Saphire (win)[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Saphire (win).rar
Size

309.4MB
MD5

21238cd7bc93cbe2e880eeda416c761a
SHA1

84897a4f25de66e5e1ec649d94be340a6f799bb9
SHA256

2133019cefbd75c8860b8538db7f2231fb5e00e4008967b68b067f667074181a
SHA512

ec16a051bd7df1994971ee8beae074f6a92abe684464b57ed5c2f8443831d3808b32c72d6ac52feff4597f174dda5bb4976e6152f2d09f9df1166a568940a91d
SSDEEP

6291456:9g2WHJ+25BFfj5MI9C1y7XbMJlYe/jb4t5pRDC4QW:9tgMwjh9p44ajbW7Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Saphire/step 3/bfx-license-tool/bfx-license-tool.exe
unpack001/Saphire/step 3/lib64/sapphire_ae.dll

Files

Saphire (win).rar
.rar

Password: time
Saphire/Read me.txt
Saphire/Step 4/GenArts/rlm/vr.lic
Saphire/Step 4/put this in.txt
Saphire/sapphire-ae-install-2020.exe
.exe windows x86

Password: time

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3e:06:93:c7:56:88:dd:c6:37:a7:1b:df:af:e6:0b:f1
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

11/12/2018, 00:00

Not After

21/12/2019, 23:59

Subject

CN=ARTEL SOFTWARE CORPORATION,O=ARTEL SOFTWARE CORPORATION,L=Boston,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:8d:ec:1f:3b:e5:25:fa:79:df:91:37:81:22:7d:d1:14:0b:ea:ec
Signer

Actual PE Digest

50:8d:ec:1f:3b:e5:25:fa:79:df:91:37:81:22:7d:d1:14:0b:ea:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Saphire/step 3/bfx-license-tool/bfx-license-tool.exe
.exe windows x86

Password: time

087e79408c02a1000f617df48f60f098

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
GetCommandLineA
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Saphire/step 3/lib64/sapphire_ae.dll
.dll windows x64

Password: time

8449f914447ca509197b13f8b43cf953

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

cufft64_10

cufftDestroy
cufftExecC2C
cufftPlan2d

cudart64_101

cudaFree
cudaDriverGetVersion
cudaMalloc
cudaMemset2D
cudaGetDeviceProperties
cudaMemcpy2D
cudaMemcpy
cudaThreadSynchronize
cudaMemcpyToArray
cudaGraphicsUnmapResources
cudaGraphicsUnregisterResource
cudaGraphicsGLRegisterImage
cudaGraphicsMapResources
cudaGraphicsSubResourceGetMappedArray
cudaMemcpyFromArray
cudaMemset
cudaMallocHost
cudaFreeHost
cudaMemcpyAsync
cudaGetLastError
cudaLaunchKernel
__cudaPushCallConfiguration
__cudaPopCallConfiguration
__cudaRegisterFatBinary
__cudaRegisterFatBinaryEnd
__cudaUnregisterFatBinary
__cudaRegisterFunction
cudaMemcpyToSymbol
__cudaRegisterVar
cudaBindTexture2D
cudaUnbindTexture
cudaRuntimeGetVersion
cudaCreateChannelDesc
__cudaRegisterTexture
cudaDeviceGetAttribute
cudaDeviceSynchronize
cudaPeekAtLastError
cudaGetErrorString
cudaGetErrorName
cudaGetDevice
cudaFuncGetAttributes
cudaOccupancyMaxActiveBlocksPerMultiprocessorWithFlags
cudaStreamSynchronize
cudaMallocArray
cudaFreeArray
cudaMemcpy2DToArray
cudaBindTextureToArray
cudaGetChannelDesc
cudaMallocPitch
cudaGetTextureReference
cudaGetDeviceCount

