f:39:a2:26:1a:99:3d:d1:51:76:da:6f:e4:fb:ea
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-12-2020 00:00

Not After

21-12-2022 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:d5:86:13:9f:0e:a8:06:96:1c:b2:3f:07:d6:09:97:f4:49:9a:f0:b2:e5:e0:4c:e1:aa:15:bd:27:b5:8e:99
Signer

Actual PE Digest

f8:d5:86:13:9f:0e:a8:06:96:1c:b2:3f:07:d6:09:97:f4:49:9a:f0:b2:e5:e0:4c:e1:aa:15:bd:27:b5:8e:99

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

04-06-2022 23:20
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

windowscodecs

WICConvertBitmapSource

kernel32

InitializeSListHead
DisableThreadLibraryCalls
CloseHandle
WaitForSingleObject
CreateThread
GetSystemInfo
ReleaseSemaphore
CreateSemaphoreA
FreeLibrary
GetProcAddress
LoadLibraryA
ExitProcess
IsProcessorFeaturePresent
GetTempPathA
DeleteFileA
GetTempFileNameA
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
EnterCriticalSection

ole32

CoInitializeEx
CoCreateInstance
PropVariantClear

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

vcruntime140

__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
strstr
strrchr
_setjmp3
__CxxLongjmpUnwind
longjmp
memchr
memset
memmove
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
_purecall
__std_exception_copy
__std_terminate
memcpy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
exit
_initterm_e
_initterm
_cexit
_crt_atexit
abort
_wassert
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table

api-ms-win-crt-math-l1-1-0

ldexp
_libm_sse2_log10_precise
_libm_sse2_log_precise
floor
ceil
_libm_sse2_sqrt_precise
_CIatan2
frexp
_libm_sse2_pow_precise
_libm_sse2_exp_precise

api-ms-win-crt-heap-l1-1-0

malloc
_aligned_malloc
_aligned_free
free
calloc
realloc
_callnewh

api-ms-win-crt-stdio-l1-1-0

fopen_s
fseek
ftell
feof
__stdio_common_vsnprintf_s
fclose
fwrite
fflush
__stdio_common_vsprintf
fread
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-utility-l1-1-0

