Extracted

• krampus downgrader v4.rar

  .rar
• krampus downgrader v4/Byfron Cryptonite.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 3.1MB - Virtual size: 3.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• krampus downgrader v4/ByfronDowngrade.lua
• krampus downgrader v4/LIVE-WindowsPlayer-version-7d64f40489634ca5.dll

  .dll windows:4 windows x64 arch:x64

  9434905d51e7bf5f119cc9e5ee85d0da

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  IMAGE_FILE_DLL

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetLastError

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  MultiByteToWideChar

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  msvcrt

  ___lc_codepage_func

  ___mb_cur_max_func

  __iob_func

  _amsg_exit

  _close

  _errno

  _initterm

  _lock

  _lseek

  _open

  _read

  _unlock

  _wopen

  _write

  abort

  calloc

  fputc

  free

  fwrite

  localeconv

  malloc

  memchr

  memcpy

  memset

  realloc

  strerror

  strlen

  strncmp

  vfprintf

  wcslen

  wcstombs

  Exports

  Exports

  _dist_code

  _length_code

  _tr_align

  _tr_flush_bits

  _tr_flush_block

  _tr_init

  _tr_stored_block

  _tr_tally

  adler32

  adler32_combine

  adler32_combine64

  adler32_z

  compress

  compress2

  compressBound

  crc32

  crc32_combine

  crc32_combine64

  crc32_z

  deflate

  deflateBound

  deflateCopy

  deflateEnd

  deflateGetDictionary

  deflateInit2_

  deflateInit_

  deflateParams

  deflatePending

  deflatePrime

  deflateReset

  deflateResetKeep

  deflateSetDictionary

  deflateSetHeader

  deflateTune

  deflate_copyright

  get_crc_table

  gz_error

  gzbuffer

  gzclearerr

  gzclose

  gzclose_r

  gzclose_w

  gzdirect

  gzdopen

  gzeof

  gzerror

  gzflush

  gzfread

  gzfwrite

  gzgetc

  gzgetc_

  gzgets

  gzoffset

  gzoffset64

  gzopen

  gzopen64

  gzopen_w

  gzprintf

  gzputc

  gzputs

  gzread

  gzrewind

  gzseek

  gzseek64

  gzsetparams

  gztell

  gztell64

  gzungetc

  gzvprintf

  gzwrite

  inflate

  inflateBack

  inflateBackEnd

  inflateBackInit_

  inflateCodesUsed

  inflateCopy

  inflateEnd

  inflateGetDictionary

  inflateGetHeader

  inflateInit2_

  inflateInit_

  inflateMark

  inflatePrime

  inflateReset

  inflateReset2

  inflateResetKeep

  inflateSetDictionary

  inflateSync

  inflateSyncPoint

  inflateUndermine

  inflateValidate

  inflate_copyright

  inflate_fast

  inflate_table

  uncompress

  uncompress2

  zError

  z_errmsg

  zcalloc

  zcfree

  zlibCompileFlags

  zlibVersion

  Sections

  .text

  Size: 77KB - Virtual size: 77KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 160B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 21KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 176B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• krampus downgrader v4/WebView2Loader.dll

  .dll windows:10 windows x64 arch:x64

  
  

  Code Sign

  33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:11

  Not After

  26/07/2019, 20:11

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31/08/2010, 22:19

  Not After

  31/08/2020, 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:07

  Not After

  08/08/2019, 20:07

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06/07/2010, 20:40

  Not After

  06/07/2025, 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  3a:0e:44:23:c0:fa:ef:3c:a2:b9:75:e9:78:49:ba:5a:76:a5:a1:f0:55:ca:52:1a:c2:9d:09:8f:b9:66:36:9d

  Signer

  Actual PE Digest

  3a:0e:44:23:c0:fa:ef:3c:a2:b9:75:e9:78:49:ba:5a:76:a5:a1:f0:55:ca:52:1a:c2:9d:09:8f:b9:66:36:9d

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  33:29:11:ca:36:3c:eb:96:9c:d1:1e:07:b1:15:13:e0:5d:32:92:a8

