Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231215-en
General
-
Target
tmp
-
Size
6.6MB
-
MD5
53eac6a1efcdd851ac025fb7bf7e9ec1
-
SHA1
9e945fc8fa397dc13c993b2ea7bde07648d2fbc7
-
SHA256
85678c213dc5d11411070297d3e899c3c052dee7a2ff1a0ccc26990c7c5f9aa3
-
SHA512
40db6da535d3f2e79127af5795f509ab0a666a493176dfc3a48d82640894c14563ecd5cbec2671768e4b17cb6115308b009f405f1f8e017162d6881ccb95f8c0
-
SSDEEP
98304:1sxvLglp0GlulJ7PiPDy12nK01Xz+3Rg+uc2ja2Iol6O:KxvML0GluP7PiP25QYR4Iq6O
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
Files
-
tmp.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
04:ed:c0:33:7e:be:be:47:b0:3b:e4:47:bc:2c:d2:d7Certificate
IssuerCN=Philips OLD City,OU=Philips Company,O=(2NDRB941-TC),L=ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…,ST=NL,C=EUNot Before18/02/2024, 12:01Not After02/06/2027, 00:00SubjectCN=Philips OLD City,OU=Philips Company,O=(2NDRB941-TC),L=ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…ⅰℯㅰⅰㅰⅰㅰㅯㅰㅰⅰㄯㅰㅰⅰⅰㅰⅰㅰㅰⅰㅰㅯㅰㅰ㄰ㅰⅰⅰⅰㅰⅰㅰㅰㅰㅰⅰㅰㅰㅯⅯㅰⅰㅰㅰⅯⅰㅰㅰㅯℰㅰㅰⅰㅰㅰⅰㅰㅰㅯㅰㄯㅰㅰⅰㅰㅰⅰㅯㅰㅰⅯㅯㅰㅰⅰㅰⅰㅰㅰㅰⅰㅰㅰⅰⅰⅰㅰㅰⅰⅯㅯⅰㅰㅰㅯⅯㅰㅰㅰⅰⅰㅰⅰ㄰ⅰㅯⅰⅰⅯㅰⅯⅰⅰⅰㅰⅰⅰㅯⅰㅰℰⅰㅰㅰㅰㅰㅯ㄰ㅰⅰⅰⅰⅯⅰㅰㅰⅯℰㅰㅰⅰㅰⅯㅰㅰⅰⅯㅰⅯⅰ㄰ⅰⅰㅰⅰⅰㅯⅰㅯℰㅰⅯㅯㅰㅰㅰㅰㅰㅰⅰⅰⅯㅰㅰㅰⅰⅰㅰㅰㅰⅯℰⅰⅯㅰㅯㅰㅰㅰⅰㅰⅯⅰㅰㅰⅰㅰㅰℰㅯㅰㅰㅰㅰㅰⅰⅰㅰⅰ㄰ㅯⅯⅰ㄰ㅰⅰⅯㅰㅰⅰㅰⅰⅰⅰㅰⅰㅰㅯㅰⅰⅰⅯㅯℰⅰㅰㅰㅰ㄰ㅰⅰㅰㅰℰⅰⅰⅰⅰⅰㅰⅰㅰⅰㅰㅯⅯㅰⅰⅰㅯⅰⅰⅰⅯㅰã…,ST=NL,C=EU39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
dd:1d:8a:b6:1f:96:7d:d2:4e:e8:cc:51:22:7f:f3:6c:47:07:7f:ae:fc:de:36:73:84:0e:63:2d:dc:50:b4:e7Signer
Actual PE Digestdd:1d:8a:b6:1f:96:7d:d2:4e:e8:cc:51:22:7f:f3:6c:47:07:7f:ae:fc:de:36:73:84:0e:63:2d:dc:50:b4:e7Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
guiscoolhelperapp.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