bsearch
srand
rand
qsort

api-ms-win-crt-string-l1-1-0

tolower
strncmp

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

??0AIDEDimension@AIDE@@QAE@II@Z
??0AIDEDimension@AIDE@@QAE@XZ
??0AIDEFormatType@AIDE@@QAE@H@Z
??0AIDEFormatType@AIDE@@QAE@XZ
??0AIDEInputOutputStreamCallBacks@AIDE@@QAE@XZ
??0AIDEInputStreamCallBacks@AIDE@@QAE@XZ
??0AIDELibInitCallBacks@AIDE@@QAE@XZ
??0AIDEOutputStreamCallBacks@AIDE@@QAE@XZ
??0AIDEPoint@AIDE@@QAE@II@Z
??0AIDEPoint@AIDE@@QAE@XZ
??0AIDEProgressCallback@AIDE@@QAE@XZ
??0ComponentInfo@AIDE@@QAE@IW4AIDEComponentType@1@@Z
??0ComponentInfo@AIDE@@QAE@XZ
??0PaletteInfo@AIDE@@QAE@XZ
??0PixelPartInfo@AIDE@@QAE@XZ
??1AIDEDimension@AIDE@@QAE@XZ
??1AIDEFormatType@AIDE@@QAE@XZ
??1AIDEInputOutputStreamCallBacks@AIDE@@QAE@XZ
??1AIDEInputStreamCallBacks@AIDE@@QAE@XZ
??1AIDELibInitCallBacks@AIDE@@QAE@XZ
??1AIDEOutputStreamCallBacks@AIDE@@QAE@XZ
??1AIDEPoint@AIDE@@QAE@XZ
??1AIDEProgressCallback@AIDE@@QAE@XZ
??1ComponentInfo@AIDE@@QAE@XZ
??1PaletteInfo@AIDE@@QAE@XZ
??1PixelPartInfo@AIDE@@QAE@XZ
??4AIDEDimension@AIDE@@QAEAAU01@ABU01@@Z
??4AIDEFormatType@AIDE@@QAEAAU01@ABU01@@Z
??4AIDEInputOutputStreamCallBacks@AIDE@@QAEAAU01@ABU01@@Z
??4AIDEInputStreamCallBacks@AIDE@@QAEAAU01@ABU01@@Z
??4AIDELayerSize@AIDE@@QAEAAU01@ABU01@@Z
??4AIDELibInitCallBacks@AIDE@@QAEAAU01@ABU01@@Z
??4AIDEOutputStreamCallBacks@AIDE@@QAEAAU01@ABU01@@Z
??4AIDEPoint@AIDE@@QAEAAU01@ABU01@@Z
??4AIDEProgressCallback@AIDE@@QAEAAU01@ABU01@@Z
??4ComponentInfo@AIDE@@QAEAAU01@ABU01@@Z
??4PaletteInfo@AIDE@@QAEAAU01@ABU01@@Z
??4PixelPartInfo@AIDE@@QAEAAU01@ABU01@@Z
?AIDEDecodeOptionsSetComponentOrder@@YA?AW4AIDEError@AIDE@@PAVDecodeOptions@Impl@2@W4AIDEComponentOrder@2@I@Z
?mVersion@AIDEInputOutputStreamCallBacks@AIDE@@2IB
?mVersion@AIDEInputStreamCallBacks@AIDE@@2IB
?mVersion@AIDELibInitCallBacks@AIDE@@2IB
?mVersion@AIDEOutputStreamCallBacks@AIDE@@2IB
?mVersion@AIDEProgressCallback@AIDE@@2IB
AIDECreateLibInstance
AIDEDecodeOptionsSetBitDepth
AIDEDecodeOptionsSetColorSpace
AIDEDecodeOptionsSetDirectDecode
AIDEDecodeOptionsSetImageOrientation
AIDEDecodeOptionsSetImageResampling
AIDEDecodeOptionsSetIntValue
AIDEDecodeOptionsSetMaxDimensions
AIDEDecodeOptionsSetNoDecodeErrors
AIDEDecodeOptionsSetPackingType
AIDEDecodeOptionsSetPalette
AIDEDecodeOptionsSetPrivateChunkNames
AIDEDecodeOptionsSetTransparency
AIDEDecoderDecodeNextImage
AIDEDecoderDecodeNextTile
AIDEDecoderFillPixelPartBuffers
AIDEDecoderGetColorInfo
AIDEDecoderGetColorSpace
AIDEDecoderGetCommonColorBitDepth
AIDEDecoderGetComponentCount
AIDEDecoderGetComponentInfo
AIDEDecoderGetDirectDecode
AIDEDecoderGetEXIF_1_Data
AIDEDecoderGetEXIF_3_Data
AIDEDecoderGetFormatType
AIDEDecoderGetGlobalTransparencyIndex
AIDEDecoderGetICCProfile
AIDEDecoderGetIPTCData
AIDEDecoderGetImageResolution
AIDEDecoderGetImageSize
AIDEDecoderGetMetaDataBlob
AIDEDecoderGetMetaDataBlobAtIndex
AIDEDecoderGetMetaDataBlobClientBuffer
AIDEDecoderGetMetaDataIntegerValue
AIDEDecoderGetPackingInfo
AIDEDecoderGetPaletteColorInfo
AIDEDecoderGetPaletteFullyTransparentValue
AIDEDecoderGetPaletteInfo
AIDEDecoderGetPaletteTransparencyType
AIDEDecoderGetPixelPartInfo
AIDEDecoderGetPixelPartInfoBigFilesSupported
AIDEDecoderGetTileInfo
AIDEDecoderGetTransparencyType
AIDEDecoderGetXMPData
AIDEDecoderHasPalettedComponent
AIDEDecoderSetMaxTileBufferSize
AIDEDecoderSetMaxTileBufferSizeBigFilesSupported
AIDEDestroyLibInstance
AIDEEncoderEncodeNRows
AIDEEncoderEncodeNextImage
AIDEEncoderFinishEncoding
AIDEEncoderGetFormatType
AIDEEncoderRegisterProgressCallback
AIDEEncoderSetColorSpace
AIDEEncoderSetCommonColorBitDepth
AIDEEncoderSetEXIF_1_Data
AIDEEncoderSetEXIF_3_Data
AIDEEncoderSetICCProfile
AIDEEncoderSetIPTCData
AIDEEncoderSetImageResampling
AIDEEncoderSetImageResolution
AIDEEncoderSetImageSize
AIDEEncoderSetMetaDataBlob
AIDEEncoderSetMetaDataIntegerValue
AIDEEncoderSetPaletteFullyTransparentIndex
AIDEEncoderSetPaletteInfo
AIDEEncoderSetPaletteTransparencyType
AIDEEncoderSetPixelPartInfo
AIDEEncoderSetPixelPartInfoBigFilesSupported
AIDEEncoderSetTileInfo
AIDEEncoderSetTransparencyType
AIDEEncoderSetXMPData
AIDEEncoderWriteHeader
AIDEEncoderWritePixelPartBuffers
AIDEJXREncodeOptionsSetAlphaChannelFormat
AIDEJXREncodeOptionsSetAlphaChannelQuality
AIDEJXREncodeOptionsSetBitStreamOrdering
AIDEJXREncodeOptionsSetChromaSubSampling
AIDEJXREncodeOptionsSetCompressionType
AIDEJXREncodeOptionsSetImageQuality
AIDEJXREncodeOptionsSetOverlapLevel
AIDEJXREncodeOptionsSetTilingSlices
AIDEJpegEncodeOptionsSetAIQuality
AIDEJpegEncodeOptionsSetCustomQuality
AIDEJpegEncodeOptionsSetEncodeMethod
AIDEJpegEncodeOptionsSetEncodeMode
AIDEJpegEncodeOptionsSetPackingType
AIDEJpegEncodeOptionsSetQualityLevel
AIDEJpegEncodeOptionsSetSave4WebQuality
AIDEJpegEncodeOptionsSetUseClipping
AIDELibBuildDate
AIDELibCreateBmpEncodeOptions
AIDELibCreateDecodeOptions
AIDELibCreateDecoder
AIDELibCreateDecoderForFormatType
AIDELibCreateEncoderForBMP
AIDELibCreateEncoderForGIF
AIDELibCreateEncoderForICON
AIDELibCreateEncoderForJPEG
AIDELibCreateEncoderForJXR
AIDELibCreateEncoderForPDF
AIDELibCreateEncoderForPNG
AIDELibCreateEncoderForRAW
AIDELibCreateEncoderForTIFF
AIDELibCreateEncoderForWEBP
AIDELibCreateGifEncodeOptions
AIDELibCreateIconEncodeOptions
AIDELibCreateInputOutputStream
AIDELibCreateInputStream
AIDELibCreateInputStreamUncached
AIDELibCreateJXREncodeOptions
AIDELibCreateJpegEncodeOptions
AIDELibCreateOutputStream
AIDELibCreatePdfEncodeOptions
AIDELibCreatePngEncodeOptions
AIDELibCreateRawEncodeOptions
AIDELibCreateTiffEncodeOptions
AIDELibCreateWebPEncodeOptions
AIDELibDestroyBmpEncodeOptions
AIDELibDestroyDecodeOptions
AIDELibDestroyDecoder
AIDELibDestroyEncoder
AIDELibDestroyGifEncodeOptions
AIDELibDestroyIconEncodeOptions
AIDELibDestroyInputOutputStream
AIDELibDestroyInputStream
AIDELibDestroyJXREncodeOptions
AIDELibDestroyJpegEncodeOptions
AIDELibDestroyOutputStream
AIDELibDestroyPdfEncodeOptions
AIDELibDestroyPngEncodeOptions
AIDELibDestroyRawEncodeOptions
AIDELibDestroyTiffEncodeOptions
AIDELibDestroyWebPEncodeOptions
AIDELibVersion
AIDEPngEncodeOptionsSetAttemptPaletteCreation
AIDEPngEncodeOptionsSetCompressionLevel
AIDEPngEncodeOptionsSetForcedPaletteCreation
AIDEPngEncodeOptionsSetInterlaced
AIDEPngEncodeOptionsSetPHYChunk
AIDEPngEncodeOptionsSetPalettizationTechnique
AIDERawEncodeOptionsSetBlurMethod
AIDETiffEncodeOptionsDiableLayer
AIDETiffEncodeOptionsSetCompressionScheme
AIDETiffEncodeOptionsSetCustomEncodeParams
AIDETiffEncodeOptionsSetPyramidParams
AIDETiffEncodeOptionsSetPyramidParamsCustomLayers
AIDETiffEncodeOptionsSetTileSize
AIDEWebPEncodeOptionsSetCompressionType
AIDEWebPEncodeOptionsSetImageQuality
AIDEWritePrivateChunk