  Signer

  Actual PE Digest

  33:29:11:ca:36:3c:eb:96:9c:d1:1e:07:b1:15:13:e0:5d:32:92:a8

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-crt-math-l1-1-0.pdb

  Exports

  Exports

  _Cbuild

  _Cmulcc

  _Cmulcr

  _FCbuild

  _FCmulcc

  _FCmulcr

  _LCbuild

  _LCmulcc

  _LCmulcr

  __setusermatherr

  _cabs

  _chgsign

  _chgsignf

  _copysign

  _copysignf

  _d_int

  _dclass

  _dexp

  _dlog

  _dnorm

  _dpcomp

  _dpoly

  _dscale

  _dsign

  _dsin

  _dtest

  _dunscale

  _except1

  _fd_int

  _fdclass

  _fdexp

  _fdlog

  _fdnorm

  _fdopen

  _fdpcomp

  _fdpoly

  _fdscale

  _fdsign

  _fdsin

  _fdtest

  _fdunscale

  _finite

  _finitef

  _fpclass

  _fpclassf

  _get_FMA3_enable

  _hypot

  _hypotf

  _isnan

  _isnanf

  _j0

  _j1

  _jn

  _ld_int

  _ldclass

  _ldexp

  _ldlog

  _ldpcomp

  _ldpoly

  _ldscale

  _ldsign

  _ldsin

  _ldtest

  _ldunscale

  _logb

  _logbf

  _nextafter

  _nextafterf

  _scalb

  _scalbf

  _set_FMA3_enable

  _y0

  _y1

  _yn

  acos

  acosf

  acosh

  acoshf

  acoshl

  asin

  asinf

  asinh

  asinhf

  asinhl

  atan

  atan2

  atan2f

  atanf

  atanh

  atanhf

  atanhl

  cabs

  cabsf

  cabsl

  cacos

  cacosf

  cacosh

  cacoshf

  cacoshl

  cacosl

  carg

  cargf

  cargl

  casin

  casinf

  casinh

  casinhf

  casinhl

  casinl

  catan

  catanf

  catanh

  catanhf

  catanhl

  catanl

  cbrt

  cbrtf

  cbrtl

  ccos

  ccosf

  ccosh

  ccoshf

  ccoshl

  ccosl

  ceil

  ceilf

  cexp

  cexpf

  cexpl

  cimag

  cimagf

  cimagl

  clog

  clog10

  clog10f

  clog10l

  clogf

  clogl

  conj

  conjf

  conjl

  copysign

  copysignf

  copysignl

  cos

  cosf

  cosh

  coshf

  cpow

  cpowf

  cpowl

  cproj

  cprojf

  cprojl

  creal

  crealf

  creall

  csin

  csinf

  csinh

  csinhf

  csinhl

  csinl

  csqrt

  csqrtf

  csqrtl

  ctan

  ctanf

  ctanh

  ctanhf

  ctanhl

  ctanl

  erf

  erfc

  erfcf

  erfcl

  erff

  erfl

  exp

  exp2

  exp2f

  exp2l

  expf

  expm1

  expm1f

  expm1l

  fabs

  fdim

  fdimf

  fdiml

  floor

  floorf

  fma

  fmaf

  fmal

  fmax

  fmaxf

  fmaxl

  fmin

  fminf

  fminl

  fmod

  fmodf

  frexp

  hypot

  ilogb

  ilogbf

  ilogbl

  ldexp

  lgamma

  lgammaf

  lgammal

  llrint

  llrintf

  llrintl

  llround

  llroundf

  llroundl

  log

  log10

  log10f

  log1p

  log1pf

  log1pl

  log2

  log2f

  log2l

  logb

  logbf

  logbl

  logf

  lrint

  lrintf

  lrintl

  lround

  lroundf

  lroundl

  modf

  modff

  nan

  nanf

  nanl

  nearbyint

  nearbyintf

  nearbyintl

  nextafter

  nextafterf

  nextafterl

  nexttoward

  nexttowardf

  nexttowardl

  norm

  normf

  norml

  pow

  powf

  remainder

  remainderf

  remainderl

  remquo

  remquof

  remquol

  rint

  rintf

  rintl

  round

  roundf

  roundl

  scalbln

  scalblnf

  scalblnl

  scalbn

  scalbnf

  scalbnl

  sin

  sinf

  sinh

  sinhf

  sqrt

  sqrtf

  tan

  tanf

  tanh

  tanhf

  tgamma

  tgammaf

  tgammal

  trunc

  truncf

  truncl

  Sections

  .rdata

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• krampus downgrader v4/api-ms-win-crt-heap-l1-1-0.dll