kernel32

WriteFile
GetComputerNameW
SetThreadPriority
GetProcessTimes
GetEnvironmentVariableW
CreateFiberEx
OpenMutexA
ConvertFiberToThread
OpenSemaphoreA
ExpandEnvironmentStringsA
WaitForSingleObject
ReleaseSemaphore
GetCurrentThreadId
ReleaseMutex
FindClose
GetLastError
FindNextFileA
FindFirstFileA
QueryPerformanceCounter
Sleep
TerminateProcess
OpenProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
CloseHandle
GetExitCodeProcess
GetFileAttributesExA
GetEnvironmentVariableA
OutputDebugStringA
GetSystemTimeAsFileTime
LocalFree
GetCurrentProcess
GetSystemInfo
GetModuleHandleA
GetProcAddress
GetTickCount
SwitchToThread
OpenFileMappingA
CreateFileMappingA
UnmapViewOfFile
DuplicateHandle
MapViewOfFileEx
SetProcessAffinityMask
GetProcessAffinityMask
GetTempPathA
GetVersionExA
DeleteFileA
RemoveDirectoryA
TerminateThread
GetSystemDirectoryA
GetModuleFileNameA
GetCommandLineA
GetSystemDefaultLCID
LoadLibraryA
GlobalFree
SetLastError
GlobalAlloc
FormatMessageA
Beep
QueryPerformanceFrequency
CreateSemaphoreA
CreateMutexA
FreeLibrary
LoadLibraryExA
DeviceIoControl
CreateFileA
CreateEventA
CreateThread
ReadFile
SetFilePointer
CreateFileW
FindFirstFileW
FindNextFileW
LoadLibraryExW
GetFileSize
GetCurrentProcessId
ExitThread
GetFileSizeEx
GetThreadLocale
InitializeCriticalSection
LeaveCriticalSection
GetModuleHandleExA
EnterCriticalSection
GetFileAttributesA
GetFileInformationByHandle
GetVolumeInformationA
CreateProcessA
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
GetStdHandle
GetFileType
GetProcessHeap
GetModuleFileNameW
TlsGetValue
GetComputerNameExW
ResumeThread
SetErrorMode
SystemTimeToFileTime
SetFileAttributesW
ConvertThreadToFiber
GetVersion
GlobalMemoryStatus
LoadLibraryW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
FileTimeToSystemTime
FlushFileBuffers
GetWindowsDirectoryA
TlsAlloc
GetDriveTypeA
SwitchToFiber
IsDebuggerPresent
InitializeSListHead
MapViewOfFile
LocalAlloc
lstrcmpA
lstrlenA
OpenEventA
WaitForMultipleObjects
GetExitCodeThread
GetLocalTime
FlushViewOfFile
VerSetConditionMask
VerifyVersionInfoA
GetSystemTime
DefineDosDeviceA
QueryDosDeviceA
HeapFree
CreateProcessW
TlsSetValue
HeapAlloc
HeapReAlloc
SearchPathA
DeleteFiber
GetLogicalDrives
GetVersionExW

user32

GetSystemMetrics
GetProcessWindowStation
GetUserObjectInformationW
SetWindowsHookExA
GetForegroundWindow
DialogBoxParamA
SetWindowPos
CallNextHookEx
SetDlgItemTextA
GetWindowTextA
ShowWindow
AllowSetForegroundWindow
PostMessageA
DestroyWindow
EnableWindow
GetDesktopWindow
IsDlgButtonChecked
GetWindowRect
EndDialog
CheckDlgButton
SetWindowTextA
wsprintfA
UnhookWindowsHookEx
KillTimer
MessageBoxW
MessageBoxA
GetDlgItem
SetTimer

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidA
RegDeleteValueA
GetSecurityInfo
SetSecurityInfo
IsValidAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExA
RegOpenKeyA
ReportEventW
RegisterEventSourceW
DeregisterEventSource
InitializeAcl
CreateWellKnownSid
AddAccessAllowedAceEx
GetUserNameA
FreeSid
RegCloseKey
SetNamedSecurityInfoA
SetEntriesInAclA
AllocateAndInitializeSid
RegDeleteKeyA
RegEnumKeyA

shell32

SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteA
ord680

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysAllocString

comctl32

ord17

wsock32

recv
getsockname
getpeername
gethostbyname
send
sendto
recvfrom
inet_ntoa
getservbyname
getsockopt
connect
WSAGetLastError
select
socket
ioctlsocket
setsockopt
bind
WSAStartup
WSACleanup
closesocket
__WSAFDIsSet
accept