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/x86/AdobeXMP.dll
.dll windows x86

Password: empress

6af9b18d0fde4654e8b2a5c75a9563ec

Code Sign

01:1f:39:a2:26:1a:99:3d:d1:51:76:da:6f:e4:fb:ea
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-12-2020 00:00

Not After

21-12-2022 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:5e:8f:63:35:31:dd:76:c0:23:f7:3e:30:cc:20:bd:18:56:20:a3:bc:89:98:1f:61:7a:d9:b1:13:2c:c5:f8
Signer

Actual PE Digest

16:5e:8f:63:35:31:dd:76:c0:23:f7:3e:30:cc:20:bd:18:56:20:a3:bc:89:98:1f:61:7a:d9:b1:13:2c:c5:f8

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

04-06-2022 23:21
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
GetSystemTimeAsFileTime
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
CloseHandle
DeleteCriticalSection
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount

ole32

CoCreateGuid

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?uncaught_exception@std@@YA_NXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

vcruntime140

_except_handler4_common
__std_type_info_destroy_list
_CxxThrowException
__std_type_info_compare
memcmp
_purecall
__std_exception_copy
memcpy
memmove
__std_exception_destroy
__std_terminate
__CxxFrameHandler3
__RTDynamicCast
memset
memchr

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_invalid_parameter_noinfo_noreturn
_cexit
_seh_filter_dll
_initterm
_initterm_e
_errno
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

strncmp
strlen
strcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
realloc

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char
setlocale

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_localtime64_s
_mktime64
_time64
_difftime64