  .dll windows:10 windows x64 arch:x64

  
  

  Code Sign

  33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:11

  Not After

  26/07/2019, 20:11

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31/08/2010, 22:19

  Not After

  31/08/2020, 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:07

  Not After

  08/08/2019, 20:07

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06/07/2010, 20:40

  Not After

  06/07/2025, 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  6e:d6:5e:72:3e:36:d8:eb:18:5a:15:7c:b7:d1:d7:a2:94:3a:0a:f8:1d:12:ef:82:99:65:78:35:67:28:54:40

  Signer

  Actual PE Digest

  6e:d6:5e:72:3e:36:d8:eb:18:5a:15:7c:b7:d1:d7:a2:94:3a:0a:f8:1d:12:ef:82:99:65:78:35:67:28:54:40

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  14:b3:5f:6d:73:dc:fc:c0:a9:10:3a:cd:c2:7b:b5:5b:25:79:6e:80

  Signer

  Actual PE Digest

  14:b3:5f:6d:73:dc:fc:c0:a9:10:3a:cd:c2:7b:b5:5b:25:79:6e:80

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-crt-heap-l1-1-0.pdb

  Exports

  Exports

  _aligned_free

  _aligned_malloc

  _aligned_msize

  _aligned_offset_malloc

  _aligned_offset_realloc

  _aligned_offset_recalloc

  _aligned_realloc

  _aligned_recalloc

  _callnewh

  _calloc_base

  _expand

  _free_base

  _get_heap_handle

  _heapchk

  _heapmin

  _heapwalk

  _malloc_base

  _msize

  _query_new_handler

  _query_new_mode

  _realloc_base

  _recalloc

  _set_new_mode

  calloc

  free

  malloc

  realloc

  Sections

  .rdata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• krampus downgrader v4/api-ms-win-crt-locale-l1-1-0.dll

  .dll windows:10 windows x64 arch:x64

  
  

  Code Sign

  33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:11

  Not After

  26/07/2019, 20:11

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31/08/2010, 22:19

  Not After

  31/08/2020, 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:07

  Not After

  08/08/2019, 20:07

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06/07/2010, 20:40

  Not After

  06/07/2025, 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  5a:45:92:9b:72:0d:e4:40:22:56:a2:e1:f6:2a:62:af:87:6b:ea:09:d2:31:d1:f8:19:7d:a0:d3:5a:75:b8:04

  Signer

  Actual PE Digest

  5a:45:92:9b:72:0d:e4:40:22:56:a2:e1:f6:2a:62:af:87:6b:ea:09:d2:31:d1:f8:19:7d:a0:d3:5a:75:b8:04

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  82:4d:d6:e4:c3:34:d8:4e:2e:38:55:84:0c:2d:a8:9f:20:c3:1b:a7

  Signer

  Actual PE Digest

  82:4d:d6:e4:c3:34:d8:4e:2e:38:55:84:0c:2d:a8:9f:20:c3:1b:a7

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-crt-locale-l1-1-0.pdb

  Exports

  Exports

  ___lc_codepage_func

  ___lc_collate_cp_func

  ___lc_locale_name_func

  ___mb_cur_max_func

  ___mb_cur_max_l_func

  __initialize_lconv_for_unsigned_char

  __pctype_func

  __pwctype_func

  _configthreadlocale

  _create_locale

  _free_locale

  _get_current_locale

  _getmbcp

  _lock_locales

  _setmbcp

  _unlock_locales

  _wcreate_locale

  _wsetlocale

  localeconv

  setlocale

  Sections

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• krampus downgrader v4/content.dll

  .dll windows:10 windows x64 arch:x64

  
  

