Red[.]Dead[.]Redemption[.]Crackfix[.]V2-EMPRESS+Mr_Goldberg[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

Red.Dead.Redemption.Crackfix.V2-EMPRESS+Mr_Goldberg.7z
Size

36.6MB
MD5

f27b1cca43fdc9352fda7169bda31269
SHA1

3c7a9088dc4c7e727f2f6da50b8fb5eb5af43712
SHA256

a91aa9c746afe77e1022d0da8e089a9850608ea150045b472fca9d22701f75dd
SHA512

f1b7b177eae7e498da469d98fb84f44915454619cff7d8781f6482117ac0e7f0484b547508e6a8e78353a34cdbe0be6aa91f1cdb16d624df8b9641166be43204
SSDEEP

786432:wnPlQ8fg4PZDUQFYPq8WBV4iv3mXVKJdmUVFO0c2VznztS7M:GQYg4PSiYPaHv3mXVKJdpbOcznzI4

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Crackfix-V2/Launcher.exe
unpack001/Crackfix-V2/RDR2.exe
unpack001/Crackfix-V2/bink2w64.dll
unpack001/Crackfix-V2/launc.dll
unpack001/Crackfix-V2/socialclub.dll

Files

Red.Dead.Redemption.Crackfix.V2-EMPRESS+Mr_Goldberg.7z
.7z
Crackfix-V2/EMP.dll
.dll windows:6 windows x64 arch:x64

ff1a92c6477507e0049d9441235946c9

Code Sign

33:00:00:02:5c:93:5a:76:bd:10:e5:99:96:00:00:00:00:02:5c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

31/01/2020, 19:26

Not After

22/01/2021, 19:26

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:a2:45:c1:7e:41:dd:a9:87:50:df:e6:90:da:75:3c:2c:8b:a0:86:7e:0c:62:82:1d:31:2a:4d:69:a0:78:bb
Signer

Actual PE Digest

54:a2:45:c1:7e:41:dd:a9:87:50:df:e6:90:da:75:3c:2c:8b:a0:86:7e:0c:62:82:1d:31:2a:4d:69:a0:78:bb

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryA
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW

Exports

Exports

EMP

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.emp0
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data2
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.EMP
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data3
Size: 608KB - Virtual size: 608KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.emp1
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 233B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Crackfix-V2/Launcher.exe
.exe windows:6 windows x64 arch:x64

e87d728eb2608eb6567741c80b0539c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReadFile
WriteFile
CloseHandle
WaitForSingleObject
CreateProcessA
CreateNamedPipeA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CreateFileW

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crackfix-V2/RDR2.exe
.exe windows:6 windows x64 arch:x64

051783ce19703ced1bb9759180d65ac4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

X:\rdr3\dlc\titleupdate\build\dev_live\game_win64_master.pdb

Imports

kernel32

FlushFileBuffers
HeapReAlloc
GetCurrentDirectoryW
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
GetTimeFormatW
GetDateFormatW
GetACP
GetStdHandle
GetFileType
GetModuleHandleExW
HeapSize
GetFullPathNameA
GetDriveTypeW
RtlUnwindEx
SetEnvironmentVariableA
GetSystemDirectoryW
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
GetStringTypeW
LCMapStringW
CompareStringW
SetEnvironmentVariableW
SetStdHandle
GetFileSize
GetConsoleWindow
GetModuleHandleA
GetPhysicallyInstalledSystemMemory
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetFullPathNameW
GetConsoleCP
TerminateProcess
CreateEventW
SetLastError
GetCPInfo
RaiseException
DecodePointer
EncodePointer
RtlPcToFileHeader
FormatMessageW
InitializeCriticalSection
GetThreadContext
GetSystemTimeAsFileTime
GetOverlappedResult
CreateFileA
VerifyVersionInfoW
CreateEventExA
VerSetConditionMask
GetSystemDefaultUILanguage
GlobalAddAtomA
LocalFree
LocalAlloc
FileTimeToSystemTime
MoveFileWithProgressW
MoveFileExW
CreateFileMappingA
FormatMessageA
UnmapViewOfFile
MapViewOfFile
ResetEvent
GetTempPathW
WriteFile
SetFileTime
SetFilePointerEx
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
WerRegisterFile
GetSystemDefaultLocaleName
CreateSemaphoreA
SetThreadAffinityMask
GetProcessAffinityMask
LoadLibraryExW
GetModuleHandleW
VirtualFree
GetLocalTime
GetSystemInfo
ResumeThread
QueryPerformanceCounter
GetCommandLineW
CloseHandle
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
OpenProcess
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32First
Process32Next
K32EnumProcessModules
K32GetModuleFileNameExA
GetProcessHandleCount
DeleteFileW
QueryPerformanceFrequency
ExitProcess
FindClose
FindFirstFileExA
FindNextFileA
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
GetVersionExA
GetNativeSystemInfo
FreeLibrary
LoadLibraryA
WideCharToMultiByte
LCIDToLocaleName
GetUserDefaultUILanguage
VirtualAlloc
VirtualProtect
GetProcAddress
VirtualQueryEx
ReadProcessMemory
GetWriteWatch
ResetWriteWatch
GetModuleFileNameA
GetModuleHandleExA
GetDiskFreeSpaceExW
MultiByteToWideChar
CreateFileW
ReadFile
SetFilePointer
CreateEventA
Sleep
lstrcmpW
SetPriorityClass
WerSetFlags
GetCommandLineA
CreateDirectoryW
FindFirstFileW
FindNextFileW
OutputDebugStringA
SetUnhandledExceptionFilter
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseSemaphore
ReleaseMutex
CreateMutexA
CreateThread
GetCurrentThread
GetCurrentThreadId
OpenThread
SetThreadPriority
GetThreadPriority
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
K32EnumProcesses
K32GetProcessImageFileNameA
VirtualQuery