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

WXMPDocOps_BranchXMP_1
WXMPDocOps_CTor_1
WXMPDocOps_Clone_1
WXMPDocOps_CreateID_1
WXMPDocOps_DecrementRefCount_1
WXMPDocOps_EnsureIDsExist_1
WXMPDocOps_GetMetaRef_1
WXMPDocOps_GetPartChangeID_1
WXMPDocOps_HasPartChanged_1
WXMPDocOps_IncrementRefCount_1
WXMPDocOps_IsDirty_1
WXMPDocOps_NewXMP_1
WXMPDocOps_NoteChange_1
WXMPDocOps_OpenXMP_1
WXMPDocOps_PrepareForSave_1
WXMPDocOps_SetAppName_1
WXMPIterator_DecrementRefCount_1
WXMPIterator_IncrementRefCount_1
WXMPIterator_Next_1
WXMPIterator_PropCTor_1
WXMPIterator_Skip_1
WXMPIterator_TableCTor_1
WXMPMeta_AppendArrayItem_1
WXMPMeta_CTor_1
WXMPMeta_Clone_1
WXMPMeta_CountArrayItems_1
WXMPMeta_DecrementRefCount_1
WXMPMeta_DeleteArrayItem_1
WXMPMeta_DeleteLocalizedText_1
WXMPMeta_DeleteNamespace_1
WXMPMeta_DeleteProperty_1
WXMPMeta_DeleteQualifier_1
WXMPMeta_DeleteStructField_1
WXMPMeta_DoesArrayItemExist_1
WXMPMeta_DoesPropertyExist_1
WXMPMeta_DoesQualifierExist_1
WXMPMeta_DoesStructFieldExist_1
WXMPMeta_DumpNamespaces_1
WXMPMeta_DumpObject_1
WXMPMeta_DumpPropertyTraits_1
WXMPMeta_Erase_1
WXMPMeta_GetArrayItem_1
WXMPMeta_GetGlobalOptions_1
WXMPMeta_GetIXMPMetadata_1
WXMPMeta_GetLocalizedText_1
WXMPMeta_GetMemProcs_1
WXMPMeta_GetNamespacePrefix_1
WXMPMeta_GetNamespaceURI_1
WXMPMeta_GetObjectName_1
WXMPMeta_GetObjectOptions_1
WXMPMeta_GetProperty_1
WXMPMeta_GetProperty_Bool_1
WXMPMeta_GetProperty_Date_1
WXMPMeta_GetProperty_Float_1
WXMPMeta_GetProperty_Int64_1
WXMPMeta_GetProperty_Int_1
WXMPMeta_GetQualifier_1
WXMPMeta_GetStructField_1
WXMPMeta_GetVersionInfo_1
WXMPMeta_GetXMPDOMFactoryInstance_1
WXMPMeta_IncrementRefCount_1
WXMPMeta_Initialize_1
WXMPMeta_MarkStaleProperties_1
WXMPMeta_ParseFromBuffer_1
WXMPMeta_RegisterAssertNotify_1
WXMPMeta_RegisterNamespace_1
WXMPMeta_RegisterPropertyTraits_1
WXMPMeta_ResetErrorCallbackLimit_1
WXMPMeta_SerializeToBuffer_1
WXMPMeta_SetArrayItem_1
WXMPMeta_SetDefaultErrorCallback_1
WXMPMeta_SetErrorCallback_1
WXMPMeta_SetGlobalOptions_1
WXMPMeta_SetLocalizedText_1
WXMPMeta_SetObjectName_1
WXMPMeta_SetObjectOptions_1
WXMPMeta_SetProperty_1
WXMPMeta_SetProperty_Bool_1
WXMPMeta_SetProperty_Date_1
WXMPMeta_SetProperty_Float_1
WXMPMeta_SetProperty_Int64_1
WXMPMeta_SetProperty_Int_1
WXMPMeta_SetQualifier_1
WXMPMeta_SetStructField_1
WXMPMeta_Sort_1
WXMPMeta_Terminate_1
WXMPMeta_UnregisterAssertNotify_1
WXMPMeta_Use_CPP_DOM_APIs_1
WXMPUtils_AppendProperties_1
WXMPUtils_ApplyTemplate_1
WXMPUtils_CatenateArrayItems_1
WXMPUtils_CollectMultiFileXMP_1
WXMPUtils_CompareDateTime_1
WXMPUtils_ComposeArrayItemPath_1
WXMPUtils_ComposeFieldSelector_1
WXMPUtils_ComposeLangSelector_1
WXMPUtils_ComposeQualifierPath_1
WXMPUtils_ComposeStructFieldPath_1
WXMPUtils_ConvertFromBool_1
WXMPUtils_ConvertFromDate_1
WXMPUtils_ConvertFromFloat_1
WXMPUtils_ConvertFromInt64_1
WXMPUtils_ConvertFromInt_1
WXMPUtils_ConvertToBool_1
WXMPUtils_ConvertToDate_1
WXMPUtils_ConvertToFloat_1
WXMPUtils_ConvertToInt64_1
WXMPUtils_ConvertToInt_1
WXMPUtils_ConvertToLocalTime_1
WXMPUtils_ConvertToUTCTime_1
WXMPUtils_CurrentDateTime_1
WXMPUtils_DecodeFromBase64_1
WXMPUtils_DistributeMultiFileXMP_1
WXMPUtils_DuplicateSubtree_1
WXMPUtils_EncodeToBase64_1
WXMPUtils_GetBulkMarkers_1
WXMPUtils_GetDateRange_1
WXMPUtils_GetMergedListPath_1
WXMPUtils_IsPropertyMultiValued_1
WXMPUtils_MergeFromJPEG_1
WXMPUtils_PackageForJPEG_1
WXMPUtils_RemoveMultiValueInfo_1
WXMPUtils_RemoveProperties_1
WXMPUtils_SeparateArrayItems_1
WXMPUtils_SetBulkMarkers_1
WXMPUtils_SetTimeZone_1
XMP_GetAssertNotify
XMP_NewExpatAdapter

Sections

.text
Size: 648KB - Virtual size: 647KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/x86/BIB.dll
.dll windows x86

Password: empress

1d0257e1aac91706ba5a3464d653bbcc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:52:96:f8:fc:d8:29:a7:5d:c9:42:94:f5:a4:15:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29-04-2022 00:00

Not After

01-05-2024 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:82:9e:48:90:6d:15:fd:16:9a:60:b0:00:eb:8a:88:89:43:56:6f:3a:83:a7:8a:ce:a5:dc:73:8f:9c:69:84
Signer

Actual PE Digest

4e:82:9e:48:90:6d:15:fd:16:9a:60:b0:00:eb:8a:88:89:43:56:6f:3a:83:a7:8a:ce:a5:dc:73:8f:9c:69:84

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

04-07-2022 20:10
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
CloseHandle
QueryPerformanceCounter
InitializeCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetSystemTimeAsFileTime
GetModuleHandleA
GetProcAddress
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetACP
Sleep
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeSListHead

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
memset
__std_exception_destroy
_purecall
memcpy
__std_terminate
__CxxFrameHandler3
memmove
_CxxThrowException
__current_exception
__std_exception_copy
__RTDynamicCast

api-ms-win-crt-string-l1-1-0

strlen
strcmp

api-ms-win-crt-stdio-l1-1-0

fseek
fread
fopen
fflush
ferror
fwrite
feof
fclose
ftell
_wfopen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_invalid_parameter_noinfo
terminate
_errno
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit

api-ms-win-crt-math-l1-1-0

log

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

Exports

Exports

BIBGetGetProcAddress
BIBGetVersion
BIBInitialize
BIBInitialize2
BIBInitialize3
BIBInitialize4
BIBLockSmithAssertNoLocksImpl
BIBLockSmithDeleteImpl
BIBLockSmithLockImpl
BIBLockSmithUnlockImpl
BIBTerminate

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/x86/BIBUtils.dll
.dll windows x86

6ec1b6b05b219bb02c165a7efc6c6592

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:52:96:f8:fc:d8:29:a7:5d:c9:42:94:f5:a4:15:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29-04-2022 00:00