  Code Sign

  33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:11

  Not After

  26/07/2019, 20:11

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31/08/2010, 22:19

  Not After

  31/08/2020, 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:07

  Not After

  08/08/2019, 20:07

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06/07/2010, 20:40

  Not After

  06/07/2025, 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  72:6a:7f:87:f7:64:2e:22:83:6d:be:56:03:8b:2a:94:76:c0:10:e1:c0:23:02:7c:e8:b4:f4:01:cb:96:50:ef

  Signer

  Actual PE Digest

  72:6a:7f:87:f7:64:2e:22:83:6d:be:56:03:8b:2a:94:76:c0:10:e1:c0:23:02:7c:e8:b4:f4:01:cb:96:50:ef

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  45:89:0a:e3:19:4f:e2:5b:f6:04:c2:87:7d:09:48:4d:98:22:f9:08

  Signer

  Actual PE Digest

  45:89:0a:e3:19:4f:e2:5b:f6:04:c2:87:7d:09:48:4d:98:22:f9:08

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-crt-string-l1-1-0.pdb

  Exports

  Exports

  __isascii

  __iscsym

  __iscsymf

  __iswcsym

  __iswcsymf

  __strncnt

  __wcsncnt

  _isalnum_l

  _isalpha_l

  _isblank_l

  _iscntrl_l

  _isctype

  _isctype_l

  _isdigit_l

  _isgraph_l

  _isleadbyte_l

  _islower_l

  _isprint_l

  _ispunct_l

  _isspace_l

  _isupper_l

  _iswalnum_l

  _iswalpha_l

  _iswblank_l

  _iswcntrl_l

  _iswcsym_l

  _iswcsymf_l

  _iswctype_l

  _iswdigit_l

  _iswgraph_l

  _iswlower_l

  _iswprint_l

  _iswpunct_l

  _iswspace_l

  _iswupper_l

  _iswxdigit_l

  _isxdigit_l

  _memccpy

  _memicmp

  _memicmp_l

  _strcoll_l

  _strdup

  _stricmp

  _stricmp_l

  _stricoll

  _stricoll_l

  _strlwr

  _strlwr_l

  _strlwr_s

  _strlwr_s_l

  _strncoll

  _strncoll_l

  _strnicmp

  _strnicmp_l

  _strnicoll

  _strnicoll_l

  _strnset

  _strnset_s

  _strrev

  _strset

  _strset_s

  _strupr

  _strupr_l

  _strupr_s

  _strupr_s_l

  _strxfrm_l

  _tolower

  _tolower_l

  _toupper

  _toupper_l

  _towlower_l

  _towupper_l

  _wcscoll_l

  _wcsdup

  _wcsicmp

  _wcsicmp_l

  _wcsicoll

  _wcsicoll_l

  _wcslwr

  _wcslwr_l

  _wcslwr_s

  _wcslwr_s_l

  _wcsncoll

  _wcsncoll_l

  _wcsnicmp

  _wcsnicmp_l

  _wcsnicoll

  _wcsnicoll_l

  _wcsnset

  _wcsnset_s

  _wcsrev

  _wcsset

  _wcsset_s

  _wcsupr

  _wcsupr_l

  _wcsupr_s

  _wcsupr_s_l

  _wcsxfrm_l

  _wctype

  is_wctype

  isalnum

  isalpha

  isblank

  iscntrl

  isdigit

  isgraph

  isleadbyte

  islower

  isprint

  ispunct

  isspace

  isupper

  iswalnum

  iswalpha

  iswascii

  iswblank

  iswcntrl

  iswctype

  iswdigit

  iswgraph

  iswlower

  iswprint

  iswpunct

  iswspace

  iswupper

  iswxdigit

  isxdigit

  mblen

  mbrlen

  memcpy_s

  memmove_s

  memset

  strcat

  strcat_s

  strcmp

  strcoll

  strcpy

  strcpy_s

  strcspn

  strlen

  strncat

  strncat_s

  strncmp

  strncpy

  strncpy_s

  strnlen

  strpbrk

  strspn

  strtok

  strtok_s

  strxfrm

  tolower

  toupper

  towctrans

  towlower

  towupper

  wcscat

  wcscat_s

  wcscmp

  wcscoll

  wcscpy

  wcscpy_s

  wcscspn

  wcslen

  wcsncat

  wcsncat_s

  wcsncmp

  wcsncpy

  wcsncpy_s

  wcsnlen

  wcspbrk

  wcsspn

  wcstok

  wcstok_s

  wcsxfrm

  wctype

  wmemcpy_s

  wmemmove_s

  Sections

  .rdata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• krampus downgrader v4/shader.dll