user32

PostMessageA
RegisterRawInputDevices
GetRawInputData
LoadCursorA
ClipCursor
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
ShowCursor
SetPropA
GetForegroundWindow
ReleaseCapture
SetActiveWindow
GetCapture
MapVirtualKeyExW
MapVirtualKeyW
MapVirtualKeyA
RegisterTouchWindow
CloseTouchInputHandle
GetTouchInputInfo
keybd_event
AdjustWindowRect
GetKeyState
CharNextA
GetDoubleClickTime
PostMessageW
SendMessageW
GetMessageExtraInfo
GetKeyboardLayout
GetKeyboardLayoutList
UnloadKeyboardLayout
ActivateKeyboardLayout
LoadKeyboardLayoutW
DefWindowProcW
MonitorFromPoint
DestroyIcon
LoadIconA
GetParent
SetWindowLongPtrA
GetWindowLongPtrA
SetRect
GetWindowRect
GetClientRect
SetWindowTextA
SetForegroundWindow
AdjustWindowRectEx
GetWindowLongA
GetDesktopWindow
ChangeDisplaySettingsExA
EnumDisplaySettingsA
EnumDisplaySettingsW
EnumDisplayDevicesW
QueryDisplayConfig
DisplayConfigGetDeviceInfo
MonitorFromWindow
UpdateWindow
CreateIconIndirect
RegisterClassW
GetCursorInfo
CreateWindowExW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
VkKeyScanExW
ShowWindow
SetCapture
MessageBoxW
SystemParametersInfoA
EnumDisplayDevicesA
LoadStringW
TranslateMessage
DispatchMessageA
PeekMessageA
WaitMessage
DestroyWindow
SetWindowPos
SetFocus
GetSystemMetrics

iphlpapi

GetIpAddrTable
GetBestRoute
GetIpForwardTable2
FreeMibTable

dsound

ord9
ord1
ord6
ord3
ord8

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

mf

MFGetService

mfplat

MFStartup
MFCreateSourceResolver
MFGetSystemTime
MFCreateAttributes
MFShutdown
MFCreateMediaType

mfreadwrite

MFCreateSourceReaderFromMediaSource

propsys

PropVariantGetStringElem
PropVariantToInt64

ws2_32

WSAStartup
WSACleanup
WSAGetLastError
getsockopt
recvfrom
recv
gethostname
getaddrinfo
freeaddrinfo
htonl
WSAAddressToStringA
getnameinfo
ntohl
ntohs
gethostbyname
socket
setsockopt
send
shutdown
listen
inet_addr
select
htons
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
sendto