Not After

01-05-2024 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:8d:86:7f:c2:82:50:d9:cf:83:97:16:d4:b7:e0:83:50:ed:25:f8:63:08:ac:60:eb:c3:64:24:4e:0f:c7:40
Signer

Actual PE Digest

04:8d:86:7f:c2:82:50:d9:cf:83:97:16:d4:b7:e0:83:50:ed:25:f8:63:08:ac:60:eb:c3:64:24:4e:0f:c7:40

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

04-07-2022 20:10
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleHandleA
GetProcAddress
GetCurrentDirectoryA
GetTempPathA
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead

vcruntime140

_except_handler4_common
__std_type_info_destroy_list
_purecall
__std_terminate
__std_exception_copy
memset
memcpy
__RTDynamicCast
__CxxFrameHandler3
_CxxThrowException
strstr
__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_seh_filter_dll
_errno
_configure_narrow_argv
_initterm
_initterm_e
_invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

strcspn
isdigit
isprint
isalpha
strspn

api-ms-win-crt-convert-l1-1-0

atof
atoi

api-ms-win-crt-filesystem-l1-1-0

rename
remove
_stat64i32

api-ms-win-crt-stdio-l1-1-0

_sopen_dispatch
__stdio_common_vsscanf
_close
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

Exports

Exports

BIBUtilsGetVersion
BIBUtilsInitialize
BIBUtilsTerminate

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/x86/CoolType.dll
.dll windows x86

4802bc9f23feb1a2452c8519e072c9db

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:52:96:f8:fc:d8:29:a7:5d:c9:42:94:f5:a4:15:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29-04-2022 00:00

Not After

01-05-2024 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:22:f2:13:c9:82:c5:d8:5e:42:5f:71:26:d1:af:c2:d7:7d:3c:3d:aa:70:fb:be:55:61:45:17:02:f8:a2:66
Signer

Actual PE Digest

df:22:f2:13:c9:82:c5:d8:5e:42:5f:71:26:d1:af:c2:d7:7d:3c:3d:aa:70:fb:be:55:61:45:17:02:f8:a2:66

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

04-07-2022 20:10
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
LocalFree
GetSystemDefaultLCID
GetUserDefaultLCID
CreateEventA
GetVersionExA
GetSystemTime
SystemTimeToFileTime
GetLastError
GetACP
FileTimeToLocalFileTime
FileTimeToSystemTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
FlushFileBuffers
GetCurrentProcess
MoveFileExW
VerSetConditionMask
IsProcessorFeaturePresent
GetSystemInfo
VerifyVersionInfoW
FreeLibrary
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
SetLastError
GetTickCount
WaitForMultipleObjects
FindNextChangeNotification
FindCloseChangeNotification
FindClose
GetCurrentProcessId
lstrlenA
CreateFileA
WaitForSingleObject
ResetEvent
SetEvent
CompareStringA
GetPrivateProfileStringA
SetFilePointer
ReadFile
GetFileSize
ReadDirectoryChangesW
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
StartThreadpoolIo
CancelThreadpoolIo
CreateThreadpoolIo
CloseHandle
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WriteFile
InitializeCriticalSection
VirtualQuery
VirtualProtect
RaiseException
InitializeSListHead

user32

GetDC
ReleaseDC
MonitorFromPoint
DestroyWindow
CreateWindowExA
RegisterClassA
GetDesktopWindow
DefWindowProcA

gdi32

SetTextAlign
SetBkMode
GetTextExtentPointI
GetDeviceCaps
GdiFlush
ExtTextOutA
GetObjectA
GetTextMetricsA
SetTextColor
SetBkColor
PatBlt
GetTextExtentPointA
GetCurrentObject
GetCharABCWidthsA
GetBitmapBits
CreateBitmap
SelectObject
GetFontData
DeleteDC
CreateCompatibleDC
DeleteObject

advapi32

ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegGetValueW

shell32

SHGetKnownFolderPath
SHGetMalloc
SHGetFolderPathW
SHGetSpecialFolderLocation

ole32

CoGetClassObject
CoInitializeEx
CoUninitialize
CoTaskMemFree

msvcp140

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_Xlength_error@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?_Random_device@std@@YAIXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z

vcruntime140

strchr
_purecall
__std_exception_copy
__std_exception_destroy
__RTDynamicCast
strstr
wcsstr
memcmp
wcschr
memchr
strrchr
__CxxLongjmpUnwind
__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
_setjmp3
memset
memcpy
__std_terminate
memmove
__CxxFrameHandler3
_CxxThrowException
wcsrchr
longjmp

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_initterm_e
_configure_narrow_argv
_set_thread_local_invalid_parameter_handler
_initterm
terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_initialize_narrow_environment
_errno
_invalid_parameter_noinfo
_initialize_onexit_table
_register_onexit_function
abort

api-ms-win-crt-string-l1-1-0

isupper
strspn
wcsncmp
wcsnlen
wcscmp
wcscpy_s
wcscat_s
strcspn
wcstok_s
strlen
strcat
wcsncat_s
strpbrk
toupper
strtok_s
strtok
isxdigit
isalnum
isdigit
tolower
wcslen
isspace
strcmp
wcscat
_wcsnicmp
_wcsicmp
wcsncpy_s
strncpy
strncmp
strcpy
isalpha
wcscpy
towupper

api-ms-win-crt-utility-l1-1-0

rand
labs
qsort
bsearch
abs

api-ms-win-crt-stdio-l1-1-0

fgets
_get_stream_buffer_pointers
setvbuf
_wfopen
ungetc
fwrite
_fseeki64
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
fputc
fsetpos
__stdio_common_vsnprintf_s
fgetpos
__stdio_common_vfprintf_s
gets_s
__stdio_common_vfwprintf_s
__stdio_common_vfprintf
__stdio_common_vsprintf_s
fread
__acrt_iob_func
clearerr
feof
ferror
_fileno
fputs
fseek
ftell
_get_osfhandle
_open_osfhandle
fgetwc
fputwc
fgetc
fflush
ungetwc
fclose

api-ms-win-crt-math-l1-1-0

_except1
_fdopen
log
atan2
floor
asin
log10
tan
ceil
atan
fabs
pow
sqrt

api-ms-win-crt-convert-l1-1-0

atol
strtol
strtoul
atoi
_ui64tow_s
_ltow_s
_ultow_s
strtof
_i64tow_s
_itoa_s
_ltoa_s
_ultoa_s
mbstowcs_s
_itow_s
strtod
_ui64toa_s
_i64toa_s