opencolorio

?getNumColorSpaces@Config@v1@OpenColorIO@@QEBAHXZ
?isNoOp@Processor@v1@OpenColorIO@@QEBA_NXZ
?CreateFromFile@Config@v1@OpenColorIO@@SA?AV?$shared_ptr@$$CBVConfig@v1@OpenColorIO@@@std@@PEBD@Z
?getProcessor@Config@v1@OpenColorIO@@QEBA?AV?$shared_ptr@$$CBVProcessor@v1@OpenColorIO@@@std@@PEBD0@Z
?apply@Processor@v1@OpenColorIO@@QEBAXAEAVImageDesc@23@@Z
??0PlanarImageDesc@v1@OpenColorIO@@QEAA@PEAM000JJ_J@Z
??1PlanarImageDesc@v1@OpenColorIO@@UEAA@XZ
?getColorSpaceNameByIndex@Config@v1@OpenColorIO@@QEBAPEBDH@Z

libmmd

fmax
cosf
fmaxf
modf
expf
atan2f
logf
sinf
acosf
__libm_sse2_sincosf
fmodf
powf
ceilf
ceil
floorf
log2f
pow
floor
log10
acos
exp2f
asin
exp
atan2
log10f
__libm_sse2_sincos
log
tan
atan
sin
asinf
fmod
__isinff
__finitef
lroundf
tanf
atanf
fabs
fminf
ldexp
frexp
sqrtf
cos
sqrt

iphlpapi

GetIfTable
GetAdaptersAddresses
GetAdaptersInfo

winhttp

WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpOpen

ws2_32

WSAStringToAddressA
shutdown
ntohl
getaddrinfo
freeaddrinfo
gethostname
htons
listen

openimageio

??1ImageSpec@OpenImageIO_v1_8@@QEAA@XZ
?basesize@TypeDesc@OpenImageIO_v1_8@@QEBA_KXZ
??0ImageSpec@OpenImageIO_v1_8@@QEAA@UTypeDesc@1@@Z
?create@ImageInput@OpenImageIO_v1_8@@SAPEAV12@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?get_float_attribute@ImageSpec@OpenImageIO_v1_8@@QEBAMVstring_view@2@M@Z
?create@ImageCache@OpenImageIO_v1_8@@SAPEAV12@_N@Z
?make_unique@ustring@OpenImageIO_v1_8@@SAPEBDVstring_view@2@@Z
?geterror@OpenImageIO_v1_8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

msvcp140

?do_tolower@?$ctype@D@std@@MEBAPEBDPEADPEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?id@?$ctype@D@std@@2V0locale@2@A
_Getctype
?do_toupper@?$ctype@D@std@@MEBADD@Z
?do_widen@?$ctype@D@std@@MEBAPEBDPEBD0PEAD@Z
?do_widen@?$ctype@D@std@@MEBADD@Z
?do_narrow@?$ctype@D@std@@MEBAPEBDPEBD0DPEAD@Z
?do_narrow@?$ctype@D@std@@MEBADDD@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MEBA_NXZ
?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHXZ
?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHXZ
?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_tolower@?$ctype@D@std@@MEBADD@Z
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@
??0_Facet_base@std@@QEAA@XZ
?_Addstd@ios_base@std@@SAXPEAV12@@Z
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
??_7ctype_base@std@@6B@
?do_is@?$ctype@_W@std@@MEBAPEB_WPEB_W0PEAF@Z
?do_is@?$ctype@_W@std@@MEBA_NF_W@Z
?do_scan_is@?$ctype@_W@std@@MEBAPEB_WFPEB_W0@Z
?do_scan_not@?$ctype@_W@std@@MEBAPEB_WFPEB_W0@Z
?do_tolower@?$ctype@_W@std@@MEBAPEB_WPEA_WPEB_W@Z
?do_tolower@?$ctype@_W@std@@MEBA_W_W@Z
?do_toupper@?$ctype@_W@std@@MEBAPEB_WPEA_WPEB_W@Z
?do_toupper@?$ctype@_W@std@@MEBA_W_W@Z
?do_widen@?$ctype@_W@std@@MEBAPEBDPEBD0PEA_W@Z
?do_widen@?$ctype@_W@std@@MEBA_WD@Z
?do_narrow@?$ctype@_W@std@@MEBAPEB_WPEB_W0DPEAD@Z
?do_narrow@?$ctype@_W@std@@MEBAD_WD@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??_7facet@locale@std@@6B@
?id@?$ctype@_W@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@
??_7?$ctype@_W@std@@6B@
?do_toupper@?$ctype@D@std@@MEBAPEBDPEADPEBD@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?_Xbad_function_call@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
?_Id_cnt@id@locale@std@@0HA
??1_Lockit@std@@QEAA@XZ
?_Locinfo_ctor@_Locinfo@std@@SAXPEAV12@PEBD@Z
?_Locinfo_dtor@_Locinfo@std@@SAXPEAV12@@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
??_7_Facet_base@std@@6B@
??_7?$ctype@D@std@@6B@
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
??_7ios_base@std@@6B@
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
_Getcvt
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