crypt32

CertGetNameStringA
CryptMsgGetParam
CertFindCertificateInStore
CryptQueryObject

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

imm32

ImmSetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmGetConversionStatus

dinput8

DirectInput8Create

xinput9_1_0

XInputSetState
XInputGetState

oo2core_5_win64

OodleNetwork1UDP_StateCompacted_MaxSize
OodleNetwork1UDP_Decode
OodleNetwork1UDP_Encode
OodleNetwork1UDP_State_Size
OodleNetwork1_Shared_SetWindow
OodleNetwork1_CompressedBufferSizeNeeded
OodleNetwork1_Shared_Size
OodleLZ_GetDecodeBufferSize
OodleLZ_Decompress
OodleLZ_GetCompressedBufferSizeNeeded
OodleLZDecoder_DecodeSome
OodleLZDecoder_Destroy
OodleLZDecoder_MemorySizeNeeded
OodleLZDecoder_Create
OodleNetwork1UDP_State_Uncompact

amd_ags_x64

agsInit

d3d9

Direct3DCreate9Ex

bcrypt

BCryptGenerateSymmetricKey
BCryptGenRandom
BCryptDestroyHash
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptGenerateKeyPair
BCryptEncrypt
BCryptDecrypt
BCryptExportKey
BCryptImportKeyPair
BCryptFinalizeKeyPair
BCryptDestroyKey
BCryptDestroySecret
BCryptSecretAgreement
BCryptDeriveKey
BCryptCreateHash

rpcrt4

UuidCreateSequential

version

VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoSizeW

bink2w64

BinkClose
BinkPause
BinkWait
BinkRegisterFrameBuffers
BinkGoto
BinkGetKeyFrame
BinkFreeGlobals
BinkGetPlatformInfo
BinkSetVolume
BinkShouldSkip
BinkSetOSFileCallbacks
BinkStartAsyncThread
BinkDoFrameAsyncMulti
BinkDoFrameAsyncWait
BinkRequestStopAsyncThreadsMulti
BinkWaitStopAsyncThreadsMulti
BinkSetSoundSystem
BinkOpenDirectSound
BinkSetMemory
BinkSetWillLoop
BinkOpenWithOptions
BinkGetFrameBuffersInfo
BinkNextFrame

gdi32

CreateBitmap
GetStockObject
DeleteObject

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegGetValueW
CryptAcquireContextA

shell32

ShellExecuteA
ShellExecuteExW
SHGetKnownFolderPath
SHGetFolderPathW
ShellExecuteW
SHGetSpecialFolderPathA

ole32

CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoInitialize
PropVariantClear
CoTaskMemFree

oleaut32

SysAllocString
VariantClear
SysFreeString
SysStringLen

Sections

.text
Size: 50.5MB - Virtual size: 50.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 27.0MB - Virtual size: 35.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 390KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 872KB - Virtual size: 872KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 21.8MB - Virtual size: 21.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Crackfix-V2/bink2w64.dll
.dll windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\devel\projects\bink\build\bink2w64.pdb

Exports

Exports

BinkAllocateFrameBuffers
BinkClose
BinkCloseTrack
BinkControlBackgroundIO
BinkCopyToBuffer
BinkCopyToBufferRect
BinkDoFrame
BinkDoFrameAsync
BinkDoFrameAsyncMulti
BinkDoFrameAsyncWait
BinkDoFramePlane
BinkFreeGlobals
BinkGetError
BinkGetFrameBuffersInfo
BinkGetGPUDataBuffersInfo
BinkGetKeyFrame
BinkGetPlatformInfo
BinkGetRealtime
BinkGetRects
BinkGetSummary
BinkGetTrackData
BinkGetTrackID
BinkGetTrackMaxSize
BinkGetTrackType
BinkGoto
BinkLogoAddress
BinkNextFrame
BinkOpen
BinkOpenDirectSound
BinkOpenMiles
BinkOpenTrack
BinkOpenWaveOut
BinkOpenWithOptions
BinkOpenXAudio2
BinkOpenXAudio27
BinkOpenXAudio28
BinkPause
BinkRegisterFrameBuffers
BinkRegisterGPUDataBuffers
BinkRequestStopAsyncThread
BinkRequestStopAsyncThreadsMulti
BinkService
BinkSetError
BinkSetFileOffset
BinkSetFrameRate
BinkSetIO
BinkSetIOSize
BinkSetMemory
BinkSetOSFileCallbacks
BinkSetPan
BinkSetSimulate
BinkSetSoundOnOff
BinkSetSoundSystem
BinkSetSoundSystem2
BinkSetSoundTrack
BinkSetSpeakerVolumes
BinkSetVideoOnOff
BinkSetVolume
BinkSetWillLoop
BinkShouldSkip
BinkStartAsyncThread
BinkUtilCPUs
BinkUtilFree
BinkUtilMalloc
BinkUtilMutexCreate
BinkUtilMutexDestroy
BinkUtilMutexLock
BinkUtilMutexLockTimeOut
BinkUtilMutexUnlock
BinkWait
BinkWaitStopAsyncThread
BinkWaitStopAsyncThreadsMulti
RADTimerRead