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_makepath_s
_wremove
_waccess
_stat64i32
_wsplitpath_s
_wfullpath
_splitpath_s

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
_mktime64
_gmtime64

Exports

Exports

CTCleanup
CTGetVersion
CTInit

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 743KB - Virtual size: 743KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 107KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hogwarts Legacy by EMPRESS/x86/JP2KLib.dll
.dll windows x86

83b05223f39b8593905fca1ffc7a2eba

Code Sign

01:1f:39:a2:26:1a:99:3d:d1:51:76:da:6f:e4:fb:ea
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-12-2020 00:00

Not After

21-12-2022 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:1b:1d:8f:72:c6:d6:23:4d:16:57:a6:90:20:b0:b6:bb:8e:cd:6f:4b:f7:aa:de:e3:22:ec:4a:ea:5f:87:18
Signer

Actual PE Digest

58:1b:1d:8f:72:c6:d6:23:4d:16:57:a6:90:20:b0:b6:bb:8e:cd:6f:4b:f7:aa:de:e3:22:ec:4a:ea:5f:87:18

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

04-06-2022 23:21
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

vcruntime140

__current_exception
__std_type_info_destroy_list
_CxxThrowException
memset
__current_exception_context
_except_handler4_common
__CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

_libm_sse2_sqrt_precise
_except1
log10
_libm_sse2_pow_precise
fabs
ceil
sqrt
pow
_libm_sse2_log_precise

api-ms-win-crt-string-l1-1-0

strncmp
strlen

api-ms-win-crt-utility-l1-1-0

abs

api-ms-win-crt-stdio-l1-1-0

fputc
fflush
fclose
__acrt_iob_func
putc
fwrite
__stdio_common_vfprintf
fopen_s

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
_initialize_onexit_table
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free