vcruntime140

__std_terminate
memmove
__C_specific_handler
wcschr
memchr
_purecall
longjmp
strstr
__std_exception_copy
__CxxFrameHandler3
__std_exception_destroy
_CxxThrowException
memset
memcpy
strchr
wcsrchr
wcsstr
strrchr
memcmp
__intrinsic_setjmp
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
realloc
free

api-ms-win-crt-string-l1-1-0

_strdup
wcstok_s
strtok_s
_stricmp
strncpy_s
strtok
strspn
strpbrk
strcat
strcmp
strcpy_s
_wcsicmp
wcsncpy_s
isspace
wcsncat_s
wcscat_s
wcscspn
strcat_s
_wcsnicmp
towlower
iswctype
towupper
isprint
wcscpy_s
ispunct
isgraph
iscntrl
isalnum
toupper
isalpha
isupper
isxdigit
strcoll
tolower
strcpy
strncmp
strncat
strlen
islower
strncpy
strncat_s
wcslen
isdigit

api-ms-win-crt-runtime-l1-1-0

exit
terminate
_endthreadex
_invalid_parameter_noinfo
_getpid
strerror
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
perror
_execute_onexit_table
_errno
system
_crt_atexit
_invalid_parameter_noinfo_noreturn
_cexit
_register_onexit_function
_beginthreadex
_initterm
abort
_initterm_e

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fflush
setvbuf
fsetpos
putc
__stdio_common_vsprintf_s
fopen
tmpfile
fgetc
_lseek
freopen
ungetc
_wopen
_popen
feof
clearerr
_ftelli64
_pclose
__stdio_common_vsprintf
fputs
ferror
_fseeki64
fgetpos
tmpnam
_fileno
_write
_read
fread
_close
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vfprintf
fwrite
ungetwc
_setmode
__stdio_common_vsscanf
_open
_locking
_chsize
_mktemp
_getcwd
_wfopen
fgets
fseek
__stdio_common_vswscanf
ftell
__stdio_common_vsnwprintf_s
fputc
fputwc
fclose
fgetwc
getc
fopen_s

api-ms-win-crt-time-l1-1-0

_localtime64
_ctime64_s
asctime
_time64
_ftime64
_ctime64
_gmtime64
clock
strftime
_difftime64
_mktime64
_mktime32

api-ms-win-crt-convert-l1-1-0

mbstowcs_s
wcstombs
mbtowc
mbstowcs
strtod
atol
strtol
_ltow_s
wcstombs_s
atoi

api-ms-win-crt-environment-l1-1-0

_wgetenv_s
getenv
_dupenv_s
_wgetenv
_putenv

api-ms-win-crt-math-l1-1-0

_copysign
_fdtest

api-ms-win-crt-filesystem-l1-1-0

_chmod
_fullpath
_wstat64i32
_chdir
_findclose
_splitpath_s
_wunlink
_wfindfirst64
_wmkdir
remove
_fstat32
rename
_fstat64i32
_stat64i32
_wrename
_wremove
_wrmdir
_wfindnext64
_mkdir
_lock_file
_unlock_file
_wstat32
_unlink