Sections

.text
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 43KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Crackfix-V2/launc.dll
.dll windows:6 windows x64 arch:x64

61b600bbe9dc564b84bc868e3bd45e1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

user32

MessageBoxA

kernel32

IsProcessorFeaturePresent
WriteConsoleW
GetCommandLineA
GetFileAttributesA
GetFileAttributesW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThread
CreateProcessA
OpenProcess
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExW
LocalAlloc
LocalFree
lstrcmpA
lstrcpyA
CreateToolhelp32Snapshot
Process32First
Process32Next
K32EnumProcessModules
K32GetModuleFileNameExA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetLastError
SetLastError
WaitForSingleObject
ExitProcess
GetExitCodeProcess
ResumeThread
CreateProcessW
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
IsWow64Process
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
DebugBreak
GetFileSize
SetFilePointer
WriteFile
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateFileW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode

Exports

Exports

launc

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crackfix-V2/orig_socialclub.dll
.dll windows:5 windows x86 arch:x86

90d36b01527a3fb6f0874bae2f8de4bf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:46

Not After

10/11/2030, 14:16

Subject

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

Issuer

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

09/03/2017, 22:04

Not After

20/03/2020, 22:34

Subject

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95
Signer

Actual PE Digest

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

X:\rgsc\src\sdk32\rage\suite\src\rgsc\rgsc\Release\socialclub.pdb

Imports

kernel32

ResetEvent
UnmapViewOfFile
CreateFileMappingW
InterlockedExchangeAdd
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ConnectNamedPipe
CreateNamedPipeW
CancelIo
RegisterWaitForSingleObject
WaitForMultipleObjects
GetCurrentThreadId
GetVersionExW
GetCurrentDirectoryW
GetFileAttributesExW
GetComputerNameW
GetVolumeInformationA
GetEnvironmentVariableA
WideCharToMultiByte
GetModuleHandleExW
GetModuleFileNameW
CopyFileW
LocalFileTimeToFileTime
SystemTimeToFileTime
MapViewOfFile
SetEnvironmentVariableA
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
WriteConsoleW
SetStdHandle
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetFileType
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
FlushFileBuffers
AreFileApisANSI
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
Sleep
MultiByteToWideChar
RtlCaptureStackBackTrace
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect
HeapAlloc
HeapFree
GetProcessHeap
GetProcessAffinityMask
GetCurrentProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
CreateThread
GetCurrentThread
SetThreadPriority
SetThreadPriorityBoost
GetLastError
ResumeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CloseHandle
GetLocalTime
CreateEventA
CreateSemaphoreA
GetModuleHandleA
OutputDebugStringA
CreateDirectoryA
CreateFileA
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
TerminateProcess
WriteFile
ReadFile
SetEndOfFile
SetFilePointerEx
FindClose
SetFileTime
CreateDirectoryW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
LocalFree
InitializeCriticalSection
SetLastError
SetFilePointer
GetTickCount
CreateMutexW
CreateProcessW
InterlockedExchange
InterlockedCompareExchange
IsDebuggerPresent
RaiseException
CreateEventW
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetStringTypeW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
HeapReAlloc
HeapSize
GetConsoleCP
GetConsoleMode
GetCPInfo
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
UnregisterWaitEx