kernel32

InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId

Exports

Exports

??0JP2KCodeStm@@QAE@XZ
??0JP2KMemFuncs@@QAE@XZ
??0JP2KMemFuncsEx@@QAE@XZ
??1JP2KCodeStm@@QAE@XZ
??4IJP2KException@@QAEAAV0@$$QAV0@@Z
??4IJP2KException@@QAEAAV0@ABV0@@Z
??4JP2KBufID_I@@QAEAAU0@$$QAU0@@Z
??4JP2KBufID_I@@QAEAAU0@ABU0@@Z
??4JP2KClientData@@QAEAAU0@$$QAU0@@Z
??4JP2KClientData@@QAEAAU0@ABU0@@Z
??4JP2KClientProcs@@QAEAAU0@$$QAU0@@Z
??4JP2KClientProcs@@QAEAAU0@ABU0@@Z
??4JP2KCodeStm@@QAEAAV0@ABV0@@Z
??4JP2KDecOpt@@QAEAAU0@$$QAU0@@Z
??4JP2KDecOpt@@QAEAAU0@ABU0@@Z
??4JP2KEncOpt@@QAEAAU0@$$QAU0@@Z
??4JP2KEncOpt@@QAEAAU0@ABU0@@Z
??4JP2KException@@QAEAAU0@$$QAU0@@Z
??4JP2KException@@QAEAAU0@ABU0@@Z
??4JP2KImageDataParms@@QAEAAU0@$$QAU0@@Z
??4JP2KImageDataParms@@QAEAAU0@ABU0@@Z
??4JP2KImageDataProcs@@QAEAAU0@$$QAU0@@Z
??4JP2KImageDataProcs@@QAEAAU0@ABU0@@Z
??4JP2KMemFuncs@@QAEAAU0@$$QAU0@@Z
??4JP2KMemFuncs@@QAEAAU0@ABU0@@Z
??4JP2KMemFuncsEx@@QAEAAU0@$$QAU0@@Z
??4JP2KMemFuncsEx@@QAEAAU0@ABU0@@Z
??4JP2KStreamProcs@@QAEAAU0@$$QAU0@@Z
??4JP2KStreamProcs@@QAEAAU0@ABU0@@Z
??4JP2KStreamProcsEx@@QAEAAU0@$$QAU0@@Z
??4JP2KStreamProcsEx@@QAEAAU0@ABU0@@Z
??4JP2KUserActions@@QAEAAU0@$$QAU0@@Z
??4JP2KUserActions@@QAEAAU0@ABU0@@Z
?ClearErrState@IJP2KException@@QAEXXZ
?Clone@IJP2KException@@QAEXPAV1@@Z
?Die@JP2KCodeStm@@QAEXXZ
?GetCurPos@JP2KCodeStm@@QAE_JXZ
?GetErrString@IJP2KException@@QAEPADXZ
?GetOpenMode@JP2KCodeStm@@QAE?AW4JP2KStmOpenMode@@XZ
?GetStmBase@JP2KCodeStm@@QAEPAXXZ
?GetStmProcs@JP2KCodeStm@@QAEPAUJP2KStreamProcsEx@@XZ
?GetTotalLength@JP2KCodeStm@@QAE_KXZ
?InitJP2KCodeStm@JP2KCodeStm@@QAEH_KHPAXPAUJP2KStreamProcsEx@@W4JP2KStmOpenMode@@H@Z
?IsReadable@JP2KCodeStm@@QAE_NXZ
?IsSeekable@JP2KCodeStm@@QAE_NXZ
?IsWritable@JP2KCodeStm@@QAE_NXZ
?ReadOnly@JP2KCodeStm@@QAE_NXZ
?StmLengthUnknown@JP2KCodeStm@@QAE_NXZ
?TellPos@JP2KCodeStm@@QAE_JXZ
?WriteOnly@JP2KCodeStm@@QAE_NXZ
?flushWriteBuffer@JP2KCodeStm@@QAEHXZ
?read@JP2KCodeStm@@QAEHPAEH@Z
?seek@JP2KCodeStm@@QAE_JH_J@Z
?write@JP2KCodeStm@@QAEHPAEH@Z
CIEParamsAreDefaults
ColorSpecIsJP2Compatibile
InitDefaultCIEParams
JP2KCopyRect
JP2KDecOptCreate
JP2KDecOptDestroy
JP2KDecOptInitToDefaults
JP2KEncOptClone
JP2KEncOptCreate
JP2KEncOptDestroy
JP2KEncOptGetGeomParams
JP2KEncOptInitToDefaults
JP2KEncOptInitToDefaultsUsingImageGeometry
JP2KGetMemObj
JP2KGetMemObjEx
JP2KImageCompletedDecoding
JP2KImageCompressAndWriteTile
JP2KImageCompressImage
JP2KImageCompressTile
JP2KImageCreate
JP2KImageDataCreate
JP2KImageDataDestroy
JP2KImageDataFreeImageBuffer
JP2KImageDataGetHeight
JP2KImageDataGetImageBuffer
JP2KImageDataGetSizeofImageDataType
JP2KImageDataGetWidth
JP2KImageDataInit
JP2KImageDataSetHeight
JP2KImageDataSetImageBuffer
JP2KImageDataSetImageBufferType
JP2KImageDataSetSizeOfImageDataType
JP2KImageDataSetWidth
JP2KImageDecodeImageRegion
JP2KImageDecodeImageWithoutSeeking
JP2KImageDecodeTileInterleaved
JP2KImageDecodeTileInterleavedIncremental
JP2KImageDecodeTilePlanar
JP2KImageDestroy
JP2KImageEncodeImage
JP2KImageEstimatePeakDecodeMemoryRequirement
JP2KImageEstimateSizeofRegionToDecode
JP2KImageFileIsJP2K
JP2KImageFileIsJP2KEx
JP2KImageFindQualityNumbersEmbedded
JP2KImageGeometryComputeTransformedPoint
JP2KImageGeometryComputeTransformedPointUsingOrientations
JP2KImageGeometryComputeTransformedRect
JP2KImageGeometryComputeTransformedRectUsingOrientations
JP2KImageGeometryCopyInit
JP2KImageGeometryCreate
JP2KImageGeometryDestroy
JP2KImageGeometryGetImageResolutionBoundingBox
JP2KImageGeometryGetNumXTiles
JP2KImageGeometryGetNumYTiles
JP2KImageGeometryGetParams
JP2KImageGeometryGetTileBoundingBox
JP2KImageGeometryGetTileCompBoundingBox
JP2KImageGeometryGetTileCompResolutionBoundingBox
JP2KImageGeometryGetTileNum
JP2KImageGeometryGetTileResolutionBoundingBox
JP2KImageGeometryGetTileResolutionBoundingBoxOfRegion
JP2KImageGeometryGetXIndex
JP2KImageGeometryGetYIndex
JP2KImageGeometryInit
JP2KImageGeometryMapCanvasCoordRectToComponentRect
JP2KImageGeometryMapCanvasCoordRectToLowerResComponentRect
JP2KImageGeometryMapRectToLowerRes
JP2KImageGeometryParamsAreInConsistent
JP2KImageGeometryTransformRect
JP2KImageGeometryTransformRectUsingOrientations
JP2KImageGetAlphaChannelCodeStreamSize
JP2KImageGetBitDepths
JP2KImageGetChannelIndex
JP2KImageGetChromaKey
JP2KImageGetClientData
JP2KImageGetCodeStream
JP2KImageGetColorSpecList
JP2KImageGetComponentType
JP2KImageGetDecodeOptions
JP2KImageGetDecodedImage
JP2KImageGetEncodeOptions
JP2KImageGetErrorDetails
JP2KImageGetGMLData
JP2KImageGetGeometryParams
JP2KImageGetGlobalTransparencyChannelNum
JP2KImageGetICCProfile
JP2KImageGetInterleavedColorData
JP2KImageGetMaxCodeStreamLength
JP2KImageGetMaxRes
JP2KImageGetMemObj
JP2KImageGetMemObjEx
JP2KImageGetMinCodeStreamLength
JP2KImageGetNumColorChannels
JP2KImageGetNumComponents
JP2KImageGetNumComponentsDoneInProgPlay
JP2KImageGetNumQualitySteps
JP2KImageGetNumTileComps
JP2KImageGetNumTiles
JP2KImageGetNumUUIDBoxes
JP2KImageGetNumXMLBoxes
JP2KImageGetOrientationForDecode
JP2KImageGetPalette
JP2KImageGetPreviewData
JP2KImageGetPreviewDataOfRegion
JP2KImageGetStreamProcs
JP2KImageGetStreamProcsEx
JP2KImageGetTempFileStream
JP2KImageGetTileComponent
JP2KImageGetTransparencyChannelNum
JP2KImageGetTransparencyCodeStreamSize
JP2KImageGetTransparencyType
JP2KImageGetUUIDBoxes
JP2KImageGetXMLBoxes
JP2KImageGlobalTransparencyChannelPresent
JP2KImageIncrementalDecodingIsEnabled
JP2KImageIncrementalDecodingIsRequired
JP2KImageInitDecoder
JP2KImageInitDecoderEx
JP2KImageInitEncoder
JP2KImageInitEncoderEx
JP2KImageIsGMLDataPresent
JP2KImageNumProgresionStepsInCompressImage
JP2KImageNumProgressionStepsInEncodeImage
JP2KImageOptimizeImage
JP2KImagePalettePresent
JP2KImagePlay
JP2KImagePlayProgression
JP2KImagePlayProgressionStart
JP2KImagePlayProgressionStop
JP2KImageReorderCodeStream
JP2KImageResolutionInfoPresent
JP2KImageRewind
JP2KImageSetAlphaChannelsForPreview
JP2KImageSetOrientationForDecode
JP2KImageSetReplayOptions
JP2KImageSkipDecodingOfAlphaChannels
JP2KImageTransparencyChannelPresent
JP2KImageUUIDPresent
JP2KImageUpdateCodestreamSize
JP2KImageValidate
JP2KImageWriteJPXHeaders
JP2KImageXMLPresent
JP2KImageZoom
JP2KLibBuildDate
JP2KLibInit
JP2KLibInitEx
JP2KLibShutDown
JP2KLibVersion
JP2KTileComponentGetDecOpt
JP2KTileComponentGetDecodeParams
JP2KTileComponentGetEncOpt
JP2KTileComponentGetHeight
JP2KTileComponentGetOutputImage
JP2KTileComponentGetProgData
JP2KTileComponentGetTileGeometryParams
JP2KTileComponentGetWaveletData
JP2KTileComponentGetWidth
JP2KTileComponentReleaseWaveletData
JP2KTileComponentResetTileCompDataIsValid
JP2KTileComponentResetTileCompDataReady
JP2KTileComponentSetDecodeOptions
JP2KTileComponentSetDecodeParams
JP2KTileComponentSetEncodeOptions
JP2KTileComponentSetIsAlphaChannel
JP2KTileComponentSetOutputImage
JP2KTileComponentSetProgData
JP2KTileComponentSetTileCompDataIsValid
JP2KTileComponentSetTileCompDataReady
JP2KTileComponentSetTileGeometryParams
JP2KTileComponentSetWaveletData
JP2KTileComponentTileCompDataIsValid
JP2KTileComponentTileCompDataReady
JP2KTileComponentValidate
JP2KTileGeometryCreate
JP2KTileGeometryDestroy
JP2KTileGeometryGetResolutionCoords
JP2KTileGeometryGetResolutionCoordsofRegion
JP2KTileGeometryInit
JP2KTileGeometryInitUsingTileIndices
JP2KTileGeometryRegionIsTile