api-ms-win-crt-process-l1-1-0

_spawnle

api-ms-win-crt-locale-l1-1-0

setlocale
localeconv

api-ms-win-crt-utility-l1-1-0

srand
abs
rand
rand_s
qsort

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcpy
_mbsupr_s

Exports

Exports

??0SapphireAbortException@@QEAA@AEBV0@@Z
??0SapphireAbortException@@QEAA@HPEBDHH@Z
??0SapphireParam@@QEAA@AEBV0@@Z
??0SapphireParam@@QEAA@PEBDW4param_type@@EMMMMMQEAMW4screen_mode@@H@Z
??0SapphireParam@@QEAA@PEBDW4param_type@@EMMMQEAMH@Z
??0SapphireParam@@QEAA@W4param_type@@PEBD@Z
??0SapphireParam@@QEAA@XZ
??0ShmemManager@IPC@Sapphire@@QEAA@AEBV012@@Z
??0ShmemManager@IPC@Sapphire@@QEAA@XZ
??0ShmemTransport@IPC@Sapphire@@QEAA@$$QEAV012@@Z
??0ShmemTransport@IPC@Sapphire@@QEAA@QEAXAEAVCircularQueueIndices@12@AEAVinterprocess_mutex@interprocess@boost@@AEAVinterprocess_condition@56@23012323PEAVShmemHeader@12@@Z
??1SapphireAbortException@@QEAA@XZ
??1SapphireParam@@UEAA@XZ
??1ShmemManager@IPC@Sapphire@@QEAA@XZ
??4MemoryCheck@@QEAAAEAV0@$$QEAV0@@Z
??4MemoryCheck@@QEAAAEAV0@AEBV0@@Z
??4SapphireAbortException@@QEAAAEAV0@AEBV0@@Z
??4SapphireParam@@QEAAAEAV0@AEBV0@@Z
??4ShmemManager@IPC@Sapphire@@QEAAAEAV012@AEBV012@@Z
??_7SapphireParam@@6B@
??_FSapphireAbortException@@QEAAXXZ
??_UMemoryCheck@@CAPEAX_K@Z
??_VMemoryCheck@@CAXPEAX@Z
??_VSapphireParam@@CAXPEAX@Z
?clamp_values@SapphireParam@@QEAAXPEAURenderContext@@@Z
?clear@SapphireParam@@AEAAXXZ
?client_pid_exists@ShmemTransport@IPC@Sapphire@@QEAA_NXZ
?clone@SapphireParam@@QEAAPEAV1@XZ
?clone_host_properties@SapphireParam@@UEAAXPEBV1@@Z
?clone_impl@SapphireParam@@MEAAPEAV1@XZ
?commit@ShmemTransport@IPC@Sapphire@@QEAA_NXZ
?connect@ShmemManager@IPC@Sapphire@@SAPEAVShmemTransport@23@QEBD@Z
?connect_impl@ShmemManager@IPC@Sapphire@@IEAAPEAVShmemTransport@23@QEBD_N_K2@Z
?create_shmem@ShmemManager@IPC@Sapphire@@IEAAPEAVwindows_shared_memory@interprocess@boost@@QEBD_N_K2@Z
?create_transport@ShmemManager@IPC@Sapphire@@IEAAPEAVShmemTransport@23@PEAVmapped_region@interprocess@boost@@_N@Z
?destroy_mapped_region@ShmemManager@IPC@Sapphire@@IEAA_NPEAVmapped_region@interprocess@boost@@_N@Z
?destroy_shmem_obj@ShmemManager@IPC@Sapphire@@IEAAXPEAVwindows_shared_memory@interprocess@boost@@_N11@Z
?format@SapphireParam@@UEAA?AW4const_format_tag@@XZ
?get_abort_type@SapphireAbortException@@QEAAHXZ
?get_canonical_name@SapphireParam@@QEAAPEBDXZ
?get_error_code@SapphireAbortException@@QEAAHXZ
?get_fast@ShmemTransport@IPC@Sapphire@@QEAA_NXZ
?get_last_error@ShmemTransport@IPC@Sapphire@@QEAA?AW4ShmemError@23@XZ
?get_ocio_path@Sapphire@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get_server_pid@ShmemTransport@IPC@Sapphire@@QEAAHXZ
?get_value@SapphireParam@@QEAAMHPEAURenderContext@@@Z
?get_value_from_buttons@SapphireParam@@MEAA_NPEAURenderContext@@@Z
?get_value_nosync@SapphireParam@@QEAAMH@Z
?get_value_object@SapphireParam@@QEAAPEAXPEAURenderContext@@@Z
?get_value_object_nosync@SapphireParam@@UEAAPEAXXZ
?init@SapphireParam@@AEAAXPEBDW4param_type@@EMMMMMQEAMW4screen_mode@@H@Z
?init@SapphireParam@@AEAAXXZ
?instance@ShmemManager@IPC@Sapphire@@1PEAV123@EA
?is_segment_valid@ShmemTransport@IPC@Sapphire@@QEAA_NXZ
?maybe_set_to_old_default@SapphireParam@@UEAA_NPEAURenderContext@@MI@Z
?needs_old_default@SapphireParam@@QEAA_NM@Z
?notify_reader@ShmemTransport@IPC@Sapphire@@IEAAXXZ
?notify_writer@ShmemTransport@IPC@Sapphire@@IEAAXXZ
?numeric_p@SapphireParam@@UEAA_NXZ
?print_stats@ShmemTransport@IPC@Sapphire@@QEAAXXZ
?ptype_name@SapphireParam@@QEBAPEBDXZ
?read@ShmemTransport@IPC@Sapphire@@QEAA_KPEAPEAXPEAPEAUMessageHeader_t@23@@Z