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExA
RegSetValueExA
ConvertSidToStringSidW

shell32

ShellExecuteA
SHCreateDirectoryExW
SHGetFolderPathW
SHGetFolderPathA

dbghelp

MiniDumpWriteDump

wininet

InternetGetConnectedState

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

ws2_32

ioctlsocket
accept
connect
getpeername
getsockname
freeaddrinfo
getaddrinfo
shutdown
htons
inet_addr
listen
recv
closesocket
bind
sendto
select
recvfrom
getsockopt
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
send
setsockopt
socket
gethostbyname

rpcrt4

UuidCreateSequential

xinput1_3

ord2

dinput8

DirectInput8Create

user32

PeekMessageW
DispatchMessageW
TranslateMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
CallMsgFilterW
GetQueueStatus
PostMessageW
WaitMessage
MsgWaitForMultipleObjectsEx
SetTimer
DefWindowProcW
MessageBoxA
DestroyWindow
PostQuitMessage
UpdateWindow
GetClientRect
GetCursorInfo
MessageBoxW
wsprintfW
SetWindowLongW
CallWindowProcW
ShowCursor
SetCursor
LoadCursorW
SendMessageW
GetAsyncKeyState
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
SetCursorPos
GetCursorPos
ClientToScreen
ScreenToClient
PtInRect
GetParent
KillTimer
SetWindowPos

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crackfix-V2/socialclub.dll
.dll windows:6 windows x64 arch:x64

b6e71df8037a744c7606e6350d48a7f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shell32

SHGetFolderPathA

kernel32

RtlUnwind
CreateDirectoryA
GetFileAttributesA
GetModuleFileNameA
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
SetEndOfFile

Exports

Exports

getInterface

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EMPRESS.nfo

Sharing

General

Malware Config

Signatures

Files

ff1a92c6477507e0049d9441235946c9

Code Sign

33:00:00:02:5c:93:5a:76:bd:10:e5:99:96:00:00:00:00:02:5cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

54:a2:45:c1:7e:41:dd:a9:87:50:df:e6:90:da:75:3c:2c:8b:a0:86:7e:0c:62:82:1d:31:2a:4d:69:a0:78:bbSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 3KB

_RDATA Size: 512B - Virtual size: 148B

.emp0 Size: 512B - Virtual size: 248B

.data2 Size: 92KB - Virtual size: 92KB

.EMP Size: 204KB - Virtual size: 204KB

.data3 Size: 608KB - Virtual size: 608KB

.emp1 Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 512B - Virtual size: 156B

.rsrc Size: 512B - Virtual size: 233B

e87d728eb2608eb6567741c80b0539c3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 4KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 2KB - Virtual size: 1KB

051783ce19703ced1bb9759180d65ac4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

iphlpapi

dsound

winmm

mf

mfplat

mfreadwrite

propsys

ws2_32

crypt32

wintrust

imm32

dinput8

xinput9_1_0

oo2core_5_win64

amd_ags_x64

d3d9

bcrypt

rpcrt4

version

bink2w64

gdi32

advapi32

shell32

ole32

oleaut32

Sections

33:00:00:02:5c:93:5a:76:bd:10:e5:99:96:00:00:00:00:02:5c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

54:a2:45:c1:7e:41:dd:a9:87:50:df:e6:90:da:75:3c:2c:8b:a0:86:7e:0c:62:82:1d:31:2a:4d:69:a0:78:bb
Signer

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 148B

.emp0
Size: 512B - Virtual size: 248B

.data2
Size: 92KB - Virtual size: 92KB

.EMP
Size: 204KB - Virtual size: 204KB

.data3
Size: 608KB - Virtual size: 608KB

.emp1
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 512B - Virtual size: 156B

.rsrc
Size: 512B - Virtual size: 233B

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 50.5MB - Virtual size: 50.5MB

.rdata
Size: 6.1MB - Virtual size: 6.1MB

.data
Size: 27.0MB - Virtual size: 35.4MB

.pdata
Size: 2.1MB - Virtual size: 2.1MB

_RDATA
Size: 40KB - Virtual size: 40KB

.rsrc
Size: 390KB - Virtual size: 392KB

.reloc
Size: 872KB - Virtual size: 872KB

.idata
Size: 15KB - Virtual size: 16KB

.text
Size: 21.8MB - Virtual size: 21.8MB

.text
Size: 254KB - Virtual size: 254KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 43KB - Virtual size: 149KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 8KB - Virtual size: 8KB

.text
Size: 148KB - Virtual size: 147KB

.rdata
Size: 49KB - Virtual size: 49KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 8KB - Virtual size: 8KB

.detourc
Size: 26KB - Virtual size: 26KB

.detourd
Size: 512B - Virtual size: 72B

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 5KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

56:33:5c:0d:f0:9e:d8:18:da:11:c2:ba:b0:54:ac:ae:c0:f2:5b:95
Signer