  .dll windows:10 windows x64 arch:x64

  
  

  Code Sign

  33:00:00:04:20:34:d8:b8:30:51:ca:cf:76:00:00:00:00:04:20

  Certificate

  Issuer

  CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  20/02/2019, 22:39

  Not After

  31/07/2020, 22:39

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Development Root Certificate Authority 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  28/05/2014, 17:33

  Not After

  28/05/2029, 17:43

  Subject

  CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  b4:48:69:45:ca:d1:19:82:dc:cf:8b:46:36:62:28:31:ce:0c:51:61:09:97:a2:e8:41:b2:7e:ad:da:e9:39:b2

  Signer

  Actual PE Digest

  b4:48:69:45:ca:d1:19:82:dc:cf:8b:46:36:62:28:31:ce:0c:51:61:09:97:a2:e8:41:b2:7e:ad:da:e9:39:b2

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-crt-runtime-l1-1-0.pdb

  Exports

  Exports

  _Exit

  __doserrno

  __fpe_flt_rounds

  __fpecode

  __p___argc

  __p___argv

  __p___wargv

  __p__acmdln

  __p__pgmptr

  __p__wcmdln

  __p__wpgmptr

  __pxcptinfoptrs

  __sys_errlist

  __sys_nerr

  __threadhandle

  __threadid

  __wcserror

  __wcserror_s

  _assert

  _beginthread

  _beginthreadex

  _c_exit

  _cexit

  _clearfp

  _configure_narrow_argv

  _configure_wide_argv

  _control87

  _controlfp

  _controlfp_s

  _crt_at_quick_exit

  _crt_atexit

  _endthread

  _endthreadex

  _errno

  _execute_onexit_table

  _exit

  _fpieee_flt

  _fpreset

  _get_doserrno

  _get_errno

  _get_initial_narrow_environment

  _get_initial_wide_environment

  _get_invalid_parameter_handler

  _get_narrow_winmain_command_line

  _get_pgmptr

  _get_terminate

  _get_thread_local_invalid_parameter_handler

  _get_wide_winmain_command_line

  _get_wpgmptr

  _getdllprocaddr

  _getpid

  _initialize_narrow_environment

  _initialize_onexit_table

  _initialize_wide_environment

  _initterm

  _initterm_e

  _invalid_parameter_noinfo

  _invalid_parameter_noinfo_noreturn

  _invoke_watson

  _query_app_type

  _register_onexit_function

  _register_thread_local_exe_atexit_callback

  _resetstkoflw

  _seh_filter_dll

  _seh_filter_exe

  _set_abort_behavior

  _set_app_type

  _set_controlfp

  _set_doserrno

  _set_errno

  _set_error_mode

  _set_invalid_parameter_handler

  _set_new_handler

  _set_thread_local_invalid_parameter_handler

  _seterrormode

  _sleep

  _statusfp

  _strerror

  _strerror_s

  _wassert

  _wcserror

  _wcserror_s

  _wperror

  _wsystem

  abort

  exit

  feclearexcept

  fegetenv

  fegetexceptflag

  fegetround

  feholdexcept

  fesetenv

  fesetexceptflag

  fesetround

  fetestexcept

  perror

  quick_exit

  raise

  set_terminate

  signal

  strerror

  strerror_s

  system

  terminate

  Sections

  .rdata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• krampus downgrader v4/texture.dll

  .dll windows:10 windows x64 arch:x64

  
  

  Code Sign

  33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:11

  Not After

  26/07/2019, 20:11

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31/08/2010, 22:19

  Not After

  31/08/2020, 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12/07/2018, 20:07