?read_and_retry@ShmemTransport@IPC@Sapphire@@QEAA_KPEAPEAXMPEAPEAUMessageHeader_t@23@@Z
?release@SapphireParam@@QEAA_NXZ
?remove@ShmemTransport@IPC@Sapphire@@QEAA_NXZ
?reserve@ShmemTransport@IPC@Sapphire@@QEAAPEAX_KQEBD@Z
?reset@ShmemManager@IPC@Sapphire@@SAXQEBD_N@Z
?reset_all@ShmemManager@IPC@Sapphire@@SAX_N@Z
?reset_all_impl@ShmemManager@IPC@Sapphire@@IEAAX_N@Z
?reset_impl@ShmemManager@IPC@Sapphire@@IEAAXQEBD_N@Z
?retain@SapphireParam@@QEAAXXZ
?serve@ShmemManager@IPC@Sapphire@@SAPEAVShmemTransport@23@QEBD_K1@Z
?set_canonical_name@SapphireParam@@QEAAXPEBD@Z
?set_fast@ShmemTransport@IPC@Sapphire@@QEAAX_N@Z
?set_to_default@SapphireParam@@UEAA_NPEAURenderContext@@I@Z
?set_value@SapphireParam@@UEAAHPEAURenderContext@@HMI@Z
?set_value_from_json@SapphireParam@@UEAAHPEAURenderContext@@PEAUcJSON@@I@Z
?set_value_from_string@SapphireParam@@UEAAHPEAURenderContext@@PEBDI@Z
?set_values@SapphireParam@@UEAAHPEAURenderContext@@HHQEAMI@Z
?shmem_error_to_string@IPC@Sapphire@@YAPEBDW4ShmemError@12@@Z
?timed_read@ShmemTransport@IPC@Sapphire@@QEAA_KPEAPEAXMPEAPEAUMessageHeader_t@23@@Z
?timed_reserve@ShmemTransport@IPC@Sapphire@@QEAAPEAX_KMQEBD@Z
?timed_write@ShmemTransport@IPC@Sapphire@@QEAA_NQEBX_KMQEBD@Z
?timed_write_string@ShmemTransport@IPC@Sapphire@@QEAA_NQEBDM0@Z
?to_json@SapphireParam@@UEAAPEAUcJSON@@PEAURenderContext@@_N@Z
?to_string@SapphireParam@@UEAAPEADPEAURenderContext@@_N@Z
?to_string_const@SapphireParam@@QEAAPEBDPEAURenderContext@@_N@Z
?try_read@ShmemTransport@IPC@Sapphire@@QEAA_KPEAPEAXPEAPEAUMessageHeader_t@23@@Z
?try_reserve@ShmemTransport@IPC@Sapphire@@QEAAPEAX_KQEBD@Z
?try_write@ShmemTransport@IPC@Sapphire@@QEAA_NQEBX_KQEBD@Z
?try_write_string@ShmemTransport@IPC@Sapphire@@QEAA_NQEBD0@Z
?update@SapphireParam@@QEAAXPEAURenderContext@@@Z
?update_ui@SapphireParam@@UEAAXPEAURenderContext@@@Z
?valid_with_inputs@SapphireParam@@QEAA_NI_N@Z
?write@ShmemTransport@IPC@Sapphire@@QEAA_NQEBX_KQEBD@Z
?write_string@ShmemTransport@IPC@Sapphire@@QEAA_NQEBD0@Z
S_set_err_handler
Sapphire_version_name
Sapphire_version_num
free_sapphire_custom_genotype_infos
free_sapphire_effect
free_sapphire_ipc_shmemtransport
generate_all_sapphire_effect_params
get_bfx_api_name
get_bfx_lic_version
get_bfx_productline_feature
get_bfx_productline_name
get_n_sapphire_builder_effects
get_n_sapphire_effects
get_sapphire_build_id
get_sapphire_builder_info_i
get_sapphire_config_dir
get_sapphire_custom_genotype_info_n
get_sapphire_plugin_info_i
get_sapphire_version_info
init_sapphire_effect
init_sapphire_effect_from_string
make_sapphire_raster_info
maybe_get_sapphire_custom_genotype_infos
render_sapphire_effect_to_native_image
render_sapphire_lensflare_to_native_image
replace_sapphire_with_productline
sapphire_abort_render
sapphire_any_nodes_get_flag
sapphire_clear_abort
sapphire_comp_bgra_8
sapphire_convert_to_bgra_8
sapphire_effect_is_time_varying
sapphire_find_pinfo_for_effect
sapphire_free_all_flare_textures
sapphire_free_all_stamp_collections
sapphire_free_check_fun
sapphire_get_flare_texture_error
sapphire_get_fromfile_popup_names
sapphire_get_native_image_dims
sapphire_get_param_bounds2
sapphire_get_param_title
sapphire_get_resized_image_size
sapphire_get_texture_info
sapphire_get_texture_pixels
sapphire_gpu
sapphire_load_flare_texture
sapphire_main
sapphire_malloc_copy_string_func
sapphire_register_flare_texture
sapphire_resize_native_image
sapphire_shutdown_apps
sapphire_version
set_bfx_api_name
set_bfx_lic_version
set_bfx_productline_feature
set_bfx_productline_name
set_sapphire_luts
version_warning_printed

