Behavioral task
behavioral1
Sample
cp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cp.exe
Resource
win10v2004-20231215-en
General
-
Target
cp.exe
-
Size
5.5MB
-
MD5
2d58310bb545d2d9b3b562dcd27d8755
-
SHA1
b00111934a023577c823eb80115df75e8ee6b94c
-
SHA256
ca1fb3d8a70ec2e8baf3e420426c8c5db796df0799c4f94c03f7330c3c4d3cfe
-
SHA512
0147f1652cd806b62029d5dcd890b9a508bb01b36926f413b752b2356da8e19407044a5e2d03eb3c53e868a3546328bac4eabe9beb1c17fcfd742cdbd8b8d59a
-
SSDEEP
98304:zl95YReQ2RgCafgakYfmZiWrwpdXGSZqdNKQeLWk7/xMmsG9AJeHu:zl95nQ6g3k4WrwpdXWwlTpMd7P
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
cp.exe.exe windows:6 windows x86 arch:x86
7106f7f21b5a6e69fd7cbbc19f3ecd14
Code Sign
2a:ba:db:e4:ac:bc:f9:95:45:a9:cd:df:56:55:5d:45Certificate
IssuerCN=†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶Not Before22/12/2023, 10:41Not After23/12/2033, 10:41SubjectCN=†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶†–þ¼¶• ¼▶▶39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
5c:bc:66:fa:87:73:4a:7b:dc:9e:3a:b7:31:7c:a2:41:89:e8:f1:01:56:21:a1:0a:b4:38:fa:a0:1f:ae:32:2cSigner
Actual PE Digest5c:bc:66:fa:87:73:4a:7b:dc:9e:3a:b7:31:7c:a2:41:89:e8:f1:01:56:21:a1:0a:b4:38:fa:a0:1f:ae:32:2cDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegSetValueExA
shell32
ShellExecuteExW
ole32
CoTaskMemFree
Sections
.text Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.iso«« Size: - Virtual size: 1001KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.iso«« Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.iso«« Size: 5.4MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 126KB - Virtual size: 450KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