  Not After

  08/08/2019, 20:07

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06/07/2010, 20:40

  Not After

  06/07/2025, 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  da:34:6d:89:13:fd:ec:58:53:71:21:ab:91:c1:2a:fc:56:4c:a2:fe:f2:1a:67:de:84:30:3b:47:31:38:5b:1c

  Signer

  Actual PE Digest

  da:34:6d:89:13:fd:ec:58:53:71:21:ab:91:c1:2a:fc:56:4c:a2:fe:f2:1a:67:de:84:30:3b:47:31:38:5b:1c

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  ba:e9:ed:3c:48:cf:9b:9e:72:b3:43:07:6a:35:f1:53:91:af:5f:0c

  Signer

  Actual PE Digest

  ba:e9:ed:3c:48:cf:9b:9e:72:b3:43:07:6a:35:f1:53:91:af:5f:0c

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-crt-stdio-l1-1-0.pdb

  Exports

  Exports

  __acrt_iob_func

  __p__commode

  __p__fmode

  __stdio_common_vfprintf

  __stdio_common_vfprintf_p

  __stdio_common_vfprintf_s

  __stdio_common_vfscanf

  __stdio_common_vfwprintf

  __stdio_common_vfwprintf_p

  __stdio_common_vfwprintf_s

  __stdio_common_vfwscanf

  __stdio_common_vsnprintf_s

  __stdio_common_vsnwprintf_s

  __stdio_common_vsprintf

  __stdio_common_vsprintf_p

  __stdio_common_vsprintf_s

  __stdio_common_vsscanf

  __stdio_common_vswprintf

  __stdio_common_vswprintf_p

  __stdio_common_vswprintf_s

  __stdio_common_vswscanf

  _chsize

  _chsize_s

  _close

  _commit

  _creat

  _dup

  _dup2

  _eof

  _fclose_nolock

  _fcloseall

  _fflush_nolock

  _fgetc_nolock

  _fgetchar

  _fgetwc_nolock

  _fgetwchar

  _filelength

  _filelengthi64

  _fileno

  _flushall

  _fputc_nolock

  _fputchar

  _fputwc_nolock

  _fputwchar

  _fread_nolock

  _fread_nolock_s

  _fseek_nolock

  _fseeki64

  _fseeki64_nolock

  _fsopen

  _ftell_nolock

  _ftelli64

  _ftelli64_nolock

  _fwrite_nolock

  _get_fmode

  _get_osfhandle

  _get_printf_count_output

  _get_stream_buffer_pointers

  _getc_nolock

  _getcwd

  _getdcwd

  _getmaxstdio

  _getw

  _getwc_nolock

  _getws

  _getws_s

  _isatty

  _kbhit

  _locking

  _lseek

  _lseeki64

  _mktemp

  _mktemp_s

  _open

  _open_osfhandle

  _pclose

  _pipe

  _popen

  _putc_nolock

  _putw

  _putwc_nolock

  _putws

  _read

  _rmtmp

  _set_fmode

  _set_printf_count_output

  _setmaxstdio

  _setmode

  _sopen

  _sopen_dispatch

  _sopen_s

  _tell

  _telli64

  _tempnam

  _ungetc_nolock

  _ungetwc_nolock

  _wcreat

  _wfdopen

  _wfopen

  _wfopen_s

  _wfreopen

  _wfreopen_s

  _wfsopen

  _wmktemp

  _wmktemp_s

  _wopen

  _wpopen

  _write

  _wsopen

  _wsopen_dispatch

  _wsopen_s

  _wtempnam

  _wtmpnam

  _wtmpnam_s

  clearerr

  clearerr_s

  fclose

  feof

  ferror

  fflush

  fgetc

  fgetpos

  fgets

  fgetwc

  fgetws

  fopen

  fopen_s

  fputc

  fputs

  fputwc

  fputws

  fread

  fread_s

  freopen

  freopen_s

  fseek

  fsetpos

  ftell

  fwrite

  getc

  getchar

  gets

  gets_s

  getwc

  getwchar

  putc

  putchar

  puts

  putwc

  putwchar

  rewind

  setbuf

  setvbuf

  tmpfile

  tmpfile_s

  tmpnam

  tmpnam_s

  ungetc

  ungetwc

  Sections

  .rdata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