Sections

.text
Size: 21.7MB - Virtual size: 21.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 822KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 469KB - Virtual size: 468KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nv_fatb
Size: 11.9MB - Virtual size: 11.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nvFatBi
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Saphire/step 3/put these files in.txt

Sharing

General

Malware Config

Signatures

Files

Password: time

Password: time

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

3e:06:93:c7:56:88:dd:c6:37:a7:1b:df:af:e6:0b:f1Certificate

Extended Key Usages

Key Usages

50:8d:ec:1f:3b:e5:25:fa:79:df:91:37:81:22:7d:d1:14:0b:ea:ecSigner

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 40KB - Virtual size: 40KB

DATA Size: 1024B - Virtual size: 592B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 15KB - Virtual size: 14KB

Password: time

087e79408c02a1000f617df48f60f098

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 140KB - Virtual size: 137KB

Password: time

8449f914447ca509197b13f8b43cf953

Headers

DLL Characteristics

File Characteristics

Imports

cufft64_10

cudart64_101

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

wsock32

opencolorio

libmmd

iphlpapi

winhttp

ws2_32

openimageio

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-process-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

3e:06:93:c7:56:88:dd:c6:37:a7:1b:df:af:e6:0b:f1
Certificate

50:8d:ec:1f:3b:e5:25:fa:79:df:91:37:81:22:7d:d1:14:0b:ea:ec
Signer

CODE
Size: 40KB - Virtual size: 40KB

DATA
Size: 1024B - Virtual size: 592B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 15KB - Virtual size: 14KB

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 140KB - Virtual size: 137KB

.text
Size: 21.7MB - Virtual size: 21.7MB

.rdata
Size: 5.8MB - Virtual size: 5.8MB

.data
Size: 822KB - Virtual size: 1.9MB

.pdata
Size: 469KB - Virtual size: 468KB

.data1
Size: 398KB - Virtual size: 397KB

.nv_fatb
Size: 11.9MB - Virtual size: 11.9MB

.nvFatBi
Size: 1024B - Virtual size: 648B

_RDATA
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 99KB - Virtual size: 99KB