Sections

.text
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: empress

Password: empress

76ab0bd1c8f81a651bad2440e8635ea7

Code Sign

01:1f:39:a2:26:1a:99:3d:d1:51:76:da:6f:e4:fb:eaCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

1c:2f:68:ed:48:e5:91:c1:45:d1:4d:68:70:fe:ac:64:7d:a0:52:98:33:fe:f1:c9:4e:23:5c:bc:89:84:2b:90Signer

Signature Validations

Verification

24-12-2021 10:42 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

dcomp

kernel32

user32

ole32

d2d1

d3d11

gdiplus

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 6KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

Password: empress

0d2bc4f44be56e5f23a4ed8ea9899cb0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 60KB - Virtual size: 60KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 176KB - Virtual size: 179KB

.rsrc Size: 2KB - Virtual size: 1KB

Password: empress

85fa29bd3c72ce2d14f3f8e4207261d4

Headers

DLL Characteristics

File Characteristics

Imports

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 347KB - Virtual size: 346KB

.rdata Size: 42KB - Virtual size: 41KB

.data Size: 139KB - Virtual size: 140KB

.pdata Size: 16KB - Virtual size: 15KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 2KB - Virtual size: 2KB

Password: empress

23076d501d734740bd988395f9a2bdc0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

01:1f:39:a2:26:1a:99:3d:d1:51:76:da:6f:e4:fb:ea
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

1c:2f:68:ed:48:e5:91:c1:45:d1:4d:68:70:fe:ac:64:7d:a0:52:98:33:fe:f1:c9:4e:23:5c:bc:89:84:2b:90
Signer

24-12-2021 10:42
Valid: true

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 6KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 60KB - Virtual size: 60KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 176KB - Virtual size: 179KB

.rsrc
Size: 2KB - Virtual size: 1KB

.text
Size: 347KB - Virtual size: 346KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 139KB - Virtual size: 140KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 2KB - Virtual size: 2KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:52:96:f8:fc:d8:29:a7:5d:c9:42:94:f5:a4:15:a4
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

15:ad:5d:15:fc:72:09:57:11:7f:e0:d3:ae:46:a9:a5:57:76:b6:2d:5c:5f:30:2e:cb:74:93:a1:44:12:fb:31
Signer

04-07-2022 20:10
Valid: true

.text
Size: 844KB - Virtual size: 843KB

.rdata
Size: 248KB - Virtual size: 247KB

.data
Size: 7KB - Virtual size: 13KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 46KB - Virtual size: 45KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:52:96:f8:fc:d8:29:a7:5d:c9:42:94:f5:a4:15:a4
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

8f:e0:d2:5a:90:d1:6b:ae:1a:ac:33:7e:43:cd:1b:9d:1a:a2:81:49:42:ab:65:f1:e9:0d:38:e7:3a:26:df:38
Signer

04-07-2022 20:10
Valid: true